@faable/faable 4.16.0 → 4.17.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Faable Cloud SLU
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/mcp/http.js

@@ -233,6 +233,15 @@ const create_http_server = (opts) => {
             if (req.method === 'GET' && url.pathname === '/llms.txt') {
                 return send(res, 200, llms_txt(base), 'text/plain; charset=utf-8');
             }
+            // ChatGPT app submission proves domain ownership by fetching this file;
+            // the token comes from the OpenAI platform, set as a secret of the app.
+            if (req.method === 'GET' &&
+                url.pathname === '/.well-known/openai-apps-challenge') {
+                const token = process.env.OPENAI_APPS_CHALLENGE?.trim();
+                return token
+                    ? send(res, 200, token, 'text/plain; charset=utf-8')
+                    : send(res, 404, { error: 'not_found' });
+            }
             // RFC 9728: at the root and with the resource path inserted (what MCP
             // clients derive from https://mcp.faable.com/mcp). Only with OAuth on.
             if (req.method === 'GET' &&

package/dist/mcp/oauth.js

@@ -20,9 +20,16 @@ import { verify, createPublicKey, createHash } from 'node:crypto';
 const AUTH_ISSUER = process.env.FAABLE_MCP_AUTH_ISSUER ?? 'https://faable.auth.faable.link';
 const oauth_enabled = () => !!process.env.FAABLE_MCP_CLIENT_ID && !!process.env.FAABLE_MCP_CLIENT_SECRET;
 // What the consent screen asks for on a first connection (Marc, 05-10:
-// reads plus deploy, like the hosted server by default). deploy:write comes
-// by step-up, the first time an agent calls a tool that needs it.
-const DEFAULT_SCOPES = ['deploy:read', 'deploy:deploy'];
+// reads plus deploy, like the hosted server by default; 18-10: plus the Auth
+// reads). deploy:write and auth:write come by step-up, the first time an
+// agent calls a tool that needs them. auth:read cannot: `tools/list` only
+// shows what the connection was allowed, so without it the Auth tools never
+// appear and no call ever asks for it (backlog §373).
+const DEFAULT_SCOPES = [
+    'deploy:read',
+    'deploy:deploy',
+    'auth:read'
+];
 const ALL_SCOPES = [
     'deploy:read',
     'deploy:deploy',

package/dist/mcp/tools.js

@@ -16,7 +16,11 @@ const target = (a) => ['--app', a.app, ...scope(a)];
 const opt = (flag, value) => value === undefined || value === null || value === ''
     ? []
     : [flag, String(value)];
-const READ = { readOnlyHint: true, openWorldHint: true };
+const READ = {
+    readOnlyHint: true,
+    destructiveHint: false,
+    openWorldHint: true
+};
 // A value as a double-quoted .env value, escaping exactly what parse_env
 // (src/commands/deploy/secrets/parse_env.ts) unescapes — no more: JSON's
 // \b, \f or \uXXXX would arrive as literal text.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "4.16.0",
+  "version": "4.17.1",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",