@samanhappy/mcphub 1.0.4 → 1.0.6

package/dist/services/hostedAuthService.js

@@ -0,0 +1,314 @@
+import { randomUUID } from 'node:crypto';
+import { getHostedUserState, HostedControlPlaneError, reserveHostedCredit, settleHostedCredit, validateHostedApiKey, } from './hostedControlPlaneClient.js';
+import { isHostedModeEnabled } from './hostedMode.js';
+import { getHostedNodeIdentity } from './hostedNodeIdentity.js';
+import { safeCompare } from '../utils/safeCompare.js';
+const KEY_PREFIX = 'mcphub-sk';
+const API_KEY_PREFIX_CHARS = 12;
+const DEFAULT_CACHE_TTL_SECONDS = 30;
+const DEFAULT_STALE_TTL_MS = 60 * 60 * 1000;
+const MAX_CACHE_ENTRIES = 1000;
+const CACHE_CLEANUP_INTERVAL_MS = 5 * 60 * 1000;
+export class HostedAuthorizationError extends Error {
+    constructor(message, code = 'hosted_forbidden') {
+        super(message);
+        this.code = code;
+        this.name = 'HostedAuthorizationError';
+    }
+}
+export class HostedAuthUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'HostedAuthUnavailableError';
+    }
+}
+function createVerificationToken(apiKey) {
+    return apiKey;
+}
+function matchesVerificationToken(apiKey, verificationToken) {
+    return safeCompare(apiKey, verificationToken);
+}
+class MemoryHostedAuthStateCache {
+    constructor() {
+        this.keyCache = new Map();
+        this.userCacheIndex = new Map();
+        this.apiKeyIdCacheIndex = new Map();
+    }
+    get(prefix) {
+        return this.keyCache.get(prefix);
+    }
+    set(prefix, entry) {
+        this.remove(prefix);
+        this.keyCache.set(prefix, entry);
+        this.addIndexedPrefix(this.userCacheIndex, entry.userId, prefix);
+        this.addIndexedPrefix(this.apiKeyIdCacheIndex, entry.apiKeyId, prefix);
+        this.prune();
+    }
+    touch(prefix, entry) {
+        this.keyCache.delete(prefix);
+        this.keyCache.set(prefix, entry);
+    }
+    remove(prefix) {
+        const existing = this.keyCache.get(prefix);
+        if (!existing)
+            return;
+        this.keyCache.delete(prefix);
+        this.removeIndexedPrefix(this.userCacheIndex, existing.userId, prefix);
+        this.removeIndexedPrefix(this.apiKeyIdCacheIndex, existing.apiKeyId, prefix);
+    }
+    invalidateUser(userId) {
+        const prefixes = this.userCacheIndex.get(userId);
+        if (!prefixes)
+            return;
+        for (const prefix of [...prefixes]) {
+            this.remove(prefix);
+        }
+    }
+    invalidateApiKeyId(apiKeyId) {
+        const prefixes = this.apiKeyIdCacheIndex.get(apiKeyId);
+        if (!prefixes)
+            return;
+        for (const prefix of [...prefixes]) {
+            this.remove(prefix);
+        }
+    }
+    prune(now = Date.now()) {
+        for (const [prefix, entry] of this.keyCache.entries()) {
+            if (entry.staleUntil <= now) {
+                this.remove(prefix);
+            }
+        }
+        while (this.keyCache.size > MAX_CACHE_ENTRIES) {
+            const oldestPrefix = this.keyCache.keys().next().value;
+            if (!oldestPrefix)
+                break;
+            this.remove(oldestPrefix);
+        }
+    }
+    size() {
+        return this.keyCache.size;
+    }
+    addIndexedPrefix(index, key, prefix) {
+        const prefixes = index.get(key);
+        if (prefixes) {
+            prefixes.add(prefix);
+            return;
+        }
+        index.set(key, new Set([prefix]));
+    }
+    removeIndexedPrefix(index, key, prefix) {
+        const prefixes = index.get(key);
+        if (!prefixes)
+            return;
+        prefixes.delete(prefix);
+        if (prefixes.size === 0) {
+            index.delete(key);
+        }
+    }
+}
+const authStateCache = new MemoryHostedAuthStateCache();
+const cacheCleanupTimer = setInterval(() => {
+    authStateCache.prune();
+}, CACHE_CLEANUP_INTERVAL_MS);
+cacheCleanupTimer.unref?.();
+export function isHostedApiKey(value) {
+    return Boolean(value?.startsWith(`${KEY_PREFIX}-`));
+}
+function extractApiKeyPrefix(key) {
+    const prefix = `${KEY_PREFIX}-`;
+    if (!key.startsWith(prefix))
+        return null;
+    const token = key.slice(prefix.length);
+    if (token.length < API_KEY_PREFIX_CHARS)
+        return null;
+    return token.slice(0, API_KEY_PREFIX_CHARS);
+}
+function projectState(validation, state, apiKey) {
+    const matchingKey = state.apiKeys.find((key) => key.id === validation.apiKeyId);
+    const ttlSeconds = Math.max(1, state.cacheTtlSeconds || validation.cacheTtlSeconds || DEFAULT_CACHE_TTL_SECONDS);
+    const now = Date.now();
+    const entry = {
+        userId: validation.userId,
+        apiKeyId: validation.apiKeyId,
+        apiKeyPrefix: validation.prefix,
+        verificationToken: createVerificationToken(apiKey),
+        scopeSlugs: matchingKey?.scopeSlugs ?? validation.scopeSlugs,
+        contentRecordingEnabled: state.contentRecordingEnabled || validation.contentRecordingEnabled,
+        subscriptions: state.subscriptions.map((subscription) => ({
+            serverSlug: subscription.serverSlug,
+            tools: subscription.tools ?? 'all',
+            byokCredentialId: subscription.byokCredentialId,
+        })),
+        expiresAt: now + ttlSeconds * 1000,
+        staleUntil: now + DEFAULT_STALE_TTL_MS,
+    };
+    Object.defineProperty(entry, 'verificationToken', {
+        value: entry.verificationToken,
+        enumerable: false,
+        writable: true,
+        configurable: true,
+    });
+    return entry;
+}
+async function loadFreshContext(apiKey, prefix) {
+    const validation = await validateHostedApiKey(apiKey);
+    if (!validation.valid || !validation.userId || !validation.apiKeyId || !validation.prefix) {
+        authStateCache.remove(prefix);
+        return null;
+    }
+    const state = await getHostedUserState(validation.userId);
+    const entry = projectState({
+        userId: validation.userId,
+        apiKeyId: validation.apiKeyId,
+        prefix: validation.prefix,
+        scopeSlugs: validation.scopeSlugs,
+        contentRecordingEnabled: validation.contentRecordingEnabled,
+        cacheTtlSeconds: validation.cacheTtlSeconds,
+    }, state, apiKey);
+    authStateCache.set(prefix, entry);
+    return entry;
+}
+function publicContext(entry) {
+    return {
+        userId: entry.userId,
+        apiKeyId: entry.apiKeyId,
+        apiKeyPrefix: entry.apiKeyPrefix,
+        scopeSlugs: entry.scopeSlugs,
+        contentRecordingEnabled: entry.contentRecordingEnabled,
+        subscriptions: entry.subscriptions,
+    };
+}
+export async function validateHostedBearer(apiKey) {
+    if (!isHostedModeEnabled() || !isHostedApiKey(apiKey)) {
+        return null;
+    }
+    const prefix = extractApiKeyPrefix(apiKey);
+    if (!prefix)
+        return null;
+    authStateCache.prune();
+    const cached = authStateCache.get(prefix);
+    if (cached &&
+        Date.now() < cached.expiresAt &&
+        matchesVerificationToken(apiKey, cached.verificationToken)) {
+        authStateCache.touch(prefix, cached);
+        return publicContext(cached);
+    }
+    try {
+        const fresh = await loadFreshContext(apiKey, prefix);
+        return fresh ? publicContext(fresh) : null;
+    }
+    catch (error) {
+        if (cached &&
+            Date.now() < cached.staleUntil &&
+            matchesVerificationToken(apiKey, cached.verificationToken)) {
+            console.warn('[hosted] control plane unavailable, serving stale cached auth state', {
+                error: String(error),
+            });
+            authStateCache.touch(prefix, cached);
+            return publicContext(cached);
+        }
+        if (error instanceof HostedControlPlaneError) {
+            throw new HostedAuthUnavailableError(error.message);
+        }
+        throw error;
+    }
+}
+function findSubscription(context, serverSlug) {
+    return (context.subscriptions.find((subscription) => subscription.serverSlug === serverSlug) ?? null);
+}
+export function assertHostedToolAllowed(context, serverSlug, toolName) {
+    if (!context)
+        return;
+    if (context.scopeSlugs && !context.scopeSlugs.includes(serverSlug)) {
+        throw new HostedAuthorizationError('API key is not scoped for this hosted server');
+    }
+    const subscription = findSubscription(context, serverSlug);
+    if (!subscription) {
+        throw new HostedAuthorizationError('User is not subscribed to this hosted server');
+    }
+    if (subscription.tools !== 'all' && !subscription.tools.includes(toolName)) {
+        throw new HostedAuthorizationError('Tool is not enabled in this hosted toolset');
+    }
+}
+export function filterHostedTools(context, serverSlug, tools, nameSeparator) {
+    if (!context)
+        return tools;
+    if (context.scopeSlugs && !context.scopeSlugs.includes(serverSlug))
+        return [];
+    const subscription = findSubscription(context, serverSlug);
+    if (!subscription)
+        return [];
+    if (subscription.tools === 'all')
+        return tools;
+    const prefix = `${serverSlug}${nameSeparator}`;
+    return tools.filter((tool) => {
+        const cleanName = tool.name.startsWith(prefix) ? tool.name.slice(prefix.length) : tool.name;
+        return subscription.tools !== 'all' && subscription.tools.includes(cleanName);
+    });
+}
+export async function reserveHostedToolCall(context, serverSlug, toolName) {
+    if (!context)
+        return null;
+    assertHostedToolAllowed(context, serverSlug, toolName);
+    const hubRequestId = randomUUID();
+    const reservation = await reserveHostedCredit({
+        userId: context.userId,
+        apiKeyId: context.apiKeyId,
+        serverSlug,
+        toolName,
+        hubRequestId,
+    });
+    return {
+        reservationId: reservation.reservationId,
+        hubRequestId,
+        userId: context.userId,
+        apiKeyId: context.apiKeyId,
+        serverSlug,
+        toolName,
+        estimatedCostMillicents: reservation.estimatedCostMillicents,
+        contentRecordingEnabled: context.contentRecordingEnabled,
+    };
+}
+export async function settleHostedToolCall(reservation, input) {
+    if (!reservation)
+        return;
+    try {
+        const nodeIdentity = getHostedNodeIdentity();
+        await settleHostedCredit({
+            reservationId: reservation.reservationId,
+            hubEventId: randomUUID(),
+            success: input.success,
+            latencyMs: input.latencyMs,
+            occurredAt: new Date().toISOString(),
+            costMillicents: input.success ? reservation.estimatedCostMillicents : 0,
+            metadata: {
+                ...(input.metadata ?? {}),
+                hubRequestId: reservation.hubRequestId,
+                hubClusterId: nodeIdentity.clusterId,
+                hubNodeId: nodeIdentity.nodeId,
+                serverSlug: reservation.serverSlug,
+                toolName: reservation.toolName,
+            },
+            requestContent: reservation.contentRecordingEnabled ? input.requestContent : undefined,
+            responseContent: reservation.contentRecordingEnabled ? input.responseContent : undefined,
+        });
+    }
+    catch (error) {
+        console.warn('[hosted] failed to settle hosted tool call', {
+            reservationId: reservation.reservationId,
+            error: String(error),
+        });
+    }
+}
+export function applyHostedWebhookEvent(event) {
+    if (event.type === 'api_key.created' && event.prefix) {
+        authStateCache.remove(event.prefix);
+        return;
+    }
+    if (event.type === 'api_key.revoked' && event.keyId) {
+        authStateCache.invalidateApiKeyId(event.keyId);
+        return;
+    }
+    authStateCache.invalidateUser(event.userId);
+}
+//# sourceMappingURL=hostedAuthService.js.map

package/dist/services/hostedAuthService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostedAuthService.js","sourceRoot":"","sources":["../../src/services/hostedAuthService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,MAAM,UAAU,GAAG,WAAW,CAAC;AAC/B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AA6ChD,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YACE,OAAe,EACN,OAAO,kBAAkB;QAElC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,SAAI,GAAJ,IAAI,CAAqB;QAGlC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,SAAS,uBAAuB,CAAC,MAAc;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAc,EAAE,iBAAyB;IACzE,OAAO,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,0BAA0B;IAAhC;QACmB,aAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;QAC/C,mBAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;QAChD,uBAAkB,GAAG,IAAI,GAAG,EAAuB,CAAC;IAmFvE,CAAC;IAjFC,GAAG,CAAC,MAAc;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,GAAG,CAAC,MAAc,EAAE,KAAuB;QACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAc,EAAE,KAAuB;QAC3C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/E,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,QAAgB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACpB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACtD,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAA2B,CAAC;YAC7E,IAAI,CAAC,YAAY;gBAAE,MAAM;YACzB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAEO,gBAAgB,CAAC,KAA+B,EAAE,GAAW,EAAE,MAAc;QACnF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAEO,mBAAmB,CAAC,KAA+B,EAAE,GAAW,EAAE,MAAc;QACtF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;CACF;AAED,MAAM,cAAc,GAAyB,IAAI,0BAA0B,EAAE,CAAC;AAE9E,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE;IACzC,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC,EAAE,yBAAyB,CAAC,CAAC;AAE9B,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC;AAE5B,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,OAAO,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CACnB,UAOC,EACD,KAAwB,EACxB,MAAc;IAEd,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CACzB,CAAC,EACD,KAAK,CAAC,eAAe,IAAI,UAAU,CAAC,eAAe,IAAI,yBAAyB,CACjF,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAqB;QAC9B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,YAAY,EAAE,UAAU,CAAC,MAAM;QAC/B,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;QAClD,UAAU,EAAE,WAAW,EAAE,UAAU,IAAI,UAAU,CAAC,UAAU;QAC5D,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,IAAI,UAAU,CAAC,uBAAuB;QAC5F,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YACxD,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,KAAK;YAClC,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;SAChD,CAAC,CAAC;QACH,SAAS,EAAE,GAAG,GAAG,UAAU,GAAG,IAAI;QAClC,UAAU,EAAE,GAAG,GAAG,oBAAoB;KACvC,CAAC;IAEF,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE;QAChD,KAAK,EAAE,KAAK,CAAC,iBAAiB;QAC9B,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAc;IAC5D,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC1F,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,YAAY,CACxB;QACE,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;QAC3D,eAAe,EAAE,UAAU,CAAC,eAAe;KAC5C,EACD,KAAK,EACL,MAAM,CACP,CAAC;IACF,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAuB;IAC5C,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,cAAc,CAAC,KAAK,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IACE,MAAM;QACN,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS;QAC7B,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAC1D,CAAC;QACD,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,MAAM;YACN,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU;YAC9B,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAC1D,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,qEAAqE,EAAE;gBAClF,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;aACrB,CAAC,CAAC;YACH,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;YAC7C,MAAM,IAAI,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,OAA0B,EAC1B,UAAkB;IAElB,OAAO,CACL,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,KAAK,UAAU,CAAC,IAAI,IAAI,CAC7F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAsC,EACtC,UAAkB,EAClB,QAAgB;IAEhB,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,wBAAwB,CAAC,8CAA8C,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,wBAAwB,CAAC,8CAA8C,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,YAAY,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,wBAAwB,CAAC,4CAA4C,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAsC,EACtC,UAAkB,EAClB,KAAU,EACV,aAAqB;IAErB,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAE9E,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,YAAY,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAE/C,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,aAAa,EAAE,CAAC;IAC/C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5F,OAAO,YAAY,CAAC,KAAK,KAAK,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAsC,EACtC,UAAkB,EAClB,QAAgB;IAEhB,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC;QAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU;QACV,QAAQ;QACR,YAAY;KACb,CAAC,CAAC;IAEH,OAAO;QACL,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,YAAY;QACZ,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU;QACV,QAAQ;QACR,uBAAuB,EAAE,WAAW,CAAC,uBAAuB;QAC5D,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;KACzD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAA2C,EAC3C,KAMC;IAED,IAAI,CAAC,WAAW;QAAE,OAAO;IAEzB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;QAC7C,MAAM,kBAAkB,CAAC;YACvB,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,UAAU,EAAE,UAAU,EAAE;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;YACvE,QAAQ,EAAE;gBACR,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACzB,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,YAAY,EAAE,YAAY,CAAC,SAAS;gBACpC,SAAS,EAAE,YAAY,CAAC,MAAM;gBAC9B,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,QAAQ,EAAE,WAAW,CAAC,QAAQ;aAC/B;YACD,cAAc,EAAE,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;YACtF,eAAe,EAAE,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;SACzF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,4CAA4C,EAAE;YACzD,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;SACrB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAsB;IAC5D,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACrD,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACpD,cAAc,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IAED,cAAc,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC"}

package/dist/services/hostedControlPlaneClient.js

@@ -0,0 +1,90 @@
+import { REDACTED_SIGNATURE_VALUE, signInternalRequest, SIGNATURE_HEADER, TIMESTAMP_HEADER, } from './hostedInternalAuth.js';
+export class HostedControlPlaneError extends Error {
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'HostedControlPlaneError';
+    }
+}
+function controlPlaneBaseUrl() {
+    const raw = process.env.HOSTED_CONTROL_PLANE_URL || process.env.MCPHUB_APP_URL;
+    if (!raw) {
+        throw new HostedControlPlaneError('HOSTED_CONTROL_PLANE_URL is not configured');
+    }
+    return raw.replace(/\/+$/, '');
+}
+const VALIDATE_API_KEY_METHOD = 'POST';
+const VALIDATE_API_KEY_PATH = '/api/internal/v1/keys/validate';
+const REDACTED_VALIDATE_API_KEY_SIGNATURE_BODY = `{"apiKey":"${REDACTED_SIGNATURE_VALUE}"}`;
+function createSignedControlPlaneHeaders(method, path, body) {
+    const { timestamp, signature } = signInternalRequest(method, path, body);
+    return {
+        [TIMESTAMP_HEADER]: timestamp,
+        [SIGNATURE_HEADER]: signature,
+    };
+}
+function createValidateHostedApiKeyAuthHeaders() {
+    const { timestamp, signature } = signInternalRequest(VALIDATE_API_KEY_METHOD, VALIDATE_API_KEY_PATH, REDACTED_VALIDATE_API_KEY_SIGNATURE_BODY);
+    return {
+        [TIMESTAMP_HEADER]: timestamp,
+        [SIGNATURE_HEADER]: signature,
+    };
+}
+async function parseControlPlaneResponse(response, method, path) {
+    const envelope = (await response.json().catch(() => null));
+    if (!response.ok || !envelope?.success) {
+        throw new HostedControlPlaneError(envelope?.message || `Control plane request failed: ${method} ${path}`, response.status, envelope?.code);
+    }
+    return envelope.data;
+}
+async function requestControlPlane(method, path, authHeaders, body) {
+    const bodyText = body === undefined ? '' : JSON.stringify(body);
+    const response = await fetch(`${controlPlaneBaseUrl()}${path}`, {
+        method,
+        headers: {
+            ...authHeaders,
+            ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
+        },
+        body: body === undefined ? undefined : bodyText,
+        signal: AbortSignal.timeout(Number(process.env.HOSTED_CONTROL_PLANE_TIMEOUT_MS || 5000)),
+    });
+    return parseControlPlaneResponse(response, method, path);
+}
+export async function validateHostedApiKey(apiKey) {
+    const body = {
+        apiKey,
+    };
+    const response = await fetch(`${controlPlaneBaseUrl()}${VALIDATE_API_KEY_PATH}`, {
+        method: VALIDATE_API_KEY_METHOD,
+        headers: {
+            ...createValidateHostedApiKeyAuthHeaders(),
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(Number(process.env.HOSTED_CONTROL_PLANE_TIMEOUT_MS || 5000)),
+    });
+    return parseControlPlaneResponse(response, VALIDATE_API_KEY_METHOD, VALIDATE_API_KEY_PATH);
+}
+export async function getHostedUserState(userId) {
+    const method = 'GET';
+    const path = `/api/internal/v1/users/${encodeURIComponent(userId)}/state`;
+    return requestControlPlane(method, path, createSignedControlPlaneHeaders(method, path));
+}
+export async function reserveHostedCredit(input) {
+    const method = 'POST';
+    const path = '/api/internal/v1/credits/reserve';
+    return requestControlPlane(method, path, createSignedControlPlaneHeaders(method, path, {
+        userId: input.userId,
+        apiKeyId: REDACTED_SIGNATURE_VALUE,
+        serverSlug: input.serverSlug,
+        toolName: input.toolName,
+        hubRequestId: input.hubRequestId,
+    }), input);
+}
+export async function settleHostedCredit(input) {
+    const method = 'POST';
+    const path = '/api/internal/v1/credits/settle';
+    return requestControlPlane(method, path, createSignedControlPlaneHeaders(method, path, input), input);
+}
+//# sourceMappingURL=hostedControlPlaneClient.js.map

package/dist/services/hostedControlPlaneClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostedControlPlaneClient.js","sourceRoot":"","sources":["../../src/services/hostedControlPlaneClient.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAyEjC,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YACE,OAAe,EACN,MAAe,EACf,IAAa;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAS;QACf,SAAI,GAAJ,IAAI,CAAS;QAGtB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,SAAS,mBAAmB;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC/E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAOD,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,qBAAqB,GAAG,gCAAgC,CAAC;AAC/D,MAAM,wCAAwC,GAAG,cAAc,wBAAwB,IAAI,CAAC;AAE5F,SAAS,+BAA+B,CACtC,MAAc,EACd,IAAY,EACZ,IAAc;IAEd,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzE,OAAO;QACL,CAAC,gBAAgB,CAAC,EAAE,SAAS;QAC7B,CAAC,gBAAgB,CAAC,EAAE,SAAS;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC;IAC5C,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAClD,uBAAuB,EACvB,qBAAqB,EACrB,wCAAwC,CACzC,CAAC;IAEF,OAAO;QACL,CAAC,gBAAgB,CAAC,EAAE,SAAS;QAC7B,CAAC,gBAAgB,CAAC,EAAE,SAAS;KAC9B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,QAAkB,EAClB,MAAc,EACd,IAAY;IAEZ,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA0B,CAAC;IACpF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,EAAE,OAAO,IAAI,iCAAiC,MAAM,IAAI,IAAI,EAAE,EACtE,QAAQ,CAAC,MAAM,EACf,QAAQ,EAAE,IAAI,CACf,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,IAAS,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,MAAc,EACd,IAAY,EACZ,WAAuC,EACvC,IAAc;IAEd,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,mBAAmB,EAAE,GAAG,IAAI,EAAE,EAAE;QAC9D,MAAM;QACN,OAAO,EAAE;YACP,GAAG,WAAW;YACd,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;SACtE;QACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;QAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,IAAI,CAAC,CAAC;KACzF,CAAC,CAAC;IAEH,OAAO,yBAAyB,CAAI,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,MAAM,IAAI,GAAG;QACX,MAAM;KACP,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,mBAAmB,EAAE,GAAG,qBAAqB,EAAE,EAAE;QAC/E,MAAM,EAAE,uBAAuB;QAC/B,OAAO,EAAE;YACP,GAAG,qCAAqC,EAAE;YAC1C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,IAAI,CAAC,CAAC;KACzF,CAAC,CAAC;IAEH,OAAO,yBAAyB,CAC9B,QAAQ,EACR,uBAAuB,EACvB,qBAAqB,CACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,0BAA0B,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;IAE1E,OAAO,mBAAmB,CACxB,MAAM,EACN,IAAI,EACJ,+BAA+B,CAAC,MAAM,EAAE,IAAI,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAMzC;IACC,MAAM,MAAM,GAAG,MAAM,CAAC;IACtB,MAAM,IAAI,GAAG,kCAAkC,CAAC;IAEhD,OAAO,mBAAmB,CACxB,MAAM,EACN,IAAI,EACJ,+BAA+B,CAAC,MAAM,EAAE,IAAI,EAAE;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,wBAAwB;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,EACF,KAAK,CACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAUxC;IACC,MAAM,MAAM,GAAG,MAAM,CAAC;IACtB,MAAM,IAAI,GAAG,iCAAiC,CAAC;IAE/C,OAAO,mBAAmB,CACxB,MAAM,EACN,IAAI,EACJ,+BAA+B,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,EACpD,KAAK,CACN,CAAC;AACJ,CAAC"}

package/dist/services/hostedEventSubscriber.js

@@ -0,0 +1,206 @@
+import { createClient } from 'redis';
+import { applyHostedWebhookEvent } from './hostedAuthService.js';
+import { isHostedModeEnabled } from './hostedMode.js';
+import { getHostedNodeIdentity } from './hostedNodeIdentity.js';
+const DEFAULT_EVENT_CHANNEL = 'mcphub:hosted-events';
+const INITIAL_CONNECT_TIMEOUT_MS = 5000;
+const VALID_EVENT_TYPES = new Set([
+    'api_key.created',
+    'api_key.revoked',
+    'subscription.added',
+    'subscription.removed',
+    'byok.upserted',
+    'byok.deleted',
+    'user.suspended',
+]);
+let subscriber = null;
+let connectingClient = null;
+let starting = false;
+let retryTimer = null;
+let lastStartupFailureSignature = null;
+let subscriberEnabled = false;
+function eventChannel() {
+    return process.env.HUB_EVENT_CHANNEL || DEFAULT_EVENT_CHANNEL;
+}
+function redisUrl() {
+    return process.env.HUB_EVENT_REDIS_URL || null;
+}
+function shouldSubscribeToRedisEvents() {
+    if (!isHostedModeEnabled())
+        return false;
+    if ((process.env.HUB_EVENT_TRANSPORT || '').toLowerCase() === 'webhook')
+        return false;
+    return Boolean(redisUrl());
+}
+function isHubClusterEvent(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const event = value;
+    return (typeof event.type === 'string' &&
+        VALID_EVENT_TYPES.has(event.type) &&
+        typeof event.userId === 'string');
+}
+function clearRetryTimer() {
+    if (!retryTimer)
+        return;
+    clearTimeout(retryTimer);
+    retryTimer = null;
+}
+function isTrackedClient(client) {
+    return subscriber === client || connectingClient === client;
+}
+function shouldAbortStartup(client) {
+    return !subscriberEnabled || connectingClient !== client;
+}
+function scheduleRetry() {
+    if (!subscriberEnabled)
+        return;
+    clearRetryTimer();
+    retryTimer = setTimeout(() => {
+        retryTimer = null;
+        void startHostedEventSubscriber();
+    }, 5000);
+    retryTimer.unref?.();
+}
+function startupFailureSignature(channel, error) {
+    return `${channel}:${String(error)}`;
+}
+export async function startHostedEventSubscriber() {
+    if (subscriber || starting || !shouldSubscribeToRedisEvents())
+        return;
+    const url = redisUrl();
+    if (!url)
+        return;
+    subscriberEnabled = true;
+    starting = true;
+    const channel = eventChannel();
+    const nodeIdentity = getHostedNodeIdentity();
+    const client = createClient({
+        url,
+        socket: {
+            connectTimeout: INITIAL_CONNECT_TIMEOUT_MS,
+            reconnectStrategy: false,
+        },
+    });
+    connectingClient = client;
+    client.on('error', (error) => {
+        if (!subscriberEnabled || subscriber !== client) {
+            return;
+        }
+        console.warn('[hosted] Redis event subscriber error', {
+            error: String(error),
+            channel,
+            hubClusterId: nodeIdentity.clusterId,
+            hubNodeId: nodeIdentity.nodeId,
+        });
+    });
+    client.on('ready', () => {
+        if (!subscriberEnabled || !isTrackedClient(client)) {
+            return;
+        }
+        console.info('[hosted] Redis event subscriber ready', {
+            channel,
+            hubClusterId: nodeIdentity.clusterId,
+            hubNodeId: nodeIdentity.nodeId,
+        });
+    });
+    client.on('end', () => {
+        const wasActiveSubscriber = subscriber === client;
+        if (!wasActiveSubscriber) {
+            return;
+        }
+        subscriber = null;
+        console.warn('[hosted] Redis event subscriber connection ended', {
+            channel,
+            hubClusterId: nodeIdentity.clusterId,
+            hubNodeId: nodeIdentity.nodeId,
+        });
+        scheduleRetry();
+    });
+    try {
+        await client.connect();
+        if (shouldAbortStartup(client)) {
+            await client.quit().catch(() => undefined);
+            return;
+        }
+        await client.subscribe(channel, (message) => {
+            if (!subscriberEnabled || !isTrackedClient(client)) {
+                return;
+            }
+            try {
+                const event = JSON.parse(message);
+                if (!isHubClusterEvent(event)) {
+                    console.warn('[hosted] Ignoring invalid cluster event', { channel });
+                    return;
+                }
+                applyHostedWebhookEvent(event);
+                console.info('[hosted] Applied cluster event', {
+                    eventId: event.eventId,
+                    type: event.type,
+                    userId: event.userId,
+                    channel,
+                    hubClusterId: nodeIdentity.clusterId,
+                    hubNodeId: nodeIdentity.nodeId,
+                });
+            }
+            catch (error) {
+                console.warn('[hosted] Failed to process cluster event', {
+                    error: String(error),
+                    channel,
+                });
+            }
+        });
+        if (shouldAbortStartup(client)) {
+            await client.quit().catch(() => undefined);
+            return;
+        }
+        clearRetryTimer();
+        lastStartupFailureSignature = null;
+        subscriber = client;
+        connectingClient = null;
+    }
+    catch (error) {
+        const shouldHandleFailure = subscriberEnabled && connectingClient === client;
+        if (shouldHandleFailure) {
+            const failureSignature = startupFailureSignature(channel, error);
+            if (lastStartupFailureSignature !== failureSignature) {
+                lastStartupFailureSignature = failureSignature;
+                console.warn('[hosted] Failed to start Redis event subscriber; local cache TTL remains authoritative', {
+                    error: String(error),
+                    channel,
+                    hubClusterId: nodeIdentity.clusterId,
+                    hubNodeId: nodeIdentity.nodeId,
+                });
+            }
+        }
+        await client.quit().catch(() => undefined);
+        if (shouldHandleFailure) {
+            scheduleRetry();
+        }
+    }
+    finally {
+        if (connectingClient === client) {
+            connectingClient = null;
+        }
+        starting = false;
+    }
+}
+export async function stopHostedEventSubscriber() {
+    subscriberEnabled = false;
+    clearRetryTimer();
+    lastStartupFailureSignature = null;
+    const client = subscriber || connectingClient;
+    subscriber = null;
+    connectingClient = null;
+    if (!client)
+        return;
+    try {
+        await client.quit();
+    }
+    catch (error) {
+        console.warn('[hosted] Failed to stop Redis event subscriber cleanly', {
+            error: String(error),
+        });
+    }
+}
+//# sourceMappingURL=hostedEventSubscriber.js.map

package/dist/services/hostedEventSubscriber.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostedEventSubscriber.js","sourceRoot":"","sources":["../../src/services/hostedEventSubscriber.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AACrD,MAAM,0BAA0B,GAAG,IAAI,CAAC;AACxC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,iBAAiB;IACjB,iBAAiB;IACjB,oBAAoB;IACpB,sBAAsB;IACtB,eAAe;IACf,cAAc;IACd,gBAAgB;CACjB,CAAC,CAAC;AAIH,IAAI,UAAU,GAA2B,IAAI,CAAC;AAC9C,IAAI,gBAAgB,GAA2B,IAAI,CAAC;AACpD,IAAI,QAAQ,GAAG,KAAK,CAAC;AACrB,IAAI,UAAU,GAA0B,IAAI,CAAC;AAC7C,IAAI,2BAA2B,GAAkB,IAAI,CAAC;AACtD,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAE9B,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,qBAAqB,CAAC;AAChE,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,4BAA4B;IACnC,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtF,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,KAAiC,CAAC;IAChD,OAAO,CACL,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;QACjC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,YAAY,CAAC,UAAU,CAAC,CAAC;IACzB,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,MAAuB;IAC9C,OAAO,UAAU,KAAK,MAAM,IAAI,gBAAgB,KAAK,MAAM,CAAC;AAC9D,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAuB;IACjD,OAAO,CAAC,iBAAiB,IAAI,gBAAgB,KAAK,MAAM,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC,iBAAiB;QAAE,OAAO;IAC/B,eAAe,EAAE,CAAC;IAClB,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;QAC3B,UAAU,GAAG,IAAI,CAAC;QAClB,KAAK,0BAA0B,EAAE,CAAC;IACpC,CAAC,EAAE,IAAI,CAAC,CAAC;IACT,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe,EAAE,KAAc;IAC9D,OAAO,GAAG,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,IAAI,UAAU,IAAI,QAAQ,IAAI,CAAC,4BAA4B,EAAE;QAAE,OAAO;IAEtE,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,iBAAiB,GAAG,IAAI,CAAC;IACzB,QAAQ,GAAG,IAAI,CAAC;IAChB,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,GAAG;QACH,MAAM,EAAE;YACN,cAAc,EAAE,0BAA0B;YAC1C,iBAAiB,EAAE,KAAK;SACzB;KACF,CAAC,CAAC;IACH,gBAAgB,GAAG,MAAM,CAAC;IAE1B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,CAAC,iBAAiB,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAChD,OAAO;QACT,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE;YACpD,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;YACpB,OAAO;YACP,YAAY,EAAE,YAAY,CAAC,SAAS;YACpC,SAAS,EAAE,YAAY,CAAC,MAAM;SAC/B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACtB,IAAI,CAAC,iBAAiB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE;YACpD,OAAO;YACP,YAAY,EAAE,YAAY,CAAC,SAAS;YACpC,SAAS,EAAE,YAAY,CAAC,MAAM;SAC/B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QACpB,MAAM,mBAAmB,GAAG,UAAU,KAAK,MAAM,CAAC;QAClD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,UAAU,GAAG,IAAI,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,kDAAkD,EAAE;YAC/D,OAAO;YACP,YAAY,EAAE,YAAY,CAAC,SAAS;YACpC,SAAS,EAAE,YAAY,CAAC,MAAM;SAC/B,CAAC,CAAC;QACH,aAAa,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QAEvB,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;YAC1C,IAAI,CAAC,iBAAiB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnD,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;gBAC7C,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9B,OAAO,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;oBACrE,OAAO;gBACT,CAAC;gBAED,uBAAuB,CAAC,KAAK,CAAC,CAAC;gBAC/B,OAAO,CAAC,IAAI,CAAC,gCAAgC,EAAE;oBAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,OAAO;oBACP,YAAY,EAAE,YAAY,CAAC,SAAS;oBACpC,SAAS,EAAE,YAAY,CAAC,MAAM;iBAC/B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,0CAA0C,EAAE;oBACvD,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;oBACpB,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,eAAe,EAAE,CAAC;QAClB,2BAA2B,GAAG,IAAI,CAAC;QACnC,UAAU,GAAG,MAAM,CAAC;QACpB,gBAAgB,GAAG,IAAI,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,mBAAmB,GAAG,iBAAiB,IAAI,gBAAgB,KAAK,MAAM,CAAC;QAE7E,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACjE,IAAI,2BAA2B,KAAK,gBAAgB,EAAE,CAAC;gBACrD,2BAA2B,GAAG,gBAAgB,CAAC;gBAC/C,OAAO,CAAC,IAAI,CACV,wFAAwF,EACxF;oBACE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;oBACpB,OAAO;oBACP,YAAY,EAAE,YAAY,CAAC,SAAS;oBACpC,SAAS,EAAE,YAAY,CAAC,MAAM;iBAC/B,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE3C,IAAI,mBAAmB,EAAE,CAAC;YACxB,aAAa,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;YAChC,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;QAED,QAAQ,GAAG,KAAK,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,iBAAiB,GAAG,KAAK,CAAC;IAC1B,eAAe,EAAE,CAAC;IAClB,2BAA2B,GAAG,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,UAAU,IAAI,gBAAgB,CAAC;IAC9C,UAAU,GAAG,IAAI,CAAC;IAClB,gBAAgB,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE;YACrE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;SACrB,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}