@cat-factory/kernel 0.243.1 → 0.244.0

package/dist/ports/mcp-oauth-repositories.d.ts

@@ -0,0 +1,58 @@
+/** One workspace's sealed OAuth grant for one tool server. */
+export interface McpOAuthGrantRecord {
+    workspaceId: string;
+    /** The tool server id the grant authorises (`McpServerDefinition.id`). */
+    serverId: string;
+    /**
+     * Sealed JSON of the token set: the access token, the refresh token when one was issued, the
+     * absolute expiry and the granted scope. Opaque to everything but `McpOAuthService`, which
+     * decrypts it to answer a dispatch and re-seals it after a refresh.
+     */
+    tokens: string;
+    /**
+     * Non-secret display summary as JSON (`McpOAuthGrantSummary`), so the operator surface can say
+     * what a board is connected to, when, by whom, and whether the last token exchange failed —
+     * without decrypting anything.
+     */
+    summary: string;
+    /**
+     * Optimistic-concurrency revision, bumped on every write. Two dispatches can reach an expired
+     * access token at the same instant and both try to refresh it; the rev is what makes one of them
+     * the writer and lets the other adopt the winner's tokens instead of overwriting them with a
+     * token set minted from a refresh token the server has already rotated away.
+     */
+    rev: number;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface McpOAuthGrantRepository {
+    get(workspaceId: string, serverId: string): Promise<McpOAuthGrantRecord | null>;
+    /**
+     * Every grant a workspace holds.
+     *
+     * The read the operator surface uses, and the reason it exists rather than a `get` per row: the
+     * tool-server inventory renders one row per DECLARED server and each needs its connection state,
+     * so a per-server read there is an N+1 over a list whose length is the deployment's whole
+     * registry.
+     */
+    listByWorkspace(workspaceId: string): Promise<McpOAuthGrantRecord[]>;
+    /**
+     * Blind write, for the two paths whose semantics ARE last-writer-wins: completing an
+     * authorization (a human just granted, and what they granted supersedes whatever was stored) and
+     * the first mint of a client-credentials token. Inserts with the record's `rev`; on conflict the
+     * STORED rev is bumped in SQL, so it stays monotonic and a concurrent `compareAndSwap` whose
+     * base predates this write reliably loses.
+     */
+    upsert(record: McpOAuthGrantRecord): Promise<void>;
+    /**
+     * Rev-guarded conditional write, for the REFRESH path: persists `record` only if the stored row
+     * still carries `expectedRev`. `expectedRev: null` means "expect NO row" (a conflict-do-nothing
+     * insert). False ⇒ another writer refreshed first, and the caller re-reads and uses THEIR tokens
+     * rather than re-applying its own — a rotated refresh token makes the loser's token set the
+     * stale one, so "reload and re-apply" would replace a working grant with a dead one.
+     */
+    compareAndSwap(record: McpOAuthGrantRecord, expectedRev: number | null): Promise<boolean>;
+    /** Disconnect: drop the grant. The next dispatch reports the server as `oauth_not_connected`. */
+    delete(workspaceId: string, serverId: string): Promise<void>;
+}
+//# sourceMappingURL=mcp-oauth-repositories.d.ts.map

package/dist/ports/mcp-oauth-repositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-repositories.d.ts","sourceRoot":"","sources":["../../src/ports/mcp-oauth-repositories.ts"],"names":[],"mappings":"AAiBA,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IAC/E;;;;;;;OAOG;IACH,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAA;IACpE;;;;;;OAMG;IACH,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClD;;;;;;OAMG;IACH,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACzF,iGAAiG;IACjG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7D"}

package/dist/ports/mcp-oauth-repositories.js

@@ -0,0 +1,18 @@
+// Persistence port for the PER-WORKSPACE OAuth grants a remote (`http`) tool server needs — the
+// tokens a board holds against a vendor's MCP server, and the machine tokens a client-credentials
+// declaration mints on demand.
+//
+// Mirrors across the D1 (Cloudflare) and Drizzle/Postgres (Node) facades; runtime parity is
+// mandatory. Values are sealed at rest by the facade's `SecretCipher` (info tag
+// `cat-factory:mcp-oauth`), so the record carries the sealed blob and never a token — which is
+// what lets it ride the mothership's persistence RPC, exactly like `CapabilityCredentialRepository`.
+//
+// ONE ROW PER (workspace, server), unlike the capability-credential store's one-blob-per-workspace.
+// The shapes differ because the WRITES do: a credential row is edited by a human filling in a
+// checklist, while a grant row is rewritten by a REFRESH on the dispatch path, and two dispatches
+// refreshing two different servers at the same moment are the ordinary case rather than the
+// pathological one. Per-server rows make those two writes touch different rows instead of
+// contending on one; the rev then only has to settle a race between two refreshes of the SAME
+// grant, which is what it is for.
+export {};
+//# sourceMappingURL=mcp-oauth-repositories.js.map

package/dist/ports/mcp-oauth-repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-repositories.js","sourceRoot":"","sources":["../../src/ports/mcp-oauth-repositories.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,kGAAkG;AAClG,+BAA+B;AAC/B,EAAE;AACF,4FAA4F;AAC5F,gFAAgF;AAChF,+FAA+F;AAC/F,qGAAqG;AACrG,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,kGAAkG;AAClG,4FAA4F;AAC5F,0FAA0F;AAC1F,8FAA8F;AAC9F,kCAAkC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/kernel",
-  "version": "0.243.1",
+  "version": "0.244.0",
   "description": "Shared vocabulary, pure logic, and port interfaces for the Agent Architecture Board.",
   "repository": {
     "type": "git",
@@ -26,7 +26,7 @@
   "dependencies": {
     "ai": "^7.0.51",
     "yaml": "^2.9.0",
-    "@cat-factory/contracts": "0.245.0"
+    "@cat-factory/contracts": "0.246.0"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^4.1.10",