@prenta/core 8.6.1 → 8.7.0

package/dist/mcp/oauth-http.js

@@ -0,0 +1,243 @@
+import { editorialRoleForApiKey } from '../api/route-helpers/auth.js';
+import { fetchClientMetadata } from './cimd.js';
+import { canonicalMcpResource, exchangeAuthorizationCode, issueAuthorizationCode, newSecret, redirectAllowed, rotateRefreshToken, } from './oauth-grants.js';
+import { MCP_CONTENT_SCOPE, signMcpAccessToken, verifyMcpAccessToken } from './oauth-token.js';
+const TXN_TTL_MS = 10 * 60 * 1000;
+const attempts = new Map();
+function nowOf(runtime) {
+    return runtime.now?.() ?? new Date();
+}
+function clientOf(runtime) {
+    return runtime.fetchClient ?? ((clientId) => fetchClientMetadata(clientId));
+}
+function allowOauthAttempt(key, limit = 30) {
+    const now = Date.now();
+    const bucket = attempts.get(key);
+    if (!bucket || bucket.reset < now) {
+        attempts.set(key, { n: 1, reset: now + 60_000 });
+        return true;
+    }
+    bucket.n += 1;
+    return bucket.n <= limit;
+}
+function noStore(body, status = 200, extra) {
+    return Response.json(body, {
+        status,
+        headers: { 'cache-control': 'no-store', ...Object.fromEntries(new Headers(extra)) },
+    });
+}
+function issuer(runtime) {
+    return runtime.siteUrl.replace(/\/+$/, '');
+}
+export function mcpResourceMetadata(runtime) {
+    const site = issuer(runtime);
+    return Response.json({
+        resource: canonicalMcpResource(site),
+        authorization_servers: [site],
+        scopes_supported: [MCP_CONTENT_SCOPE],
+        bearer_methods_supported: ['header'],
+    });
+}
+export function mcpAuthorizationServerMetadata(runtime) {
+    const site = issuer(runtime);
+    return Response.json({
+        issuer: site,
+        authorization_endpoint: `${site}/oauth/authorize`,
+        token_endpoint: `${site}/oauth/token`,
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code', 'refresh_token'],
+        code_challenge_methods_supported: ['S256'],
+        token_endpoint_auth_methods_supported: ['none'],
+        client_id_metadata_document_supported: true,
+        authorization_response_iss_parameter_supported: true,
+        scopes_supported: [MCP_CONTENT_SCOPE],
+    });
+}
+function redirectTarget(uri, params) {
+    const url = new URL(uri);
+    for (const [key, value] of Object.entries(params))
+        url.searchParams.set(key, value);
+    return url.toString();
+}
+export async function beginAuthorization(request, runtime) {
+    const ip = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || 'unknown';
+    if (!(runtime.allowAttempt ?? allowOauthAttempt)(`authorize:${ip}`)) {
+        return noStore({ error: 'slow_down' }, 429);
+    }
+    const url = new URL(request.url);
+    const clientId = url.searchParams.get('client_id') ?? '';
+    const redirectUri = url.searchParams.get('redirect_uri') ?? '';
+    const challenge = url.searchParams.get('code_challenge') ?? '';
+    const method = url.searchParams.get('code_challenge_method') ?? '';
+    const resource = url.searchParams.get('resource') ?? '';
+    const responseType = url.searchParams.get('response_type') ?? '';
+    const state = url.searchParams.get('state');
+    const scope = url.searchParams.get('scope') ?? MCP_CONTENT_SCOPE;
+    const expected = canonicalMcpResource(issuer(runtime));
+    if (responseType !== 'code' || method !== 'S256' || !challenge) {
+        return noStore({ error: 'invalid_request' }, 400);
+    }
+    if (scope !== MCP_CONTENT_SCOPE)
+        return noStore({ error: 'invalid_scope' }, 400);
+    if (resource !== expected)
+        return noStore({ error: 'invalid_target' }, 400);
+    const meta = await clientOf(runtime)(clientId);
+    if ('error' in meta)
+        return noStore({ error: meta.error }, 400);
+    if (!redirectAllowed(redirectUri, meta.redirectUris)) {
+        return noStore({ error: 'invalid_request', error_description: 'redirect_uri mismatch' }, 400);
+    }
+    const txn = {
+        id: newSecret(),
+        clientId,
+        clientName: meta.clientName,
+        redirectUri,
+        resource,
+        scope,
+        codeChallenge: challenge,
+        state,
+        expiresAt: new Date(nowOf(runtime).getTime() + TXN_TTL_MS),
+    };
+    await runtime.transactions.put(txn);
+    const admin = runtime.adminPath.startsWith('/') ? runtime.adminPath : `/${runtime.adminPath}`;
+    const next = new URL(`${issuer(runtime)}${admin}/mcp/consent`);
+    next.searchParams.set('txn', txn.id);
+    return Response.redirect(next.toString(), 302);
+}
+export async function readConsentTransaction(txnId, runtime) {
+    const txn = await runtime.transactions.get(txnId);
+    if (!txn || txn.expiresAt.getTime() <= nowOf(runtime).getTime())
+        return null;
+    return { transaction: txn, redirectHost: new URL(txn.redirectUri).host };
+}
+export async function completeConsent(input, runtime) {
+    const txn = await runtime.transactions.get(input.txnId);
+    if (!txn || txn.expiresAt.getTime() <= nowOf(runtime).getTime())
+        return { error: 'expired' };
+    await runtime.transactions.delete(input.txnId);
+    const iss = issuer(runtime);
+    if (!input.allow) {
+        return {
+            redirectUrl: redirectTarget(txn.redirectUri, {
+                error: 'access_denied',
+                ...(txn.state ? { state: txn.state } : {}),
+                iss,
+            }),
+        };
+    }
+    const user = await runtime.loadUser(input.userId);
+    if (!user?.active)
+        return { error: 'forbidden' };
+    const { code } = await issueAuthorizationCode(runtime.grants, {
+        userId: user.id,
+        clientId: txn.clientId,
+        redirectUri: txn.redirectUri,
+        resource: txn.resource,
+        scope: txn.scope,
+        codeChallenge: txn.codeChallenge,
+        now: nowOf(runtime),
+    });
+    return {
+        redirectUrl: redirectTarget(txn.redirectUri, {
+            code,
+            ...(txn.state ? { state: txn.state } : {}),
+            iss,
+        }),
+    };
+}
+async function issueAccess(runtime, userId, scope) {
+    const user = await runtime.loadUser(userId);
+    if (!user?.active)
+        return null;
+    const role = editorialRoleForApiKey(user.role, {
+        collections: ['*'],
+        actions: ['read', 'create', 'update'],
+    });
+    const signed = await signMcpAccessToken({
+        secret: runtime.secret,
+        issuer: issuer(runtime),
+        resource: canonicalMcpResource(issuer(runtime)),
+        userId,
+        role,
+        scope,
+    });
+    return signed.token;
+}
+export async function handleTokenRequest(request, runtime) {
+    const ip = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || 'unknown';
+    if (!(runtime.allowAttempt ?? allowOauthAttempt)(`token:${ip}`)) {
+        return noStore({ error: 'slow_down' }, 429);
+    }
+    const body = new URLSearchParams(await request.text());
+    const grantType = body.get('grant_type') ?? '';
+    const clientId = body.get('client_id') ?? '';
+    const resource = body.get('resource') ?? '';
+    const expected = canonicalMcpResource(issuer(runtime));
+    if (resource !== expected)
+        return noStore({ error: 'invalid_target' }, 400);
+    if (grantType === 'authorization_code') {
+        const exchanged = await exchangeAuthorizationCode(runtime.grants, {
+            code: body.get('code') ?? '',
+            verifier: body.get('code_verifier') ?? '',
+            clientId,
+            redirectUri: body.get('redirect_uri') ?? '',
+            resource,
+            now: nowOf(runtime),
+        });
+        if (!exchanged.ok)
+            return noStore({ error: 'invalid_grant' }, 400);
+        const access = await issueAccess(runtime, exchanged.grant.userId, exchanged.grant.scope);
+        if (!access)
+            return noStore({ error: 'invalid_grant' }, 400);
+        return noStore({
+            access_token: access,
+            token_type: 'Bearer',
+            expires_in: 15 * 60,
+            refresh_token: exchanged.refreshToken,
+            scope: exchanged.grant.scope,
+        });
+    }
+    if (grantType === 'refresh_token') {
+        const rotated = await rotateRefreshToken(runtime.grants, {
+            refreshToken: body.get('refresh_token') ?? '',
+            clientId,
+            resource,
+            now: nowOf(runtime),
+        });
+        if (!rotated.ok)
+            return noStore({ error: 'invalid_grant' }, 400);
+        const access = await issueAccess(runtime, rotated.grant.userId, rotated.grant.scope);
+        if (!access)
+            return noStore({ error: 'invalid_grant' }, 400);
+        return noStore({
+            access_token: access,
+            token_type: 'Bearer',
+            expires_in: 15 * 60,
+            refresh_token: rotated.refreshToken,
+            scope: rotated.grant.scope,
+        });
+    }
+    return noStore({ error: 'unsupported_grant_type' }, 400);
+}
+export async function mcpBearerStatus(token, runtime) {
+    const claims = await verifyMcpAccessToken({
+        token,
+        secret: runtime.secret,
+        resource: canonicalMcpResource(issuer(runtime)),
+    });
+    if (!claims)
+        return null;
+    if (claims.scope !== MCP_CONTENT_SCOPE)
+        return 'insufficient_scope';
+    const user = await runtime.loadUser(claims.userId);
+    if (!user?.active)
+        return null;
+    return {
+        userId: user.id,
+        role: editorialRoleForApiKey(user.role, {
+            collections: ['*'],
+            actions: ['read', 'create', 'update'],
+        }),
+    };
+}
+//# sourceMappingURL=oauth-http.js.map

package/dist/mcp/oauth-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-http.js","sourceRoot":"","sources":["../../src/mcp/oauth-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAuB,MAAM,WAAW,CAAA;AACpE,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,SAAS,EACT,eAAe,EACf,kBAAkB,GAEnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAG9F,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwC,CAAA;AAgBhE,SAAS,KAAK,CAAC,OAAwB;IACrC,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,OAAwB;IACxC,OAAO,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,QAAgB,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAA;AACrF,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,KAAK,GAAG,EAAE;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC;QAClC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC,CAAA;QAChD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,CAAC,CAAC,IAAI,CAAC,CAAA;IACb,OAAO,MAAM,CAAC,CAAC,IAAI,KAAK,CAAA;AAC1B,CAAC;AAED,SAAS,OAAO,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,KAAmB;IAC/D,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;QACzB,MAAM;QACN,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE;KACpF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,OAAwB;IACtC,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAwB;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC;QACpC,qBAAqB,EAAE,CAAC,IAAI,CAAC;QAC7B,gBAAgB,EAAE,CAAC,iBAAiB,CAAC;QACrC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,OAAwB;IACrE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,MAAM,EAAE,IAAI;QACZ,sBAAsB,EAAE,GAAG,IAAI,kBAAkB;QACjD,cAAc,EAAE,GAAG,IAAI,cAAc;QACrC,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,qCAAqC,EAAE,IAAI;QAC3C,8CAA8C,EAAE,IAAI;QACpD,gBAAgB,EAAE,CAAC,iBAAiB,CAAC;KACtC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,MAA8B;IACjE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACxB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACnF,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,OAAwB;IAExB,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAA;IACrF,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,iBAAiB,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC;QACpE,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;IACxD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAC9D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAA;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAA;IAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;IACvD,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAA;IAChE,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,iBAAiB,CAAA;IAChE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IAEtD,IAAI,YAAY,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/D,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IACD,IAAI,KAAK,KAAK,iBAAiB;QAAE,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;IAChF,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;IAE3E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/D,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACrD,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/F,CAAC;IAED,MAAM,GAAG,GAAqB;QAC5B,EAAE,EAAE,SAAS,EAAE;QACf,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW;QACX,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,SAAS;QACxB,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC;KAC3D,CAAA;IACD,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAA;IAC7F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,cAAc,CAAC,CAAA;IAC9D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IACpC,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAa,EACb,OAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAAE,OAAO,IAAI,CAAA;IAC5E,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAA;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAwD,EACxD,OAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACvD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IAC5F,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,WAAW,EAAE,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE;gBAC3C,KAAK,EAAE,eAAe;gBACtB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG;aACJ,CAAC;SACH,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjD,IAAI,CAAC,IAAI,EAAE,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IAChD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,MAAM,EAAE;QAC5D,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;KACpB,CAAC,CAAA;IACF,OAAO;QACL,WAAW,EAAE,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE;YAC3C,IAAI;YACJ,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG;SACJ,CAAC;KACH,CAAA;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAwB,EAAE,MAAc,EAAE,KAAa;IAChF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,CAAC,IAAI,EAAE,MAAM;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE;QAC7C,WAAW,EAAE,CAAC,GAAG,CAAC;QAClB,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;KACtC,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;QACvB,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM;QACN,IAAI;QACJ,KAAK;KACN,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,KAAK,CAAA;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,OAAwB;IAExB,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAA;IACrF,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,iBAAiB,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;QAChE,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;IAC7C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;IAC3C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IACtD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;IAE3E,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,MAAM,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;YAC5B,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;YACzC,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;YAC3C,QAAQ;YACR,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;SACpB,CAAC,CAAA;QACF,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;QAClE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACxF,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5D,OAAO,OAAO,CAAC;YACb,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,EAAE,GAAG,EAAE;YACnB,aAAa,EAAE,SAAS,CAAC,YAAY;YACrC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK;SAC7B,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE;YACvD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;YAC7C,QAAQ;YACR,QAAQ;YACR,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;SACpB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;QAChE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACpF,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5D,OAAO,OAAO,CAAC;YACb,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,EAAE,GAAG,EAAE;YACnB,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,OAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;QACxC,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;KAChD,CAAC,CAAA;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,IAAI,MAAM,CAAC,KAAK,KAAK,iBAAiB;QAAE,OAAO,oBAAoB,CAAA;IACnE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAClD,IAAI,CAAC,IAAI,EAAE,MAAM;QAAE,OAAO,IAAI,CAAA;IAC9B,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE;YACtC,WAAW,EAAE,CAAC,GAAG,CAAC;YAClB,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;SACtC,CAAC;KACH,CAAA;AACH,CAAC"}

package/dist/mcp/oauth-token.d.ts

@@ -0,0 +1,43 @@
+export declare const MCP_CONTENT_SCOPE = "content";
+export declare const MCP_CONTENT_KEY_SCOPES: {
+    collections: string[];
+    actions: readonly ["read", "create", "update"];
+    globals: string[];
+    media: boolean;
+};
+export type McpAccessClaims = {
+    userId: string;
+    role: string;
+    scope: string;
+    jti: string;
+};
+export declare function signMcpAccessToken(input: {
+    secret: string;
+    issuer: string;
+    resource: string;
+    userId: string;
+    role: string;
+    scope: string;
+}): Promise<{
+    token: string;
+    jti: string;
+}>;
+export declare function verifyMcpAccessToken(input: {
+    token: string;
+    secret: string;
+    resource: string;
+}): Promise<McpAccessClaims | null>;
+/** Short-lived assertion used only inside this process. Never returned to a client. */
+export declare function signMcpInternalToken(input: {
+    secret: string;
+    userId: string;
+    role: string;
+}): Promise<string>;
+export declare function verifyMcpInternalToken(input: {
+    token: string;
+    secret: string;
+}): Promise<{
+    userId: string;
+    role: string;
+} | null>;
+//# sourceMappingURL=oauth-token.d.ts.map

package/dist/mcp/oauth-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token.d.ts","sourceRoot":"","sources":["../../src/mcp/oauth-token.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,iBAAiB,YAAY,CAAA;AAE1C,eAAO,MAAM,sBAAsB;;;;;CAKlC,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAY1C;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAclC;AAED,uFAAuF;AACvF,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,MAAM,CAAC,CAUlB;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAenD"}

package/dist/mcp/oauth-token.js

@@ -0,0 +1,78 @@
+import { randomBytes } from 'node:crypto';
+import * as jose from 'jose';
+const ACCESS_TYP = 'mcp-access+jwt';
+const INTERNAL_TYP = 'mcp-internal+jwt';
+const ACCESS_TTL = '15m';
+const INTERNAL_AUDIENCE = 'prenta-cms-mcp-internal';
+export const MCP_CONTENT_SCOPE = 'content';
+export const MCP_CONTENT_KEY_SCOPES = {
+    collections: ['*'],
+    actions: ['read', 'create', 'update'],
+    globals: ['*'],
+    media: true,
+};
+export async function signMcpAccessToken(input) {
+    const jti = randomBytes(16).toString('hex');
+    const token = await new jose.SignJWT({ role: input.role, scope: input.scope })
+        .setProtectedHeader({ alg: 'HS256', typ: ACCESS_TYP })
+        .setSubject(input.userId)
+        .setIssuer(input.issuer)
+        .setAudience(input.resource)
+        .setJti(jti)
+        .setIssuedAt()
+        .setExpirationTime(ACCESS_TTL)
+        .sign(new TextEncoder().encode(input.secret));
+    return { token, jti };
+}
+export async function verifyMcpAccessToken(input) {
+    try {
+        const { payload } = await jose.jwtVerify(input.token, new TextEncoder().encode(input.secret), {
+            algorithms: ['HS256'],
+            audience: input.resource,
+            typ: ACCESS_TYP,
+        });
+        if (typeof payload.sub !== 'string' || payload.sub.length === 0)
+            return null;
+        if (typeof payload.role !== 'string' || typeof payload.scope !== 'string')
+            return null;
+        if (typeof payload.jti !== 'string')
+            return null;
+        return { userId: payload.sub, role: payload.role, scope: payload.scope, jti: payload.jti };
+    }
+    catch {
+        return null;
+    }
+}
+/** Short-lived assertion used only inside this process. Never returned to a client. */
+export async function signMcpInternalToken(input) {
+    return new jose.SignJWT({ role: input.role, scope: MCP_CONTENT_SCOPE })
+        .setProtectedHeader({ alg: 'HS256', typ: INTERNAL_TYP })
+        .setSubject(input.userId)
+        .setIssuer('prenta-cms')
+        .setAudience(INTERNAL_AUDIENCE)
+        .setJti(randomBytes(16).toString('hex'))
+        .setIssuedAt()
+        .setExpirationTime('60s')
+        .sign(new TextEncoder().encode(input.secret));
+}
+export async function verifyMcpInternalToken(input) {
+    try {
+        const { payload } = await jose.jwtVerify(input.token, new TextEncoder().encode(input.secret), {
+            algorithms: ['HS256'],
+            audience: INTERNAL_AUDIENCE,
+            issuer: 'prenta-cms',
+            typ: INTERNAL_TYP,
+        });
+        if (typeof payload.sub !== 'string' || payload.sub.length === 0)
+            return null;
+        if (payload.scope !== MCP_CONTENT_SCOPE)
+            return null;
+        if (typeof payload.role !== 'string')
+            return null;
+        return { userId: payload.sub, role: payload.role };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=oauth-token.js.map

package/dist/mcp/oauth-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token.js","sourceRoot":"","sources":["../../src/mcp/oauth-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,MAAM,UAAU,GAAG,gBAAgB,CAAA;AACnC,MAAM,YAAY,GAAG,kBAAkB,CAAA;AACvC,MAAM,UAAU,GAAG,KAAK,CAAA;AACxB,MAAM,iBAAiB,GAAG,yBAAyB,CAAA;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAA;AAE1C,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW,EAAE,CAAC,GAAG,CAAC;IAClB,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAU;IAC9C,OAAO,EAAE,CAAC,GAAG,CAAC;IACd,KAAK,EAAE,IAAI;CACZ,CAAA;AASD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAOxC;IACC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;SAC3E,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SACrD,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;SACxB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;SACvB,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;SAC3B,MAAM,CAAC,GAAG,CAAC;SACX,WAAW,EAAE;SACb,iBAAiB,CAAC,UAAU,CAAC;SAC7B,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/C,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAI1C;IACC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;YAC5F,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,EAAE,UAAU;SAChB,CAAC,CAAA;QACF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC5E,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QACtF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAChD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAA;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAI1C;IACC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;SACpE,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;SACvD,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;SACxB,SAAS,CAAC,YAAY,CAAC;SACvB,WAAW,CAAC,iBAAiB,CAAC;SAC9B,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SACvC,WAAW,EAAE;SACb,iBAAiB,CAAC,KAAK,CAAC;SACxB,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAG5C;IACC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;YAC5F,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ,EAAE,iBAAiB;YAC3B,MAAM,EAAE,YAAY;YACpB,GAAG,EAAE,YAAY;SAClB,CAAC,CAAA;QACF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC5E,IAAI,OAAO,CAAC,KAAK,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAA;QACpD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QACjD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAA;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/mcp/prisma-store.d.ts

@@ -0,0 +1,5 @@
+import type { OauthGrantStore } from './oauth-grants.js';
+import type { TransactionStore } from './transactions.js';
+export declare function prismaGrantStore(): OauthGrantStore;
+export declare function prismaTransactionStore(): TransactionStore;
+//# sourceMappingURL=prisma-store.d.ts.map

package/dist/mcp/prisma-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-store.d.ts","sourceRoot":"","sources":["../../src/mcp/prisma-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAe,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACrE,OAAO,KAAK,EAAoB,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AA8B3E,wBAAgB,gBAAgB,IAAI,eAAe,CA8ClD;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,CAczD"}

package/dist/mcp/prisma-store.js

@@ -0,0 +1,69 @@
+import { getDB } from '../db.js';
+function db() {
+    return getDB();
+}
+export function prismaGrantStore() {
+    return {
+        async insert(row) {
+            await db().mcpOauthGrant.create({ data: row });
+        },
+        async findByCodeHash(hash) {
+            return db().mcpOauthGrant.findUnique({ where: { codeHash: hash } });
+        },
+        async save(row) {
+            await db().mcpOauthGrant.update({
+                where: { id: row.id },
+                data: {
+                    codeConsumedAt: row.codeConsumedAt,
+                    refreshHash: row.refreshHash,
+                    refreshExpiresAt: row.refreshExpiresAt,
+                    revokedAt: row.revokedAt,
+                },
+            });
+        },
+        async findByRefreshHash(hash) {
+            const row = await db().mcpOauthGrant.findUnique({ where: { refreshHash: hash } });
+            if (!row || row.revokedAt)
+                return null;
+            return row;
+        },
+        async findReplay(hash) {
+            return db().mcpOauthRefreshReplay.findUnique({ where: { hash } });
+        },
+        async rememberReplay(hash, familyId) {
+            await db().mcpOauthRefreshReplay.create({ data: { hash, familyId } });
+        },
+        async revokeFamily(familyId, now) {
+            await db().mcpOauthGrant.updateMany({
+                where: { familyId, revokedAt: null },
+                data: { revokedAt: now },
+            });
+        },
+        async listForUser(userId) {
+            return db().mcpOauthGrant.findMany({ where: { userId } });
+        },
+        async revokeById(id, userId, now) {
+            const row = await db().mcpOauthGrant.findUnique({ where: { id } });
+            if (!row || row.userId !== userId || row.revokedAt)
+                return false;
+            await db().mcpOauthGrant.update({ where: { id }, data: { revokedAt: now } });
+            return true;
+        },
+    };
+}
+export function prismaTransactionStore() {
+    return {
+        async put(row) {
+            await db().mcpOauthTransaction.create({ data: row });
+        },
+        async get(id) {
+            return db().mcpOauthTransaction.findUnique({ where: { id } });
+        },
+        async delete(id) {
+            await db()
+                .mcpOauthTransaction.delete({ where: { id } })
+                .catch(() => { });
+        },
+    };
+}
+//# sourceMappingURL=prisma-store.js.map

package/dist/mcp/prisma-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-store.js","sourceRoot":"","sources":["../../src/mcp/prisma-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AA4BhC,SAAS,EAAE;IACT,OAAO,KAAK,EAAM,CAAA;AACpB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;QAChD,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,IAAI;YACvB,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;QACrE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;gBAC9B,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;gBACrB,IAAI,EAAE;oBACJ,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;oBACtC,SAAS,EAAE,GAAG,CAAC,SAAS;iBACzB;aACF,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,iBAAiB,CAAC,IAAI;YAC1B,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;YACjF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAA;YACtC,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ;YACjC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;QACvE,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG;YAC9B,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC;gBAClC,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;gBACpC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;aACzB,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;QAC3D,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG;YAC9B,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;YAClE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAA;YAChE,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;YAC5E,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;QACtD,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAC/D,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,EAAE,EAAE;iBACP,mBAAmB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;iBAC7C,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACpB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/mcp/public.d.ts

@@ -0,0 +1,5 @@
+export declare function handleMcpProtectedResource(): Response;
+export declare function handleMcpAuthorizationServer(): Response;
+export declare function handleMcpAuthorize(request: Request): Promise<Response>;
+export declare function handleMcpToken(request: Request): Promise<Response>;
+//# sourceMappingURL=public.d.ts.map

package/dist/mcp/public.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.d.ts","sourceRoot":"","sources":["../../src/mcp/public.ts"],"names":[],"mappings":"AAeA,wBAAgB,0BAA0B,IAAI,QAAQ,CAIrD;AAED,wBAAgB,4BAA4B,IAAI,QAAQ,CAIvD;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAItE;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAIlE"}

package/dist/mcp/public.js

@@ -0,0 +1,30 @@
+import { beginAuthorization, handleTokenRequest, mcpAuthorizationServerMetadata, mcpResourceMetadata, } from './oauth-http.js';
+import { mcpOauthRuntime } from './runtime.js';
+function unavailable() {
+    return Response.json({ error: 'server_error', error_description: 'MCP site URL is not configured' }, { status: 500, headers: { 'cache-control': 'no-store' } });
+}
+export function handleMcpProtectedResource() {
+    const runtime = mcpOauthRuntime();
+    if (!runtime)
+        return unavailable();
+    return mcpResourceMetadata(runtime);
+}
+export function handleMcpAuthorizationServer() {
+    const runtime = mcpOauthRuntime();
+    if (!runtime)
+        return unavailable();
+    return mcpAuthorizationServerMetadata(runtime);
+}
+export function handleMcpAuthorize(request) {
+    const runtime = mcpOauthRuntime();
+    if (!runtime)
+        return Promise.resolve(unavailable());
+    return beginAuthorization(request, runtime);
+}
+export function handleMcpToken(request) {
+    const runtime = mcpOauthRuntime();
+    if (!runtime)
+        return Promise.resolve(unavailable());
+    return handleTokenRequest(request, runtime);
+}
+//# sourceMappingURL=public.js.map

package/dist/mcp/public.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.js","sourceRoot":"","sources":["../../src/mcp/public.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,SAAS,WAAW;IAClB,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,gCAAgC,EAAE,EAC9E,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAC1D,CAAA;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAA;IACjC,IAAI,CAAC,OAAO;QAAE,OAAO,WAAW,EAAE,CAAA;IAClC,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAA;AACrC,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,MAAM,OAAO,GAAG,eAAe,EAAE,CAAA;IACjC,IAAI,CAAC,OAAO;QAAE,OAAO,WAAW,EAAE,CAAA;IAClC,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,MAAM,OAAO,GAAG,eAAe,EAAE,CAAA;IACjC,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;IACnD,OAAO,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,OAAO,GAAG,eAAe,EAAE,CAAA;IACjC,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;IACnD,OAAO,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AAC7C,CAAC"}

package/dist/mcp/runtime.d.ts

@@ -0,0 +1,4 @@
+import type { McpOauthRuntime } from './oauth-http.js';
+export declare function mcpSiteUrl(): string | null;
+export declare function mcpOauthRuntime(): McpOauthRuntime | null;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/mcp/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/mcp/runtime.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAa,MAAM,iBAAiB,CAAA;AAuBjE,wBAAgB,UAAU,IAAI,MAAM,GAAG,IAAI,CAM1C;AAED,wBAAgB,eAAe,IAAI,eAAe,GAAG,IAAI,CA4BxD"}

package/dist/mcp/runtime.js

@@ -0,0 +1,46 @@
+import { getAdminPath, getSessionSecret } from '../api/route-helpers/auth.js';
+import { getPrentaConfig } from '../config/runtime.js';
+import { getDB } from '../db.js';
+import { prismaGrantStore, prismaTransactionStore } from './prisma-store.js';
+export function mcpSiteUrl() {
+    const fromEnv = process.env.NEXT_PUBLIC_SITE_URL?.trim();
+    if (fromEnv)
+        return fromEnv.replace(/\/+$/, '');
+    const fromConfig = getPrentaConfig()?.seo?.siteUrl?.trim();
+    if (fromConfig)
+        return fromConfig.replace(/\/+$/, '');
+    return null;
+}
+export function mcpOauthRuntime() {
+    const siteUrl = mcpSiteUrl();
+    if (!siteUrl)
+        return null;
+    let secret = '';
+    try {
+        secret = getSessionSecret();
+    }
+    catch {
+        return null;
+    }
+    return {
+        siteUrl,
+        adminPath: getAdminPath(),
+        secret,
+        grants: prismaGrantStore(),
+        transactions: prismaTransactionStore(),
+        loadUser: async (userId) => {
+            const user = await getDB().user.findUnique({
+                where: { id: userId },
+                select: { id: true, role: true, isActive: true, suspendedAt: true, lockedAt: true },
+            });
+            if (!user)
+                return null;
+            return {
+                id: user.id,
+                role: user.role,
+                active: user.isActive !== false && !user.suspendedAt && !user.lockedAt,
+            };
+        },
+    };
+}
+//# sourceMappingURL=runtime.js.map

package/dist/mcp/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/mcp/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAwB5E,MAAM,UAAU,UAAU;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAA;IACxD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC/C,MAAM,UAAU,GAAG,eAAe,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1D,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACrD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,gBAAgB,EAAE,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO;QACL,OAAO;QACP,SAAS,EAAE,YAAY,EAAE;QACzB,MAAM;QACN,MAAM,EAAE,gBAAgB,EAAE;QAC1B,YAAY,EAAE,sBAAsB,EAAE;QACtC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAA6B,EAAE;YACpD,MAAM,IAAI,GAAG,MAAM,KAAK,EAAU,CAAC,IAAI,CAAC,UAAU,CAAC;gBACjD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;aACpF,CAAC,CAAA;YACF,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA;YACtB,OAAO;gBACL,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ;aACvE,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/mcp/transactions.d.ts

@@ -0,0 +1,18 @@
+export type OauthTransaction = {
+    id: string;
+    clientId: string;
+    clientName: string;
+    redirectUri: string;
+    resource: string;
+    scope: string;
+    codeChallenge: string;
+    state: string | null;
+    expiresAt: Date;
+};
+export interface TransactionStore {
+    put(row: OauthTransaction): Promise<void>;
+    get(id: string): Promise<OauthTransaction | null>;
+    delete(id: string): Promise<void>;
+}
+export declare function createMemoryTransactionStore(): TransactionStore;
+//# sourceMappingURL=transactions.d.ts.map

package/dist/mcp/transactions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transactions.d.ts","sourceRoot":"","sources":["../../src/mcp/transactions.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IACjD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClC;AAED,wBAAgB,4BAA4B,IAAI,gBAAgB,CAa/D"}

package/dist/mcp/transactions.js

@@ -0,0 +1,15 @@
+export function createMemoryTransactionStore() {
+    const rows = new Map();
+    return {
+        async put(row) {
+            rows.set(row.id, { ...row });
+        },
+        async get(id) {
+            return rows.get(id) ?? null;
+        },
+        async delete(id) {
+            rows.delete(id);
+        },
+    };
+}
+//# sourceMappingURL=transactions.js.map

package/dist/mcp/transactions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transactions.js","sourceRoot":"","sources":["../../src/mcp/transactions.ts"],"names":[],"mappings":"AAkBA,MAAM,UAAU,4BAA4B;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAA;IAChD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAA;QAC7B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACjB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/privacy/phi.d.ts

@@ -0,0 +1,5 @@
+import type { AuthSession } from '../api/route-helpers/auth.js';
+export declare function phiSafeguardsEnabled(): Promise<boolean>;
+export declare function phiDisclosureDenied(session: AuthSession): Promise<Response | null>;
+export declare function setPhiSafeguards(enabled: boolean, userId: string): Promise<void>;
+//# sourceMappingURL=phi.d.ts.map

package/dist/privacy/phi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phi.d.ts","sourceRoot":"","sources":["../../src/privacy/phi.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAgC/D,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAM7D;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQxF;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBtF"}