@loopbacktools/server 0.0.0-stage → 0.4.0

package/dist/src/worker/http.js

@@ -0,0 +1,291 @@
+import { BUILD_HEADER, RELOAD_CODE, REVISION_HEADER } from "@loopbacktools/protocol";
+import { REVISION } from "@loopbacktools/protocol/schema";
+import { Effect, Option } from "effect";
+import { Hono } from "hono";
+import { RegExpRouter } from "hono/router/reg-exp-router";
+import { registerRoutes } from "../generated/app.gen.js";
+import { openApiDocument } from "@loopbacktools/protocol/document";
+import { fileKey, Files } from "./files.js";
+import { Gate, vouchedAccess } from "./gate.js";
+import { answerUnhandled, problem, run, } from "./run.js";
+import { UPLOAD_MAX_BYTES } from "../space/operations.js";
+import { buildOf } from "../space/rpc.js";
+import { VERSION } from "../version.js";
+import { makeMcp } from "./mcp.js";
+import { Spaces } from "./spaces.js";
+/** The contract, naming the release that serves it, so a deployment can be checked from outside. */
+const document = { ...openApiDocument, info: { ...openApiDocument.info, version: VERSION } };
+/** How many closed asks a history page holds when the caller does not say. */
+const DEFAULT_PAGE = 20;
+/**
+ * A refused request's 401. When the gate takes credentials from an authorization server, the
+ * challenge says where its protected resource metadata is, so an MCP client can go and sign in.
+ */
+const unauthorized = (message, resourceMetadata) => Response.json(problem("auth.unauthorized", message), {
+    status: 401,
+    headers: {
+        "WWW-Authenticate": resourceMetadata === undefined
+            ? 'Bearer realm="loopback"'
+            : `Bearer realm="loopback", resource_metadata="${resourceMetadata}"`,
+    },
+});
+/** Where the MCP endpoint's protected resource metadata is (RFC 9728): the well-known path, then its path. */
+const RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+/** The prefix a browser puts its event ticket behind in `Sec-WebSocket-Protocol`. */
+const TICKET_PROTOCOL_PREFIX = "loopback.ticket.";
+/** The event ticket a socket upgrade offers, split into the space it names and its secret. */
+const ticketOf = (request) => {
+    const ticket = (request.headers.get("Sec-WebSocket-Protocol") ?? "")
+        .split(",")
+        .map((protocol) => protocol.trim())
+        .find((protocol) => protocol.startsWith(TICKET_PROTOCOL_PREFIX))
+        ?.slice(TICKET_PROTOCOL_PREFIX.length);
+    if (ticket === undefined)
+        return undefined;
+    const dot = ticket.indexOf(".");
+    return { spaceId: ticket.slice(0, dot), secret: ticket.slice(dot + 1) };
+};
+/**
+ * Who a request is from. The Worker's invoker vouches first, when it does; otherwise the
+ * deployment's gate decides from the request itself. A refusal is the 401 to answer with.
+ */
+const authenticate = (runtime, request, props, requestId) => run(runtime, request.signal, requestId, Effect.gen(function* () {
+    const vouched = yield* vouchedAccess(props);
+    if (vouched !== undefined)
+        return vouched;
+    const gate = yield* Gate;
+    return yield* gate
+        .authenticate(request)
+        .pipe(Effect.catchTag("Unauthorized", (refused) => Effect.flatMap(gate.authorizationServers, (servers) => Effect.fail(unauthorized(refused.reason, servers.length === 0
+        ? undefined
+        : `${new URL(request.url).origin}${RESOURCE_METADATA_PATH}/mcp`)))));
+}).pipe(Effect.result));
+/** The props the Worker's invoker passed, if any. */
+const propsOf = (c) => c.executionCtx.props;
+/** The access a handler's caller holds. Every route that reaches a handler requires one but uploads. */
+const accessOf = (caller) => caller.access === null
+    ? Effect.die(new Error("A gated operation was reached without access."))
+    : Effect.succeed(caller.access);
+const spaceOf = (caller) => Effect.gen(function* () {
+    const spaces = yield* Spaces;
+    return spaces.of(yield* accessOf(caller));
+});
+const tooLarge = (maxBytes) => ({
+    status: 413,
+    body: problem("upload.too_large", `Images may be up to ${maxBytes} bytes.`),
+});
+const notFound = (message) => Effect.succeed({ status: 404, body: problem("not_found", message) });
+/** The handler for each operation the contract declares. */
+const handlers = (runtime, request, requestId) => {
+    const serve = (effect) => run(runtime, request.signal, requestId, effect);
+    return {
+        EventTickets_issue: (caller) => serve(Effect.gen(function* () {
+            const access = yield* accessOf(caller);
+            const spaces = yield* Spaces;
+            const issued = yield* spaces.of(access).issueTicket(access.actor.id);
+            return {
+                status: 201,
+                body: { ticket: `${issued.spaceId}.${issued.secret}`, expiresAt: issued.expiresAt },
+            };
+        })),
+        Session_whoami: (caller) => serve(Effect.map(accessOf(caller), (access) => ({
+            status: 200,
+            body: { space: access.space, actor: access.actor },
+        }))),
+        Snapshots_read: (caller) => serve(Effect.gen(function* () {
+            const space = yield* spaceOf(caller);
+            return { status: 200, body: yield* space.snapshot() };
+        })),
+        Asks_list: (caller, input) => serve(Effect.gen(function* () {
+            const space = yield* spaceOf(caller);
+            return {
+                status: 200,
+                body: yield* space.history(input.before, input.limit ?? DEFAULT_PAGE),
+            };
+        })),
+        Asks_read: (caller, input) => serve(Effect.gen(function* () {
+            const space = yield* spaceOf(caller);
+            return { status: 200, body: yield* space.get(input.id) };
+        }).pipe(Effect.catchTag("AskNotFound", () => notFound(`No ask ${input.id}.`)))),
+        Asks_reply: (caller, input) => serve(Effect.gen(function* () {
+            const access = yield* accessOf(caller);
+            const space = yield* spaceOf(caller);
+            return {
+                status: 200,
+                body: yield* space.reply(input.id, input.reply, access.actor),
+            };
+        }).pipe(Effect.catchTags({
+            AskNotFound: () => notFound(`No ask ${input.id}.`),
+            AskClosed: () => Effect.succeed({
+                status: 409,
+                body: problem("ask.closed", "This ask has already been answered."),
+            }),
+            NotYourTurn: () => Effect.succeed({
+                status: 409,
+                body: problem("ask.agent_turn", "The agent owes an answer before you can reply."),
+            }),
+            ReplyInvalid: (error) => Effect.succeed({
+                status: 422,
+                body: problem("reply.invalid", error.reason),
+            }),
+        }))),
+        Files_read: (caller, input) => serve(Effect.gen(function* () {
+            const spaces = yield* Spaces;
+            const files = yield* Files;
+            const access = yield* accessOf(caller);
+            const upload = yield* spaces.of(access).findUpload(input.uploadId);
+            const body = yield* files.get(fileKey(spaces.idOf(access), input.uploadId));
+            if (Option.isNone(body))
+                return yield* notFound(`No file ${input.uploadId}.`);
+            return { status: 200, contentType: upload.contentType, body: body.value };
+        }).pipe(Effect.catchTag("UploadNotFound", () => notFound(`No file ${input.uploadId}.`)))),
+        Uploads_store: (_caller, input) => serve(Effect.gen(function* () {
+            const spaces = yield* Spaces;
+            const files = yield* Files;
+            const space = spaces.byId(input.spaceId);
+            if (Option.isNone(space))
+                return yield* notFound("No such upload.");
+            const length = Number(request.headers.get("Content-Length") ?? Number.NaN);
+            if (!Number.isSafeInteger(length) || length <= 0 || request.body === null) {
+                return {
+                    status: 422,
+                    body: problem("upload.length_required", "Send the image with a Content-Length."),
+                };
+            }
+            // Refused before the ticket is claimed, so it stays good for an image that fits.
+            if (length > UPLOAD_MAX_BYTES)
+                return tooLarge(UPLOAD_MAX_BYTES);
+            const claimed = yield* space.value.claimUpload(input.token, input["Content-Type"]);
+            if (length > claimed.maxBytes)
+                return tooLarge(claimed.maxBytes);
+            yield* files.put(fileKey(input.spaceId, claimed.uploadId), request.body, length, claimed.contentType);
+            return {
+                status: 201,
+                body: yield* space.value.completeUpload(claimed.uploadId, length),
+            };
+        }).pipe(Effect.catchTags({
+            UploadNotFound: () => notFound("No such upload."),
+            UploadExpired: () => Effect.succeed({
+                status: 410,
+                body: problem("upload.expired", "This upload URL has expired or was already used."),
+            }),
+            UploadRejected: (error) => Effect.succeed({
+                status: 422,
+                body: problem("upload.rejected", error.reason),
+            }),
+            UploadIncomplete: () => Effect.succeed({
+                status: 422,
+                body: problem("upload.incomplete", "The image ended before, or ran past, its Content-Length."),
+            }),
+        }))),
+    };
+};
+const deps = (runtimeOf) => ({
+    authorize: (requirements) => async (c, next) => {
+        // Every gated operation asks for a bearer token and nothing else; the gate decides what one is.
+        if (!requirements.some((requirement) => "BearerAuth" in requirement)) {
+            return unauthorized("This operation accepts no credentials Loopback can check.");
+        }
+        const access = await authenticate(runtimeOf(c.env), c.req.raw, propsOf(c), c.get("requestId"));
+        if (access._tag === "Failure")
+            return access.failure;
+        c.set("access", access.success);
+        await next();
+        return undefined;
+    },
+    context: (c, authentication) => {
+        const access = authentication === "none" ? null : (c.get("access") ?? null);
+        if (authentication === "required" && access === null)
+            return null;
+        return { access, requestId: c.get("requestId"), signal: c.req.raw.signal };
+    },
+    noContext: () => unauthorized("A bearer token is required."),
+    notAcceptable: (c, offered) => c.json(problem("request.not_acceptable", `This responds with ${offered.join(", ")}.`), 406),
+    invalid: (result, c) => result.success
+        ? undefined
+        : c.json(problem("request.invalid", "The request does not match the API contract."), 400),
+});
+/**
+ * The Worker's surface: the contract's routes, the event socket, the document that describes them,
+ * and the MCP endpoint agents connect to.
+ */
+export const makeApp = (runtimeOf, inboxUrl) => {
+    const app = new Hono({ router: new RegExpRouter() });
+    // Middleware before `registerRoutes`: Hono applies it only to routes registered after it.
+    app.use(async (c, next) => {
+        c.set("requestId", c.req.header("cf-ray") ?? crypto.randomUUID());
+        await next();
+    });
+    // Nothing the Worker answers is to be sniffed as another type. Everything names the code that
+    // answered, so a client can tell when Loopback has been updated under it. A WebSocket's 101 is the
+    // space's own response, and is left as it is.
+    app.use(async (c, next) => {
+        await next();
+        if (c.res.status === 101)
+            return;
+        c.res.headers.set("X-Content-Type-Options", "nosniff");
+        c.res.headers.set("Referrer-Policy", "no-referrer");
+        c.res.headers.set(REVISION_HEADER, String(REVISION));
+        const build = buildOf(c.env);
+        if (build !== undefined)
+            c.res.headers.set(BUILD_HEADER, build);
+    });
+    // A client writing a later revision of the contract than this code reads is from newer code, as a
+    // page loaded before a rollback is: it is refused before anything runs, and reloads onto this code.
+    app.use(async (c, next) => {
+        if (Number(c.req.header(REVISION_HEADER)) > REVISION) {
+            return c.json(problem(RELOAD_CODE, "This is from a newer version of Loopback than the server. Reload it."), 409);
+        }
+        await next();
+        return undefined;
+    });
+    app.onError((error, c) => answerUnhandled(error, c.get("requestId")));
+    app.notFound((c) => c.json(problem("not_found", "No such route."), 404));
+    app.get("/api/v1/openapi.json", (c) => c.json(document));
+    // Protected resource metadata for the MCP endpoint, when the gate takes credentials from an
+    // authorization server: clients find it at the well-known path or under it, by the resource's path.
+    const protectedResource = async (c) => {
+        const servers = await run(runtimeOf(c.env), c.req.raw.signal, c.get("requestId"), Gate.use((gate) => gate.authorizationServers));
+        if (servers.length === 0)
+            return c.json(problem("not_found", "No such route."), 404);
+        return c.json({
+            resource: `${new URL(c.req.url).origin}/mcp`,
+            authorization_servers: servers,
+            bearer_methods_supported: ["header"],
+            resource_name: "Loopback",
+        });
+    };
+    app.get(RESOURCE_METADATA_PATH, protectedResource);
+    app.get(`${RESOURCE_METADATA_PATH}/mcp`, protectedResource);
+    app.get("/api/v1/events", async (c) => {
+        if (c.req.header("Upgrade")?.toLowerCase() !== "websocket") {
+            return c.json(problem("events.upgrade_required", "Connect with a WebSocket."), 426);
+        }
+        const runtime = runtimeOf(c.env);
+        const ticket = ticketOf(c.req.raw);
+        if (ticket !== undefined) {
+            // A browser's one-time pass, spent against the space it names.
+            return run(runtime, c.req.raw.signal, c.get("requestId"), Effect.gen(function* () {
+                const spaces = yield* Spaces;
+                const space = spaces.byId(ticket.spaceId);
+                if (Option.isNone(space))
+                    return unauthorized("The event ticket is not valid.");
+                yield* space.value.redeemTicket(ticket.secret);
+                return yield* spaces.connect(ticket.spaceId, c.req.raw);
+            }).pipe(Effect.catchTag("TicketInvalid", () => Effect.succeed(unauthorized("The event ticket is not valid, or was already used.")))));
+        }
+        const access = await authenticate(runtime, c.req.raw, propsOf(c), c.get("requestId"));
+        if (access._tag === "Failure")
+            return access.failure;
+        return run(runtime, c.req.raw.signal, c.get("requestId"), Spaces.use((spaces) => spaces.connect(access.success, c.req.raw)));
+    });
+    const mcp = makeMcp(inboxUrl);
+    app.all("/mcp", async (c) => {
+        const runtime = runtimeOf(c.env);
+        const access = await authenticate(runtime, c.req.raw, propsOf(c), c.get("requestId"));
+        if (access._tag === "Failure")
+            return access.failure;
+        return mcp(c.req.raw, runtime, access.success, c.get("requestId"));
+    });
+    return registerRoutes(app, (c) => handlers(runtimeOf(c.env), c.req.raw, c.get("requestId")), deps(runtimeOf));
+};

package/dist/src/worker/jwt.d.ts

@@ -0,0 +1,49 @@
+import { Layer } from "effect";
+import { type JWTPayload } from "jose";
+import type { LoopbackBindings, WorkerBindings } from "./env.ts";
+import { WorkerEnv } from "./env.ts";
+import { type Access, Gate } from "./gate.ts";
+/** How a JWT gate checks a token, and how it reads the caller from the token's claims. */
+export interface JwtGateOptions {
+    /** Where the login publishes the keys it signs tokens with, as a JSON Web Key Set. */
+    readonly jwksUrl: string;
+    /** Fetches the key set in place of the global `fetch`: a service binding to the login, say. */
+    readonly fetcher?: {
+        readonly fetch: (url: string, init: RequestInit) => Promise<Response>;
+    };
+    /** The `iss` every token must carry; MCP clients are sent here to sign in. */
+    readonly issuer: string;
+    /** The audiences a token may be for; it must carry at least one of them in `aud`. */
+    readonly audience: ReadonlyArray<string>;
+    /** The claim that names the space a token opens. A token without it opens nothing. */
+    readonly spaceClaim: string;
+    /** The claim that holds the caller's display name. `name` unless said otherwise. */
+    readonly nameClaim?: string;
+    /**
+     * Asked once a token has verified, with its claims and the caller they name: whether that caller
+     * may still come in. A login whose tokens outlive a membership or a grant answers here, returning
+     * the reason to refuse, which the caller is told, or nothing to let them in. A check that throws
+     * fails the request as a defect, like a key set out of reach.
+     */
+    readonly check?: (claims: JWTPayload, access: Access) => Promise<string | undefined>;
+}
+/**
+ * A gate for a deployment that serves a space per tenant behind any login that issues JWTs: a token
+ * signed by one of the login's keys, from its issuer, for one of the audiences, opens the space its
+ * claim names, as the person its `sub` names. Keys are fetched from the key set and cached by the
+ * isolate. A key set out of reach is not the caller's fault, so it fails the request as a defect
+ * rather than refusing it.
+ */
+export declare const makeJwtGate: (options: JwtGateOptions) => Gate["Service"];
+/**
+ * A JWT gate configured in code, from the Worker's environment: how a host composing Loopback uses
+ * it. `options` may take the host's own environment type, such as the one `wrangler types` writes.
+ */
+export declare const jwtGate: <Env extends LoopbackBindings = WorkerBindings>(options: (env: Env) => JwtGateOptions) => Layer.Layer<Gate, never, WorkerEnv>;
+/**
+ * The gate a deployment's settings choose: the token gate when `LOOPBACK_TOKEN` is set, the JWT gate
+ * when `LOOPBACK_JWKS_URL` is. Exactly one of them: both, or neither, is a deployment that cannot say
+ * who anyone is, answered as a 500 that says so. Settings are read on first use, so a deployment whose
+ * invoker vouches for every caller needs neither.
+ */
+export declare const ConfiguredGate: Layer.Layer<Gate, never, never>;

package/dist/src/worker/jwt.js

@@ -0,0 +1,142 @@
+import { Config, Effect, Layer, Option } from "effect";
+import { createRemoteJWKSet, customFetch, errors, jwtVerify } from "jose";
+import { z } from "zod";
+import { Unauthorized } from "../domain/errors.js";
+import { WorkerEnv } from "./env.js";
+import { credentialOf, Gate, makeTokenGate, NotConfigured } from "./gate.js";
+/** The caller a token's claims name, read from the configured claims. */
+const caller = z.object({
+    sub: z.string().min(1),
+    space: z.string().min(1),
+});
+/** The caller's display name, when the token carries a usable one; it never decides access. */
+const nameOf = (claim) => typeof claim === "string" && claim.trim() !== "" ? claim : undefined;
+/** The signature algorithms a token may use. `none` and the HMAC family are never among them. */
+const ALGORITHMS = ["EdDSA", "ES256", "RS256"];
+/** Failures that say the token is wrong, as opposed to the login's keys being out of reach. */
+const refusals = [
+    errors.JWTClaimValidationFailed,
+    errors.JWTInvalid,
+    errors.JWSInvalid,
+    errors.JWSSignatureVerificationFailed,
+    errors.JOSEAlgNotAllowed,
+    errors.JOSENotSupported,
+    errors.JWKSNoMatchingKey,
+    errors.JWKSMultipleMatchingKeys,
+];
+/**
+ * A gate for a deployment that serves a space per tenant behind any login that issues JWTs: a token
+ * signed by one of the login's keys, from its issuer, for one of the audiences, opens the space its
+ * claim names, as the person its `sub` names. Keys are fetched from the key set and cached by the
+ * isolate. A key set out of reach is not the caller's fault, so it fails the request as a defect
+ * rather than refusing it.
+ */
+export const makeJwtGate = (options) => {
+    const keys = createRemoteJWKSet(new URL(options.jwksUrl), options.fetcher === undefined
+        ? {}
+        : { [customFetch]: (url, init) => options.fetcher.fetch(url, init) });
+    const nameClaim = options.nameClaim ?? "name";
+    return Gate.of({
+        authenticate: Effect.fnUntraced(function* (request) {
+            const presented = credentialOf(request);
+            if (presented === undefined) {
+                return yield* new Unauthorized({ reason: "A bearer token is required." });
+            }
+            const verified = yield* Effect.tryPromise({
+                try: () => jwtVerify(presented, keys, {
+                    issuer: options.issuer,
+                    audience: [...options.audience],
+                    algorithms: ALGORITHMS,
+                }),
+                catch: (error) => error,
+            }).pipe(Effect.catch((error) => {
+                if (error instanceof errors.JWTExpired) {
+                    return Effect.fail(new Unauthorized({ reason: "The token has expired." }));
+                }
+                if (refusals.some((refusal) => error instanceof refusal)) {
+                    return Effect.fail(new Unauthorized({ reason: "The token is not valid." }));
+                }
+                return Effect.die(error);
+            }));
+            const parsed = caller.safeParse({
+                sub: verified.payload.sub,
+                space: verified.payload[options.spaceClaim],
+            });
+            if (!parsed.success) {
+                return yield* new Unauthorized({
+                    reason: `The token must name a person in \`sub\` and a space in \`${options.spaceClaim}\`.`,
+                });
+            }
+            const { sub, space } = parsed.data;
+            const name = nameOf(verified.payload[nameClaim]);
+            const access = { space, actor: name === undefined ? { id: sub } : { id: sub, name } };
+            if (options.check !== undefined) {
+                const check = options.check;
+                const refusal = yield* Effect.promise(() => check(verified.payload, access));
+                if (refusal !== undefined)
+                    return yield* new Unauthorized({ reason: refusal });
+            }
+            return access;
+        }),
+        authorizationServers: Effect.succeed([options.issuer]),
+    });
+};
+/**
+ * A JWT gate configured in code, from the Worker's environment: how a host composing Loopback uses
+ * it. `options` may take the host's own environment type, such as the one `wrangler types` writes.
+ */
+// The parameter is what lets `options` take the host's own environment type: a function of that
+// type does not accept every LoopbackBindings, so it could not be passed as one.
+// oxlint-disable-next-line typescript/no-unnecessary-type-parameters
+export const jwtGate = (options) => Layer.effect(Gate, WorkerEnv.use((env) => Effect.sync(() => makeJwtGate(options(env)))));
+/** The settings a JWT-gated deployment reads, and the token gate's secret. */
+const SETTINGS = {
+    token: "LOOPBACK_TOKEN",
+    jwksUrl: "LOOPBACK_JWKS_URL",
+    issuer: "LOOPBACK_JWT_ISSUER",
+    audience: "LOOPBACK_JWT_AUDIENCE",
+    spaceClaim: "LOOPBACK_SPACE_CLAIM",
+    nameClaim: "LOOPBACK_NAME_CLAIM",
+};
+const setting = (name) => Config.option(Config.NonEmptyString(name)).pipe(Effect.catch(() => Effect.succeed(Option.none())));
+const required = (name) => setting(name).pipe(Effect.flatMap(Option.match({
+    onNone: () => Effect.die(new NotConfigured(`${name} is not set; a JWT-gated deployment needs it.`)),
+    onSome: Effect.succeed,
+})));
+/** The JWT gate's options, from the deployment's settings. */
+const configuredJwtOptions = Effect.gen(function* () {
+    const nameClaim = yield* setting(SETTINGS.nameClaim);
+    const options = {
+        jwksUrl: yield* required(SETTINGS.jwksUrl),
+        issuer: yield* required(SETTINGS.issuer),
+        audience: (yield* required(SETTINGS.audience))
+            .split(",")
+            .map((audience) => audience.trim())
+            .filter((audience) => audience.length > 0),
+        spaceClaim: yield* required(SETTINGS.spaceClaim),
+        ...(Option.isSome(nameClaim) ? { nameClaim: nameClaim.value } : {}),
+    };
+    return options;
+});
+/**
+ * The gate a deployment's settings choose: the token gate when `LOOPBACK_TOKEN` is set, the JWT gate
+ * when `LOOPBACK_JWKS_URL` is. Exactly one of them: both, or neither, is a deployment that cannot say
+ * who anyone is, answered as a 500 that says so. Settings are read on first use, so a deployment whose
+ * invoker vouches for every caller needs neither.
+ */
+export const ConfiguredGate = Layer.effect(Gate, Effect.gen(function* () {
+    const chosen = yield* Effect.cached(Effect.gen(function* () {
+        const token = yield* setting(SETTINGS.token);
+        const jwks = yield* setting(SETTINGS.jwksUrl);
+        if (Option.isSome(token) && Option.isSome(jwks)) {
+            return yield* Effect.die(new NotConfigured(`Both ${SETTINGS.token} and ${SETTINGS.jwksUrl} are set. Set one: the token for a single space, or the JWT settings for a space per tenant.`));
+        }
+        if (Option.isSome(jwks))
+            return makeJwtGate(yield* configuredJwtOptions);
+        return yield* makeTokenGate;
+    }));
+    return Gate.of({
+        authenticate: (request) => Effect.flatMap(chosen, (gate) => gate.authenticate(request)),
+        authorizationServers: Effect.flatMap(chosen, (gate) => gate.authorizationServers),
+    });
+}));

package/dist/src/worker/mcp.d.ts

@@ -0,0 +1,15 @@
+import type { Access } from "./gate.ts";
+import { type WorkerRuntime } from "./run.ts";
+/** Where an inbox, or one ask in it, is read and answered. */
+export interface InboxLink {
+    readonly origin: string;
+    readonly space: string;
+    readonly askId?: string;
+}
+/** The inbox this Worker serves itself, as `@loopbacktools/app` routes it: the space's, or one ask in it. */
+export declare const defaultInboxUrl: ({ origin, space, askId }: InboxLink) => string;
+/**
+ * The MCP endpoint. The gate runs first; what it established reaches the per-request server
+ * through the `authInfo` the SDK passes along untouched.
+ */
+export declare const makeMcp: (inboxUrl: (link: InboxLink) => string) => (request: Request, runtime: WorkerRuntime, access: Access, requestId: string) => Promise<Response>;