@hotmeshio/long-tail 0.23.2 → 0.24.0

package/build/routes/yaml-workflows/deployment.js

@@ -33,24 +33,25 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const api = __importStar(require("../../api/yaml-workflows"));
-const router = (0, express_1.Router)();
+const auth_1 = require("../../modules/auth");
+const router = (0, http_1.Router)();
 /**
  * POST /api/yaml-workflows/:id/deploy
  * Deploy all YAML workflows sharing this workflow's app_id as a merged version.
  * Bumps the version and deploys all graphs together.
  */
-router.post('/:id/deploy', async (req, res) => {
-    const result = await api.deployYamlWorkflow({ id: req.params.id });
+router.post('/:id/deploy', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.deployYamlWorkflow({ id: String(req.params.id) }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * POST /api/yaml-workflows/:id/activate
  * Activate the deployed version for this workflow's app_id and register all workers.
  */
-router.post('/:id/activate', async (req, res) => {
-    const result = await api.activateYamlWorkflow({ id: req.params.id });
+router.post('/:id/activate', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.activateYamlWorkflow({ id: String(req.params.id) }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
@@ -72,16 +73,16 @@ router.post('/:id/invoke', async (req, res) => {
  * POST /api/yaml-workflows/:id/archive
  * Archive a YAML workflow (stops accepting new invocations).
  */
-router.post('/:id/archive', async (req, res) => {
-    const result = await api.archiveYamlWorkflow({ id: req.params.id });
+router.post('/:id/archive', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.archiveYamlWorkflow({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * POST /api/yaml-workflows/:id/restore
  * Restore an archived YAML workflow back to draft status for redeployment.
  */
-router.post('/:id/restore', async (req, res) => {
-    const result = await api.restoreYamlWorkflow({ id: req.params.id });
+router.post('/:id/restore', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.restoreYamlWorkflow({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/yaml-workflows/index.js

@@ -3,12 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const cron_1 = __importDefault(require("./cron"));
 const crud_1 = __importDefault(require("./crud"));
 const deployment_1 = __importDefault(require("./deployment"));
 const versions_1 = __importDefault(require("./versions"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // cron.ts handles: GET /cron/status, PUT /:id/cron, DELETE /:id/cron
 // Mount before crud so /cron/status doesn't match /:id
 router.use(cron_1.default);

package/build/routes/yaml-workflows/versions.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const api = __importStar(require("../../api/yaml-workflows"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/yaml-workflows/:id/versions
  * Return version history for a YAML workflow.

package/build/services/agent/authority.d.ts

@@ -0,0 +1,14 @@
+import type { AgentBehaviors } from '../../types/agent';
+/** Refuse an agent create or update whose schedules the caller could not run themselves. */
+export declare function assertMayConfigureAgent(callerId: string, input: {
+    id?: string;
+    user_id?: string | null;
+    behaviors?: AgentBehaviors;
+}): Promise<void>;
+/** Refuse a subscription create or update the caller could not run themselves. */
+export declare function assertMayConfigureSubscription(callerId: string, input: {
+    agentId: string;
+    subscriptionId?: string;
+    reaction_type?: string;
+    execute_as?: string | null;
+}): Promise<void>;

package/build/services/agent/authority.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertMayConfigureAgent = assertMayConfigureAgent;
+exports.assertMayConfigureSubscription = assertMayConfigureSubscription;
+/**
+ * Who may configure automation. Agents run on their own, as the identity they
+ * name (an execute_as, else the agent's user_id) or, with none, as lt-system.
+ * Whoever configures one must be able to run as that identity: the same rule
+ * as an execute_as override. Automation that would run as lt-system, or a
+ * capability subscription (a tool called with lt-system authority), is a
+ * superadmin's to configure.
+ */
+const workflow_invocation_1 = require("../workflow-invocation");
+const user_1 = require("../user");
+const index_1 = require("./index");
+const subscriptions_1 = require("./subscriptions");
+const SYSTEM_AUTHORITY = 'runs as lt-system; only superadmin can configure it';
+async function assertIdentity(callerId, identity, what) {
+    if (!identity)
+        throw new workflow_invocation_1.InvocationError(`${what} has no identity, so it ${SYSTEM_AUTHORITY}`, 403);
+    await (0, workflow_invocation_1.assertMayActAs)(callerId, identity);
+}
+/** Refuse an agent create or update whose schedules the caller could not run themselves. */
+async function assertMayConfigureAgent(callerId, input) {
+    if (await (0, user_1.isSuperAdmin)(callerId))
+        return;
+    const existing = input.id ? await (0, index_1.getAgent)(input.id) : null;
+    const userId = input.user_id !== undefined ? input.user_id : existing?.user_id ?? null;
+    const behaviors = input.behaviors ?? existing?.behaviors;
+    if (userId)
+        await (0, workflow_invocation_1.assertMayActAs)(callerId, userId);
+    if (behaviors?.cron)
+        await assertIdentity(callerId, userId, 'the agent schedule');
+    for (const schedule of behaviors?.schedules ?? []) {
+        await assertIdentity(callerId, schedule.execute_as || userId, 'an agent schedule');
+    }
+}
+/** Refuse a subscription create or update the caller could not run themselves. */
+async function assertMayConfigureSubscription(callerId, input) {
+    if (await (0, user_1.isSuperAdmin)(callerId))
+        return;
+    const existing = input.subscriptionId ? await (0, subscriptions_1.getSubscription)(input.subscriptionId) : null;
+    if (input.subscriptionId && (!existing || existing.agent_id !== input.agentId)) {
+        throw new workflow_invocation_1.InvocationError('Subscription not found', 404);
+    }
+    const reaction = input.reaction_type ?? existing?.reaction_type;
+    if (reaction === 'capability') {
+        throw new workflow_invocation_1.InvocationError(`a capability subscription calls a tool directly, so it ${SYSTEM_AUTHORITY}`, 403);
+    }
+    const agent = await (0, index_1.getAgent)(input.agentId);
+    const executeAs = input.execute_as !== undefined ? input.execute_as : existing?.execute_as;
+    await assertIdentity(callerId, executeAs || agent?.user_id, 'the subscription');
+}

package/build/services/auth/bot-api-key.d.ts

@@ -29,4 +29,6 @@ export declare function revokeBotApiKey(id: string): Promise<boolean>;
 /**
  * List API keys for a bot account (without hashes).
  */
+/** The bot account a key belongs to, or null when there is no such key. */
+export declare function getBotApiKeyOwner(keyId: string): Promise<string | null>;
 export declare function listBotApiKeys(userId: string): Promise<BotApiKeyRecord[]>;

package/build/services/auth/bot-api-key.js

@@ -39,8 +39,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateBotApiKey = generateBotApiKey;
 exports.validateBotApiKey = validateBotApiKey;
 exports.revokeBotApiKey = revokeBotApiKey;
+exports.getBotApiKeyOwner = getBotApiKeyOwner;
 exports.listBotApiKeys = listBotApiKeys;
 const crypto = __importStar(require("crypto"));
+const uuid_1 = require("../../lib/uuid");
 const bcryptjs_1 = __importDefault(require("bcryptjs"));
 const db_1 = require("../../lib/db");
 const sql_1 = require("./sql");
@@ -87,6 +89,14 @@ async function revokeBotApiKey(id) {
 /**
  * List API keys for a bot account (without hashes).
  */
+/** The bot account a key belongs to, or null when there is no such key. */
+async function getBotApiKeyOwner(keyId) {
+    if (!(0, uuid_1.isUuid)(keyId))
+        return null;
+    const pool = await (0, db_1.getPool)();
+    const { rows } = await pool.query(sql_1.GET_BOT_KEY_OWNER, [keyId]);
+    return rows[0]?.user_id ?? null;
+}
 async function listBotApiKeys(userId) {
     const pool = await (0, db_1.getPool)();
     const { rows } = await pool.query(sql_1.LIST_BOT_KEYS_BY_USER, [userId]);

package/build/services/auth/oauth-server/access-token.d.ts

@@ -0,0 +1,36 @@
+import type { AuthPayload, LTGrantPolicy, LTGrantRole, LTGrantSnapshot } from '../../../types';
+/**
+ * Access tokens are HS256 JWTs for one resource (`aud`, the `/mcp` URL). They
+ * name the grant (`gid`) and the person (`sub`) and carry no `userId` claim,
+ * so `requireAuth` refuses them on `/api`. A verified token is honored only
+ * while its grant is live: `/mcp` reads the grant on each request and acts on
+ * its current roles, policy and scope.
+ */
+export interface AccessTokenTarget {
+    issuer: string;
+    audience: string;
+}
+export interface LTAccessTokenClaims {
+    iss: string;
+    aud: string;
+    sub: string;
+    client_id: string;
+    gid: string;
+    scope: string;
+    policy: LTGrantPolicy;
+    roles: LTGrantRole[];
+    iat: number;
+    exp: number;
+}
+export declare function signAccessToken(snapshot: LTGrantSnapshot, target: AccessTokenTarget, ttlSeconds?: number): {
+    token: string;
+    expiresIn: number;
+};
+/** The claims of a valid access token for `target`; null for anything else. */
+export declare function verifyAccessToken(token: string, target: AccessTokenTarget): LTAccessTokenClaims | null;
+/**
+ * The request identity for a verified access token and its live grant, in the
+ * shape other credentials produce. Roles, policy and scope come from the grant
+ * as it stands now, not as the token recorded them.
+ */
+export declare function accessTokenPrincipal(claims: LTAccessTokenClaims, live: LTGrantSnapshot): AuthPayload;

package/build/services/auth/oauth-server/access-token.js

@@ -0,0 +1,80 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signAccessToken = signAccessToken;
+exports.verifyAccessToken = verifyAccessToken;
+exports.accessTokenPrincipal = accessTokenPrincipal;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const config_1 = require("../../../modules/config");
+const defaults_1 = require("../../../modules/defaults");
+const constants_1 = require("./constants");
+function signAccessToken(snapshot, target, ttlSeconds = defaults_1.OAUTH_ACCESS_TOKEN_TTL_SECONDS) {
+    if (!config_1.config.JWT_SECRET)
+        throw new Error('signAccessToken: JWT_SECRET is not configured');
+    const token = jsonwebtoken_1.default.sign({
+        client_id: snapshot.client_id,
+        gid: snapshot.grant_id,
+        scope: snapshot.scope,
+        policy: snapshot.policy,
+        roles: snapshot.roles,
+    }, config_1.config.JWT_SECRET, {
+        algorithm: 'HS256',
+        header: { alg: 'HS256', typ: constants_1.ACCESS_TOKEN_TYPE },
+        issuer: target.issuer,
+        audience: target.audience,
+        subject: snapshot.user_id,
+        expiresIn: ttlSeconds,
+    });
+    return { token, expiresIn: ttlSeconds };
+}
+/** The claims of a valid access token for `target`; null for anything else. */
+function verifyAccessToken(token, target) {
+    if (!config_1.config.JWT_SECRET)
+        return null;
+    try {
+        const decoded = jsonwebtoken_1.default.verify(token, config_1.config.JWT_SECRET, {
+            algorithms: ['HS256'],
+            issuer: target.issuer,
+            audience: target.audience,
+            complete: true,
+        });
+        if (decoded.header.typ !== constants_1.ACCESS_TOKEN_TYPE)
+            return null;
+        const claims = decoded.payload;
+        if (typeof claims.exp !== 'number')
+            return null;
+        if (!claims.sub || !claims.gid || !claims.client_id || !Array.isArray(claims.roles))
+            return null;
+        return claims;
+    }
+    catch {
+        return null;
+    }
+}
+function highestRoleType(roles) {
+    if (roles.some((r) => r.type === 'superadmin'))
+        return 'superadmin';
+    if (roles.some((r) => r.type === 'admin'))
+        return 'admin';
+    return 'member';
+}
+/**
+ * The request identity for a verified access token and its live grant, in the
+ * shape other credentials produce. Roles, policy and scope come from the grant
+ * as it stands now, not as the token recorded them.
+ */
+function accessTokenPrincipal(claims, live) {
+    return {
+        userId: claims.sub,
+        role: highestRoleType(live.roles),
+        roles: live.roles.map((r) => ({ role: r.role, type: r.type })),
+        scopes: [live.scope],
+        principalType: constants_1.OAUTH_PRINCIPAL_TYPE,
+        clientId: live.client_id,
+        grantId: live.grant_id,
+        policy: live.policy,
+        grantRoles: live.roles,
+    };
+}

package/build/services/auth/oauth-server/authorization.d.ts

@@ -0,0 +1,47 @@
+import type { OAuthServerSettings } from '../../../modules/oauth-server';
+import type { LTGrantPreset, LTOAuthClient } from '../../../types/oauth-server';
+/**
+ * Validation of an authorization request (RFC 6749 §4.1.1 with PKCE, RFC 7636,
+ * and resource indicators, RFC 8707). Used by the authorize redirect and again
+ * when the person approves, so the consent page is never trusted.
+ */
+export interface AuthorizationRequest {
+    client: LTOAuthClient;
+    redirectUri: string;
+    codeChallenge: string;
+    state?: string;
+    scope?: string;
+    resource: string;
+}
+export type AuthorizationCheck = {
+    ok: true;
+    request: AuthorizationRequest;
+}
+/** The client or redirect URI can't be trusted: answer here, never redirect. */
+ | {
+    ok: false;
+    redirect: false;
+    error: string;
+    description: string;
+}
+/** The client and redirect URI are known: report the error to the client. */
+ | {
+    ok: false;
+    redirect: true;
+    redirectUri: string;
+    state?: string;
+    error: string;
+    description: string;
+};
+export declare function checkAuthorizationRequest(params: Record<string, unknown>, settings: OAuthServerSettings): Promise<AuthorizationCheck>;
+export declare function isGrantPreset(value: unknown): value is LTGrantPreset;
+/** `uri` with `params` added to its query, keeping any query it already has. */
+export declare function withQuery(uri: string, params: Record<string, string | undefined>): string;
+/**
+ * The presets the person may grant. Read-only always; Just be me only when it
+ * adds something: a membership that can write, or an admin tier.
+ */
+export declare function grantablePresets(roles: Array<{
+    type: string;
+    write_scope?: string | null;
+}>): LTGrantPreset[];

package/build/services/auth/oauth-server/authorization.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAuthorizationRequest = checkAuthorizationRequest;
+exports.isGrantPreset = isGrantPreset;
+exports.withQuery = withQuery;
+exports.grantablePresets = grantablePresets;
+const registration_1 = require("./registration");
+const store_1 = require("./store");
+const constants_1 = require("./constants");
+const CODE_CHALLENGE = /^[A-Za-z0-9_-]{43,128}$/;
+const PRESETS = new Set(Object.keys(constants_1.PRESET_SCOPE));
+const text = (value) => (typeof value === 'string' && value !== '' && !(0, registration_1.hasControlCharacters)(value) ? value : undefined);
+async function checkAuthorizationRequest(params, settings) {
+    const clientId = text(params.client_id);
+    const redirectUri = text(params.redirect_uri);
+    const client = clientId ? await (0, store_1.getClient)(clientId) : null;
+    if (!client)
+        return { ok: false, redirect: false, error: 'invalid_client', description: 'unknown client_id' };
+    if (!redirectUri || !client.redirect_uris.includes(redirectUri)) {
+        return { ok: false, redirect: false, error: 'invalid_request', description: 'redirect_uri is not registered for this client' };
+    }
+    const state = text(params.state);
+    const fail = (error, description) => ({ ok: false, redirect: true, redirectUri, state, error, description });
+    if (params.response_type !== 'code')
+        return fail('unsupported_response_type', 'response_type must be code');
+    const codeChallenge = text(params.code_challenge);
+    if (!codeChallenge || !CODE_CHALLENGE.test(codeChallenge))
+        return fail('invalid_request', 'a PKCE code_challenge is required');
+    if (params.code_challenge_method !== 'S256')
+        return fail('invalid_request', 'code_challenge_method must be S256');
+    const resource = text(params.resource) ?? settings.resource;
+    if (resource !== settings.resource)
+        return fail('invalid_target', `resource must be ${settings.resource}`);
+    return { ok: true, request: { client, redirectUri, codeChallenge, state, scope: text(params.scope), resource } };
+}
+function isGrantPreset(value) {
+    return typeof value === 'string' && PRESETS.has(value);
+}
+/** `uri` with `params` added to its query, keeping any query it already has. */
+function withQuery(uri, params) {
+    const url = new URL(uri);
+    for (const [key, value] of Object.entries(params))
+        if (value !== undefined)
+            url.searchParams.set(key, value);
+    return url.toString();
+}
+/**
+ * The presets the person may grant. Read-only always; Just be me only when it
+ * adds something: a membership that can write, or an admin tier.
+ */
+function grantablePresets(roles) {
+    const canWrite = roles.some((r) => r.type === 'admin' || r.type === 'superadmin' || (r.write_scope ?? 'all') !== 'none');
+    return canWrite ? ['read_only', 'just_me'] : ['read_only'];
+}

package/build/services/auth/oauth-server/constants.d.ts

@@ -0,0 +1,11 @@
+import type { LTGrantPreset } from '../../../types/oauth-server';
+export declare const MCP_SCOPES: {
+    readonly READ: "mcp:read";
+    readonly FULL: "mcp:full";
+};
+/** The coarse scope a grant preset is reported as. */
+export declare const PRESET_SCOPE: Record<LTGrantPreset, string>;
+/** JOSE `typ` for access tokens (RFC 9068). */
+export declare const ACCESS_TOKEN_TYPE = "at+jwt";
+/** `principalType` of a request authenticated by an OAuth access token. */
+export declare const OAUTH_PRINCIPAL_TYPE = "oauth";

package/build/services/auth/oauth-server/constants.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAUTH_PRINCIPAL_TYPE = exports.ACCESS_TOKEN_TYPE = exports.PRESET_SCOPE = exports.MCP_SCOPES = void 0;
+exports.MCP_SCOPES = {
+    READ: 'mcp:read',
+    FULL: 'mcp:full',
+};
+/** The coarse scope a grant preset is reported as. */
+exports.PRESET_SCOPE = {
+    read_only: exports.MCP_SCOPES.READ,
+    just_me: exports.MCP_SCOPES.FULL,
+};
+/** JOSE `typ` for access tokens (RFC 9068). */
+exports.ACCESS_TOKEN_TYPE = 'at+jwt';
+/** `principalType` of a request authenticated by an OAuth access token. */
+exports.OAUTH_PRINCIPAL_TYPE = 'oauth';

package/build/services/auth/oauth-server/index.d.ts

@@ -0,0 +1,3 @@
+export { REFRESH_REUSE_GRACE_SECONDS, createSecret, hashSecret, pkceChallenge, registerClient, getClient, issueAuthorizationCode, exchangeAuthorizationCode, rotateRefreshToken, getLiveGrant, revokeByRefreshToken, revokeGrant, listGrants, type RevokedGrant, } from './store';
+export { signAccessToken, verifyAccessToken, accessTokenPrincipal, type AccessTokenTarget, type LTAccessTokenClaims, } from './access-token';
+export { MCP_SCOPES, PRESET_SCOPE, ACCESS_TOKEN_TYPE, OAUTH_PRINCIPAL_TYPE } from './constants';

package/build/services/auth/oauth-server/index.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAUTH_PRINCIPAL_TYPE = exports.ACCESS_TOKEN_TYPE = exports.PRESET_SCOPE = exports.MCP_SCOPES = exports.accessTokenPrincipal = exports.verifyAccessToken = exports.signAccessToken = exports.listGrants = exports.revokeGrant = exports.revokeByRefreshToken = exports.getLiveGrant = exports.rotateRefreshToken = exports.exchangeAuthorizationCode = exports.issueAuthorizationCode = exports.getClient = exports.registerClient = exports.pkceChallenge = exports.hashSecret = exports.createSecret = exports.REFRESH_REUSE_GRACE_SECONDS = void 0;
+var store_1 = require("./store");
+Object.defineProperty(exports, "REFRESH_REUSE_GRACE_SECONDS", { enumerable: true, get: function () { return store_1.REFRESH_REUSE_GRACE_SECONDS; } });
+Object.defineProperty(exports, "createSecret", { enumerable: true, get: function () { return store_1.createSecret; } });
+Object.defineProperty(exports, "hashSecret", { enumerable: true, get: function () { return store_1.hashSecret; } });
+Object.defineProperty(exports, "pkceChallenge", { enumerable: true, get: function () { return store_1.pkceChallenge; } });
+Object.defineProperty(exports, "registerClient", { enumerable: true, get: function () { return store_1.registerClient; } });
+Object.defineProperty(exports, "getClient", { enumerable: true, get: function () { return store_1.getClient; } });
+Object.defineProperty(exports, "issueAuthorizationCode", { enumerable: true, get: function () { return store_1.issueAuthorizationCode; } });
+Object.defineProperty(exports, "exchangeAuthorizationCode", { enumerable: true, get: function () { return store_1.exchangeAuthorizationCode; } });
+Object.defineProperty(exports, "rotateRefreshToken", { enumerable: true, get: function () { return store_1.rotateRefreshToken; } });
+Object.defineProperty(exports, "getLiveGrant", { enumerable: true, get: function () { return store_1.getLiveGrant; } });
+Object.defineProperty(exports, "revokeByRefreshToken", { enumerable: true, get: function () { return store_1.revokeByRefreshToken; } });
+Object.defineProperty(exports, "revokeGrant", { enumerable: true, get: function () { return store_1.revokeGrant; } });
+Object.defineProperty(exports, "listGrants", { enumerable: true, get: function () { return store_1.listGrants; } });
+var access_token_1 = require("./access-token");
+Object.defineProperty(exports, "signAccessToken", { enumerable: true, get: function () { return access_token_1.signAccessToken; } });
+Object.defineProperty(exports, "verifyAccessToken", { enumerable: true, get: function () { return access_token_1.verifyAccessToken; } });
+Object.defineProperty(exports, "accessTokenPrincipal", { enumerable: true, get: function () { return access_token_1.accessTokenPrincipal; } });
+var constants_1 = require("./constants");
+Object.defineProperty(exports, "MCP_SCOPES", { enumerable: true, get: function () { return constants_1.MCP_SCOPES; } });
+Object.defineProperty(exports, "PRESET_SCOPE", { enumerable: true, get: function () { return constants_1.PRESET_SCOPE; } });
+Object.defineProperty(exports, "ACCESS_TOKEN_TYPE", { enumerable: true, get: function () { return constants_1.ACCESS_TOKEN_TYPE; } });
+Object.defineProperty(exports, "OAUTH_PRINCIPAL_TYPE", { enumerable: true, get: function () { return constants_1.OAUTH_PRINCIPAL_TYPE; } });

package/build/services/auth/oauth-server/metadata.d.ts

@@ -0,0 +1,21 @@
+import type { OAuthServerSettings } from '../../../modules/oauth-server';
+/** Endpoint paths under the issuer. */
+export declare const OAUTH_ENDPOINT_PATHS: {
+    readonly AUTHORIZE: "/api/oauth/authorize";
+    readonly TOKEN: "/api/oauth/token";
+    readonly REGISTER: "/api/oauth/register";
+    readonly REVOKE: "/api/oauth/revoke";
+};
+/** RFC 8414 authorization server metadata. */
+export declare function authorizationServerMetadata(settings: OAuthServerSettings): Record<string, unknown>;
+/** RFC 9728 protected resource metadata for `/mcp`. */
+export declare function protectedResourceMetadata(settings: OAuthServerSettings): Record<string, unknown>;
+/**
+ * Root-relative paths of the two well-known documents. The issuer's and the
+ * resource's paths are appended after the well-known segment (RFC 8414 §3,
+ * RFC 9728 §3).
+ */
+export declare function wellKnownPaths(settings: OAuthServerSettings): {
+    authorizationServer: string;
+    protectedResource: string;
+};

package/build/services/auth/oauth-server/metadata.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAUTH_ENDPOINT_PATHS = void 0;
+exports.authorizationServerMetadata = authorizationServerMetadata;
+exports.protectedResourceMetadata = protectedResourceMetadata;
+exports.wellKnownPaths = wellKnownPaths;
+const constants_1 = require("./constants");
+/** Endpoint paths under the issuer. */
+exports.OAUTH_ENDPOINT_PATHS = {
+    AUTHORIZE: '/api/oauth/authorize',
+    TOKEN: '/api/oauth/token',
+    REGISTER: '/api/oauth/register',
+    REVOKE: '/api/oauth/revoke',
+};
+const SCOPES_SUPPORTED = [constants_1.MCP_SCOPES.READ, constants_1.MCP_SCOPES.FULL];
+/** RFC 8414 authorization server metadata. */
+function authorizationServerMetadata(settings) {
+    const at = (path) => `${settings.issuer}${path}`;
+    return {
+        issuer: settings.issuer,
+        authorization_endpoint: at(exports.OAUTH_ENDPOINT_PATHS.AUTHORIZE),
+        token_endpoint: at(exports.OAUTH_ENDPOINT_PATHS.TOKEN),
+        registration_endpoint: at(exports.OAUTH_ENDPOINT_PATHS.REGISTER),
+        revocation_endpoint: at(exports.OAUTH_ENDPOINT_PATHS.REVOKE),
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code', 'refresh_token'],
+        code_challenge_methods_supported: ['S256'],
+        token_endpoint_auth_methods_supported: ['none'],
+        revocation_endpoint_auth_methods_supported: ['none'],
+        scopes_supported: SCOPES_SUPPORTED,
+    };
+}
+/** RFC 9728 protected resource metadata for `/mcp`. */
+function protectedResourceMetadata(settings) {
+    return {
+        resource: settings.resource,
+        authorization_servers: [settings.issuer],
+        bearer_methods_supported: ['header'],
+        scopes_supported: SCOPES_SUPPORTED,
+    };
+}
+/**
+ * Root-relative paths of the two well-known documents. The issuer's and the
+ * resource's paths are appended after the well-known segment (RFC 8414 §3,
+ * RFC 9728 §3).
+ */
+function wellKnownPaths(settings) {
+    const issuerPath = new URL(settings.issuer).pathname.replace(/\/+$/, '');
+    return {
+        authorizationServer: `/.well-known/oauth-authorization-server${issuerPath}`,
+        protectedResource: new URL(settings.resourceMetadataUrl).pathname,
+    };
+}

package/build/services/auth/oauth-server/registration.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Dynamic client registration (RFC 7591) for public MCP clients: validation
+ * of the requested client metadata, and a per-address registration limit.
+ */
+/** Whether a value carries a control character. */
+export declare function hasControlCharacters(value: string): boolean;
+/** A client name as the consent page may show it: no controls, no direction overrides, trimmed. */
+export declare function displayableClientName(name: string): string;
+/**
+ * The address a registration counts against: IPv4 as is, IPv6 by its /64,
+ * which one host or network usually holds in full.
+ */
+export declare function registrationAddressKey(address: string): string;
+export declare const REGISTRATION_ERRORS: {
+    readonly INVALID_REDIRECT_URI: "invalid_redirect_uri";
+    readonly INVALID_CLIENT_METADATA: "invalid_client_metadata";
+};
+export type RegistrationResult = {
+    ok: true;
+    clientName?: string;
+    redirectUris: string[];
+} | {
+    ok: false;
+    error: string;
+    description: string;
+};
+/**
+ * Loopback http or https on any port, or an https URI equal, in canonical
+ * form, to one the deployment allows. Matching whole URIs, not hosts, keeps a
+ * code from landing on any other path, query or port of an allowed host.
+ */
+export declare function isAllowedRedirectUri(uri: string, allowedUris: string[]): boolean;
+export declare function validateClientMetadata(body: unknown, allowedUris: string[]): RegistrationResult;
+/** A fixed-window count of registrations per address, in memory, per process. */
+export declare class RegistrationLimiter {
+    private readonly limit;
+    private readonly windowMs;
+    private windows;
+    constructor(limit: number, windowMs: number);
+    /** Count one registration from `address`; false when over the limit. */
+    allow(address: string, now?: number): boolean;
+}