@voyant-travel/hono 0.120.1 → 0.121.0

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAQhC,OAAO,EAAE,KAAK,gBAAgB,EAA0C,MAAM,kBAAkB,CAAA;AA+BhG,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAY,eAAe,EAAE,MAAM,YAAY,CAAA;AAI5F,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,SAAS,SAAS,cAAc,IAAI;IAChD,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAA;AAuBD;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IAEd,IAAI,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;CAC/D;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB,CAAC,SAAS,GAAG,OAAO;IACtD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;;;;;;;OAQG;IACH,QAAQ,EAAE,OAAO,qBAAqB,EAAE,QAAQ,CAAA;IAChD;;;;;OAKG;IACH,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB;;;;;;OAMG;IACH,YAAY,EAAE,WAAW,EAAE,CAAA;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,SAAS,SAAS,cAAc,EACvD,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,mBAAmB,CAAC,SAAS,CAAC,CA+f5D"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAQhC,OAAO,EAAE,KAAK,gBAAgB,EAA0C,MAAM,kBAAkB,CAAA;AA+BhG,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAY,eAAe,EAAE,MAAM,YAAY,CAAA;AAI5F,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,SAAS,SAAS,cAAc,IAAI;IAChD,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAA;AAuBD;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IAEd,IAAI,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;CAC/D;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB,CAAC,SAAS,GAAG,OAAO;IACtD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;;;;;;;OAQG;IACH,QAAQ,EAAE,OAAO,qBAAqB,EAAE,QAAQ,CAAA;IAChD;;;;;OAKG;IACH,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB;;;;;;OAMG;IACH,YAAY,EAAE,WAAW,EAAE,CAAA;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,SAAS,SAAS,cAAc,EACvD,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,mBAAmB,CAAC,SAAS,CAAC,CA4gB5D"}

package/dist/app.js

@@ -417,6 +417,21 @@ export function mountApp(config) {
     // uniform across eager + lazy. Webhook routes are intentionally excluded — the
     // per-module docs cover the admin/storefront surfaces only.
     const moduleMounts = [];
+    const deferredLazyRouteMounts = [];
+    function deferLazyRoutesAt(moduleName, prefix, load) {
+        lazyMounts.push({ prefix, load });
+        moduleMounts.push({ moduleName, prefix, load });
+        deferredLazyRouteMounts.push(() => {
+            mountLazyRoutesAt(app, prefix, load);
+        });
+    }
+    function deferLazyRoutePaths(moduleName, paths, load) {
+        lazyMounts.push({ prefix: "/", load });
+        moduleMounts.push({ moduleName, prefix: "/", load });
+        deferredLazyRouteMounts.push(() => {
+            mountLazyRoutePaths(app, paths, load);
+        });
+    }
     // Mount module routes
     for (const mod of allModules) {
         const moduleName = mod.module.name;
@@ -433,19 +448,13 @@ export function mountApp(config) {
             moduleMounts.push({ moduleName, prefix: publicPrefix, load: () => publicRoutes });
         }
         if (mod.lazyAdminRoutes) {
-            mountLazyRoutesAt(app, adminPrefix, mod.lazyAdminRoutes);
-            lazyMounts.push({ prefix: adminPrefix, load: mod.lazyAdminRoutes });
-            moduleMounts.push({ moduleName, prefix: adminPrefix, load: mod.lazyAdminRoutes });
+            deferLazyRoutesAt(moduleName, adminPrefix, mod.lazyAdminRoutes);
         }
         if (mod.lazyPublicRoutes) {
-            mountLazyRoutesAt(app, publicPrefix, mod.lazyPublicRoutes);
-            lazyMounts.push({ prefix: publicPrefix, load: mod.lazyPublicRoutes });
-            moduleMounts.push({ moduleName, prefix: publicPrefix, load: mod.lazyPublicRoutes });
+            deferLazyRoutesAt(moduleName, publicPrefix, mod.lazyPublicRoutes);
         }
         if (mod.lazyRoutes) {
-            mountLazyRoutePaths(app, mod.lazyRoutes.paths, mod.lazyRoutes.load);
-            lazyMounts.push({ prefix: "/", load: mod.lazyRoutes.load });
-            moduleMounts.push({ moduleName, prefix: "/", load: mod.lazyRoutes.load });
+            deferLazyRoutePaths(moduleName, mod.lazyRoutes.paths, mod.lazyRoutes.load);
         }
         if (mod.webhookRoutes) {
             app.route(`/v1/${moduleName}`, mod.webhookRoutes);
@@ -467,24 +476,21 @@ export function mountApp(config) {
             moduleMounts.push({ moduleName, prefix: publicPrefix, load: () => publicRoutes });
         }
         if (ext.lazyAdminRoutes) {
-            mountLazyRoutesAt(app, adminPrefix, ext.lazyAdminRoutes);
-            lazyMounts.push({ prefix: adminPrefix, load: ext.lazyAdminRoutes });
-            moduleMounts.push({ moduleName, prefix: adminPrefix, load: ext.lazyAdminRoutes });
+            deferLazyRoutesAt(moduleName, adminPrefix, ext.lazyAdminRoutes);
         }
         if (ext.lazyPublicRoutes) {
-            mountLazyRoutesAt(app, publicPrefix, ext.lazyPublicRoutes);
-            lazyMounts.push({ prefix: publicPrefix, load: ext.lazyPublicRoutes });
-            moduleMounts.push({ moduleName, prefix: publicPrefix, load: ext.lazyPublicRoutes });
+            deferLazyRoutesAt(moduleName, publicPrefix, ext.lazyPublicRoutes);
         }
         if (ext.lazyRoutes) {
-            mountLazyRoutePaths(app, ext.lazyRoutes.paths, ext.lazyRoutes.load);
-            lazyMounts.push({ prefix: "/", load: ext.lazyRoutes.load });
-            moduleMounts.push({ moduleName, prefix: "/", load: ext.lazyRoutes.load });
+            deferLazyRoutePaths(moduleName, ext.lazyRoutes.paths, ext.lazyRoutes.load);
         }
         if (ext.webhookRoutes) {
             app.route(`/v1/${moduleName}`, ext.webhookRoutes);
         }
     }
+    for (const mountLazyRoutes of deferredLazyRouteMounts) {
+        mountLazyRoutes();
+    }
     // Additional routes
     if (config.additionalRoutes) {
         config.additionalRoutes(app);

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAM7C,OAAO,EACL,KAAK,QAAQ,EAEb,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,aAAa,CAAA;AA2GpB,wBAAgB,WAAW,CAAC,SAAS,SAAS,cAAc,EAC1D,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC7B,IAAI,CAAC,EAAE;IACL,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAA;CACxC,GACA,iBAAiB,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAC,CAwLD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAM7C,OAAO,EACL,KAAK,QAAQ,EAEb,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,aAAa,CAAA;AAgIpB,wBAAgB,WAAW,CAAC,SAAS,SAAS,cAAc,EAC1D,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC7B,IAAI,CAAC,EAAE;IACL,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAA;CACxC,GACA,iBAAiB,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAC,CA4LD"}

package/dist/middleware/auth.js

@@ -1,5 +1,5 @@
 import { apikeyTable } from "@voyant-travel/db/schema/iam";
-import { permissionsToStrings } from "@voyant-travel/types/api-keys";
+import { API_KEY_AUDIENCES, permissionsToStrings } from "@voyant-travel/types/api-keys";
 import { and, eq, sql } from "drizzle-orm";
 import { constantTimeEqual, sha256Base64Url, sha256Hex } from "../auth/crypto.js";
 import { extractBearerToken, verifySession } from "../auth/session-jwt.js";
@@ -91,6 +91,26 @@ async function writeCachedApiKey(kv, keyHash, row) {
         // cache writes are best-effort
     }
 }
+const API_KEY_AUDIENCE_SET = new Set(API_KEY_AUDIENCES);
+/**
+ * Extract the grant audience from an API key's `metadata` JSON. Malformed or
+ * absent metadata falls back to `"staff"` (legacy server-to-server default).
+ */
+function resolveApiKeyAudience(metadata) {
+    if (!metadata)
+        return "staff";
+    try {
+        const parsed = JSON.parse(metadata);
+        const value = parsed?.audience;
+        if (typeof value === "string" && API_KEY_AUDIENCE_SET.has(value)) {
+            return value;
+        }
+    }
+    catch {
+        // Ignore malformed metadata — fall back to the staff default.
+    }
+    return "staff";
+}
 function applyAuthContext(c, auth) {
     if (auth.userId)
         c.set("userId", auth.userId);
@@ -102,6 +122,8 @@ function applyAuthContext(c, auth) {
         c.set("callerType", auth.callerType);
     if (auth.actor)
         c.set("actor", auth.actor);
+    if (auth.audience)
+        c.set("audience", auth.audience);
     if (auth.scopes !== undefined)
         c.set("scopes", auth.scopes);
     if (auth.isInternalRequest !== undefined)
@@ -209,16 +231,20 @@ export function requireAuth(dbSource, opts) {
                     .catch(() => { });
                 tryGetExecutionCtx(c)?.waitUntil(counterUpdate);
                 const scopes = permissionsToStrings(row.permissions);
+                // Audience is a grant attribute carried on the key's `metadata`, not
+                // inferred from scopes (D3). Legacy keys with no audience default to
+                // `staff`, preserving prior server-to-server behaviour. The actor
+                // follows the audience so a non-staff key resolves to its own
+                // visibility pool instead of silently gaining operator privileges.
+                const audience = resolveApiKeyAudience(row.metadata);
                 applyAuthContext(c, {
                     organizationId: row.referenceId,
                     scopes,
                     callerType: "api_key",
                     apiTokenId: row.id,
                     apiKeyId: row.id,
-                    // Core-owned API keys (`voy_` prefix) are server-to-server credentials
-                    // issued to operator staff. The actor stays explicit here so that
-                    // `requireActor` doesn't have to default unset callers to "staff".
-                    actor: "staff",
+                    actor: audience,
+                    audience,
                 });
                 // `await` is load-bearing: with a bare `return next()` the
                 // `finally` would run as soon as the downstream promise is

package/dist/middleware/require-actor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"require-actor.d.ts","sourceRoot":"","sources":["../../src/middleware/require-actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAG7C,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AA8DlE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAIzD;AAED,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,EAC5E,GAAG,OAAO,EAAE,KAAK,EAAE,GAClB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAC,CAAA;AACF,wBAAgB,YAAY,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,EAC5E,OAAO,EAAE,mBAAmB,EAC5B,GAAG,OAAO,EAAE,KAAK,EAAE,GAClB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAC,CAAA"}
+{"version":3,"file":"require-actor.d.ts","sourceRoot":"","sources":["../../src/middleware/require-actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAG7C,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AA0ElE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAIzD;AAED,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,EAC5E,GAAG,OAAO,EAAE,KAAK,EAAE,GAClB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAC,CAAA;AACF,wBAAgB,YAAY,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,EAC5E,OAAO,EAAE,mBAAmB,EAC5B,GAAG,OAAO,EAAE,KAAK,EAAE,GAClB,iBAAiB,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAC,CAAA"}

package/dist/middleware/require-actor.js

@@ -1,5 +1,15 @@
 import { hasApiKeyPermission, permissionStringsToPermissions } from "@voyant-travel/types/api-keys";
 import { normalizePathname } from "../lib/public-paths.js";
+/**
+ * Route surfaces exempt from the coarse method+path permission guard because
+ * they enforce authorization at a finer grain internally: `_meta` (capability
+ * discovery) and `mcp` (the agent tool server, which gates every tool by its own
+ * `requiredScopes`). Neither is a real module name.
+ */
+const COARSE_GUARD_EXEMPT_RESOURCES = new Set(["_meta", "mcp"]);
+function isCoarseGuardExempt(resource) {
+    return resource !== null && COARSE_GUARD_EXEMPT_RESOURCES.has(resource);
+}
 function apiKeyResourceFromPath(pathname) {
     const surfaceMatch = pathname.match(/^\/v1\/(?:admin|public)\/([^/]+)/);
     if (surfaceMatch?.[1])
@@ -84,11 +94,13 @@ export function requireActor(...args) {
                 basePath: options.basePath,
             });
             const resource = apiKeyResourceFromPath(pathname);
-            // Meta/discovery endpoints (e.g. `/v1/admin/_meta/capabilities`) report
-            // what the caller can do — including the key's own granted scopes — so any
-            // authenticated API key may read them, regardless of module scope. `_meta`
-            // is a reserved namespace (no module is named `_meta`).
-            if (resource === "_meta")
+            // Coarse-guard-exempt surfaces. `_meta` (capability discovery) and `mcp`
+            // (the agent tool server) are dispatch surfaces where authorization is
+            // enforced at a finer grain than method+path: the MCP server filters and
+            // gates each tool by its own `requiredScopes` (voyant#2792, D2). So any
+            // authenticated key reaches them; a key with no relevant scopes simply
+            // sees an empty tool list. Neither is a real module name.
+            if (isCoarseGuardExempt(resource))
                 return next();
             const actions = apiKeyPermissionActionsForMethod(c.req.method, pathname);
             if (resource && hasAnyApiKeyPermission(c.get("scopes"), resource, actions)) {
@@ -119,7 +131,7 @@ export function requireActor(...args) {
                 basePath: options.basePath,
             });
             const resource = apiKeyResourceFromPath(pathname);
-            if (resource && resource !== "_meta") {
+            if (resource && !isCoarseGuardExempt(resource)) {
                 const actions = apiKeyPermissionActionsForMethod(c.req.method, pathname);
                 if (!hasAnyApiKeyPermission(scopes, resource, actions)) {
                     return c.json({ error: "Forbidden: missing required permission" }, 403);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/hono",
-  "version": "0.120.1",
+  "version": "0.121.0",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -133,21 +133,21 @@
   "dependencies": {
     "@hono/zod-openapi": "^1.4.0",
     "drizzle-orm": "^0.45.2",
-    "hono": "^4.12.25",
+    "hono": "^4.12.27",
     "zod": "^4.4.3",
-    "@voyant-travel/core": "^0.111.1",
-    "@voyant-travel/types": "^0.106.1",
+    "@voyant-travel/core": "^0.112.0",
+    "@voyant-travel/db": "^0.109.5",
     "@voyant-travel/storage": "^0.106.0",
-    "@voyant-travel/db": "^0.109.4",
-    "@voyant-travel/utils": "^0.105.5",
-    "@voyant-travel/workflows": "^0.111.14"
+    "@voyant-travel/types": "^0.107.0",
+    "@voyant-travel/utils": "^0.105.6",
+    "@voyant-travel/workflows": "^0.111.15"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^4.20260628.1",
+    "@cloudflare/workers-types": "^4.20260702.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9",
     "@voyant-travel/voyant-typescript-config": "^0.1.0",
-    "@voyant-travel/workflows-orchestrator": "^0.111.14"
+    "@voyant-travel/workflows-orchestrator": "^0.111.15"
   },
   "files": [
     "dist"