@hydradb/mcp 1.2.2 → 1.3.0

package/dist/hydra/client.d.ts

@@ -47,6 +47,14 @@ export interface HydraConfig {
     database: string;
     /** Collection scope (canonical name for the sub-tenant). */
     collection?: string;
+    /**
+     * Databases a per-call `database` override may name. Absent means any.
+     * Set from an OAuth grant the user confined to specific databases; the
+     * default `database` is always allowed.
+     */
+    allowedDatabases?: string[];
+    /** Collections a per-call `collection` override may name. Absent means any. */
+    allowedCollections?: string[];
     /** Optional base URL override; defaults to the SDK's environment. */
     baseUrl?: string;
     /**
@@ -177,16 +185,45 @@ type ScopeFields = {
     database: string;
     collection?: string;
 };
+/**
+ * A per-call `database` named one the connection is not allowed to touch.
+ *
+ * Written for the agent that reads it as a tool error: it names what IS
+ * allowed and where the choice was made, so the agent can either use an
+ * allowed database or tell the user to reconnect with wider access, rather
+ * than retrying blindly.
+ */
+export declare class ScopeNotAllowedError extends Error {
+    readonly kind: "database" | "collection";
+    readonly requested: string;
+    readonly allowed: readonly string[];
+    constructor(kind: "database" | "collection", requested: string, allowed: readonly string[]);
+}
+/** Kept for the name callers already import; the database case of the above. */
+export declare const DatabaseNotAllowedError: typeof ScopeNotAllowedError;
+/** Throws unless `database` is one the connection may use. */
+export declare function assertDatabaseAllowed(database: string, allowed: readonly string[] | undefined): void;
+/**
+ * Throws unless `collection` is one the connection may use.
+ *
+ * Separate from the database check because confinement has to cover both:
+ * a caller pinned to one database can otherwise step sideways into a
+ * collection the consent screen never showed, and `drop_collection` makes
+ * that destructive.
+ */
+export declare function assertCollectionAllowed(collection: string, allowed: readonly string[] | undefined): void;
 declare abstract class Resource {
     protected readonly sdk: HydraDBClient;
     private readonly database;
     private readonly collection?;
-    protected constructor(sdk: HydraDBClient, database: string, collection?: string | undefined);
+    private readonly allowedDatabases?;
+    private readonly allowedCollections?;
+    protected constructor(sdk: HydraDBClient, database: string, collection?: string | undefined, allowedDatabases?: readonly string[] | undefined, allowedCollections?: readonly string[] | undefined);
     protected scope(override?: string, dbOverride?: string): ScopeFields;
     protected call<T>(path: string, fn: () => Promise<unknown>): Promise<T>;
 }
 export declare class ContextResource extends Resource {
-    constructor(sdk: HydraDBClient, database: string, collection?: string);
+    constructor(sdk: HydraDBClient, database: string, collection?: string, allowedDatabases?: readonly string[], allowedCollections?: readonly string[]);
     /**
      * The single retrieval entry point (SDK `client.query`).
      *
@@ -214,7 +251,7 @@ export declare class ContextResource extends Resource {
     delete(params: DeleteParams, opts?: RequestOptions): Promise<SDK.SourcesMemoryDeleteResponse>;
 }
 export declare class DatabasesResource extends Resource {
-    constructor(sdk: HydraDBClient, database: string, collection?: string);
+    constructor(sdk: HydraDBClient, database: string, collection?: string, allowedDatabases?: readonly string[], allowedCollections?: readonly string[]);
     create(params: CreateDatabaseParams): Promise<SDK.TenantsTenantCreateAcceptedResponse>;
     delete(database: string): Promise<SDK.TenantsTenantDeleteResponse>;
     list(): Promise<SDK.TenantsTenantIdsResponse>;
@@ -231,6 +268,14 @@ export declare class DatabasesResource extends Resource {
 export declare class HydraDB {
     readonly context: ContextResource;
     readonly databases: DatabasesResource;
+    /** The default database every unscoped call uses. */
+    readonly database: string;
+    /** Databases a per-call override may name; undefined means any. */
+    readonly allowedDatabases?: readonly string[];
+    /** Collections a per-call override may name; undefined means any. */
+    readonly allowedCollections?: readonly string[];
+    /** The default collection every unscoped call uses. */
+    readonly collection?: string;
     /**
      * BYOG graph operations. Not backed by the SDK — see ./graph.ts for why —
      * but exposed here so callers reach every HydraDB surface through one object.

package/dist/hydra/client.js

@@ -47,15 +47,64 @@ const STDERR_LOGGER = {
 function req(opts) {
     return opts?.signal ? { abortSignal: opts.signal } : undefined;
 }
+/**
+ * A per-call `database` named one the connection is not allowed to touch.
+ *
+ * Written for the agent that reads it as a tool error: it names what IS
+ * allowed and where the choice was made, so the agent can either use an
+ * allowed database or tell the user to reconnect with wider access, rather
+ * than retrying blindly.
+ */
+export class ScopeNotAllowedError extends Error {
+    constructor(kind, requested, allowed) {
+        super(`This connection is confined to ${kind} ${allowed.map((d) => `"${d}"`).join(", ")} ` +
+            `and cannot use ${kind} "${requested}". The user chose this when approving the ` +
+            `connection; to use another ${kind} they must reconnect and allow it.`);
+        this.kind = kind;
+        this.requested = requested;
+        this.allowed = allowed;
+        this.name = "ScopeNotAllowedError";
+    }
+}
+/** Kept for the name callers already import; the database case of the above. */
+export const DatabaseNotAllowedError = ScopeNotAllowedError;
+/** Throws unless `database` is one the connection may use. */
+export function assertDatabaseAllowed(database, allowed) {
+    if (allowed && !allowed.includes(database)) {
+        throw new ScopeNotAllowedError("database", database, allowed);
+    }
+}
+/**
+ * Throws unless `collection` is one the connection may use.
+ *
+ * Separate from the database check because confinement has to cover both:
+ * a caller pinned to one database can otherwise step sideways into a
+ * collection the consent screen never showed, and `drop_collection` makes
+ * that destructive.
+ */
+export function assertCollectionAllowed(collection, allowed) {
+    if (allowed && !allowed.includes(collection)) {
+        throw new ScopeNotAllowedError("collection", collection, allowed);
+    }
+}
 class Resource {
-    constructor(sdk, database, collection) {
+    constructor(sdk, database, collection, allowedDatabases, allowedCollections) {
         this.sdk = sdk;
         this.database = database;
         this.collection = collection;
+        this.allowedDatabases = allowedDatabases;
+        this.allowedCollections = allowedCollections;
     }
     scope(override, dbOverride) {
         const database = dbOverride?.trim() || this.database;
+        // Enforced HERE, on the one path every per-call scope takes, so no tool
+        // can forget to check. The configured defaults are always allowed.
+        if (database !== this.database)
+            assertDatabaseAllowed(database, this.allowedDatabases);
         const collection = override?.trim() || this.collection;
+        if (collection && collection !== this.collection) {
+            assertCollectionAllowed(collection, this.allowedCollections);
+        }
         return collection != null && collection !== ""
             ? { database, collection }
             : { database };
@@ -65,6 +114,10 @@ class Resource {
             return unwrap(await fn());
         }
         catch (err) {
+            // A refused database is a decision the user made, not a transport
+            // failure from `path`; it keeps its own type and message.
+            if (err instanceof ScopeNotAllowedError)
+                throw err;
             throw translateError(path, err);
         }
     }
@@ -73,8 +126,8 @@ export class ContextResource extends Resource {
     // The base constructor is `protected`, so this one is what makes the class
     // instantiable from outside the file. Removing it fails with TS2674.
     // biome-ignore lint/complexity/noUselessConstructor: widens visibility
-    constructor(sdk, database, collection) {
-        super(sdk, database, collection);
+    constructor(sdk, database, collection, allowedDatabases, allowedCollections) {
+        super(sdk, database, collection, allowedDatabases, allowedCollections);
     }
     /**
      * The single retrieval entry point (SDK `client.query`).
@@ -250,8 +303,8 @@ export class DatabasesResource extends Resource {
     // The base constructor is `protected`, so this one is what makes the class
     // instantiable from outside the file. Removing it fails with TS2674.
     // biome-ignore lint/complexity/noUselessConstructor: widens visibility
-    constructor(sdk, database, collection) {
-        super(sdk, database, collection);
+    constructor(sdk, database, collection, allowedDatabases, allowedCollections) {
+        super(sdk, database, collection, allowedDatabases, allowedCollections);
     }
     create(params) {
         return this.call("/databases", () => this.sdk.databases.create({
@@ -298,8 +351,12 @@ export class HydraDB {
                 // overridden — level and silencing keep the SDK's own defaults.
                 logging: { logger: STDERR_LOGGER },
             });
-        this.context = new ContextResource(client, config.database, config.collection);
-        this.databases = new DatabasesResource(client, config.database, config.collection);
+        this.database = config.database;
+        this.collection = config.collection;
+        this.allowedDatabases = config.allowedDatabases;
+        this.allowedCollections = config.allowedCollections;
+        this.context = new ContextResource(client, config.database, config.collection, config.allowedDatabases, config.allowedCollections);
+        this.databases = new DatabasesResource(client, config.database, config.collection, config.allowedDatabases, config.allowedCollections);
         this.graph = new GraphResource({
             token: config.token,
             ...(config.baseUrl != null ? { baseUrl: config.baseUrl } : {}),

package/dist/hydra/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/hydra/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAoBrC;;;;;;;;;;;GAWG;AACH,MAAM,aAAa,GAAG;IACrB,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC9C,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjD,IAAI,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC7C,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjD,IAAI,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC7C,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjD,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC9C,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACjD,CAAC;AAEF,6FAA6F;AAC7F,SAAS,GAAG,CAAC,IAAqB;IACjC,OAAO,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAmJD,MAAe,QAAQ;IACtB,YACoB,GAAkB,EACpB,QAAgB,EAChB,UAAmB;QAFjB,QAAG,GAAH,GAAG,CAAe;QACpB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,eAAU,GAAV,UAAU,CAAS;IAClC,CAAC;IAEM,KAAK,CAAC,QAAiB,EAAE,UAAmB;QACrD,MAAM,QAAQ,GAAG,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC;QACrD,MAAM,UAAU,GAAG,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC;QACvD,OAAO,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE;YAC7C,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE;YAC1B,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;IACjB,CAAC;IAES,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,EAA0B;QAC/D,IAAI,CAAC;YACJ,OAAO,MAAM,CAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;CACD;AAED,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC5C,2EAA2E;IAC3E,qEAAqE;IACrE,uEAAuE;IACvE,YAAY,GAAkB,EAAE,QAAgB,EAAE,UAAmB;QACpE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CACV,MAAmB,EACnB,IAAqB;QAErB,qEAAqE;QACrE,wEAAwE;QACxE,wCAAwC;QACxC,oFAAoF;QACpF,wEAAwE;QACxE,qEAAqE;QACrE,qEAAqE;QACrE,EAAE;QACF,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,+DAA+D;QAC/D,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACd,aAAa,MAAM,CAAC,QAAQ,wCAAwC;gBACpE,uEAAuE;gBACvE,iEAAiE,CACjE,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GACZ,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAElE,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC/B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YACd,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACjD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO;YACP,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SACzC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CACb,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACX,MAAoB,EACpB,IAAqB;QAErB,MAAM,OAAO,GAA6B;YACzC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACjD,IAAI,EAAE,MAAM,CAAC,IAAI;SACjB,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC3B,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;YACnC,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI;gBAAE,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC;YACnE,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACjD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC;YAC9C,kEAAkE;YAClE,sCAAsC;YACtC,IAAI,KAAK,IAAI,MAAM,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;gBAChD,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,kBAAkB,CAAC;YACtD,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI;gBAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC9D,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI;gBAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YACpD,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI;gBAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC9D,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI;gBAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC7D,IAAI,MAAM,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;gBACvC,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,kBAAkB,CAAC;YACtD,CAAC;YACD,IAAI,MAAM,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;gBACpC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC;YAChD,CAAC;YACD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACP,gEAAgE;YAChE,sEAAsE;YACtE,mEAAmE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,oCAAoC;YACpC,MAAM,WAAW,GAChB;gBACC,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;gBACvB,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;gBAC7B,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;gBACvB,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;gBACjC,CAAC,oBAAoB,EAAE,MAAM,CAAC,kBAAkB,CAAC;gBACjD,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;gBAC7B,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;gBAC7B,CAAC,oBAAoB,EAAE,MAAM,CAAC,kBAAkB,CAAC;gBACjD,CAAC,iBAAiB,EAAE,MAAM,CAAC,eAAe,CAAC;aAE5C;iBACC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;iBACpC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAExB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACd,wCAAwC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;oBACnE,oEAAoE;oBACpE,eAAe,CACf,CAAC;YACH,CAAC;YAED,sEAAsE;YACtE,iEAAiE;YACjE,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACzB,OAAO,CAAC,SAAS,GAAG;oBACnB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;oBACvC,gDAAgD;oBAChD,mDAAmD;oBACnD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,KAAK;oBAC/D,WAAW,EAAE,eAAe;iBAC5B,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE,CACxC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAC3C,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,IAAI,CACH,SAAqB,EAAE,EACvB,IAAqB;QAErB,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,CACtC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;YACrB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACjD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SACzB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CACb,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,OAAO,CACN,MAAqB,EACrB,IAAqB;QAErB,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CACzC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;YACxB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACjD,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,aAAa,EAAE,MAAM,CAAC,aAAa;SACnC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CACb,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,eAAe,CACd,MAA6B,EAC7B,IAAqB;QAErB,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE,CACxC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YACvB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACjD,GAAG,EAAE,MAAM,CAAC,GAAG;SACf,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CACb,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,SAAS,CACR,SAA0B,EAAE;QAE5B,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAC3C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;YAC1B,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACjD,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;SACrB,CAAC,CACF,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,MAAM,CACL,MAAoB,EACpB,IAAqB;QAErB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YACvB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACjD,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,IAAI,EAAE,MAAM,CAAC,IAAI;SACjB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CACb,CAAC;IACH,CAAC;CACD;AAED,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC9C,2EAA2E;IAC3E,qEAAqE;IACrE,uEAAuE;IACvE,YAAY,GAAkB,EAAE,QAAgB,EAAE,UAAmB;QACpE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,CACL,MAA4B;QAE5B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CACnC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;YACrD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAC/C,CAAC,CACF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,QAAgB;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,WAAW,CAAC,QAAgB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAC/C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAgB;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CACzC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CACtC,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,SAAS,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAC1C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CACvC,CAAC;IACH,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,OAAO,OAAO;IASnB,YAAY,MAAmB,EAAE,GAAmB;QACnD,MAAM,MAAM,GACX,GAAG;YACH,IAAI,aAAa,CAAC;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,kEAAkE;gBAClE,oEAAoE;gBACpE,yDAAyD;gBACzD,gBAAgB,EAAE,MAAM,CAAC,cAAc,IAAI,uBAAuB;gBAClE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,mBAAmB;gBACpD,qEAAqE;gBACrE,+DAA+D;gBAC/D,gEAAgE;gBAChE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;aAClC,CAAC,CAAC;QACJ,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/E,IAAI,CAAC,SAAS,GAAG,IAAI,iBAAiB,CACrC,MAAM,EACN,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,UAAU,CACjB,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,aAAa,CAAC;YAC9B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,uBAAuB;YAChE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,mBAAmB;SACpD,CAAC,CAAC;IACJ,CAAC;CACD"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/hydra/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAoBrC;;;;;;;;;;;GAWG;AACH,MAAM,aAAa,GAAG;IACrB,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC9C,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjD,IAAI,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC7C,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjD,IAAI,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC7C,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjD,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAC9C,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACjD,CAAC;AAEF,6FAA6F;AAC7F,SAAS,GAAG,CAAC,IAAqB;IACjC,OAAO,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AA2JD;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YACU,IAA+B,EAC/B,SAAiB,EACjB,OAA0B;QAEnC,KAAK,CACJ,kCAAkC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACnF,kBAAkB,IAAI,KAAK,SAAS,4CAA4C;YAChF,8BAA8B,IAAI,oCAAoC,CACvE,CAAC;QARO,SAAI,GAAJ,IAAI,CAA2B;QAC/B,cAAS,GAAT,SAAS,CAAQ;QACjB,YAAO,GAAP,OAAO,CAAmB;QAOnC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACpC,CAAC;CACD;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D,8DAA8D;AAC9D,MAAM,UAAU,qBAAqB,CACpC,QAAgB,EAChB,OAAsC;IAEtC,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,oBAAoB,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACtC,UAAkB,EAClB,OAAsC;IAEtC,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,oBAAoB,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;AACF,CAAC;AAED,MAAe,QAAQ;IACtB,YACoB,GAAkB,EACpB,QAAgB,EAChB,UAAmB,EACnB,gBAAoC,EACpC,kBAAsC;QAJpC,QAAG,GAAH,GAAG,CAAe;QACpB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,eAAU,GAAV,UAAU,CAAS;QACnB,qBAAgB,GAAhB,gBAAgB,CAAoB;QACpC,uBAAkB,GAAlB,kBAAkB,CAAoB;IACrD,CAAC;IAEM,KAAK,CAAC,QAAiB,EAAE,UAAmB;QACrD,MAAM,QAAQ,GAAG,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC;QACrD,wEAAwE;QACxE,mEAAmE;QACnE,IAAI,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvF,MAAM,UAAU,GAAG,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC;QACvD,IAAI,UAAU,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAClD,uBAAuB,CAAC,UAAU,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE;YAC7C,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE;YAC1B,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;IACjB,CAAC;IAES,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,EAA0B;QAC/D,IAAI,CAAC;YACJ,OAAO,MAAM,CAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,kEAAkE;YAClE,0DAA0D;YAC1D,IAAI,GAAG,YAAY,oBAAoB;gBAAE,MAAM,GAAG,CAAC;YACnD,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;CACD;AAED,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC5C,2EAA2E;IAC3E,qEAAqE;IACrE,uEAAuE;IACvE,YACC,GAAkB,EAClB,QAAgB,EAChB,UAAmB,EACnB,gBAAoC,EACpC,kBAAsC;QAEtC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IACxE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CACV,MAAmB,EACnB,IAAqB;QAErB,qEAAqE;QACrE,wEAAwE;QACxE,wCAAwC;QACxC,oFAAoF;QACpF,wEAAwE;QACxE,qEAAqE;QACrE,qEAAqE;QACrE,EAAE;QACF,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,+DAA+D;QAC/D,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACd,aAAa,MAAM,CAAC,QAAQ,wCAAwC;gBACpE,uEAAuE;gBACvE,iEAAiE,CACjE,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GACZ,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAElE,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC/B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YACd,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACjD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO;YACP,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SACzC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CACb,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACX,MAAoB,EACpB,IAAqB;QAErB,MAAM,OAAO,GAA6B;YACzC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACjD,IAAI,EAAE,MAAM,CAAC,IAAI;SACjB,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC3B,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;YACnC,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI;gBAAE,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC;YACnE,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACjD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC;YAC9C,kEAAkE;YAClE,sCAAsC;YACtC,IAAI,KAAK,IAAI,MAAM,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;gBAChD,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,kBAAkB,CAAC;YACtD,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI;gBAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC9D,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI;gBAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YACpD,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI;gBAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC9D,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI;gBAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC7D,IAAI,MAAM,CAAC,kBAAkB,IAAI,IAAI,EAAE,CAAC;gBACvC,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,kBAAkB,CAAC;YACtD,CAAC;YACD,IAAI,MAAM,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;gBACpC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC;YAChD,CAAC;YACD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACP,gEAAgE;YAChE,sEAAsE;YACtE,mEAAmE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,oCAAoC;YACpC,MAAM,WAAW,GAChB;gBACC,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;gBACvB,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;gBAC7B,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;gBACvB,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;gBACjC,CAAC,oBAAoB,EAAE,MAAM,CAAC,kBAAkB,CAAC;gBACjD,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;gBAC7B,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;gBAC7B,CAAC,oBAAoB,EAAE,MAAM,CAAC,kBAAkB,CAAC;gBACjD,CAAC,iBAAiB,EAAE,MAAM,CAAC,eAAe,CAAC;aAE5C;iBACC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;iBACpC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAExB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACd,wCAAwC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;oBACnE,oEAAoE;oBACpE,eAAe,CACf,CAAC;YACH,CAAC;YAED,sEAAsE;YACtE,iEAAiE;YACjE,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACzB,OAAO,CAAC,SAAS,GAAG;oBACnB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;oBACvC,gDAAgD;oBAChD,mDAAmD;oBACnD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,KAAK;oBAC/D,WAAW,EAAE,eAAe;iBAC5B,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE,CACxC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAC3C,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,IAAI,CACH,SAAqB,EAAE,EACvB,IAAqB;QAErB,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,CACtC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;YACrB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACjD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SACzB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CACb,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,OAAO,CACN,MAAqB,EACrB,IAAqB;QAErB,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CACzC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;YACxB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACjD,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,aAAa,EAAE,MAAM,CAAC,aAAa;SACnC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CACb,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,eAAe,CACd,MAA6B,EAC7B,IAAqB;QAErB,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE,CACxC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YACvB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACjD,GAAG,EAAE,MAAM,CAAC,GAAG;SACf,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CACb,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,SAAS,CACR,SAA0B,EAAE;QAE5B,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAC3C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;YAC1B,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACjD,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;SACrB,CAAC,CACF,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,MAAM,CACL,MAAoB,EACpB,IAAqB;QAErB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YACvB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YACjD,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,IAAI,EAAE,MAAM,CAAC,IAAI;SACjB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CACb,CAAC;IACH,CAAC;CACD;AAED,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC9C,2EAA2E;IAC3E,qEAAqE;IACrE,uEAAuE;IACvE,YACC,GAAkB,EAClB,QAAgB,EAChB,UAAmB,EACnB,gBAAoC,EACpC,kBAAsC;QAEtC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,CACL,MAA4B;QAE5B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CACnC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;YACrD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAC/C,CAAC,CACF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,QAAgB;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,WAAW,CAAC,QAAgB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAC/C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAgB;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CACzC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CACtC,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,SAAS,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAC1C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CACvC,CAAC;IACH,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,OAAO,OAAO;IAiBnB,YAAY,MAAmB,EAAE,GAAmB;QACnD,MAAM,MAAM,GACX,GAAG;YACH,IAAI,aAAa,CAAC;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,kEAAkE;gBAClE,oEAAoE;gBACpE,yDAAyD;gBACzD,gBAAgB,EAAE,MAAM,CAAC,cAAc,IAAI,uBAAuB;gBAClE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,mBAAmB;gBACpD,qEAAqE;gBACrE,+DAA+D;gBAC/D,gEAAgE;gBAChE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;aAClC,CAAC,CAAC;QACJ,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAChD,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,CACjC,MAAM,EACN,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,gBAAgB,EACvB,MAAM,CAAC,kBAAkB,CACzB,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,iBAAiB,CACrC,MAAM,EACN,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,gBAAgB,EACvB,MAAM,CAAC,kBAAkB,CACzB,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,aAAa,CAAC;YAC9B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,uBAAuB;YAChE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,mBAAmB;SACpD,CAAC,CAAC;IACJ,CAAC;CACD"}

package/dist/hydra/index.d.ts

@@ -10,4 +10,5 @@ export type { HydraConfig, ContextKind, RequestOptions, QueryKind, ConversationT
 export { GraphResource } from "./graph.js";
 export type { GraphConfig, GraphQueryParams, GraphScopeParams, GraphRow, } from "./graph.js";
 export { HydraWrapperError, responseError, translateError } from "./errors.js";
+export { assertCollectionAllowed, assertDatabaseAllowed, DatabaseNotAllowedError, ScopeNotAllowedError, } from "./client.js";
 export { unwrap } from "./envelope.js";

package/dist/hydra/index.js

@@ -8,5 +8,6 @@
 export { HydraDB, ContextResource, DatabasesResource, DEFAULT_TIMEOUT_SECONDS, DEFAULT_MAX_RETRIES, } from "./client.js";
 export { GraphResource } from "./graph.js";
 export { HydraWrapperError, responseError, translateError } from "./errors.js";
+export { assertCollectionAllowed, assertDatabaseAllowed, DatabaseNotAllowedError, ScopeNotAllowedError, } from "./client.js";
 export { unwrap } from "./envelope.js";
 //# sourceMappingURL=index.js.map

package/dist/hydra/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hydra/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,GACnB,MAAM,aAAa,CAAC;AAgBrB,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAO3C,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hydra/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,GACnB,MAAM,aAAa,CAAC;AAgBrB,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAO3C,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EACN,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC"}

package/dist/oauth.d.ts

@@ -0,0 +1,109 @@
+/**
+ * The OAuth 2.1 RESOURCE-SERVER half of MCP authorization (PRO-1790).
+ *
+ * This server never issues tokens and never talks to the user. It does three
+ * things the MCP authorization spec asks of a protected resource:
+ *
+ *   1. Advertise where its authorization server is, via an RFC 9728 Protected
+ *      Resource Metadata document at `/.well-known/oauth-protected-resource`,
+ *      and point at that document from every 401 (`WWW-Authenticate`).
+ *   2. Recognise an access token the authorization server issued and turn it
+ *      into the same {@link RequestCredentials} an API key would produce, by
+ *      asking the authorization server what the token stands for (RFC 7662
+ *      introspection). The answer carries the API key the dashboard minted on
+ *      the user's Approve click, so the tool layer keeps calling Hydra DB
+ *      exactly as it does for a key: nothing downstream knows OAuth exists.
+ *   3. Refuse a token that was not issued for THIS server (audience binding,
+ *      RFC 8707), so a token minted for another resource cannot be replayed
+ *      here.
+ *
+ * All of it is additive and switched on only by configuration: with no
+ * `HYDRADB_OAUTH_ISSUER` the server behaves exactly as before.
+ */
+/** Access tokens the dashboard issues carry this prefix; keys carry `sk_`. */
+export declare const ACCESS_TOKEN_PREFIX = "hmat_";
+/** The one scope this resource defines. Granularity is PRO-1789's problem. */
+export declare const SCOPE = "hydradb";
+export interface OAuthConfig {
+    /** The authorization server, e.g. `https://app.hydradb.com`. No trailing slash. */
+    issuer: string;
+    /** This server's canonical URL as clients know it, e.g. `https://mcp.hydradb.com`. */
+    resource: string;
+    /** Shared secret presented to the issuer's introspection endpoint. */
+    introspectionSecret: string;
+    /** Overrides for tests. */
+    fetchFn?: typeof fetch;
+    now?: () => number;
+}
+/** Everything an introspected token stands for. Mirrors the dashboard's response. */
+export interface IntrospectedToken {
+    apiKey: string;
+    database?: string;
+    collection?: string;
+    /**
+     * Databases a per-call `database` argument may name. Absent means any (the
+     * user chose to let the app switch when asked); present means the user
+     * confined the app to exactly these on the consent screen, and this server
+     * is where that promise is kept, because the API key behind the token is
+     * org-wide and the key never leaves this process.
+     */
+    allowedDatabases?: string[];
+    /**
+     * Collections a per-call `collection` argument may name, on the same terms.
+     * Confinement has to cover both or it means nothing: a caller pinned to one
+     * database could still step sideways into a collection the consent screen
+     * never showed and, through `drop_collection`, delete it.
+     */
+    allowedCollections?: string[];
+    userId?: string;
+    clientId?: string;
+    clientName?: string;
+    /** Epoch seconds. */
+    expiresAt: number;
+}
+export type IntrospectionResult = {
+    ok: true;
+    token: IntrospectedToken;
+} | {
+    ok: false;
+    reason: "invalid_token" | "wrong_audience" | "unavailable";
+    detail?: string;
+};
+/**
+ * Read the OAuth configuration, or `null` when the feature is off.
+ *
+ * All three values are needed: an issuer says where to send clients, a
+ * resource says which audience to accept, and the secret is what makes the
+ * introspection answer trustworthy. Half a configuration is treated as none,
+ * with a startup warning, rather than as a server that advertises an
+ * authorization flow it cannot complete.
+ */
+export declare function resolveOAuthConfig(env?: Record<string, string | undefined>, warn?: (message: string) => void): OAuthConfig | null;
+/** Where the Protected Resource Metadata document lives for this server. */
+export declare function metadataUrl(config: OAuthConfig, mcpPath?: string): string;
+/** The RFC 9728 document itself. */
+export declare function protectedResourceMetadata(config: OAuthConfig): Record<string, unknown>;
+/**
+ * The `WWW-Authenticate` value for a 401.
+ *
+ * `resource_metadata` is how a client that arrived with nothing learns where
+ * to log in (the MCP spec's first discovery step), and `scope` tells it what
+ * to ask for. `error` is included only when a token was PRESENTED and refused,
+ * so an anonymous first contact reads as "authenticate" rather than "your
+ * token is bad".
+ */
+export declare function wwwAuthenticate(config: OAuthConfig, error?: "invalid_token" | "insufficient_scope", description?: string): string;
+/** Whether a bearer value is one of OUR access tokens rather than an API key. */
+export declare function isAccessToken(bearer: string | undefined): bearer is string;
+/** Test-only. */
+export declare function __resetIntrospectionCache(): void;
+/**
+ * Ask the issuer what a token stands for.
+ *
+ * The response shape is the contract in PRO-1790: `active`, `aud`, `exp`,
+ * `api_key`, `database`, `collection`, `sub`, `client_id`, `client_name`.
+ * Audience is checked HERE, not trusted from the issuer's say-so: the issuer
+ * may legitimately serve several resources, and this server must only honour
+ * tokens minted for itself.
+ */
+export declare function introspect(config: OAuthConfig, token: string): Promise<IntrospectionResult>;

package/dist/oauth.js

@@ -0,0 +1,228 @@
+/**
+ * The OAuth 2.1 RESOURCE-SERVER half of MCP authorization (PRO-1790).
+ *
+ * This server never issues tokens and never talks to the user. It does three
+ * things the MCP authorization spec asks of a protected resource:
+ *
+ *   1. Advertise where its authorization server is, via an RFC 9728 Protected
+ *      Resource Metadata document at `/.well-known/oauth-protected-resource`,
+ *      and point at that document from every 401 (`WWW-Authenticate`).
+ *   2. Recognise an access token the authorization server issued and turn it
+ *      into the same {@link RequestCredentials} an API key would produce, by
+ *      asking the authorization server what the token stands for (RFC 7662
+ *      introspection). The answer carries the API key the dashboard minted on
+ *      the user's Approve click, so the tool layer keeps calling Hydra DB
+ *      exactly as it does for a key: nothing downstream knows OAuth exists.
+ *   3. Refuse a token that was not issued for THIS server (audience binding,
+ *      RFC 8707), so a token minted for another resource cannot be replayed
+ *      here.
+ *
+ * All of it is additive and switched on only by configuration: with no
+ * `HYDRADB_OAUTH_ISSUER` the server behaves exactly as before.
+ */
+import { createHash } from "node:crypto";
+import { logger } from "./logger.js";
+/** Access tokens the dashboard issues carry this prefix; keys carry `sk_`. */
+export const ACCESS_TOKEN_PREFIX = "hmat_";
+/** The one scope this resource defines. Granularity is PRO-1789's problem. */
+export const SCOPE = "hydradb";
+function stripSlash(url) {
+    return url.replace(/\/+$/, "");
+}
+/**
+ * Read the OAuth configuration, or `null` when the feature is off.
+ *
+ * All three values are needed: an issuer says where to send clients, a
+ * resource says which audience to accept, and the secret is what makes the
+ * introspection answer trustworthy. Half a configuration is treated as none,
+ * with a startup warning, rather than as a server that advertises an
+ * authorization flow it cannot complete.
+ */
+export function resolveOAuthConfig(env = process.env, warn = (m) => console.error(`[hydradb-mcp] ${m}`)) {
+    const issuer = env.HYDRADB_OAUTH_ISSUER?.trim();
+    const resource = env.HYDRADB_MCP_PUBLIC_URL?.trim();
+    const introspectionSecret = env.HYDRADB_OAUTH_INTROSPECTION_SECRET?.trim();
+    if (!issuer && !resource && !introspectionSecret)
+        return null;
+    const missing = [
+        !issuer && "HYDRADB_OAUTH_ISSUER",
+        !resource && "HYDRADB_MCP_PUBLIC_URL",
+        !introspectionSecret && "HYDRADB_OAUTH_INTROSPECTION_SECRET",
+    ].filter(Boolean);
+    if (missing.length > 0) {
+        warn(`WARNING: OAuth is partially configured (missing ${missing.join(", ")}); ` +
+            "it stays OFF until all three are set.");
+        return null;
+    }
+    for (const [name, value] of [
+        ["HYDRADB_OAUTH_ISSUER", issuer],
+        ["HYDRADB_MCP_PUBLIC_URL", resource],
+    ]) {
+        if (!/^https?:\/\//i.test(value)) {
+            warn(`WARNING: ${name} must be an absolute http(s) URL; OAuth stays OFF.`);
+            return null;
+        }
+    }
+    return {
+        issuer: stripSlash(issuer),
+        resource: stripSlash(resource),
+        introspectionSecret: introspectionSecret,
+    };
+}
+/** Where the Protected Resource Metadata document lives for this server. */
+export function metadataUrl(config, mcpPath = "") {
+    // RFC 9728 puts the well-known segment BEFORE the resource's path, so a
+    // server at /mcp advertises at /.well-known/oauth-protected-resource/mcp.
+    return `${config.resource}/.well-known/oauth-protected-resource${mcpPath}`;
+}
+/** The RFC 9728 document itself. */
+export function protectedResourceMetadata(config) {
+    return {
+        resource: config.resource,
+        authorization_servers: [config.issuer],
+        scopes_supported: [SCOPE],
+        bearer_methods_supported: ["header"],
+        resource_name: "Hydra DB MCP",
+        resource_documentation: "https://docs.hydradb.com/mcp",
+    };
+}
+/**
+ * The `WWW-Authenticate` value for a 401.
+ *
+ * `resource_metadata` is how a client that arrived with nothing learns where
+ * to log in (the MCP spec's first discovery step), and `scope` tells it what
+ * to ask for. `error` is included only when a token was PRESENTED and refused,
+ * so an anonymous first contact reads as "authenticate" rather than "your
+ * token is bad".
+ */
+export function wwwAuthenticate(config, error, description) {
+    const parts = [`Bearer realm="Hydra DB MCP"`];
+    if (error)
+        parts.push(`error="${error}"`);
+    if (description)
+        parts.push(`error_description="${description.replace(/"/g, "'")}"`);
+    parts.push(`resource_metadata="${metadataUrl(config)}"`);
+    parts.push(`scope="${SCOPE}"`);
+    return parts.join(", ");
+}
+/** Whether a bearer value is one of OUR access tokens rather than an API key. */
+export function isAccessToken(bearer) {
+    return typeof bearer === "string" && bearer.startsWith(ACCESS_TOKEN_PREFIX);
+}
+// --- Introspection, with a bounded memo ---
+/**
+ * Introspection answers are memoised per token so the hosted server, which
+ * builds a client per request, does not ask the dashboard on every tool call.
+ * Only successes are cached, for the shorter of the token's own expiry and
+ * this ceiling. The ceiling IS the revocation lag: measured end to end, a
+ * disconnect or a refresh-token reuse detection reaches this server exactly
+ * one ceiling later. Thirty seconds keeps an agent's burst of tool calls at
+ * one hop while keeping that lag short enough that a revoked token cannot do
+ * much with it.
+ */
+const INTROSPECTION_CACHE_TTL_MS = 30000;
+const INTROSPECTION_CACHE_MAX = 5000;
+const INTROSPECTION_TIMEOUT_MS = 5000;
+const cache = new Map();
+/** Test-only. */
+export function __resetIntrospectionCache() {
+    cache.clear();
+}
+function cacheKey(token) {
+    // Never keep the raw token as a Map key: it would sit in memory in the
+    // clear for as long as the entry lives.
+    return createHash("sha256").update(token).digest("hex");
+}
+/**
+ * Ask the issuer what a token stands for.
+ *
+ * The response shape is the contract in PRO-1790: `active`, `aud`, `exp`,
+ * `api_key`, `database`, `collection`, `sub`, `client_id`, `client_name`.
+ * Audience is checked HERE, not trusted from the issuer's say-so: the issuer
+ * may legitimately serve several resources, and this server must only honour
+ * tokens minted for itself.
+ */
+export async function introspect(config, token) {
+    const now = config.now ?? Date.now;
+    const key = cacheKey(token);
+    const hit = cache.get(key);
+    if (hit && hit.expires > now())
+        return { ok: true, token: hit.token };
+    if (hit)
+        cache.delete(key);
+    const fetchFn = config.fetchFn ?? fetch;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), INTROSPECTION_TIMEOUT_MS);
+    let body;
+    try {
+        const res = await fetchFn(`${config.issuer}/api/oauth/introspect`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json",
+                Authorization: `Bearer ${config.introspectionSecret}`,
+            },
+            body: new URLSearchParams({ token }).toString(),
+            signal: controller.signal,
+        });
+        if (res.status === 401 || res.status === 403) {
+            // Our secret was refused. That is an operator problem, not the
+            // caller's, and it must not read as "your token is invalid".
+            logger.error("introspection refused: HYDRADB_OAUTH_INTROSPECTION_SECRET is not accepted by the issuer");
+            return { ok: false, reason: "unavailable", detail: "introspection refused" };
+        }
+        if (!res.ok) {
+            return { ok: false, reason: "unavailable", detail: `introspection HTTP ${res.status}` };
+        }
+        body = (await res.json());
+    }
+    catch (err) {
+        return {
+            ok: false,
+            reason: "unavailable",
+            detail: err instanceof Error ? err.message : String(err),
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (body.active !== true)
+        return { ok: false, reason: "invalid_token" };
+    const aud = body.aud;
+    const audiences = Array.isArray(aud) ? aud : typeof aud === "string" ? [aud] : [];
+    if (!audiences.some((a) => typeof a === "string" && stripSlash(a) === config.resource)) {
+        return { ok: false, reason: "wrong_audience" };
+    }
+    const apiKey = typeof body.api_key === "string" ? body.api_key : "";
+    const exp = typeof body.exp === "number" ? body.exp : 0;
+    if (!apiKey || exp <= Math.floor(now() / 1000)) {
+        return { ok: false, reason: "invalid_token" };
+    }
+    const stringList = (v) => Array.isArray(v)
+        ? v.filter((d) => typeof d === "string" && d.length > 0)
+        : undefined;
+    const allowed = stringList(body.databases);
+    const allowedCols = stringList(body.collections);
+    const resolved = {
+        apiKey,
+        ...(allowed ? { allowedDatabases: allowed } : {}),
+        ...(allowedCols ? { allowedCollections: allowedCols } : {}),
+        database: typeof body.database === "string" && body.database ? body.database : undefined,
+        collection: typeof body.collection === "string" && body.collection ? body.collection : undefined,
+        userId: typeof body.sub === "string" ? body.sub : undefined,
+        clientId: typeof body.client_id === "string" ? body.client_id : undefined,
+        clientName: typeof body.client_name === "string" ? body.client_name : undefined,
+        expiresAt: exp,
+    };
+    if (cache.size >= INTROSPECTION_CACHE_MAX) {
+        const oldest = cache.keys().next().value;
+        if (oldest != null)
+            cache.delete(oldest);
+    }
+    cache.set(key, {
+        token: resolved,
+        expires: Math.min(now() + INTROSPECTION_CACHE_TTL_MS, exp * 1000),
+    });
+    return { ok: true, token: resolved };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC;AA6C/B,SAAS,UAAU,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CACjC,MAA0C,OAAO,CAAC,GAAG,EACrD,OAAkC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;IAE5E,MAAM,MAAM,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IACpD,MAAM,mBAAmB,GAAG,GAAG,CAAC,kCAAkC,EAAE,IAAI,EAAE,CAAC;IAC3E,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,OAAO,GAAG;QACf,CAAC,MAAM,IAAI,sBAAsB;QACjC,CAAC,QAAQ,IAAI,wBAAwB;QACrC,CAAC,mBAAmB,IAAI,oCAAoC;KAC5D,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CACH,mDAAmD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YACzE,uCAAuC,CACxC,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,sBAAsB,EAAE,MAAM,CAAC;QAChC,CAAC,wBAAwB,EAAE,QAAQ,CAAC;KAC3B,EAAE,CAAC;QACZ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAM,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,YAAY,IAAI,oDAAoD,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IACD,OAAO;QACN,MAAM,EAAE,UAAU,CAAC,MAAO,CAAC;QAC3B,QAAQ,EAAE,UAAU,CAAC,QAAS,CAAC;QAC/B,mBAAmB,EAAE,mBAAoB;KACzC,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,MAAmB,EAAE,OAAO,GAAG,EAAE;IAC5D,wEAAwE;IACxE,0EAA0E;IAC1E,OAAO,GAAG,MAAM,CAAC,QAAQ,wCAAwC,OAAO,EAAE,CAAC;AAC5E,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,yBAAyB,CAAC,MAAmB;IAC5D,OAAO;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,qBAAqB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACtC,gBAAgB,EAAE,CAAC,KAAK,CAAC;QACzB,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,aAAa,EAAE,cAAc;QAC7B,sBAAsB,EAAE,8BAA8B;KACtD,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC9B,MAAmB,EACnB,KAA8C,EAC9C,WAAoB;IAEpB,MAAM,KAAK,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC9C,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;IAC1C,IAAI,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,sBAAsB,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,MAA0B;IACvD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAC7E,CAAC;AAED,6CAA6C;AAE7C;;;;;;;;;GASG;AACH,MAAM,0BAA0B,GAAG,KAAM,CAAC;AAC1C,MAAM,uBAAuB,GAAG,IAAK,CAAC;AACtC,MAAM,wBAAwB,GAAG,IAAK,CAAC;AAMvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE5C,iBAAiB;AACjB,MAAM,UAAU,yBAAyB;IACxC,KAAK,CAAC,KAAK,EAAE,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC9B,uEAAuE;IACvE,wCAAwC;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,MAAmB,EACnB,KAAa;IAEb,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IACtE,IAAI,GAAG;QAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,wBAAwB,CAAC,CAAC;IAC7E,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,uBAAuB,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,MAAM,CAAC,mBAAmB,EAAE;aACrD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;YAC/C,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC9C,+DAA+D;YAC/D,6DAA6D;YAC7D,MAAM,CAAC,KAAK,CAAC,yFAAyF,CAAC,CAAC;YACxG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,sBAAsB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACzF,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACH,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAExE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,CAAU,EAAwB,EAAE,CACvD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACf,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACrE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAsB;QACnC,MAAM;QACN,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACxF,UAAU,EACT,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QACrF,MAAM,EAAE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAC3D,QAAQ,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACzE,UAAU,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC/E,SAAS,EAAE,GAAG;KACd,CAAC;IAEF,IAAI,KAAK,CAAC,IAAI,IAAI,uBAAuB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACzC,IAAI,MAAM,IAAI,IAAI;YAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;QACd,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,0BAA0B,EAAE,GAAG,GAAG,IAAI,CAAC;KACjE,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC"}

package/dist/server.d.ts

@@ -19,12 +19,20 @@ export declare function inFlightCount(): number;
 export declare function legacyToolsEnabled(env?: NodeJS.ProcessEnv): boolean;
 /** Test-only: reset the once-per-process alias warning dedupe. */
 export declare function __resetAliasWarnings(): void;
+export interface ServerOptions {
+    /**
+     * Register the OAuth-connection tools (currently `hydradb_databases`).
+     * Set by the HTTP transport when the request authenticated with an OAuth
+     * token; never for API keys, so their tool list is unchanged.
+     */
+    oauthTools?: boolean;
+}
 export declare function createHydraDBServer(hydraOverride?: HydraDB, 
 /**
  * Graph scope/gating override, for tests and embedders. Without it the graph
  * config is read from the environment exactly as the rest of the config is.
  */
-graphOverride?: Partial<GraphConfig>): import("@modelcontextprotocol/sdk/server").Server<{
+graphOverride?: Partial<GraphConfig>, options?: ServerOptions): import("@modelcontextprotocol/sdk/server").Server<{
     method: string;
     params?: {
         [x: string]: unknown;