@hotmeshio/long-tail 0.23.2 → 0.24.0

package/build/routes/mcp.js

@@ -33,9 +33,28 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/mcp"));
-const router = (0, express_1.Router)();
+const capabilities_1 = require("../modules/capabilities");
+const auth_1 = require("../modules/auth");
+const router = (0, http_1.Router)();
+/**
+ * A server's transport_config carries connection secrets (headers, env,
+ * commands). Only a builder, who may edit the server, reads it back.
+ */
+async function redactTransport(result, auth) {
+    if (!result.data || (await (0, capabilities_1.mayBuild)(auth ? { userId: auth.userId } : undefined)))
+        return result;
+    const strip = (server) => {
+        const { transport_config: _secret, ...rest } = server;
+        return rest;
+    };
+    const data = result.data;
+    return {
+        ...result,
+        data: Array.isArray(data.servers) ? { ...data, servers: data.servers.map(strip) } : strip(data),
+    };
+}
 // ── Server registration CRUD ──────────────────────────────────────────
 /**
  * GET /api/mcp/servers
@@ -52,13 +71,14 @@ router.get('/servers', async (req, res) => {
         limit: req.query.limit ? parseInt(req.query.limit, 10) : undefined,
         offset: req.query.offset ? parseInt(req.query.offset, 10) : undefined,
     });
-    res.status(result.status).json(result.data ?? { error: result.error });
+    const shown = await redactTransport(result, req.auth);
+    res.status(shown.status).json(shown.data ?? { error: shown.error });
 });
 /**
  * POST /api/mcp/servers
  * Register a new MCP server.
  */
-router.post('/servers', async (req, res) => {
+router.post('/servers', auth_1.requireBuilder, async (req, res) => {
     const { name, description, transport_type, transport_config, auto_connect, metadata, tags, compile_hints, credential_providers } = req.body;
     const result = await api.createMcpServer({
         name,
@@ -77,7 +97,7 @@ router.post('/servers', async (req, res) => {
  * POST /api/mcp/servers/test-connection
  * Test connectivity to an MCP server without persisting it.
  */
-router.post('/servers/test-connection', async (req, res) => {
+router.post('/servers/test-connection', auth_1.requireBuilder, async (req, res) => {
     const { transport_type, transport_config } = req.body;
     const result = await api.testConnection({ transport_type, transport_config });
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -88,23 +108,23 @@ router.post('/servers/test-connection', async (req, res) => {
  * Get a specific MCP server.
  */
 router.get('/servers/:id', async (req, res) => {
-    const result = await api.getMcpServer({ id: req.params.id });
+    const result = await redactTransport(await api.getMcpServer({ id: req.params.id }), req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * PUT /api/mcp/servers/:id
  * Update an MCP server registration.
  */
-router.put('/servers/:id', async (req, res) => {
-    const result = await api.updateMcpServer({ id: req.params.id, ...req.body });
+router.put('/servers/:id', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.updateMcpServer({ ...req.body, id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * DELETE /api/mcp/servers/:id
  * Delete an MCP server registration.
  */
-router.delete('/servers/:id', async (req, res) => {
-    const result = await api.deleteMcpServer({ id: req.params.id });
+router.delete('/servers/:id', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.deleteMcpServer({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 // ── Connection management ─────────────────────────────────────────────
@@ -112,16 +132,16 @@ router.delete('/servers/:id', async (req, res) => {
  * POST /api/mcp/servers/:id/connect
  * Connect to a registered MCP server.
  */
-router.post('/servers/:id/connect', async (req, res) => {
-    const result = await api.connectMcpServer({ id: req.params.id });
+router.post('/servers/:id/connect', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.connectMcpServer({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * POST /api/mcp/servers/:id/disconnect
  * Disconnect from a specific MCP server.
  */
-router.post('/servers/:id/disconnect', async (req, res) => {
-    const result = await api.disconnectMcpServer({ id: req.params.id });
+router.post('/servers/:id/disconnect', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.disconnectMcpServer({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 // ── Credential status ────────────────────────────────────────────────
@@ -153,7 +173,7 @@ router.post('/servers/:id/tools/:toolName/call', async (req, res) => {
         toolName: req.params.toolName,
         arguments: req.body.arguments,
         execute_as: req.body.execute_as,
-    }, req.auth ? { userId: req.auth.userId } : undefined);
+    }, req.auth ? { userId: req.auth.userId, role: req.auth.role } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/me.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/me"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── Self-service (/api/me) — the authenticated user, no admin gates ─────────
 /**
  * GET /api/me/preferences

package/build/routes/namespaces.js

@@ -33,9 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/namespaces"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/namespaces
  * List all registered MCP YAML namespaces.
@@ -49,7 +50,7 @@ router.get('/', async (_req, res) => {
  * Register a new namespace.
  * Body: { name: string, description?: string, metadata?: object }
  */
-router.post('/', async (req, res) => {
+router.post('/', auth_1.requireBuilder, async (req, res) => {
     const result = await api.registerNamespace({
         name: req.body?.name,
         description: req.body?.description,

package/build/routes/nats-credentials.js

@@ -1,10 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const events_1 = require("../lib/events");
 const nats_1 = require("../lib/events/nats");
 const nats_ws_proxy_1 = require("../lib/events/nats-ws-proxy");
-const router = (0, express_1.Router)();
+const nats_ws_ticket_1 = require("../lib/events/nats-ws-ticket");
+const logger_1 = require("../lib/logger");
+const config_1 = require("../modules/config");
+let warnedServerToken = false;
+/** The WebSocket URL with a ticket for this person; the proxy holds the NATS credential. */
+function withTicket(wsUrl, userId) {
+    const ticket = (0, nats_ws_ticket_1.signNatsWsTicket)(userId);
+    if (!ticket)
+        return null;
+    const url = new URL(wsUrl);
+    url.searchParams.set(nats_ws_ticket_1.NATS_WS_TICKET_PARAM, ticket);
+    return url.toString();
+}
+const router = (0, http_1.Router)();
 /**
  * GET /api/nats-credentials
  * Returns NATS WebSocket URL and auth token.
@@ -21,9 +34,20 @@ router.get('/', async (req, res) => {
         wsUrl = (0, nats_ws_proxy_1.deriveWsUrlFromRequest)(req, natsAdapter.wsProxyBasePath);
         natsAdapter.setWsUrl(wsUrl);
     }
+    // Behind the proxy the browser gets a ticket, never the NATS credential, and
+    // the proxy lets it subscribe only.
+    if (natsAdapter.wsProxyTarget && wsUrl) {
+        return res.json({ natsWsUrl: withTicket(wsUrl, req.auth.userId), natsToken: null });
+    }
+    // A direct connection needs a credential: a subscribe-only one when the
+    // deployment provides it.
+    if (!config_1.config.NATS_DASHBOARD_TOKEN && natsAdapter.authToken && !warnedServerToken) {
+        warnedServerToken = true;
+        logger_1.loggerRegistry.warn('[lt-nats] browsers receive the NATS server token; set NATS_DASHBOARD_TOKEN to a subscribe-only credential, or use the WebSocket proxy');
+    }
     res.json({
         natsWsUrl: wsUrl,
-        natsToken: natsAdapter.authToken,
+        natsToken: config_1.config.NATS_DASHBOARD_TOKEN || natsAdapter.authToken,
     });
 });
 exports.default = router;

package/build/routes/oauth-server/authorize.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/oauth-server/authorize.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = require("../../lib/http");
+const auth_1 = require("../../modules/auth");
+const oauth_server_1 = require("../../modules/oauth-server");
+const defaults_1 = require("../../modules/defaults");
+const oauth_server_2 = require("../../services/auth/oauth-server");
+const authorization_1 = require("../../services/auth/oauth-server/authorization");
+const user_1 = require("../../services/user");
+const router = (0, http_1.Router)();
+const CONSENT_PAGE_PATH = '/oauth/consent';
+const BOT_PRINCIPAL_TYPE = 'bot';
+/** Send a failed authorization check: here when the client is untrusted, else back to the client. */
+function sendAuthorizationError(res, check, issuer, asJson) {
+    if (!check.redirect) {
+        res.status(400).json({ error: check.error, error_description: check.description });
+        return;
+    }
+    const redirect = (0, authorization_1.withQuery)(check.redirectUri, {
+        error: check.error, error_description: check.description, state: check.state, iss: issuer,
+    });
+    if (asJson)
+        res.json({ redirect });
+    else
+        res.redirect(302, redirect);
+}
+/**
+ * GET /api/oauth/authorize
+ * The authorization request (RFC 6749 §4.1.1, PKCE S256 required). Redirects
+ * to the dashboard consent page with the validated request.
+ */
+router.get('/authorize', async (req, res) => {
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    const check = await (0, authorization_1.checkAuthorizationRequest)(req.query, settings);
+    if (!check.ok)
+        return sendAuthorizationError(res, check, settings.issuer, false);
+    const { client, redirectUri, codeChallenge, state, scope, resource } = check.request;
+    res.redirect(302, (0, authorization_1.withQuery)(`${settings.issuer}${CONSENT_PAGE_PATH}`, {
+        client_id: client.client_id, redirect_uri: redirectUri, code_challenge: codeChallenge,
+        code_challenge_method: 'S256', response_type: 'code', state, scope, resource,
+    }));
+});
+/** Consent is a person's decision: a bot key may not grant access. */
+function refuseBots(req, res) {
+    if (req.auth?.principalType !== BOT_PRINCIPAL_TYPE)
+        return false;
+    res.status(403).json({ error: 'access_denied', error_description: 'a service account cannot grant access' });
+    return true;
+}
+/**
+ * POST /api/oauth/authorize
+ * The person approves. Body: the authorization request plus
+ * { preset: 'read_only' | 'just_me' }. Returns { redirect } for the consent
+ * page to navigate to, carrying the code.
+ */
+router.post('/authorize', auth_1.requireAuth, async (req, res) => {
+    if (refuseBots(req, res))
+        return;
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    const check = await (0, authorization_1.checkAuthorizationRequest)(req.body ?? {}, settings);
+    if (!check.ok)
+        return sendAuthorizationError(res, check, settings.issuer, true);
+    const preset = req.body?.preset;
+    if (!(0, authorization_1.isGrantPreset)(preset)) {
+        res.status(400).json({ error: 'invalid_request', error_description: 'preset must be read_only or just_me' });
+        return;
+    }
+    if (!(0, authorization_1.grantablePresets)(await (0, user_1.getUserRoles)(req.auth.userId)).includes(preset)) {
+        res.status(403).json({ error: 'access_denied', error_description: `you may not grant ${preset}` });
+        return;
+    }
+    const { client, redirectUri, codeChallenge, state, resource } = check.request;
+    const { code } = await (0, oauth_server_2.issueAuthorizationCode)({
+        userId: req.auth.userId, clientId: client.client_id, policy: { preset }, scope: oauth_server_2.PRESET_SCOPE[preset],
+        redirectUri, codeChallenge, resource, ttlSeconds: defaults_1.OAUTH_CODE_TTL_SECONDS,
+    });
+    res.json({ redirect: (0, authorization_1.withQuery)(redirectUri, { code, state, iss: settings.issuer }) });
+});
+/**
+ * POST /api/oauth/deny
+ * The person declines. Body: { client_id, redirect_uri, state? }. Returns
+ * { redirect } carrying error=access_denied.
+ */
+router.post('/deny', auth_1.requireAuth, async (req, res) => {
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    const clientId = typeof req.body?.client_id === 'string' ? req.body.client_id : '';
+    const client = clientId ? await (0, oauth_server_2.getClient)(clientId) : null;
+    const redirectUri = req.body?.redirect_uri;
+    if (!client || typeof redirectUri !== 'string' || !client.redirect_uris.includes(redirectUri)) {
+        res.status(400).json({ error: 'invalid_request', error_description: 'unknown client or redirect_uri' });
+        return;
+    }
+    const state = typeof req.body?.state === 'string' ? req.body.state : undefined;
+    res.json({ redirect: (0, authorization_1.withQuery)(redirectUri, { error: 'access_denied', state, iss: settings.issuer }) });
+});
+/**
+ * GET /api/oauth/clients/:id
+ * The client the consent page is asking about.
+ */
+router.get('/clients/:id', auth_1.requireAuth, async (req, res) => {
+    const client = await (0, oauth_server_2.getClient)(String(req.params.id));
+    if (!client) {
+        res.status(404).json({ error: 'not_found' });
+        return;
+    }
+    res.json({ client_id: client.client_id, client_name: client.client_name, redirect_uris: client.redirect_uris });
+});
+exports.default = router;

package/build/routes/oauth-server/grants.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/oauth-server/grants.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = require("../../lib/http");
+const auth_1 = require("../../modules/auth");
+const roles_1 = require("../../services/user/roles");
+const oauth_server_1 = require("../../services/auth/oauth-server");
+const authorization_1 = require("../../services/auth/oauth-server/authorization");
+const router = (0, http_1.Router)();
+/**
+ * GET /api/oauth/presets
+ * The presets the signed-in person may grant at consent.
+ */
+router.get('/presets', auth_1.requireAuth, async (req, res) => {
+    res.json({ presets: (0, authorization_1.grantablePresets)(await (0, roles_1.getUserRoles)(req.auth.userId)) });
+});
+/**
+ * GET /api/oauth/grants
+ * The signed-in person's connected apps.
+ */
+router.get('/grants', auth_1.requireAuth, async (req, res) => {
+    res.json({ grants: await (0, oauth_server_1.listGrants)(req.auth.userId) });
+});
+/**
+ * DELETE /api/oauth/grants/:id
+ * Disconnect one of the signed-in person's apps. Its tokens stop working at once.
+ */
+router.delete('/grants/:id', auth_1.requireAuth, async (req, res) => {
+    const revoked = await (0, oauth_server_1.revokeGrant)(String(req.params.id), req.auth.userId);
+    if (!revoked) {
+        res.status(404).json({ error: 'not_found' });
+        return;
+    }
+    res.json({ disconnected: true });
+});
+exports.default = router;

package/build/routes/oauth-server/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * OAuth authorization server endpoints under /api/oauth. The public ones
+ * (metadata, register, token, revoke) take no Long Tail session and allow
+ * any origin. The consent endpoints take the person's dashboard session.
+ * Every endpoint answers 404 until the server is configured.
+ */
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/oauth-server/index.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = require("../../lib/http");
+const oauth_server_1 = require("../../modules/oauth-server");
+const metadata_1 = require("../../services/auth/oauth-server/metadata");
+const registration_1 = __importDefault(require("./registration"));
+const authorize_1 = __importDefault(require("./authorize"));
+const token_1 = __importDefault(require("./token"));
+const grants_1 = __importDefault(require("./grants"));
+/**
+ * OAuth authorization server endpoints under /api/oauth. The public ones
+ * (metadata, register, token, revoke) take no Long Tail session and allow
+ * any origin. The consent endpoints take the person's dashboard session.
+ * Every endpoint answers 404 until the server is configured.
+ */
+const router = (0, http_1.Router)();
+router.use((_req, res, next) => {
+    if (!(0, oauth_server_1.getOAuthServerSettings)()) {
+        res.status(404).json({ error: 'not_found' });
+        return;
+    }
+    next();
+});
+/**
+ * GET /api/oauth/metadata
+ * The authorization server metadata, for clients that do not use the
+ * well-known document.
+ */
+router.get('/metadata', (0, http_1.allowAnyOrigin)(['GET']), (_req, res) => {
+    res.json((0, metadata_1.authorizationServerMetadata)((0, oauth_server_1.getOAuthServerSettings)()));
+});
+router.use(registration_1.default);
+router.use(authorize_1.default);
+router.use(token_1.default);
+router.use(grants_1.default);
+/**
+ * Anything an endpoint did not answer itself answers in the RFC 6749 error
+ * shape: a body that does not parse is the client's error, anything else the
+ * server's. No message or stack reaches the client.
+ */
+router.use((err, _req, res, _next) => {
+    if (res.headersSent)
+        return;
+    const malformed = err?.type === 'entity.parse.failed' || err?.status === 400;
+    res.status(malformed ? 400 : 500).json(malformed
+        ? { error: 'invalid_request', error_description: 'the request body is malformed' }
+        : { error: 'server_error', error_description: 'the request could not be completed' });
+});
+exports.default = router;

package/build/routes/oauth-server/registration.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/oauth-server/registration.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = require("../../lib/http");
+const oauth_server_1 = require("../../modules/oauth-server");
+const defaults_1 = require("../../modules/defaults");
+const oauth_server_2 = require("../../services/auth/oauth-server");
+const registration_1 = require("../../services/auth/oauth-server/registration");
+const router = (0, http_1.Router)();
+const limiter = new registration_1.RegistrationLimiter(defaults_1.OAUTH_REGISTRATIONS_PER_WINDOW, defaults_1.OAUTH_REGISTRATION_WINDOW_SECONDS * 1000);
+/**
+ * POST /api/oauth/register
+ * Dynamic client registration (RFC 7591) for public clients.
+ * Body: { redirect_uris, client_name?, grant_types?, response_types?, token_endpoint_auth_method? }
+ */
+router.options('/register', (0, http_1.allowAnyOrigin)(['POST']));
+router.post('/register', (0, http_1.allowAnyOrigin)(['POST']), async (req, res) => {
+    if (!limiter.allow((0, registration_1.registrationAddressKey)(req.ip ?? 'unknown'))) {
+        res.status(429).json({ error: 'rate_limited', error_description: 'too many client registrations; try again later' });
+        return;
+    }
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    const checked = (0, registration_1.validateClientMetadata)(req.body, settings.allowedRedirectUris);
+    if (!checked.ok) {
+        res.status(400).json({ error: checked.error, error_description: checked.description });
+        return;
+    }
+    const client = await (0, oauth_server_2.registerClient)({ clientName: checked.clientName, redirectUris: checked.redirectUris });
+    res.status(201).json({
+        client_id: client.client_id,
+        client_id_issued_at: Math.floor(new Date(client.created_at).getTime() / 1000),
+        client_name: client.client_name ?? undefined,
+        redirect_uris: client.redirect_uris,
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none',
+    });
+});
+exports.default = router;

package/build/routes/oauth-server/token.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/oauth-server/token.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = require("../../lib/http");
+const oauth_server_1 = require("../../modules/oauth-server");
+const defaults_1 = require("../../modules/defaults");
+const oauth_server_2 = require("../../services/auth/oauth-server");
+const registration_1 = require("../../services/auth/oauth-server/registration");
+const router = (0, http_1.Router)();
+/**
+ * A form field, taking the first value when the host parsed repeats into an
+ * array. A value carrying a control character is treated as absent: no
+ * token, id or URI contains one.
+ */
+function field(body, name) {
+    const value = body?.[name];
+    const first = Array.isArray(value) ? value[0] : value;
+    return typeof first === 'string' && first !== '' && !(0, registration_1.hasControlCharacters)(first) ? first : undefined;
+}
+/** RFC 7636 §4.1: 43 to 128 unreserved characters. */
+const CODE_VERIFIER = /^[A-Za-z0-9._~-]{43,128}$/;
+function tokenError(res, error, description) {
+    res.status(400).json({ error, error_description: description });
+}
+function sendTokens(res, snapshot, refreshToken) {
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    const { token, expiresIn } = (0, oauth_server_2.signAccessToken)(snapshot, { issuer: settings.issuer, audience: settings.resource });
+    res.json({ access_token: token, token_type: 'Bearer', expires_in: expiresIn, refresh_token: refreshToken, scope: snapshot.scope });
+}
+const tokenEndpoint = [(0, http_1.allowAnyOrigin)(['POST']), (0, http_1.formBody)()];
+/**
+ * POST /api/oauth/token
+ * grant_type=authorization_code: code, redirect_uri, client_id, code_verifier
+ * grant_type=refresh_token: refresh_token, client_id
+ * Returns { access_token, token_type, expires_in, refresh_token, scope }.
+ */
+router.options('/token', (0, http_1.allowAnyOrigin)(['POST']));
+router.post('/token', ...tokenEndpoint, async (req, res) => {
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Pragma', 'no-cache');
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    const grantType = field(req.body, 'grant_type');
+    const clientId = field(req.body, 'client_id');
+    if (!clientId)
+        return tokenError(res, 'invalid_request', 'client_id is required');
+    if (grantType === 'authorization_code') {
+        const code = field(req.body, 'code');
+        const redirectUri = field(req.body, 'redirect_uri');
+        const codeVerifier = field(req.body, 'code_verifier');
+        if (!code || !redirectUri || !codeVerifier) {
+            return tokenError(res, 'invalid_request', 'code, redirect_uri and code_verifier are required');
+        }
+        if (!CODE_VERIFIER.test(codeVerifier)) {
+            return tokenError(res, 'invalid_request', 'code_verifier must be 43 to 128 unreserved characters');
+        }
+        const resource = field(req.body, 'resource');
+        if (resource !== undefined && resource !== settings.resource) {
+            return tokenError(res, 'invalid_target', `resource must be ${settings.resource}`);
+        }
+        const exchanged = await (0, oauth_server_2.exchangeAuthorizationCode)({
+            code, clientId, redirectUri, codeVerifier, refreshTtlSeconds: defaults_1.OAUTH_REFRESH_TOKEN_TTL_SECONDS,
+        });
+        if (!exchanged)
+            return tokenError(res, 'invalid_grant', 'the authorization code is invalid, expired or already used');
+        return sendTokens(res, exchanged.snapshot, exchanged.refreshToken);
+    }
+    if (grantType === 'refresh_token') {
+        const refreshToken = field(req.body, 'refresh_token');
+        if (!refreshToken)
+            return tokenError(res, 'invalid_request', 'refresh_token is required');
+        const rotated = await (0, oauth_server_2.rotateRefreshToken)({ refreshToken, clientId, refreshTtlSeconds: defaults_1.OAUTH_REFRESH_TOKEN_TTL_SECONDS });
+        if (rotated.snapshot === null) {
+            return tokenError(res, 'invalid_grant', 'the refresh token is invalid, expired or revoked');
+        }
+        return sendTokens(res, rotated.snapshot, rotated.refreshToken);
+    }
+    return tokenError(res, 'unsupported_grant_type', 'grant_type must be authorization_code or refresh_token');
+});
+/**
+ * POST /api/oauth/revoke
+ * Token revocation (RFC 7009): a refresh token or an access token, with the
+ * client_id that holds it. Revokes the whole grant. Always answers 200.
+ */
+router.options('/revoke', (0, http_1.allowAnyOrigin)(['POST']));
+router.post('/revoke', ...tokenEndpoint, async (req, res) => {
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    const token = field(req.body, 'token');
+    const clientId = field(req.body, 'client_id');
+    if (token && clientId) {
+        const claims = (0, oauth_server_2.verifyAccessToken)(token, { issuer: settings.issuer, audience: settings.resource });
+        if (claims) {
+            if (claims.client_id === clientId)
+                await (0, oauth_server_2.revokeGrant)(claims.gid);
+        }
+        else {
+            await (0, oauth_server_2.revokeByRefreshToken)(token, clientId);
+        }
+    }
+    res.status(200).end();
+});
+exports.default = router;

package/build/routes/oauth-well-known.d.ts

@@ -0,0 +1,8 @@
+import { Router } from '../lib/http';
+/**
+ * The two OAuth well-known documents, mounted at the host's root. Answers
+ * exactly those paths and passes every other request on, so it never shadows
+ * the host's routes. Paths are computed per request because the issuer is
+ * configured after the router is mounted.
+ */
+export declare function createWellKnownRouter(): Router;

package/build/routes/oauth-well-known.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWellKnownRouter = createWellKnownRouter;
+const http_1 = require("../lib/http");
+const oauth_server_1 = require("../modules/oauth-server");
+const metadata_1 = require("../services/auth/oauth-server/metadata");
+/**
+ * The two OAuth well-known documents, mounted at the host's root. Answers
+ * exactly those paths and passes every other request on, so it never shadows
+ * the host's routes. Paths are computed per request because the issuer is
+ * configured after the router is mounted.
+ */
+function createWellKnownRouter() {
+    const router = (0, http_1.Router)();
+    const cors = (0, http_1.allowAnyOrigin)(['GET']);
+    router.use((req, res, next) => {
+        const settings = (0, oauth_server_1.getOAuthServerSettings)();
+        if (!settings || (req.method !== 'GET' && req.method !== 'OPTIONS'))
+            return next();
+        const paths = (0, metadata_1.wellKnownPaths)(settings);
+        const document = req.path === paths.authorizationServer
+            ? (0, metadata_1.authorizationServerMetadata)(settings)
+            : req.path === paths.protectedResource
+                ? (0, metadata_1.protectedResourceMetadata)(settings)
+                : null;
+        if (!document)
+            return next();
+        cors(req, res, () => res.json(document));
+    });
+    return router;
+}

package/build/routes/oauth.js

@@ -1,12 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.setOAuthConfig = setOAuthConfig;
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const logger_1 = require("../lib/logger");
 const oauth_1 = require("../services/oauth");
 const user_1 = require("../services/user");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── OAuth startup config (set by initializeOAuth) ────────────────────────────
 let _oauthConfig = {
     autoProvision: true,

package/build/routes/overview.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/overview"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/overview?period=24h
  * System overview — triage, throughput, trends, infrastructure, processes.

package/build/routes/personas.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/personas"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // Personas are role bundles — a management surface. Reads and writes share the
 // role-management gate (admin type, superadmin, engineer), the same audience
 // that manages roles and users.