@nodetool-ai/websocket 0.7.0-rc.23 → 0.8.2

package/dist/routes/kie-pricing.js

@@ -0,0 +1,45 @@
+import { aggregateKiePricingByModelId, fetchAllKiePricingRecords, resolveKiePricing, } from "@nodetool-ai/kie-nodes/kie-pricing-api";
+const CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
+let catalogCache = null;
+async function getKiePricingCatalog() {
+    const now = Date.now();
+    if (catalogCache != null && now < catalogCache.expiresAt) {
+        return catalogCache.byModelId;
+    }
+    const records = await fetchAllKiePricingRecords();
+    const byModelId = aggregateKiePricingByModelId(records);
+    catalogCache = {
+        byModelId,
+        expiresAt: now + CACHE_TTL_MS,
+    };
+    return byModelId;
+}
+const kiePricingRoute = async (app) => {
+    app.get("/api/kie/pricing", async (req, reply) => {
+        const raw = req.query["model_id"];
+        const modelIds = raw
+            ? [...new Set(Array.isArray(raw) ? raw : [raw])]
+            : [];
+        if (modelIds.length === 0) {
+            reply.status(400).send({ detail: "model_id query param required" });
+            return;
+        }
+        try {
+            const catalog = await getKiePricingCatalog();
+            const byModelId = {};
+            for (const id of modelIds) {
+                const entry = resolveKiePricing(catalog, id);
+                if (entry) {
+                    byModelId[id] = entry;
+                }
+            }
+            reply.send({ byModelId, fetched_at: new Date().toISOString() });
+        }
+        catch (err) {
+            console.error("[kie-pricing] fetch failed:", err);
+            reply.status(502).send({ detail: "Failed to fetch KIE pricing" });
+        }
+    });
+};
+export default kiePricingRoute;
+//# sourceMappingURL=kie-pricing.js.map

package/dist/routes/kie-pricing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kie-pricing.js","sourceRoot":"","sources":["../../src/routes/kie-pricing.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,iBAAiB,GAElB,MAAM,wCAAwC,CAAC;AAEhD,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AAE9C,IAAI,YAAY,GAGL,IAAI,CAAC;AAEhB,KAAK,UAAU,oBAAoB;IAGjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,YAAY,IAAI,IAAI,IAAI,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC;QACzD,OAAO,YAAY,CAAC,SAAS,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACxD,YAAY,GAAG;QACb,SAAS;QACT,SAAS,EAAE,GAAG,GAAG,YAAY;KAC9B,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,eAAe,GAAuB,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAI,GAAG,CAAC,KAA2C,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,GAAG;YAClB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChD,CAAC,CAAC,EAAE,CAAC;QAEP,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;YAC7C,MAAM,SAAS,GAA2C,EAAE,CAAC;YAC7D,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC7C,IAAI,KAAK,EAAE,CAAC;oBACV,SAAS,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;gBACxB,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAClD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/dist/routes/kie-webhook.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyPluginAsync } from "fastify";
+declare const kieWebhookRoute: FastifyPluginAsync;
+export default kieWebhookRoute;
+//# sourceMappingURL=kie-webhook.d.ts.map

package/dist/routes/kie-webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kie-webhook.d.ts","sourceRoot":"","sources":["../../src/routes/kie-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAiDlD,QAAA,MAAM,eAAe,EAAE,kBAiBtB,CAAC;eAEa,eAAe"}

package/dist/routes/kie-webhook.js

@@ -0,0 +1,70 @@
+import { resolveWebhook, rejectWebhook } from "@nodetool-ai/runtime";
+import { isNonEmptyString, isObjectLike, isString } from "../lib/wire-values.js";
+/**
+ * Extract a task ID from the KIE callback body. KIE may nest it under
+ * `data.taskId` or send it at the top level — try both.
+ */
+function extractTaskId(body) {
+    if (!isObjectLike(body))
+        return undefined;
+    const b = body;
+    if (isNonEmptyString(b.taskId))
+        return b.taskId;
+    if (isNonEmptyString(b.task_id))
+        return b.task_id;
+    const data = b.data;
+    if (isObjectLike(data)) {
+        const d = data;
+        if (isNonEmptyString(d.taskId))
+            return d.taskId;
+        if (isNonEmptyString(d.task_id))
+            return d.task_id;
+    }
+    return undefined;
+}
+function extractStatus(body) {
+    if (!isObjectLike(body))
+        return undefined;
+    const b = body;
+    if (isString(b.status))
+        return b.status;
+    if (isString(b.state))
+        return b.state;
+    const data = b.data;
+    if (isObjectLike(data)) {
+        const d = data;
+        if (isString(d.status))
+            return d.status;
+        if (isString(d.state))
+            return d.state;
+    }
+    return undefined;
+}
+const FAILURE_STATES = new Set([
+    "failed",
+    "fail",
+    "CREATE_TASK_FAILED",
+    "GENERATE_AUDIO_FAILED",
+    "CALLBACK_EXCEPTION",
+    "SENSITIVE_WORD_ERROR"
+]);
+const kieWebhookRoute = async (app) => {
+    // KIE calls POST /api/kie/webhook with taskId in the body.
+    app.post("/api/kie/webhook", async (req, reply) => {
+        const taskId = extractTaskId(req.body);
+        if (!taskId) {
+            reply.status(400).send({ error: "No taskId in request body" });
+            return;
+        }
+        const status = extractStatus(req.body);
+        if (status && FAILURE_STATES.has(status)) {
+            rejectWebhook(taskId, status);
+        }
+        else {
+            resolveWebhook(taskId, req.body);
+        }
+        reply.send({ status: "accepted" });
+    });
+};
+export default kieWebhookRoute;
+//# sourceMappingURL=kie-webhook.js.map

package/dist/routes/kie-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kie-webhook.js","sourceRoot":"","sources":["../../src/routes/kie-webhook.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACT,MAAM,uBAAuB,CAAC;AAE/B;;;GAGG;AACH,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC;QAChD,IAAI,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC;QACxC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,QAAQ;IACR,MAAM;IACN,oBAAoB;IACpB,uBAAuB;IACvB,oBAAoB;IACpB,sBAAsB;CACvB,CAAC,CAAC;AAEH,MAAM,eAAe,GAAuB,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,2DAA2D;IAC3D,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/dist/routes/nodes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nodes.d.ts","sourceRoot":"","sources":["../../src/routes/nodes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKrD,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,QAAA,MAAM,WAAW,EAAE,kBAAkB,CAAC,YAAY,CAyGjD,CAAC;AAqCF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"nodes.d.ts","sourceRoot":"","sources":["../../src/routes/nodes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAerD,UAAU,YAAY;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,QAAA,MAAM,WAAW,EAAE,kBAAkB,CAAC,YAAY,CAyFjD,CAAC;eAgDa,WAAW"}

package/dist/routes/nodes.js

@@ -1,7 +1,8 @@
 import { bridge } from "../lib/bridge.js";
 import { handleNodeMetadata } from "../http-api.js";
-import { resolveKieDynamicSchema } from "@nodetool-ai/base-nodes";
+import { resolveComfyWorkflow, resolveKieDynamicSchema } from "@nodetool-ai/base-nodes";
 import { ApiErrorCode, apiError } from "../error-codes.js";
+import { isNonBlankString, isObjectLike, isString } from "../lib/wire-values.js";
 const nodesRoutes = async (app, opts) => {
     const { apiOptions } = opts;
     /**
@@ -11,19 +12,13 @@ const nodesRoutes = async (app, opts) => {
     app.get("/api/nodes/metadata", async (req, reply) => {
         await bridge(req, reply, (request) => handleNodeMetadata(request, apiOptions));
     });
-    /**
-     * Legacy alias for /api/nodes/metadata.
-     */
-    app.get("/api/node/metadata", async (req, reply) => {
-        await bridge(req, reply, (request) => handleNodeMetadata(request, apiOptions));
-    });
     /**
      * KIE dynamic schema resolution — stays as REST (fast, stateless, no auth needed).
      */
     app.post("/api/kie/resolve-dynamic-schema", async (req, reply) => {
         const body = req.body;
         const modelInfo = extractKieModelInfo(body);
-        if (typeof modelInfo !== "string" || !modelInfo.trim()) {
+        if (!isNonBlankString(modelInfo)) {
             reply
                 .status(400)
                 .send(apiError(ApiErrorCode.INVALID_INPUT, "model_info must be a non-empty string"));
@@ -39,53 +34,34 @@ const nodesRoutes = async (app, opts) => {
         }
     });
     /**
-     * Proxy ComfyUI /object_info through the backend to avoid CORS issues
-     * with remote hosts (e.g. RunPod Pods).
+     * ComfyUI workflow parsing for the Comfy runner nodes. Takes a workflow in
+     * API format (`workflow`, JSON text or object) or a ComfyUI-exported PNG
+     * (`png_base64`), and returns the normalized prompt with the dynamic inputs,
+     * outputs, and exposable params the editor shows. Stateless, like the KIE
+     * route above.
      */
-    app.get("/api/comfy/object_info", async (req, reply) => {
-        const host = req.query["host"]?.trim();
-        if (!host) {
-            reply.status(400).send({ error: "host query parameter is required" });
-            return;
+    app.post("/api/comfy/resolve-workflow", {
+        schema: {
+            body: {
+                type: "object",
+                properties: {
+                    workflow: {},
+                    png_base64: { type: "string", minLength: 1 }
+                },
+                oneOf: [{ required: ["workflow"] }, { required: ["png_base64"] }]
+            }
         }
-        // Validate and normalise the host into a safe URL (prevents SSRF via
-        // non-HTTP schemes such as file://, ftp://, etc.).
-        let parsedUrl;
+    }, async (req, reply) => {
+        const body = req.body;
         try {
-            const raw = host.startsWith("http") ? host : `http://${host}`;
-            parsedUrl = new URL(raw);
+            reply.send(resolveComfyWorkflow(isString(body.png_base64)
+                ? { png_base64: body.png_base64 }
+                : { workflow: body.workflow }));
         }
-        catch {
-            reply.status(400).send({ error: "Invalid host URL" });
-            return;
-        }
-        if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+        catch (error) {
             reply
                 .status(400)
-                .send({ error: "Only http and https hosts are supported" });
-            return;
-        }
-        // Trim any trailing slashes without backtracking regex (avoids ReDoS).
-        let base = parsedUrl.origin + parsedUrl.pathname;
-        let end = base.length;
-        while (end > 0 && base[end - 1] === "/")
-            end--;
-        base = base.slice(0, end);
-        try {
-            const resp = await fetch(`${base}/object_info`);
-            if (!resp.ok) {
-                reply
-                    .status(resp.status)
-                    .send({ error: `ComfyUI returned ${resp.status}` });
-                return;
-            }
-            const data = await resp.json();
-            reply.send(data);
-        }
-        catch (err) {
-            reply.status(502).send({
-                error: `Cannot reach ComfyUI at ${base}: ${err instanceof Error ? err.message : String(err)}`
-            });
+                .send(apiError(ApiErrorCode.INVALID_INPUT, error instanceof Error ? error.message : String(error)));
         }
     });
 };
@@ -102,7 +78,7 @@ function extractKieModelInfo(body) {
             return text;
         }
     }
-    if (typeof body === "string") {
+    if (isString(body)) {
         try {
             const parsed = JSON.parse(body);
             return extractKieModelInfo(parsed);
@@ -111,9 +87,11 @@ function extractKieModelInfo(body) {
             return body;
         }
     }
-    if (!body || typeof body !== "object") {
+    if (!isObjectLike(body)) {
         return undefined;
     }
+    // SAFETY: the checks above proved `body` is a non-null object; its members
+    // came out of a JSON request body.
     const record = body;
     return (record.model_info ??
         record.modelInfo ??

package/dist/routes/nodes.js.map

@@ -1 +1 @@
-{"version":3,"file":"nodes.js","sourceRoot":"","sources":["../../src/routes/nodes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAM3D,MAAM,WAAW,GAAqC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACxE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAE5B;;;OAGG;IACH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAClD,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CACnC,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CACxC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACjD,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CACnC,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CACxC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2C,CAAC;QAC7D,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;YACvD,KAAK;iBACF,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,QAAQ,CACN,YAAY,CAAC,aAAa,EAC1B,uCAAuC,CACxC,CACF,CAAC;YACJ,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK;iBACF,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,QAAQ,CACN,YAAY,CAAC,aAAa,EAC1B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CACF,CAAC;QACN,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACrD,MAAM,IAAI,GAAI,GAAG,CAAC,KAAgC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,mDAAmD;QACnD,IAAI,SAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;YAC9D,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtE,KAAK;iBACF,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,IAAI,IAAI,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC;QACjD,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACtB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;YAAE,GAAG,EAAE,CAAC;QAC/C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAE1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,KAAK;qBACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;qBACnB,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,KAAK,EAAE,2BAA2B,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC9F,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;YAC3C,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,OAAO,CACL,MAAM,CAAC,UAAU;QACjB,MAAM,CAAC,SAAS;QAChB,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC;QACtC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,eAAe,WAAW,CAAC"}
+{"version":3,"file":"nodes.js","sourceRoot":"","sources":["../../src/routes/nodes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EACL,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACT,MAAM,uBAAuB,CAAC;AAM/B,MAAM,WAAW,GAAqC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACxE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAE5B;;;OAGG;IACH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAClD,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CACnC,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CACxC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;OAEG;IACH,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2C,CAAC;QAC7D,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,KAAK;iBACF,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,QAAQ,CACN,YAAY,CAAC,aAAa,EAC1B,uCAAuC,CACxC,CACF,CAAC;YACJ,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK;iBACF,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,QAAQ,CACN,YAAY,CAAC,aAAa,EAC1B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CACF,CAAC;QACN,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,GAAG,CAAC,IAAI,CACN,6BAA6B,EAC7B;QACE,MAAM,EAAE;YACN,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,QAAQ,EAAE,EAAE;oBACZ,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;iBAC7C;gBACD,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;aAClE;SACF;KACF,EACD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAmD,CAAC;QACrE,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CACR,oBAAoB,CAClB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;gBACvB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;gBACjC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAChC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK;iBACF,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,QAAQ,CACN,YAAY,CAAC,aAAa,EAC1B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CACF,CAAC;QACN,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AAWF,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;YAC3C,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,2EAA2E;IAC3E,mCAAmC;IACnC,MAAM,MAAM,GAAG,IAAoC,CAAC;IACpD,OAAO,CACL,MAAM,CAAC,UAAU;QACjB,MAAM,CAAC,SAAS;QAChB,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC;QACtC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,eAAe,WAAW,CAAC"}

package/dist/routes/oauth-as.d.ts

@@ -0,0 +1,30 @@
+/**
+ * MCP OAuth 2.1 authorization server + resource-server discovery routes
+ * (`docs/mcp-oauth-design.md`). NodeTool is both the AS and the RS for
+ * `/mcp` — this plugin registers the seven endpoints that make that work:
+ *
+ *   GET  /.well-known/oauth-protected-resource/mcp   (RFC 9728)
+ *   GET  /.well-known/oauth-protected-resource        (RFC 9728, root form)
+ *   GET  /.well-known/oauth-authorization-server       (RFC 8414)
+ *   GET  /oauth/authorize
+ *   POST /oauth/token
+ *   POST /oauth/register                                (RFC 7591)
+ *   POST /oauth/revoke                                   (RFC 7009)
+ *
+ * Self-contained: no dependency on `server.ts` wiring, no import of the
+ * agent-access tRPC router. The consent page and the `approveOauthRequest`
+ * mutation (T4) are reached only through `pendingStore` — `/oauth/authorize`
+ * parks a request and 302s to `/oauth/consent?request_id=…` (an SPA route
+ * this plugin never renders), and `/oauth/token` reads back whatever
+ * `pendingStore.putCode` produced, from either the real consent flow or a
+ * test driving the store directly.
+ *
+ * Grant lifetime: the consent step (`approveOauthRequest`) creates the
+ * `McpOauthGrant` and threads its id through `pendingStore.putCode`, so the
+ * token endpoint mints tokens for exactly that grant — and revokes it when a
+ * code is replayed (OAuth 2.1 code-replay rule). One consent, one grant row.
+ */
+import type { FastifyPluginAsync } from "fastify";
+export declare const oauthAsRoutes: FastifyPluginAsync;
+export default oauthAsRoutes;
+//# sourceMappingURL=oauth-as.d.ts.map

package/dist/routes/oauth-as.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-as.d.ts","sourceRoot":"","sources":["../../src/routes/oauth-as.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAgB,MAAM,SAAS,CAAC;AAkHhE,eAAO,MAAM,aAAa,EAAE,kBA6f3B,CAAC;eAEa,aAAa"}