@synoikia/core 0.1.0

package/dist/audit-query.d.ts

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+import type { DbLike } from './db/index.js';
+/** Audit log reads for the portal (design §8.2): filterable, paginated, exportable. Never writes. */
+export declare const AuditQuerySchema: z.ZodObject<{
+    instance: z.ZodOptional<z.ZodString>;
+    kind: z.ZodOptional<z.ZodEnum<{
+        search: "search";
+        config: "config";
+        call: "call";
+        auth: "auth";
+        plugin: "plugin";
+    }>>;
+    decision: z.ZodOptional<z.ZodString>;
+    operation: z.ZodOptional<z.ZodString>;
+    target: z.ZodOptional<z.ZodString>;
+    actor: z.ZodOptional<z.ZodString>;
+    from: z.ZodOptional<z.ZodCoercedDate<unknown>>;
+    to: z.ZodOptional<z.ZodCoercedDate<unknown>>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    offset: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export type AuditQuery = z.infer<typeof AuditQuerySchema>;
+export declare function queryAudit(db: DbLike, raw: unknown): {
+    rows: {
+        id: number;
+        at: Date;
+        kind: "search" | "config" | "call" | "auth" | "plugin";
+        instanceId: string | null;
+        operationKey: string | null;
+        classification: string | null;
+        decision: string | null;
+        actorKind: "mcp_client" | "user" | "system";
+        actorId: string | null;
+        decidedBy: string | null;
+        decidedVia: string | null;
+        params: unknown;
+        resolvedTargets: unknown;
+        resultStatus: string | null;
+        durationMs: number | null;
+        detail: unknown;
+    }[];
+    total: number;
+    limit: number;
+    offset: number;
+};
+/**
+ * The audit CSV, one page of rows at a time, so an export of a large log never sits in memory at once.
+ * Pages continue from the last row seen (keyset), not by offset: rows written during the export
+ * neither shift nor repeat what follows.
+ */
+export declare function auditCsvChunks(db: DbLike, raw: unknown): Generator<string>;
+export declare function exportAuditCsv(db: DbLike, raw: unknown): string;

package/dist/audit-query.js

@@ -0,0 +1,116 @@
+import { and, desc, eq, gte, lt, lte, or, sql } from 'drizzle-orm';
+import { z } from 'zod';
+import { auditLog } from './db/schema.js';
+/** Audit log reads for the portal (design §8.2): filterable, paginated, exportable. Never writes. */
+export const AuditQuerySchema = z.object({
+    instance: z.string().optional(),
+    kind: z.enum(['call', 'search', 'config', 'auth', 'plugin']).optional(),
+    /** Prefix match, e.g. `auto-approved` or `rejected:`. */
+    decision: z.string().optional(),
+    operation: z.string().optional(),
+    /** Substring of the resolved targets JSON, e.g. an entity id. */
+    target: z.string().optional(),
+    actor: z.string().optional(),
+    from: z.coerce.date().optional(),
+    to: z.coerce.date().optional(),
+    limit: z.coerce.number().int().min(1).max(1000).default(100),
+    offset: z.coerce.number().int().min(0).default(0),
+});
+const escapeLike = (s) => s.replace(/[%_\\]/g, (c) => `\\${c}`);
+function where(q) {
+    const c = [];
+    if (q.instance)
+        c.push(eq(auditLog.instanceId, q.instance));
+    if (q.kind)
+        c.push(eq(auditLog.kind, q.kind));
+    if (q.decision)
+        c.push(sql `${auditLog.decision} LIKE ${`${escapeLike(q.decision)}%`} ESCAPE '\\'`);
+    if (q.operation)
+        c.push(sql `${auditLog.operationKey} LIKE ${`${escapeLike(q.operation)}%`} ESCAPE '\\'`);
+    if (q.target)
+        c.push(sql `${auditLog.resolvedTargets} LIKE ${`%${escapeLike(q.target)}%`} ESCAPE '\\'`);
+    if (q.actor)
+        c.push(eq(auditLog.actorId, q.actor));
+    if (q.from)
+        c.push(gte(auditLog.at, q.from));
+    if (q.to)
+        c.push(lte(auditLog.at, q.to));
+    return c.length ? and(...c) : undefined;
+}
+export function queryAudit(db, raw) {
+    const q = AuditQuerySchema.parse(raw);
+    const rows = db
+        .select()
+        .from(auditLog)
+        .where(where(q))
+        .orderBy(desc(auditLog.at), desc(auditLog.id))
+        .limit(q.limit)
+        .offset(q.offset)
+        .all();
+    const total = db
+        .select({ n: sql `count(*)` })
+        .from(auditLog)
+        .where(where(q))
+        .get()?.n ?? 0;
+    return { rows, total, limit: q.limit, offset: q.offset };
+}
+const CSV_COLUMNS = [
+    'id',
+    'at',
+    'kind',
+    'instanceId',
+    'operationKey',
+    'classification',
+    'decision',
+    'actorKind',
+    'actorId',
+    'decidedBy',
+    'decidedVia',
+    'resultStatus',
+    'durationMs',
+    'params',
+    'resolvedTargets',
+    'detail',
+];
+function csvCell(v) {
+    if (v === null || v === undefined)
+        return '';
+    let s = v instanceof Date ? v.toISOString() : typeof v === 'object' ? JSON.stringify(v) : String(v);
+    // Neutralize spreadsheet formula injection.
+    if (/^[=+\-@\t\r]/.test(s))
+        s = `'${s}`;
+    return /[",\n\r]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s;
+}
+const CSV_PAGE = 1000;
+/**
+ * The audit CSV, one page of rows at a time, so an export of a large log never sits in memory at once.
+ * Pages continue from the last row seen (keyset), not by offset: rows written during the export
+ * neither shift nor repeat what follows.
+ */
+export function* auditCsvChunks(db, raw) {
+    const q = AuditQuerySchema.parse({ ...raw, limit: CSV_PAGE });
+    yield `${CSV_COLUMNS.join(',')}\n`;
+    let last;
+    for (;;) {
+        const after = last
+            ? or(lt(auditLog.at, last.at), and(eq(auditLog.at, last.at), lt(auditLog.id, last.id)))
+            : undefined;
+        const rows = db
+            .select()
+            .from(auditLog)
+            .where(and(where(q), after))
+            .orderBy(desc(auditLog.at), desc(auditLog.id))
+            .limit(CSV_PAGE)
+            .all();
+        if (rows.length)
+            yield rows.map((r) => `${CSV_COLUMNS.map((c) => csvCell(r[c])).join(',')}\n`).join('');
+        if (rows.length < CSV_PAGE)
+            return;
+        const tail = rows.at(-1);
+        last = { at: tail.at, id: tail.id };
+    }
+}
+export function exportAuditCsv(db, raw) {
+    return [...auditCsvChunks(db, raw)].join('');
+}
+//# sourceMappingURL=audit-query.js.map

package/dist/audit-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-query.js","sourceRoot":"","sources":["../src/audit-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,qGAAqG;AAErG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvE,yDAAyD;IACzD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAExE,SAAS,KAAK,CAAC,CAAa;IAC1B,MAAM,CAAC,GAAU,EAAE,CAAC;IACpB,IAAI,CAAC,CAAC,QAAQ;QAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,IAAI;QAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,QAAQ;QAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA,GAAG,QAAQ,CAAC,QAAQ,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,CAAC;IACnG,IAAI,CAAC,CAAC,SAAS;QAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA,GAAG,QAAQ,CAAC,YAAY,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,cAAc,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA,GAAG,QAAQ,CAAC,eAAe,SAAS,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC;IACvG,IAAI,CAAC,CAAC,KAAK;QAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,IAAI;QAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,EAAE;QAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAU,EAAE,GAAY;IACjD,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,EAAE;SACZ,MAAM,EAAE;SACR,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACf,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;SAC7C,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;SACd,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;SAChB,GAAG,EAAE,CAAC;IACT,MAAM,KAAK,GACT,EAAE;SACC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAQ,UAAU,EAAE,CAAC;SACpC,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACf,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACnB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,YAAY;IACZ,cAAc;IACd,gBAAgB;IAChB,UAAU;IACV,WAAW;IACX,SAAS;IACT,WAAW;IACX,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,iBAAiB;IACjB,QAAQ;CACA,CAAC;AAEX,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpG,4CAA4C;IAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACxC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,CAAC;AAEtB;;;;GAIG;AACH,MAAM,SAAS,CAAC,CAAC,cAAc,CAAC,EAAU,EAAE,GAAY;IACtD,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,GAAI,GAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACnC,IAAI,IAA0C,CAAC;IAC/C,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,IAAI;YAChB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACvF,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,EAAE;aACZ,MAAM,EAAE;aACR,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;aAC3B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aAC7C,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,EAAE,CAAC;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxG,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ;YAAE,OAAO;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;QAC1B,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,GAAY;IACrD,OAAO,CAAC,GAAG,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/C,CAAC"}

package/dist/audit.d.ts

@@ -0,0 +1,5 @@
+import type { DbLike } from './db/index.js';
+import { auditLog } from './db/schema.js';
+export type AuditEvent = Omit<typeof auditLog.$inferInsert, 'id' | 'at'>;
+/** Append-only (design §7.3): this module only ever inserts. */
+export declare function writeAudit(db: DbLike, event: AuditEvent, at?: Date): void;

package/dist/audit.js

@@ -0,0 +1,8 @@
+import { auditLog } from './db/schema.js';
+/** Append-only (design §7.3): this module only ever inserts. */
+export function writeAudit(db, event, at = new Date()) {
+    db.insert(auditLog)
+        .values({ ...event, at })
+        .run();
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAI1C,gEAAgE;AAChE,MAAM,UAAU,UAAU,CAAC,EAAU,EAAE,KAAiB,EAAE,KAAW,IAAI,IAAI,EAAE;IAC7E,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC;SACxB,GAAG,EAAE,CAAC;AACX,CAAC"}

package/dist/auth/mcp-auth.d.ts

@@ -0,0 +1,50 @@
+import type { Context } from 'hono';
+import type { JWTVerifyGetKey } from 'jose';
+import type { AppContext } from '../app.js';
+import type { OAuthService } from './oauth.js';
+import type { AccessCeiling } from '../gate/access.js';
+import type { AuthMode } from '../instances/manager.js';
+/**
+ * Authentication for `/{slug}` (design §6.2). The mode is the instance override or the global
+ * default. Every accepted request yields an identity that is recorded on each audited call.
+ */
+export interface McpIdentity {
+    kind: 'token' | 'oauth' | 'external';
+    /** Stable principal for session binding: a token id, `grant:<id>`, or the external identity. */
+    principal: string;
+    /** Human-readable, shown in audit and approvals: `token:Claude Code`, `oauth:Claude for admin`. */
+    label: string;
+    /**
+     * Ceiling on what this principal can reach (design §6.3): chosen on the consent page for OAuth,
+     * set per bearer token. `external` mode trusts the fronting proxy, so it is not limited here.
+     */
+    access: AccessCeiling;
+}
+export type McpAuthResult = {
+    ok: true;
+    identity: McpIdentity;
+} | {
+    ok: false;
+    status: 401 | 403;
+    error: string;
+    message: string;
+    wwwAuthenticate?: string;
+};
+/**
+ * The MCP listener's public origin: PUBLIC_MCP_URL, or — only where no security decision depends on
+ * it (the approval-page link sent back to the same client, sign-in redirects) — the request's origin.
+ */
+export declare function publicMcpBase(ctx: AppContext, c: Context): string;
+export declare const resourceUrl: (base: string, slug: string) => string;
+export declare function effectiveAuthMode(ctx: AppContext, instanceAuthMode: string | null): AuthMode;
+/**
+ * Verifies a `Cf-Access-Jwt-Assertion` against the team's signing keys: signature, issuer (the team
+ * domain), audience (the Access application's AUD tag) and expiry. Returns who it names, or null.
+ * `keys` replaces the team's published key set (tests).
+ */
+export declare function verifyCloudflareAccess(teamDomain: string, aud: string, assertion: string, keys?: JWTVerifyGetKey): Promise<string | null>;
+export declare function authenticateMcp(ctx: AppContext, oauth: OAuthService, c: Context, instance: {
+    id: string;
+    slug: string;
+    authMode: string | null;
+}): Promise<McpAuthResult>;

package/dist/auth/mcp-auth.js

@@ -0,0 +1,160 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { getSettings } from '../settings.js';
+import { McpTokenService, TOKEN_PREFIX } from './mcp-tokens.js';
+import { ACCESS_PREFIX, canonicalResource } from './oauth.js';
+import { clientIp, requestOrigin } from '../http/common.js';
+/**
+ * The MCP listener's public origin: PUBLIC_MCP_URL, or — only where no security decision depends on
+ * it (the approval-page link sent back to the same client, sign-in redirects) — the request's origin.
+ */
+export function publicMcpBase(ctx, c) {
+    return (ctx.config.PUBLIC_MCP_URL ?? requestOrigin(c, ctx.config.TRUST_PROXY)).replace(/\/+$/, '');
+}
+export const resourceUrl = (base, slug) => canonicalResource(`${base}/${slug}`);
+export function effectiveAuthMode(ctx, instanceAuthMode) {
+    return instanceAuthMode ?? getSettings(ctx.db, 'mcp').defaultAuthMode;
+}
+const jwksCache = new Map();
+/**
+ * Verifies a `Cf-Access-Jwt-Assertion` against the team's signing keys: signature, issuer (the team
+ * domain), audience (the Access application's AUD tag) and expiry. Returns who it names, or null.
+ * `keys` replaces the team's published key set (tests).
+ */
+export async function verifyCloudflareAccess(teamDomain, aud, assertion, keys) {
+    const domain = teamDomain.replace(/^https?:\/\//, '').replace(/\/+$/, '');
+    let jwks = keys ?? jwksCache.get(domain);
+    if (!jwks) {
+        const remote = createRemoteJWKSet(new URL(`https://${domain}/cdn-cgi/access/certs`));
+        jwksCache.set(domain, remote);
+        jwks = remote;
+    }
+    try {
+        const { payload } = await jwtVerify(assertion, jwks, { issuer: `https://${domain}`, audience: aud });
+        return typeof payload.email === 'string' ? payload.email : (payload.sub ?? 'cf-access');
+    }
+    catch {
+        return null;
+    }
+}
+export async function authenticateMcp(ctx, oauth, c, instance) {
+    const mode = effectiveAuthMode(ctx, instance.authMode);
+    const settings = getSettings(ctx.db, 'mcp');
+    if (mode === 'external') {
+        const { teamDomain, aud } = settings.cfAccess;
+        if (teamDomain && aud) {
+            const assertion = c.req.header('cf-access-jwt-assertion');
+            const who = assertion ? await verifyCloudflareAccess(teamDomain, aud, assertion) : null;
+            if (!who)
+                return {
+                    ok: false,
+                    status: 401,
+                    error: 'unauthorized',
+                    message: 'Cloudflare Access assertion missing or invalid',
+                };
+            return {
+                ok: true,
+                identity: { kind: 'external', principal: `cf:${who}`, label: `external:${who}`, access: 'write' },
+            };
+        }
+        const header = settings.trustedIdentityHeader;
+        const named = header && c.req.header(header)?.trim().slice(0, 200);
+        if (named)
+            return {
+                ok: true,
+                identity: { kind: 'external', principal: `ext:${named}`, label: `external:${named}`, access: 'write' },
+            };
+        // Anonymous: without an identity, the client address is what keeps callers' sessions (and rate
+        // budgets) apart; otherwise every anonymous client would share one principal.
+        const ip = clientIp(c, ctx.config.TRUST_PROXY) ?? 'unknown';
+        return {
+            ok: true,
+            identity: {
+                kind: 'external',
+                principal: `ext-anon:${ip}`,
+                label: `external (anonymous, ${ip})`,
+                access: 'write',
+            },
+        };
+    }
+    const allowBearer = mode === 'bearer' || mode === 'bearer+oauth';
+    // OAuth is off until PUBLIC_MCP_URL is set: its discovery documents must not come from the Host header.
+    const allowOauth = (mode === 'oauth' || mode === 'bearer+oauth') && !!ctx.config.PUBLIC_MCP_URL;
+    const base = publicMcpBase(ctx, c);
+    const challenge = (error) => {
+        const params = [];
+        if (allowOauth)
+            params.push(`resource_metadata="${base}/.well-known/oauth-protected-resource/${instance.slug}"`);
+        if (error)
+            params.push(`error="${error}"`);
+        return params.length ? `Bearer ${params.join(', ')}` : 'Bearer';
+    };
+    const auth = c.req.header('authorization');
+    const token = auth?.match(/^Bearer\s+(\S+)$/i)?.[1];
+    if (!token)
+        return {
+            ok: false,
+            status: 401,
+            error: 'unauthorized',
+            message: 'Authentication required',
+            wwwAuthenticate: challenge(),
+        };
+    if (allowBearer && token.startsWith(TOKEN_PREFIX)) {
+        const row = ctx.tokens.verify(token);
+        if (!row)
+            return {
+                ok: false,
+                status: 401,
+                error: 'invalid_token',
+                message: 'Invalid or expired token',
+                wwwAuthenticate: challenge('invalid_token'),
+            };
+        if (!McpTokenService.inScope(row, instance.id)) {
+            return {
+                ok: false,
+                status: 403,
+                error: 'insufficient_scope',
+                message: 'This token is not valid for this endpoint',
+            };
+        }
+        return {
+            ok: true,
+            identity: { kind: 'token', principal: `token:${row.id}`, label: `token:${row.name}`, access: row.access },
+        };
+    }
+    if (allowOauth && token.startsWith(ACCESS_PREFIX)) {
+        const found = oauth.verifyAccess(token, instance.id);
+        if (!found)
+            return {
+                ok: false,
+                status: 401,
+                error: 'invalid_token',
+                message: 'Invalid or expired token',
+                wwwAuthenticate: challenge('invalid_token'),
+            };
+        if (!found.inAudience) {
+            return {
+                ok: false,
+                status: 403,
+                error: 'insufficient_scope',
+                message: 'This token was not granted for this endpoint',
+            };
+        }
+        return {
+            ok: true,
+            identity: {
+                kind: 'oauth',
+                principal: `grant:${found.grantId}`,
+                label: `oauth:${found.client.name} (${found.user.username})`,
+                access: found.access,
+            },
+        };
+    }
+    return {
+        ok: false,
+        status: 401,
+        error: 'invalid_token',
+        message: 'This endpoint does not accept that kind of token',
+        wwwAuthenticate: challenge('invalid_token'),
+    };
+}
+//# sourceMappingURL=mcp-auth.js.map

package/dist/auth/mcp-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.js","sourceRoot":"","sources":["../../src/auth/mcp-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAI9D,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAwB5D;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAe,EAAE,CAAU;IACvD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AAEhG,MAAM,UAAU,iBAAiB,CAAC,GAAe,EAAE,gBAA+B;IAChF,OAAQ,gBAAoC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC;AAC7F,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,GAAW,EACX,SAAiB,EACjB,IAAsB;IAEtB,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,IAAI,IAAI,GAAG,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,WAAW,MAAM,uBAAuB,CAAC,CAAC,CAAC;QACrF,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACrG,OAAO,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAe,EACf,KAAmB,EACnB,CAAU,EACV,QAA+D;IAE/D,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAE5C,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC9C,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACxF,IAAI,CAAC,GAAG;gBACN,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,gDAAgD;iBAC1D,CAAC;YACJ,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;aAClG,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,qBAAqB,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnE,IAAI,KAAK;YACP,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;aACvG,CAAC;QACJ,+FAA+F;QAC/F,8EAA8E;QAC9E,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE;gBACR,IAAI,EAAE,UAAU;gBAChB,SAAS,EAAE,YAAY,EAAE,EAAE;gBAC3B,KAAK,EAAE,wBAAwB,EAAE,GAAG;gBACpC,MAAM,EAAE,OAAO;aAChB;SACF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,cAAc,CAAC;IACjE,wGAAwG;IACxG,MAAM,UAAU,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;IAChG,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE;QACnC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,yCAAyC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QACjH,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClE,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QACR,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,yBAAyB;YAClC,eAAe,EAAE,SAAS,EAAE;SAC7B,CAAC;IAEJ,IAAI,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YACN,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,0BAA0B;gBACnC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;aAC5C,CAAC;QACJ,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,2CAA2C;aACrD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;SAC1G,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YACR,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,0BAA0B;gBACnC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;aAC5C,CAAC;QACJ,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,8CAA8C;aACxD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE;gBACR,IAAI,EAAE,OAAO;gBACb,SAAS,EAAE,SAAS,KAAK,CAAC,OAAO,EAAE;gBACnC,KAAK,EAAE,SAAS,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG;gBAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,kDAAkD;QAC3D,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/auth/mcp-tokens.d.ts

@@ -0,0 +1,57 @@
+import { z } from 'zod';
+import type { Db } from '../db/index.js';
+import { mcpTokens } from '../db/schema.js';
+/**
+ * Static bearer tokens for MCP clients (design §6.2): `syn_…`, shown once, stored as SHA-256,
+ * scoped to instance ids or `*`. A token outside its scope gets 403, not 401.
+ */
+export declare const TOKEN_PREFIX = "syn_";
+export declare const CreateTokenSchema: z.ZodObject<{
+    name: z.ZodString;
+    scope: z.ZodArray<z.ZodString>;
+    access: z.ZodDefault<z.ZodEnum<{
+        read: "read";
+        write: "write";
+    }>>;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodCoercedDate<unknown>>>;
+}, z.core.$strip>;
+type TokenRow = typeof mcpTokens.$inferSelect;
+export declare class McpTokenService {
+    private readonly db;
+    private readonly now;
+    constructor(db: Db, now?: () => Date);
+    list(): {
+        id: string;
+        name: string;
+        scope: string[];
+        access: "read" | "write";
+        createdAt: Date;
+        expiresAt: Date | null;
+        lastUsedAt: Date | null;
+        revokedAt: Date | null;
+    }[];
+    create(raw: unknown, actor?: {
+        userId?: string;
+    }): {
+        token: string;
+        id: string;
+        name: string;
+        scope: string[];
+        access: "read" | "write";
+        createdAt: Date;
+        expiresAt: Date | null;
+        lastUsedAt: Date | null;
+        revokedAt: Date | null;
+    };
+    revoke(id: string, actor?: {
+        userId?: string;
+    }): void;
+    /** Their creator was disabled: bearer tokens they made are revoked (re-enabling revives none). */
+    revokeCreatedBy(userId: string, actor?: {
+        userId?: string;
+    }): number;
+    /** Returns the token row if the value is live (not revoked/expired), regardless of scope. */
+    verify(value: string): TokenRow | null;
+    static inScope(row: Pick<TokenRow, 'scope'>, instanceId: string): boolean;
+}
+export {};

package/dist/auth/mcp-tokens.js

@@ -0,0 +1,143 @@
+import { randomUUID } from 'node:crypto';
+import { and, asc, eq, inArray, isNull } from 'drizzle-orm';
+import { z } from 'zod';
+import { writeAudit } from '../audit.js';
+import { mcpTokens, pluginInstances } from '../db/schema.js';
+import { NotFoundError, ValidationError } from '../errors.js';
+import { ACCESS_CEILINGS } from '../gate/access.js';
+import { randomToken, sha256 } from './tokens.js';
+/**
+ * Static bearer tokens for MCP clients (design §6.2): `syn_…`, shown once, stored as SHA-256,
+ * scoped to instance ids or `*`. A token outside its scope gets 403, not 401.
+ */
+export const TOKEN_PREFIX = 'syn_';
+export const CreateTokenSchema = z.object({
+    name: z.string().trim().min(1).max(100),
+    scope: z.array(z.string().min(1)).min(1),
+    /** `read` (default) hides and blocks every write, whatever the endpoint's levels allow. */
+    access: z.enum(ACCESS_CEILINGS).default('read'),
+    expiresAt: z.coerce.date().nullable().optional(),
+});
+const publicToken = (t) => ({
+    id: t.id,
+    name: t.name,
+    scope: t.scope,
+    access: t.access,
+    createdAt: t.createdAt,
+    expiresAt: t.expiresAt,
+    lastUsedAt: t.lastUsedAt,
+    revokedAt: t.revokedAt,
+});
+export class McpTokenService {
+    db;
+    now;
+    constructor(db, now = () => new Date()) {
+        this.db = db;
+        this.now = now;
+    }
+    list() {
+        return this.db.select().from(mcpTokens).orderBy(asc(mcpTokens.createdAt)).all().map(publicToken);
+    }
+    create(raw, actor = {}) {
+        const input = CreateTokenSchema.parse(raw);
+        if (input.expiresAt && input.expiresAt.getTime() <= this.now().getTime()) {
+            throw new ValidationError('invalid_expiry', 'Expiry must be in the future');
+        }
+        if (!input.scope.includes('*')) {
+            const known = new Set(this.db
+                .select({ id: pluginInstances.id })
+                .from(pluginInstances)
+                .all()
+                .map((r) => r.id));
+            const unknown = input.scope.filter((s) => !known.has(s));
+            if (unknown.length)
+                throw new ValidationError('unknown_instance', `Unknown endpoint(s) in scope: ${unknown.join(', ')}`);
+        }
+        const token = `${TOKEN_PREFIX}${randomToken(32)}`;
+        const id = randomUUID();
+        this.db.transaction((tx) => {
+            tx.insert(mcpTokens)
+                .values({
+                id,
+                name: input.name,
+                tokenHash: sha256(token),
+                scope: input.scope,
+                access: input.access,
+                createdBy: actor.userId ?? null,
+                createdAt: this.now(),
+                expiresAt: input.expiresAt ?? null,
+            })
+                .run();
+            writeAudit(tx, {
+                kind: 'config',
+                decision: 'mcp_token_created',
+                actorKind: 'user',
+                actorId: actor.userId,
+                detail: { id, name: input.name, scope: input.scope, access: input.access, expiresAt: input.expiresAt ?? null },
+            });
+        });
+        return { ...publicToken(this.db.select().from(mcpTokens).where(eq(mcpTokens.id, id)).get()), token };
+    }
+    revoke(id, actor = {}) {
+        const row = this.db.select().from(mcpTokens).where(eq(mcpTokens.id, id)).get();
+        if (!row)
+            throw new NotFoundError('token_not_found', 'No such token');
+        this.db.transaction((tx) => {
+            tx.update(mcpTokens).set({ revokedAt: this.now() }).where(eq(mcpTokens.id, id)).run();
+            writeAudit(tx, {
+                kind: 'config',
+                decision: 'mcp_token_revoked',
+                actorKind: 'user',
+                actorId: actor.userId,
+                detail: { id, name: row.name },
+            });
+        });
+    }
+    /** Their creator was disabled: bearer tokens they made are revoked (re-enabling revives none). */
+    revokeCreatedBy(userId, actor = {}) {
+        return this.db.transaction((tx) => {
+            const live = tx
+                .select({ id: mcpTokens.id, name: mcpTokens.name })
+                .from(mcpTokens)
+                .where(and(eq(mcpTokens.createdBy, userId), isNull(mcpTokens.revokedAt)))
+                .all();
+            if (!live.length)
+                return 0;
+            tx.update(mcpTokens)
+                .set({ revokedAt: this.now() })
+                .where(inArray(mcpTokens.id, live.map((t) => t.id)))
+                .run();
+            writeAudit(tx, {
+                kind: 'config',
+                decision: 'mcp_tokens_revoked',
+                actorKind: actor.userId ? 'user' : 'system',
+                actorId: actor.userId,
+                detail: { createdBy: userId, reason: 'user_disabled', tokens: live.map((t) => t.name) },
+            });
+            return live.length;
+        });
+    }
+    /** Returns the token row if the value is live (not revoked/expired), regardless of scope. */
+    verify(value) {
+        if (!value.startsWith(TOKEN_PREFIX) || value.length > 200)
+            return null;
+        const row = this.db
+            .select()
+            .from(mcpTokens)
+            .where(eq(mcpTokens.tokenHash, sha256(value)))
+            .get();
+        if (!row || row.revokedAt)
+            return null;
+        const now = this.now();
+        if (row.expiresAt && row.expiresAt.getTime() <= now.getTime())
+            return null;
+        if (!row.lastUsedAt || now.getTime() - row.lastUsedAt.getTime() > 60_000) {
+            this.db.update(mcpTokens).set({ lastUsedAt: now }).where(eq(mcpTokens.id, row.id)).run();
+        }
+        return row;
+    }
+    static inScope(row, instanceId) {
+        return row.scope.includes('*') || row.scope.includes(instanceId);
+    }
+}
+//# sourceMappingURL=mcp-tokens.js.map

package/dist/auth/mcp-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-tokens.js","sourceRoot":"","sources":["../../src/auth/mcp-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAElD;;;GAGG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,2FAA2F;IAC3F,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAIH,MAAM,WAAW,GAAG,CAAC,CAAW,EAAE,EAAE,CAAC,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,SAAS,EAAE,CAAC,CAAC,SAAS;CACvB,CAAC,CAAC;AAEH,MAAM,OAAO,eAAe;IAEP;IACA;IAFnB,YACmB,EAAM,EACN,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QADlC,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEJ,IAAI;QACF,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,CAAC,GAAY,EAAE,QAA6B,EAAE;QAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACzE,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;iBAClC,IAAI,CAAC,eAAe,CAAC;iBACrB,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACpB,CAAC;YACF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,IAAI,OAAO,CAAC,MAAM;gBAChB,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,iCAAiC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;iBACjB,MAAM,CAAC;gBACN,EAAE;gBACF,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;gBAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;aACnC,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,mBAAmB;gBAC7B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE;aAC/G,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAG,CAAC,EAAE,KAAK,EAAE,CAAC;IACxG,CAAC;IAED,MAAM,CAAC,EAAU,EAAE,QAA6B,EAAE;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/E,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;QACtE,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACtF,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,mBAAmB;gBAC7B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kGAAkG;IAClG,eAAe,CAAC,MAAc,EAAE,QAA6B,EAAE;QAC7D,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YAChC,MAAM,IAAI,GAAG,EAAE;iBACZ,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;iBAClD,IAAI,CAAC,SAAS,CAAC;iBACf,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;iBACxE,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,CAAC,CAAC;YAC3B,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;iBACjB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;iBAC9B,KAAK,CACJ,OAAO,CACL,SAAS,CAAC,EAAE,EACZ,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtB,CACF;iBACA,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,oBAAoB;gBAC9B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC3C,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;aACxF,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6FAA6F;IAC7F,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,MAAM,EAAE;aACR,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;aAC7C,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC;QAC3E,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;YACzE,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAA4B,EAAE,UAAkB;QAC7D,OAAO,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;CACF"}