npm - @graphoria/server - Versions diffs - 0.3.0 → 0.5.0 - Mend

@graphoria/server 0.3.0 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (203) hide show

package/README.md +28 -20
package/dist/src/ai/mcp/index.d.ts +9 -2
package/dist/src/ai/mcp/index.d.ts.map +1 -1
package/dist/src/analyzeQuery/analyzers/selectionAnalyzer.d.ts.map +1 -1
package/dist/src/analyzeQuery/depthLimit.d.ts +1 -13
package/dist/src/analyzeQuery/depthLimit.d.ts.map +1 -1
package/dist/src/authentication/capabilities.d.ts +18 -0
package/dist/src/authentication/capabilities.d.ts.map +1 -0
package/dist/src/authentication/capabilities.test.d.ts +2 -0
package/dist/src/authentication/capabilities.test.d.ts.map +1 -0
package/dist/src/authentication/jwt.d.ts.map +1 -1
package/dist/src/authentication/paseto.d.ts.map +1 -1
package/dist/src/authentication/secrets.d.ts +9 -0
package/dist/src/authentication/secrets.d.ts.map +1 -0
package/dist/src/authentication/secrets.test.d.ts +2 -0
package/dist/src/authentication/secrets.test.d.ts.map +1 -0
package/dist/src/authentication/tokenRepository.d.ts.map +1 -1
package/dist/src/config/types/db.d.ts +25 -0
package/dist/src/config/types/db.d.ts.map +1 -1
package/dist/src/configuration/getSchemas/index.d.ts +40 -2
package/dist/src/configuration/getSchemas/index.d.ts.map +1 -1
package/dist/src/configuration/getSchemas/mergeEntities/index.d.ts +20 -1
package/dist/src/configuration/getSchemas/mergeEntities/index.d.ts.map +1 -1
package/dist/src/configuration/gql/gqlAuthOperations.d.ts.map +1 -1
package/dist/src/configuration/gql/handleGraphQLRequestFactory.d.ts.map +1 -1
package/dist/src/configuration/gql/handleGraphQLSubscriptionFactory.d.ts.map +1 -1
package/dist/src/configuration/index.d.ts +30 -1
package/dist/src/configuration/index.d.ts.map +1 -1
package/dist/src/configuration/rest/generateOpenAPI.d.ts.map +1 -1
package/dist/src/configuration/rest/generateOpenAPI.test.d.ts +2 -0
package/dist/src/configuration/rest/generateOpenAPI.test.d.ts.map +1 -0
package/dist/src/configuration/rest/handleRESTRequestFactory.d.ts.map +1 -1
package/dist/src/console/api.d.ts.map +1 -1
package/dist/src/console/session.d.ts +12 -4
package/dist/src/console/session.d.ts.map +1 -1
package/dist/src/cron/index.d.ts.map +1 -1
package/dist/src/databases/common.d.ts +20 -6
package/dist/src/databases/common.d.ts.map +1 -1
package/dist/src/databases/core/executor.d.ts +4 -6
package/dist/src/databases/core/executor.d.ts.map +1 -1
package/dist/src/databases/core/function-mapping.d.ts +2 -3
package/dist/src/databases/core/function-mapping.d.ts.map +1 -1
package/dist/src/databases/core/procedure-arguments.d.ts +17 -0
package/dist/src/databases/core/procedure-arguments.d.ts.map +1 -0
package/dist/src/databases/core/procedure-arguments.test.d.ts +2 -0
package/dist/src/databases/core/procedure-arguments.test.d.ts.map +1 -0
package/dist/src/databases/core/query-builder.d.ts +5 -0
package/dist/src/databases/core/query-builder.d.ts.map +1 -1
package/dist/src/databases/engines/mssql/connection.d.ts +1 -1
package/dist/src/databases/engines/mssql/connection.d.ts.map +1 -1
package/dist/src/databases/engines/mssql/getStructure.d.ts +5 -0
package/dist/src/databases/engines/mssql/getStructure.d.ts.map +1 -1
package/dist/src/databases/engines/mssql/query/index.d.ts +2 -2
package/dist/src/databases/engines/mssql/query/index.d.ts.map +1 -1
package/dist/src/databases/engines/mysql/connection.d.ts +1 -1
package/dist/src/databases/engines/mysql/connection.d.ts.map +1 -1
package/dist/src/databases/engines/mysql/getStructure.d.ts +5 -0
package/dist/src/databases/engines/mysql/getStructure.d.ts.map +1 -1
package/dist/src/databases/engines/mysql/query/index.d.ts +2 -2
package/dist/src/databases/engines/mysql/query/index.d.ts.map +1 -1
package/dist/src/databases/engines/postgresql/connection.d.ts +1 -1
package/dist/src/databases/engines/postgresql/connection.d.ts.map +1 -1
package/dist/src/databases/engines/postgresql/getStructure.d.ts +5 -0
package/dist/src/databases/engines/postgresql/getStructure.d.ts.map +1 -1
package/dist/src/databases/engines/postgresql/query/index.d.ts +2 -2
package/dist/src/databases/engines/postgresql/query/index.d.ts.map +1 -1
package/dist/src/databases/high-level-operations.d.ts +5 -0
package/dist/src/databases/high-level-operations.d.ts.map +1 -1
package/dist/src/databases/metadata/structure.d.ts +5 -0
package/dist/src/databases/metadata/structure.d.ts.map +1 -1
package/dist/src/databases/transformers/data-transformers.d.ts +30 -0
package/dist/src/databases/transformers/data-transformers.d.ts.map +1 -1
package/dist/src/index.d.ts +4 -0
package/dist/src/index.d.ts.map +1 -1
package/dist/src/logging/audit.d.ts +27 -0
package/dist/src/logging/audit.d.ts.map +1 -0
package/dist/src/logging/audit.test.d.ts +2 -0
package/dist/src/logging/audit.test.d.ts.map +1 -0
package/dist/src/logging/slowQuery.d.ts +29 -0
package/dist/src/logging/slowQuery.d.ts.map +1 -0
package/dist/src/logging/slowQuery.test.d.ts +2 -0
package/dist/src/logging/slowQuery.test.d.ts.map +1 -0
package/dist/src/observability/health.d.ts +23 -0
package/dist/src/observability/health.d.ts.map +1 -0
package/dist/src/observability/health.test.d.ts +2 -0
package/dist/src/observability/health.test.d.ts.map +1 -0
package/dist/src/observability/httpMetrics.d.ts +7 -0
package/dist/src/observability/httpMetrics.d.ts.map +1 -0
package/dist/src/observability/httpMetrics.test.d.ts +2 -0
package/dist/src/observability/httpMetrics.test.d.ts.map +1 -0
package/dist/src/observability/httpTracing.d.ts +11 -0
package/dist/src/observability/httpTracing.d.ts.map +1 -0
package/dist/src/observability/httpTracing.test.d.ts +2 -0
package/dist/src/observability/httpTracing.test.d.ts.map +1 -0
package/dist/src/observability/metrics.d.ts +81 -0
package/dist/src/observability/metrics.d.ts.map +1 -0
package/dist/src/observability/metrics.perf.test.d.ts +2 -0
package/dist/src/observability/metrics.perf.test.d.ts.map +1 -0
package/dist/src/observability/metrics.test.d.ts +2 -0
package/dist/src/observability/metrics.test.d.ts.map +1 -0
package/dist/src/observability/metricsRoute.d.ts +19 -0
package/dist/src/observability/metricsRoute.d.ts.map +1 -0
package/dist/src/observability/metricsRoute.test.d.ts +2 -0
package/dist/src/observability/metricsRoute.test.d.ts.map +1 -0
package/dist/src/observability/tracing.d.ts +92 -0
package/dist/src/observability/tracing.d.ts.map +1 -0
package/dist/src/observability/tracing.perf.test.d.ts +2 -0
package/dist/src/observability/tracing.perf.test.d.ts.map +1 -0
package/dist/src/observability/tracing.test.d.ts +2 -0
package/dist/src/observability/tracing.test.d.ts.map +1 -0
package/dist/src/queues/kafka.d.ts +6 -0
package/dist/src/queues/kafka.d.ts.map +1 -1
package/dist/src/queues/kafka.test.d.ts +2 -0
package/dist/src/queues/kafka.test.d.ts.map +1 -0
package/dist/src/queues/rabbitmq.d.ts.map +1 -1
package/dist/src/remoteREST/proxy.d.ts.map +1 -1
package/dist/src/remoteSchemas/proxy.d.ts.map +1 -1
package/dist/src/singletons/cache/redisClient.d.ts +2 -2
package/dist/src/singletons/cache/redisClient.d.ts.map +1 -1
package/dist/src/singletons/databases.d.ts +1 -0
package/dist/src/singletons/databases.d.ts.map +1 -1
package/dist/src/singletons/env.d.ts +37 -4
package/dist/src/singletons/env.d.ts.map +1 -1
package/dist/src/singletons/queues.d.ts +1 -0
package/dist/src/singletons/queues.d.ts.map +1 -1
package/dist/src/subscriptions/strategies/database.d.ts.map +1 -1
package/dist/src/subscriptions/utils/polling.d.ts +1 -0
package/dist/src/subscriptions/utils/polling.d.ts.map +1 -1
package/dist/src/subscriptions/utils/polling.test.d.ts +2 -0
package/dist/src/subscriptions/utils/polling.test.d.ts.map +1 -0
package/dist/src/types/env.d.ts +113 -12
package/dist/src/types/env.d.ts.map +1 -1
package/dist/src/types/zod/configuration.d.ts +25 -0
package/dist/src/types/zod/configuration.d.ts.map +1 -1
package/dist/src/types/zod/db.d.ts +85 -0
package/dist/src/types/zod/db.d.ts.map +1 -1
package/dist/src/utils/rateLimit.d.ts.map +1 -1
package/dist/src/utils/redis.d.ts +17 -0
package/dist/src/utils/redis.d.ts.map +1 -0
package/dist/src/utils/redis.test.d.ts +2 -0
package/dist/src/utils/redis.test.d.ts.map +1 -0
package/dist/src/utils/responses.d.ts +6 -0
package/dist/src/utils/responses.d.ts.map +1 -1
package/dist/src/utils/sessionVariables.d.ts +2 -0
package/dist/src/utils/sessionVariables.d.ts.map +1 -1
package/dist/tsconfig.tsbuildinfo +1 -1
package/package.json +8 -5
package/playgrounds/console/index.html +9 -9
package/playgrounds/graphiql/index.html +549 -686
package/playgrounds/scalar/index.html +1 -1
package/src/ai/mcp/index.ts +19 -14
package/src/analyzeQuery/analyzers/selectionAnalyzer.ts +2 -1
package/src/analyzeQuery/depthLimit.ts +15 -5
package/src/authentication/capabilities.ts +56 -0
package/src/authentication/index.ts +3 -3
package/src/authentication/jwt.ts +30 -25
package/src/authentication/paseto.ts +36 -26
package/src/authentication/secrets.ts +30 -0
package/src/authentication/tokenRepository.ts +2 -3
package/src/config/types/db.ts +16 -2
package/src/configuration/getSchemas/mergeEntities/index.ts +0 -26
package/src/configuration/gql/gqlAuthOperations.ts +26 -0
package/src/configuration/gql/handleGraphQLRequestFactory.ts +241 -148
package/src/configuration/gql/handleGraphQLSubscriptionFactory.ts +9 -0
package/src/configuration/rest/generateOpenAPI.ts +61 -11
package/src/configuration/rest/handleRESTRequestFactory.ts +26 -0
package/src/console/api.ts +64 -24
package/src/console/session.ts +30 -26
package/src/cron/index.ts +59 -36
package/src/databases/common.ts +109 -10
package/src/databases/core/executor.ts +97 -20
package/src/databases/core/function-mapping.ts +1 -2
package/src/databases/core/procedure-arguments.ts +25 -0
package/src/databases/engines/mssql/connection.ts +0 -3
package/src/databases/engines/mssql/query/index.ts +4 -1
package/src/databases/engines/mysql/connection.ts +10 -7
package/src/databases/engines/mysql/query/index.ts +5 -2
package/src/databases/engines/postgresql/connection.ts +10 -7
package/src/databases/engines/postgresql/query/index.ts +5 -2
package/src/databases/high-level-operations.ts +44 -2
package/src/index.ts +200 -76
package/src/logging/audit.ts +86 -0
package/src/logging/slowQuery.ts +59 -0
package/src/observability/health.ts +67 -0
package/src/observability/httpMetrics.ts +37 -0
package/src/observability/httpTracing.ts +48 -0
package/src/observability/metrics.ts +243 -0
package/src/observability/metricsRoute.ts +33 -0
package/src/observability/tracing.ts +421 -0
package/src/queues/kafka.ts +45 -2
package/src/queues/rabbitmq.ts +37 -1
package/src/remoteREST/proxy.ts +17 -0
package/src/remoteSchemas/proxy.ts +17 -0
package/src/singletons/cache/redisClient.ts +4 -5
package/src/singletons/databases.ts +5 -0
package/src/singletons/queues.ts +9 -3
package/src/subscriptions/strategies/database.ts +2 -0
package/src/subscriptions/utils/polling.ts +80 -21
package/src/types/env.ts +53 -8
package/src/utils/rateLimit.ts +6 -1
package/src/utils/redis.ts +71 -0
package/src/utils/responses.ts +12 -0
package/src/utils/sessionVariables.ts +2 -0

package/playgrounds/scalar/index.html CHANGED Viewed

@@ -2,7 +2,7 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    <link rel="icon" type="image/svg+xml" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI0OCIgaGVpZ2h0PSI0NiIgZmlsbD0ibm9uZSIgdmlld0JveD0iMCAwIDQ4IDQ2Ij48cGF0aCBmaWxsPSIjODYzYmZmIiBkPSJNMjUuOTQ2IDQ0LjkzOGMtLjY2NC44NDUtMi4wMjEuMzc1LTIuMDIxLS42OThWMzMuOTM3YTIuMjYgMi4yNiAwIDAgMC0yLjI2Mi0yLjI2MkgxMC4yODdjLS45MiAwLTEuNDU2LTEuMDQtLjkyLTEuNzg4bDcuNDgtMTAuNDcxYzEuMDctMS40OTcgMC0zLjU3OC0xLjg0Mi0zLjU3OEgxLjIzN2MtLjkyIDAtMS40NTYtMS4wNC0uOTItMS43ODhMMTAuMDEzLjQ3NGMuMjE0LS4yOTcuNTU2LS40NzQuOTItLjQ3NGgyOC44OTRjLjkyIDAgMS40NTYgMS4wNC45MiAxLjc4OGwtNy40OCAxMC40NzFjLTEuMDcgMS40OTggMCAzLjU3OSAxLjg0MiAzLjU3OWgxMS4zNzdjLjk0MyAwIDEuNDczIDEuMDg4Ljg5IDEuODNMMjUuOTQ3IDQ0Ljk0eiIgc3R5bGU9ImZpbGw6Izg2M2JmZjtmaWxsOmNvbG9yKGRpc3BsYXktcDMgLjUyNTIgLjIzIDEpO2ZpbGwtb3BhY2l0eToxIi8+PG1hc2sgaWQ9ImEiIHdpZHRoPSI0OCIgaGVpZ2h0PSI0NiIgeD0iMCIgeT0iMCIgbWFza1VuaXRzPSJ1c2VyU3BhY2VPblVzZSIgc3R5bGU9Im1hc2stdHlwZTphbHBoYSI+PHBhdGggZmlsbD0iIzAwMCIgZD0iTTI1Ljg0MiA0NC45MzhjLS42NjQuODQ0LTIuMDIxLjM3NS0yLjAyMS0uNjk4VjMzLjkzN2EyLjI2IDIuMjYgMCAwIDAtMi4yNjItMi4yNjJIMTAuMTgzYy0uOTIgMC0xLjQ1Ni0xLjA0LS45Mi0xLjc4OGw3LjQ4LTEwLjQ3MWMxLjA3LTEuNDk4IDAtMy41NzktMS44NDItMy41NzlIMS4xMzNjLS45MiAwLTEuNDU2LTEuMDQtLjkyLTEuNzg3TDkuOTEuNDczYy4yMTQtLjI5Ny41NTYtLjQ3NC45Mi0uNDc0aDI4Ljg5NGMuOTIgMCAxLjQ1NiAxLjA0LjkyIDEuNzg4bC03LjQ4IDEwLjQ3MWMtMS4wNyAxLjQ5OCAwIDMuNTc4IDEuODQyIDMuNTc4aDExLjM3N2MuOTQzIDAgMS40NzMgMS4wODguODkgMS44MzJMMjUuODQzIDQ0Ljk0eiIgc3R5bGU9ImZpbGw6IzAwMDtmaWxsLW9wYWNpdHk6MSIvPjwvbWFzaz48ZyBtYXNrPSJ1cmwoI2EpIj48ZyBmaWx0ZXI9InVybCgjYikiPjxlbGxpcHNlIGN4PSI1LjUwOCIgY3k9IjE0LjcwNCIgZmlsbD0iI2VkZTZmZiIgcng9IjUuNTA4IiByeT0iMTQuNzA0IiBzdHlsZT0iZmlsbDojZWRlNmZmO2ZpbGw6Y29sb3IoZGlzcGxheS1wMyAuOTI3NSAuOTAzMyAxKTtmaWxsLW9wYWNpdHk6MSIgdHJhbnNmb3JtPSJtYXRyaXgoLjAwMzI0IDEgMSAtLjAwMzI0IC00LjQ3IDMxLjUxNikiLz48L2c+PGcgZmlsdGVyPSJ1cmwoI2MpIj48ZWxsaXBzZSBjeD0iMTAuMzk5IiBjeT0iMjkuODUxIiBmaWxsPSIjZWRlNmZmIiByeD0iMTAuMzk5IiByeT0iMjkuODUxIiBzdHlsZT0iZmlsbDojZWRlNmZmO2ZpbGw6Y29sb3IoZGlzcGxheS1wMyAuOTI3NSAuOTAzMyAxKTtmaWxsLW9wYWNpdHk6MSIgdHJhbnNmb3JtPSJtYXRyaXgoLjAwMzI0IDEgMSAtLjAwMzI0IC0zOS4zMjggNy44ODMpIi8+PC9nPjxnIGZpbHRlcj0idXJsKCNkKSI+PGVsbGlwc2UgY3g9IjUuNTA4IiBjeT0iMzAuNDg3IiBmaWxsPSIjN2UxNGZmIiByeD0iNS41MDgiIHJ5PSIzMC40ODciIHN0eWxlPSJmaWxsOiM3ZTE0ZmY7ZmlsbDpjb2xvcihkaXNwbGF5LXAzIC40OTIyIC4wNzY3IDEpO2ZpbGwtb3BhY2l0eToxIiB0cmFuc2Zvcm09InJvdGF0ZSg4OS44MTQgLTI1LjkxMyAtMTQuNjM5KXNjYWxlKDEgLTEpIi8+PC9nPjxnIGZpbHRlcj0idXJsKCNlKSI+PGVsbGlwc2UgY3g9IjUuNTA4IiBjeT0iMzAuNTk5IiBmaWxsPSIjN2UxNGZmIiByeD0iNS41MDgiIHJ5PSIzMC41OTkiIHN0eWxlPSJmaWxsOiM3ZTE0ZmY7ZmlsbDpjb2xvcihkaXNwbGF5LXAzIC40OTIyIC4wNzY3IDEpO2ZpbGwtb3BhY2l0eToxIiB0cmFuc2Zvcm09InJvdGF0ZSg4OS44MTQgLTMyLjY0NCAtMy4zMzQpc2NhbGUoMSAtMSkiLz48L2c+PGcgZmlsdGVyPSJ1cmwoI2YpIj48ZWxsaXBzZSBjeD0iNS41MDgiIGN5PSIzMC41OTkiIGZpbGw9IiM3ZTE0ZmYiIHJ4PSI1LjUwOCIgcnk9IjMwLjU5OSIgc3R5bGU9ImZpbGw6IzdlMTRmZjtmaWxsOmNvbG9yKGRpc3BsYXktcDMgLjQ5MjIgLjA3NjcgMSk7ZmlsbC1vcGFjaXR5OjEiIHRyYW5zZm9ybT0ibWF0cml4KC4wMDMyNCAxIDEgLS4wMDMyNCAtMzQuMzQgMzAuNDcpIi8+PC9nPjxnIGZpbHRlcj0idXJsKCNnKSI+PGVsbGlwc2UgY3g9IjE0LjA3MiIgY3k9IjIyLjA3OCIgZmlsbD0iI2VkZTZmZiIgcng9IjE0LjA3MiIgcnk9IjIyLjA3OCIgc3R5bGU9ImZpbGw6I2VkZTZmZjtmaWxsOmNvbG9yKGRpc3BsYXktcDMgLjkyNzUgLjkwMzMgMSk7ZmlsbC1vcGFjaXR5OjEiIHRyYW5zZm9ybT0icm90YXRlKDkzLjM1IDI0LjUwNiA0OC40OTMpc2NhbGUoLTEgMSkiLz48L2c+PGcgZmlsdGVyPSJ1cmwoI2gpIj48ZWxsaXBzZSBjeD0iMy40NyIgY3k9IjIxLjUwMSIgZmlsbD0iIzdlMTRmZiIgcng9IjMuNDciIHJ5PSIyMS41MDEiIHN0eWxlPSJmaWxsOiM3ZTE0ZmY7ZmlsbDpjb2xvcihkaXNwbGF5LXAzIC40OTIyIC4wNzY3IDEpO2ZpbGwtb3BhY2l0eToxIiB0cmFuc2Zvcm09InJvdGF0ZSg4OS4wMDkgMjguNzA4IDQ3LjU5KXNjYWxlKC0xIDEpIi8+PC9nPjxnIGZpbHRlcj0idXJsKCNpKSI+PGVsbGlwc2UgY3g9IjMuNDciIGN5PSIyMS41MDEiIGZpbGw9IiM3ZTE0ZmYiIHJ4PSIzLjQ3IiByeT0iMjEuNTAxIiBzdHlsZT0iZmlsbDojN2UxNGZmO2ZpbGw6Y29sb3IoZGlzcGxheS1wMyAuNDkyMiAuMDc2NyAxKTtmaWxsLW9wYWNpdHk6MSIgdHJhbnNmb3JtPSJyb3RhdGUoODkuMDA5IDI4LjcwOCA0Ny41OSlzY2FsZSgtMSAxKSIvPjwvZz48ZyBmaWx0ZXI9InVybCgjaikiPjxlbGxpcHNlIGN4PSIuMzg3IiBjeT0iOC45NzIiIGZpbGw9IiM3ZTE0ZmYiIHJ4PSI0LjQwNyIgcnk9IjI5LjEwOCIgc3R5bGU9ImZpbGw6IzdlMTRmZjtmaWxsOmNvbG9yKGRpc3BsYXktcDMgLjQ5MjIgLjA3NjcgMSk7ZmlsbC1vcGFjaXR5OjEiIHRyYW5zZm9ybT0icm90YXRlKDM5LjUxIC4zODcgOC45NzIpIi8+PC9nPjxnIGZpbHRlcj0idXJsKCNrKSI+PGVsbGlwc2UgY3g9IjQ3LjUyMyIgY3k9Ii02LjA5MiIgZmlsbD0iIzdlMTRmZiIgcng9IjQuNDA3IiByeT0iMjkuMTA4IiBzdHlsZT0iZmlsbDojN2UxNGZmO2ZpbGw6Y29sb3IoZGlzcGxheS1wMyAuNDkyMiAuMDc2NyAxKTtmaWxsLW9wYWNpdHk6MSIgdHJhbnNmb3JtPSJyb3RhdGUoMzcuODkyIDQ3LjUyMyAtNi4wOTIpIi8+PC9nPjxnIGZpbHRlcj0idXJsKCNsKSI+PGVsbGlwc2UgY3g9IjQxLjQxMiIgY3k9IjYuMzMzIiBmaWxsPSIjNDdiZmZmIiByeD0iNS45NzEiIHJ5PSI5LjY2NSIgc3R5bGU9ImZpbGw6IzQ3YmZmZjtmaWxsOmNvbG9yKGRpc3BsYXktcDMgLjI3OTkgLjc0OCAxKTtmaWxsLW9wYWNpdHk6MSIgdHJhbnNmb3JtPSJyb3RhdGUoMzcuODkyIDQxLjQxMiA2LjMzMykiLz48L2c+PGcgZmlsdGVyPSJ1cmwoI20pIj48ZWxsaXBzZSBjeD0iLTEuODc5IiBjeT0iMzguMzMyIiBmaWxsPSIjN2UxNGZmIiByeD0iNC40MDciIHJ5PSIyOS4xMDgiIHN0eWxlPSJmaWxsOiM3ZTE0ZmY7ZmlsbDpjb2xvcihkaXNwbGF5LXAzIC40OTIyIC4wNzY3IDEpO2ZpbGwtb3BhY2l0eToxIiB0cmFuc2Zvcm09InJvdGF0ZSgzNy44OTIgLTEuODggMzguMzMyKSIvPjwvZz48ZyBmaWx0ZXI9InVybCgjbikiPjxlbGxpcHNlIGN4PSItMS44NzkiIGN5PSIzOC4zMzIiIGZpbGw9IiM3ZTE0ZmYiIHJ4PSI0LjQwNyIgcnk9IjI5LjEwOCIgc3R5bGU9ImZpbGw6IzdlMTRmZjtmaWxsOmNvbG9yKGRpc3BsYXktcDMgLjQ5MjIgLjA3NjcgMSk7ZmlsbC1vcGFjaXR5OjEiIHRyYW5zZm9ybT0icm90YXRlKDM3Ljg5MiAtMS44OCAzOC4zMzIpIi8+PC9nPjxnIGZpbHRlcj0idXJsKCNvKSI+PGVsbGlwc2UgY3g9IjM1LjY1MSIgY3k9IjI5LjkwNyIgZmlsbD0iIzdlMTRmZiIgcng9IjQuNDA3IiByeT0iMjkuMTA4IiBzdHlsZT0iZmlsbDojN2UxNGZmO2ZpbGw6Y29sb3IoZGlzcGxheS1wMyAuNDkyMiAuMDc2NyAxKTtmaWxsLW9wYWNpdHk6MSIgdHJhbnNmb3JtPSJyb3RhdGUoMzcuODkyIDM1LjY1MSAyOS45MDcpIi8+PC9nPjxnIGZpbHRlcj0idXJsKCNwKSI+PGVsbGlwc2UgY3g9IjM4LjQxOCIgY3k9IjMyLjQiIGZpbGw9IiM0N2JmZmYiIHJ4PSI1Ljk3MSIgcnk9IjE1LjI5NyIgc3R5bGU9ImZpbGw6IzQ3YmZmZjtmaWxsOmNvbG9yKGRpc3BsYXktcDMgLjI3OTkgLjc0OCAxKTtmaWxsLW9wYWNpdHk6MSIgdHJhbnNmb3JtPSJyb3RhdGUoMzcuODkyIDM4LjQxOCAzMi40KSIvPjwvZz48L2c+PGRlZnM+PGZpbHRlciBpZD0iYiIgd2lkdGg9IjYwLjA0NSIgaGVpZ2h0PSI0MS42NTQiIHg9Ii0xOS43NyIgeT0iMTYuMTQ5IiBjb2xvci1pbnRlcnBvbGF0aW9uLWZpbHRlcnM9InNSR0IiIGZpbHRlclVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+PGZlRmxvb2QgZmxvb2Qtb3BhY2l0eT0iMCIgcmVzdWx0PSJCYWNrZ3JvdW5kSW1hZ2VGaXgiLz48ZmVCbGVuZCBpbj0iU291cmNlR3JhcGhpYyIgaW4yPSJCYWNrZ3JvdW5kSW1hZ2VGaXgiIHJlc3VsdD0ic2hhcGUiLz48ZmVHYXVzc2lhbkJsdXIgcmVzdWx0PSJlZmZlY3QxX2ZvcmVncm91bmRCbHVyXzIwMDJfMTcxNTgiIHN0ZERldmlhdGlvbj0iNy42NTkiLz48L2ZpbHRlcj48ZmlsdGVyIGlkPSJjIiB3aWR0aD0iOTAuMzQiIGhlaWdodD0iNTEuNDM3IiB4PSItNTQuNjEzIiB5PSItNy41MzMiIGNvbG9yLWludGVycG9sYXRpb24tZmlsdGVycz0ic1JHQiIgZmlsdGVyVW5pdHM9InVzZXJTcGFjZU9uVXNlIj48ZmVGbG9vZCBmbG9vZC1vcGFjaXR5PSIwIiByZXN1bHQ9IkJhY2tncm91bmRJbWFnZUZpeCIvPjxmZUJsZW5kIGluPSJTb3VyY2VHcmFwaGljIiBpbjI9IkJhY2tncm91bmRJbWFnZUZpeCIgcmVzdWx0PSJzaGFwZSIvPjxmZUdhdXNzaWFuQmx1ciByZXN1bHQ9ImVmZmVjdDFfZm9yZWdyb3VuZEJsdXJfMjAwMl8xNzE1OCIgc3RkRGV2aWF0aW9uPSI3LjY1OSIvPjwvZmlsdGVyPjxmaWx0ZXIgaWQ9ImQiIHdpZHRoPSI3OS4zNTUiIGhlaWdodD0iMjkuNCIgeD0iLTQ5LjY0IiB5PSIyLjAzIiBjb2xvci1pbnRlcnBvbGF0aW9uLWZpbHRlcnM9InNSR0IiIGZpbHRlclVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+PGZlRmxvb2QgZmxvb2Qtb3BhY2l0eT0iMCIgcmVzdWx0PSJCYWNrZ3JvdW5kSW1hZ2VGaXgiLz48ZmVCbGVuZCBpbj0iU291cmNlR3JhcGhpYyIgaW4yPSJCYWNrZ3JvdW5kSW1hZ2VGaXgiIHJlc3VsdD0ic2hhcGUiLz48ZmVHYXVzc2lhbkJsdXIgcmVzdWx0PSJlZmZlY3QxX2ZvcmVncm91bmRCbHVyXzIwMDJfMTcxNTgiIHN0ZERldmlhdGlvbj0iNC41OTYiLz48L2ZpbHRlcj48ZmlsdGVyIGlkPSJlIiB3aWR0aD0iNzkuNTc5IiBoZWlnaHQ9IjI5LjQiIHg9Ii00NS4wNDUiIHk9IjIwLjAyOSIgY29sb3ItaW50ZXJwb2xhdGlvbi1maWx0ZXJzPSJzUkdCIiBmaWx0ZXJVbml0cz0idXNlclNwYWNlT25Vc2UiPjxmZUZsb29kIGZsb29kLW9wYWNpdHk9IjAiIHJlc3VsdD0iQmFja2dyb3VuZEltYWdlRml4Ii8+PGZlQmxlbmQgaW49IlNvdXJjZUdyYXBoaWMiIGluMj0iQmFja2dyb3VuZEltYWdlRml4IiByZXN1bHQ9InNoYXBlIi8+PGZlR2F1c3NpYW5CbHVyIHJlc3VsdD0iZWZmZWN0MV9mb3JlZ3JvdW5kQmx1cl8yMDAyXzE3MTU4IiBzdGREZXZpYXRpb249IjQuNTk2Ii8+PC9maWx0ZXI+PGZpbHRlciBpZD0iZiIgd2lkdGg9Ijc5LjU3OSIgaGVpZ2h0PSIyOS40IiB4PSItNDMuNTEzIiB5PSIyMS4xNzgiIGNvbG9yLWludGVycG9sYXRpb24tZmlsdGVycz0ic1JHQiIgZmlsdGVyVW5pdHM9InVzZXJTcGFjZU9uVXNlIj48ZmVGbG9vZCBmbG9vZC1vcGFjaXR5PSIwIiByZXN1bHQ9IkJhY2tncm91bmRJbWFnZUZpeCIvPjxmZUJsZW5kIGluPSJTb3VyY2VHcmFwaGljIiBpbjI9IkJhY2tncm91bmRJbWFnZUZpeCIgcmVzdWx0PSJzaGFwZSIvPjxmZUdhdXNzaWFuQmx1ciByZXN1bHQ9ImVmZmVjdDFfZm9yZWdyb3VuZEJsdXJfMjAwMl8xNzE1OCIgc3RkRGV2aWF0aW9uPSI0LjU5NiIvPjwvZmlsdGVyPjxmaWx0ZXIgaWQ9ImciIHdpZHRoPSI3NC43NDkiIGhlaWdodD0iNTguODUyIiB4PSIxNS43NTYiIHk9Ii0xNy45MDEiIGNvbG9yLWludGVycG9sYXRpb24tZmlsdGVycz0ic1JHQiIgZmlsdGVyVW5pdHM9InVzZXJTcGFjZU9uVXNlIj48ZmVGbG9vZCBmbG9vZC1vcGFjaXR5PSIwIiByZXN1bHQ9IkJhY2tncm91bmRJbWFnZUZpeCIvPjxmZUJsZW5kIGluPSJTb3VyY2VHcmFwaGljIiBpbjI9IkJhY2tncm91bmRJbWFnZUZpeCIgcmVzdWx0PSJzaGFwZSIvPjxmZUdhdXNzaWFuQmx1ciByZXN1bHQ9ImVmZmVjdDFfZm9yZWdyb3VuZEJsdXJfMjAwMl8xNzE1OCIgc3RkRGV2aWF0aW9uPSI3LjY1OSIvPjwvZmlsdGVyPjxmaWx0ZXIgaWQ9ImgiIHdpZHRoPSI2MS4zNzciIGhlaWdodD0iMjUuMzYyIiB4PSIyMy41NDgiIHk9IjIuMjg0IiBjb2xvci1pbnRlcnBvbGF0aW9uLWZpbHRlcnM9InNSR0IiIGZpbHRlclVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+PGZlRmxvb2QgZmxvb2Qtb3BhY2l0eT0iMCIgcmVzdWx0PSJCYWNrZ3JvdW5kSW1hZ2VGaXgiLz48ZmVCbGVuZCBpbj0iU291cmNlR3JhcGhpYyIgaW4yPSJCYWNrZ3JvdW5kSW1hZ2VGaXgiIHJlc3VsdD0ic2hhcGUiLz48ZmVHYXVzc2lhbkJsdXIgcmVzdWx0PSJlZmZlY3QxX2ZvcmVncm91bmRCbHVyXzIwMDJfMTcxNTgiIHN0ZERldmlhdGlvbj0iNC41OTYiLz48L2ZpbHRlcj48ZmlsdGVyIGlkPSJpIiB3aWR0aD0iNjEuMzc3IiBoZWlnaHQ9IjI1LjM2MiIgeD0iMjMuNTQ4IiB5PSIyLjI4NCIgY29sb3ItaW50ZXJwb2xhdGlvbi1maWx0ZXJzPSJzUkdCIiBmaWx0ZXJVbml0cz0idXNlclNwYWNlT25Vc2UiPjxmZUZsb29kIGZsb29kLW9wYWNpdHk9IjAiIHJlc3VsdD0iQmFja2dyb3VuZEltYWdlRml4Ii8+PGZlQmxlbmQgaW49IlNvdXJjZUdyYXBoaWMiIGluMj0iQmFja2dyb3VuZEltYWdlRml4IiByZXN1bHQ9InNoYXBlIi8+PGZlR2F1c3NpYW5CbHVyIHJlc3VsdD0iZWZmZWN0MV9mb3JlZ3JvdW5kQmx1cl8yMDAyXzE3MTU4IiBzdGREZXZpYXRpb249IjQuNTk2Ii8+PC9maWx0ZXI+PGZpbHRlciBpZD0iaiIgd2lkdGg9IjU2LjA0NSIgaGVpZ2h0PSI2My42NDkiIHg9Ii0yNy42MzYiIHk9Ii0yMi44NTMiIGNvbG9yLWludGVycG9sYXRpb24tZmlsdGVycz0ic1JHQiIgZmlsdGVyVW5pdHM9InVzZXJTcGFjZU9uVXNlIj48ZmVGbG9vZCBmbG9vZC1vcGFjaXR5PSIwIiByZXN1bHQ9IkJhY2tncm91bmRJbWFnZUZpeCIvPjxmZUJsZW5kIGluPSJTb3VyY2VHcmFwaGljIiBpbjI9IkJhY2tncm91bmRJbWFnZUZpeCIgcmVzdWx0PSJzaGFwZSIvPjxmZUdhdXNzaWFuQmx1ciByZXN1bHQ9ImVmZmVjdDFfZm9yZWdyb3VuZEJsdXJfMjAwMl8xNzE1OCIgc3RkRGV2aWF0aW9uPSI0LjU5NiIvPjwvZmlsdGVyPjxmaWx0ZXIgaWQ9ImsiIHdpZHRoPSI1NC44MTQiIGhlaWdodD0iNjQuNjQ2IiB4PSIyMC4xMTYiIHk9Ii0zOC40MTUiIGNvbG9yLWludGVycG9sYXRpb24tZmlsdGVycz0ic1JHQiIgZmlsdGVyVW5pdHM9InVzZXJTcGFjZU9uVXNlIj48ZmVGbG9vZCBmbG9vZC1vcGFjaXR5PSIwIiByZXN1bHQ9IkJhY2tncm91bmRJbWFnZUZpeCIvPjxmZUJsZW5kIGluPSJTb3VyY2VHcmFwaGljIiBpbjI9IkJhY2tncm91bmRJbWFnZUZpeCIgcmVzdWx0PSJzaGFwZSIvPjxmZUdhdXNzaWFuQmx1ciByZXN1bHQ9ImVmZmVjdDFfZm9yZWdyb3VuZEJsdXJfMjAwMl8xNzE1OCIgc3RkRGV2aWF0aW9uPSI0LjU5NiIvPjwvZmlsdGVyPjxmaWx0ZXIgaWQ9ImwiIHdpZHRoPSIzMy41NDEiIGhlaWdodD0iMzUuMzEzIiB4PSIyNC42NDEiIHk9Ii0xMS4zMjMiIGNvbG9yLWludGVycG9sYXRpb24tZmlsdGVycz0ic1JHQiIgZmlsdGVyVW5pdHM9InVzZXJTcGFjZU9uVXNlIj48ZmVGbG9vZCBmbG9vZC1vcGFjaXR5PSIwIiByZXN1bHQ9IkJhY2tncm91bmRJbWFnZUZpeCIvPjxmZUJsZW5kIGluPSJTb3VyY2VHcmFwaGljIiBpbjI9IkJhY2tncm91bmRJbWFnZUZpeCIgcmVzdWx0PSJzaGFwZSIvPjxmZUdhdXNzaWFuQmx1ciByZXN1bHQ9ImVmZmVjdDFfZm9yZWdyb3VuZEJsdXJfMjAwMl8xNzE1OCIgc3RkRGV2aWF0aW9uPSI0LjU5NiIvPjwvZmlsdGVyPjxmaWx0ZXIgaWQ9Im0iIHdpZHRoPSI1NC44MTQiIGhlaWdodD0iNjQuNjQ2IiB4PSItMjkuMjg2IiB5PSI2LjAwOSIgY29sb3ItaW50ZXJwb2xhdGlvbi1maWx0ZXJzPSJzUkdCIiBmaWx0ZXJVbml0cz0idXNlclNwYWNlT25Vc2UiPjxmZUZsb29kIGZsb29kLW9wYWNpdHk9IjAiIHJlc3VsdD0iQmFja2dyb3VuZEltYWdlRml4Ii8+PGZlQmxlbmQgaW49IlNvdXJjZUdyYXBoaWMiIGluMj0iQmFja2dyb3VuZEltYWdlRml4IiByZXN1bHQ9InNoYXBlIi8+PGZlR2F1c3NpYW5CbHVyIHJlc3VsdD0iZWZmZWN0MV9mb3JlZ3JvdW5kQmx1cl8yMDAyXzE3MTU4IiBzdGREZXZpYXRpb249IjQuNTk2Ii8+PC9maWx0ZXI+PGZpbHRlciBpZD0ibiIgd2lkdGg9IjU0LjgxNCIgaGVpZ2h0PSI2NC42NDYiIHg9Ii0yOS4yODYiIHk9IjYuMDA5IiBjb2xvci1pbnRlcnBvbGF0aW9uLWZpbHRlcnM9InNSR0IiIGZpbHRlclVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+PGZlRmxvb2QgZmxvb2Qtb3BhY2l0eT0iMCIgcmVzdWx0PSJCYWNrZ3JvdW5kSW1hZ2VGaXgiLz48ZmVCbGVuZCBpbj0iU291cmNlR3JhcGhpYyIgaW4yPSJCYWNrZ3JvdW5kSW1hZ2VGaXgiIHJlc3VsdD0ic2hhcGUiLz48ZmVHYXVzc2lhbkJsdXIgcmVzdWx0PSJlZmZlY3QxX2ZvcmVncm91bmRCbHVyXzIwMDJfMTcxNTgiIHN0ZERldmlhdGlvbj0iNC41OTYiLz48L2ZpbHRlcj48ZmlsdGVyIGlkPSJvIiB3aWR0aD0iNTQuODE0IiBoZWlnaHQ9IjY0LjY0NiIgeD0iOC4yNDQiIHk9Ii0yLjQxNiIgY29sb3ItaW50ZXJwb2xhdGlvbi1maWx0ZXJzPSJzUkdCIiBmaWx0ZXJVbml0cz0idXNlclNwYWNlT25Vc2UiPjxmZUZsb29kIGZsb29kLW9wYWNpdHk9IjAiIHJlc3VsdD0iQmFja2dyb3VuZEltYWdlRml4Ii8+PGZlQmxlbmQgaW49IlNvdXJjZUdyYXBoaWMiIGluMj0iQmFja2dyb3VuZEltYWdlRml4IiByZXN1bHQ9InNoYXBlIi8+PGZlR2F1c3NpYW5CbHVyIHJlc3VsdD0iZWZmZWN0MV9mb3JlZ3JvdW5kQmx1cl8yMDAyXzE3MTU4IiBzdGREZXZpYXRpb249IjQuNTk2Ii8+PC9maWx0ZXI+PGZpbHRlciBpZD0icCIgd2lkdGg9IjM5LjQwOSIgaGVpZ2h0PSI0My42MjMiIHg9IjE4LjcxMyIgeT0iMTAuNTg4IiBjb2xvci1pbnRlcnBvbGF0aW9uLWZpbHRlcnM9InNSR0IiIGZpbHRlclVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+PGZlRmxvb2QgZmxvb2Qtb3BhY2l0eT0iMCIgcmVzdWx0PSJCYWNrZ3JvdW5kSW1hZ2VGaXgiLz48ZmVCbGVuZCBpbj0iU291cmNlR3JhcGhpYyIgaW4yPSJCYWNrZ3JvdW5kSW1hZ2VGaXgiIHJlc3VsdD0ic2hhcGUiLz48ZmVHYXVzc2lhbkJsdXIgcmVzdWx0PSJlZmZlY3QxX2ZvcmVncm91bmRCbHVyXzIwMDJfMTcxNTgiIHN0ZERldmlhdGlvbj0iNC41OTYiLz48L2ZpbHRlcj48L2RlZnM+PC9zdmc+" />
+    <link rel="icon" type="image/svg+xml" href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0IiBmaWxsPSJub25lIiByb2xlPSJpbWciIGFyaWEtbGFiZWw9IkdyYXBob3JpYSI+CiAgPHN0eWxlPi5ibGFkZXtzdHJva2U6IzBGMTcyMH1AbWVkaWEgKHByZWZlcnMtY29sb3Itc2NoZW1lOmRhcmspey5ibGFkZXtzdHJva2U6I0ZCRkNGQ319PC9zdHlsZT4KICA8ZyBzdHJva2U9IiMxMkEzQkYiIHN0cm9rZS13aWR0aD0iNC42IiBzdHJva2UtbGluZWNhcD0icm91bmQiPgogICAgPHBhdGggZD0iTTM5LjMxIDguMDkgQTI1IDI1IDAgMCAxIDU2LjM2IDM3LjYzIj48L3BhdGg+CiAgICA8cGF0aCBkPSJNNDkuMDUgNTAuMjkgQTI1IDI1IDAgMCAxIDE0Ljk1IDUwLjI5Ij48L3BhdGg+CiAgICA8cGF0aCBkPSJNNy42NCAzNy42MyBBMjUgMjUgMCAwIDEgMjQuNjkgOC4wOSI+PC9wYXRoPgogIDwvZz4KICA8ZyBjbGFzcz0iYmxhZGUiIHN0cm9rZS13aWR0aD0iNC44IiBzdHJva2UtbGluZWNhcD0icm91bmQiPgogICAgPHBhdGggZD0iTTM0LjA2IDIzLjc1IEEyNCAyNCAwIDAgMSAzMS4zNyAxNC4wMSI+PC9wYXRoPgogICAgPHBhdGggZD0iTTM4LjExIDM3LjkxIEEyNCAyNCAwIDAgMSA0Ny44OSA0MC40NSI+PC9wYXRoPgogICAgPHBhdGggZD0iTTIzLjgzIDM0LjM0IEEyNCAyNCAwIDAgMSAxNi43NCA0MS41NCI+PC9wYXRoPgogIDwvZz4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjciIHI9IjUuMiIgZmlsbD0iIzEyQTNCRiI+PC9jaXJjbGU+CiAgPGNpcmNsZSBjeD0iNTMuNjUiIGN5PSI0NC41IiByPSI1LjIiIGZpbGw9IiMxMkEzQkYiPjwvY2lyY2xlPgogIDxjaXJjbGUgY3g9IjEwLjM1IiBjeT0iNDQuNSIgcj0iNS4yIiBmaWxsPSIjMTJBM0JGIj48L2NpcmNsZT4KICA8Y2lyY2xlIGN4PSIzMiIgY3k9IjMyIiByPSI3IiBmaWxsPSIjMTRCMzg5Ij48L2NpcmNsZT4KPC9zdmc+" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Graphoria - Scalar Playground</title>
   <style>html,body{height:100%;margin:0;padding:0}#scalar-client{width:100%!important}.missing-endpoint{padding:32px;font-family:monospace}.token-banner{position:fixed;color:#fff;z-index:10001;animation:3s forwards fadeOut;background:#22c55e;border-radius:6px;padding:8px 16px;font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Noto Sans,Ubuntu,Cantarell,Helvetica Neue,sans-serif;font-size:14px;top:10px;right:10px}@keyframes fadeOut{0%,70%{opacity:1}to{opacity:0;visibility:hidden}}

package/src/ai/mcp/index.ts CHANGED Viewed

@@ -1,23 +1,17 @@
-import { timingSafeEqual } from "crypto";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/server";
+import type { CapabilityAuthorizer } from "../../authentication/capabilities";
 import type { AnalyzedConfiguration } from "../../configuration";
 import type { CreateMcpServerOptions } from "./create-server";
 import { createMcpServer } from "./create-server";
 import { logger } from "../../logging";
-const safeCompare = (a: string, b: string): boolean => {
-  const bufA = Buffer.from(a);
-  const bufB = Buffer.from(b);
-  if (bufA.length !== bufB.length) return false;
-  return timingSafeEqual(bufA, bufB);
-};
+import { audit } from "../../logging/audit";
 export type CreateMCPRoutesOptions = CreateMcpServerOptions & {
   requireAdminSecret?: boolean;
-  adminSecret?: string;
+  /** Decides whether the presented header grants `mcp`; without one the gate never opens. */
+  authorize?: CapabilityAuthorizer;
   adminSecretHeader?: string;
 };
@@ -34,16 +28,27 @@ const jsonRpcError = (status: number, code: number, message: string) =>
     },
   );
+type RequestServer = { requestIP(req: Request): { address: string } | null };
 const handleMcpPost =
   (analyzedConfiguration: AnalyzedConfiguration, options: CreateMCPRoutesOptions) =>
-  async (req: Request) => {
+  async (req: Request, bunServer?: RequestServer) => {
     if (options.requireAdminSecret) {
       const headerName = options.adminSecretHeader ?? "x-admin-secret";
-      const provided = req.headers.get(headerName);
-      const expected = options.adminSecret ?? "";
-      if (!provided || !expected || !safeCompare(provided, expected)) {
+      const grant = options.authorize?.(req.headers.get(headerName), "mcp");
+      if (!grant) {
         return jsonRpcError(401, -32001, "Unauthorized: admin secret required");
       }
+      const ip = bunServer?.requestIP(req)?.address;
+      audit().emit({
+        action: "admin_secret.used",
+        actor: {
+          type: "admin_secret",
+          scope: grant.superset ? "all" : "mcp",
+          ...(ip ? { ip } : {}),
+        },
+        target: { kind: "mcp" },
+      });
     }
     const server = createMcpServer(analyzedConfiguration, options);

package/src/analyzeQuery/analyzers/selectionAnalyzer.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { GraphQLObjectType, GraphQLSchema } from "graphql";
+import { GraphQLNonNull, GraphQLObjectType, GraphQLSchema } from "graphql";
 import type { FieldNode, SelectionNode } from "graphql";
 import type { MergedEntities } from "../../configuration/getSchemas/mergeEntities";
@@ -55,6 +55,7 @@ export const analyzeSelections = (
         const directives = analyzeDirectives(field.directives || [], generatedVariables);
         const isRequired =
+          fieldType instanceof GraphQLNonNull &&
           directives.filter(
             (dir) => dir.name === "include" || dir.name === "skip" || dir.name === "when",
           ).length === 0;

package/src/analyzeQuery/depthLimit.ts CHANGED Viewed

@@ -77,6 +77,16 @@ function computeDepth(
  * const errors = validate(schema, parse(query), [depthLimitRule(10)]);
  * ```
  */
+/**
+ * Identity, not message matching: a caller classifying a rejection needs to
+ * tell this rule's error from an ordinary validation error, and the message is
+ * not a contract. Weak so a held error never pins the entry.
+ */
+const depthErrors = new WeakSet<GraphQLError>();
+export const isDepthLimitError = (error: unknown): boolean =>
+  error instanceof GraphQLError && depthErrors.has(error);
 export const depthLimitRule =
   (maxDepth: number) =>
   (context: ValidationContext): ASTVisitor => {
@@ -92,12 +102,12 @@ export const depthLimitRule =
           if (depth > maxDepth) {
             const operationName = def.name?.value ?? "anonymous";
-            context.reportError(
-              new GraphQLError(
-                `Query depth of ${depth} exceeds the maximum allowed depth of ${maxDepth} (operation: "${operationName}"). Raise MAX_QUERY_DEPTH to allow deeper queries.`,
-                { nodes: [def] },
-              ),
+            const error = new GraphQLError(
+              `Query depth of ${depth} exceeds the maximum allowed depth of ${maxDepth} (operation: "${operationName}"). Raise MAX_QUERY_DEPTH to allow deeper queries.`,
+              { nodes: [def] },
             );
+            depthErrors.add(error);
+            context.reportError(error);
           }
         }
       },

package/src/authentication/capabilities.ts ADDED Viewed

@@ -0,0 +1,56 @@
+import type { Env } from "../types/env";
+import { logger } from "../logging";
+import { matchesAnySecret } from "./secrets";
+export type Capability = "console:read" | "console:write" | "ai" | "mcp" | "metrics";
+/** `superset` is true when the admin secret, not a scoped credential, matched. */
+export type CapabilityGrant = { superset: boolean };
+export type CapabilityAuthorizer = (
+  candidate: string | null,
+  capability: Capability,
+) => CapabilityGrant | null;
+type WarnLog = { warn: (obj: object, msg: string) => void };
+// Each list is checked on its own so the rotation debug line inside
+// matchesAnySecret keeps reporting the index within one credential.
+const scopedSecretsFor = (env: Env, capability: Capability): string[][] => {
+  switch (capability) {
+    case "console:read":
+      return [env.console.writeSecrets, env.console.readSecrets];
+    case "console:write":
+      return [env.console.writeSecrets];
+    case "ai":
+      return [env.ai.secrets];
+    case "mcp":
+      return [env.ai.mcp.secrets];
+    case "metrics":
+      return [env.metrics.secrets];
+  }
+};
+/**
+ * Decides whether a presented secret grants a capability. The admin secret
+ * grants all of them and is reported as the superset so the caller can tell
+ * the two apart; it is also logged, since a scoped credential would have done.
+ */
+export const createCapabilityAuthorizer = (
+  env: Env,
+  log: WarnLog = logger("auth"),
+): CapabilityAuthorizer => {
+  return (candidate, capability) => {
+    if (matchesAnySecret(candidate, env.admin.secrets)) {
+      log.warn({ capability }, "admin secret used where a scoped credential would do");
+      return { superset: true };
+    }
+    for (const secrets of scopedSecretsFor(env, capability)) {
+      if (matchesAnySecret(candidate, secrets)) return { superset: false };
+    }
+    return null;
+  };
+};

package/src/authentication/index.ts CHANGED Viewed

@@ -7,7 +7,7 @@ import { createPASETOService } from "./paseto";
 export const createTokenService = (env: Env, strategy: TokenStrategy = "jwt"): TokenService => {
   switch (strategy) {
     case "jwt": {
-      if (!env.jwt.secret) {
+      if (env.jwt.secrets.length === 0) {
         throw new Error(
           "JWT_SECRET environment variable is required when using jwt token strategy",
         );
@@ -15,7 +15,7 @@ export const createTokenService = (env: Env, strategy: TokenStrategy = "jwt"): T
       return createJWTService(env);
     }
     case "paseto_local": {
-      if (!env.paseto.localKey) {
+      if (env.paseto.localKeys.length === 0) {
         throw new Error(
           "PASETO_LOCAL_KEY environment variable is required when using paseto_local token strategy.",
         );
@@ -23,7 +23,7 @@ export const createTokenService = (env: Env, strategy: TokenStrategy = "jwt"): T
       return createPASETOService(env, "local");
     }
     case "paseto_public": {
-      if (!env.paseto.secretKey || !env.paseto.publicKey) {
+      if (!env.paseto.secretKey || env.paseto.publicKeys.length === 0) {
         throw new Error(
           "PASETO_SECRET_KEY and PASETO_PUBLIC_KEY environment variables are required when using paseto_public token strategy.",
         );

package/src/authentication/jwt.ts CHANGED Viewed

@@ -1,6 +1,4 @@
-import { timingSafeEqual } from "crypto";
-import { SignJWT, jwtVerify } from "jose";
+import { SignJWT, errors, jwtVerify } from "jose";
 import type { JWTPayload } from "jose";
 import type { Env } from "../types/env";
@@ -9,6 +7,7 @@ import type { TokenRepository } from "./tokenRepository";
 import type { TokenGenerationParameters, TokenOptions, TokenResponse, TokenService } from "./types";
 import { parseDurationToSeconds } from "./duration";
+import { matchesAnySecret } from "./secrets";
 import { createTokenRepository } from "./tokenRepository";
 import { logger } from "../logging";
@@ -16,18 +15,6 @@ import { logger } from "../logging";
 const ACCESS_TOKEN_AUDIENCE = "access";
 const REFRESH_TOKEN_AUDIENCE = "refresh";
-// Timing-safe string comparison to prevent timing attacks
-const safeCompare = (a: string, b: string): boolean => {
-  try {
-    const bufA = Buffer.from(a);
-    const bufB = Buffer.from(b);
-    if (bufA.length !== bufB.length) return false;
-    return timingSafeEqual(bufA, bufB);
-  } catch {
-    return false;
-  }
-};
 export type { TokenGenerationParameters, TokenOptions, TokenResponse };
 export type JWTTokenPayload = JWTPayload &
@@ -43,7 +30,9 @@ export const createJWTService = (
   tokenRepositoryOverride?: TokenRepository,
 ): TokenService => {
   const tokenRepository = tokenRepositoryOverride ?? createTokenRepository(env.cache.redisUrl);
-  const jwtSecret = new TextEncoder().encode(env.jwt.secret);
+  // First entry signs; every entry verifies, so a rotation can overlap.
+  const jwtSecrets = env.jwt.secrets.map((secret) => new TextEncoder().encode(secret));
+  const signingSecret = jwtSecrets[0];
   const createToken = async (
     payload: TokenGenerationParameters,
@@ -67,7 +56,8 @@ export const createJWTService = (
         jwt.setNotBefore(options.notBefore);
       }
-      return await jwt.sign(jwtSecret);
+      if (!signingSecret) throw new Error("No JWT secret configured");
+      return await jwt.sign(signingSecret);
     } catch (error) {
       logger("auth").child({ strategy: "jwt" }).error({ err: error }, "token creation failed");
       throw new Error("Token creation failed");
@@ -78,23 +68,38 @@ export const createJWTService = (
     token: string,
     options: TokenOptions = {},
   ): Promise<T> => {
-    const { payload } = await jwtVerify(token, jwtSecret, {
+    const verifyOptions = {
       issuer: options.issuer,
       audience: options.audience,
       algorithms: [ALGORITHM],
       typ: TYP,
-    });
+    };
-    return payload as T;
+    let lastError: unknown = new Error("No JWT secret configured");
+    for (const [index, secret] of jwtSecrets.entries()) {
+      try {
+        const { payload } = await jwtVerify(token, secret, verifyOptions);
+        if (index > 0) {
+          logger("auth")
+            .child({ strategy: "jwt" })
+            .debug({ index }, "token verified with a previous secret");
+        }
+        return payload as T;
+      } catch (error) {
+        // Only a signature mismatch means "try the next secret"; a claim
+        // failure came from the secret that did sign this token.
+        if (!(error instanceof errors.JWSSignatureVerificationFailed)) throw error;
+        lastError = error;
+      }
+    }
+    throw lastError;
   };
   const verifyTokenAndGetRole = async (
     authHeader: string | null,
     adminSecretHeader: string | null,
   ): Promise<string> => {
-    // Use timing-safe comparison to prevent timing attacks
-    if (env.admin.secret && adminSecretHeader && safeCompare(adminSecretHeader, env.admin.secret))
-      return env.superadmin.role;
+    if (matchesAnySecret(adminSecretHeader, env.admin.secrets)) return env.superadmin.role;
     if (!authHeader) return env.anonymousRole;
@@ -115,8 +120,8 @@ export const createJWTService = (
     authHeader: string | null,
     adminSecretHeader: string | null,
   ): Promise<SessionContext> => {
-    if (env.admin.secret && adminSecretHeader && safeCompare(adminSecretHeader, env.admin.secret))
-      return { sub: "superadmin", role: env.superadmin.role };
+    if (matchesAnySecret(adminSecretHeader, env.admin.secrets))
+      return { sub: "superadmin", role: env.superadmin.role, authMethod: "admin_secret" };
     if (!authHeader || !authHeader.startsWith("Bearer "))
       return { sub: "anonymous", role: env.anonymousRole };

package/src/authentication/paseto.ts CHANGED Viewed

@@ -1,5 +1,4 @@
-import { timingSafeEqual } from "crypto";
+import { PasetoDecryptionFailed, PasetoSignatureInvalid } from "paseto-ts/lib/errors";
 import { decrypt, encrypt, sign, verify } from "paseto-ts/v4";
 import type { Env } from "../types/env";
@@ -8,6 +7,7 @@ import type { TokenRepository } from "./tokenRepository";
 import type { TokenGenerationParameters, TokenOptions, TokenResponse, TokenService } from "./types";
 import { parseDurationToSeconds, toPasetoDuration } from "./duration";
+import { matchesAnySecret } from "./secrets";
 import { createTokenRepository } from "./tokenRepository";
 import { logger } from "../logging";
@@ -15,18 +15,6 @@ import { logger } from "../logging";
 const ACCESS_TOKEN_AUDIENCE = "access";
 const REFRESH_TOKEN_AUDIENCE = "refresh";
-// Timing-safe string comparison to prevent timing attacks
-const safeCompare = (a: string, b: string): boolean => {
-  try {
-    const bufA = Buffer.from(a);
-    const bufB = Buffer.from(b);
-    if (bufA.length !== bufB.length) return false;
-    return timingSafeEqual(bufA, bufB);
-  } catch {
-    return false;
-  }
-};
 type PasetoPayload = {
   sub: string;
   role: string;
@@ -56,7 +44,12 @@ export const createPASETOService = (
 ): TokenService => {
   const tokenRepository = tokenRepositoryOverride ?? createTokenRepository(env.cache.redisUrl);
-  // Token creation and verification functions based on mode
+  // In local mode the first key encrypts and every key decrypts. In public
+  // mode the secret key signs and every public key verifies. Either way a
+  // rotation can overlap.
+  const verifyingKeys = mode === "local" ? env.paseto.localKeys : env.paseto.publicKeys;
+  const signingKey = mode === "local" ? env.paseto.localKeys[0] : env.paseto.secretKey;
   const createPasetoToken = async (
     payload: Record<string, unknown>,
     expiry: string,
@@ -66,19 +59,37 @@ export const createPASETOService = (
       exp: toPasetoDuration(expiry),
     };
+    if (!signingKey) throw new Error("No PASETO key configured");
     if (mode === "local") {
-      return encrypt(env.paseto.localKey!, pasetoPayload);
+      return encrypt(signingKey, pasetoPayload);
     }
-    return sign(env.paseto.secretKey!, pasetoPayload);
+    return sign(signingKey, pasetoPayload);
   };
   const verifyPasetoToken = async (token: string): Promise<PasetoPayload> => {
-    if (mode === "local") {
-      const { payload } = await decrypt<PasetoPayload>(env.paseto.localKey!, token);
-      return payload;
+    let lastError: unknown = new Error("No PASETO key configured");
+    for (const [index, key] of verifyingKeys.entries()) {
+      try {
+        const { payload } =
+          mode === "local"
+            ? await decrypt<PasetoPayload>(key, token)
+            : await verify<PasetoPayload>(key, token);
+        if (index > 0) {
+          logger("auth")
+            .child({ strategy: "paseto" })
+            .debug({ index }, "token verified with a previous key");
+        }
+        return payload;
+      } catch (error) {
+        // Only a key mismatch means "try the next key"; a claim failure came
+        // from the key that did produce this token.
+        const keyMismatch =
+          error instanceof PasetoDecryptionFailed || error instanceof PasetoSignatureInvalid;
+        if (!keyMismatch) throw error;
+        lastError = error;
+      }
     }
-    const { payload } = await verify<PasetoPayload>(env.paseto.publicKey!, token);
-    return payload;
+    throw lastError;
   };
   const createToken = async (
@@ -132,8 +143,7 @@ export const createPASETOService = (
     authHeader: string | null,
     adminSecretHeader: string | null,
   ): Promise<string> => {
-    if (env.admin.secret && adminSecretHeader && safeCompare(adminSecretHeader, env.admin.secret))
-      return env.superadmin.role;
+    if (matchesAnySecret(adminSecretHeader, env.admin.secrets)) return env.superadmin.role;
     if (!authHeader) return env.anonymousRole;
@@ -153,8 +163,8 @@ export const createPASETOService = (
     authHeader: string | null,
     adminSecretHeader: string | null,
   ): Promise<SessionContext> => {
-    if (env.admin.secret && adminSecretHeader && safeCompare(adminSecretHeader, env.admin.secret))
-      return { sub: "superadmin", role: env.superadmin.role };
+    if (matchesAnySecret(adminSecretHeader, env.admin.secrets))
+      return { sub: "superadmin", role: env.superadmin.role, authMethod: "admin_secret" };
     if (!authHeader || !authHeader.startsWith("Bearer "))
       return { sub: "anonymous", role: env.anonymousRole };

package/src/authentication/secrets.ts ADDED Viewed

@@ -0,0 +1,30 @@
+import { timingSafeEqual } from "crypto";
+import { logger } from "../logging";
+// Timing-safe string comparison to prevent timing attacks
+export const safeCompare = (a: string, b: string): boolean => {
+  try {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length) return false;
+    return timingSafeEqual(bufA, bufB);
+  } catch {
+    return false;
+  }
+};
+/**
+ * True when `candidate` equals any entry of a rotating secret set. The first
+ * entry is the current secret; a match further along means a caller still
+ * holds a previous one, which is logged so the operator knows when it is safe
+ * to drop it.
+ */
+export const matchesAnySecret = (candidate: string | null, secrets: string[]): boolean => {
+  if (!candidate) return false;
+  const index = secrets.findIndex((secret) => safeCompare(candidate, secret));
+  if (index > 0) logger("auth").debug({ index }, "matched a previous secret");
+  return index >= 0;
+};

package/src/authentication/tokenRepository.ts CHANGED Viewed

@@ -1,7 +1,6 @@
-import { RedisClient as ValkeyClient } from "bun";
 import { parseDurationToMs } from "./duration";
 import { logger } from "../logging";
+import { createRedisClient } from "../utils/redis";
 export type TokenRepository = {
   saveJti(jti: string, expiresIn: string): Promise<void>;
@@ -80,4 +79,4 @@ export const createTokenRepository = (redisUrl: string): TokenRepository =>
   // Bun's RedisClient exposes the same hset/hmget/expire surface we need but
   // its declared types are wider than TokenRepositoryClient. The cast is the
   // structural-typing bridge and is intentional.
-  createTokenRepositoryWithClient(new ValkeyClient(redisUrl) as unknown as TokenRepositoryClient);
+  createTokenRepositoryWithClient(createRedisClient(redisUrl) as unknown as TokenRepositoryClient);

package/src/config/types/db.ts CHANGED Viewed

@@ -51,14 +51,28 @@ export const RelationshipConditionZod = z
     operator: z.enum(RELATIONSHIP_CONDITION_OPERATORS).optional().default("eq"),
     /** Literal compared against the column (omit for `is_null` / `is_not_null`) */
     value: z.union([z.string(), z.number(), z.boolean()]).optional(),
+    /**
+     * Column on an ancestor table, compared against this condition's column
+     * instead of a literal. The ancestor must sit above the relationship in the
+     * query path; the nearest match wins, and a query that does not traverse it
+     * is rejected rather than joined without the predicate.
+     */
+    ancestor: z
+      .strictObject({ schema: z.string(), name: z.string(), column: z.string() })
+      .optional(),
   })
   .refine((cond) => (cond.source === undefined) !== (cond.target === undefined), {
     message: 'Relationship condition must set exactly one of "source" or "target"',
   })
   .refine(
     (cond) =>
-      cond.operator === "is_null" || cond.operator === "is_not_null" || cond.value !== undefined,
-    { message: 'Relationship condition requires a "value" unless operator is is_null/is_not_null' },
+      cond.operator === "is_null" || cond.operator === "is_not_null"
+        ? cond.ancestor === undefined
+        : (cond.value === undefined) !== (cond.ancestor === undefined),
+    {
+      message:
+        'Relationship condition requires exactly one of "value" or "ancestor", and neither operand may be an "ancestor" when operator is is_null/is_not_null',
+    },
   );
 export type RelationshipCondition = z.input<typeof RelationshipConditionZod>;

package/src/configuration/getSchemas/mergeEntities/index.ts CHANGED Viewed

@@ -7,23 +7,6 @@ import type { TypedOperation } from "../../../types/zod/operation";
 import { EntitySource, createResolverEntry } from "../../../types/resolver";
 import { columnFieldName } from "../../../databases/transformers/graphqlName";
-import { SqlTypeCategory, categorizeSqlType } from "../../../databases/sqlTypeUtils";
-const dataTypeToOpenApiType = (dataType: string): string => {
-  const category = categorizeSqlType(dataType);
-  switch (category) {
-    case SqlTypeCategory.INTEGER:
-    case SqlTypeCategory.FLOAT:
-      return "number";
-    case SqlTypeCategory.BOOLEAN:
-      return "boolean";
-    case SqlTypeCategory.DATE_TIME:
-    case SqlTypeCategory.STRING:
-    default:
-      return "string";
-  }
-};
 export const mergeEntities = (
   entityOfRole: EntitiesOfRole,
@@ -236,15 +219,6 @@ export const mergeEntities = (
      */
     columnSqlName: (table: string, fieldName: string): string =>
       queriesMap[table]?.columns.find((c) => columnFieldName(c) === fieldName)?.name ?? fieldName,
-    getColumnTypeForOpenApi: (table: string, column: string) => {
-      const tableObj = queriesMap[table];
-      const columnObj = tableObj?.columns.find((c) => c.name === column);
-      if (!columnObj) return "string";
-      return dataTypeToOpenApiType(columnObj.dataType);
-    },
   };
 };

package/src/configuration/gql/gqlAuthOperations.ts CHANGED Viewed

@@ -5,6 +5,7 @@ import type { SessionContext } from "../../utils/sessionVariables";
 import { resolveVariableRef } from "../../analyzeQuery/resolveVariables";
 import { checkUserCredentials } from "../../databases";
+import { actorFromSession, audit } from "../../logging/audit";
 import { getTokenService } from "../../singletons/authentication";
 // Handle auth mutations: auth_login / auth_refresh / auth_logout
@@ -35,9 +36,23 @@ export const handleAuthMutation = async (
       passwordValue.toString(),
     );
+    const actor = { type: "credentials", sub: usernameValue.toString() } as const;
     if (!result.valid) {
+      audit().emit({
+        action: "auth.login",
+        outcome: "failure",
+        actor,
+        target: { kind: "auth", via: "graphql" },
+        reason: "Invalid username or password",
+      });
       throw new Error("Invalid username or password");
     }
+    audit().emit({
+      action: "auth.login",
+      outcome: "success",
+      actor,
+      target: { kind: "auth", via: "graphql", role: result.role },
+    });
     const data = await getTokenService().createTokenPair({
       sub: usernameValue.toString(),
@@ -104,9 +119,11 @@ export const handleAuthMutation = async (
   if (field.name === "auth_logout") {
     const tokenService = getTokenService();
+    const revoked: string[] = [];
     if (session?.jti) {
       await tokenService.revoke(session.jti);
+      revoked.push(session.jti);
     }
     const refreshCookie = req?.cookies?.get("refresh_token");
@@ -116,6 +133,7 @@ export const handleAuthMutation = async (
           audience: "refresh",
         });
         await tokenService.revoke(refreshPayload.jti);
+        revoked.push(refreshPayload.jti);
       } catch {
         // tampered or expired cookie — nothing to revoke
       }
@@ -125,6 +143,14 @@ export const handleAuthMutation = async (
       req.cookies.delete("refresh_token");
     }
+    if (revoked.length > 0) {
+      audit().emit({
+        action: "auth.logout",
+        actor: actorFromSession(session),
+        target: { kind: "auth", via: "graphql", revoked },
+      });
+    }
     return {
       data: {
         [field.alias || field.name]: true,