@cat-factory/server 0.222.2 → 0.224.0

package/dist/modules/toolServers/ToolServerController.js

@@ -1,11 +1,15 @@
-import { listToolServersContract, probeToolServerContract } from '@cat-factory/contracts';
+import { disconnectToolServerOAuthContract, listToolServersContract, probeToolServerContract, startToolServerOAuthContract, } from '@cat-factory/contracts';
+import { NotFoundError, ValidationError } from '@cat-factory/kernel';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
+import { createMcpOAuthTokenSource } from '../../agents/mcpOAuthTokenSource.js';
+import { requireCapability } from '../../http/guards.js';
 import { requireWorkspacePermissionIncludingReads } from '../../http/workspaceAccess.js';
 import { param } from '../../http/params.js';
 import { requestLogger } from '../../http/requestLogging.js';
-import { collectDeclaredToolServers } from './declaredToolServers.js';
+import { collectDeclaredToolServers, resolveDeclaredToolServers } from './declaredToolServers.js';
 import { probeToolServer } from './probeToolServer.js';
+import { requireMcpOAuthRedirectUrl } from './mcpOAuthRedirect.js';
 /**
  * TOOL SERVER (MCP) OPERABILITY: what this deployment declared, and whether one of them answers.
  *
@@ -33,9 +37,21 @@ export function toolServerController() {
     const gate = requireWorkspacePermissionIncludingReads('secrets.manage');
     app.use('/tool-servers', gate);
     app.use('/tool-servers/*', gate);
-    buildHonoRoute(app, listToolServersContract, (c) => {
+    buildHonoRoute(app, listToolServersContract, async (c) => {
         const container = c.get('container');
-        return c.json({ servers: collectDeclaredToolServers({ agentKindRegistry: container.agentKindRegistry }) }, 200);
+        // ONE read of the workspace's grants for the whole inventory, indexed by server id — the
+        // declarations are the deployment's entire registry, so a per-row lookup here would be an N+1
+        // over it. Absent store ⇒ an empty map, and each OAuth declaration renders as not connected,
+        // which is the true state of a deployment that cannot keep a grant.
+        const grants = container.mcpOAuth
+            ? await container.mcpOAuth.listStatuses(param(c, 'workspaceId'))
+            : new Map();
+        return c.json({
+            servers: collectDeclaredToolServers({
+                agentKindRegistry: container.agentKindRegistry,
+                oauthGrants: grants,
+            }),
+        }, 200);
     });
     buildHonoRoute(app, probeToolServerContract, async (c) => {
         const container = c.get('container');
@@ -49,9 +65,69 @@ export function toolServerController() {
             ...(container.toolSecretResolver
                 ? { resolveToolSecrets: container.toolSecretResolver }
                 : {}),
+            // The same token source a dispatch mints with, so an OAuth server's verdict is about this
+            // board's grant rather than about an unauthenticated request nobody makes.
+            ...(container.mcpOAuth
+                ? {
+                    resolveToolServerOAuth: createMcpOAuthTokenSource({
+                        oauth: container.mcpOAuth,
+                        ...(container.toolSecretResolver
+                            ? { resolveToolSecrets: container.toolSecretResolver }
+                            : {}),
+                        logger: requestLogger(c),
+                    }),
+                }
+                : {}),
             logger: requestLogger(c),
         }), 200);
     });
+    // Begin an interactive grant. Everything that can refuse does so BEFORE a browser leaves the
+    // app: an id nothing declares (404), a server that does not authenticate with OAuth or does so
+    // with the machine grant (422), a deployment with no grant store or no registered redirect URL
+    // (503). A refusal after the redirect would land on a vendor's error page instead.
+    buildHonoRoute(app, startToolServerOAuthContract, async (c) => {
+        const container = c.get('container');
+        const oauthService = requireCapability(container.mcpOAuth, 'Tool-server OAuth is not configured: this deployment has no encryption key, so it has ' +
+            'nowhere to keep a grant.');
+        const definition = requireOAuthServer(container.agentKindRegistry, c.req.valid('param').id);
+        return c.json(await oauthService.startAuthorization({
+            workspaceId: param(c, 'workspaceId'),
+            serverId: definition.id,
+            serverUrl: definition.url,
+            oauth: definition.oauth,
+            userId: c.get('user')?.id ?? null,
+            redirectUri: requireMcpOAuthRedirectUrl(container),
+        }), 200);
+    });
+    buildHonoRoute(app, disconnectToolServerOAuthContract, async (c) => {
+        const container = c.get('container');
+        const oauthService = requireCapability(container.mcpOAuth, 'Tool-server OAuth is not configured: this deployment has no encryption key, so it has ' +
+            'nowhere to keep a grant.');
+        // The id is NOT re-checked against a live declaration. A grant outlives the declaration that
+        // created it (a deployment retires a server, or renames it in a refactor), and the row is then
+        // a live vendor token nobody can reach — so the one action that removes it must not be gated
+        // on the registry still naming it.
+        await oauthService.disconnect(param(c, 'workspaceId'), c.req.valid('param').id);
+        return c.body(null, 204);
+    });
     return app;
 }
+/**
+ * The declared server behind an id, narrowed to one that can actually be granted.
+ *
+ * Both refusals are the operator's to act on and neither is the same as the other: an id nothing
+ * declares means the deployment changed under the panel they are looking at (404), while a server
+ * that declares no OAuth — or declares it on a transport with no request to authorise — means the
+ * button was rendered for a row it does not apply to (422, with a `reason` the SPA translates).
+ */
+function requireOAuthServer(registry, serverId) {
+    const declared = resolveDeclaredToolServers(registry).get(serverId);
+    if (!declared)
+        throw new NotFoundError('Tool server', serverId);
+    const { oauth, transport, id } = declared.definition;
+    if (!oauth || transport.kind !== 'http') {
+        throw new ValidationError(`Tool server '${serverId}' does not authenticate with OAuth, so there is nothing to grant.`, { reason: 'tool_server_without_oauth' });
+    }
+    return { id, url: transport.url, oauth };
+}
 //# sourceMappingURL=ToolServerController.js.map

package/dist/modules/toolServers/ToolServerController.js.map

@@ -1 +1 @@
-{"version":3,"file":"ToolServerController.js","sourceRoot":"","sources":["../../../src/modules/toolServers/ToolServerController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAA;AACxF,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,+FAA+F;IAC/F,iGAAiG;IACjG,iGAAiG;IACjG,2EAA2E;IAC3E,MAAM,IAAI,GAAG,wCAAwC,CAAC,gBAAgB,CAAC,CAAA;IACvE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA;IAEhC,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;QACjD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,OAAO,EAAE,0BAA0B,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAC3F,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,OAAO,CAAC,CAAC,IAAI,CACX,MAAM,eAAe,CAAC;YACpB,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;YAC9C,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC;YACpC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE;YACjC,6FAA6F;YAC7F,0FAA0F;YAC1F,sCAAsC;YACtC,GAAG,CAAC,SAAS,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;SACzB,CAAC,EACF,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"ToolServerController.js","sourceRoot":"","sources":["../../../src/modules/toolServers/ToolServerController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAA;AAE/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAA;AACxF,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAA;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AAElE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAC9B,+FAA+F;IAC/F,iGAAiG;IACjG,iGAAiG;IACjG,2EAA2E;IAC3E,MAAM,IAAI,GAAG,wCAAwC,CAAC,gBAAgB,CAAC,CAAA;IACvE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IAC9B,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA;IAEhC,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,yFAAyF;QACzF,8FAA8F;QAC9F,6FAA6F;QAC7F,oEAAoE;QACpE,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ;YAC/B,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;YAChE,CAAC,CAAC,IAAI,GAAG,EAAE,CAAA;QACb,OAAO,CAAC,CAAC,IAAI,CACX;YACE,OAAO,EAAE,0BAA0B,CAAC;gBAClC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;gBAC9C,WAAW,EAAE,MAAM;aACpB,CAAC;SACH,EACD,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,OAAO,CAAC,CAAC,IAAI,CACX,MAAM,eAAe,CAAC;YACpB,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;YAC9C,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC;YACpC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE;YACjC,6FAA6F;YAC7F,0FAA0F;YAC1F,sCAAsC;YACtC,GAAG,CAAC,SAAS,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;YACP,0FAA0F;YAC1F,2EAA2E;YAC3E,GAAG,CAAC,SAAS,CAAC,QAAQ;gBACpB,CAAC,CAAC;oBACE,sBAAsB,EAAE,yBAAyB,CAAC;wBAChD,KAAK,EAAE,SAAS,CAAC,QAAQ;wBACzB,GAAG,CAAC,SAAS,CAAC,kBAAkB;4BAC9B,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE;4BACtD,CAAC,CAAC,EAAE,CAAC;wBACP,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;qBACzB,CAAC;iBACH;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;SACzB,CAAC,EACF,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,mFAAmF;IACnF,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,YAAY,GAAG,iBAAiB,CACpC,SAAS,CAAC,QAAQ,EAClB,wFAAwF;YACtF,0BAA0B,CAC7B,CAAA;QACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;QAC3F,OAAO,CAAC,CAAC,IAAI,CACX,MAAM,YAAY,CAAC,kBAAkB,CAAC;YACpC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC;YACpC,QAAQ,EAAE,UAAU,CAAC,EAAE;YACvB,SAAS,EAAE,UAAU,CAAC,GAAG;YACzB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI;YACjC,WAAW,EAAE,0BAA0B,CAAC,SAAS,CAAC;SACnD,CAAC,EACF,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,iCAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjE,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,YAAY,GAAG,iBAAiB,CACpC,SAAS,CAAC,QAAQ,EAClB,wFAAwF;YACtF,0BAA0B,CAC7B,CAAA;QACD,6FAA6F;QAC7F,+FAA+F;QAC/F,6FAA6F;QAC7F,mCAAmC;QACnC,MAAM,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;QAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CACzB,QAA2B,EAC3B,QAAgB;IAEhB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACnE,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;IAC/D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAA;IACpD,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxC,MAAM,IAAI,eAAe,CACvB,gBAAgB,QAAQ,mEAAmE,EAC3F,EAAE,MAAM,EAAE,2BAA2B,EAAE,CACxC,CAAA;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,CAAA;AAC1C,CAAC"}

package/dist/modules/toolServers/declaredToolServers.d.ts

@@ -1,8 +1,22 @@
 import type { AgentKind, McpServerDefinition } from '@cat-factory/kernel';
 import type { AgentKindRegistry } from '@cat-factory/agents';
-import type { ToolServerNotProbeableReason, ToolServerView } from '@cat-factory/contracts';
+import type { ToolServerNotProbeableReason, ToolServerOAuthStatus, ToolServerView } from '@cat-factory/contracts';
+/**
+ * The non-secret half of a stored grant, as `McpOAuthService.listStatuses` returns it: everything
+ * `ToolServerOAuthStatus` holds except the two fields the DECLARATION decides (`grant`) and this
+ * projection derives (`connected`).
+ */
+export type StoredOAuthGrants = ReadonlyMap<string, Omit<ToolServerOAuthStatus, 'grant' | 'connected'>>;
 export interface CollectDeclaredToolServersInput {
     agentKindRegistry: AgentKindRegistry;
+    /**
+     * This workspace's grants, keyed by server id — read ONCE for the whole inventory rather than
+     * per row, because the rows are the deployment's entire registry.
+     *
+     * Omitted ⇒ no grant store is wired, and every OAuth declaration renders as not connected, which
+     * is the true state of a deployment that has nowhere to keep a grant.
+     */
+    oauthGrants?: StoredOAuthGrants;
 }
 /** One declared server: the definition this surface answers for, and the kinds that reach it. */
 export interface DeclaredToolServer {

package/dist/modules/toolServers/declaredToolServers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"declaredToolServers.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/declaredToolServers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAOzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EAAE,4BAA4B,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAa1F,MAAM,WAAW,+BAA+B;IAC9C,iBAAiB,EAAE,iBAAiB,CAAA;CACrC;AAED,iGAAiG;AACjG,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,mBAAmB,CAAA;IAC/B,UAAU,EAAE,SAAS,EAAE,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,iBAAiB,GAC1B,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAejC;AAED,2EAA2E;AAC3E,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,+BAA+B,GACrC,cAAc,EAAE,CAIlB;AA2CD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,mBAAmB,GAC9B,4BAA4B,GAAG,SAAS,CAS1C"}
+{"version":3,"file":"declaredToolServers.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/declaredToolServers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAOzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EACV,4BAA4B,EAC5B,qBAAqB,EACrB,cAAc,EACf,MAAM,wBAAwB,CAAA;AAa/B;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,WAAW,CACzC,MAAM,EACN,IAAI,CAAC,qBAAqB,EAAE,OAAO,GAAG,WAAW,CAAC,CACnD,CAAA;AAED,MAAM,WAAW,+BAA+B;IAC9C,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;CAChC;AAED,iGAAiG;AACjG,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,mBAAmB,CAAA;IAC/B,UAAU,EAAE,SAAS,EAAE,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,iBAAiB,GAC1B,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAejC;AAED,2EAA2E;AAC3E,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,+BAA+B,GACrC,cAAc,EAAE,CAMlB;AAsED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,mBAAmB,GAC9B,4BAA4B,GAAG,SAAS,CAS1C"}

package/dist/modules/toolServers/declaredToolServers.js

@@ -43,11 +43,11 @@ export function resolveDeclaredToolServers(registry) {
 /** Every declared tool server, projected non-secretly and sorted by id. */
 export function collectDeclaredToolServers(input) {
     return [...resolveDeclaredToolServers(input.agentKindRegistry).values()]
-        .map((declared) => toView(declared.definition, declared.declaredBy))
+        .map((declared) => toView(declared.definition, declared.declaredBy, input.oauthGrants ?? new Map()))
         .sort((a, b) => a.id.localeCompare(b.id));
 }
 /** Project one definition into its non-secret operator-facing view. */
-function toView(definition, declaredBy) {
+function toView(definition, declaredBy, grants) {
     const notProbeable = notProbeableReason(definition);
     return {
         id: definition.id,
@@ -65,10 +65,30 @@ function toView(definition, declaredBy) {
             required: secret.required !== false,
             ...(secret.usage ? { usage: secret.usage } : {}),
         })),
+        ...oauthStatus(definition, grants),
         probeable: notProbeable === undefined,
         ...(notProbeable ? { notProbeableReason: notProbeable } : {}),
     };
 }
+/**
+ * The OAuth half of a row: the declaration's grant type, joined to whether THIS workspace holds a
+ * grant for it.
+ *
+ * Absent for a server that declares no OAuth, which is what keeps the Connect affordance off every
+ * row it does not apply to. `connected` is derived from the presence of a stored grant rather than
+ * stored as a flag, so a disconnect that removed the row cannot leave a row claiming otherwise.
+ */
+function oauthStatus(definition, grants) {
+    const oauth = definition.oauth;
+    if (!oauth)
+        return {};
+    const stored = grants.get(definition.id);
+    // The stored half is spread FIRST so the two derived fields cannot be overwritten by it. The
+    // summary is a JSON blob parsed back out of a row, so its shape is a claim rather than a
+    // guarantee, and a drifted one must not be able to say a server is `connected` when no row was
+    // read or to rename the grant the DECLARATION states.
+    return { oauth: { ...stored, grant: oauth.grant, connected: Boolean(stored) } };
+}
 /**
  * What the declaration points at, for recognition on the surface.
  *

package/dist/modules/toolServers/declaredToolServers.js.map

@@ -1 +1 @@
-{"version":3,"file":"declaredToolServers.js","sourceRoot":"","sources":["../../../src/modules/toolServers/declaredToolServers.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,GACd,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAsBxE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAA;IAEtD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,CAAC;QACpD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACxC,IAAI,QAAQ;gBAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;gBACvC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC1E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CACxC,KAAsC;IAEtC,OAAO,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC;SACrE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;SACnE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC7C,CAAC;AAED,uEAAuE;AACvE,SAAS,MAAM,CAAC,UAA+B,EAAE,UAAuB;IACtE,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACnD,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,EAAE;QACxC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI;QACpC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC;QAClC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;QAClC,iBAAiB,EAAE,oBAAoB,CAAC,UAAU,CAAC;QACnD,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC1D,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,yFAAyF;YACzF,2EAA2E;YAC3E,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,KAAK;YACnC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,SAAS,EAAE,YAAY,KAAK,SAAS;QACrC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,UAA+B;IACrD,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,mBAAmB,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC9F,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAA;IAC5C,OAAO,aAAa,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA+B;IAE/B,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAA;IACnE,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAA;IACpC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,iBAAiB,CAAA;IACvD,iGAAiG;IACjG,kGAAkG;IAClG,qEAAqE;IACrE,IAAI,oBAAoB,CAAC,GAAG,CAAC;QAAE,OAAO,qBAAqB,CAAA;IAC3D,OAAO,SAAS,CAAA;AAClB,CAAC"}
+{"version":3,"file":"declaredToolServers.js","sourceRoot":"","sources":["../../../src/modules/toolServers/declaredToolServers.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,GACd,MAAM,qBAAqB,CAAA;AAO5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAwCxE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAA;IAEtD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,CAAC;QACpD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACxC,IAAI,QAAQ;gBAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;gBACvC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC1E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CACxC,KAAsC;IAEtC,OAAO,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC;SACrE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAChB,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,GAAG,EAAE,CAAC,CACjF;SACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC7C,CAAC;AAED,uEAAuE;AACvE,SAAS,MAAM,CACb,UAA+B,EAC/B,UAAuB,EACvB,MAAyB;IAEzB,MAAM,YAAY,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACnD,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,EAAE;QACxC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI;QACpC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC;QAClC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;QAClC,iBAAiB,EAAE,oBAAoB,CAAC,UAAU,CAAC;QACnD,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC1D,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,yFAAyF;YACzF,2EAA2E;YAC3E,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,KAAK;YACnC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,GAAG,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC;QAClC,SAAS,EAAE,YAAY,KAAK,SAAS;QACrC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,UAA+B,EAC/B,MAAyB;IAEzB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IACxC,6FAA6F;IAC7F,yFAAyF;IACzF,+FAA+F;IAC/F,sDAAsD;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAA;AACjF,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,UAA+B;IACrD,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,mBAAmB,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC9F,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAA;IAC5C,OAAO,aAAa,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA+B;IAE/B,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAA;IACnE,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAA;IACpC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,iBAAiB,CAAA;IACvD,iGAAiG;IACjG,kGAAkG;IAClG,qEAAqE;IACrE,IAAI,oBAAoB,CAAC,GAAG,CAAC;QAAE,OAAO,qBAAqB,CAAA;IAC3D,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/modules/toolServers/mcpOAuthRedirect.d.ts

@@ -0,0 +1,27 @@
+import type { ServerContainer } from '../../http/env.js';
+/**
+ * The path in the SPA that a vendor's authorization server redirects an operator's browser to.
+ *
+ * A page in the APP rather than a route on this backend, and that is a security decision rather
+ * than a routing preference. A redirect target is reached by a third-party browser navigation,
+ * which carries no bearer token, so a backend route receiving it could never tell who was
+ * completing the grant; the page re-presents the vendor's `code` and `state` over the authenticated
+ * API instead (`completeToolServerOAuthContract`), where the session, the user binding and the
+ * `secrets.manage` re-check all apply. Exported for the docs and tests that must state the exact
+ * string an operator registers at the vendor.
+ */
+export declare const MCP_OAUTH_CALLBACK_PATH = "/mcp-oauth-callback";
+/**
+ * The configured redirect URL, or the refusal that names what to configure.
+ *
+ * Deliberately not derived from the incoming request. The value has to match, to the byte, what
+ * the deployment registered as its OAuth client's redirect URI, and a `Host`-derived string is a
+ * different value behind every proxy, preview URL and private hostname a deployment sits behind —
+ * so deriving it turns a one-time configuration step into an exchange that fails at the vendor
+ * with `redirect_uri_mismatch`, which names nothing on this side.
+ *
+ * A 503 with its own `reason` rather than a generic unavailability, because the deployment IS
+ * otherwise wired: the store exists, the declaration is sound, and one variable is missing.
+ */
+export declare function requireMcpOAuthRedirectUrl(container: ServerContainer): string;
+//# sourceMappingURL=mcpOAuthRedirect.d.ts.map

package/dist/modules/toolServers/mcpOAuthRedirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpOAuthRedirect.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/mcpOAuthRedirect.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,wBAAwB,CAAA;AAE5D;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAW7E"}

package/dist/modules/toolServers/mcpOAuthRedirect.js

@@ -0,0 +1,35 @@
+import { UnavailableError } from '@cat-factory/kernel';
+/**
+ * The path in the SPA that a vendor's authorization server redirects an operator's browser to.
+ *
+ * A page in the APP rather than a route on this backend, and that is a security decision rather
+ * than a routing preference. A redirect target is reached by a third-party browser navigation,
+ * which carries no bearer token, so a backend route receiving it could never tell who was
+ * completing the grant; the page re-presents the vendor's `code` and `state` over the authenticated
+ * API instead (`completeToolServerOAuthContract`), where the session, the user binding and the
+ * `secrets.manage` re-check all apply. Exported for the docs and tests that must state the exact
+ * string an operator registers at the vendor.
+ */
+export const MCP_OAUTH_CALLBACK_PATH = '/mcp-oauth-callback';
+/**
+ * The configured redirect URL, or the refusal that names what to configure.
+ *
+ * Deliberately not derived from the incoming request. The value has to match, to the byte, what
+ * the deployment registered as its OAuth client's redirect URI, and a `Host`-derived string is a
+ * different value behind every proxy, preview URL and private hostname a deployment sits behind —
+ * so deriving it turns a one-time configuration step into an exchange that fails at the vendor
+ * with `redirect_uri_mismatch`, which names nothing on this side.
+ *
+ * A 503 with its own `reason` rather than a generic unavailability, because the deployment IS
+ * otherwise wired: the store exists, the declaration is sound, and one variable is missing.
+ */
+export function requireMcpOAuthRedirectUrl(container) {
+    const url = container.mcpOAuthRedirectUrl?.trim();
+    if (!url) {
+        throw new UnavailableError('Tool-server OAuth needs a redirect URL. Set MCP_OAUTH_REDIRECT_URL to this deployment’s ' +
+            `public app URL followed by ${MCP_OAUTH_CALLBACK_PATH}, and register the same value as ` +
+            'the OAuth client’s redirect URI at the vendor.', 'mcp_oauth_redirect_url_not_configured');
+    }
+    return url;
+}
+//# sourceMappingURL=mcpOAuthRedirect.js.map

package/dist/modules/toolServers/mcpOAuthRedirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpOAuthRedirect.js","sourceRoot":"","sources":["../../../src/modules/toolServers/mcpOAuthRedirect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAGtD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAA;AAE5D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAA0B;IACnE,MAAM,GAAG,GAAG,SAAS,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAA;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,gBAAgB,CACxB,0FAA0F;YACxF,8BAA8B,uBAAuB,mCAAmC;YACxF,gDAAgD,EAClD,uCAAuC,CACxC,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/toolServers/probeToolServer.d.ts

@@ -1,4 +1,4 @@
-import type { Logger, ToolSecretResolver } from '@cat-factory/kernel';
+import type { Logger, McpOAuthTokenSource, ToolSecretResolver } from '@cat-factory/kernel';
 import type { ToolServerProbeResult } from '@cat-factory/contracts';
 import type { AgentKindRegistry } from '@cat-factory/agents';
 import { type McpProbeDeps } from './mcpProbe.js';
@@ -14,6 +14,13 @@ export interface ProbeToolServerInput {
      * path already applies to the same state.
      */
     resolveToolSecrets?: ToolSecretResolver;
+    /**
+     * The facade's OAuth token source — the SAME one a dispatch mints an `Authorization` header
+     * with. Absent ⇒ the deployment has no grant store, and a server declaring OAuth is reported as
+     * `oauth_not_connected` rather than probed unauthenticated, which would report a working server
+     * as a 401 and send the operator to the wrong fix.
+     */
+    resolveToolServerOAuth?: McpOAuthTokenSource;
     logger?: Logger;
     /** Injected for tests; forwarded to the protocol client. */
     probe?: McpProbeDeps;

package/dist/modules/toolServers/probeToolServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"probeToolServer.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/probeToolServer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EAGN,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAEnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAE5D,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,eAAe,CAAA;AAuBrE,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4DAA4D;IAC5D,KAAK,CAAC,EAAE,YAAY,CAAA;CACrB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8CjG"}
+{"version":3,"file":"probeToolServer.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/probeToolServer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,mBAAmB,EAGnB,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAEnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAG5D,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,eAAe,CAAA;AAuBrE,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,mBAAmB,CAAA;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4DAA4D;IAC5D,KAAK,CAAC,EAAE,YAAY,CAAA;CACrB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAqDjG"}

package/dist/modules/toolServers/probeToolServer.js

@@ -1,6 +1,7 @@
 import { NotFoundError, isValidMcpToolName, noopLogger, runBestEffort } from '@cat-factory/kernel';
 import { isReservedPlatformEnvKey, reservedEnvKeyMessage } from '@cat-factory/contracts';
 import { MCP_PROBE_TOOL_NAME_CAP } from '@cat-factory/contracts';
+import { mergeHeaders } from '../../agents/toolServers.js';
 import { notProbeableReason, resolveDeclaredToolServers } from './declaredToolServers.js';
 import { probeMcpHttpServer } from './mcpProbe.js';
 /**
@@ -25,13 +26,21 @@ export async function probeToolServer(input) {
     const credentials = await resolveCredentials(input, definition);
     if (!credentials.ok)
         return { serverId, ...credentials.failure };
+    const granted = await resolveOAuthHeader(input, definition, definition.transport.url);
+    if (!granted.ok)
+        return { serverId, ...granted.failure };
     const outcome = await probeMcpHttpServer({
         url: definition.transport.url,
         // The declaration's own headers and the RESOLVED CREDENTIAL stay apart, because the protocol
         // client treats them differently at a redirect: a hop off the declared origin is refused while
         // a credential is riding, and a non-secret `x-tenant` is no reason to refuse anything.
         headers: { ...definition.transport.headers },
-        credentialHeaders: credentials.headers,
+        // The granted token joins the CREDENTIAL side, not the declaration's own headers: it is the
+        // secret a cross-origin redirect must not carry, which is the whole reason the probe keeps
+        // the two apart. Last, so it wins a header a static credential also names — the same
+        // precedence the dispatch applies (through the same case-insensitive merge, so the probe
+        // cannot report on a header pair the dispatch would collapse), and boot warns about it.
+        credentialHeaders: mergeHeaders(credentials.headers, granted.headers),
     }, input.probe);
     if (outcome.status !== 'ok') {
         input.logger?.warn('tool server probe failed', {
@@ -96,6 +105,47 @@ function checkAllowedTools(definition, tools, toolsComplete) {
         },
     };
 }
+/**
+ * Mint the access token an OAuth-declaring server needs, as the header its declaration named.
+ *
+ * The two failure statuses are the probe's whole value here. `oauth_not_connected` says nobody has
+ * granted this board access, which is a Connect button rather than anything about the endpoint;
+ * `oauth_token_failed` says a grant IS on file and produced nothing, which is a revocation, an
+ * expiry, or an authorization server having a bad day. Probing anyway and reporting the 401 would
+ * collapse both into "your credential is wrong", the one diagnosis that is false in both cases.
+ */
+async function resolveOAuthHeader(input, definition, serverUrl) {
+    const oauth = definition.oauth;
+    if (!oauth)
+        return { ok: true, headers: {} };
+    const source = input.resolveToolServerOAuth;
+    if (!source) {
+        return {
+            ok: false,
+            failure: {
+                status: 'oauth_not_connected',
+                error: 'This deployment has no encryption key, so it has nowhere to keep an OAuth grant and ' +
+                    'no run can authenticate against this server either.',
+            },
+        };
+    }
+    const result = await source.accessToken({
+        workspaceId: input.workspaceId,
+        serverId: definition.id,
+        serverUrl,
+        oauth,
+    });
+    if (result.status === 'ok')
+        return { ok: true, headers: { [result.header]: result.value } };
+    if (result.status === 'not_connected')
+        return { ok: false, failure: { status: 'oauth_not_connected' } };
+    input.logger?.warn('tool server probe could not obtain an oauth token', {
+        toolServerId: definition.id,
+        workspaceId: input.workspaceId,
+        detail: result.error,
+    });
+    return { ok: false, failure: { status: 'oauth_token_failed', error: result.error } };
+}
 /**
  * Resolve the declared credentials into request headers, or report why the probe cannot proceed.
  *

package/dist/modules/toolServers/probeToolServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"probeToolServer.js","sourceRoot":"","sources":["../../../src/modules/toolServers/probeToolServer.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAClG,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAExF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAEhE,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAA;AACzF,OAAO,EAAqB,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAwCrE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B;IAC/D,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAA;IAC9B,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAC9C,IAAI,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAA;IACtF,kGAAkG;IAClG,qEAAqE;IACrE,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAA;IACrF,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/D,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAA;IAEhE,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC;QACE,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG;QAC7B,6FAA6F;QAC7F,+FAA+F;QAC/F,uFAAuF;QACvF,OAAO,EAAE,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE;QAC5C,iBAAiB,EAAE,WAAW,CAAC,OAAO;KACvC,EACD,KAAK,CAAC,KAAK,CACZ,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE;YAC7C,YAAY,EAAE,QAAQ;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,EAAE,OAAO,CAAC,KAAK;SACtB,CAAC,CAAA;QACF,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAA;IACjC,CAAC;IACD,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;QAC/B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC;QACtD,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC;KACvE,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAA2B;IACjD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACxF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IACrE,OAAO,QAAQ,CAAC,UAAU,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,iBAAiB,CACxB,UAA+B,EAC/B,KAAe,EACf,aAAsB;IAEtB,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3F,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAC9B,OAAO;QACL,YAAY,EAAE;YACZ,QAAQ;YACR,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC7E,OAAO,EAAE,aAAa;SACvB;KACF,CAAA;AACH,CAAC;AAYD;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAA2B,EAC3B,UAA+B;IAE/B,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAA;IAC5C,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IAEtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAClF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAA;IAC/E,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,wEAAwE,EAAE;YAC3F,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,aAAa,EAAE,MAAM,CAAC,GAAG;YACzB,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1C,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,MAAM,EAAE,oBAAoB;gBAC5B,kBAAkB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;aACjE;SACF,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACpE,MAAM,QAAQ,GAAG,KAAK,CAAC,kBAAkB,CAAA;IACzC,MAAM,QAAQ,GACZ,QAAQ,IAAI,IAAI,CAAC,MAAM;QACrB,CAAC,CAAC,CAAC,CAAC,MAAM,aAAa,CACnB,KAAK,CAAC,MAAM,IAAI,UAAU,EAC1B,6CAA6C,EAC7C,GAAG,EAAE,CACH,QAAQ,CAAC,OAAO,CAAC;YACf,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE;YACnD,IAAI;SACL,CAAC,EACJ,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAChC,CAAC,IAAI,EAAE,CAAC;QACX,CAAC,CAAC,EAAE,CAAA;IAER,gGAAgG;IAChG,kGAAkG;IAClG,mBAAmB;IACnB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3F,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,MAAM,EAAE,qBAAqB;gBAC7B,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;aAC3D;SACF,CAAA;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAA;AACjE,CAAC;AAED,sGAAsG;AACtG,SAAS,iBAAiB,CACxB,IAAoB,EACpB,QAAgC;IAEhC,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,SAAQ;QACtC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,cAAc;YAC5C,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC;YACpD,CAAC,CAAC,KAAK,CAAA;IACX,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"probeToolServer.js","sourceRoot":"","sources":["../../../src/modules/toolServers/probeToolServer.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAClG,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAExF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAA;AACzF,OAAO,EAAqB,kBAAkB,EAAE,MAAM,eAAe,CAAA;AA+CrE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B;IAC/D,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAA;IAC9B,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAC9C,IAAI,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAA;IACtF,kGAAkG;IAClG,qEAAqE;IACrE,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAA;IACrF,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/D,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAA;IAChE,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IACrF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;IAExD,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC;QACE,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG;QAC7B,6FAA6F;QAC7F,+FAA+F;QAC/F,uFAAuF;QACvF,OAAO,EAAE,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE;QAC5C,4FAA4F;QAC5F,2FAA2F;QAC3F,qFAAqF;QACrF,yFAAyF;QACzF,wFAAwF;QACxF,iBAAiB,EAAE,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;KACtE,EACD,KAAK,CAAC,KAAK,CACZ,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE;YAC7C,YAAY,EAAE,QAAQ;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,EAAE,OAAO,CAAC,KAAK;SACtB,CAAC,CAAA;QACF,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAA;IACjC,CAAC;IACD,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;QAC/B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC;QACtD,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC;KACvE,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAA2B;IACjD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACxF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IACrE,OAAO,QAAQ,CAAC,UAAU,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,iBAAiB,CACxB,UAA+B,EAC/B,KAAe,EACf,aAAsB;IAEtB,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3F,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAC9B,OAAO;QACL,YAAY,EAAE;YACZ,QAAQ;YACR,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC7E,OAAO,EAAE,aAAa;SACvB;KACF,CAAA;AACH,CAAC;AAOD;;;;;;;;GAQG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAA2B,EAC3B,UAA+B,EAC/B,SAAiB;IAEjB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,CAAA;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,MAAM,EAAE,qBAAqB;gBAC7B,KAAK,EACH,sFAAsF;oBACtF,qDAAqD;aACxD;SACF,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,UAAU,CAAC,EAAE;QACvB,SAAS;QACT,KAAK;KACN,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAA;IAC3F,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAA;IAClE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,mDAAmD,EAAE;QACtE,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,MAAM,CAAC,KAAK;KACrB,CAAC,CAAA;IACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAA;AACtF,CAAC;AAYD;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAA2B,EAC3B,UAA+B;IAE/B,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAA;IAC5C,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IAEtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAClF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAA;IAC/E,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,wEAAwE,EAAE;YAC3F,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,aAAa,EAAE,MAAM,CAAC,GAAG;YACzB,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1C,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,MAAM,EAAE,oBAAoB;gBAC5B,kBAAkB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;aACjE;SACF,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACpE,MAAM,QAAQ,GAAG,KAAK,CAAC,kBAAkB,CAAA;IACzC,MAAM,QAAQ,GACZ,QAAQ,IAAI,IAAI,CAAC,MAAM;QACrB,CAAC,CAAC,CAAC,CAAC,MAAM,aAAa,CACnB,KAAK,CAAC,MAAM,IAAI,UAAU,EAC1B,6CAA6C,EAC7C,GAAG,EAAE,CACH,QAAQ,CAAC,OAAO,CAAC;YACf,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE;YACnD,IAAI;SACL,CAAC,EACJ,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAChC,CAAC,IAAI,EAAE,CAAC;QACX,CAAC,CAAC,EAAE,CAAA;IAER,gGAAgG;IAChG,kGAAkG;IAClG,mBAAmB;IACnB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3F,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,MAAM,EAAE,qBAAqB;gBAC7B,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;aAC3D;SACF,CAAA;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAA;AACjE,CAAC;AAED,sGAAsG;AACtG,SAAS,iBAAiB,CACxB,IAAoB,EACpB,QAAgC;IAEhC,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,SAAQ;QACtC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,cAAc;YAC5C,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC;YACpD,CAAC,CAAC,KAAK,CAAA;IACX,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/modules/workspaces/WorkspaceMemberController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WorkspaceMemberController.d.ts","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceMemberController.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAyB/C,wBAAgB,yBAAyB,IAAI,IAAI,CAAC,MAAM,CAAC,CAiDxD"}
+{"version":3,"file":"WorkspaceMemberController.d.ts","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceMemberController.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAyB/C,wBAAgB,yBAAyB,IAAI,IAAI,CAAC,MAAM,CAAC,CAuDxD"}

package/dist/modules/workspaces/WorkspaceMemberController.js

@@ -37,20 +37,20 @@ export function workspaceMemberController() {
         const service = requireMemberService(c);
         requirePermission(c, 'members.manage');
         const { workspaceId, userId } = c.req.valid('param');
-        const member = await service.setRole(workspaceId, userId, c.req.valid('json').role);
+        const member = await service.setRole(workspaceId, userId, c.req.valid('json').role, c.get('user')?.id ?? null);
         return c.json(member, 200);
     });
     buildHonoRoute(app, removeWorkspaceMemberContract, async (c) => {
         const service = requireMemberService(c);
         requirePermission(c, 'members.manage');
         const { workspaceId, userId } = c.req.valid('param');
-        await service.remove(workspaceId, userId);
+        await service.remove(workspaceId, userId, c.get('user')?.id ?? null);
         return c.body(null, 204);
     });
     buildHonoRoute(app, setWorkspaceAccessModeContract, async (c) => {
         const service = requireMemberService(c);
         requirePermission(c, 'members.manage');
-        const workspace = await service.setAccessMode(param(c, 'workspaceId'), c.req.valid('json').accessMode);
+        const workspace = await service.setAccessMode(param(c, 'workspaceId'), c.req.valid('json').accessMode, c.get('user')?.id ?? null);
         return c.json(workspace, 200);
     });
     return app;

package/dist/modules/workspaces/WorkspaceMemberController.js.map

@@ -1 +1 @@
-{"version":3,"file":"WorkspaceMemberController.js","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceMemberController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,8EAA8E;AAC9E,uFAAuF;AACvF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,iFAAiF;AACjF,+DAA+D;AAC/D,EAAE;AACF,0FAA0F;AAC1F,qFAAqF;AACrF,8EAA8E;AAE9E,8FAA8F;AAC9F,SAAS,oBAAoB,CAAmB,CAAa;IAC3D,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,EACzC,wCAAwC,CACzC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,wFAAwF;IACxF,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,IAAI,EACT,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,CAC1B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAA;QACnF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACpD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAC3C,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,CAC/B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"WorkspaceMemberController.js","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceMemberController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,8EAA8E;AAC9E,uFAAuF;AACvF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,iFAAiF;AACjF,+DAA+D;AAC/D,EAAE;AACF,0FAA0F;AAC1F,qFAAqF;AACrF,8EAA8E;AAE9E,8FAA8F;AAC9F,SAAS,oBAAoB,CAAmB,CAAa;IAC3D,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,EACzC,wCAAwC,CACzC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,wFAAwF;IACxF,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,IAAI,EACT,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,CAC1B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAClC,WAAW,EACX,MAAM,EACN,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EACxB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,CAC1B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACpD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,CAAA;QACpE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAC3C,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,EAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,CAC1B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/persistence/rpc-allowlist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-allowlist.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAgBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,0BAA0B,EAAE,sBAooCxC,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,oCAAoC,YAC/C,yBAAyB,EACzB,gCAAgC,EAChC,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,kCAAkC,CAC1B,CAAA;AAEV,yEAAyE;AACzE,MAAM,MAAM,+BAA+B,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAA"}
+{"version":3,"file":"rpc-allowlist.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAgBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,0BAA0B,EAAE,sBAopCxC,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,oCAAoC,YAC/C,yBAAyB,EACzB,gCAAgC,EAChC,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,kCAAkC,CAC1B,CAAA;AAEV,yEAAyE;AACzE,MAAM,MAAM,+BAA+B,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAA"}

package/dist/persistence/rpc-allowlist.js

@@ -853,6 +853,22 @@ export const REMOTE_PERSISTENCE_METHODS = {
         deleteIfRev: { scope: { kind: 'workspace', arg: 0 } },
         delete: { scope: { kind: 'workspace', arg: 0 } },
     },
+    // The PER-WORKSPACE OAUTH GRANTS a board holds against remote MCP tool servers. Sealed exactly
+    // like the credentials above (opened in the service under the LOCAL key), so no token crosses
+    // the machine API, and `remote` for the identical reason: the grant is org state a RUN resolves,
+    // and a mothership-mode node has no `db` to keep it in — a connection an operator made on the
+    // mothership has to reach the dispatch that needs the token. The connect/disconnect CRUD and the
+    // dispatch's refresh are the SAME methods; everything is workspace-scoped on arg0 except the
+    // record-based `upsert`/`compareAndSwap`, which bind on the record's `workspaceId` FIELD. The
+    // rev-guarded `compareAndSwap` is what makes a refresh safe across two nodes rather than two
+    // requests, which is precisely the case a mothership deployment makes ordinary.
+    mcpOAuthGrantRepository: {
+        get: { scope: { kind: 'workspace', arg: 0 } },
+        listByWorkspace: { scope: { kind: 'workspace', arg: 0 } },
+        upsert: { scope: { kind: 'workspaceField', arg: 0 } },
+        compareAndSwap: { scope: { kind: 'workspaceField', arg: 0 } },
+        delete: { scope: { kind: 'workspace', arg: 0 } },
+    },
     // The per-service PRE-PR VALIDATION CHECKS, keyed by service-frame block like
     // `releaseHealthConfigRepository` above. Nothing sealed — the commands are operator-authored
     // shell strings that run inside the run's own container — so the plain record crosses the