@hotmeshio/long-tail 0.23.2 → 0.24.1

package/build/modules/auth.js

@@ -1,42 +1,9 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireRoleManager = exports.requireBuilder = exports.requireAdmin = exports.requireAuth = exports.JwtAuthAdapter = void 0;
+exports.requireWorkflowReader = exports.requireRoleManager = exports.requireBuilder = exports.requireAdmin = exports.requireCredentialAuth = exports.requireAuth = exports.JwtAuthAdapter = void 0;
 exports.createAuthMiddleware = createAuthMiddleware;
 exports.setAuthAdapter = setAuthAdapter;
 exports.signToken = signToken;
@@ -44,7 +11,7 @@ const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const config_1 = require("./config");
 const sso_1 = require("./sso");
 const logger_1 = require("../lib/logger");
-const user_1 = require("../services/user");
+const capabilities_1 = require("./capabilities");
 const sso_provision_1 = require("../services/user/sso-provision");
 const bot_api_key_1 = require("../services/auth/bot-api-key");
 const principal_1 = require("../services/iam/principal");
@@ -192,6 +159,16 @@ const requireAuth = async (req, res, next) => {
     mw(req, res, next);
 };
 exports.requireAuth = requireAuth;
+/**
+ * `requireAuth` without the SSO fallback: only a credential the request
+ * carries itself (the configured adapter, else a Bearer JWT or bot key).
+ * For endpoints a cross-site page must not reach through the host's cookie.
+ */
+const requireCredentialAuth = (req, res, next) => {
+    const mw = _authMiddleware || createAuthMiddleware(new JwtAuthAdapter());
+    return mw(req, res, next);
+};
+exports.requireCredentialAuth = requireCredentialAuth;
 /**
  * Replace the auth adapter used by `requireAuth`.
  * Call before starting the server.
@@ -199,107 +176,47 @@ exports.requireAuth = requireAuth;
 function setAuthAdapter(adapter) {
     _authMiddleware = createAuthMiddleware(adapter);
 }
-/**
- * Middleware that requires admin access. Must be placed AFTER requireAuth.
- *
- * Checks isSuperAdmin() via the database first, then falls back to the
- * JWT `role` claim for stateless admin checks. Returns 403 otherwise.
- */
-const requireAdmin = async (req, res, next) => {
-    try {
-        if (!req.auth?.userId) {
-            res.status(403).json({ error: 'Forbidden' });
-            return;
-        }
-        // Fast path: trust the JWT role claim for admin/superadmin
-        if (req.auth.role === 'admin' || req.auth.role === 'superadmin') {
-            next();
-            return;
-        }
-        // Slow path: check database for superadmin role type
-        if (await (0, user_1.isSuperAdmin)(req.auth.userId)) {
-            next();
-            return;
+/** Express gate over a capability predicate. Must be placed AFTER requireAuth. */
+function requireCapability(check, denial) {
+    return async (req, res, next) => {
+        try {
+            if (!req.auth?.userId) {
+                res.status(403).json({ error: 'Forbidden' });
+                return;
+            }
+            if (await check(req.auth)) {
+                next();
+                return;
+            }
+            res.status(403).json({ error: denial });
         }
-        res.status(403).json({ error: 'Forbidden: admin access required' });
-    }
-    catch {
-        res.status(403).json({ error: 'Forbidden' });
-    }
-};
-exports.requireAdmin = requireAdmin;
-/**
- * Middleware that requires builder access. Must be placed AFTER requireAuth.
- *
- * Builders are superadmin or users with the 'engineer' role.
- * This is the backend equivalent of the dashboard's `isBuilder` check.
- */
-const requireBuilder = async (req, res, next) => {
-    try {
-        if (!req.auth?.userId) {
+        catch {
             res.status(403).json({ error: 'Forbidden' });
-            return;
         }
-        // Fast path: trust the JWT role claim for superadmin
-        if (req.auth.role === 'superadmin') {
-            next();
-            return;
-        }
-        // Check database for superadmin role type
-        if (await (0, user_1.isSuperAdmin)(req.auth.userId)) {
-            next();
-            return;
-        }
-        // Check database for engineer role (builder)
-        const { hasRole } = await Promise.resolve().then(() => __importStar(require('../services/user/roles')));
-        if (await hasRole(req.auth.userId, 'engineer')) {
-            next();
-            return;
-        }
-        res.status(403).json({ error: 'Forbidden: builder access required' });
-    }
-    catch {
-        res.status(403).json({ error: 'Forbidden' });
-    }
-};
-exports.requireBuilder = requireBuilder;
-/**
- * Middleware that requires role-management access. Must be placed AFTER requireAuth.
- *
- * Grants access to superadmins, admin-type users, and engineers — the backend
- * equivalent of the dashboard's `isBuilder || isOps`. Ops (admin type) manage
- * users and roles; builders (superadmin, engineer) are a superset. This is the
- * gate for reading and writing role definitions.
- */
-const requireRoleManager = async (req, res, next) => {
+    };
+}
+/** Admin access: admin or superadmin claim, or a superadmin in the database. */
+exports.requireAdmin = requireCapability(capabilities_1.mayAdminister, 'Forbidden: admin access required');
+/** Builder access: superadmin or the 'engineer' role. Backend twin of the dashboard's `isBuilder`. */
+exports.requireBuilder = requireCapability(capabilities_1.mayBuild, 'Forbidden: builder access required');
+/** Role-management access: admin access or the 'engineer' role. Backend twin of `isBuilder || isOps`. */
+exports.requireRoleManager = requireCapability(capabilities_1.mayManageRoles, 'Forbidden: role-management access required');
+/** Reads of one workflow run (`:workflowId`): builder access, or the person who started it or it runs as. */
+const requireWorkflowReader = async (req, res, next) => {
     try {
-        if (!req.auth?.userId) {
-            res.status(403).json({ error: 'Forbidden' });
-            return;
-        }
-        // Fast path: trust the JWT role claim for admin/superadmin
-        if (req.auth.role === 'admin' || req.auth.role === 'superadmin') {
-            next();
-            return;
-        }
-        // Slow path: check database for superadmin role type
-        if (await (0, user_1.isSuperAdmin)(req.auth.userId)) {
-            next();
-            return;
-        }
-        // Check database for engineer role (builder)
-        const { hasRole } = await Promise.resolve().then(() => __importStar(require('../services/user/roles')));
-        if (await hasRole(req.auth.userId, 'engineer')) {
+        if (req.auth?.userId && await (0, capabilities_1.mayReadWorkflowRun)(req.auth, String(req.params.workflowId))) {
             next();
             return;
         }
-        res.status(403).json({ error: 'Forbidden: role-management access required' });
+        res.status(403).json({ error: 'Forbidden: workflow read access required' });
     }
-    catch {
-        res.status(403).json({ error: 'Forbidden' });
+    catch (err) {
+        // A failed lookup is not an access decision: report it, and serve nothing.
+        logger_1.loggerRegistry.error(`[long-tail] workflow read check failed: ${err?.message}`);
+        res.status(500).json({ error: 'Workflow read check failed' });
     }
 };
-exports.requireRoleManager = requireRoleManager;
+exports.requireWorkflowReader = requireWorkflowReader;
 /**
  * Generate a JWT token. Utility for tests and token provisioning.
  */

package/build/modules/capabilities.d.ts

@@ -0,0 +1,62 @@
+import type { AuthPayload, CapabilityAccess, CapabilitySet, LTGrantRole } from '../types';
+/**
+ * Capability predicates shared by every entry point that faces people.
+ *
+ * Each predicate trusts the principal's `role` claim first and only then
+ * consults the database. Lookup errors propagate so callers can deny.
+ */
+export type CapabilityPrincipal = Pick<AuthPayload, 'userId' | 'role'> & {
+    /** Present for OAuth callers: the memberships the access token carries. */
+    grantRoles?: LTGrantRole[];
+};
+export interface RoleGrant {
+    role: string;
+    type?: string;
+}
+export type GrantDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    error: string;
+};
+/** Admin or superadmin claim, or a superadmin in the database. */
+export declare function mayAdminister(principal: CapabilityPrincipal | undefined): Promise<boolean>;
+/** Superadmin (claim or database), or holder of the engineer role. */
+export declare function mayBuild(principal: CapabilityPrincipal | undefined): Promise<boolean>;
+/**
+ * Builder access, or the person a workflow run was started by or runs as,
+ * read from the run's own start envelope.
+ */
+export declare function mayReadWorkflowRun(principal: CapabilityPrincipal | undefined, workflowId: string): Promise<boolean>;
+/** Anyone who may administer, plus holders of the engineer role. */
+export declare function mayManageRoles(principal: CapabilityPrincipal | undefined): Promise<boolean>;
+/**
+ * Whether `granterId` may assign `grant` to a user.
+ *
+ * - superadmin: any role and type
+ * - engineer: any role, never the superadmin type
+ * - anyone else: only roles they hold, never the superadmin type
+ */
+export declare function mayGrantRole(granterId: string, grant: RoleGrant): Promise<GrantDecision>;
+/** Whether `granterId` may assign every grant in a new account's role list. */
+export declare function mayGrantRoles(granterId: string, grants: RoleGrant[] | undefined): Promise<GrantDecision>;
+/**
+ * Whether `callerId` may change, remove, or mint keys for an account. An
+ * account holding superadmin is a superadmin's to manage; any other account
+ * is left to the route's own gate.
+ */
+export declare function mayManageAccount(callerId: string, targetId: string): Promise<GrantDecision>;
+/** Removing a role follows the grant rule for the role as the account holds it. */
+export declare function mayRevokeRole(callerId: string, targetId: string, role: string): Promise<GrantDecision>;
+/**
+ * Every capability the principal holds, with the same outcomes as the
+ * predicates above. A superadmin claim costs no lookup; anyone else costs
+ * at most one superadmin lookup and one engineer-role lookup.
+ */
+export declare function resolveCapabilities(principal: CapabilityPrincipal | undefined): Promise<CapabilitySet>;
+/**
+ * Capability checks for one request. `caller` needs only an authenticated
+ * principal; any other gate resolves the principal's capabilities once, on
+ * first need, so a request that checks only `caller` gates makes no lookup.
+ */
+export declare function capabilityAccess(principal: CapabilityPrincipal | undefined): CapabilityAccess;

package/build/modules/capabilities.js

@@ -0,0 +1,188 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mayAdminister = mayAdminister;
+exports.mayBuild = mayBuild;
+exports.mayReadWorkflowRun = mayReadWorkflowRun;
+exports.mayManageRoles = mayManageRoles;
+exports.mayGrantRole = mayGrantRole;
+exports.mayGrantRoles = mayGrantRoles;
+exports.mayManageAccount = mayManageAccount;
+exports.mayRevokeRole = mayRevokeRole;
+exports.resolveCapabilities = resolveCapabilities;
+exports.capabilityAccess = capabilityAccess;
+const user_1 = require("../services/user");
+const export_1 = require("../services/export");
+const uuid_1 = require("../lib/uuid");
+const BUILDER_ROLE = 'engineer';
+async function hasBuilderRole(userId) {
+    const { hasRole } = await Promise.resolve().then(() => __importStar(require('../services/user/roles')));
+    return hasRole(userId, BUILDER_ROLE);
+}
+/** Admin or superadmin claim, or a superadmin in the database. */
+async function mayAdminister(principal) {
+    if (!principal?.userId)
+        return false;
+    if (principal.role === 'admin' || principal.role === 'superadmin')
+        return true;
+    return (0, user_1.isSuperAdmin)(principal.userId);
+}
+/** Superadmin (claim or database), or holder of the engineer role. */
+async function mayBuild(principal) {
+    if (!principal?.userId)
+        return false;
+    if (principal.role === 'superadmin')
+        return true;
+    if (await (0, user_1.isSuperAdmin)(principal.userId))
+        return true;
+    return hasBuilderRole(principal.userId);
+}
+/**
+ * Builder access, or the person a workflow run was started by or runs as,
+ * read from the run's own start envelope.
+ */
+async function mayReadWorkflowRun(principal, workflowId) {
+    if (!principal?.userId)
+        return false;
+    if (await mayBuild(principal))
+        return true;
+    const started = await (0, export_1.getWorkflowStartIdentity)(workflowId);
+    return !!started && (started.userId === principal.userId || started.initiatedBy === principal.userId);
+}
+/** Anyone who may administer, plus holders of the engineer role. */
+async function mayManageRoles(principal) {
+    if (!principal?.userId)
+        return false;
+    if (await mayAdminister(principal))
+        return true;
+    return hasBuilderRole(principal.userId);
+}
+/**
+ * Whether `granterId` may assign `grant` to a user.
+ *
+ * - superadmin: any role and type
+ * - engineer: any role, never the superadmin type
+ * - anyone else: only roles they hold, never the superadmin type
+ */
+async function mayGrantRole(granterId, grant) {
+    if (await (0, user_1.isSuperAdmin)(granterId))
+        return { allowed: true };
+    if (grant.type === 'superadmin') {
+        return { allowed: false, error: 'Only superadmin can assign superadmin role type' };
+    }
+    if (await hasBuilderRole(granterId))
+        return { allowed: true };
+    const { hasRole } = await Promise.resolve().then(() => __importStar(require('../services/user/roles')));
+    if (await hasRole(granterId, grant.role))
+        return { allowed: true };
+    return { allowed: false, error: `You can only assign roles you hold. You do not have the '${grant.role}' role.` };
+}
+const ALLOWED = { allowed: true };
+/** Whether `granterId` may assign every grant in a new account's role list. */
+async function mayGrantRoles(granterId, grants) {
+    for (const grant of grants ?? []) {
+        const decision = await mayGrantRole(granterId, grant);
+        if (!decision.allowed)
+            return decision;
+    }
+    return ALLOWED;
+}
+/**
+ * Whether `callerId` may change, remove, or mint keys for an account. An
+ * account holding superadmin is a superadmin's to manage; any other account
+ * is left to the route's own gate.
+ */
+async function mayManageAccount(callerId, targetId) {
+    if (await (0, user_1.isSuperAdmin)(callerId))
+        return ALLOWED;
+    if (!(0, uuid_1.isUuid)(targetId))
+        return ALLOWED;
+    if (await (0, user_1.isSuperAdmin)(targetId)) {
+        return { allowed: false, error: 'Only superadmin can change a superadmin account' };
+    }
+    return ALLOWED;
+}
+/** Removing a role follows the grant rule for the role as the account holds it. */
+async function mayRevokeRole(callerId, targetId, role) {
+    const account = await mayManageAccount(callerId, targetId);
+    if (!account.allowed || !(0, uuid_1.isUuid)(targetId))
+        return account;
+    const { getUserRoles } = await Promise.resolve().then(() => __importStar(require('../services/user')));
+    const held = (await getUserRoles(targetId)).find((r) => r.role === role);
+    return held ? mayGrantRole(callerId, { role, type: held.type }) : ALLOWED;
+}
+/** Capabilities from memberships carried by the caller's token: the same outcomes, no lookup. */
+function capabilitiesFromRoles(roles) {
+    const superadmin = roles.some((r) => r.type === 'superadmin');
+    const admin = superadmin || roles.some((r) => r.type === 'admin');
+    const engineer = roles.some((r) => r.role === BUILDER_ROLE);
+    return { caller: true, admin, builder: superadmin || engineer, roleManager: admin || engineer, superadmin };
+}
+const NO_CAPABILITIES = {
+    caller: false, admin: false, builder: false, roleManager: false, superadmin: false,
+};
+/**
+ * Every capability the principal holds, with the same outcomes as the
+ * predicates above. A superadmin claim costs no lookup; anyone else costs
+ * at most one superadmin lookup and one engineer-role lookup.
+ */
+async function resolveCapabilities(principal) {
+    if (!principal?.userId)
+        return NO_CAPABILITIES;
+    if (principal.grantRoles)
+        return capabilitiesFromRoles(principal.grantRoles);
+    if (principal.role === 'superadmin' || (await (0, user_1.isSuperAdmin)(principal.userId))) {
+        return { caller: true, admin: true, builder: true, roleManager: true, superadmin: true };
+    }
+    const admin = principal.role === 'admin';
+    const engineer = await hasBuilderRole(principal.userId);
+    return { caller: true, admin, builder: engineer, roleManager: admin || engineer, superadmin: false };
+}
+/**
+ * Capability checks for one request. `caller` needs only an authenticated
+ * principal; any other gate resolves the principal's capabilities once, on
+ * first need, so a request that checks only `caller` gates makes no lookup.
+ */
+function capabilityAccess(principal) {
+    let resolved;
+    return async (gate) => {
+        if (!principal?.userId)
+            return false;
+        if (gate === 'caller')
+            return true;
+        resolved ??= resolveCapabilities(principal);
+        return (await resolved)[gate];
+    };
+}

package/build/modules/config.d.ts

@@ -8,9 +8,28 @@ export declare const config: {
     NATS_URL: string;
     NATS_WS_URL: string;
     NATS_TOKEN: string;
+    /** A subscribe-only NATS credential for browsers that connect without the proxy. */
+    NATS_DASHBOARD_TOKEN: string;
+    /** How long a browser's WebSocket proxy ticket admits an upgrade. The dashboard fetches one per attempt. */
+    NATS_WS_TICKET_TTL_SECONDS: number;
+    /** Largest WebSocket frame the proxy accepts from a browser, near NATS's own max_payload. */
+    NATS_WS_MAX_PAYLOAD_BYTES: number;
+    /** How often the proxy rechecks a connection holder's account; a change closes the connection. */
+    NATS_WS_RECHECK_SECONDS: number;
+    /**
+     * Dashboard reconnect: first backoff delay, delay cap, how long a drop lasts
+     * before the banner shows, and the window the first retry and catch-up
+     * refetch spread across.
+     */
+    NATS_RECONNECT_INITIAL_MS: number;
+    NATS_RECONNECT_MAX_MS: number;
+    NATS_LIVE_NOTICE_AFTER_MS: number;
+    NATS_RECONNECT_SPREAD_MS: number;
     PORT: number;
     NODE_ENV: string;
     JWT_SECRET: string;
+    LT_SEED_SERVICE_KEYS: boolean;
+    LT_OAUTH_ISSUER: string;
     HONEYCOMB_API_KEY: string;
     ROLE_ENFORCEMENT_CACHE_TTL_MS: number;
     LT_ANALYTICS_MAX_GROUPS: number;

package/build/modules/config.js

@@ -1,6 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.postgres_options = exports.config = void 0;
+/** A positive integer from the environment, or the default when unset or malformed. */
+function positiveInt(name, fallback) {
+    const value = Number(process.env[name]);
+    return Number.isInteger(value) && value > 0 ? value : fallback;
+}
 exports.config = {
     POSTGRES_HOST: process.env.POSTGRES_HOST || 'localhost',
     POSTGRES_PORT: parseInt(process.env.POSTGRES_PORT || '5415', 10),
@@ -15,9 +20,31 @@ exports.config = {
     NATS_URL: process.env.NATS_URL || 'nats://localhost:4222',
     NATS_WS_URL: process.env.NATS_WS_URL || '',
     NATS_TOKEN: process.env.NATS_TOKEN || '',
+    /** A subscribe-only NATS credential for browsers that connect without the proxy. */
+    NATS_DASHBOARD_TOKEN: process.env.NATS_DASHBOARD_TOKEN || '',
+    /** How long a browser's WebSocket proxy ticket admits an upgrade. The dashboard fetches one per attempt. */
+    NATS_WS_TICKET_TTL_SECONDS: positiveInt('NATS_WS_TICKET_TTL_SECONDS', 300),
+    /** Largest WebSocket frame the proxy accepts from a browser, near NATS's own max_payload. */
+    NATS_WS_MAX_PAYLOAD_BYTES: positiveInt('NATS_WS_MAX_PAYLOAD_BYTES', 1024 * 1024),
+    /** How often the proxy rechecks a connection holder's account; a change closes the connection. */
+    NATS_WS_RECHECK_SECONDS: positiveInt('NATS_WS_RECHECK_SECONDS', 60),
+    /**
+     * Dashboard reconnect: first backoff delay, delay cap, how long a drop lasts
+     * before the banner shows, and the window the first retry and catch-up
+     * refetch spread across.
+     */
+    NATS_RECONNECT_INITIAL_MS: positiveInt('NATS_RECONNECT_INITIAL_MS', 1000),
+    NATS_RECONNECT_MAX_MS: positiveInt('NATS_RECONNECT_MAX_MS', 60000),
+    NATS_LIVE_NOTICE_AFTER_MS: positiveInt('NATS_LIVE_NOTICE_AFTER_MS', 30000),
+    NATS_RECONNECT_SPREAD_MS: positiveInt('NATS_RECONNECT_SPREAD_MS', 5000),
     PORT: parseInt(process.env.PORT || '3000', 10),
     NODE_ENV: process.env.NODE_ENV || 'development',
     JWT_SECRET: process.env.JWT_SECRET || '',
+    // Mint the seeded mcp-service account's API keys and print them to stdout once, at first seed.
+    // Local docker compose sets it; elsewhere a superadmin mints keys from the dashboard.
+    LT_SEED_SERVICE_KEYS: process.env.LT_SEED_SERVICE_KEYS === 'true',
+    // Enables the OAuth authorization server for /mcp when start() passes no auth.oauthServer.
+    LT_OAUTH_ISSUER: process.env.LT_OAUTH_ISSUER || '',
     HONEYCOMB_API_KEY: process.env.HONEYCOMB_API_KEY || '',
     // Resolver schema enforcement: TTL for the cached enforcing-role set and
     // latest role form schemas. Bounds cross-container staleness after a role

package/build/modules/defaults.d.ts

@@ -60,3 +60,13 @@ export declare const CLAIM_DURATION_OPTIONS: number[];
 export declare const STOP_WORDS: Set<string>;
 /** YAML dump line width. */
 export declare const YAML_LINE_WIDTH: number;
+/** Access-token lifetime. Bounds how stale a token's roles can be when no revocation event arrives. */
+export declare const OAUTH_ACCESS_TOKEN_TTL_SECONDS: number;
+/** Refresh-token lifetime. Each refresh issues a new one. */
+export declare const OAUTH_REFRESH_TOKEN_TTL_SECONDS: number;
+/** Authorization-code lifetime, from consent to the client's token request. */
+export declare const OAUTH_CODE_TTL_SECONDS: number;
+/** Client registrations allowed per address in each window. */
+export declare const OAUTH_REGISTRATIONS_PER_WINDOW: number;
+/** Registration rate-limit window. */
+export declare const OAUTH_REGISTRATION_WINDOW_SECONDS: number;

package/build/modules/defaults.js

@@ -9,7 +9,7 @@
  * Grouped by domain so related knobs live together.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.YAML_LINE_WIDTH = exports.STOP_WORDS = exports.CLAIM_DURATION_OPTIONS = exports.ESCALATION_BULK_RESOLVE_MAX = exports.YAML_VERSION_LIMIT = exports.YAML_LIST_LIMIT = exports.QUERY_LIMIT_MAX = exports.QUERY_LIMIT_DEFAULT = exports.CONFIG_CACHE_TTL_MS = exports.MCP_TOOL_TIMEOUT_MS = exports.WORKFLOW_SYNC_TIMEOUT_MS = exports.JOB_EXPIRE_SECS = exports.WORKFLOW_EXPIRE_SECS = exports.TOOL_ARG_LIMIT_CAP = exports.TOOL_ROUNDS_MCP_QUERY = exports.TOOL_ROUNDS_TRIAGE = exports.TOOL_RESULT_MAX_CHARS = exports.LLM_MAX_INPUT_CHARS = exports.LLM_MAX_ARRAY_ITEMS = exports.LLM_MAX_TOKENS_VISION = exports.LLM_MAX_TOKENS_JSON = exports.LLM_MAX_TOKENS_DEFAULT = exports.LLM_BASE_URL = exports.LLM_MODEL_SECONDARY = exports.LLM_MODEL_PRIMARY = void 0;
+exports.OAUTH_REGISTRATION_WINDOW_SECONDS = exports.OAUTH_REGISTRATIONS_PER_WINDOW = exports.OAUTH_CODE_TTL_SECONDS = exports.OAUTH_REFRESH_TOKEN_TTL_SECONDS = exports.OAUTH_ACCESS_TOKEN_TTL_SECONDS = exports.YAML_LINE_WIDTH = exports.STOP_WORDS = exports.CLAIM_DURATION_OPTIONS = exports.ESCALATION_BULK_RESOLVE_MAX = exports.YAML_VERSION_LIMIT = exports.YAML_LIST_LIMIT = exports.QUERY_LIMIT_MAX = exports.QUERY_LIMIT_DEFAULT = exports.CONFIG_CACHE_TTL_MS = exports.MCP_TOOL_TIMEOUT_MS = exports.WORKFLOW_SYNC_TIMEOUT_MS = exports.JOB_EXPIRE_SECS = exports.WORKFLOW_EXPIRE_SECS = exports.TOOL_ARG_LIMIT_CAP = exports.TOOL_ROUNDS_MCP_QUERY = exports.TOOL_ROUNDS_TRIAGE = exports.TOOL_RESULT_MAX_CHARS = exports.LLM_MAX_INPUT_CHARS = exports.LLM_MAX_ARRAY_ITEMS = exports.LLM_MAX_TOKENS_VISION = exports.LLM_MAX_TOKENS_JSON = exports.LLM_MAX_TOKENS_DEFAULT = exports.LLM_BASE_URL = exports.LLM_MODEL_SECONDARY = exports.LLM_MODEL_PRIMARY = void 0;
 function envInt(key, fallback) {
     const v = process.env[key];
     if (v === undefined || v === '')
@@ -97,3 +97,14 @@ exports.STOP_WORDS = new Set([
 // ── Formatting ───────────────────────────────────────────────────────
 /** YAML dump line width. */
 exports.YAML_LINE_WIDTH = envInt('LT_YAML_LINE_WIDTH', 120);
+// ── OAuth authorization server ───────────────────────────────────────
+/** Access-token lifetime. Bounds how stale a token's roles can be when no revocation event arrives. */
+exports.OAUTH_ACCESS_TOKEN_TTL_SECONDS = envInt('LT_OAUTH_ACCESS_TOKEN_TTL_SECONDS', 300);
+/** Refresh-token lifetime. Each refresh issues a new one. */
+exports.OAUTH_REFRESH_TOKEN_TTL_SECONDS = envInt('LT_OAUTH_REFRESH_TOKEN_TTL_SECONDS', 30 * 24 * 60 * 60);
+/** Authorization-code lifetime, from consent to the client's token request. */
+exports.OAUTH_CODE_TTL_SECONDS = envInt('LT_OAUTH_CODE_TTL_SECONDS', 60);
+/** Client registrations allowed per address in each window. */
+exports.OAUTH_REGISTRATIONS_PER_WINDOW = envInt('LT_OAUTH_REGISTRATIONS_PER_WINDOW', 20);
+/** Registration rate-limit window. */
+exports.OAUTH_REGISTRATION_WINDOW_SECONDS = envInt('LT_OAUTH_REGISTRATION_WINDOW_SECONDS', 600);

package/build/modules/maintenance.d.ts

@@ -10,6 +10,8 @@ import type { LTMaintenanceConfig } from '../types/maintenance';
  * 3. Strip execution artifacts from entity jobs older than 30 days
  *    (preserves jdata, udata, jmark, hmark — exports always work)
  * 4. Hard-delete pruned jobs older than 180 days
+ * 5. Delete OAuth server rows (expired codes and tokens, unused or revoked
+ *    grants, clients with no live grant) older than 7 days
  *
  * Conservative defaults — execution artifacts (activity inputs, stream
  * history) are needed for rich export data. Pruning too early strips

package/build/modules/maintenance.js

@@ -12,6 +12,8 @@ exports.defaultMaintenanceConfig = void 0;
  * 3. Strip execution artifacts from entity jobs older than 30 days
  *    (preserves jdata, udata, jmark, hmark — exports always work)
  * 4. Hard-delete pruned jobs older than 180 days
+ * 5. Delete OAuth server rows (expired codes and tokens, unused or revoked
+ *    grants, clients with no live grant) older than 7 days
  *
  * Conservative defaults — execution artifacts (activity inputs, stream
  * history) are needed for rich export data. Pruning too early strips
@@ -44,5 +46,10 @@ exports.defaultMaintenanceConfig = {
             olderThan: '180 days',
             pruned: true,
         },
+        {
+            target: 'oauth',
+            action: 'delete',
+            olderThan: '7 days',
+        },
     ],
 };

package/build/modules/mcp-auth.d.ts

@@ -0,0 +1,11 @@
+import type { RequestHandler } from '../lib/http';
+/**
+ * Authentication for `/mcp`. Only a credential the request carries itself
+ * authenticates: the host's SSO cookie fallback never applies here, since a
+ * cookie rides along on a request any page the person visits can send. With
+ * the OAuth server configured, an access token for this resource
+ * authenticates the request while its grant is live, and every 401 carries
+ * the RFC 9728 challenge so MCP clients can discover how to sign in. Any other
+ * credential goes through the configured auth adapter unchanged.
+ */
+export declare const requireMcpAuth: RequestHandler;