@hotmeshio/long-tail 0.24.0 → 0.24.2

package/build/lib/events/nats-ws-ticket.js

@@ -6,15 +6,28 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.NATS_WS_TICKET_PARAM = exports.NATS_WS_TICKET_TYPE = void 0;
 exports.signNatsWsTicket = signNatsWsTicket;
 exports.verifyNatsWsTicket = verifyNatsWsTicket;
+exports.spendNatsWsTicket = spendNatsWsTicket;
+const crypto_1 = require("crypto");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const db_1 = require("../db");
 const config_1 = require("../../modules/config");
 /**
  * A browser's pass to the NATS WebSocket proxy, in place of the NATS server
  * credential. It names the person in `sub` and carries no `userId`, so it
- * authenticates nothing but the proxy upgrade.
+ * authenticates nothing but the proxy upgrade. Each ticket admits one
+ * upgrade: the dashboard fetches a fresh one for every connection attempt.
  */
 exports.NATS_WS_TICKET_TYPE = 'nats-ws+jwt';
 exports.NATS_WS_TICKET_PARAM = 'ticket';
+/** Record the ticket as spent, and drop expired records. True only for its first use. */
+const SPEND_TICKET = `
+  WITH expired AS (
+    DELETE FROM lt_nats_ws_tickets WHERE expires_at < NOW()
+  )
+  INSERT INTO lt_nats_ws_tickets (jti, expires_at)
+  VALUES ($1, to_timestamp($2))
+  ON CONFLICT (jti) DO NOTHING
+  RETURNING jti`;
 function signNatsWsTicket(userId) {
     if (!config_1.config.JWT_SECRET)
         return null;
@@ -22,10 +35,11 @@ function signNatsWsTicket(userId) {
         algorithm: 'HS256',
         header: { alg: 'HS256', typ: exports.NATS_WS_TICKET_TYPE },
         subject: userId,
+        jwtid: (0, crypto_1.randomUUID)(),
         expiresIn: config_1.config.NATS_WS_TICKET_TTL_SECONDS,
     });
 }
-/** The person a valid ticket names; null for anything else. */
+/** The claims of a valid ticket; null for anything else. Does not spend it. */
 function verifyNatsWsTicket(ticket) {
     if (!ticket || !config_1.config.JWT_SECRET)
         return null;
@@ -33,10 +47,17 @@ function verifyNatsWsTicket(ticket) {
         const decoded = jsonwebtoken_1.default.verify(ticket, config_1.config.JWT_SECRET, { algorithms: ['HS256'], complete: true });
         if (decoded.header.typ !== exports.NATS_WS_TICKET_TYPE)
             return null;
-        const payload = decoded.payload;
-        return typeof payload.sub === 'string' && typeof payload.exp === 'number' ? payload.sub : null;
+        const { sub, jti, exp } = decoded.payload;
+        if (typeof sub !== 'string' || typeof jti !== 'string' || typeof exp !== 'number')
+            return null;
+        return { userId: sub, jti, exp };
     }
     catch {
         return null;
     }
 }
+/** Spend a verified ticket. False when it was already spent. */
+async function spendNatsWsTicket(ticket) {
+    const { rowCount } = await (0, db_1.getPool)().query(SPEND_TICKET, [ticket.jti, ticket.exp]);
+    return rowCount === 1;
+}

package/build/modules/config.d.ts

@@ -12,6 +12,10 @@ export declare const config: {
     NATS_DASHBOARD_TOKEN: string;
     /** How long a browser's WebSocket proxy ticket admits an upgrade. The dashboard fetches one per attempt. */
     NATS_WS_TICKET_TTL_SECONDS: number;
+    /** Largest WebSocket frame the proxy accepts from a browser, near NATS's own max_payload. */
+    NATS_WS_MAX_PAYLOAD_BYTES: number;
+    /** How often the proxy rechecks a connection holder's account; a change closes the connection. */
+    NATS_WS_RECHECK_SECONDS: number;
     /**
      * Dashboard reconnect: first backoff delay, delay cap, how long a drop lasts
      * before the banner shows, and the window the first retry and catch-up
@@ -24,7 +28,12 @@ export declare const config: {
     PORT: number;
     NODE_ENV: string;
     JWT_SECRET: string;
+    LT_SEED_SERVICE_KEYS: boolean;
     LT_OAUTH_ISSUER: string;
+    /** Spent, expired and revoked OAuth rows are deleted once older than this many days. */
+    OAUTH_RETENTION_DAYS: number;
+    /** Least time between one process's OAuth sweeps. A sweep runs on an OAuth write. */
+    OAUTH_SWEEP_SECONDS: number;
     HONEYCOMB_API_KEY: string;
     ROLE_ENFORCEMENT_CACHE_TTL_MS: number;
     LT_ANALYTICS_MAX_GROUPS: number;

package/build/modules/config.js

@@ -24,6 +24,10 @@ exports.config = {
     NATS_DASHBOARD_TOKEN: process.env.NATS_DASHBOARD_TOKEN || '',
     /** How long a browser's WebSocket proxy ticket admits an upgrade. The dashboard fetches one per attempt. */
     NATS_WS_TICKET_TTL_SECONDS: positiveInt('NATS_WS_TICKET_TTL_SECONDS', 300),
+    /** Largest WebSocket frame the proxy accepts from a browser, near NATS's own max_payload. */
+    NATS_WS_MAX_PAYLOAD_BYTES: positiveInt('NATS_WS_MAX_PAYLOAD_BYTES', 1024 * 1024),
+    /** How often the proxy rechecks a connection holder's account; a change closes the connection. */
+    NATS_WS_RECHECK_SECONDS: positiveInt('NATS_WS_RECHECK_SECONDS', 60),
     /**
      * Dashboard reconnect: first backoff delay, delay cap, how long a drop lasts
      * before the banner shows, and the window the first retry and catch-up
@@ -36,8 +40,15 @@ exports.config = {
     PORT: parseInt(process.env.PORT || '3000', 10),
     NODE_ENV: process.env.NODE_ENV || 'development',
     JWT_SECRET: process.env.JWT_SECRET || '',
+    // Mint the seeded mcp-service account's API keys and print them to stdout once, at first seed.
+    // Local docker compose sets it; elsewhere a superadmin mints keys from the dashboard.
+    LT_SEED_SERVICE_KEYS: process.env.LT_SEED_SERVICE_KEYS === 'true',
     // Enables the OAuth authorization server for /mcp when start() passes no auth.oauthServer.
     LT_OAUTH_ISSUER: process.env.LT_OAUTH_ISSUER || '',
+    /** Spent, expired and revoked OAuth rows are deleted once older than this many days. */
+    OAUTH_RETENTION_DAYS: positiveInt('OAUTH_RETENTION_DAYS', 7),
+    /** Least time between one process's OAuth sweeps. A sweep runs on an OAuth write. */
+    OAUTH_SWEEP_SECONDS: positiveInt('OAUTH_SWEEP_SECONDS', 600),
     HONEYCOMB_API_KEY: process.env.HONEYCOMB_API_KEY || '',
     // Resolver schema enforcement: TTL for the cached enforcing-role set and
     // latest role form schemas. Bounds cross-container staleness after a role

package/build/modules/maintenance.d.ts

@@ -10,6 +10,8 @@ import type { LTMaintenanceConfig } from '../types/maintenance';
  * 3. Strip execution artifacts from entity jobs older than 30 days
  *    (preserves jdata, udata, jmark, hmark — exports always work)
  * 4. Hard-delete pruned jobs older than 180 days
+ * 5. Delete OAuth server rows (expired codes and tokens, unused or revoked
+ *    grants, clients never consented to) older than 7 days
  *
  * Conservative defaults — execution artifacts (activity inputs, stream
  * history) are needed for rich export data. Pruning too early strips

package/build/modules/maintenance.js

@@ -12,6 +12,8 @@ exports.defaultMaintenanceConfig = void 0;
  * 3. Strip execution artifacts from entity jobs older than 30 days
  *    (preserves jdata, udata, jmark, hmark — exports always work)
  * 4. Hard-delete pruned jobs older than 180 days
+ * 5. Delete OAuth server rows (expired codes and tokens, unused or revoked
+ *    grants, clients never consented to) older than 7 days
  *
  * Conservative defaults — execution artifacts (activity inputs, stream
  * history) are needed for rich export data. Pruning too early strips
@@ -44,5 +46,10 @@ exports.defaultMaintenanceConfig = {
             olderThan: '180 days',
             pruned: true,
         },
+        {
+            target: 'oauth',
+            action: 'delete',
+            olderThan: '7 days',
+        },
     ],
 };

package/build/routes/agents.js

@@ -124,13 +124,13 @@ router.get('/:agentId/subscriptions', async (req, res) => {
  * Create an event subscription for an agent.
  */
 router.post('/:agentId/subscriptions', auth_1.requireBuilder, async (req, res) => {
-    const { topic, reaction_type, execute_as } = req.body;
+    const { topic, reaction_type, workflow_type, execute_as } = req.body;
     if (!topic || !reaction_type) {
         res.status(400).json({ error: 'topic and reaction_type are required' });
         return;
     }
     const agentId = String(req.params.agentId);
-    const check = () => (0, authority_1.assertMayConfigureSubscription)(req.auth.userId, { agentId, reaction_type, execute_as });
+    const check = () => (0, authority_1.assertMayConfigureSubscription)(req.auth.userId, { agentId, reaction_type, workflow_type, execute_as });
     if (!(await authorized(check, res)))
         return;
     const result = await subApi.createSubscription({ ...req.body, agentId });
@@ -144,7 +144,8 @@ router.put('/:agentId/subscriptions/:subId', auth_1.requireBuilder, async (req,
     const agentId = String(req.params.agentId);
     const id = String(req.params.subId);
     const check = () => (0, authority_1.assertMayConfigureSubscription)(req.auth.userId, {
-        agentId, subscriptionId: id, reaction_type: req.body?.reaction_type, execute_as: req.body?.execute_as,
+        agentId, subscriptionId: id, reaction_type: req.body?.reaction_type,
+        workflow_type: req.body?.workflow_type, execute_as: req.body?.execute_as,
     });
     if (!(await authorized(check, res)))
         return;

package/build/routes/oauth-server/authorize.js

@@ -51,9 +51,11 @@ function refuseBots(req, res) {
  * POST /api/oauth/authorize
  * The person approves. Body: the authorization request plus
  * { preset: 'read_only' | 'just_me' }. Returns { redirect } for the consent
- * page to navigate to, carrying the code.
+ * page to navigate to, carrying the code. Only the dashboard's own bearer
+ * credential approves: a host session cookie, which any same-site script
+ * could send, does not.
  */
-router.post('/authorize', auth_1.requireAuth, async (req, res) => {
+router.post('/authorize', auth_1.requireCredentialAuth, async (req, res) => {
     if (refuseBots(req, res))
         return;
     const settings = (0, oauth_server_1.getOAuthServerSettings)();
@@ -79,9 +81,9 @@ router.post('/authorize', auth_1.requireAuth, async (req, res) => {
 /**
  * POST /api/oauth/deny
  * The person declines. Body: { client_id, redirect_uri, state? }. Returns
- * { redirect } carrying error=access_denied.
+ * { redirect } carrying error=access_denied. Bearer credential only, as authorize.
  */
-router.post('/deny', auth_1.requireAuth, async (req, res) => {
+router.post('/deny', auth_1.requireCredentialAuth, async (req, res) => {
     const settings = (0, oauth_server_1.getOAuthServerSettings)();
     const clientId = typeof req.body?.client_id === 'string' ? req.body.client_id : '';
     const client = clientId ? await (0, oauth_server_2.getClient)(clientId) : null;

package/build/routes/yaml-workflows/cron.js

@@ -59,7 +59,7 @@ router.put('/:id/cron', auth_1.requireBuilder, async (req, res) => {
         cron_schedule: req.body.cron_schedule,
         cron_envelope: req.body.cron_envelope,
         execute_as: req.body.execute_as,
-    });
+    }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**

package/build/services/agent/authority.d.ts

@@ -10,5 +10,6 @@ export declare function assertMayConfigureSubscription(callerId: string, input:
     agentId: string;
     subscriptionId?: string;
     reaction_type?: string;
+    workflow_type?: string | null;
     execute_as?: string | null;
 }): Promise<void>;

package/build/services/agent/authority.js

@@ -8,13 +8,16 @@ exports.assertMayConfigureSubscription = assertMayConfigureSubscription;
  * Whoever configures one must be able to run as that identity: the same rule
  * as an execute_as override. Automation that would run as lt-system, or a
  * capability subscription (a tool called with lt-system authority), is a
- * superadmin's to configure.
+ * superadmin's to configure. A durable subscription starts its workflow
+ * under that workflow's invocation rules, for the configurer here and for
+ * the run identity each time it fires.
  */
 const workflow_invocation_1 = require("../workflow-invocation");
 const user_1 = require("../user");
 const index_1 = require("./index");
 const subscriptions_1 = require("./subscriptions");
 const SYSTEM_AUTHORITY = 'runs as lt-system; only superadmin can configure it';
+const DURABLE_REACTION = 'durable';
 async function assertIdentity(callerId, identity, what) {
     if (!identity)
         throw new workflow_invocation_1.InvocationError(`${what} has no identity, so it ${SYSTEM_AUTHORITY}`, 403);
@@ -47,6 +50,9 @@ async function assertMayConfigureSubscription(callerId, input) {
     if (reaction === 'capability') {
         throw new workflow_invocation_1.InvocationError(`a capability subscription calls a tool directly, so it ${SYSTEM_AUTHORITY}`, 403);
     }
+    const workflowType = input.workflow_type !== undefined ? input.workflow_type : existing?.workflow_type;
+    if (reaction === DURABLE_REACTION && workflowType)
+        await (0, workflow_invocation_1.checkInvocationRoles)(workflowType, callerId);
     const agent = await (0, index_1.getAgent)(input.agentId);
     const executeAs = input.execute_as !== undefined ? input.execute_as : existing?.execute_as;
     await assertIdentity(callerId, executeAs || agent?.user_id, 'the subscription');

package/build/services/agent/trigger-registry.js

@@ -245,12 +245,17 @@ class AgentTriggerRegistry {
     async executeReaction(sub, mapped, deterministicId) {
         switch (sub.reaction_type) {
             case 'durable': {
-                const { invokeWorkflow } = await Promise.resolve().then(() => __importStar(require('../workflow-invocation')));
+                const { invokeWorkflow, checkInvocationRoles } = await Promise.resolve().then(() => __importStar(require('../workflow-invocation')));
+                // The run identity must be able to start this workflow now. Only a
+                // superadmin configures a subscription with no identity.
+                const runAs = sub.execute_as ?? sub.agent_user_id ?? undefined;
+                if (runAs)
+                    await checkInvocationRoles(sub.workflow_type, runAs);
                 await invokeWorkflow({
                     workflowType: sub.workflow_type,
                     data: mapped.data ?? mapped,
                     metadata: mapped.metadata ?? { source: 'agent', certified: true },
-                    executeAs: sub.execute_as ?? sub.agent_user_id ?? undefined,
+                    executeAs: runAs,
                     options: { workflowId: deterministicId },
                     auth: { userId: sub.agent_user_id || 'lt-system', role: 'admin' },
                 });

package/build/services/auth/oauth-server/index.d.ts

@@ -1,3 +1,3 @@
-export { REFRESH_REUSE_GRACE_SECONDS, createSecret, hashSecret, pkceChallenge, registerClient, getClient, issueAuthorizationCode, exchangeAuthorizationCode, rotateRefreshToken, getLiveGrant, revokeByRefreshToken, revokeGrant, listGrants, type RevokedGrant, } from './store';
+export { REFRESH_REUSE_GRACE_SECONDS, createSecret, hashSecret, pkceChallenge, registerClient, getClient, issueAuthorizationCode, exchangeAuthorizationCode, rotateRefreshToken, getLiveGrant, revokeByRefreshToken, revokeGrant, listGrants, pruneOAuthServer, sweepOAuthServer, type RevokedGrant, type OAuthPruneCounts, } from './store';
 export { signAccessToken, verifyAccessToken, accessTokenPrincipal, type AccessTokenTarget, type LTAccessTokenClaims, } from './access-token';
 export { MCP_SCOPES, PRESET_SCOPE, ACCESS_TOKEN_TYPE, OAUTH_PRINCIPAL_TYPE } from './constants';

package/build/services/auth/oauth-server/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAUTH_PRINCIPAL_TYPE = exports.ACCESS_TOKEN_TYPE = exports.PRESET_SCOPE = exports.MCP_SCOPES = exports.accessTokenPrincipal = exports.verifyAccessToken = exports.signAccessToken = exports.listGrants = exports.revokeGrant = exports.revokeByRefreshToken = exports.getLiveGrant = exports.rotateRefreshToken = exports.exchangeAuthorizationCode = exports.issueAuthorizationCode = exports.getClient = exports.registerClient = exports.pkceChallenge = exports.hashSecret = exports.createSecret = exports.REFRESH_REUSE_GRACE_SECONDS = void 0;
+exports.OAUTH_PRINCIPAL_TYPE = exports.ACCESS_TOKEN_TYPE = exports.PRESET_SCOPE = exports.MCP_SCOPES = exports.accessTokenPrincipal = exports.verifyAccessToken = exports.signAccessToken = exports.sweepOAuthServer = exports.pruneOAuthServer = exports.listGrants = exports.revokeGrant = exports.revokeByRefreshToken = exports.getLiveGrant = exports.rotateRefreshToken = exports.exchangeAuthorizationCode = exports.issueAuthorizationCode = exports.getClient = exports.registerClient = exports.pkceChallenge = exports.hashSecret = exports.createSecret = exports.REFRESH_REUSE_GRACE_SECONDS = void 0;
 var store_1 = require("./store");
 Object.defineProperty(exports, "REFRESH_REUSE_GRACE_SECONDS", { enumerable: true, get: function () { return store_1.REFRESH_REUSE_GRACE_SECONDS; } });
 Object.defineProperty(exports, "createSecret", { enumerable: true, get: function () { return store_1.createSecret; } });
@@ -15,6 +15,8 @@ Object.defineProperty(exports, "getLiveGrant", { enumerable: true, get: function
 Object.defineProperty(exports, "revokeByRefreshToken", { enumerable: true, get: function () { return store_1.revokeByRefreshToken; } });
 Object.defineProperty(exports, "revokeGrant", { enumerable: true, get: function () { return store_1.revokeGrant; } });
 Object.defineProperty(exports, "listGrants", { enumerable: true, get: function () { return store_1.listGrants; } });
+Object.defineProperty(exports, "pruneOAuthServer", { enumerable: true, get: function () { return store_1.pruneOAuthServer; } });
+Object.defineProperty(exports, "sweepOAuthServer", { enumerable: true, get: function () { return store_1.sweepOAuthServer; } });
 var access_token_1 = require("./access-token");
 Object.defineProperty(exports, "signAccessToken", { enumerable: true, get: function () { return access_token_1.signAccessToken; } });
 Object.defineProperty(exports, "verifyAccessToken", { enumerable: true, get: function () { return access_token_1.verifyAccessToken; } });

package/build/services/auth/oauth-server/sql.d.ts

@@ -1,7 +1,7 @@
 export declare const INSERT_CLIENT = "\n  INSERT INTO lt_oauth_clients (client_id, client_name, redirect_uris)\n  VALUES ($1, $2, $3)\n  RETURNING client_id, client_name, redirect_uris, created_at";
 export declare const GET_CLIENT = "\n  SELECT client_id, client_name, redirect_uris, created_at\n  FROM lt_oauth_clients WHERE client_id = $1";
-/** Create the grant and its authorization code together. */
-export declare const ISSUE_CODE = "\n  WITH g AS (\n    INSERT INTO lt_oauth_grants (user_id, client_id, policy, scope)\n    VALUES ($1, $2, $3, $4)\n    RETURNING id\n  )\n  INSERT INTO lt_oauth_codes (code_hash, grant_id, redirect_uri, code_challenge, resource, expires_at)\n  SELECT $5, g.id, $6, $7, $8, NOW() + make_interval(secs => $9) FROM g\n  RETURNING grant_id";
+/** Create the grant and its authorization code together, and stamp the client's consent. */
+export declare const ISSUE_CODE = "\n  WITH g AS (\n    INSERT INTO lt_oauth_grants (user_id, client_id, policy, scope)\n    VALUES ($1, $2, $3, $4)\n    RETURNING id\n  ),\n  consented AS (\n    UPDATE lt_oauth_clients SET last_consent_at = NOW() WHERE client_id = $2\n  )\n  INSERT INTO lt_oauth_codes (code_hash, grant_id, redirect_uri, code_challenge, resource, expires_at)\n  SELECT $5, g.id, $6, $7, $8, NOW() + make_interval(secs => $9) FROM g\n  RETURNING grant_id";
 /**
  * Consume a code and issue the first refresh token. The code must be unused,
  * unexpired, for this client and redirect URI, and match the PKCE challenge;
@@ -26,9 +26,28 @@ export declare const ROTATE_REFRESH_TOKEN = "\n  WITH old AS (\n    UPDATE lt_oa
  * outside the retry grace window: the token has leaked.
  */
 export declare const REVOKE_ON_REFRESH_REUSE = "\n  UPDATE lt_oauth_grants g SET revoked_at = NOW()\n  FROM lt_oauth_refresh_tokens t\n  WHERE t.token_hash = $1 AND t.used_at IS NOT NULL\n    AND t.used_at < NOW() - make_interval(secs => $2)\n    AND g.id = t.grant_id AND g.revoked_at IS NULL\n  RETURNING g.id AS grant_id, g.user_id";
+/**
+ * Revoke the grant of an authorization code presented again after it was
+ * exchanged: the code has leaked (RFC 6749 §4.1.2).
+ */
+export declare const REVOKE_ON_CODE_REUSE = "\n  UPDATE lt_oauth_grants g SET revoked_at = NOW()\n  FROM lt_oauth_codes c\n  WHERE c.code_hash = $1 AND c.used_at IS NOT NULL\n    AND g.id = c.grant_id AND g.revoked_at IS NULL\n  RETURNING g.id AS grant_id, g.user_id";
 /** Revoke the grant a refresh token belongs to, for the client presenting it. */
 export declare const REVOKE_BY_REFRESH_TOKEN = "\n  UPDATE lt_oauth_grants g SET revoked_at = NOW()\n  FROM lt_oauth_refresh_tokens t\n  WHERE t.token_hash = $1 AND g.id = t.grant_id AND g.client_id = $2 AND g.revoked_at IS NULL\n  RETURNING g.id AS grant_id, g.user_id";
 /** Revoke a grant by id, optionally only when it belongs to the given user. */
 export declare const REVOKE_GRANT = "\n  UPDATE lt_oauth_grants SET revoked_at = NOW()\n  WHERE id = $1 AND ($2::uuid IS NULL OR user_id = $2) AND revoked_at IS NULL\n  RETURNING id AS grant_id, user_id";
 /** A person's live grants that a client has put to use, newest first. */
 export declare const LIST_GRANTS = "\n  SELECT g.id AS grant_id, g.client_id, c.client_name, g.policy, g.scope, g.created_at,\n         (SELECT MAX(t.created_at) FROM lt_oauth_refresh_tokens t WHERE t.grant_id = g.id) AS last_used_at\n  FROM lt_oauth_grants g\n  JOIN lt_oauth_clients c ON c.client_id = g.client_id\n  WHERE g.user_id = $1 AND g.revoked_at IS NULL\n    AND EXISTS (SELECT 1 FROM lt_oauth_refresh_tokens t WHERE t.grant_id = g.id)\n  ORDER BY g.created_at DESC";
+/** Refresh tokens past expiry, or rotated out, longer ago than the window. */
+export declare const PRUNE_REFRESH_TOKENS = "\n  DELETE FROM lt_oauth_refresh_tokens\n  WHERE expires_at < NOW() - $1::interval OR used_at < NOW() - $1::interval";
+/** Authorization codes past expiry longer ago than the window, exchanged or not. */
+export declare const PRUNE_CODES = "\n  DELETE FROM lt_oauth_codes WHERE expires_at < NOW() - $1::interval";
+/**
+ * Grants revoked longer ago than the window, and grants older than the window
+ * left with no refresh token and no code: never exchanged, or long unused.
+ */
+export declare const PRUNE_GRANTS = "\n  DELETE FROM lt_oauth_grants g\n  WHERE g.revoked_at < NOW() - $1::interval\n     OR (g.created_at < NOW() - $1::interval\n         AND NOT EXISTS (SELECT 1 FROM lt_oauth_refresh_tokens t WHERE t.grant_id = g.id)\n         AND NOT EXISTS (SELECT 1 FROM lt_oauth_codes c WHERE c.grant_id = g.id))";
+/**
+ * Clients registered longer ago than the window that no one ever consented to.
+ * A client with a consent is kept: the app holds its client id to reconnect.
+ */
+export declare const PRUNE_CLIENTS = "\n  DELETE FROM lt_oauth_clients c\n  WHERE c.last_consent_at IS NULL AND c.created_at < NOW() - $1::interval\n    AND NOT EXISTS (SELECT 1 FROM lt_oauth_grants g WHERE g.client_id = c.client_id)";

package/build/services/auth/oauth-server/sql.js

@@ -1,7 +1,7 @@
 "use strict";
 // ── OAuth authorization server queries ─────────────────────────────────────
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LIST_GRANTS = exports.REVOKE_GRANT = exports.REVOKE_BY_REFRESH_TOKEN = exports.REVOKE_ON_REFRESH_REUSE = exports.ROTATE_REFRESH_TOKEN = exports.GET_LIVE_GRANT = exports.EXCHANGE_CODE = exports.ISSUE_CODE = exports.GET_CLIENT = exports.INSERT_CLIENT = void 0;
+exports.PRUNE_CLIENTS = exports.PRUNE_GRANTS = exports.PRUNE_CODES = exports.PRUNE_REFRESH_TOKENS = exports.LIST_GRANTS = exports.REVOKE_GRANT = exports.REVOKE_BY_REFRESH_TOKEN = exports.REVOKE_ON_CODE_REUSE = exports.REVOKE_ON_REFRESH_REUSE = exports.ROTATE_REFRESH_TOKEN = exports.GET_LIVE_GRANT = exports.EXCHANGE_CODE = exports.ISSUE_CODE = exports.GET_CLIENT = exports.INSERT_CLIENT = void 0;
 /** The grant owner's current memberships, as a JSON array. Expects alias `g`. */
 const GRANT_ROLES = `
   COALESCE((
@@ -17,12 +17,15 @@ exports.INSERT_CLIENT = `
 exports.GET_CLIENT = `
   SELECT client_id, client_name, redirect_uris, created_at
   FROM lt_oauth_clients WHERE client_id = $1`;
-/** Create the grant and its authorization code together. */
+/** Create the grant and its authorization code together, and stamp the client's consent. */
 exports.ISSUE_CODE = `
   WITH g AS (
     INSERT INTO lt_oauth_grants (user_id, client_id, policy, scope)
     VALUES ($1, $2, $3, $4)
     RETURNING id
+  ),
+  consented AS (
+    UPDATE lt_oauth_clients SET last_consent_at = NOW() WHERE client_id = $2
   )
   INSERT INTO lt_oauth_codes (code_hash, grant_id, redirect_uri, code_challenge, resource, expires_at)
   SELECT $5, g.id, $6, $7, $8, NOW() + make_interval(secs => $9) FROM g
@@ -101,6 +104,16 @@ exports.REVOKE_ON_REFRESH_REUSE = `
     AND t.used_at < NOW() - make_interval(secs => $2)
     AND g.id = t.grant_id AND g.revoked_at IS NULL
   RETURNING g.id AS grant_id, g.user_id`;
+/**
+ * Revoke the grant of an authorization code presented again after it was
+ * exchanged: the code has leaked (RFC 6749 §4.1.2).
+ */
+exports.REVOKE_ON_CODE_REUSE = `
+  UPDATE lt_oauth_grants g SET revoked_at = NOW()
+  FROM lt_oauth_codes c
+  WHERE c.code_hash = $1 AND c.used_at IS NOT NULL
+    AND g.id = c.grant_id AND g.revoked_at IS NULL
+  RETURNING g.id AS grant_id, g.user_id`;
 /** Revoke the grant a refresh token belongs to, for the client presenting it. */
 exports.REVOKE_BY_REFRESH_TOKEN = `
   UPDATE lt_oauth_grants g SET revoked_at = NOW()
@@ -121,3 +134,29 @@ exports.LIST_GRANTS = `
   WHERE g.user_id = $1 AND g.revoked_at IS NULL
     AND EXISTS (SELECT 1 FROM lt_oauth_refresh_tokens t WHERE t.grant_id = g.id)
   ORDER BY g.created_at DESC`;
+// ── Maintenance: each statement takes the retention window as $1 (an interval) ──
+/** Refresh tokens past expiry, or rotated out, longer ago than the window. */
+exports.PRUNE_REFRESH_TOKENS = `
+  DELETE FROM lt_oauth_refresh_tokens
+  WHERE expires_at < NOW() - $1::interval OR used_at < NOW() - $1::interval`;
+/** Authorization codes past expiry longer ago than the window, exchanged or not. */
+exports.PRUNE_CODES = `
+  DELETE FROM lt_oauth_codes WHERE expires_at < NOW() - $1::interval`;
+/**
+ * Grants revoked longer ago than the window, and grants older than the window
+ * left with no refresh token and no code: never exchanged, or long unused.
+ */
+exports.PRUNE_GRANTS = `
+  DELETE FROM lt_oauth_grants g
+  WHERE g.revoked_at < NOW() - $1::interval
+     OR (g.created_at < NOW() - $1::interval
+         AND NOT EXISTS (SELECT 1 FROM lt_oauth_refresh_tokens t WHERE t.grant_id = g.id)
+         AND NOT EXISTS (SELECT 1 FROM lt_oauth_codes c WHERE c.grant_id = g.id))`;
+/**
+ * Clients registered longer ago than the window that no one ever consented to.
+ * A client with a consent is kept: the app holds its client id to reconnect.
+ */
+exports.PRUNE_CLIENTS = `
+  DELETE FROM lt_oauth_clients c
+  WHERE c.last_consent_at IS NULL AND c.created_at < NOW() - $1::interval
+    AND NOT EXISTS (SELECT 1 FROM lt_oauth_grants g WHERE g.client_id = c.client_id)`;

package/build/services/auth/oauth-server/store.d.ts

@@ -34,7 +34,8 @@ export declare function issueAuthorizationCode(input: {
 /**
  * Exchange a code for the grant and its first refresh token. Null when the
  * code is unknown, used, expired, for another client or redirect URI, fails
- * PKCE, or its grant or owner is no longer active.
+ * PKCE, or its grant or owner is no longer active. A code presented again
+ * after its exchange revokes its grant.
  */
 export declare function exchangeAuthorizationCode(input: {
     code: string;
@@ -72,3 +73,23 @@ export declare function revokeByRefreshToken(refreshToken: string, clientId: str
 export declare function revokeGrant(grantId: string, userId?: string): Promise<RevokedGrant | null>;
 /** The person's live grants that a client has put to use. */
 export declare function listGrants(userId: string): Promise<LTGrantSummary[]>;
+export interface OAuthPruneCounts {
+    refreshTokens: number;
+    codes: number;
+    grants: number;
+    clients: number;
+}
+/**
+ * Delete what the authorization server no longer needs, older than the
+ * window (a Postgres interval): spent and expired refresh tokens and codes,
+ * then grants with neither left or revoked, then clients never consented to.
+ * Each step reads what the one before it left.
+ */
+export declare function pruneOAuthServer(olderThan: string): Promise<OAuthPruneCounts>;
+/**
+ * Delete what the server no longer needs, older than OAUTH_RETENTION_DAYS.
+ * Each OAuth write calls it, and it runs at most once per OAUTH_SWEEP_SECONDS
+ * in a process, so the tables stay bounded with or without a maintenance
+ * schedule. A failed sweep is logged and never fails the write.
+ */
+export declare function sweepOAuthServer(): Promise<void>;

package/build/services/auth/oauth-server/store.js

@@ -46,8 +46,12 @@ exports.getLiveGrant = getLiveGrant;
 exports.revokeByRefreshToken = revokeByRefreshToken;
 exports.revokeGrant = revokeGrant;
 exports.listGrants = listGrants;
+exports.pruneOAuthServer = pruneOAuthServer;
+exports.sweepOAuthServer = sweepOAuthServer;
 const crypto = __importStar(require("crypto"));
 const db_1 = require("../../../lib/db");
+const logger_1 = require("../../../lib/logger");
+const config_1 = require("../../../modules/config");
 const uuid_1 = require("../../../lib/uuid");
 const sql_1 = require("./sql");
 /** A refresh token reused within this many seconds is treated as a client retry. */
@@ -68,6 +72,7 @@ async function registerClient(input) {
     const { rows } = await (0, db_1.getPool)().query(sql_1.INSERT_CLIENT, [
         `ltc_${createSecret()}`, input.clientName ?? null, input.redirectUris,
     ]);
+    void sweepOAuthServer();
     return rows[0];
 }
 /** A client id as registerClient issues it; anything else names no client and never reaches SQL. */
@@ -89,21 +94,28 @@ async function issueAuthorizationCode(input) {
         input.userId, input.clientId, input.policy, input.scope,
         hashSecret(code), input.redirectUri, input.codeChallenge, input.resource ?? null, input.ttlSeconds,
     ]);
+    void sweepOAuthServer();
     return { code, grantId: rows[0].grant_id };
 }
 /**
  * Exchange a code for the grant and its first refresh token. Null when the
  * code is unknown, used, expired, for another client or redirect URI, fails
- * PKCE, or its grant or owner is no longer active.
+ * PKCE, or its grant or owner is no longer active. A code presented again
+ * after its exchange revokes its grant.
  */
 async function exchangeAuthorizationCode(input) {
+    const pool = (0, db_1.getPool)();
     const refreshToken = createSecret();
-    const { rows } = await (0, db_1.getPool)().query(sql_1.EXCHANGE_CODE, [
-        hashSecret(input.code), input.clientId, input.redirectUri, pkceChallenge(input.codeVerifier),
+    const codeHash = hashSecret(input.code);
+    const { rows } = await pool.query(sql_1.EXCHANGE_CODE, [
+        codeHash, input.clientId, input.redirectUri, pkceChallenge(input.codeVerifier),
         hashSecret(refreshToken), input.refreshTtlSeconds,
     ]);
-    if (!rows[0])
+    if (!rows[0]) {
+        await pool.query(sql_1.REVOKE_ON_CODE_REUSE, [codeHash]);
         return null;
+    }
+    void sweepOAuthServer();
     const { resource, ...snapshot } = rows[0];
     return { snapshot, resource, refreshToken };
 }
@@ -118,8 +130,10 @@ async function rotateRefreshToken(input) {
     const next = createSecret();
     const oldHash = hashSecret(input.refreshToken);
     const { rows } = await pool.query(sql_1.ROTATE_REFRESH_TOKEN, [oldHash, hashSecret(next), input.refreshTtlSeconds, input.clientId]);
-    if (rows[0])
+    if (rows[0]) {
+        void sweepOAuthServer();
         return { snapshot: rows[0], refreshToken: next };
+    }
     const reuse = await pool.query(sql_1.REVOKE_ON_REFRESH_REUSE, [oldHash, exports.REFRESH_REUSE_GRACE_SECONDS]);
     return { snapshot: null, revoked: reuse.rows[0] ?? null };
 }
@@ -149,3 +163,38 @@ async function listGrants(userId) {
     const { rows } = await (0, db_1.getPool)().query(sql_1.LIST_GRANTS, [userId]);
     return rows;
 }
+/**
+ * Delete what the authorization server no longer needs, older than the
+ * window (a Postgres interval): spent and expired refresh tokens and codes,
+ * then grants with neither left or revoked, then clients never consented to.
+ * Each step reads what the one before it left.
+ */
+async function pruneOAuthServer(olderThan) {
+    const pool = (0, db_1.getPool)();
+    const refreshTokens = (await pool.query(sql_1.PRUNE_REFRESH_TOKENS, [olderThan])).rowCount ?? 0;
+    const codes = (await pool.query(sql_1.PRUNE_CODES, [olderThan])).rowCount ?? 0;
+    const grants = (await pool.query(sql_1.PRUNE_GRANTS, [olderThan])).rowCount ?? 0;
+    const clients = (await pool.query(sql_1.PRUNE_CLIENTS, [olderThan])).rowCount ?? 0;
+    return { refreshTokens, codes, grants, clients };
+}
+let nextSweepAt = 0;
+/**
+ * Delete what the server no longer needs, older than OAUTH_RETENTION_DAYS.
+ * Each OAuth write calls it, and it runs at most once per OAUTH_SWEEP_SECONDS
+ * in a process, so the tables stay bounded with or without a maintenance
+ * schedule. A failed sweep is logged and never fails the write.
+ */
+async function sweepOAuthServer() {
+    const now = Date.now();
+    if (now < nextSweepAt)
+        return;
+    nextSweepAt = now + config_1.config.OAUTH_SWEEP_SECONDS * 1000;
+    try {
+        const counts = await pruneOAuthServer(`${config_1.config.OAUTH_RETENTION_DAYS} days`);
+        if (Object.values(counts).some(Boolean))
+            logger_1.loggerRegistry.info(`[lt-oauth] swept: ${JSON.stringify(counts)}`);
+    }
+    catch (err) {
+        logger_1.loggerRegistry.warn(`[lt-oauth] sweep failed: ${err?.message}`);
+    }
+}

package/build/services/cron/index.js

@@ -65,6 +65,7 @@ function validateCronSchedule(expr) {
 const CRON_TOPIC_PREFIX = 'lt.cron';
 const CRON_ID_PREFIX = 'lt-cron';
 const YAML_CRON_TOPIC_PREFIX = 'lt.cron.yaml';
+const CRON_SOURCE = 'cron';
 const YAML_CRON_ID_PREFIX = 'lt-cron-yaml';
 /**
  * Singleton registry for workflow cron schedules.
@@ -241,9 +242,10 @@ class LTCronRegistry {
                 try {
                     cronCallCount++;
                     logger_1.loggerRegistry.info(`[lt-cron] tick #${cronCallCount} at ${new Date().toISOString()} — pub(${appId}/${graphTopic})`);
-                    const { getEngine } = await Promise.resolve().then(() => __importStar(require('../yaml-workflow/deployer')));
-                    const engine = await getEngine(appId);
-                    await engine.pub(graphTopic, cronEnvelope, undefined, { entity: graphTopic });
+                    // Through the invoke service, so the run carries only the scope the
+                    // server resolves for execute_as, never one written in the envelope.
+                    const { invokeYamlWorkflow } = await Promise.resolve().then(() => __importStar(require('../yaml-workflow/invoke')));
+                    await invokeYamlWorkflow(wf, { data: cronEnvelope, execute_as: wf.execute_as ?? undefined, source: CRON_SOURCE });
                     logger_1.loggerRegistry.info(`[lt-cron] tick #${cronCallCount} published successfully`);
                 }
                 catch (err) {

package/build/services/maintenance/index.js

@@ -106,6 +106,14 @@ async function executeRule(appId, rule) {
             }
             break;
         }
+        // Drop the authorization server's dead rows: spent or expired tokens and
+        // codes, grants with neither left or long revoked, clients never consented to.
+        case rule.target === 'oauth' && rule.action === 'delete': {
+            const { pruneOAuthServer } = await Promise.resolve().then(() => __importStar(require('../auth/oauth-server')));
+            const counts = await pruneOAuthServer(rule.olderThan);
+            logger_1.loggerRegistry.info(`[lt-maintenance] oauth pruned: ${JSON.stringify(counts)} (olderThan: ${rule.olderThan})`);
+            break;
+        }
         default:
             logger_1.loggerRegistry.warn(`[lt-maintenance] unknown rule, skipping: ${JSON.stringify(rule)}`);
     }

package/build/services/mcp/seed-service-account.d.ts

@@ -6,6 +6,9 @@
  *   - `mcp:full`  — all tools (automation, orchestration)
  *
  * Idempotent — skips creation if the account already exists.
- * Keys are generated once and logged; they cannot be retrieved again.
+ * With LT_SEED_SERVICE_KEYS=true (local docker compose) the keys are
+ * generated once and printed to stdout, never to the logger; they cannot be
+ * retrieved again. Otherwise the account is created without keys and a
+ * superadmin mints them from the dashboard or the bot-accounts API.
  */
 export declare function seedMcpServiceAccount(): Promise<void>;