@roarpeng/graphflow 1.14.1 → 1.15.0

package/dist/security/rbac.js

@@ -0,0 +1,213 @@
+"use strict";
+/**
+ * Team HTTP RBAC — viewer | contributor | admin.
+ *
+ * Local-first surfaces (stdio, loopback file/sqlite, unauthenticated loopback
+ * HTTP) never consult this module. Shared HTTP surfaces fail closed: a missing
+ * role is a deny, not a silent grant.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TeamAuthorizationError = exports.TEAM_PERMISSIONS = exports.TEAM_ROLES = void 0;
+exports.isTeamRole = isTeamRole;
+exports.permissionsForRole = permissionsForRole;
+exports.roleSatisfies = roleSatisfies;
+exports.hasPermission = hasPermission;
+exports.roleFromScopes = roleFromScopes;
+exports.defaultScopesForRole = defaultScopesForRole;
+exports.permissionForTeamMethod = permissionForTeamMethod;
+exports.permissionForMcpTool = permissionForMcpTool;
+exports.authorizePermission = authorizePermission;
+exports.authorizeTeamMethod = authorizeTeamMethod;
+exports.authorizeMcpTool = authorizeMcpTool;
+exports.assertAuthorized = assertAuthorized;
+exports.TEAM_ROLES = ["viewer", "contributor", "admin"];
+exports.TEAM_PERMISSIONS = [
+    "graph.read",
+    "graph.write",
+    "graph.delete",
+    "skill.read",
+    "skill.sync",
+    "artifact.import",
+    "governance.mutate",
+    "diagnose.read",
+];
+const ROLE_RANK = {
+    viewer: 0,
+    contributor: 1,
+    admin: 2,
+};
+const ROLE_PERMISSIONS = {
+    viewer: ["graph.read", "skill.read", "diagnose.read"],
+    contributor: [
+        "graph.read",
+        "graph.write",
+        "skill.read",
+        "skill.sync",
+        "artifact.import",
+        "diagnose.read",
+    ],
+    admin: [
+        "graph.read",
+        "graph.write",
+        "graph.delete",
+        "skill.read",
+        "skill.sync",
+        "artifact.import",
+        "governance.mutate",
+        "diagnose.read",
+    ],
+};
+/** Graphify / team-memory JSON-RPC methods. */
+const TEAM_METHOD_PERMISSION = {
+    "graph.query_subgraph": "graph.read",
+    "graph.get_nodes": "graph.read",
+    "graph.get_neighbors": "graph.read",
+    "graph.read_snapshot": "graph.read",
+    "team.health": "diagnose.read",
+    "graph.upsert_nodes": "graph.write",
+    "graph.upsert_edges": "graph.write",
+    "graph.delete_node": "graph.delete",
+    "graph.delete_edge": "graph.delete",
+    "skill.sync_push": "skill.sync",
+    "skill.sync_pull": "skill.read",
+    "artifact.import": "artifact.import",
+    "governance.quarantine": "governance.mutate",
+    "governance.review": "governance.mutate",
+};
+/** GraphFlow MCP tool names on the shared HTTP surface. */
+const MCP_TOOL_PERMISSION = {
+    graphflow_context: "graph.read",
+    graphflow_diagnose: "diagnose.read",
+    graphflow_skill_insights: "skill.read",
+    graphflow_skill_guide: "diagnose.read",
+    graphflow_run: "graph.write",
+    graphflow_plan: "graph.write",
+    graphflow_index: "graph.write",
+    graphflow_insight: "graph.write",
+    graphflow_report_outcome: "graph.write",
+    graphflow_artifact: "artifact.import",
+};
+function isTeamRole(value) {
+    return typeof value === "string" && exports.TEAM_ROLES.includes(value);
+}
+function permissionsForRole(role) {
+    return ROLE_PERMISSIONS[role];
+}
+function roleSatisfies(actual, required) {
+    return ROLE_RANK[actual] >= ROLE_RANK[required];
+}
+function hasPermission(role, permission) {
+    if (!role)
+        return false;
+    return ROLE_PERMISSIONS[role].includes(permission);
+}
+/**
+ * Map JWT `scope` tokens (and a few aliases) to the strongest matching role.
+ * Unknown scopes are ignored — absence of a known role scope means unresolved.
+ */
+function roleFromScopes(scopes) {
+    let best;
+    for (const raw of scopes) {
+        const scope = raw.trim().toLowerCase();
+        if (!scope)
+            continue;
+        const mapped = mapScopeToken(scope);
+        if (!mapped)
+            continue;
+        if (!best || ROLE_RANK[mapped] > ROLE_RANK[best])
+            best = mapped;
+    }
+    return best;
+}
+function mapScopeToken(scope) {
+    if (scope === "memory:admin" ||
+        scope === "admin" ||
+        scope === "role:admin" ||
+        scope === "graphflow:admin") {
+        return "admin";
+    }
+    if (scope === "memory:write" ||
+        scope === "contributor" ||
+        scope === "role:contributor" ||
+        scope === "editor" ||
+        scope === "role:editor" ||
+        scope === "graphflow:write") {
+        return "contributor";
+    }
+    if (scope === "memory:read" ||
+        scope === "viewer" ||
+        scope === "role:viewer" ||
+        scope === "graphflow:read") {
+        return "viewer";
+    }
+    return undefined;
+}
+function defaultScopesForRole(role) {
+    if (role === "admin")
+        return "memory:read memory:write memory:admin";
+    if (role === "contributor")
+        return "memory:read memory:write";
+    return "memory:read";
+}
+function permissionForTeamMethod(method) {
+    return TEAM_METHOD_PERMISSION[method];
+}
+function permissionForMcpTool(toolName) {
+    return MCP_TOOL_PERMISSION[toolName];
+}
+function authorizePermission(role, permission, subject = "action") {
+    if (!role) {
+        return {
+            ok: false,
+            permission,
+            reason: `RBAC denied ${subject}: role unresolved (fail closed)`,
+        };
+    }
+    if (!hasPermission(role, permission)) {
+        return {
+            ok: false,
+            role,
+            permission,
+            reason: `RBAC denied ${subject}: role '${role}' lacks '${permission}'`,
+        };
+    }
+    return { ok: true, role, permission };
+}
+function authorizeTeamMethod(role, method) {
+    const permission = permissionForTeamMethod(method);
+    if (!permission) {
+        return {
+            ok: false,
+            ...(role ? { role } : {}),
+            reason: `RBAC denied ${method}: unknown method (fail closed)`,
+        };
+    }
+    return authorizePermission(role, permission, method);
+}
+function authorizeMcpTool(role, toolName) {
+    const permission = permissionForMcpTool(toolName);
+    if (!permission) {
+        return {
+            ok: false,
+            ...(role ? { role } : {}),
+            reason: `RBAC denied ${toolName}: unknown tool (fail closed)`,
+        };
+    }
+    return authorizePermission(role, permission, toolName);
+}
+class TeamAuthorizationError extends Error {
+    statusCode = 403;
+    decision;
+    constructor(decision) {
+        super(decision.reason ?? "RBAC denied");
+        this.name = "TeamAuthorizationError";
+        this.decision = decision;
+    }
+}
+exports.TeamAuthorizationError = TeamAuthorizationError;
+function assertAuthorized(decision) {
+    if (!decision.ok) {
+        throw new TeamAuthorizationError(decision);
+    }
+}
+//# sourceMappingURL=rbac.js.map

package/dist/security/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../src/security/rbac.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAoFH,gCAEC;AAED,gDAEC;AAED,sCAEC;AAED,sCAGC;AAMD,wCAUC;AAgCD,oDAIC;AAED,0DAEC;AAED,oDAEC;AAED,kDAqBC;AAED,kDAaC;AAED,4CAaC;AAaD,4CAIC;AAnOY,QAAA,UAAU,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAU,CAAC;AAGzD,QAAA,gBAAgB,GAAG;IAC9B,YAAY;IACZ,aAAa;IACb,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,mBAAmB;IACnB,eAAe;CACP,CAAC;AAGX,MAAM,SAAS,GAA6B;IAC1C,MAAM,EAAE,CAAC;IACT,WAAW,EAAE,CAAC;IACd,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,MAAM,gBAAgB,GAAgD;IACpE,MAAM,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,eAAe,CAAC;IACrD,WAAW,EAAE;QACX,YAAY;QACZ,aAAa;QACb,YAAY;QACZ,YAAY;QACZ,iBAAiB;QACjB,eAAe;KAChB;IACD,KAAK,EAAE;QACL,YAAY;QACZ,aAAa;QACb,cAAc;QACd,YAAY;QACZ,YAAY;QACZ,iBAAiB;QACjB,mBAAmB;QACnB,eAAe;KAChB;CACF,CAAC;AAEF,+CAA+C;AAC/C,MAAM,sBAAsB,GAAmC;IAC7D,sBAAsB,EAAE,YAAY;IACpC,iBAAiB,EAAE,YAAY;IAC/B,qBAAqB,EAAE,YAAY;IACnC,qBAAqB,EAAE,YAAY;IACnC,aAAa,EAAE,eAAe;IAC9B,oBAAoB,EAAE,aAAa;IACnC,oBAAoB,EAAE,aAAa;IACnC,mBAAmB,EAAE,cAAc;IACnC,mBAAmB,EAAE,cAAc;IACnC,iBAAiB,EAAE,YAAY;IAC/B,iBAAiB,EAAE,YAAY;IAC/B,iBAAiB,EAAE,iBAAiB;IACpC,uBAAuB,EAAE,mBAAmB;IAC5C,mBAAmB,EAAE,mBAAmB;CACzC,CAAC;AAEF,2DAA2D;AAC3D,MAAM,mBAAmB,GAAmC;IAC1D,iBAAiB,EAAE,YAAY;IAC/B,kBAAkB,EAAE,eAAe;IACnC,wBAAwB,EAAE,YAAY;IACtC,qBAAqB,EAAE,eAAe;IACtC,aAAa,EAAE,aAAa;IAC5B,cAAc,EAAE,aAAa;IAC7B,eAAe,EAAE,aAAa;IAC9B,iBAAiB,EAAE,aAAa;IAChC,wBAAwB,EAAE,aAAa;IACvC,kBAAkB,EAAE,iBAAiB;CACtC,CAAC;AASF,SAAgB,UAAU,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,kBAAgC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,SAAgB,kBAAkB,CAAC,IAAc;IAC/C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAgB,aAAa,CAAC,MAAgB,EAAE,QAAkB;IAChE,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,aAAa,CAAC,IAA0B,EAAE,UAA0B;IAClF,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,MAAyB;IACtD,IAAI,IAA0B,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,MAAM,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IACE,KAAK,KAAK,cAAc;QACxB,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,YAAY;QACtB,KAAK,KAAK,iBAAiB,EAC3B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IACE,KAAK,KAAK,cAAc;QACxB,KAAK,KAAK,aAAa;QACvB,KAAK,KAAK,kBAAkB;QAC5B,KAAK,KAAK,QAAQ;QAClB,KAAK,KAAK,aAAa;QACvB,KAAK,KAAK,iBAAiB,EAC3B,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IACE,KAAK,KAAK,aAAa;QACvB,KAAK,KAAK,QAAQ;QAClB,KAAK,KAAK,aAAa;QACvB,KAAK,KAAK,gBAAgB,EAC1B,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,oBAAoB,CAAC,IAAc;IACjD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,uCAAuC,CAAC;IACrE,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,0BAA0B,CAAC;IAC9D,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAgB,uBAAuB,CAAC,MAAc;IACpD,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,oBAAoB,CAAC,QAAgB;IACnD,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,SAAgB,mBAAmB,CACjC,IAA0B,EAC1B,UAA0B,EAC1B,OAAO,GAAG,QAAQ;IAElB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,EAAE,EAAE,KAAK;YACT,UAAU;YACV,MAAM,EAAE,eAAe,OAAO,iCAAiC;SAChE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,UAAU;YACV,MAAM,EAAE,eAAe,OAAO,WAAW,IAAI,YAAY,UAAU,GAAG;SACvE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACxC,CAAC;AAED,SAAgB,mBAAmB,CACjC,IAA0B,EAC1B,MAAc;IAEd,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,eAAe,MAAM,gCAAgC;SAC9D,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAgB,gBAAgB,CAC9B,IAA0B,EAC1B,QAAgB;IAEhB,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,eAAe,QAAQ,8BAA8B;SAC9D,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,MAAa,sBAAuB,SAAQ,KAAK;IACtC,UAAU,GAAG,GAAG,CAAC;IACjB,QAAQ,CAAwB;IAEzC,YAAY,QAA+B;QACzC,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AATD,wDASC;AAED,SAAgB,gBAAgB,CAAC,QAA+B;IAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC"}

package/dist/security/token-auth.d.ts

@@ -1,6 +1,9 @@
+import { type TeamRole } from "./rbac.js";
 export interface TokenAuthConfig {
     /** Shared-secret bearer tokens for local/team deployments. */
     bearerTokens?: readonly string[];
+    /** Optional role assignment for each bearer token value. */
+    bearerRoleMap?: Readonly<Record<string, TeamRole>>;
     /** HS256 JWT secret. */
     jwtSecret?: string;
     /** RS256/ES256 public key PEM for OIDC providers. */
@@ -9,15 +12,25 @@ export interface TokenAuthConfig {
     audience?: string;
     requiredScope?: string;
 }
-export declare function verifyAccessToken(authorizationHeader: string | undefined, config: TokenAuthConfig): Promise<{
+export interface AccessTokenResult {
     authenticated: boolean;
     subject?: string;
     reason?: string;
-}>;
+    role?: TeamRole;
+    scopes?: string[];
+}
+export declare function verifyAccessToken(authorizationHeader: string | undefined, config: TokenAuthConfig): Promise<AccessTokenResult>;
 export declare function issueLocalJwt(subject: string, secret: string, options?: {
     issuer?: string;
     audience?: string;
     scope?: string;
+    role?: TeamRole;
     ttlSeconds?: number;
 }): string;
+/** Parse `viewer:secret`, `admin:secret`, or `secret:admin` into token + role. Bare tokens have no role. */
+export declare function parseRoleTaggedBearer(raw: string): {
+    token: string;
+    role?: TeamRole;
+};
+export declare function credentialsConfigured(config: TokenAuthConfig | undefined): boolean;
 //# sourceMappingURL=token-auth.d.ts.map

package/dist/security/token-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-auth.d.ts","sourceRoot":"","sources":["../../src/security/token-auth.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAwCD,wBAAsB,iBAAiB,CACrC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC;IAAE,aAAa,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkDxE;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GACxF,MAAM,CAeR"}
+{"version":3,"file":"token-auth.d.ts","sourceRoot":"","sources":["../../src/security/token-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,QAAQ,EACd,MAAM,WAAW,CAAC;AAEnB,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,4DAA4D;IAC5D,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnD,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAkFD,wBAAsB,iBAAiB,CACrC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAqE5B;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CAChB,GACL,MAAM,CAkBR;AAED,4GAA4G;AAC5G,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;CAAE,CAcrF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAOlF"}

package/dist/security/token-auth.js

@@ -2,7 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyAccessToken = verifyAccessToken;
 exports.issueLocalJwt = issueLocalJwt;
+exports.parseRoleTaggedBearer = parseRoleTaggedBearer;
+exports.credentialsConfigured = credentialsConfigured;
 const node_crypto_1 = require("node:crypto");
+const rbac_js_1 = require("./rbac.js");
 function splitToken(token) {
     const parts = token.split(".");
     if (parts.length !== 3)
@@ -23,14 +26,54 @@ function secureEquals(left, right) {
     const b = Buffer.from(right);
     return a.length === b.length && (0, node_crypto_1.timingSafeEqual)(a, b);
 }
+function parseScopeList(value) {
+    if (typeof value === "string") {
+        return value.split(/[\s,]+/).map((item) => item.trim()).filter(Boolean);
+    }
+    if (Array.isArray(value)) {
+        return value.filter((item) => typeof item === "string" && item.trim().length > 0);
+    }
+    return [];
+}
+function roleFromClaims(payload) {
+    if ((0, rbac_js_1.isTeamRole)(payload.role))
+        return payload.role;
+    const roles = Array.isArray(payload.roles) ? payload.roles : [];
+    const fromRoles = (0, rbac_js_1.roleFromScopes)(roles.filter((item) => typeof item === "string"));
+    if (fromRoles)
+        return fromRoles;
+    return (0, rbac_js_1.roleFromScopes)([...parseScopeList(payload.scope), ...parseScopeList(payload.scp)]);
+}
+function bearerCandidates(config) {
+    const seen = new Set();
+    const out = [];
+    for (const token of config.bearerTokens ?? []) {
+        if (token && !seen.has(token)) {
+            seen.add(token);
+            out.push(token);
+        }
+    }
+    for (const token of Object.keys(config.bearerRoleMap ?? {})) {
+        if (token && !seen.has(token)) {
+            seen.add(token);
+            out.push(token);
+        }
+    }
+    return out;
+}
 async function verifyAccessToken(authorizationHeader, config) {
     if (!authorizationHeader?.startsWith("Bearer ")) {
         return { authenticated: false, reason: "missing bearer token" };
     }
     const token = authorizationHeader.slice(7).trim();
-    for (const expected of config.bearerTokens ?? []) {
+    for (const expected of bearerCandidates(config)) {
         if (expected && secureEquals(token, expected)) {
-            return { authenticated: true, subject: "bearer" };
+            const role = config.bearerRoleMap?.[expected];
+            return {
+                authenticated: true,
+                subject: "bearer",
+                ...(role ? { role } : {}),
+            };
         }
     }
     const jwt = splitToken(token);
@@ -54,6 +97,13 @@ async function verifyAccessToken(authorizationHeader, config) {
     }
     if (!verified)
         return { authenticated: false, reason: "signature rejected" };
+    const now = Math.floor(Date.now() / 1000);
+    if (typeof jwt.payload.exp === "number" && jwt.payload.exp < now) {
+        return { authenticated: false, reason: "token expired" };
+    }
+    if (typeof jwt.payload.nbf === "number" && jwt.payload.nbf > now) {
+        return { authenticated: false, reason: "token not yet valid" };
+    }
     if (config.issuer && jwt.payload.iss !== config.issuer) {
         return { authenticated: false, reason: "issuer rejected" };
     }
@@ -61,21 +111,30 @@ async function verifyAccessToken(authorizationHeader, config) {
     if (config.audience && !audience.includes(config.audience)) {
         return { authenticated: false, reason: "audience rejected" };
     }
-    const scopes = typeof jwt.payload.scope === "string" ? jwt.payload.scope.split(/\s+/) : [];
+    const scopes = [...parseScopeList(jwt.payload.scope), ...parseScopeList(jwt.payload.scp)];
     if (config.requiredScope && !scopes.includes(config.requiredScope)) {
         return { authenticated: false, reason: "scope rejected" };
     }
-    return { authenticated: true, subject: typeof jwt.payload.sub === "string" ? jwt.payload.sub : "jwt" };
+    const role = roleFromClaims(jwt.payload);
+    return {
+        authenticated: true,
+        subject: typeof jwt.payload.sub === "string" ? jwt.payload.sub : "jwt",
+        ...(role ? { role } : {}),
+        ...(scopes.length > 0 ? { scopes } : {}),
+    };
 }
 function issueLocalJwt(subject, secret, options = {}) {
     const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
     const now = Math.floor(Date.now() / 1000);
+    const role = options.role;
+    const scope = options.scope ?? (role ? (0, rbac_js_1.defaultScopesForRole)(role) : undefined);
     const header = encode({ alg: "HS256", typ: "JWT" });
     const payload = encode({
         sub: subject,
         ...(options.issuer ? { iss: options.issuer } : {}),
         ...(options.audience ? { aud: options.audience } : {}),
-        ...(options.scope ? { scope: options.scope } : {}),
+        ...(scope ? { scope } : {}),
+        ...(role ? { role } : {}),
         iat: now,
         exp: now + (options.ttlSeconds ?? 3600),
     });
@@ -83,4 +142,26 @@ function issueLocalJwt(subject, secret, options = {}) {
     const signature = (0, node_crypto_1.createHmac)("sha256", secret).update(data).digest("base64url");
     return `${data}.${signature}`;
 }
+/** Parse `viewer:secret`, `admin:secret`, or `secret:admin` into token + role. Bare tokens have no role. */
+function parseRoleTaggedBearer(raw) {
+    const trimmed = raw.trim();
+    const sep = trimmed.indexOf(":");
+    if (sep > 0) {
+        const left = trimmed.slice(0, sep).trim();
+        const right = trimmed.slice(sep + 1).trim();
+        if (right && (0, rbac_js_1.isTeamRole)(left.toLowerCase())) {
+            return { token: right, role: left.toLowerCase() };
+        }
+        if (left && (0, rbac_js_1.isTeamRole)(right.toLowerCase())) {
+            return { token: left, role: right.toLowerCase() };
+        }
+    }
+    return { token: trimmed };
+}
+function credentialsConfigured(config) {
+    return Boolean(config?.bearerTokens?.length ||
+        (config?.bearerRoleMap && Object.keys(config.bearerRoleMap).length > 0) ||
+        config?.jwtSecret ||
+        config?.publicKeyPem);
+}
 //# sourceMappingURL=token-auth.js.map

package/dist/security/token-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-auth.js","sourceRoot":"","sources":["../../src/security/token-auth.ts"],"names":[],"mappings":";;AAoDA,8CAqDC;AAED,sCAmBC;AA9HD,6CAAmG;AAgCnG,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc;YACrF,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc;YACtF,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC;SAC/C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,mBAAuC,EACvC,MAAuB;IAEvB,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAElD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,QAAQ,IAAI,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAChF,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IAClG,CAAC;SAAM,IACL,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC;QAC5D,MAAM,CAAC,YAAY,EACnB,CAAC;QACD,IAAI,CAAC;YACH,QAAQ,GAAG,IAAA,oBAAY,EACrB,GAAG,CAAC,MAAM,CAAC,GAAG,EACd,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACnB,IAAA,6BAAe,EAAC,MAAM,CAAC,YAAY,CAAC,EACpC,GAAG,CAAC,SAAS,CACd,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAE7E,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACvD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AACzG,CAAC;AAED,SAAgB,aAAa,CAC3B,OAAe,EACf,MAAc,EACd,UAAuF,EAAE;IAEzF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC;QACrB,GAAG,EAAE,OAAO;QACZ,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChF,OAAO,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"token-auth.js","sourceRoot":"","sources":["../../src/security/token-auth.ts"],"names":[],"mappings":";;AA8GA,8CAwEC;AAED,sCA4BC;AAGD,sDAcC;AAED,sDAOC;AA9OD,6CAAmG;AACnG,uCAKmB;AAgDnB,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc;YACrF,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc;YACtF,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC;SAC/C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,OAAkB;IACxC,IAAI,IAAA,oBAAU,EAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,IAAA,wBAAc,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC;IACnG,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,IAAA,wBAAc,EAAC,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAuB;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC9C,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5D,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,mBAAuC,EACvC,MAAuB;IAEvB,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAElD,KAAK,MAAM,QAAQ,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,IAAI,QAAQ,IAAI,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC9C,OAAO;gBACL,aAAa,EAAE,IAAI;gBACnB,OAAO,EAAE,QAAQ;gBACjB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAChF,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IAClG,CAAC;SAAM,IACL,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC;QAC5D,MAAM,CAAC,YAAY,EACnB,CAAC;QACD,IAAI,CAAC;YACH,QAAQ,GAAG,IAAA,oBAAY,EACrB,GAAG,CAAC,MAAM,CAAC,GAAG,EACd,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACnB,IAAA,6BAAe,EAAC,MAAM,CAAC,YAAY,CAAC,EACpC,GAAG,CAAC,SAAS,CACd,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAE7E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;QACjE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;QACjE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACvD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK;QACtE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAC3B,OAAe,EACf,MAAc,EACd,UAMI,EAAE;IAEN,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,8BAAoB,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC;QACrB,GAAG,EAAE,OAAO;QACZ,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChF,OAAO,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,4GAA4G;AAC5G,SAAgB,qBAAqB,CAAC,GAAW;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,KAAK,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAc,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,IAAI,IAAI,IAAA,oBAAU,EAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAc,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,SAAgB,qBAAqB,CAAC,MAAmC;IACvE,OAAO,OAAO,CACZ,MAAM,EAAE,YAAY,EAAE,MAAM;QAC1B,CAAC,MAAM,EAAE,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACvE,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,YAAY,CACvB,CAAC;AACJ,CAAC"}

package/dist/surfaces/cli/index.js

@@ -31,6 +31,10 @@ async function executeCommand(command, args, configPath) {
     if (command === "doctor") {
         const { buildDoctorReport, formatDoctorLegacyText } = require("./init");
         const data = buildDoctorReport(process.cwd());
+        if (data.team?.enabled) {
+            const { probeTeamDiagnosis } = await import("../team/diagnose.js");
+            data.team = await probeTeamDiagnosis(configPath);
+        }
         if (!data.ok) {
             process.exitCode = 1;
         }
@@ -59,9 +63,22 @@ async function executeCommand(command, args, configPath) {
             legacyText: `MCP removal complete`,
         };
     }
+    if (command === "team") {
+        return executeTeamCommand(args);
+    }
+    if (command === "diagnose") {
+        const data = (0, runtime_1.diagnoseRoutingResult)(configPath);
+        const { probeTeamDiagnosis } = await import("../team/diagnose.js");
+        data.team = await probeTeamDiagnosis(configPath);
+        return {
+            command: "diagnose",
+            data,
+            legacyText: (0, runtime_1.diagnoseRouting)(configPath, data),
+        };
+    }
     if (command === "mcp" && args[0] === "serve") {
         if (!args.includes("--http")) {
-            console.log("Usage: graphflow mcp serve --http [--host <host>] [--port <port>] [--endpoint </path>] [--stateful] [--sse-only]");
+            console.log("Usage: graphflow mcp serve --http [--host <host>] [--port <port>] [--endpoint </path>] [--stateful] [--sse-only] [--http-token <role:token>] [--rbac]");
             process.exitCode = 1;
             return undefined;
         }
@@ -584,16 +601,27 @@ async function executeCommand(command, args, configPath) {
         // overwrite semantics. Team golden queries ride along and merge into
         // `.graphflow/team-golden.json` (dedupe by text, local-first order).
         const directionArg = args[1]?.trim().toLowerCase();
-        if (directionArg !== "export" && directionArg !== "import") {
-            console.log("Usage: graphflow skill sync <export|import> [--path <file>] [--force]");
+        if (directionArg !== "export" && directionArg !== "import" && directionArg !== "push" && directionArg !== "pull") {
+            console.log("Usage: graphflow skill sync <export|import|push|pull> [--path <file>] [--force]");
             console.log("  import MERGES per-skill-id: newer updatedAt wins; ties keep local; --force overwrites.");
             console.log("  team golden queries ride along -> .graphflow/team-golden.json (dedupe, local-first).");
+            console.log("  push/pull use graphPolicy.mcpEndpoint (mcp-http team server) and keep MERGE on pull.");
             process.exitCode = 1;
             return undefined;
         }
         const pathIdx = args.indexOf("--path");
         const customPath = pathIdx >= 0 ? args[pathIdx + 1]?.trim() : undefined;
         const force = args.includes("--force");
+        if (directionArg === "push" || directionArg === "pull") {
+            const data = await (0, runtime_1.syncSkillPackageRemote)(configPath, directionArg, { force });
+            return {
+                command: "skill-sync",
+                data,
+                legacyText: data.direction === "push"
+                    ? `direction=push; path=${data.path}; skillCount=${data.skillCount ?? 0}; revision=${data.revision ?? 0}`
+                    : `direction=pull; path=${data.path}; imported=${data.imported ?? 0}; skipped=${data.skipped ?? 0}; updated=${data.updated ?? 0}; revision=${data.revision ?? 0}`,
+            };
+        }
         const data = await (0, runtime_1.syncSkillPackageRuntime)(configPath, directionArg, customPath, { force });
         return {
             command: "skill-sync",
@@ -721,10 +749,12 @@ async function executeCommand(command, args, configPath) {
     }
     if (command === "route" && args[0] === "diagnose") {
         const data = (0, runtime_1.diagnoseRoutingResult)(configPath);
+        const { probeTeamDiagnosis } = await import("../team/diagnose.js");
+        data.team = await probeTeamDiagnosis(configPath);
         return {
             command: "route-diagnose",
             data,
-            legacyText: (0, runtime_1.diagnoseRouting)(configPath),
+            legacyText: (0, runtime_1.diagnoseRouting)(configPath, data),
         };
     }
     if (command === "artifact" && args[0] === "export") {
@@ -1109,6 +1139,51 @@ main().catch((error) => {
     console.error("GraphFlow execution failed:", error);
     process.exitCode = 1;
 });
+async function executeTeamCommand(args) {
+    const sub = args[0]?.trim();
+    if (sub === "serve") {
+        const { startTeamServerFromArgv } = await import("../team/ops.js");
+        const started = await startTeamServerFromArgv(args.slice(1));
+        const { httpServer: _httpServer, close: _close, ...data } = started;
+        return {
+            command: "team-serve",
+            data,
+            legacyText: `GraphFlow team memory listening on ${data.url} ` +
+                `(auth=${data.requireAuth ? "required" : "optional"}; rbac=on; store=${data.storeRoot})`,
+        };
+    }
+    if (sub === "issue-token") {
+        const { issueTeamTokenFromArgv } = await import("../team/ops.js");
+        const data = issueTeamTokenFromArgv(args.slice(1));
+        return {
+            command: "team-issue-token",
+            data,
+            legacyText: `subject=${data.subject}; role=${data.role}; ttl=${data.ttlSeconds}; token=${data.token}`,
+        };
+    }
+    if (sub === "example-config") {
+        const { buildTeamClientExampleConfig } = await import("../team/ops.js");
+        const endpoint = (0, output_1.readCliFlagValue)(args, "--endpoint");
+        const tenant = (0, output_1.readCliFlagValue)(args, "--tenant");
+        const apiKey = (0, output_1.readCliFlagValue)(args, "--api-key");
+        const data = buildTeamClientExampleConfig({
+            ...(endpoint ? { endpoint } : {}),
+            ...(tenant ? { tenant } : {}),
+            ...(apiKey ? { apiKey } : {}),
+        });
+        return {
+            command: "team-example-config",
+            data,
+            legacyText: JSON.stringify(data, null, 2),
+        };
+    }
+    console.log("Usage: graphflow team <serve|issue-token|example-config>");
+    console.log("  team serve [--host <host>] [--port <port>] [--store <dir>] [--http-token <role:token>] [--http-jwt-secret <secret>] [--allow-tenant <id>]");
+    console.log("  team issue-token --subject <id> --role <viewer|contributor|admin> [--secret <jwt>] [--ttl <seconds>]");
+    console.log("  team example-config [--endpoint <url>] [--tenant <id>]");
+    process.exitCode = 1;
+    return undefined;
+}
 function buildInsightLegacyText(data) {
     const lines = [];
     lines.push("=== Six Thinking Hats Insight ===");