@executor-js/sdk 1.5.19 → 1.5.21

package/dist/{chunk-EJKXSREX.js → chunk-DN5AKD4U.js}

@@ -2,6 +2,7 @@
 import { Option, Schema } from "effect";
 var DEFAULT_EXECUTOR_SERVER_ORIGIN = "http://127.0.0.1:4000";
 var DEFAULT_EXECUTOR_SERVER_USERNAME = "executor";
+var EXECUTOR_ORG_SELECTOR_HEADER = "x-executor-organization";
 var stripTrailingSlash = (value) => value.replace(/\/+$/, "");
 var displayNameFromOrigin = (origin) => origin.replace(/^https?:\/\//, "").replace(/\/+$/, "");
 var normalizeExecutorServerOrigin = (raw) => {
@@ -157,6 +158,7 @@ var InternalError = class extends Schema2.TaggedErrorClass()(
 export {
   DEFAULT_EXECUTOR_SERVER_ORIGIN,
   DEFAULT_EXECUTOR_SERVER_USERNAME,
+  EXECUTOR_ORG_SELECTOR_HEADER,
   normalizeExecutorServerOrigin,
   apiBaseUrlForServerOrigin,
   originFromApiBaseUrl,
@@ -168,4 +170,4 @@ export {
   isOAuthPopupResult,
   InternalError
 };
-//# sourceMappingURL=chunk-EJKXSREX.js.map
+//# sourceMappingURL=chunk-DN5AKD4U.js.map

package/dist/chunk-DN5AKD4U.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server-connection.ts","../src/oauth-popup-types.ts","../src/api-errors.ts"],"sourcesContent":["import { Option, Schema } from \"effect\";\n\nexport const DEFAULT_EXECUTOR_SERVER_ORIGIN = \"http://127.0.0.1:4000\";\nexport const DEFAULT_EXECUTOR_SERVER_USERNAME = \"executor\";\nexport const EXECUTOR_ORG_SELECTOR_HEADER = \"x-executor-organization\";\n\nexport type ExecutorServerConnectionKind = \"http\" | \"desktop-sidecar\";\nexport type ExecutorLocalServerKind = \"cli-daemon\" | \"desktop-sidecar\" | \"foreground\";\n\nexport type ExecutorServerAuth =\n  | {\n      readonly kind: \"basic\";\n      readonly username?: string;\n      readonly password: string;\n    }\n  | {\n      readonly kind: \"bearer\";\n      readonly token: string;\n    }\n  | {\n      // OAuth 2.0 device-flow credential from `executor login` against a hosted\n      // server. The access token is sent as a Bearer; `refreshToken` +\n      // `expiresAt` (epoch seconds) + `tokenEndpoint` + `clientId` let the CLI\n      // refresh it before expiry without a fresh browser login.\n      readonly kind: \"oauth\";\n      readonly accessToken: string;\n      readonly refreshToken?: string;\n      readonly expiresAt?: number;\n      readonly tokenEndpoint?: string;\n      readonly clientId?: string;\n    };\n\nexport interface ExecutorServerConnection {\n  readonly kind: ExecutorServerConnectionKind;\n  readonly key: string;\n  readonly origin: string;\n  readonly apiBaseUrl: string;\n  readonly displayName: string;\n  readonly auth?: ExecutorServerAuth;\n}\n\nexport interface ExecutorServerConnectionInput {\n  readonly kind?: ExecutorServerConnectionKind;\n  readonly key?: string;\n  readonly origin?: string;\n  readonly apiBaseUrl?: string;\n  readonly displayName?: string;\n  readonly auth?: ExecutorServerAuth;\n}\n\nexport interface ExecutorLocalServerManifest {\n  readonly version: 1;\n  readonly kind: ExecutorLocalServerKind;\n  readonly pid: number;\n  readonly startedAt: string;\n  readonly dataDir: string;\n  readonly scopeDir: string | null;\n  readonly connection: ExecutorServerConnection;\n  readonly owner: {\n    readonly client: \"cli\" | \"desktop\";\n    readonly version: string | null;\n    readonly executablePath: string | null;\n  };\n}\n\nconst stripTrailingSlash = (value: string): string => value.replace(/\\/+$/, \"\");\n\nconst displayNameFromOrigin = (origin: string): string =>\n  origin.replace(/^https?:\\/\\//, \"\").replace(/\\/+$/, \"\");\n\nexport const normalizeExecutorServerOrigin = (raw: string): string => {\n  const trimmed = stripTrailingSlash(raw.trim());\n  if (!trimmed) return DEFAULT_EXECUTOR_SERVER_ORIGIN;\n\n  const parsed = new URL(/^https?:\\/\\//.test(trimmed) ? trimmed : `http://${trimmed}`);\n  if (parsed.pathname === \"/api\") {\n    parsed.pathname = \"/\";\n  }\n  parsed.search = \"\";\n  parsed.hash = \"\";\n  return stripTrailingSlash(parsed.toString());\n};\n\nexport const apiBaseUrlForServerOrigin = (origin: string): string => `${origin}/api`;\n\nexport const originFromApiBaseUrl = (raw: string): string => {\n  const parsed = new URL(raw);\n  if (parsed.pathname.endsWith(\"/api\")) {\n    parsed.pathname = parsed.pathname.slice(0, -\"/api\".length) || \"/\";\n  }\n  parsed.search = \"\";\n  parsed.hash = \"\";\n  return normalizeExecutorServerOrigin(parsed.toString());\n};\n\nexport const normalizeExecutorServerConnection = (\n  input: ExecutorServerConnectionInput = {},\n): ExecutorServerConnection => {\n  const origin = normalizeExecutorServerOrigin(\n    input.origin ??\n      (input.apiBaseUrl ? originFromApiBaseUrl(input.apiBaseUrl) : DEFAULT_EXECUTOR_SERVER_ORIGIN),\n  );\n  const apiBaseUrl = stripTrailingSlash(input.apiBaseUrl ?? apiBaseUrlForServerOrigin(origin));\n  const kind = input.kind ?? \"http\";\n\n  return {\n    kind,\n    key: input.key ?? `${kind}:${origin}`,\n    origin,\n    apiBaseUrl,\n    displayName: input.displayName ?? displayNameFromOrigin(origin),\n    ...(input.auth ? { auth: input.auth } : {}),\n  };\n};\n\nconst encodeBasicCredentials = (credentials: string): string | null => {\n  if (typeof globalThis.btoa === \"function\") {\n    return globalThis.btoa(credentials);\n  }\n\n  const buffer = (\n    globalThis as {\n      readonly Buffer?: {\n        readonly from: (value: string) => { readonly toString: (encoding: \"base64\") => string };\n      };\n    }\n  ).Buffer;\n  if (buffer) {\n    return buffer.from(credentials).toString(\"base64\");\n  }\n\n  return null;\n};\n\nexport const getExecutorServerAuthorizationHeader = (\n  connection: ExecutorServerConnection,\n): string | null => {\n  const auth = connection.auth;\n  if (!auth) return null;\n  if (auth.kind === \"bearer\") return `Bearer ${auth.token}`;\n  if (auth.kind === \"oauth\") return `Bearer ${auth.accessToken}`;\n  const encoded = encodeBasicCredentials(\n    `${auth.username ?? DEFAULT_EXECUTOR_SERVER_USERNAME}:${auth.password}`,\n  );\n  return encoded ? `Basic ${encoded}` : null;\n};\n\nconst ExecutorServerAuthJson = Schema.Union([\n  Schema.Struct({\n    kind: Schema.Literal(\"basic\"),\n    username: Schema.optional(Schema.String),\n    password: Schema.String,\n  }),\n  Schema.Struct({\n    kind: Schema.Literal(\"bearer\"),\n    token: Schema.String,\n  }),\n  Schema.Struct({\n    kind: Schema.Literal(\"oauth\"),\n    accessToken: Schema.String,\n    refreshToken: Schema.optional(Schema.String),\n    expiresAt: Schema.optional(Schema.Number),\n    tokenEndpoint: Schema.optional(Schema.String),\n    clientId: Schema.optional(Schema.String),\n  }),\n]);\n\nconst ExecutorServerConnectionJson = Schema.Struct({\n  kind: Schema.optional(Schema.Literals([\"http\", \"desktop-sidecar\"])),\n  key: Schema.optional(Schema.String),\n  origin: Schema.String,\n  apiBaseUrl: Schema.optional(Schema.String),\n  displayName: Schema.optional(Schema.String),\n  auth: Schema.optional(ExecutorServerAuthJson),\n});\n\nconst ExecutorLocalServerManifestJson = Schema.Struct({\n  version: Schema.Literal(1),\n  kind: Schema.Literals([\"cli-daemon\", \"desktop-sidecar\", \"foreground\"]),\n  pid: Schema.Number,\n  startedAt: Schema.String,\n  dataDir: Schema.String,\n  scopeDir: Schema.NullOr(Schema.String),\n  connection: ExecutorServerConnectionJson,\n  owner: Schema.Struct({\n    client: Schema.Literals([\"cli\", \"desktop\"]),\n    version: Schema.NullOr(Schema.String),\n    executablePath: Schema.NullOr(Schema.String),\n  }),\n});\n\nconst decodeUnknownJsonOption = Schema.decodeUnknownOption(Schema.UnknownFromJsonString);\nconst decodeExecutorLocalServerManifestJson = Schema.decodeUnknownOption(\n  ExecutorLocalServerManifestJson,\n);\n\nconst canNormalizeServerOrigin = (origin: string): boolean => {\n  const trimmed = stripTrailingSlash(origin.trim());\n  if (!trimmed) return true;\n  return URL.canParse(/^https?:\\/\\//.test(trimmed) ? trimmed : `http://${trimmed}`);\n};\n\nexport const parseExecutorLocalServerManifest = (\n  raw: string,\n): ExecutorLocalServerManifest | null => {\n  const json = decodeUnknownJsonOption(raw);\n  if (Option.isNone(json)) return null;\n  const decoded = decodeExecutorLocalServerManifestJson(json.value);\n  if (Option.isNone(decoded)) return null;\n  const parsed = decoded.value;\n  if (\n    !Number.isInteger(parsed.pid) ||\n    parsed.pid <= 0 ||\n    !canNormalizeServerOrigin(parsed.connection.origin)\n  ) {\n    return null;\n  }\n\n  const connection = normalizeExecutorServerConnection(parsed.connection);\n  return {\n    version: 1,\n    kind: parsed.kind,\n    pid: parsed.pid,\n    startedAt: parsed.startedAt,\n    dataDir: parsed.dataDir,\n    scopeDir: parsed.scopeDir,\n    connection,\n    owner: {\n      client: parsed.owner.client,\n      version: parsed.owner.version,\n      executablePath: parsed.owner.executablePath,\n    },\n  };\n};\n\nexport const serializeExecutorLocalServerManifest = (\n  manifest: ExecutorLocalServerManifest,\n): string => `${JSON.stringify(manifest, null, 2)}\\n`;\n","// ---------------------------------------------------------------------------\n// OAuth popup result — the message shape exchanged between the popup window\n// (opened during authorization) and the opener (the onboarding UI). Both the\n// server-side HTML generator and the client-side popup opener agree on this\n// shape so that success / failure can be communicated reliably via both\n// `postMessage` and `BroadcastChannel`.\n// ---------------------------------------------------------------------------\n\n/** Message type literal used to identify our popup results. */\nexport const OAUTH_POPUP_MESSAGE_TYPE = \"executor:oauth-result\" as const;\n\nexport type OAuthPopupResult<TAuth> =\n  | ({\n      readonly type: typeof OAUTH_POPUP_MESSAGE_TYPE;\n      readonly ok: true;\n      readonly sessionId: string;\n    } & TAuth)\n  | {\n      readonly type: typeof OAUTH_POPUP_MESSAGE_TYPE;\n      readonly ok: false;\n      readonly sessionId: string | null;\n      /** Short user-facing summary. */\n      readonly error: string;\n      /** Full technical detail. Omitted when identical to `error`. */\n      readonly errorDetails?: string;\n    };\n\nexport const isOAuthPopupResult = <TAuth>(value: unknown): value is OAuthPopupResult<TAuth> =>\n  typeof value === \"object\" &&\n  value !== null &&\n  (value as { type?: unknown }).type === OAUTH_POPUP_MESSAGE_TYPE;\n","// ---------------------------------------------------------------------------\n// Wire-level HTTP errors. Lives in the SDK so plugin `HttpApiGroup`\n// definitions (which sit on the SDK side of the dependency graph and\n// must stay publishable) can declare them without dragging in the\n// server-only `@executor-js/api` package. The HTTP edge in\n// `@executor-js/api` re-exports these and pairs them with the\n// translation/capture helpers used by handlers.\n// ---------------------------------------------------------------------------\n\nimport { Schema } from \"effect\";\n\n/** Public 500 surface. Opaque by schema — only `traceId` crosses the wire. */\nexport class InternalError extends Schema.TaggedErrorClass<InternalError>()(\n  \"InternalError\",\n  {\n    /** Opaque correlation id for backend lookup (Sentry event id, log line, etc.). */\n    traceId: Schema.String,\n  },\n  { httpApiStatus: 500 },\n) {}\n"],"mappings":";AAAA,SAAS,QAAQ,cAAc;AAExB,IAAM,iCAAiC;AACvC,IAAM,mCAAmC;AACzC,IAAM,+BAA+B;AA6D5C,IAAM,qBAAqB,CAAC,UAA0B,MAAM,QAAQ,QAAQ,EAAE;AAE9E,IAAM,wBAAwB,CAAC,WAC7B,OAAO,QAAQ,gBAAgB,EAAE,EAAE,QAAQ,QAAQ,EAAE;AAEhD,IAAM,gCAAgC,CAAC,QAAwB;AACpE,QAAM,UAAU,mBAAmB,IAAI,KAAK,CAAC;AAC7C,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,SAAS,IAAI,IAAI,eAAe,KAAK,OAAO,IAAI,UAAU,UAAU,OAAO,EAAE;AACnF,MAAI,OAAO,aAAa,QAAQ;AAC9B,WAAO,WAAW;AAAA,EACpB;AACA,SAAO,SAAS;AAChB,SAAO,OAAO;AACd,SAAO,mBAAmB,OAAO,SAAS,CAAC;AAC7C;AAEO,IAAM,4BAA4B,CAAC,WAA2B,GAAG,MAAM;AAEvE,IAAM,uBAAuB,CAAC,QAAwB;AAC3D,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,MAAI,OAAO,SAAS,SAAS,MAAM,GAAG;AACpC,WAAO,WAAW,OAAO,SAAS,MAAM,GAAG,CAAC,OAAO,MAAM,KAAK;AAAA,EAChE;AACA,SAAO,SAAS;AAChB,SAAO,OAAO;AACd,SAAO,8BAA8B,OAAO,SAAS,CAAC;AACxD;AAEO,IAAM,oCAAoC,CAC/C,QAAuC,CAAC,MACX;AAC7B,QAAM,SAAS;AAAA,IACb,MAAM,WACH,MAAM,aAAa,qBAAqB,MAAM,UAAU,IAAI;AAAA,EACjE;AACA,QAAM,aAAa,mBAAmB,MAAM,cAAc,0BAA0B,MAAM,CAAC;AAC3F,QAAM,OAAO,MAAM,QAAQ;AAE3B,SAAO;AAAA,IACL;AAAA,IACA,KAAK,MAAM,OAAO,GAAG,IAAI,IAAI,MAAM;AAAA,IACnC;AAAA,IACA;AAAA,IACA,aAAa,MAAM,eAAe,sBAAsB,MAAM;AAAA,IAC9D,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,EAC3C;AACF;AAEA,IAAM,yBAAyB,CAAC,gBAAuC;AACrE,MAAI,OAAO,WAAW,SAAS,YAAY;AACzC,WAAO,WAAW,KAAK,WAAW;AAAA,EACpC;AAEA,QAAM,SACJ,WAKA;AACF,MAAI,QAAQ;AACV,WAAO,OAAO,KAAK,WAAW,EAAE,SAAS,QAAQ;AAAA,EACnD;AAEA,SAAO;AACT;AAEO,IAAM,uCAAuC,CAClD,eACkB;AAClB,QAAM,OAAO,WAAW;AACxB,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,SAAS,SAAU,QAAO,UAAU,KAAK,KAAK;AACvD,MAAI,KAAK,SAAS,QAAS,QAAO,UAAU,KAAK,WAAW;AAC5D,QAAM,UAAU;AAAA,IACd,GAAG,KAAK,YAAY,gCAAgC,IAAI,KAAK,QAAQ;AAAA,EACvE;AACA,SAAO,UAAU,SAAS,OAAO,KAAK;AACxC;AAEA,IAAM,yBAAyB,OAAO,MAAM;AAAA,EAC1C,OAAO,OAAO;AAAA,IACZ,MAAM,OAAO,QAAQ,OAAO;AAAA,IAC5B,UAAU,OAAO,SAAS,OAAO,MAAM;AAAA,IACvC,UAAU,OAAO;AAAA,EACnB,CAAC;AAAA,EACD,OAAO,OAAO;AAAA,IACZ,MAAM,OAAO,QAAQ,QAAQ;AAAA,IAC7B,OAAO,OAAO;AAAA,EAChB,CAAC;AAAA,EACD,OAAO,OAAO;AAAA,IACZ,MAAM,OAAO,QAAQ,OAAO;AAAA,IAC5B,aAAa,OAAO;AAAA,IACpB,cAAc,OAAO,SAAS,OAAO,MAAM;AAAA,IAC3C,WAAW,OAAO,SAAS,OAAO,MAAM;AAAA,IACxC,eAAe,OAAO,SAAS,OAAO,MAAM;AAAA,IAC5C,UAAU,OAAO,SAAS,OAAO,MAAM;AAAA,EACzC,CAAC;AACH,CAAC;AAED,IAAM,+BAA+B,OAAO,OAAO;AAAA,EACjD,MAAM,OAAO,SAAS,OAAO,SAAS,CAAC,QAAQ,iBAAiB,CAAC,CAAC;AAAA,EAClE,KAAK,OAAO,SAAS,OAAO,MAAM;AAAA,EAClC,QAAQ,OAAO;AAAA,EACf,YAAY,OAAO,SAAS,OAAO,MAAM;AAAA,EACzC,aAAa,OAAO,SAAS,OAAO,MAAM;AAAA,EAC1C,MAAM,OAAO,SAAS,sBAAsB;AAC9C,CAAC;AAED,IAAM,kCAAkC,OAAO,OAAO;AAAA,EACpD,SAAS,OAAO,QAAQ,CAAC;AAAA,EACzB,MAAM,OAAO,SAAS,CAAC,cAAc,mBAAmB,YAAY,CAAC;AAAA,EACrE,KAAK,OAAO;AAAA,EACZ,WAAW,OAAO;AAAA,EAClB,SAAS,OAAO;AAAA,EAChB,UAAU,OAAO,OAAO,OAAO,MAAM;AAAA,EACrC,YAAY;AAAA,EACZ,OAAO,OAAO,OAAO;AAAA,IACnB,QAAQ,OAAO,SAAS,CAAC,OAAO,SAAS,CAAC;AAAA,IAC1C,SAAS,OAAO,OAAO,OAAO,MAAM;AAAA,IACpC,gBAAgB,OAAO,OAAO,OAAO,MAAM;AAAA,EAC7C,CAAC;AACH,CAAC;AAED,IAAM,0BAA0B,OAAO,oBAAoB,OAAO,qBAAqB;AACvF,IAAM,wCAAwC,OAAO;AAAA,EACnD;AACF;AAEA,IAAM,2BAA2B,CAAC,WAA4B;AAC5D,QAAM,UAAU,mBAAmB,OAAO,KAAK,CAAC;AAChD,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,IAAI,SAAS,eAAe,KAAK,OAAO,IAAI,UAAU,UAAU,OAAO,EAAE;AAClF;AAEO,IAAM,mCAAmC,CAC9C,QACuC;AACvC,QAAM,OAAO,wBAAwB,GAAG;AACxC,MAAI,OAAO,OAAO,IAAI,EAAG,QAAO;AAChC,QAAM,UAAU,sCAAsC,KAAK,KAAK;AAChE,MAAI,OAAO,OAAO,OAAO,EAAG,QAAO;AACnC,QAAM,SAAS,QAAQ;AACvB,MACE,CAAC,OAAO,UAAU,OAAO,GAAG,KAC5B,OAAO,OAAO,KACd,CAAC,yBAAyB,OAAO,WAAW,MAAM,GAClD;AACA,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,kCAAkC,OAAO,UAAU;AACtE,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,WAAW,OAAO;AAAA,IAClB,SAAS,OAAO;AAAA,IAChB,UAAU,OAAO;AAAA,IACjB;AAAA,IACA,OAAO;AAAA,MACL,QAAQ,OAAO,MAAM;AAAA,MACrB,SAAS,OAAO,MAAM;AAAA,MACtB,gBAAgB,OAAO,MAAM;AAAA,IAC/B;AAAA,EACF;AACF;AAEO,IAAM,uCAAuC,CAClD,aACW,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA;;;ACpO1C,IAAM,2BAA2B;AAkBjC,IAAM,qBAAqB,CAAQ,UACxC,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;;;ACrBzC,SAAS,UAAAA,eAAc;AAGhB,IAAM,gBAAN,cAA4BA,QAAO,iBAAgC;AAAA,EACxE;AAAA,EACA;AAAA;AAAA,IAEE,SAASA,QAAO;AAAA,EAClB;AAAA,EACA,EAAE,eAAe,IAAI;AACvB,EAAE;AAAC;","names":["Schema"]}

package/dist/{chunk-MYRPYTSV.js → chunk-GUZHNTDQ.js}

@@ -9,6 +9,7 @@ import {
   IntegrationRemovalNotAllowedError,
   InvalidConnectionInputError,
   NoHandlerError,
+  OAUTH2_SESSION_TTL_MS,
   OAuthCompleteError,
   OAuthProbeError,
   OAuthRegisterDynamicError,
@@ -21,10 +22,12 @@ import {
   ToolPolicyActionSchema,
   ToolSchemaView,
   comparePolicyRow,
+  encodeOAuthCallbackState,
   isValidPattern,
+  matchPattern,
   resolveEffectivePolicy,
   rowToToolPolicy
-} from "./chunk-PCSRC6WP.js";
+} from "./chunk-SNWDGE3G.js";
 import {
   OAUTH2_DEFAULT_TIMEOUT_MS,
   assertSupportedOAuthEndpointUrl,
@@ -695,10 +698,6 @@ var TOOL_POLICY_ACTIONS = [
 ];
 var isToolPolicyAction = (value) => typeof value === "string" && TOOL_POLICY_ACTIONS.includes(value);
 
-// src/oauth.ts
-var OAUTH2_PROVIDER_KEY = "oauth2";
-var OAUTH2_SESSION_TTL_MS = 15 * 60 * 1e3;
-
 // src/plugin-storage.ts
 var definePluginStorageCollection = (name, schema, options) => ({
   name,
@@ -3848,7 +3847,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
 }));
 
 // src/oauth-service.ts
-import { Effect as Effect7, Option as Option2, Schema as Schema4 } from "effect";
+import { Duration as Duration2, Effect as Effect7, Option as Option2, Schema as Schema4 } from "effect";
 import { FetchHttpClient as FetchHttpClient2 } from "effect/unstable/http";
 
 // src/oauth-discovery.ts
@@ -4278,6 +4277,48 @@ var makeOAuthService = (deps) => {
   const httpClientLayer = deps.httpClientLayer ?? FetchHttpClient2.layer;
   const fetch = deps.fetch;
   const redirectUri = deps.redirectUri;
+  const MAX_DISCOVERY_AUTH_SERVERS = 3;
+  const MAX_DISCOVERED_SCOPES = 100;
+  const capScopes = (scopes) => dedupeScopes(scopes).slice(0, MAX_DISCOVERED_SCOPES);
+  const discoverScopesForResource = (resource) => Effect7.gen(function* () {
+    if (resource == null) {
+      return yield* new OAuthDiscoveryError({
+        message: "Cannot discover OAuth scopes: the client has no resource configured"
+      });
+    }
+    const discoveryOptions = { endpointUrlPolicy: deps.endpointUrlPolicy, httpClientLayer };
+    const protectedResource = yield* discoverProtectedResourceMetadata(
+      resource,
+      discoveryOptions
+    );
+    const resourceScopes = protectedResource?.metadata.scopes_supported;
+    if (resourceScopes !== void 0) return capScopes(resourceScopes);
+    for (const issuer of (protectedResource?.metadata.authorization_servers ?? []).slice(
+      0,
+      MAX_DISCOVERY_AUTH_SERVERS
+    )) {
+      const authServer = yield* discoverAuthorizationServerMetadata(
+        issuer,
+        discoveryOptions
+      ).pipe(Effect7.catchTag("OAuthDiscoveryError", () => Effect7.succeed(null)));
+      const scopes = authServer?.metadata.scopes_supported;
+      if (scopes !== void 0) return capScopes(scopes);
+    }
+    return [];
+  }).pipe(
+    // Bound the whole sequence (PRM + up to MAX_DISCOVERY_AUTH_SERVERS AS
+    // fetches, each with its own request timeout). 30s is larger than a single
+    // request timeout so it bounds the sequence, not a slow-but-valid request.
+    Effect7.timeoutOrElse({
+      duration: Duration2.seconds(30),
+      orElse: () => Effect7.fail(
+        new OAuthDiscoveryError({
+          message: "OAuth scope discovery timed out",
+          cause: "timeout"
+        })
+      )
+    })
+  );
   const createClient = (input) => Effect7.gen(function* () {
     yield* validateClientEndpoints(input, deps.endpointUrlPolicy);
     const keys = yield* Effect7.try({
@@ -4465,15 +4506,22 @@ var makeOAuthService = (deps) => {
         message: `OAuth client not found: ${input.client}`
       });
     }
-    const declaredScopes = yield* deps.resolveDeclaredOAuthScopes(input.integration, input.template).pipe(
+    const scopePolicy = yield* deps.resolveOAuthScopePolicy(input.integration, input.template).pipe(
       Effect7.mapError(
         (cause) => new OAuthStartError({
           // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: StorageFailure carries a typed `message` field
-          message: `Failed to resolve declared OAuth scopes: ${cause.message}`
+          message: `Failed to resolve OAuth scope policy: ${cause.message}`
         })
       )
     );
-    const requestedScopes = dedupeScopes(declaredScopes);
+    const requestedScopes = scopePolicy.kind === "discover" ? yield* discoverScopesForResource(client.resource).pipe(
+      Effect7.mapError(
+        (cause) => new OAuthStartError({
+          // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: OAuthDiscoveryError carries a typed `message` field
+          message: `Failed to discover OAuth scopes: ${cause.message}`
+        })
+      )
+    ) : dedupeScopes(scopePolicy.scopes);
     if (client.grant === "client_credentials") {
       const token = yield* exchangeClientCredentials({
         tokenUrl: client.tokenUrl,
@@ -4518,6 +4566,10 @@ var makeOAuthService = (deps) => {
     const verifier = createPkceCodeVerifier();
     const challenge = yield* Effect7.promise(() => createPkceCodeChallenge(verifier));
     const state = OAuthState.make(createOAuthState());
+    const providerState = encodeOAuthCallbackState({
+      state: String(state),
+      orgSlug: deps.callbackStateOrgSlug
+    });
     const now = /* @__PURE__ */ new Date();
     const expiresAt = Date.now() + OAUTH2_SESSION_TTL_MS;
     yield* deps.fuma.use(
@@ -4534,10 +4586,10 @@ var makeOAuthService = (deps) => {
         redirect_url: flowRedirectUri,
         pkce_verifier: verifier,
         identity_label: input.identityLabel ?? null,
-        // Persist the requested scope set (declared ∪ client) so `complete`'s
-        // recorded-scope fallback reflects exactly what was requested when the
-        // AS omits `scope`, without re-resolving the integration's declared
-        // scopes at completion.
+        // Persist the requested scope set (the integration's declared or
+        // discovered scopes) so `complete`'s recorded-scope fallback reflects
+        // exactly what was requested when the AS omits `scope`, without
+        // re-resolving it at completion.
         payload: { owner: input.owner, clientOwner: input.clientOwner, requestedScopes },
         expires_at: expiresAt,
         created_at: now
@@ -4549,7 +4601,7 @@ var makeOAuthService = (deps) => {
         clientId: client.clientId,
         redirectUrl: flowRedirectUri,
         scopes: requestedScopes,
-        state: String(state),
+        state: providerState,
         codeChallenge: challenge,
         resource: client.resource ?? void 0,
         // Provider quirks (Google: access_type=offline + prompt=consent) —
@@ -4585,9 +4637,10 @@ var makeOAuthService = (deps) => {
       pkceVerifier: sessionRow.pkce_verifier == null ? null : String(sessionRow.pkce_verifier),
       identityLabel: sessionRow.identity_label == null ? null : String(sessionRow.identity_label),
       expiresAt: Number(sessionRow.expires_at),
-      // The scope set `start` requested (declared ∪ client), persisted on the
-      // session payload. Drives the recorded-scope fallback when the AS omits
-      // `scope`. Missing/legacy payloads fall back to the client's scopes below.
+      // The scope set `start` requested (the integration's declared or
+      // discovered scopes), persisted on the session payload. Drives the
+      // recorded-scope fallback when the AS omits `scope`. Missing/legacy
+      // payloads fall back to the client's scopes below.
       requestedScopes: requestedScopesFromPayload(sessionRow.payload),
       // The app's owner, recorded by `start` — reload the SAME app at
       // completion by explicit owner (no derivation). Defaults to the session
@@ -4728,7 +4781,13 @@ var makeOAuthService = (deps) => {
       authorizationUrl: as.metadata.authorization_endpoint,
       tokenUrl: as.metadata.token_endpoint,
       resource: resource?.metadata.resource ?? null,
-      scopesSupported: as.metadata.scopes_supported,
+      // Prefer the resource's own RFC 9728 scopes (authoritative, even when
+      // empty); fall back to the authorization server's list only when PRM is
+      // silent. For a spec-compliant MCP server (one that publishes PRM) this
+      // matches what `oauth.start` discovers. The AS fallback is a best-effort
+      // hint for the registration form on servers that omit PRM — where
+      // `oauth.start` requests none — so the two can differ for those.
+      scopesSupported: resource?.metadata.scopes_supported ?? as.metadata.scopes_supported,
       registrationEndpoint: as.metadata.registration_endpoint ?? null,
       tokenEndpointAuthMethodsSupported: as.metadata.token_endpoint_auth_methods_supported
     };
@@ -5328,6 +5387,7 @@ var createExecutor = (config) => Effect8.gen(function* () {
   const transaction = (effect) => fuma.transaction(effect);
   const staticTools = /* @__PURE__ */ new Map();
   const runtimes = /* @__PURE__ */ new Map();
+  let activeToolPolicyProvider = null;
   const credentialProviders = /* @__PURE__ */ new Map();
   const credentialProviderOrder = [];
   const staticToolOwner = () => subject == null ? "org" : "user";
@@ -6055,12 +6115,25 @@ var createExecutor = (config) => Effect8.gen(function* () {
       updated_at: now
     });
   });
-  const connectionsList = (filter) => core.findMany("connection", {
-    where: (b) => b.and(
-      filter?.integration === void 0 ? true : b("integration", "=", String(filter.integration)),
-      filter?.owner === void 0 ? true : b("owner", "=", filter.owner)
-    )
-  }).pipe(Effect8.map((rows) => rows.map(rowToConnection)));
+  const connectionsList = (filter) => Effect8.gen(function* () {
+    const rows = yield* core.findMany("connection", {
+      where: (b) => b.and(
+        filter?.integration === void 0 ? true : b("integration", "=", String(filter.integration)),
+        filter?.owner === void 0 ? true : b("owner", "=", filter.owner)
+      )
+    });
+    const connections = rows.map(rowToConnection);
+    if (!activeToolPolicyProvider) return connections;
+    const visibleTools = yield* toolsList({ includeAnnotations: false });
+    const visibleConnectionKeys = new Set(
+      visibleTools.filter((tool2) => !tool2.static).map((tool2) => `${tool2.owner}:${tool2.integration}:${tool2.connection}`)
+    );
+    return connections.filter(
+      (connection) => visibleConnectionKeys.has(
+        `${connection.owner}:${connection.integration}:${connection.name}`
+      )
+    );
+  });
   const connectionsGet = (ref) => findConnectionRow(ref).pipe(Effect8.map((row) => row ? rowToConnection(row) : null));
   const connectionsUpdate = (ref, input) => Effect8.gen(function* () {
     const row = yield* findConnectionRow(ref);
@@ -6139,6 +6212,51 @@ var createExecutor = (config) => Effect8.gen(function* () {
     }
     return yield* produceConnectionTools(integrationRow, ref);
   });
+  const compareProviderPolicyRule = (a, b) => {
+    if (a.position < b.position) return -1;
+    if (a.position > b.position) return 1;
+    return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+  };
+  const resolveProviderPolicyFromRules = (toolId, rules3) => {
+    for (const rule of [...rules3].sort(compareProviderPolicyRule)) {
+      if (!matchPattern(rule.pattern, toolId)) continue;
+      return {
+        action: rule.action,
+        source: "user",
+        pattern: rule.pattern,
+        policyId: rule.id
+      };
+    }
+    return {
+      action: "block",
+      source: "user",
+      pattern: "*"
+    };
+  };
+  const listActivePolicyRuleSet = () => activeToolPolicyProvider ? (
+    // Batched per-operation resolver: fetch all policy + connection state
+    // once, then resolve every tool in this operation against that
+    // snapshot. Avoids the per-tool resolve N+1 on the list surface.
+    activeToolPolicyProvider.prepare ? activeToolPolicyProvider.prepare().pipe(Effect8.map((resolve) => ({ kind: "prepared", resolve }))) : activeToolPolicyProvider.resolve ? Effect8.succeed({
+      kind: "provider",
+      provider: activeToolPolicyProvider,
+      rules: null
+    }) : activeToolPolicyProvider.list().pipe(
+      Effect8.map((rules3) => ({
+        kind: "provider",
+        provider: activeToolPolicyProvider,
+        rules: rules3
+      }))
+    )
+  ) : core.findMany("tool_policy", {}).pipe(Effect8.map((rows) => ({ kind: "global", rows })));
+  const resolvePolicyFromRuleSet = (toolId, ruleSet, defaultRequiresApproval) => ruleSet.kind === "prepared" ? Effect8.succeed(ruleSet.resolve({ toolId, defaultRequiresApproval })) : ruleSet.kind === "provider" ? ruleSet.provider.resolve ? ruleSet.provider.resolve({ toolId, defaultRequiresApproval }) : Effect8.succeed(resolveProviderPolicyFromRules(toolId, ruleSet.rules ?? [])) : Effect8.succeed(
+    resolveEffectivePolicy(
+      toolId,
+      ruleSet.rows,
+      ownerRankForRow,
+      defaultRequiresApproval
+    )
+  );
   const matchesToolFilter = (tool2, filter) => {
     if (!filter) return true;
     if (filter.integration !== void 0 && tool2.integration !== filter.integration) return false;
@@ -6195,16 +6313,15 @@ var createExecutor = (config) => Effect8.gen(function* () {
       select: TOOL_INVOCATION_COLUMNS
     });
     const includeBlocked = filter?.includeBlocked ?? false;
-    const policyRows = yield* core.findMany("tool_policy", {});
+    const policyRules = yield* listActivePolicyRuleSet();
     const tools = [];
     for (const row of rows) {
       const tool2 = rowToTool(row);
       if (!matchesToolFilter(tool2, filter)) continue;
       if (!includeBlocked) {
-        const effective = resolveEffectivePolicy(
+        const effective = yield* resolvePolicyFromRuleSet(
           normalizedPolicyId(tool2),
-          policyRows,
-          ownerRankForRow,
+          policyRules,
           tool2.annotations?.requiresApproval
         );
         if (effective.action === "block") continue;
@@ -6215,10 +6332,9 @@ var createExecutor = (config) => Effect8.gen(function* () {
       const tool2 = staticToolToTool(entry);
       if (!matchesToolFilter(tool2, filter)) continue;
       if (!includeBlocked) {
-        const effective = resolveEffectivePolicy(
+        const effective = yield* resolvePolicyFromRuleSet(
           normalizedPolicyId(tool2),
-          policyRows,
-          ownerRankForRow,
+          policyRules,
           tool2.annotations?.requiresApproval
         );
         if (effective.action === "block") continue;
@@ -6228,9 +6344,16 @@ var createExecutor = (config) => Effect8.gen(function* () {
     return tools;
   });
   const toolSchema = (address) => Effect8.gen(function* () {
+    const policyRules = yield* listActivePolicyRuleSet();
     const staticEntry = staticTools.get(String(address));
     if (staticEntry) {
       const tool3 = staticToolToTool(staticEntry);
+      const effective2 = yield* resolvePolicyFromRuleSet(
+        normalizedPolicyId(tool3),
+        policyRules,
+        tool3.annotations?.requiresApproval
+      );
+      if (effective2.action === "block") return null;
       const preview2 = yield* Effect8.tryPromise({
         try: () => buildToolTypeScriptPreview({
           inputSchema: tool3.inputSchema,
@@ -6262,6 +6385,12 @@ var createExecutor = (config) => Effect8.gen(function* () {
     });
     if (!row) return null;
     const tool2 = rowToTool(row);
+    const effective = yield* resolvePolicyFromRuleSet(
+      normalizedPolicyId(tool2),
+      policyRules,
+      tool2.annotations?.requiresApproval
+    );
+    if (effective.action === "block") return null;
     const definitionRows = yield* core.findMany("definition", {
       where: (b) => b.and(
         byOwner(parsed.owner)(b),
@@ -6482,11 +6611,10 @@ ${approvalArgumentPreview(args)}`,
       );
       const staticEntry = staticTools.get(String(address));
       if (staticEntry) {
-        const policyRows2 = yield* core.findMany("tool_policy", {});
-        const policy2 = resolveEffectivePolicy(
+        const policyRules2 = yield* listActivePolicyRuleSet();
+        const policy2 = yield* resolvePolicyFromRuleSet(
           String(address),
-          policyRows2,
-          ownerRankForRow,
+          policyRules2,
           staticEntry.tool.annotations?.requiresApproval
         );
         if (policy2.action === "block") {
@@ -6526,12 +6654,11 @@ ${approvalArgumentPreview(args)}`,
         });
       }
       const toolForPolicy = rowToTool(row);
-      const policyRows = yield* core.findMany("tool_policy", {});
+      const policyRules = yield* listActivePolicyRuleSet();
       const annotations = decodeJsonColumn(row.annotations);
-      const policy = resolveEffectivePolicy(
+      const policy = yield* resolvePolicyFromRuleSet(
         normalizedPolicyId(toolForPolicy),
-        policyRows,
-        ownerRankForRow,
+        policyRules,
         annotations?.requiresApproval
       );
       if (policy.action === "block") {
@@ -6620,21 +6747,22 @@ ${approvalArgumentPreview(args)}`,
     ownedKeys: (owner) => ownedKeys(owner),
     defaultWritableProvider,
     mintOAuthConnection: (input) => mintOAuthConnection(input),
-    // Resolve the integration's DECLARED oauth scopes for a (integration,
-    // template): load the row, run the owning plugin's auth-method projector,
-    // and return the matching oauth method's declared `oauth.scopes`. Drives
-    // the union-with-client-scopes request in `oauth.start` so reusing a narrow
-    // client on a broad integration still requests the integration's full
-    // scope set. Empty (no row / no oauth method / no declared scopes) ⇒ the
-    // union collapses to the client's scopes (current behavior).
-    resolveDeclaredOAuthScopes: (integration, template) => findIntegrationRow(integration).pipe(
+    // One integration-row read + one projector run. Resolve the method this
+    // template selects exactly as the runtime's `selectAuthMethod` does —
+    // exact slug match, else the sole declared method (single-method
+    // integrations accept any slug); an ambiguous miss selects nothing rather
+    // than guessing across methods. The discover-vs-scopes choice then reads
+    // off that method (MCP exposes `discoveryUrl`), so core needs no plugin-id
+    // knowledge.
+    resolveOAuthScopePolicy: (integration, template) => findIntegrationRow(integration).pipe(
       Effect8.map((row) => {
-        if (!row) return [];
-        const methods = describeAuthMethodsForRow(row);
-        const match = methods.find(
-          (m) => m.kind === "oauth" && m.template === String(template)
-        ) ?? methods.find((m) => m.kind === "oauth");
-        return match?.oauth?.scopes ?? [];
+        const methods = row ? describeAuthMethodsForRow(row) : [];
+        const selected = methods.find((m) => m.template === String(template)) ?? (methods.length === 1 ? methods[0] : void 0);
+        const oauth2 = selected?.kind === "oauth" ? selected.oauth : void 0;
+        if (oauth2?.scopes === void 0 && oauth2?.discoveryUrl !== void 0) {
+          return { kind: "discover" };
+        }
+        return { kind: "scopes", scopes: oauth2?.scopes ?? [] };
       })
     ),
     httpClientLayer: config.httpClientLayer,
@@ -6644,7 +6772,8 @@ ${approvalArgumentPreview(args)}`,
     // OAuth service receives `null` and redirect-requiring flows fail loudly
     // instead of silently using `http://127.0.0.1/callback`. Hosts that serve
     // OAuth (cloud, self-host) derive a real `${webBaseUrl}/oauth/callback`.
-    redirectUri: config.redirectUri ?? null
+    redirectUri: config.redirectUri ?? null,
+    callbackStateOrgSlug: config.oauthCallbackStateOrgSlug ?? null
   });
   const blobPartitions = {
     org: `o:${tenant}`,
@@ -6718,6 +6847,19 @@ ${approvalArgumentPreview(args)}`,
       oauth,
       transaction: (effect) => transaction(effect)
     };
+    if (plugin.toolPolicyProvider) {
+      const rawProvider = plugin.toolPolicyProvider(ctx);
+      const provider = Effect8.isEffect(rawProvider) ? yield* rawProvider : rawProvider;
+      if (provider) {
+        if (activeToolPolicyProvider) {
+          return yield* new StorageError({
+            message: "Only one plugin can provide the active tool policy source.",
+            cause: void 0
+          });
+        }
+        activeToolPolicyProvider = provider;
+      }
+    }
     const extension = plugin.extension ? plugin.extension(ctx) : {};
     if (plugin.extension) {
       extensions[plugin.id] = extension;
@@ -6845,8 +6987,6 @@ export {
   coreSchema,
   TOOL_POLICY_ACTIONS,
   isToolPolicyAction,
-  OAUTH2_PROVIDER_KEY,
-  OAUTH2_SESSION_TTL_MS,
   definePluginStorageCollection,
   pluginStorageId,
   buildToolTypeScriptPreview,
@@ -6862,4 +7002,4 @@ export {
   collectTables,
   createExecutor
 };
-//# sourceMappingURL=chunk-MYRPYTSV.js.map
+//# sourceMappingURL=chunk-GUZHNTDQ.js.map