@elaraai/e3-api-server 0.0.2-beta.5 → 0.0.2-beta.50

package/dist/src/auth/device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.js","sourceRoot":"","sources":["../../../src/auth/device.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2BpC,mCAAmC;AACnC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;AAEpD,+CAA+C;AAC/C,yDAAyD;AACzD,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACzB,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,eAAe;AAC1B,eAAe,CAAC,KAAK,EAAE,CAAC;AAExB;;GAEG;AACH,SAAS,kBAAkB;IACzB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,kCAAkC,CAAC,CAAC,0BAA0B;IAC5E,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC;YAAE,IAAI,IAAI,GAAG,CAAC;QACzB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAwB;IACzD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,wDAAwD;IACxD,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7C,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,YAAY;QAEnC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE;YAC3B,QAAQ;YACR,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,0BAA0B;YACxD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI;SACzC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,GAAG,MAAM,CAAC,OAAO,SAAS;YAC5C,yBAAyB,EAAE,GAAG,MAAM,CAAC,OAAO,qBAAqB,QAAQ,EAAE;YAC3E,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,CAAC,EAAE,qCAAqC;SACnD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,mCAAmC;IACnC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW;YAC1C,CAAC,CAAC,qEAAqE;YACvE,CAAC,CAAC,EAAE,CAAC;QAEP,OAAO,CAAC,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;sBAgBI,QAAQ,IAAI,WAAW;;mDAEM,QAAQ;;;IAGvD,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,EAAE;IAC5E,iBAAiB;;QAEb,CAAC,CAAC;IACR,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAC7C,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QAEjD,4CAA4C;QAC5C,KAAK,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC9D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,OAAO,CAAC,CAAC,IAAI,CAAC;;;;;;;;;;;;;QAad,CAAC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;;;;;;;;;;;;;QAaV,EAAE,GAAG,CAAC,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QAEnD,oBAAoB;QACpB,IAAI,SAAS,KAAK,8CAA8C,EAAE,CAAC;YACjE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAE1C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC;YAED,0BAA0B;YAC1B,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAEhC,kBAAkB;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,MAAM,aAAa,GAAe;gBAChC,GAAG,EAAE,UAAU;gBACf,GAAG,EAAE,MAAM,CAAC,OAAO;gBACnB,GAAG,EAAE,MAAM,CAAC,OAAO;gBACnB,GAAG,EAAE,GAAG;gBACR,GAAG,EAAE,GAAG;gBACR,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,iBAAiB;gBACnC,UAAU,EAAE,QAAQ;aACrB,CAAC;YACF,MAAM,cAAc,GAAe;gBACjC,GAAG,EAAE,UAAU;gBACf,GAAG,EAAE,MAAM,CAAC,OAAO;gBACnB,GAAG,EAAE,MAAM,CAAC,OAAO;gBACnB,GAAG,EAAE,GAAG;gBACR,GAAG,EAAE,GAAG;gBACR,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,kBAAkB;gBACpC,UAAU,EAAE,SAAS;aACtB,CAAC;YAEF,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,YAAY,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC;gBACjD,aAAa,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC;gBACnD,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,MAAM,CAAC,iBAAiB;aACrC,CAAC,CAAC;QACL,CAAC;QAED,sBAAsB;QACtB,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;YAEzD,IAAI,CAAC;gBACH,4DAA4D;gBAC5D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;gBAChD,MAAM,OAAO,GAAG,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAErD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;oBACrC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC3F,CAAC;gBAED,4BAA4B;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC1C,MAAM,aAAa,GAAe;oBAChC,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,GAAG,EAAE,MAAM,CAAC,OAAO;oBACnB,GAAG,EAAE,MAAM,CAAC,OAAO;oBACnB,GAAG,EAAE,GAAG;oBACR,GAAG,EAAE,GAAG;oBACR,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,iBAAiB;oBACnC,UAAU,EAAE,QAAQ;iBACrB,CAAC;gBAEF,4CAA4C;gBAC5C,MAAM,iBAAiB,GAAe;oBACpC,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,GAAG,EAAE,MAAM,CAAC,OAAO;oBACnB,GAAG,EAAE,MAAM,CAAC,OAAO;oBACnB,GAAG,EAAE,GAAG;oBACR,GAAG,EAAE,GAAG;oBACR,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,kBAAkB;oBACpC,UAAU,EAAE,SAAS;iBACtB,CAAC;gBAEF,OAAO,CAAC,CAAC,IAAI,CAAC;oBACZ,YAAY,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC;oBACjD,aAAa,EAAE,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC;oBACtD,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,MAAM,CAAC,iBAAiB;iBACrC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/auth/discovery.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+/**
+ * OIDC Discovery endpoint (/.well-known/openid-configuration).
+ */
+import { Hono } from 'hono';
+import type { KeyPair } from './keys.js';
+/**
+ * Discovery configuration.
+ */
+export interface DiscoveryConfig {
+    /** Server base URL (e.g., http://localhost:3000) */
+    baseUrl: string;
+    /** RSA keypair for JWKS */
+    keys: KeyPair;
+}
+/**
+ * Create discovery routes.
+ */
+export declare function createDiscoveryRoutes(config: DiscoveryConfig): Hono;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/src/auth/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../src/auth/discovery.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CA6BnE"}

package/dist/src/auth/discovery.js

@@ -0,0 +1,40 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+/**
+ * OIDC Discovery endpoint (/.well-known/openid-configuration).
+ */
+import { Hono } from 'hono';
+import { publicKeyToJwk } from './keys.js';
+/**
+ * Create discovery routes.
+ */
+export function createDiscoveryRoutes(config) {
+    const app = new Hono();
+    // GET /.well-known/openid-configuration - OIDC Discovery
+    app.get('/.well-known/openid-configuration', (c) => {
+        return c.json({
+            issuer: config.baseUrl,
+            device_authorization_endpoint: `${config.baseUrl}/oauth2/device_authorization`,
+            token_endpoint: `${config.baseUrl}/oauth2/token`,
+            jwks_uri: `${config.baseUrl}/.well-known/jwks.json`,
+            response_types_supported: ['token'],
+            grant_types_supported: [
+                'urn:ietf:params:oauth:grant-type:device_code',
+                'refresh_token',
+            ],
+            subject_types_supported: ['public'],
+            id_token_signing_alg_values_supported: ['RS256'],
+            token_endpoint_auth_methods_supported: ['none'],
+        });
+    });
+    // GET /.well-known/jwks.json - JSON Web Key Set
+    app.get('/.well-known/jwks.json', (c) => {
+        return c.json({
+            keys: [publicKeyToJwk(config.keys)],
+        });
+    });
+    return app;
+}
+//# sourceMappingURL=discovery.js.map

package/dist/src/auth/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/auth/discovery.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAY3C;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,yDAAyD;IACzD,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM,CAAC,OAAO;YACtB,6BAA6B,EAAE,GAAG,MAAM,CAAC,OAAO,8BAA8B;YAC9E,cAAc,EAAE,GAAG,MAAM,CAAC,OAAO,eAAe;YAChD,QAAQ,EAAE,GAAG,MAAM,CAAC,OAAO,wBAAwB;YACnD,wBAAwB,EAAE,CAAC,OAAO,CAAC;YACnC,qBAAqB,EAAE;gBACrB,8CAA8C;gBAC9C,eAAe;aAChB;YACD,uBAAuB,EAAE,CAAC,QAAQ,CAAC;YACnC,qCAAqC,EAAE,CAAC,OAAO,CAAC;YAChD,qCAAqC,EAAE,CAAC,MAAM,CAAC;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,gDAAgD;IAChD,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE;QACtC,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SACpC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/auth/index.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+/**
+ * OIDC authentication provider for e3-api-server.
+ *
+ * Provides OAuth2 Device Flow (RFC 8628) with JWT tokens,
+ * compatible with AWS Cognito for cloud deployment.
+ */
+import { Hono } from 'hono';
+import { type KeyPair } from './keys.js';
+export { generateKeyPair, verifyJwt, type KeyPair, type JwtPayload } from './keys.js';
+/**
+ * Parse duration string to seconds.
+ * Supports: "5s", "15m", "1h", "24h", "90d"
+ */
+export declare function parseDuration(duration: string): number;
+/**
+ * OIDC provider configuration.
+ */
+export interface OidcConfig {
+    /** Server base URL (e.g., http://localhost:3000) */
+    baseUrl: string;
+    /** Access token expiry duration (default: "1h") */
+    tokenExpiry?: string;
+    /** Refresh token expiry duration (default: "90d") */
+    refreshTokenExpiry?: string;
+    /** Auto-approve device codes (for CI testing) */
+    autoApprove?: boolean;
+}
+/**
+ * OIDC provider instance.
+ */
+export interface OidcProvider {
+    /** Hono app with all auth routes */
+    routes: Hono;
+    /** RSA keypair (for validating tokens) */
+    keys: KeyPair;
+    /** Server base URL */
+    baseUrl: string;
+    /** Access token expiry in seconds */
+    accessTokenExpiry: number;
+}
+/**
+ * Create an OIDC provider for the e3-api-server.
+ *
+ * This provides:
+ * - /.well-known/openid-configuration (discovery)
+ * - /.well-known/jwks.json (public keys)
+ * - /oauth2/device_authorization (start device flow)
+ * - /device (approval page)
+ * - /oauth2/token (exchange codes and refresh tokens)
+ */
+export declare function createOidcProvider(config: OidcConfig): OidcProvider;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAmB,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAI1D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAEtF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgBtD;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iDAAiD;IACjD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,MAAM,EAAE,IAAI,CAAC;IACb,0CAA0C;IAC1C,IAAI,EAAE,OAAO,CAAC;IACd,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,CA4BnE"}

package/dist/src/auth/index.js

@@ -0,0 +1,69 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+/**
+ * OIDC authentication provider for e3-api-server.
+ *
+ * Provides OAuth2 Device Flow (RFC 8628) with JWT tokens,
+ * compatible with AWS Cognito for cloud deployment.
+ */
+import { Hono } from 'hono';
+import { generateKeyPair } from './keys.js';
+import { createDeviceRoutes } from './device.js';
+import { createDiscoveryRoutes } from './discovery.js';
+export { generateKeyPair, verifyJwt } from './keys.js';
+/**
+ * Parse duration string to seconds.
+ * Supports: "5s", "15m", "1h", "24h", "90d"
+ */
+export function parseDuration(duration) {
+    const match = duration.match(/^(\d+)(s|m|h|d)$/);
+    if (!match) {
+        throw new Error(`Invalid duration format: ${duration}. Use format like "5s", "15m", "1h", "90d"`);
+    }
+    const value = parseInt(match[1], 10);
+    const unit = match[2];
+    switch (unit) {
+        case 's': return value;
+        case 'm': return value * 60;
+        case 'h': return value * 60 * 60;
+        case 'd': return value * 60 * 60 * 24;
+        default: throw new Error(`Unknown duration unit: ${unit}`);
+    }
+}
+/**
+ * Create an OIDC provider for the e3-api-server.
+ *
+ * This provides:
+ * - /.well-known/openid-configuration (discovery)
+ * - /.well-known/jwks.json (public keys)
+ * - /oauth2/device_authorization (start device flow)
+ * - /device (approval page)
+ * - /oauth2/token (exchange codes and refresh tokens)
+ */
+export function createOidcProvider(config) {
+    const keys = generateKeyPair();
+    const accessTokenExpiry = parseDuration(config.tokenExpiry ?? '1h');
+    const refreshTokenExpiry = parseDuration(config.refreshTokenExpiry ?? '90d');
+    const autoApprove = config.autoApprove ?? process.env.E3_AUTH_AUTO_APPROVE === '1';
+    const deviceConfig = {
+        baseUrl: config.baseUrl,
+        keys,
+        accessTokenExpiry,
+        refreshTokenExpiry,
+        autoApprove,
+    };
+    const app = new Hono();
+    // Mount discovery routes (/.well-known/*)
+    app.route('/', createDiscoveryRoutes({ baseUrl: config.baseUrl, keys }));
+    // Mount device flow routes (/oauth2/*, /device)
+    app.route('/', createDeviceRoutes(deviceConfig));
+    return {
+        routes: app,
+        keys,
+        baseUrl: config.baseUrl,
+        accessTokenExpiry,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/src/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAgB,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAyB,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAiC,MAAM,WAAW,CAAC;AAEtF;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,4CAA4C,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEtB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC;QACvB,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;QAC5B,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,CAAC;QACjC,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACtC,OAAO,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AA8BD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;IACpE,MAAM,kBAAkB,GAAG,aAAa,CAAC,MAAM,CAAC,kBAAkB,IAAI,KAAK,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IAEnF,MAAM,YAAY,GAAqB;QACrC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;QACJ,iBAAiB;QACjB,kBAAkB;QAClB,WAAW;KACZ,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,0CAA0C;IAC1C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEzE,gDAAgD;IAChD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;IAEjD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI;QACJ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,iBAAiB;KAClB,CAAC;AACJ,CAAC"}

package/dist/src/auth/keys.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+/**
+ * RSA keypair generation and JWT signing for OIDC provider.
+ */
+import * as crypto from 'node:crypto';
+/**
+ * RSA keypair for JWT signing.
+ */
+export interface KeyPair {
+    privateKey: crypto.KeyObject;
+    publicKey: crypto.KeyObject;
+    /** Key ID for JWKS */
+    kid: string;
+}
+/**
+ * JWT payload claims.
+ */
+export interface JwtPayload {
+    /** Subject - user identifier */
+    sub: string;
+    /** Issuer */
+    iss: string;
+    /** Audience */
+    aud: string;
+    /** Expiration time (Unix timestamp) */
+    exp: number;
+    /** Issued at time (Unix timestamp) */
+    iat: number;
+    /** Not before time (Unix timestamp) */
+    nbf: number;
+    /** Token type (access or refresh) */
+    token_type?: 'access' | 'refresh';
+}
+/**
+ * Generate an RSA keypair for JWT signing.
+ * Keys are generated in-memory on server startup.
+ */
+export declare function generateKeyPair(): KeyPair;
+/**
+ * Sign a JWT payload with the private key.
+ */
+export declare function signJwt(payload: JwtPayload, keys: KeyPair): string;
+/**
+ * Verify a JWT and return the payload.
+ * @throws Error if verification fails
+ */
+export declare function verifyJwt(token: string, keys: KeyPair): JwtPayload;
+/**
+ * Export public key in JWK format for JWKS endpoint.
+ */
+export declare function publicKeyToJwk(keys: KeyPair): object;
+//# sourceMappingURL=keys.d.ts.map

package/dist/src/auth/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/auth/keys.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;IAC5B,sBAAsB;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,qCAAqC;IACrC,UAAU,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CACnC;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,OAAO,CASzC;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAgBlE;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,UAAU,CA4BlE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAQpD"}

package/dist/src/auth/keys.js

@@ -0,0 +1,78 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+/**
+ * RSA keypair generation and JWT signing for OIDC provider.
+ */
+import * as crypto from 'node:crypto';
+/**
+ * Generate an RSA keypair for JWT signing.
+ * Keys are generated in-memory on server startup.
+ */
+export function generateKeyPair() {
+    const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+    });
+    // Generate a random key ID
+    const kid = crypto.randomBytes(8).toString('hex');
+    return { privateKey, publicKey, kid };
+}
+/**
+ * Sign a JWT payload with the private key.
+ */
+export function signJwt(payload, keys) {
+    const header = {
+        alg: 'RS256',
+        typ: 'JWT',
+        kid: keys.kid,
+    };
+    const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
+    const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
+    const sign = crypto.createSign('RSA-SHA256');
+    sign.update(`${headerB64}.${payloadB64}`);
+    const signature = sign.sign(keys.privateKey);
+    const signatureB64 = signature.toString('base64url');
+    return `${headerB64}.${payloadB64}.${signatureB64}`;
+}
+/**
+ * Verify a JWT and return the payload.
+ * @throws Error if verification fails
+ */
+export function verifyJwt(token, keys) {
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        throw new Error('Malformed JWT: expected 3 parts');
+    }
+    const [headerB64, payloadB64, signatureB64] = parts;
+    // Verify signature
+    const verify = crypto.createVerify('RSA-SHA256');
+    verify.update(`${headerB64}.${payloadB64}`);
+    const signature = Buffer.from(signatureB64, 'base64url');
+    if (!verify.verify(keys.publicKey, signature)) {
+        throw new Error('Invalid JWT signature');
+    }
+    // Decode and validate payload
+    const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString());
+    const now = Math.floor(Date.now() / 1000);
+    if (payload.exp !== undefined && payload.exp < now) {
+        throw new Error('Token expired');
+    }
+    if (payload.nbf !== undefined && payload.nbf > now) {
+        throw new Error('Token not yet valid');
+    }
+    return payload;
+}
+/**
+ * Export public key in JWK format for JWKS endpoint.
+ */
+export function publicKeyToJwk(keys) {
+    const publicKeyJwk = keys.publicKey.export({ format: 'jwk' });
+    return {
+        ...publicKeyJwk,
+        kid: keys.kid,
+        use: 'sig',
+        alg: 'RS256',
+    };
+}
+//# sourceMappingURL=keys.js.map

package/dist/src/auth/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/auth/keys.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAgCtC;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;QAClE,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IAEH,2BAA2B;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAElD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,OAAmB,EAAE,IAAa;IACxD,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAErD,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,YAAY,EAAE,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,IAAa;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;IAEpD,mBAAmB;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,8BAA8B;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAe,CAAC;IAE1F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,OAAO;QACL,GAAG,YAAY;QACf,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,OAAO;KACb,CAAC;AACJ,CAAC"}

package/dist/src/beast2.d.ts

@@ -6,15 +6,27 @@ import type { EastType, ValueTypeOf } from '@elaraai/east';
 import type { Context } from 'hono';
 import { type Error } from './types.js';
 /**
- * Decode BEAST2 request body.
+ * Decode BEAST2 request body from Hono context.
  */
 export declare function decodeBody<T extends EastType>(c: Context, type: T): Promise<ValueTypeOf<T>>;
+/**
+ * Decode raw BEAST2 bytes (for handlers that receive body directly).
+ */
+export declare function decodeBeast2<T extends EastType>(data: Uint8Array, type: T): ValueTypeOf<T>;
 /**
  * Send BEAST2 success response.
+ *
+ * Returns a web Response object that can be used by both Hono routes and Lambda handlers.
  */
-export declare function sendSuccess<T extends EastType>(c: Context, type: T, value: ValueTypeOf<T>): Response;
+export declare function sendSuccess<T extends EastType>(type: T, value: ValueTypeOf<T>): Response;
 /**
  * Send BEAST2 error response.
+ *
+ * Returns a web Response object that can be used by both Hono routes and Lambda handlers.
+ */
+export declare function sendError<T extends EastType>(type: T, error: Error): Response;
+/**
+ * Send BEAST2 success response with custom HTTP status.
  */
-export declare function sendError<T extends EastType>(c: Context, type: T, error: Error): Response;
+export declare function sendSuccessWithStatus<T extends EastType>(type: T, value: ValueTypeOf<T>, status: number): Response;
 //# sourceMappingURL=beast2.d.ts.map

package/dist/src/beast2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"beast2.d.ts","sourceRoot":"","sources":["../../src/beast2.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAgB,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAEtD;;GAEG;AACH,wBAAsB,UAAU,CAAC,CAAC,SAAS,QAAQ,EACjD,CAAC,EAAE,OAAO,EACV,IAAI,EAAE,CAAC,GACN,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CASzB;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,QAAQ,EAC5C,CAAC,EAAE,OAAO,EACV,IAAI,EAAE,CAAC,EACP,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GACpB,QAAQ,CAWV;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,QAAQ,EAC1C,CAAC,EAAE,OAAO,EACV,IAAI,EAAE,CAAC,EACP,KAAK,EAAE,KAAK,GACX,QAAQ,CAWV"}
+{"version":3,"file":"beast2.d.ts","sourceRoot":"","sources":["../../src/beast2.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAgB,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAEtD;;GAEG;AACH,wBAAsB,UAAU,CAAC,CAAC,SAAS,QAAQ,EACjD,CAAC,EAAE,OAAO,EACV,IAAI,EAAE,CAAC,GACN,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAUzB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,QAAQ,EAC7C,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,CAAC,GACN,WAAW,CAAC,CAAC,CAAC,CAGhB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,QAAQ,EAC5C,IAAI,EAAE,CAAC,EACP,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GACpB,QAAQ,CAYV;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,QAAQ,EAC1C,IAAI,EAAE,CAAC,EACP,KAAK,EAAE,KAAK,GACX,QAAQ,CAYV;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,QAAQ,EACtD,IAAI,EAAE,CAAC,EACP,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EACrB,MAAM,EAAE,MAAM,GACb,QAAQ,CAYV"}

package/dist/src/beast2.js

@@ -3,44 +3,74 @@
  * Licensed under BSL 1.1. See LICENSE for details.
  */
 import { encodeBeast2For, decodeBeast2For, variant } from '@elaraai/east';
+import { BEAST2_CONTENT_TYPE } from '@elaraai/e3-core';
 import { ResponseType } from './types.js';
 /**
- * Decode BEAST2 request body.
+ * Decode BEAST2 request body from Hono context.
  */
 export async function decodeBody(c, type) {
     const contentType = c.req.header('content-type');
-    if (contentType !== 'application/beast2') {
-        throw new Error(`Expected Content-Type: application/beast2, got ${contentType}`);
+    if (contentType !== BEAST2_CONTENT_TYPE) {
+        throw new Error(`Expected Content-Type: ${BEAST2_CONTENT_TYPE}, got ${contentType}`);
     }
+    // TODO should we use use streaming decoder here?
     const buffer = await c.req.arrayBuffer();
     const decode = decodeBeast2For(type);
     return decode(new Uint8Array(buffer));
 }
+/**
+ * Decode raw BEAST2 bytes (for handlers that receive body directly).
+ */
+export function decodeBeast2(data, type) {
+    const decode = decodeBeast2For(type);
+    return decode(data);
+}
 /**
  * Send BEAST2 success response.
+ *
+ * Returns a web Response object that can be used by both Hono routes and Lambda handlers.
  */
-export function sendSuccess(c, type, value) {
+export function sendSuccess(type, value) {
     const responseType = ResponseType(type);
-    const encode = encodeBeast2For(responseType);
+    const encode = encodeBeast2For(responseType); // TODO should we use streaming encoder here?
     const body = encode(variant('success', value));
     return new Response(body, {
         status: 200,
         headers: {
-            'Content-Type': 'application/beast2',
+            'Content-Type': BEAST2_CONTENT_TYPE,
+            'Content-Length': String(body.byteLength),
         },
     });
 }
 /**
  * Send BEAST2 error response.
+ *
+ * Returns a web Response object that can be used by both Hono routes and Lambda handlers.
  */
-export function sendError(c, type, error) {
+export function sendError(type, error) {
     const responseType = ResponseType(type);
     const encode = encodeBeast2For(responseType);
     const body = encode(variant('error', error));
     return new Response(body, {
         status: 200,
         headers: {
-            'Content-Type': 'application/beast2',
+            'Content-Type': BEAST2_CONTENT_TYPE,
+            'Content-Length': String(body.byteLength),
+        },
+    });
+}
+/**
+ * Send BEAST2 success response with custom HTTP status.
+ */
+export function sendSuccessWithStatus(type, value, status) {
+    const responseType = ResponseType(type);
+    const encode = encodeBeast2For(responseType); // TODO should we use streaming encoder here?
+    const body = encode(variant('success', value));
+    return new Response(body, {
+        status,
+        headers: {
+            'Content-Type': BEAST2_CONTENT_TYPE,
+            'Content-Length': String(body.byteLength),
         },
     });
 }

package/dist/src/beast2.js.map

@@ -1 +1 @@
-{"version":3,"file":"beast2.js","sourceRoot":"","sources":["../../src/beast2.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAG1E,OAAO,EAAE,YAAY,EAAc,MAAM,YAAY,CAAC;AAEtD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,CAAU,EACV,IAAO;IAEP,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACjD,IAAI,WAAW,KAAK,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,kDAAkD,WAAW,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,CAAU,EACV,IAAO,EACP,KAAqB;IAErB,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAqC,CAAC,CAAC;IAEnF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,oBAAoB;SACrC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CACvB,CAAU,EACV,IAAO,EACP,KAAY;IAEZ,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAqC,CAAC,CAAC;IAEjF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,oBAAoB;SACrC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"beast2.js","sourceRoot":"","sources":["../../src/beast2.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAc,MAAM,YAAY,CAAC;AAEtD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,CAAU,EACV,IAAO;IAEP,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACjD,IAAI,WAAW,KAAK,mBAAmB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,0BAA0B,mBAAmB,SAAS,WAAW,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,iDAAiD;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAgB,EAChB,IAAO;IAEP,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,IAAO,EACP,KAAqB;IAErB,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,6CAA6C;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAqC,CAAC,CAAC;IAEnF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,mBAAmB;YACnC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;SAC1C;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,IAAO,EACP,KAAY;IAEZ,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAqC,CAAC,CAAC;IAEjF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,mBAAmB;YACnC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;SAC1C;KACF,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAO,EACP,KAAqB,EACrB,MAAc;IAEd,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,6CAA6C;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAqC,CAAC,CAAC;IAEnF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,mBAAmB;YACnC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;SAC1C;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/src/cli.js

@@ -10,17 +10,69 @@ program
     .name('e3-api-server')
     .description('HTTP server for e3 repositories')
     .version('0.0.1-beta.0')
-    .argument('<repo>', 'Path to e3 repository')
+    .option('--repos <dir>', 'Directory containing e3 repositories (multi-repo mode)')
+    .option('--repo <path>', 'Path to a single repository (single-repo mode, access via /repos/default)')
     .option('-p, --port <port>', 'HTTP port', '3000')
     .option('-H, --host <host>', 'Bind address', 'localhost')
-    .action(async (repo, options) => {
+    .option('--cors', 'Enable CORS')
+    .option('--oidc', 'Enable built-in OIDC authentication provider')
+    .option('--token-expiry <duration>', 'Access token expiry (e.g., "5s", "15m", "1h")', '1h')
+    .option('--refresh-token-expiry <duration>', 'Refresh token expiry (e.g., "1h", "7d", "90d")', '90d')
+    .option('--auth-key <path>', 'JWT public key path (external auth)')
+    .option('--auth-issuer <iss>', 'Expected JWT issuer (external auth)')
+    .option('--auth-audience <aud>', 'Expected JWT audience (external auth)')
+    .action(async (options) => {
+    // Validate mutually exclusive options
+    if (options.repos && options.repo) {
+        console.error('Error: Cannot specify both --repos and --repo');
+        process.exit(1);
+    }
+    if (!options.repos && !options.repo) {
+        console.error('Error: Must specify either --repos or --repo');
+        process.exit(1);
+    }
+    const port = parseInt(options.port, 10);
+    const host = options.host;
+    // Build auth config if all auth options provided (external provider)
+    const auth = options.authKey && options.authIssuer && options.authAudience
+        ? {
+            publicKeyPath: options.authKey,
+            issuer: options.authIssuer,
+            audience: options.authAudience,
+        }
+        : undefined;
+    // Build OIDC config if enabled (built-in provider)
+    const oidc = options.oidc
+        ? {
+            baseUrl: `http://${host}:${port}`,
+            tokenExpiry: options.tokenExpiry,
+            refreshTokenExpiry: options.refreshTokenExpiry,
+        }
+        : undefined;
     const server = await createServer({
-        repo,
-        port: parseInt(options.port, 10),
-        host: options.host,
+        reposDir: options.repos,
+        singleRepoPath: options.repo,
+        port,
+        host,
+        cors: options.cors,
+        auth,
+        oidc,
     });
     await server.start();
-    console.log(`e3-api-server listening on http://${options.host}:${server.port}`);
+    console.log(`e3-api-server listening on http://${host}:${server.port}`);
+    if (options.repos) {
+        console.log(`Serving repositories from: ${options.repos}`);
+    }
+    else {
+        console.log(`Serving single repository from: ${options.repo}`);
+        console.log(`Access via: http://${host}:${server.port}/repos/default`);
+    }
+    if (oidc) {
+        console.log(`OIDC provider enabled (token expiry: ${options.tokenExpiry})`);
+        if (process.env.E3_AUTH_AUTO_APPROVE === '1') {
+            console.log('  Auto-approve mode enabled (E3_AUTH_AUTO_APPROVE=1)');
+        }
+    }
     // Handle shutdown signals
     const shutdown = async () => {
         console.log('\nShutting down...');

package/dist/src/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,eAAe,CAAC;KACrB,WAAW,CAAC,iCAAiC,CAAC;KAC9C,OAAO,CAAC,cAAc,CAAC;KACvB,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;KAC3C,MAAM,CAAC,mBAAmB,EAAE,WAAW,EAAE,MAAM,CAAC;KAChD,MAAM,CAAC,mBAAmB,EAAE,cAAc,EAAE,WAAW,CAAC;KACxD,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,OAG5B,EAAE,EAAE;IACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,IAAI;QACJ,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,OAAO,CAAC,GAAG,CAAC,qCAAqC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAEhF,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,eAAe,CAAC;KACrB,WAAW,CAAC,iCAAiC,CAAC;KAC9C,OAAO,CAAC,cAAc,CAAC;KACvB,MAAM,CAAC,eAAe,EAAE,wDAAwD,CAAC;KACjF,MAAM,CAAC,eAAe,EAAE,2EAA2E,CAAC;KACpG,MAAM,CAAC,mBAAmB,EAAE,WAAW,EAAE,MAAM,CAAC;KAChD,MAAM,CAAC,mBAAmB,EAAE,cAAc,EAAE,WAAW,CAAC;KACxD,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;KAC/B,MAAM,CAAC,QAAQ,EAAE,8CAA8C,CAAC;KAChE,MAAM,CAAC,2BAA2B,EAAE,+CAA+C,EAAE,IAAI,CAAC;KAC1F,MAAM,CAAC,mCAAmC,EAAE,gDAAgD,EAAE,KAAK,CAAC;KACpG,MAAM,CAAC,mBAAmB,EAAE,qCAAqC,CAAC;KAClE,MAAM,CAAC,qBAAqB,EAAE,qCAAqC,CAAC;KACpE,MAAM,CAAC,uBAAuB,EAAE,uCAAuC,CAAC;KACxE,MAAM,CAAC,KAAK,EAAE,OAYd,EAAE,EAAE;IACH,sCAAsC;IACtC,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAE1B,qEAAqE;IACrE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,YAAY;QACxE,CAAC,CAAC;YACE,aAAa,EAAE,OAAO,CAAC,OAAO;YAC9B,MAAM,EAAE,OAAO,CAAC,UAAU;YAC1B,QAAQ,EAAE,OAAO,CAAC,YAAY;SAC/B;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,mDAAmD;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI;QACvB,CAAC,CAAC;YACE,OAAO,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE;YACjC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;SAC/C;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,QAAQ,EAAE,OAAO,CAAC,KAAK;QACvB,cAAc,EAAE,OAAO,CAAC,IAAI;QAC5B,IAAI;QACJ,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI;QACJ,IAAI;KACL,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,OAAO,CAAC,GAAG,CAAC,qCAAqC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,8BAA8B,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,mCAAmC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,IAAI,MAAM,CAAC,IAAI,gBAAgB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,wCAAwC,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC;QAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/src/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkBH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CA+DlD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoBH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CAqElD"}

package/dist/src/errors.js

@@ -3,11 +3,14 @@
  * Licensed under BSL 1.1. See LICENSE for details.
  */
 import { variant, some, none } from '@elaraai/east';
-import { WorkspaceNotFoundError, WorkspaceNotDeployedError, WorkspaceExistsError, WorkspaceLockError, PackageNotFoundError, PackageExistsError, PackageInvalidError, DatasetNotFoundError, TaskNotFoundError, ObjectNotFoundError, DataflowError, DataflowAbortedError, PermissionDeniedError, } from '@elaraai/e3-core';
+import { RepoNotFoundError, WorkspaceNotFoundError, WorkspaceNotDeployedError, WorkspaceExistsError, WorkspaceLockError, PackageNotFoundError, PackageExistsError, PackageInvalidError, DatasetNotFoundError, TaskNotFoundError, ExecutionNotFoundError, ObjectNotFoundError, DataflowError, DataflowAbortedError, PermissionDeniedError, } from '@elaraai/e3-core';
 /**
  * Convert an e3-core error to an API error variant.
  */
 export function errorToVariant(err) {
+    if (err instanceof RepoNotFoundError) {
+        return variant('repository_not_found', { repo: err.repo });
+    }
     if (err instanceof WorkspaceNotFoundError) {
         return variant('workspace_not_found', { workspace: err.workspace });
     }
@@ -20,7 +23,7 @@ export function errorToVariant(err) {
     if (err instanceof WorkspaceLockError) {
         return variant('workspace_locked', {
             workspace: err.workspace,
-            holder: err.holder
+            holder: err.holder && err.holder.pid !== undefined
                 ? variant('known', {
                     pid: BigInt(err.holder.pid),
                     acquiredAt: err.holder.acquiredAt,
@@ -54,6 +57,9 @@ export function errorToVariant(err) {
     if (err instanceof TaskNotFoundError) {
         return variant('task_not_found', { task: err.task });
     }
+    if (err instanceof ExecutionNotFoundError) {
+        return variant('execution_not_found', { task: err.task });
+    }
     if (err instanceof ObjectNotFoundError) {
         return variant('object_not_found', { hash: err.hash });
     }