@n24q02m/hull 0.0.0-stage → 0.4.0-beta.9

package/build/storage/session-lock.js

@@ -0,0 +1,105 @@
+/**
+ * File-based session lock to prevent duplicate relay sessions.
+ *
+ * When multiple MCP server processes start simultaneously (common in Claude Code),
+ * this lock prevents each from creating a separate relay session (rate limit:
+ * max 10 sessions/IP/10min).
+ *
+ * Lock file location: <config_dir>/mcp/relay-session-<server>.lock
+ */
+import { existsSync } from 'node:fs';
+import { chmod, mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import envPaths from 'env-paths';
+const paths = envPaths('mcp', { suffix: '' });
+const DEFAULT_LOCK_DIR = paths.config;
+const DEFAULT_MAX_AGE_MS = 600_000;
+// Allow overriding lock directory for testing
+let lockDirOverride = null;
+// Directory init (mkdir+chmod) runs exactly once per lock-dir lifetime so an
+// existing overly-permissive directory is tightened (TOCTOU hardening); the
+// flag resets whenever the lock dir changes.
+let dirInitDone = false;
+export function setLockDir(path) {
+    lockDirOverride = path;
+    dirInitDone = false;
+}
+function getLockDir() {
+    return lockDirOverride ?? DEFAULT_LOCK_DIR;
+}
+function lockPath(serverName) {
+    return join(getLockDir(), `relay-session-${serverName}.lock`);
+}
+export async function acquireSessionLock(serverName, maxAgeMs = DEFAULT_MAX_AGE_MS) {
+    const path = lockPath(serverName);
+    try {
+        if (!existsSync(path)) {
+            return null;
+        }
+        const raw = await readFile(path, 'utf-8');
+        const data = JSON.parse(raw);
+        // Validate required fields
+        if (typeof data.session_id !== 'string' ||
+            typeof data.relay_url !== 'string' ||
+            typeof data.created_at !== 'number') {
+            await releaseSessionLock(serverName);
+            return null;
+        }
+        const info = {
+            sessionId: data.session_id,
+            relayUrl: data.relay_url,
+            createdAt: data.created_at
+        };
+        const age = Date.now() - info.createdAt;
+        if (age > maxAgeMs) {
+            // Expired lock: clean up and return null
+            await releaseSessionLock(serverName);
+            return null;
+        }
+        return info;
+    }
+    catch {
+        // Corrupt or unreadable lock file: clean up and return null
+        try {
+            await releaseSessionLock(serverName);
+        }
+        catch {
+            /* ignore cleanup errors */
+        }
+        return null;
+    }
+}
+export async function writeSessionLock(serverName, info) {
+    const path = lockPath(serverName);
+    const dir = dirname(path);
+    if (!existsSync(dir)) {
+        await mkdir(dir, { recursive: true, mode: 0o700 });
+    }
+    if (!dirInitDone) {
+        if (process.platform !== 'win32') {
+            await chmod(dir, 0o700);
+        }
+        dirInitDone = true;
+    }
+    const data = {
+        session_id: info.sessionId,
+        relay_url: info.relayUrl,
+        created_at: info.createdAt
+    };
+    // Write atomically via temp file + rename
+    const tmpPath = `${path}.tmp`;
+    await writeFile(tmpPath, JSON.stringify(data), { encoding: 'utf-8', mode: 0o600 });
+    await rename(tmpPath, path);
+}
+export async function releaseSessionLock(serverName) {
+    const path = lockPath(serverName);
+    try {
+        if (existsSync(path)) {
+            await unlink(path);
+        }
+    }
+    catch {
+        /* ignore errors during cleanup */
+    }
+}
+//# sourceMappingURL=session-lock.js.map

package/build/storage/session-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-lock.js","sourceRoot":"","sources":["../../src/storage/session-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,QAAQ,MAAM,WAAW,CAAA;AAEhC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;AAC7C,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAA;AAErC,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAElC,8CAA8C;AAC9C,IAAI,eAAe,GAAkB,IAAI,CAAA;AACzC,6EAA6E;AAC7E,4EAA4E;AAC5E,6CAA6C;AAC7C,IAAI,WAAW,GAAG,KAAK,CAAA;AAEvB,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC5C,eAAe,GAAG,IAAI,CAAA;IACtB,WAAW,GAAG,KAAK,CAAA;AACrB,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,eAAe,IAAI,gBAAgB,CAAA;AAC5C,CAAC;AAED,SAAS,QAAQ,CAAC,UAAkB;IAClC,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,iBAAiB,UAAU,OAAO,CAAC,CAAA;AAC/D,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkB,EAClB,QAAQ,GAAG,kBAAkB;IAE7B,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;IACjC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAA;QAE/C,2BAA2B;QAC3B,IACE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;YACnC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;YAClC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EACnC,CAAC;YACD,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;YACpC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,IAAI,GAAgB;YACxB,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAA;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAA;QACvC,IAAI,GAAG,GAAG,QAAQ,EAAE,CAAC;YACnB,yCAAyC;YACzC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;YACpC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,IAAiB;IAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACzB,CAAC;QACD,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;IAED,MAAM,IAAI,GAAoB;QAC5B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,UAAU,EAAE,IAAI,CAAC,SAAS;KAC3B,CAAA;IAED,0CAA0C;IAC1C,MAAM,OAAO,GAAG,GAAG,IAAI,MAAM,CAAA;IAC7B,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAClF,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;IACjC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;AACH,CAAC"}

package/build/token-auth/authenticator.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Token authentication: one mechanism, three modes. TS counterpart of
+ * core-py `hull_core.auth.middleware.Authenticator`.
+ *
+ * - `no-auth`: loopback-only; one shared namespace; no Authorization header.
+ * - `token`:   one shared token; still one shared namespace.
+ * - `multi`:   users.toml; token -> user -> namespace; 401 wrong token,
+ *              403 disabled user, 429 over limit.
+ */
+import type { AuthContext, HttpAuthMode } from './context.js';
+import { SlidingWindowLimiter } from './limiter.js';
+import { type TokenUser } from './users.js';
+export type { HttpAuthMode } from './context.js';
+/** Mode names in core-py `AUTH_MODES` order. */
+export declare const HTTP_AUTH_MODES: readonly HttpAuthMode[];
+/** HTTP auth configuration for `runHttpServer({ auth })`. */
+export type HttpAuthConfig = {
+    readonly mode: 'no-auth';
+} | {
+    readonly mode: 'token';
+    /** `scrypt$...` hash of the shared token (mint with `token hash`). */
+    readonly tokenHash: string;
+    /** Optional shared per-minute cap; `null`/absent means unlimited. */
+    readonly rpm?: number | null;
+} | {
+    readonly mode: 'multi';
+    /** users.toml path; `~` is expanded. Defaults to `~/.hull/users.toml`. */
+    readonly usersFile?: string;
+    /** Pre-loaded table (e.g. from `loadUsers`); takes precedence over `usersFile`. */
+    readonly users?: ReadonlyMap<string, TokenUser>;
+};
+/** Result of authenticating one request. `status === null` means proceed. */
+export interface AuthOutcome {
+    readonly context: AuthContext | null;
+    readonly status: number | null;
+    readonly detail: string;
+    readonly ok: boolean;
+}
+/** Raised when an `HttpAuthConfig` is unusable (detected before the server binds). */
+export declare class AuthConfigError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Default users.toml location, same as core-py: `~/.hull/users.toml`. */
+export declare function defaultUsersFile(): string;
+/**
+ * Extract the bearer token the way core-py does: split on the first space,
+ * case-insensitive `bearer` scheme, Python-`strip()`ed non-empty value.
+ */
+export declare function parseBearer(authz: string | null | undefined): string | null;
+/** Resolves bearer tokens to `AuthContext`s according to the configured mode. */
+export declare class Authenticator {
+    readonly mode: HttpAuthMode;
+    readonly limiter: SlidingWindowLimiter;
+    private readonly config;
+    /**
+     * Validates the whole config up front (unknown mode, empty or malformed
+     * token hash, bad rpm, unreadable users.toml) so a broken deployment
+     * fails at boot rather than answering 500 per request.
+     */
+    constructor(config: HttpAuthConfig, options?: {
+        limiter?: SlidingWindowLimiter;
+    });
+    /** Number of rows in the users table (`multi` mode), else 0. */
+    get userCount(): number;
+    authenticate(authz: string | null | undefined): Promise<AuthOutcome>;
+    private admit;
+}
+//# sourceMappingURL=authenticator.d.ts.map

package/build/token-auth/authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../src/token-auth/authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAGnD,OAAO,EAA8B,KAAK,SAAS,EAAE,MAAM,YAAY,CAAA;AAEvE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD,gDAAgD;AAChD,eAAO,MAAM,eAAe,EAAE,SAAS,YAAY,EAAiD,CAAA;AAEpG,6DAA6D;AAC7D,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;CAChD,CAAA;AAEL,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;CACrB;AAED,sFAAsF;AACtF,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAGzD;CACF;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAQD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAO3E;AAgDD,iFAAiF;AACjF,qBAAa,aAAa;IACxB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IAEvC;;;;OAIG;IACH,YAAY,MAAM,EAAE,cAAc,EAAE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,oBAAoB,CAAA;KAAO,EAInF;IAED,gEAAgE;IAChE,IAAI,SAAS,IAAI,MAAM,CAEtB;IAEK,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAgCzE;IAED,OAAO,CAAC,KAAK;CAId"}

package/build/token-auth/authenticator.js

@@ -0,0 +1,146 @@
+/**
+ * Token authentication: one mechanism, three modes. TS counterpart of
+ * core-py `hull_core.auth.middleware.Authenticator`.
+ *
+ * - `no-auth`: loopback-only; one shared namespace; no Authorization header.
+ * - `token`:   one shared token; still one shared namespace.
+ * - `multi`:   users.toml; token -> user -> namespace; 401 wrong token,
+ *              403 disabled user, 429 over limit.
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { localAuthContext } from './context.js';
+import { SlidingWindowLimiter } from './limiter.js';
+import { pyRepr, pyStrip } from './py-compat.js';
+import { isValidTokenHash, verifyToken } from './tokens.js';
+import { findUserByToken, loadUsers } from './users.js';
+/** Mode names in core-py `AUTH_MODES` order. */
+export const HTTP_AUTH_MODES = Object.freeze(['no-auth', 'token', 'multi']);
+/** Raised when an `HttpAuthConfig` is unusable (detected before the server binds). */
+export class AuthConfigError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'AuthConfigError';
+    }
+}
+/** Default users.toml location, same as core-py: `~/.hull/users.toml`. */
+export function defaultUsersFile() {
+    return join(homedir(), '.hull', 'users.toml');
+}
+function expandUser(path) {
+    if (path === '~')
+        return homedir();
+    if (path.startsWith('~/') || path.startsWith('~\\'))
+        return join(homedir(), path.slice(2));
+    return path;
+}
+/**
+ * Extract the bearer token the way core-py does: split on the first space,
+ * case-insensitive `bearer` scheme, Python-`strip()`ed non-empty value.
+ */
+export function parseBearer(authz) {
+    if (!authz)
+        return null;
+    const space = authz.indexOf(' ');
+    const scheme = space === -1 ? authz : authz.slice(0, space);
+    const value = space === -1 ? '' : pyStrip(authz.slice(space + 1));
+    if (scheme.toLowerCase() !== 'bearer' || value.length === 0)
+        return null;
+    return value;
+}
+function outcome(context, status, detail = '') {
+    return Object.freeze({ context, status, detail, ok: status === null && context !== null });
+}
+function validRpm(rpm) {
+    return rpm === undefined || rpm === null || (Number.isSafeInteger(rpm) && rpm >= 1);
+}
+function resolveConfig(config) {
+    const mode = config.mode;
+    if (mode === 'no-auth')
+        return { mode };
+    if (mode === 'token') {
+        const { tokenHash, rpm } = config;
+        if (typeof tokenHash !== 'string' || tokenHash.length === 0) {
+            throw new AuthConfigError('[server] auth = "token" requires a non-empty token_hash');
+        }
+        if (!isValidTokenHash(tokenHash)) {
+            throw new AuthConfigError('[server] token_hash is not a scrypt encoding (mint one with `hull token hash`)');
+        }
+        if (!validRpm(rpm))
+            throw new AuthConfigError('[server] rpm must be a positive integer');
+        return { mode, tokenHash, rpm: rpm ?? null };
+    }
+    if (mode === 'multi') {
+        const { users, usersFile } = config;
+        if (users !== undefined) {
+            for (const [uid, user] of users) {
+                if (!isValidTokenHash(user.tokenHash)) {
+                    throw new AuthConfigError(`user ${pyRepr(uid)}: token_hash missing or not a scrypt encoding (mint one with \`hull token hash\`)`);
+                }
+            }
+            return { mode, users };
+        }
+        const path = usersFile ? expandUser(usersFile) : defaultUsersFile();
+        return { mode, users: loadUsers(path) };
+    }
+    const shown = typeof mode === 'string' ? pyRepr(mode) : String(mode);
+    throw new AuthConfigError(`[server] auth must be one of ('no-auth', 'token', 'multi'), got ${shown}`);
+}
+/** Resolves bearer tokens to `AuthContext`s according to the configured mode. */
+export class Authenticator {
+    /**
+     * Validates the whole config up front (unknown mode, empty or malformed
+     * token hash, bad rpm, unreadable users.toml) so a broken deployment
+     * fails at boot rather than answering 500 per request.
+     */
+    constructor(config, options = {}) {
+        this.config = resolveConfig(config);
+        this.mode = this.config.mode;
+        this.limiter = options.limiter ?? new SlidingWindowLimiter();
+    }
+    /** Number of rows in the users table (`multi` mode), else 0. */
+    get userCount() {
+        return this.config.mode === 'multi' ? this.config.users.size : 0;
+    }
+    async authenticate(authz) {
+        const config = this.config;
+        if (config.mode === 'no-auth')
+            return outcome(localAuthContext(), null);
+        const token = parseBearer(authz);
+        if (token === null)
+            return outcome(null, 401, 'missing or malformed Authorization header');
+        if (config.mode === 'token') {
+            if (!(await verifyToken(token, config.tokenHash)))
+                return outcome(null, 401, 'invalid token');
+            return this.admit({
+                uid: 'shared',
+                namespace: 'default',
+                mode: 'token',
+                allowedRoots: Object.freeze([]),
+                rpm: config.rpm,
+                disabled: false,
+                attributes: Object.freeze({})
+            });
+        }
+        const user = await findUserByToken(config.users, token);
+        if (user === null)
+            return outcome(null, 401, 'invalid token');
+        if (!user.enabled)
+            return outcome(null, 403, `user ${pyRepr(user.uid)} is disabled`);
+        return this.admit({
+            uid: user.uid,
+            namespace: user.namespace,
+            mode: 'multi',
+            allowedRoots: user.allowedRoots,
+            rpm: user.limits.rpm,
+            disabled: false,
+            attributes: Object.freeze({})
+        });
+    }
+    admit(ctx) {
+        if (!this.limiter.check(ctx.uid, ctx.rpm))
+            return outcome(null, 429, 'rate limit exceeded');
+        return outcome(Object.freeze(ctx), null);
+    }
+}
+//# sourceMappingURL=authenticator.js.map

package/build/token-auth/authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.js","sourceRoot":"","sources":["../../src/token-auth/authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAGhC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAkB,MAAM,YAAY,CAAA;AAIvE,gDAAgD;AAChD,MAAM,CAAC,MAAM,eAAe,GAA4B,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;AA4BpG,sFAAsF;AACtF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;AAC/C,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAA;IAClC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1F,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,MAAM,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC3D,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;IACjE,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACxE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,OAAO,CAAC,OAA2B,EAAE,MAAqB,EAAE,MAAM,GAAG,EAAE;IAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC,CAAA;AAC5F,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAK,GAAc,IAAI,CAAC,CAAC,CAAA;AACjG,CAAC;AAOD,SAAS,aAAa,CAAC,MAAsB;IAC3C,MAAM,IAAI,GAAI,MAA6B,CAAC,IAAI,CAAA;IAChD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACvC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAoD,CAAA;QAC/E,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,eAAe,CAAC,yDAAyD,CAAC,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,eAAe,CAAC,gFAAgF,CAAC,CAAA;QAC7G,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,yCAAyC,CAAC,CAAA;QACxF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAA;IAC9C,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAoD,CAAA;QACjF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;gBAChC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBACtC,MAAM,IAAI,eAAe,CACvB,QAAQ,MAAM,CAAC,GAAG,CAAC,mFAAmF,CACvG,CAAA;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QACxB,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAA;QACnE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAA;IACzC,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACpE,MAAM,IAAI,eAAe,CAAC,mEAAmE,KAAK,EAAE,CAAC,CAAA;AACvG,CAAC;AAED,iFAAiF;AACjF,MAAM,OAAO,aAAa;IAKxB;;;;OAIG;IACH,YAAY,MAAsB,EAAE,OAAO,GAAuC,EAAE;QAClF,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,oBAAoB,EAAE,CAAA;IAC9D,CAAC;IAED,gEAAgE;IAChE,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAgC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,gBAAgB,EAAE,EAAE,IAAI,CAAC,CAAA;QAEvE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,2CAA2C,CAAC,CAAA;QAE1F,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;gBAAE,OAAO,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,eAAe,CAAC,CAAA;YAC7F,OAAO,IAAI,CAAC,KAAK,CAAC;gBAChB,GAAG,EAAE,QAAQ;gBACb,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,OAAO;gBACb,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;aAC9B,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACvD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,eAAe,CAAC,CAAA;QAC7D,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QACpF,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,OAAO;YACb,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;YACpB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,GAAgB;QAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAA;QAC3F,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;IAC1C,CAAC;CACF"}

package/build/token-auth/cli.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `token hash` CLI subcommand: mint a `scrypt$...` hash for `token` mode
+ * (`tokenHash`) or a users.toml row (`token_hash`).
+ *
+ * Unlike core-py `hull token hash <token>`, the plaintext is never taken
+ * from argv (it would land in shell history and the process table). It is
+ * read from piped stdin, or from a hidden, confirmed TTY prompt. Only the
+ * hash is printed to stdout; prompts and errors go to stderr.
+ */
+/** Same shape as `CliHandler` in `cli/build-cli.ts` (kept local to avoid a dependency). */
+export type TokenCliHandler = (argv: string[]) => number | Promise<number>;
+export interface TokenCliInput {
+    isTTY?: boolean;
+    setRawMode?(mode: boolean): unknown;
+    setEncoding?(encoding: BufferEncoding): unknown;
+    on(event: 'data', listener: (chunk: string | Buffer) => void): unknown;
+    on(event: 'end' | 'close', listener: () => void): unknown;
+    on(event: 'error', listener: (err: Error) => void): unknown;
+    removeListener(event: 'data', listener: (chunk: string | Buffer) => void): unknown;
+    removeListener(event: 'end' | 'close', listener: () => void): unknown;
+    removeListener(event: 'error', listener: (err: Error) => void): unknown;
+    resume?(): unknown;
+    pause?(): unknown;
+}
+export interface TokenCliOutput {
+    write(chunk: string): unknown;
+}
+export interface TokenCliIO {
+    stdin?: TokenCliInput;
+    stdout?: TokenCliOutput;
+    stderr?: TokenCliOutput;
+}
+/**
+ * Build the `token` subcommand handler (`token hash`). Built into
+ * `buildCli` under the name `token`; `io` is injectable for tests.
+ */
+export declare function tokenCliHandler(io?: TokenCliIO): TokenCliHandler;
+//# sourceMappingURL=cli.d.ts.map

package/build/token-auth/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/token-auth/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,2FAA2F;AAC3F,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;AAE1E,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,UAAU,CAAC,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAA;IACnC,WAAW,CAAC,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAA;IAC/C,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,KAAK,IAAI,GAAG,OAAO,CAAA;IACtE,EAAE,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;IACzD,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAA;IAC3D,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,KAAK,IAAI,GAAG,OAAO,CAAA;IAClF,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;IACrE,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAA;IACvE,MAAM,CAAC,IAAI,OAAO,CAAA;IAClB,KAAK,CAAC,IAAI,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,aAAa,CAAA;IACrB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAkJD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAAE,GAAE,UAAe,GAAG,eAAe,CAyBpE"}

package/build/token-auth/cli.js

@@ -0,0 +1,192 @@
+/**
+ * `token hash` CLI subcommand: mint a `scrypt$...` hash for `token` mode
+ * (`tokenHash`) or a users.toml row (`token_hash`).
+ *
+ * Unlike core-py `hull token hash <token>`, the plaintext is never taken
+ * from argv (it would land in shell history and the process table). It is
+ * read from piped stdin, or from a hidden, confirmed TTY prompt. Only the
+ * hash is printed to stdout; prompts and errors go to stderr.
+ */
+import { pyStrip } from './py-compat.js';
+import { hashToken } from './tokens.js';
+const USAGE = 'usage: token hash  (reads the token from stdin or a hidden prompt; never from argv)';
+class InputAborted extends Error {
+}
+function readAll(stdin) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        const onData = (chunk) => {
+            chunks.push(typeof chunk === 'string' ? Buffer.from(chunk, 'utf8') : chunk);
+        };
+        const cleanup = () => {
+            stdin.removeListener('data', onData);
+            stdin.removeListener('end', onEnd);
+            stdin.removeListener('error', onError);
+        };
+        const onEnd = () => {
+            cleanup();
+            try {
+                resolve(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+            }
+            catch (err) {
+                reject(err);
+            }
+        };
+        const onError = (err) => {
+            cleanup();
+            reject(err);
+        };
+        stdin.on('data', onData);
+        stdin.on('end', onEnd);
+        stdin.on('error', onError);
+        stdin.resume?.();
+    });
+}
+/** Reads hidden lines from a raw-mode TTY; keeps type-ahead between prompts. */
+class HiddenReader {
+    constructor(stdin, stderr) {
+        this.stdin = stdin;
+        this.stderr = stderr;
+        this.pending = [];
+    }
+    async read(prompt) {
+        this.stderr.write(prompt);
+        const typed = [];
+        const consume = (chars) => {
+            while (chars.length > 0) {
+                const ch = chars.shift();
+                if (ch === '\r' || ch === '\n') {
+                    this.pending = chars;
+                    return 'done';
+                }
+                if (ch === '\u0003')
+                    throw new InputAborted('interrupted');
+                if (ch === '\u0004') {
+                    if (typed.length === 0)
+                        throw new InputAborted('end of input');
+                    this.pending = chars;
+                    return 'done';
+                }
+                if (ch === '\u007f' || ch === '\b')
+                    typed.pop();
+                else
+                    typed.push(ch);
+            }
+            return 'more';
+        };
+        try {
+            if (consume(this.pending) === 'done')
+                return typed.join('');
+            return await new Promise((resolve, reject) => {
+                const cleanup = () => {
+                    this.stdin.removeListener('data', onData);
+                    this.stdin.removeListener('end', onEnd);
+                    this.stdin.removeListener('error', onError);
+                };
+                const onData = (chunk) => {
+                    try {
+                        if (consume(Array.from(chunk.toString())) === 'done') {
+                            cleanup();
+                            resolve(typed.join(''));
+                        }
+                    }
+                    catch (err) {
+                        cleanup();
+                        reject(err);
+                    }
+                };
+                const onEnd = () => {
+                    cleanup();
+                    reject(new InputAborted('end of input'));
+                };
+                const onError = (err) => {
+                    cleanup();
+                    reject(err);
+                };
+                this.stdin.on('data', onData);
+                this.stdin.on('end', onEnd);
+                this.stdin.on('error', onError);
+                this.stdin.resume?.();
+            });
+        }
+        finally {
+            this.stderr.write('\n');
+        }
+    }
+}
+async function promptToken(stdin, stderr) {
+    stdin.setEncoding?.('utf8');
+    stdin.setRawMode?.(true);
+    try {
+        const reader = new HiddenReader(stdin, stderr);
+        const first = await reader.read('Token: ');
+        const second = await reader.read('Repeat token: ');
+        if (first !== second) {
+            stderr.write('token hash: tokens do not match\n');
+            return null;
+        }
+        return first;
+    }
+    finally {
+        stdin.setRawMode?.(false);
+        stdin.pause?.();
+    }
+}
+function fromPipe(text, stderr) {
+    let token = text;
+    if (token.endsWith('\r\n'))
+        token = token.slice(0, -2);
+    else if (token.endsWith('\n'))
+        token = token.slice(0, -1);
+    if (/[\r\n]/.test(token)) {
+        stderr.write('token hash: expected a single line on stdin\n');
+        return null;
+    }
+    return token;
+}
+function checkToken(token, stderr) {
+    if (token.length === 0) {
+        stderr.write('token hash: empty token\n');
+        return false;
+    }
+    // The guard strips the bearer value, so a padded token could never match.
+    if (pyStrip(token) !== token) {
+        stderr.write('token hash: token must not start or end with whitespace\n');
+        return false;
+    }
+    return true;
+}
+/**
+ * Build the `token` subcommand handler (`token hash`). Built into
+ * `buildCli` under the name `token`; `io` is injectable for tests.
+ */
+export function tokenCliHandler(io = {}) {
+    return async (argv) => {
+        const stdin = io.stdin ?? process.stdin;
+        const stdout = io.stdout ?? process.stdout;
+        const stderr = io.stderr ?? process.stderr;
+        if (argv[0] !== 'hash' || argv.length > 1) {
+            if (argv[0] === 'hash')
+                stderr.write('token hash: refusing a token on argv (it would be logged)\n');
+            stderr.write(`${USAGE}\n`);
+            return 2;
+        }
+        let token;
+        try {
+            token = stdin.isTTY ? await promptToken(stdin, stderr) : fromPipe(await readAll(stdin), stderr);
+        }
+        catch (err) {
+            if (err instanceof InputAborted) {
+                stderr.write(`token hash: aborted (${err.message})\n`);
+                return 130;
+            }
+            stderr.write(`token hash: could not read token: ${err.message}\n`);
+            return 1;
+        }
+        if (token === null || !checkToken(token, stderr))
+            return 1;
+        stdout.write(`${await hashToken(token)}\n`);
+        return 0;
+    };
+}
+//# sourceMappingURL=cli.js.map

package/build/token-auth/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/token-auth/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA6BvC,MAAM,KAAK,GAAG,qFAAqF,CAAA;AAEnG,MAAM,YAAa,SAAQ,KAAK;CAAG;AAEnC,SAAS,OAAO,CAAC,KAAoB;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAQ,EAAE;YAC9C,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAC7E,CAAC,CAAA;QACD,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACpC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YAClC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACxC,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,OAAO,EAAE,CAAA;YACT,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YAClF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,CAAA;YACb,CAAC;QACH,CAAC,CAAA;QACD,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE;YACnC,OAAO,EAAE,CAAA;YACT,MAAM,CAAC,GAAG,CAAC,CAAA;QACb,CAAC,CAAA;QACD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACxB,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACtB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC1B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAA;IAClB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,YAAY;IAGhB,YACmB,KAAoB,EACpB,MAAsB;QADtB,UAAK,GAAL,KAAK,CAAe;QACpB,WAAM,GAAN,MAAM,CAAgB;QAJjC,YAAO,GAAa,EAAE,CAAA;IAK3B,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACzB,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,MAAM,OAAO,GAAG,CAAC,KAAe,EAAmB,EAAE;YACnD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,EAAY,CAAA;gBAClC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;oBAC/B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;oBACpB,OAAO,MAAM,CAAA;gBACf,CAAC;gBACD,IAAI,EAAE,KAAK,QAAQ;oBAAE,MAAM,IAAI,YAAY,CAAC,aAAa,CAAC,CAAA;gBAC1D,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;wBAAE,MAAM,IAAI,YAAY,CAAC,cAAc,CAAC,CAAA;oBAC9D,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;oBACpB,OAAO,MAAM,CAAA;gBACf,CAAC;gBACD,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI;oBAAE,KAAK,CAAC,GAAG,EAAE,CAAA;;oBAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACrB,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CAAA;QACD,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC3D,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACnD,MAAM,OAAO,GAAG,GAAS,EAAE;oBACzB,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;oBACzC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;oBACvC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBAC7C,CAAC,CAAA;gBACD,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAQ,EAAE;oBAC9C,IAAI,CAAC;wBACH,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;4BACrD,OAAO,EAAE,CAAA;4BACT,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;wBACzB,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,EAAE,CAAA;wBACT,MAAM,CAAC,GAAG,CAAC,CAAA;oBACb,CAAC;gBACH,CAAC,CAAA;gBACD,MAAM,KAAK,GAAG,GAAS,EAAE;oBACvB,OAAO,EAAE,CAAA;oBACT,MAAM,CAAC,IAAI,YAAY,CAAC,cAAc,CAAC,CAAC,CAAA;gBAC1C,CAAC,CAAA;gBACD,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE;oBACnC,OAAO,EAAE,CAAA;oBACT,MAAM,CAAC,GAAG,CAAC,CAAA;gBACb,CAAC,CAAA;gBACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBAC7B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;gBAC3B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBAC/B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAA;YACvB,CAAC,CAAC,CAAA;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,WAAW,CAAC,KAAoB,EAAE,MAAsB;IACrE,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAA;IAC3B,KAAK,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAA;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAClD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACjD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAA;QACzB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;IACjB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAsB;IACpD,IAAI,KAAK,GAAG,IAAI,CAAA;IAChB,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;SACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACzD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAC7D,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,MAAsB;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACzC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,0EAA0E;IAC1E,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAA;QACzE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,EAAE,GAAe,EAAE;IACjD,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,IAAK,OAAO,CAAC,KAAkC,CAAA;QACrE,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAA;QAC1C,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAA;QAC1C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;gBAAE,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAA;YACnG,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAA;YAC1B,OAAO,CAAC,CAAA;QACV,CAAC;QACD,IAAI,KAAoB,CAAA;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;QACjG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;gBAChC,MAAM,CAAC,KAAK,CAAC,wBAAwB,GAAG,CAAC,OAAO,KAAK,CAAC,CAAA;gBACtD,OAAO,GAAG,CAAA;YACZ,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,qCAAsC,GAAa,CAAC,OAAO,IAAI,CAAC,CAAA;YAC7E,OAAO,CAAC,CAAA;QACV,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3C,OAAO,CAAC,CAAA;IACV,CAAC,CAAA;AACH,CAAC"}

package/build/token-auth/context.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Request-scoped identity for MCP tools.
+ *
+ * TS counterpart of core-py `hull_core.auth.context`. The HTTP auth guard
+ * resolves the caller before the MCP handler runs and binds the resulting
+ * `AuthContext` in an `AsyncLocalStorage` (the analogue of Python's
+ * contextvar). Tools read it with `currentUser()` and scope every storage
+ * access by its `namespace`.
+ */
+/** The three HTTP auth modes, mirroring core-py `AUTH_MODES`. */
+export type HttpAuthMode = 'no-auth' | 'token' | 'multi';
+/** Resolved caller identity attached to one HTTP request. */
+export interface AuthContext {
+    readonly uid: string;
+    readonly namespace: string;
+    readonly mode: HttpAuthMode;
+    /** Filesystem roots the caller may touch; empty grants nothing. */
+    readonly allowedRoots: readonly string[];
+    /** Per-minute request cap; `null` means unlimited. */
+    readonly rpm: number | null;
+    readonly disabled: boolean;
+    readonly attributes: Readonly<Record<string, unknown>>;
+}
+/** Identity used in no-auth mode (and for in-process tool calls). */
+export declare function localAuthContext(): AuthContext;
+/** The caller's identity; falls back to the local identity when unset. */
+export declare function currentUser(): AuthContext;
+/** Run `fn` with `ctx` bound as the current user for its whole async scope. */
+export declare function runWithAuthContext<T>(ctx: AuthContext, fn: () => T): T;
+//# sourceMappingURL=context.d.ts.map

package/build/token-auth/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/token-auth/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,iEAAiE;AACjE,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAA;AAExD,6DAA6D;AAC7D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACvD;AAID,qEAAqE;AACrE,wBAAgB,gBAAgB,IAAI,WAAW,CAU9C;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,IAAI,WAAW,CAEzC;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEtE"}

package/build/token-auth/context.js

@@ -0,0 +1,32 @@
+/**
+ * Request-scoped identity for MCP tools.
+ *
+ * TS counterpart of core-py `hull_core.auth.context`. The HTTP auth guard
+ * resolves the caller before the MCP handler runs and binds the resulting
+ * `AuthContext` in an `AsyncLocalStorage` (the analogue of Python's
+ * contextvar). Tools read it with `currentUser()` and scope every storage
+ * access by its `namespace`.
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+const storage = new AsyncLocalStorage();
+/** Identity used in no-auth mode (and for in-process tool calls). */
+export function localAuthContext() {
+    return Object.freeze({
+        uid: 'local',
+        namespace: 'default',
+        mode: 'no-auth',
+        allowedRoots: Object.freeze([]),
+        rpm: null,
+        disabled: false,
+        attributes: Object.freeze({})
+    });
+}
+/** The caller's identity; falls back to the local identity when unset. */
+export function currentUser() {
+    return storage.getStore() ?? localAuthContext();
+}
+/** Run `fn` with `ctx` bound as the current user for its whole async scope. */
+export function runWithAuthContext(ctx, fn) {
+    return storage.run(ctx, fn);
+}
+//# sourceMappingURL=context.js.map