@samanhappy/mcphub 1.1.6 → 1.1.8

package/dist/db/entities/Group.js

@@ -25,6 +25,10 @@ __decorate([
     Column({ type: 'text', nullable: true }),
     __metadata("design:type", String)
 ], Group.prototype, "description", void 0);
+__decorate([
+    Column({ type: 'text', nullable: true }),
+    __metadata("design:type", String)
+], Group.prototype, "instructions", void 0);
 __decorate([
     Column({ type: 'simple-json' }),
     __metadata("design:type", Array)
@@ -41,6 +45,10 @@ __decorate([
     Column({ type: 'simple-json', nullable: true }),
     __metadata("design:type", Array)
 ], Group.prototype, "sharedWithUsers", void 0);
+__decorate([
+    Column({ type: 'boolean', default: false }),
+    __metadata("design:type", Boolean)
+], Group.prototype, "settingsSyncManaged", void 0);
 __decorate([
     CreateDateColumn({ name: 'created_at', type: 'timestamp' }),
     __metadata("design:type", Date)

package/dist/db/entities/Group.js.map

@@ -1 +1 @@
-{"version":3,"file":"Group.js","sourceRoot":"","sources":["../../../src/db/entities/Group.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,MAAM,EACN,MAAM,EACN,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAEjB;;GAEG;AAEI,IAAM,KAAK,GAAX,MAAM,KAAK;CAqCjB,CAAA;AAnCC;IADC,sBAAsB,CAAC,MAAM,CAAC;;iCACpB;AAGX;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;mCAC1C;AAGb;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;0CACpB;AAGrB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACvB,KAAK;sCAUZ;AAGF;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oCAC1C;AAGf;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yCACZ;AAG5C;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;8CACrB;AAG3B;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;wCAAC;AAGhB;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;wCAAC;AApCL,KAAK;IADjB,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;GACd,KAAK,CAqCjB;;AAED,eAAe,KAAK,CAAC"}
+{"version":3,"file":"Group.js","sourceRoot":"","sources":["../../../src/db/entities/Group.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,MAAM,EACN,MAAM,EACN,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAEjB;;GAEG;AAEI,IAAM,KAAK,GAAX,MAAM,KAAK;CA4CjB,CAAA;AA1CC;IADC,sBAAsB,CAAC,MAAM,CAAC;;iCACpB;AAGX;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;mCAC1C;AAGb;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;0CACpB;AAGrB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;2CACnB;AAGtB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACvB,KAAK;sCAUZ;AAGF;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oCAC1C;AAGf;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yCACZ;AAG5C;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;8CACrB;AAI3B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;;kDACd;AAG9B;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;wCAAC;AAGhB;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;wCAAC;AA3CL,KAAK;IADjB,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;GACd,KAAK,CA4CjB;;AAED,eAAe,KAAK,CAAC"}

package/dist/db/entities/OAuthToken.js

@@ -50,6 +50,10 @@ __decorate([
     Column({ type: 'varchar', length: 255 }),
     __metadata("design:type", String)
 ], OAuthToken.prototype, "username", void 0);
+__decorate([
+    Column({ name: 'session_version', type: 'varchar', length: 64, nullable: true }),
+    __metadata("design:type", String)
+], OAuthToken.prototype, "sessionVersion", void 0);
 __decorate([
     CreateDateColumn({ name: 'created_at', type: 'timestamp' }),
     __metadata("design:type", Date)

package/dist/db/entities/OAuthToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"OAuthToken.js","sourceRoot":"","sources":["../../../src/db/entities/OAuthToken.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,MAAM,EACN,MAAM,EACN,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,GACN,MAAM,SAAS,CAAC;AAEjB;;;GAGG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAU;CAkCtB,CAAA;AAhCC;IADC,sBAAsB,CAAC,MAAM,CAAC;;sCACpB;AAIX;IAFC,KAAK,EAAE;IACP,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;+CACzD;AAGpB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACzC,IAAI;wDAAC;AAI3B;IAFC,KAAK,EAAE;IACP,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;gDACxE;AAGtB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;8BACxD,IAAI;yDAAC;AAG7B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yCAC1C;AAIf;IAFC,KAAK,EAAE;IACP,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;4CAC3C;AAIjB;IAFC,KAAK,EAAE;IACP,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;4CACxB;AAGjB;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;6CAAC;AAGhB;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;6CAAC;AAjCL,UAAU;IADtB,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;GACpB,UAAU,CAkCtB;;AAED,eAAe,UAAU,CAAC"}
+{"version":3,"file":"OAuthToken.js","sourceRoot":"","sources":["../../../src/db/entities/OAuthToken.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,MAAM,EACN,MAAM,EACN,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,GACN,MAAM,SAAS,CAAC;AAEjB;;;GAGG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAU;CAqCtB,CAAA;AAnCC;IADC,sBAAsB,CAAC,MAAM,CAAC;;sCACpB;AAIX;IAFC,KAAK,EAAE;IACP,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;+CACzD;AAGpB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACzC,IAAI;wDAAC;AAI3B;IAFC,KAAK,EAAE;IACP,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;gDACxE;AAGtB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;8BACxD,IAAI;yDAAC;AAG7B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yCAC1C;AAIf;IAFC,KAAK,EAAE;IACP,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;4CAC3C;AAIjB;IAFC,KAAK,EAAE;IACP,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;4CACxB;AAGjB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDACzD;AAGxB;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;6CAAC;AAGhB;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;6CAAC;AApCL,UAAU;IADtB,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;GACpB,UAAU,CAqCtB;;AAED,eAAe,UAAU,CAAC"}

package/dist/db/entities/Server.js

@@ -117,6 +117,10 @@ __decorate([
     Column({ type: 'varchar', length: 128, nullable: true }),
     __metadata("design:type", String)
 ], Server.prototype, "settingsSyncHash", void 0);
+__decorate([
+    Column({ type: 'boolean', default: false }),
+    __metadata("design:type", Boolean)
+], Server.prototype, "settingsSyncManaged", void 0);
 __decorate([
     CreateDateColumn({ name: 'created_at', type: 'timestamp' }),
     __metadata("design:type", Date)

package/dist/db/entities/Server.js.map

@@ -1 +1 @@
-{"version":3,"file":"Server.js","sourceRoot":"","sources":["../../../src/db/entities/Server.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EACL,MAAM,EACN,MAAM,EACN,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAEjB;;GAEG;AAEI,IAAM,MAAM,GAAZ,MAAM,MAAM;CA0FlB,CAAA;AAxFC;IADC,sBAAsB,CAAC,MAAM,CAAC;;kCACpB;AAGX;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;oCAC1C;AAGb;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oCAC1C;AAGd;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;2CACpB;AAGrB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mCAC5B;AAGb;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uCACxC;AAGjB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oCAChC;AAGhB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mCACnB;AAG7B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uCACf;AAGjC;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;uCAC1B;AAGjB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qCAC1C;AAQf;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;;0CACjB;AAG3C;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CAC3B;AAG3B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;;+CAClB;AAG1B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACb;AAG3B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qCACmB;AAGnE;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uCACqB;AAGrE;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yCACuB;AAGvE;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uCAClB;AAG9B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qCACpB;AAG5B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qCACpB;AAG5B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uCAClB;AAG9B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDAClB;AAG9B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDACjB;AAG3B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDACV;AAItC;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDAC/B;AAG1B;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;yCAAC;AAGhB;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;yCAAC;AAzFL,MAAM;IADlB,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;GACf,MAAM,CA0FlB;;AAED,eAAe,MAAM,CAAC"}
+{"version":3,"file":"Server.js","sourceRoot":"","sources":["../../../src/db/entities/Server.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EACL,MAAM,EACN,MAAM,EACN,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAEjB;;GAEG;AAEI,IAAM,MAAM,GAAZ,MAAM,MAAM;CA8FlB,CAAA;AA5FC;IADC,sBAAsB,CAAC,MAAM,CAAC;;kCACpB;AAGX;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;oCAC1C;AAGb;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oCAC1C;AAGd;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;2CACpB;AAGrB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mCAC5B;AAGb;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uCACxC;AAGjB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oCAChC;AAGhB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mCACnB;AAG7B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uCACf;AAGjC;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;uCAC1B;AAGjB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qCAC1C;AAQf;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;;0CACjB;AAG3C;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CAC3B;AAG3B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;;+CAClB;AAG1B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACb;AAG3B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qCAC4C;AAG5F;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uCACqB;AAGrE;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yCACuB;AAGvE;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uCAClB;AAG9B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qCACpB;AAG5B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qCACpB;AAG5B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uCAClB;AAG9B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDAClB;AAG9B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDACjB;AAG3B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDACV;AAItC;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDAC/B;AAI1B;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;;mDACd;AAG9B;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;yCAAC;AAGhB;IADC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;8BACjD,IAAI;yCAAC;AA7FL,MAAM;IADlB,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;GACf,MAAM,CA8FlB;;AAED,eAAe,MAAM,CAAC"}

package/dist/middlewares/auth.js

@@ -1,8 +1,5 @@
-import jwt from 'jsonwebtoken';
+import { resolveJwtUser } from '../utils/userSession.js';
 import defaultConfig from '../config/index.js';
-import { JWT_SECRET } from '../config/jwt.js';
-import { getToken } from '../models/OAuth.js';
-import { isOAuthServerEnabled } from '../services/oauthServerService.js';
 import { getBearerKeyDao, getSystemConfigDao } from '../dao/index.js';
 import { getBetterAuthRuntimeConfig } from '../services/betterAuthConfig.js';
 import { authenticateForwardAuthToken } from '../services/forwardAuthService.js';
@@ -122,24 +119,6 @@ export const auth = async (req, res, next) => {
         next();
         return;
     }
-    // Check for OAuth access token in the configured bearer auth header
-    const accessToken = getBearerTokenFromHeaders(req.headers, systemConfig);
-    if (accessToken && isOAuthServerEnabled()) {
-        const oauthToken = await getToken(accessToken);
-        if (oauthToken && oauthToken.accessToken === accessToken) {
-            // Valid OAuth token - look up user to get admin status
-            const { findUserByUsername } = await import('../models/User.js');
-            const user = await findUserByUsername(oauthToken.username);
-            // Set user context with proper admin status
-            req.user = {
-                username: oauthToken.username,
-                isAdmin: user?.isAdmin || false,
-            };
-            req.oauthToken = oauthToken;
-            next();
-            return;
-        }
-    }
     const betterAuthConfig = await getBetterAuthRuntimeConfig(systemConfig);
     if (betterAuthConfig.enabled) {
         const betterAuthUser = await resolveBetterAuthUserSafe(req);
@@ -168,9 +147,12 @@ export const auth = async (req, res, next) => {
     }
     // Verify JWT token
     try {
-        const decoded = jwt.verify(token, JWT_SECRET);
-        // Add user from payload to request
-        req.user = decoded.user;
+        const user = await resolveJwtUser(token);
+        if (!user) {
+            res.status(401).json({ success: false, message: 'Token is not valid' });
+            return;
+        }
+        req.user = { username: user.username, isAdmin: user.isAdmin || false };
         next();
     }
     catch (error) {

package/dist/middlewares/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middlewares/auth.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,aAAa,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;IAC/B,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS;IACxC,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC;AAE7C,MAAM,yBAAyB,GAAG,KAAK,EAAE,GAAY,EAAE,EAAE;IACvD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAC9B,GAAY,EACZ,YAAkC,EACP,EAAE;IAC7B,MAAM,gBAAgB,GAAG,YAAY,EAAE,OAAO,EAAE,gBAAgB,IAAI,IAAI,CAAC;IACzE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,CAAC;IAErD,wEAAwE;IACxE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAA0B,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAClE,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAC9B,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kFAAkF;IAClF,8EAA8E;IAC9E,+BAA+B;IAC/B,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,IAAI,WAAW,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACpE,MAAM,CAAC,IAAI,CACT,gDAAgD,WAAW,CAAC,EAAE,UAAU,WAAW,CAAC,IAAI,uCAAuC,CAChI,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,GAAG,CACR,qCAAqC,WAAW,CAAC,EAAE,UAAU,WAAW,CAAC,IAAI,gBAAgB,WAAW,CAAC,UAAU,EAAE,CACtH,CAAC;IACF,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,SAAS,CAAC,CAAC;AAEvC,MAAM,aAAa,GAAG,CAAC,GAAY,EAAW,EAAE;IAC9C,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,CAAC;IAChC,QAAQ,EAAE,OAAO;IACjB,OAAO,EAAE,IAAI;IACb,kBAAkB,EAAE,KAAK;CAC1B,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,GAAY,EAAW,EAAE;IACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,GAAG,QAAQ,MAAM,CAAC;IAEpC,OAAO,CACL,GAAG,CAAC,OAAO,KAAK,SAAS;QACzB,GAAG,CAAC,WAAW,KAAK,SAAS;QAC7B,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,CAC5C,CAAC;AACJ,CAAC,CAAC;AAEF,uCAAuC;AACvC,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;IAC3F,MAAM,CAAC,GAAI,GAAW,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG,MAAM,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACtD,MAAM,aAAa,GAAG,YAAY,EAAE,OAAO,IAAI;QAC7C,iBAAiB,EAAE,IAAI;QACvB,oBAAoB,EAAE,IAAI;QAC1B,QAAQ,EAAE,KAAK;KAChB,CAAC;IAEF,mEAAmE;IACnE,4EAA4E;IAC5E,MAAM,iBAAiB,GAAG,MAAM,4BAA4B,CAC1D,yBAAyB,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,EACpD,YAAY,CACb,CAAC;IACF,IAAI,iBAAiB,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAChD,GAAW,CAAC,IAAI,GAAG;YAClB,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,QAAQ;YACzC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK;SACjD,CAAC;QACD,GAAW,CAAC,eAAe,GAAG,iBAAiB,CAAC,IAAI,CAAC;QACtD,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,IAAI,iBAAmC,CAAC;IACxC,IAAI,CAAC;QACH,iBAAiB,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,KAAc,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACrB,GAAW,CAAC,IAAI,GAAG;YAClB,QAAQ,EAAE,iBAAiB,CAAC,KAAK,IAAI,QAAQ;YAC7C,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,KAAK;SAC1B,CAAC;QACD,GAAW,CAAC,SAAS,GAAG,iBAAiB,CAAC;QAC3C,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,oEAAoE;IACpE,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACzE,IAAI,WAAW,IAAI,oBAAoB,EAAE,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE/C,IAAI,UAAU,IAAI,UAAU,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACzD,uDAAuD;YACvD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACjE,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAE3D,4CAA4C;YAC3C,GAAW,CAAC,IAAI,GAAG;gBAClB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK;aAChC,CAAC;YACD,GAAW,CAAC,UAAU,GAAG,UAAU,CAAC;YACrC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC5D,IAAI,cAAc,EAAE,CAAC;YAClB,GAAW,CAAC,IAAI,GAAG;gBAClB,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,OAAO,EAAE,cAAc,CAAC,OAAO,IAAI,KAAK;aACzC,CAAC;YACF,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,KAAe,CAAC;IAC7C,MAAM,KAAK,GAAG,WAAW,IAAI,UAAU,CAAC;IAExC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,QAAQ,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,GAAW,CAAC,IAAI,GAAG,kBAAkB,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,oBAAoB;IACpB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IAED,mBAAmB;IACnB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAE9C,mCAAmC;QAClC,GAAW,CAAC,IAAI,GAAI,OAAe,CAAC,IAAI,CAAC;QAC1C,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middlewares/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,aAAa,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;IAC/B,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS;IACxC,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC;AAE7C,MAAM,yBAAyB,GAAG,KAAK,EAAE,GAAY,EAAE,EAAE;IACvD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAC9B,GAAY,EACZ,YAAkC,EACP,EAAE;IAC7B,MAAM,gBAAgB,GAAG,YAAY,EAAE,OAAO,EAAE,gBAAgB,IAAI,IAAI,CAAC;IACzE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,CAAC;IAErD,wEAAwE;IACxE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAA0B,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAClE,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAC9B,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kFAAkF;IAClF,8EAA8E;IAC9E,+BAA+B;IAC/B,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,IAAI,WAAW,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACpE,MAAM,CAAC,IAAI,CACT,gDAAgD,WAAW,CAAC,EAAE,UAAU,WAAW,CAAC,IAAI,uCAAuC,CAChI,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,GAAG,CACR,qCAAqC,WAAW,CAAC,EAAE,UAAU,WAAW,CAAC,IAAI,gBAAgB,WAAW,CAAC,UAAU,EAAE,CACtH,CAAC;IACF,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,SAAS,CAAC,CAAC;AAEvC,MAAM,aAAa,GAAG,CAAC,GAAY,EAAW,EAAE;IAC9C,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,CAAC;IAChC,QAAQ,EAAE,OAAO;IACjB,OAAO,EAAE,IAAI;IACb,kBAAkB,EAAE,KAAK;CAC1B,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,GAAY,EAAW,EAAE;IACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,GAAG,QAAQ,MAAM,CAAC;IAEpC,OAAO,CACL,GAAG,CAAC,OAAO,KAAK,SAAS;QACzB,GAAG,CAAC,WAAW,KAAK,SAAS;QAC7B,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,CAC5C,CAAC;AACJ,CAAC,CAAC;AAEF,uCAAuC;AACvC,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;IAC3F,MAAM,CAAC,GAAI,GAAW,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG,MAAM,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC;IACtD,MAAM,aAAa,GAAG,YAAY,EAAE,OAAO,IAAI;QAC7C,iBAAiB,EAAE,IAAI;QACvB,oBAAoB,EAAE,IAAI;QAC1B,QAAQ,EAAE,KAAK;KAChB,CAAC;IAEF,mEAAmE;IACnE,4EAA4E;IAC5E,MAAM,iBAAiB,GAAG,MAAM,4BAA4B,CAC1D,yBAAyB,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,EACpD,YAAY,CACb,CAAC;IACF,IAAI,iBAAiB,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAChD,GAAW,CAAC,IAAI,GAAG;YAClB,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,QAAQ;YACzC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK;SACjD,CAAC;QACD,GAAW,CAAC,eAAe,GAAG,iBAAiB,CAAC,IAAI,CAAC;QACtD,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,IAAI,iBAAmC,CAAC;IACxC,IAAI,CAAC;QACH,iBAAiB,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,KAAc,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACrB,GAAW,CAAC,IAAI,GAAG;YAClB,QAAQ,EAAE,iBAAiB,CAAC,KAAK,IAAI,QAAQ;YAC7C,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,KAAK;SAC1B,CAAC;QACD,GAAW,CAAC,SAAS,GAAG,iBAAiB,CAAC;QAC3C,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC5D,IAAI,cAAc,EAAE,CAAC;YAClB,GAAW,CAAC,IAAI,GAAG;gBAClB,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,OAAO,EAAE,cAAc,CAAC,OAAO,IAAI,KAAK;aACzC,CAAC;YACF,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,KAAe,CAAC;IAC7C,MAAM,KAAK,GAAG,WAAW,IAAI,UAAU,CAAC;IAExC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,QAAQ,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,GAAW,CAAC,IAAI,GAAG,kBAAkB,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,oBAAoB;IACpB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IAED,mBAAmB;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACA,GAAW,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,KAAK,EAAE,CAAC;QAChF,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CAAC"}

package/dist/middlewares/toolCallGuard.js

@@ -0,0 +1,499 @@
+/**
+ * Opt-in pre-call guard for `tools/call` requests.
+ *
+ * When enabled, tool call arguments are inspected for a small set of
+ * high-confidence dangerous payloads — shell command injection/RCE and
+ * cloud instance-metadata (SSRF / credential-hijack) targets — and a
+ * matching call is blocked before it reaches the upstream MCP server
+ * (fail-closed).
+ *
+ * Rules are split into two tiers:
+ * - **Always-on** rules detect payloads that are dangerous in any field,
+ *   not only an executable one: cloud instance-metadata endpoints and
+ *   credential paths (SSRF / credential hijack). These are checked on
+ *   every string value.
+ * - **Execution** rules detect shell/RCE content (chaining, command
+ *   substitution, download-and-execute, sensitive-file reads, destructive
+ *   deletion, reverse shells, PowerShell cradles). Because shell-like text
+ *   and punctuation routinely appear inside ordinary prose, documentation
+ *   and messaging arguments, these rules are applied only to values held
+ *   in fields explicitly named to carry executable content
+ *   (`command`, `cmd`, `script`, `run`, … — see {@link EXECUTION_KEYS}).
+ *
+ * Every pattern is a high-confidence indicator of an attack and every
+ * inspection is linear in the size of its input (no catastrophic
+ * backtracking). No network access and no third-party dependencies are
+ * required.
+ *
+ * Enable with `TOOL_CALL_GUARD_ENABLED=true`. The guard is off by default
+ * and performs no work unless explicitly enabled.
+ */
+/**
+ * Thrown when the guard blocks a tool call. The message is safe to return to
+ * the caller; it deliberately does not echo the matched payload.
+ */
+export class ToolCallBlockedError extends Error {
+    constructor(message, 
+    /** Stable machine-readable identifier of the rule that fired. */
+    ruleId) {
+        super(message);
+        this.ruleId = ruleId;
+        this.name = 'ToolCallBlockedError';
+    }
+}
+/** Returns true when the pre-call guard is explicitly enabled via environment. */
+export const isToolCallGuardEnabled = (env = process.env) => env.TOOL_CALL_GUARD_ENABLED === 'true';
+/**
+ * Normalised names of object keys whose values hold executable content.
+ * A key matches when its lower-cased name, after removing `_`, `-` and
+ * spaces, is one of these tokens, or ends with one of the suffixes in
+ * {@link EXECUTION_KEY_SUFFIXES}.
+ */
+const EXECUTION_KEYS = new Set([
+    'command',
+    'cmd',
+    'cmds',
+    'script',
+    'exec',
+    'execute',
+    'shell',
+    'run',
+    'code',
+    'statement',
+    'expression',
+]);
+/** Normalised key suffixes that indicate executable content. */
+const EXECUTION_KEY_SUFFIXES = ['command', 'commands', 'script'];
+/** Returns true when an object key is explicitly named to carry a command. */
+const isExecutionKey = (key) => {
+    const normalised = key.toLowerCase().replace(/[_\-\s]/g, '');
+    if (EXECUTION_KEYS.has(normalised))
+        return true;
+    return EXECUTION_KEY_SUFFIXES.some((suffix) => normalised.endsWith(suffix));
+};
+/**
+ * Command substitution / execution expansions. These forms execute the
+ * embedded command whenever a shell interprets the value, so they are a
+ * direct RCE indicator.
+ *
+ * `$( ... )` is matched directly. Backtick pairs are inspected with a
+ * linear scan rather than a single regex, because a single opening
+ * backtick followed by a long run of non-backtick characters made the old
+ * backtick expression retry across the whole string.
+ */
+const COMMAND_EXPANSION = {
+    id: 'command-expansion',
+    scope: 'execution',
+    test: (v) => /\$\([^)]/.test(v) || backtickSpanContains(v, SHELL_SYNTAX_CHARS),
+};
+/** Matches characters that indicate the content of a backtick span is shell syntax. */
+const SHELL_SYNTAX_CHARS = /[;&|$/]/;
+/**
+ * Linear scan for backtick-delimited spans that contain shell syntax or a
+ * known command. Each character is visited once; there is no backtracking.
+ */
+const backtickSpanContains = (value, syntax) => {
+    let open = -1;
+    for (let i = 0; i < value.length; i += 1) {
+        if (value[i] !== '`')
+            continue;
+        if (open === -1) {
+            open = i;
+        }
+        else {
+            const span = value.slice(open + 1, i);
+            if (syntax.test(span) || COMMAND_IN_BACKTICK.test(span))
+                return true;
+            open = -1;
+        }
+    }
+    return false;
+};
+/** A backtick span that runs a known command with an argument. */
+const COMMAND_IN_BACKTICK = /^\s*(?:sudo\s+)?(?:cat|ls|id|whoami|uname|wget|curl|bash|sh|nc|python|perl|ruby|chmod|chown|rm|cp|mv)\s+\S/;
+/**
+ * Classic shell metacharacter chaining (`;`, `&&`, `||`) immediately
+ * followed by a command name. Requires a following command token so prose
+ * and ordinary punctuation do not match.
+ */
+const SHELL_CHAINING = {
+    id: 'shell-chaining',
+    scope: 'execution',
+    test: (v) => /(?:;|&&|\|\|)\s*(?:sudo\s+)?(?:cat|ls|id|whoami|uname|wget|curl|bash|sh|nc|python|perl|ruby|chmod|chown|rm|cp|mv)\b/.test(v),
+};
+/**
+ * Download-and-execute pattern, e.g. `curl http://... | sh` or
+ * `wget -O- ... | bash`, including the `sh -c "$(curl ...)"` form.
+ *
+ * The piped form is detected with a linear scan: the line is split at each
+ * pipe and a single pass records whether a downloader appeared before the
+ * pipe and whether a shell follows it. The previous expression used
+ * `curl/wget` followed by `[^|\n]*` running to the terminator, so a string
+ * of repeated command words (`'curl '.repeat(40000)`) made the engine retry
+ * from each word and produced quadratic time. The shell is not required to
+ * sit at the end of the line: real invocations pass arguments (`sh -s`) or
+ * append comments (`sh # install`), and this rule is execution-scoped so
+ * downloaders merely quoted in prose are not matched.
+ */
+const DOWNLOADER_PIPE = {
+    id: 'downloader-pipe',
+    scope: 'execution',
+    test: (v) => {
+        if (SH_C_CURL.test(v))
+            return true;
+        for (const line of v.split('\n')) {
+            if (hasDownloaderPipedToShell(line))
+                return true;
+        }
+        return false;
+    },
+};
+/** The `sh -c "$(curl ...)"` download-and-execute form. */
+const SH_C_CURL = /(?:ba|z|fi|k|t?c)?sh\s+-c\s+["']?\$\((?:curl|wget)\b/;
+/** A shell command name (bash/sh/zsh/fish/ksh/tcsh). */
+const SHELL_AFTER_PIPE = /^(?:sudo\s+)?(?:ba|z|fi|k|t?c)?sh\b/;
+/** A downloader command name. */
+const DOWNLOADER_IN_SEGMENT = /\b(?:curl|wget)\b/;
+/**
+ * Linear detection of `downloader ... | shell` within one line. The line is
+ * split at pipes and visited once; every segment is inspected with a
+ * bounded regex that does not run to an end-of-line terminator.
+ */
+const hasDownloaderPipedToShell = (line) => {
+    let downloaderSeen = false;
+    for (const segment of line.split('|')) {
+        if (SHELL_AFTER_PIPE.test(segment.trimStart()) && downloaderSeen)
+            return true;
+        if (DOWNLOADER_IN_SEGMENT.test(segment))
+            downloaderSeen = true;
+    }
+    return false;
+};
+/**
+ * Reading sensitive account files through a shell command, including their
+ * use inside command substitution. `passwd` alone is harmless (it contains
+ * only public account names), so a reader command must precede it; `shadow`
+ * is sensitive regardless.
+ *
+ * Detected with a linear token scan: the line is split on whitespace and
+ * visited once, recording whether a reader command appeared before the
+ * `/etc/passwd` token. The previous expression used a reader word followed
+ * by `[^\n]*` running to the path, so repeated command words
+ * (`'cat '.repeat(50000)`) caused quadratic retries. Quoted path tokens
+ * (`cat "/etc/passwd"`) and absolute reader paths (`/bin/cat`) are handled
+ * by normalising each token before comparison.
+ */
+const SENSITIVE_FILE_READ = {
+    id: 'sensitive-file-read',
+    scope: 'execution',
+    test: (v) => {
+        for (const line of v.split('\n')) {
+            if (SHADOW_PATH.test(line))
+                return true;
+            if (hasReaderThenPasswd(line))
+                return true;
+        }
+        return false;
+    },
+};
+/** A reference to `/etc/shadow`; sensitive even without an explicit reader. */
+const SHADOW_PATH = /\/etc\/shadow(?![\w.-])/;
+/**
+ * Removes a single matching pair of surrounding quotes from a whitespace
+ * token, so a path written as `"/etc/passwd"` is recognised the same as the
+ * unquoted form.
+ */
+const stripQuotes = (token) => {
+    if (token.length < 2)
+        return token;
+    const first = token[0];
+    const last = token[token.length - 1];
+    if ((first === '"' || first === "'") && last === first) {
+        return token.slice(1, -1);
+    }
+    return token;
+};
+/** True when a (possibly quote-wrapped) token ends in `/etc/passwd`. */
+const isPasswdToken = (token) => /\/etc\/passwd(?![\w.-])$/.test(stripQuotes(token));
+/** Basenames of commands that read a file. */
+const FILE_READER_WORDS = new Set([
+    'cat',
+    'head',
+    'tail',
+    'less',
+    'more',
+    'tac',
+    'nl',
+    'od',
+    'xxd',
+    'cp',
+    'mv',
+    'grep',
+    'open',
+]);
+/**
+ * True when a whitespace token is a file-reader command, whether given as a
+ * bare name (`cat`) or an absolute executable path (`/bin/cat`,
+ * `/usr/bin/cat`).
+ */
+const isFileReaderToken = (token) => {
+    const slash = token.lastIndexOf('/');
+    const name = slash === -1 ? token : token.slice(slash + 1);
+    return FILE_READER_WORDS.has(name);
+};
+/**
+ * Linear detection of a reader command followed later by `/etc/passwd`
+ * within one line. Tokens are visited once; a reader seen earlier is
+ * remembered when the path token is reached. Quoted paths and absolute
+ * reader-command paths are handled by {@link isPasswdToken} and
+ * {@link isFileReaderToken}.
+ */
+const hasReaderThenPasswd = (line) => {
+    let readerSeen = false;
+    for (const token of line.split(/\s+/)) {
+        if (isPasswdToken(token) && readerSeen)
+            return true;
+        if (isFileReaderToken(token))
+            readerSeen = true;
+    }
+    return false;
+};
+/**
+ * Forced recursive deletion of a system/home root.
+ *
+ * Implemented as a linear per-line scan instead of a single regex. The
+ * original combined three greedy `[^\n]*` segments in one expression, and
+ * even the intermediate `/-[^\s]*[rf]/` flag check retried from each dash,
+ * so long runs of dashes (e.g. `rm ` + `'-'.repeat(100000)) produced
+ * catastrophic backtracking. The checks below run independently on each
+ * line, inspecting only whitespace-delimited flag tokens, so the total work
+ * is O(n) with no backtracking across segments.
+ */
+const FORCE_DELETE_ROOT = {
+    id: 'force-delete-root',
+    scope: 'execution',
+    test: (v) => {
+        for (const line of v.split('\n')) {
+            if (!/\brm\b/.test(line))
+                continue;
+            if (!hasRecursiveForceFlag(line))
+                continue;
+            if (/(?:--no-preserve-root\b)?\s\/(?:\s|$|\*)/.test(line))
+                return true;
+        }
+        return false;
+    },
+};
+/**
+ * Returns true when the line carries a recursive flag (a single-dash flag
+ * token containing `r`), or `--no-preserve-root`. Recursive deletion of the
+ * root target is dangerous with `-r` alone, so `-f` is not required. Only
+ * whitespace-delimited tokens are inspected, so a run of dashes that never
+ * forms such a token is visited once and rejected.
+ */
+const hasRecursiveForceFlag = (line) => {
+    if (line.includes('--no-preserve-root'))
+        return true;
+    for (const token of line.split(/\s+/)) {
+        if (token.length < 2 || token[0] !== '-' || token[1] === '-')
+            continue;
+        if (token.slice(1).includes('r'))
+            return true;
+    }
+    return false;
+};
+/**
+ * Reverse-shell starters.
+ *
+ * The `/dev/tcp/host/port` and `nc -e /bin/sh` forms are detected with
+ * linear scans rather than run-on regexes. The previous expressions were
+ * `/dev/tcp/\S+/\d+` and `\bnc\b[^\n]*-e\s+/…/sh`; on a string of repeated
+ * prefixes (`'/dev/tcp/'.repeat(20000)` or `'nc '.repeat(60000)`) each
+ * match advanced while scanning to the end of the line for a suffix that
+ * was absent, producing quadratic retries.
+ */
+const REVERSE_SHELL = {
+    id: 'reverse-shell',
+    scope: 'execution',
+    test: (v) => {
+        if (hasDevTcpRedirect(v))
+            return true;
+        if (/bash\s+-i\b/.test(v))
+            return true;
+        for (const line of v.split('\n')) {
+            if (hasNetcatExecShell(line))
+                return true;
+        }
+        return false;
+    },
+};
+const DEV_TCP_PREFIX = '/dev/tcp/';
+/** Characters that terminate a shell word even without whitespace. */
+const isShellDelimiter = (ch) => /[;|&'"`><)]/.test(ch);
+/**
+ * Linear detection of a bash `/dev/tcp/host/port` redirect. Each prefix
+ * occurrence advances a single cursor (there is no rescanning of earlier
+ * text). The host/port token ends at whitespace or a shell delimiter such as
+ * `;` or a closing quote, so a port immediately followed by `;` is still
+ * recognised; both the host and the port are validated.
+ */
+const hasDevTcpRedirect = (value) => {
+    let from = 0;
+    for (;;) {
+        const start = value.indexOf(DEV_TCP_PREFIX, from);
+        if (start === -1)
+            return false;
+        const restStart = start + DEV_TCP_PREFIX.length;
+        let end = restStart;
+        while (end < value.length) {
+            const ch = value[end];
+            if (/\s/.test(ch) || isShellDelimiter(ch))
+                break;
+            end += 1;
+        }
+        const segment = value.slice(restStart, end);
+        const slash = segment.indexOf('/');
+        if (slash > 0 &&
+            /^[A-Za-z0-9_.[\]:-]+$/.test(segment.slice(0, slash)) &&
+            /^\d+$/.test(segment.slice(slash + 1))) {
+            return true;
+        }
+        from = end;
+    }
+};
+/**
+ * Linear detection of a netcat/ncat reverse shell within one line. Both the
+ * starter and the `-e /…/sh` execute form are matched with bounded patterns;
+ * neither runs to the end of the line, so repeated `nc` words do not retry.
+ */
+const hasNetcatExecShell = (line) => {
+    if (!/\bnc(?:at)?\b/.test(line))
+        return false;
+    return /(?:^|\s)-e\s+\/(?:bin|usr\/bin)\/sh(?![\w.-])/.test(line);
+};
+/** PowerShell download cradles (download + execute APIs used together). */
+const POWERSHELL_CRADLE = {
+    id: 'powershell-cradle',
+    scope: 'execution',
+    test: (v) => {
+        const lower = v.toLowerCase();
+        const downloads = /(?:downloadstring|downloadfile|invoke-webrequest\s*\(|invoke-restmethod\s*\(|\biwr\b|\birm\b)/.test(lower);
+        const executes = /(?:iex|invoke-expression)\s*[.(]/.test(lower);
+        return downloads && executes;
+    },
+};
+/**
+ * Cloud instance metadata service targets (AWS / GCP / Azure / Alibaba /
+ * Oracle / DigitalOcean / OpenStack), in dotted, decimal or hex form for the
+ * AWS IMDS address. The IMDS hostnames are not routable on any ordinary
+ * network, so a match is always an SSRF attempt regardless of the field it
+ * appears in.
+ */
+const CLOUD_METADATA_URL = {
+    id: 'cloud-metadata-url',
+    scope: 'always',
+    test: (v) => /https?:\/\/(?:169\.254\.169\.254|2852039166|0xa9fea9fe)(?::\d+)?\//.test(v) ||
+        /https?:\/\/(?:metadata\.google\.internal|169\.254\.169\.254\.metadata\.azure\.com|100\.100\.100\.200)\//.test(v),
+};
+/** Well-known cloud credential / IMDS token paths or hostnames. */
+const CLOUD_CREDENTIAL_PATH = {
+    id: 'cloud-credential-path',
+    scope: 'always',
+    test: (v) => /\/latest\/(?:meta-data|api\/token)/.test(v) ||
+        /\/computeMetadata\/v1\//.test(v) ||
+        /\/metadata\/instance\//.test(v) ||
+        /(?:metadata\.aliyuninc\.com|169\.254\.170\.2)\//.test(v),
+};
+const RULES = [
+    COMMAND_EXPANSION,
+    SHELL_CHAINING,
+    DOWNLOADER_PIPE,
+    SENSITIVE_FILE_READ,
+    FORCE_DELETE_ROOT,
+    REVERSE_SHELL,
+    POWERSHELL_CRADLE,
+    CLOUD_METADATA_URL,
+    CLOUD_CREDENTIAL_PATH,
+];
+/**
+ * Cap on total argument text inspected per call. When a single call contains
+ * more text than this, it cannot be fully inspected and the guard blocks the
+ * call (fail-closed) rather than treating the unexamined portion as safe.
+ * This keeps a single call from doing unbounded work while preventing an
+ * attacker from padding a payload past the budget to smuggle a command.
+ */
+const MAX_SCAN_BYTES = 1000000;
+/**
+ * Rule id reported when a call contains more text than the scan budget and
+ * therefore cannot be fully inspected.
+ */
+const SCAN_LIMIT_RULE_ID = 'scan-limit-exceeded';
+/**
+ * Inspect tool call arguments for high-confidence dangerous payloads.
+ *
+ * Every string value reachable from the arguments object (including arrays
+ * and nested objects) is checked. Strings inside a field whose key is named
+ * for executable content (and everything nested beneath it) are also
+ * checked against the execution-tier rules; other strings are checked only
+ * against the always-on (SSRF/credential) rules. Non-string values are
+ * ignored.
+ *
+ * @returns `{ blocked: false }` when nothing matched, otherwise the id of
+ *          the first matching rule.
+ */
+export const inspectToolArguments = (args) => {
+    let budget = MAX_SCAN_BYTES;
+    const scan = (node, execution) => {
+        if (typeof node === 'string') {
+            // Fail closed: if this string cannot be fully inspected within the
+            // remaining budget, block the call instead of silently passing the
+            // unexamined content through.
+            if (node.length > budget)
+                return SCAN_LIMIT_RULE_ID;
+            budget -= node.length;
+            for (const rule of RULES) {
+                if (rule.scope === 'execution' && !execution)
+                    continue;
+                if (rule.test(node))
+                    return rule.id;
+            }
+            return undefined;
+        }
+        if (Array.isArray(node)) {
+            for (const item of node) {
+                const hit = scan(item, execution);
+                if (hit)
+                    return hit;
+            }
+            return undefined;
+        }
+        if (node !== null && typeof node === 'object') {
+            for (const [key, value] of Object.entries(node)) {
+                // A command-named field puts its whole subtree into execution scope;
+                // other fields keep the scope inherited from their parent.
+                const hit = scan(value, execution || isExecutionKey(key));
+                if (hit)
+                    return hit;
+            }
+        }
+        return undefined;
+    };
+    // A top-level bare string is not a named execution field, so only the
+    // always-on rules apply to it. (In MCP, tool call arguments are an object;
+    // bare-string inputs exist mainly for testing.)
+    const ruleId = scan(args, false);
+    return ruleId ? { blocked: true, ruleId } : { blocked: false };
+};
+/**
+ * Assert that tool call arguments are safe. Throws {@link ToolCallBlockedError}
+ * (fail-closed) when a high-confidence dangerous pattern is present.
+ */
+export const assertToolCallArgumentsSafe = (args, env = process.env) => {
+    if (!isToolCallGuardEnabled(env))
+        return;
+    const result = inspectToolArguments(args);
+    if (result.blocked && result.ruleId) {
+        throw new ToolCallBlockedError(`Blocked by tool call guard: tool call arguments matched rule '${result.ruleId}'`, result.ruleId);
+    }
+};
+//# sourceMappingURL=toolCallGuard.js.map