@wardby/cli 0.1.0

package/dist/import/tool-scan.d.ts

@@ -0,0 +1,8 @@
+export declare const SPEC_UNSUPPORTED_HOST_APIS: readonly string[];
+export declare function supportedGlobalsFromPrelude(preludeSource: string): Set<string>;
+export declare function scanToolCode(code: string, supported: ReadonlySet<string>): {
+    ok: true;
+} | {
+    ok: false;
+    rejectedApis: string[];
+};

package/dist/import/tool-scan.js

@@ -0,0 +1,20 @@
+// Host APIs a migration bundle's tool may reference that wardby will NOT
+// provide. sendEmail/getInboundEmail are intentionally absent here: they
+// exist as throwing placeholders in SANDBOX_PRELUDE (they import fine and
+// fail at runtime). npmLockUpdate is roadmap-excluded (spec §3.3), so a tool
+// referencing it is rejected at import. Cross-checked against the live
+// prelude so the list self-heals off anything the prelude later defines.
+export const SPEC_UNSUPPORTED_HOST_APIS = ["npmLockUpdate"];
+export function supportedGlobalsFromPrelude(preludeSource) {
+    const names = new Set();
+    const re = /globalThis\.([A-Za-z_$][\w$]*)\s*=/g;
+    let m;
+    while ((m = re.exec(preludeSource)) !== null)
+        names.add(m[1]);
+    return names;
+}
+export function scanToolCode(code, supported) {
+    const denied = SPEC_UNSUPPORTED_HOST_APIS.filter((api) => !supported.has(api));
+    const hit = denied.filter((api) => new RegExp(`\\b${api}\\b`).test(code));
+    return hit.length === 0 ? { ok: true } : { ok: false, rejectedApis: hit };
+}

package/dist/mcp/auth/ownership.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Single seam for ownership decisions across Agent/BudgetGroup/Tool/Secret/
+ * Webhook/Task (and anything else that gains a nullable owner column
+ * later). A null owner means "public": readable AND mutable by anyone —
+ * there is no gatekeeper, so no principal is turned away. `isOwner` stays
+ * available (strict, no null-passthrough) for checks that must stay
+ * owner-only regardless of publicness — e.g. a future claim-on-edit
+ * feature would use it to tell "already owned" apart from "public" before
+ * deciding whether to stamp a new owner. Every tool file routes through
+ * this module instead of re-deriving the null-handling itself, so changing
+ * the policy again later is a change here, not an N-file sweep.
+ */
+import type { PrismaClient, Tool } from "@prisma/client";
+export declare function canRead(ownerId: string | null, principalId: string): boolean;
+export declare function isOwner(ownerId: string | null, principalId: string): boolean;
+/** Same rule as canRead: a null owner is a mutation target for anyone, same as it's a read target for anyone. */
+export declare function canMutate(ownerId: string | null, principalId: string): boolean;
+export declare function assertCanMutate(ownerId: string | null, principalId: string, notFoundMessage: string): void;
+/** Prisma where-clause fragment: rows owned by the caller, plus public (null-owner) rows. */
+export declare function visibleToPrincipal(principalId: string): {
+    OR: ({
+        ownerId: string;
+    } | {
+        ownerId: null;
+    })[];
+};
+export declare function requireOwnedAgent(db: PrismaClient, id: string, principalId: string): Promise<{
+    name: string;
+    model: string;
+    budgetUsd: import("@prisma/client/runtime/library").Decimal;
+    id: string;
+    systemPrompt: string;
+    createdAt: Date;
+    updatedAt: Date;
+    kind: import("@prisma/client").$Enums.AgentKind;
+    schedule: string | null;
+    timezone: string;
+    scheduleEnabled: boolean;
+    lastScheduledAt: Date | null;
+    maxTurns: number;
+    ownerId: string | null;
+    budgetGroupId: string | null;
+    memoryEnabled: boolean;
+}>;
+export declare function requireReadableAgent(db: PrismaClient, id: string, principalId: string): Promise<{
+    name: string;
+    model: string;
+    budgetUsd: import("@prisma/client/runtime/library").Decimal;
+    id: string;
+    systemPrompt: string;
+    createdAt: Date;
+    updatedAt: Date;
+    kind: import("@prisma/client").$Enums.AgentKind;
+    schedule: string | null;
+    timezone: string;
+    scheduleEnabled: boolean;
+    lastScheduledAt: Date | null;
+    maxTurns: number;
+    ownerId: string | null;
+    budgetGroupId: string | null;
+    memoryEnabled: boolean;
+}>;
+export declare function requireOwnedBudgetGroup(db: PrismaClient, id: string, principalId: string): Promise<{
+    name: string;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    ownerId: string | null;
+    dailyBudgetUsd: import("@prisma/client/runtime/library").Decimal | null;
+    weeklyBudgetUsd: import("@prisma/client/runtime/library").Decimal | null;
+    monthlyBudgetUsd: import("@prisma/client/runtime/library").Decimal | null;
+    warnThresholdRatio: import("@prisma/client/runtime/library").Decimal;
+}>;
+export declare function requireReadableBudgetGroup(db: PrismaClient, id: string, principalId: string): Promise<{
+    name: string;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    ownerId: string | null;
+    dailyBudgetUsd: import("@prisma/client/runtime/library").Decimal | null;
+    weeklyBudgetUsd: import("@prisma/client/runtime/library").Decimal | null;
+    monthlyBudgetUsd: import("@prisma/client/runtime/library").Decimal | null;
+    warnThresholdRatio: import("@prisma/client/runtime/library").Decimal;
+}>;
+export declare function requireOwnedSecret(db: PrismaClient, id: string, principalId: string): Promise<void>;
+export declare function requireOwnedWebhook(db: PrismaClient, id: string, principalId: string): Promise<void>;
+export declare function requireOwnedDatastore(db: PrismaClient, id: string, principalId: string): Promise<{
+    name: string;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    ownerId: string | null;
+}>;
+export declare function requireOwnedTool(db: Pick<PrismaClient, "tool">, id: string, principalId: string): Promise<Tool>;
+/**
+ * A Task's principalId is the caller who triggered it, not the underlying
+ * agent's owner — a public agent's runs are still private to whoever
+ * triggered them. No canRead/null=public path exists here on purpose.
+ */
+export declare function requireOwnedTask(db: PrismaClient, taskId: string, principalId: string): Promise<{
+    status: import("@prisma/client").$Enums.TaskStatus;
+    runId: string | null;
+    error: import("@prisma/client/runtime/library").JsonValue | null;
+    result: import("@prisma/client/runtime/library").JsonValue | null;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    kind: import("@prisma/client").$Enums.TaskKind;
+    principalId: string | null;
+    inputRequests: import("@prisma/client/runtime/library").JsonValue | null;
+    inputResponses: import("@prisma/client/runtime/library").JsonValue | null;
+    ttlAt: Date;
+}>;

package/dist/mcp/auth/ownership.js

@@ -0,0 +1,87 @@
+import { McpError } from "../errors.js";
+export function canRead(ownerId, principalId) {
+    return ownerId === null || ownerId === principalId;
+}
+export function isOwner(ownerId, principalId) {
+    return ownerId === principalId;
+}
+/** Same rule as canRead: a null owner is a mutation target for anyone, same as it's a read target for anyone. */
+export function canMutate(ownerId, principalId) {
+    return ownerId === null || ownerId === principalId;
+}
+export function assertCanMutate(ownerId, principalId, notFoundMessage) {
+    if (!canMutate(ownerId, principalId))
+        throw new McpError(403, notFoundMessage);
+}
+/** Prisma where-clause fragment: rows owned by the caller, plus public (null-owner) rows. */
+export function visibleToPrincipal(principalId) {
+    return { OR: [{ ownerId: principalId }, { ownerId: null }] };
+}
+export async function requireOwnedAgent(db, id, principalId) {
+    const agent = await db.agent.findUnique({ where: { id } });
+    if (!agent)
+        throw new McpError(404, `Agent "${id}" not found.`);
+    assertCanMutate(agent.ownerId, principalId, `Agent "${id}" is not owned by the caller.`);
+    return agent;
+}
+export async function requireReadableAgent(db, id, principalId) {
+    const agent = await db.agent.findUnique({ where: { id } });
+    if (!agent || !canRead(agent.ownerId, principalId)) {
+        throw new McpError(404, `Agent "${id}" not found.`);
+    }
+    return agent;
+}
+export async function requireOwnedBudgetGroup(db, id, principalId) {
+    const group = await db.budgetGroup.findUnique({ where: { id } });
+    if (!group)
+        throw new McpError(404, `Budget group "${id}" not found.`);
+    assertCanMutate(group.ownerId, principalId, `Budget group "${id}" is not owned by the caller.`);
+    return group;
+}
+export async function requireReadableBudgetGroup(db, id, principalId) {
+    const group = await db.budgetGroup.findUnique({ where: { id } });
+    if (!group || !canRead(group.ownerId, principalId)) {
+        throw new McpError(404, `Budget group "${id}" not found.`);
+    }
+    return group;
+}
+export async function requireOwnedSecret(db, id, principalId) {
+    const secret = await db.secret.findUnique({ where: { id } });
+    if (!secret)
+        throw new McpError(403, `Secret "${id}" is not owned by the caller.`);
+    assertCanMutate(secret.ownerId, principalId, `Secret "${id}" is not owned by the caller.`);
+}
+export async function requireOwnedWebhook(db, id, principalId) {
+    const webhook = await db.webhook.findUnique({ where: { id } });
+    if (!webhook)
+        throw new McpError(403, `Webhook "${id}" is not owned by the caller.`);
+    assertCanMutate(webhook.ownerId, principalId, `Webhook "${id}" is not owned by the caller.`);
+}
+export async function requireOwnedDatastore(db, id, principalId) {
+    const datastore = await db.datastore.findUnique({ where: { id } });
+    if (!datastore)
+        throw new McpError(403, `Datastore "${id}" is not owned by the caller.`);
+    assertCanMutate(datastore.ownerId, principalId, `Datastore "${id}" is not owned by the caller.`);
+    return datastore;
+}
+export async function requireOwnedTool(db, id, principalId) {
+    const tool = await db.tool.findUnique({ where: { id } });
+    if (!tool)
+        throw new McpError(404, `Tool "${id}" not found.`);
+    assertCanMutate(tool.ownerId, principalId, `Tool "${id}" is not owned by the caller.`);
+    return tool;
+}
+/**
+ * A Task's principalId is the caller who triggered it, not the underlying
+ * agent's owner — a public agent's runs are still private to whoever
+ * triggered them. No canRead/null=public path exists here on purpose.
+ */
+export async function requireOwnedTask(db, taskId, principalId) {
+    const task = await db.task.findUnique({ where: { id: taskId } });
+    // 404, not 403: confirming a taskId exists at all to a non-owner is
+    // itself a small information leak — same reasoning as agent reads.
+    if (!task || !isOwner(task.principalId, principalId)) {
+        throw new McpError(404, `Task "${taskId}" not found.`);
+    }
+    return task;
+}

package/dist/mcp/auth/principal.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Find-or-create a Principal by subject. `subject` is either the IdP's
+ * subject claim (delegating/self-hosted, from a validated AuthProfile) or
+ * the configured LOCAL_PRINCIPAL (stdio, no token) — either way, the caller
+ * always carries an owner, so a deployment that later moves from stdio to
+ * HTTP+OAuth doesn't orphan locally-authored agents.
+ */
+import type { PrismaClient, Principal } from "@prisma/client";
+export declare function resolvePrincipal(subject: string, db: PrismaClient): Promise<Principal>;

package/dist/mcp/auth/principal.js

@@ -0,0 +1,9 @@
+import { requireSubject } from "../../providers/auth/subject.js";
+export async function resolvePrincipal(subject, db) {
+    requireSubject(subject);
+    return db.principal.upsert({
+        where: { subject },
+        create: { subject },
+        update: {},
+    });
+}

package/dist/mcp/auth/resource-server.d.ts

@@ -0,0 +1,47 @@
+/**
+ * OAuth 2.1 resource-server surface: PRM (.well-known) discovery, bearer
+ * validation, and scope enforcement. Works identically regardless of which
+ * AuthProvider (delegating | self-hosted) is active — both implement
+ * verifyBearer, so this file never branches on auth mode.
+ */
+import type { PrismaClient } from "@prisma/client";
+import type { AuthProvider } from "../../providers/auth/types.js";
+import { McpError } from "../errors.js";
+import type { McpRequestContext, McpProviders } from "../context.js";
+/** The initial capability tiers (§Scopes → capability tiers in the design doc). */
+export declare const SCOPES_SUPPORTED: string[];
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+    bearer_methods_supported: string[];
+}
+/** RFC 9728 §3.1: insert `/.well-known/oauth-protected-resource` before the resource's path. */
+export declare function protectedResourceMetadataUrl(canonicalUri: string): string;
+export declare function protectedResourceMetadata(config: {
+    canonicalUri: string;
+    authorizationServers: string[];
+}): ProtectedResourceMetadata;
+export interface AuthenticateHeaders {
+    authorization?: string;
+}
+export interface AuthenticateDeps {
+    authProvider: AuthProvider;
+    db: PrismaClient;
+    providers: McpProviders;
+    canonicalUri: string;
+}
+/**
+ * Validates the bearer token in the `Authorization` header only — never a
+ * query string, so a caller passing a token any other way is structurally
+ * invisible here and falls through to the missing-header 401.
+ */
+export declare function authenticate(headers: AuthenticateHeaders, deps: AuthenticateDeps): Promise<McpRequestContext>;
+/**
+ * Throws a 403 insufficient_scope McpError listing every scope this
+ * operation needs (not just the ones the caller is missing) — so a client
+ * can re-auth once with the full required set instead of round-tripping
+ * per missing scope.
+ */
+export declare function requireScope(ctx: McpRequestContext, canonicalUri: string, ...scopes: string[]): void;
+export { McpError };

package/dist/mcp/auth/resource-server.js

@@ -0,0 +1,82 @@
+import { resolvePrincipal } from "./principal.js";
+import { McpError, unauthorized, insufficientScope } from "../errors.js";
+/** The initial capability tiers (§Scopes → capability tiers in the design doc). */
+export const SCOPES_SUPPORTED = [
+    "agents:read",
+    "agents:write",
+    "tools:write",
+    "runs:trigger",
+    "datastore:write",
+    "secrets:write",
+    "webhooks:write",
+    "budget_groups:write",
+    // Reassigns an agent's owner regardless of who currently owns it (or
+    // whether it's public) — a step above agents:write, which only ever lets
+    // a caller act on agents they already own or that are unowned.
+    "agents:admin",
+];
+/** RFC 9728 §3.1: insert `/.well-known/oauth-protected-resource` before the resource's path. */
+export function protectedResourceMetadataUrl(canonicalUri) {
+    const url = new URL(canonicalUri);
+    const path = url.pathname === "/" ? "" : url.pathname;
+    return `${url.origin}/.well-known/oauth-protected-resource${path}`;
+}
+export function protectedResourceMetadata(config) {
+    return {
+        resource: config.canonicalUri,
+        authorization_servers: config.authorizationServers,
+        scopes_supported: SCOPES_SUPPORTED,
+        bearer_methods_supported: ["header"],
+    };
+}
+/**
+ * Validates the bearer token in the `Authorization` header only — never a
+ * query string, so a caller passing a token any other way is structurally
+ * invisible here and falls through to the missing-header 401.
+ */
+export async function authenticate(headers, deps) {
+    const resourceMetadataUrl = protectedResourceMetadataUrl(deps.canonicalUri);
+    const header = headers.authorization;
+    if (!header || !header.startsWith("Bearer ")) {
+        throw unauthorized("Missing or malformed Authorization header (expected: Bearer <token>).", resourceMetadataUrl);
+    }
+    const token = header.slice("Bearer ".length).trim();
+    if (!token) {
+        throw unauthorized("Missing or malformed Authorization header (expected: Bearer <token>).", resourceMetadataUrl);
+    }
+    let verified;
+    try {
+        verified = await deps.authProvider.verifyBearer(token);
+    }
+    catch {
+        throw unauthorized("Invalid token.", resourceMetadataUrl);
+    }
+    const principal = await resolvePrincipal(verified.subject, deps.db);
+    return {
+        principal,
+        scopes: new Set(verified.scopes),
+        canonicalUri: deps.canonicalUri,
+        providers: deps.providers,
+        db: deps.db,
+        // authenticate() only sees the HTTP Authorization header, before the
+        // JSON-RPC body (and its _meta envelope) is even parsed — the real
+        // per-call value is computed later, in server.ts's resolveCtx, once the
+        // envelope is available. Callers using ONLY this function's return
+        // value (streamable-http.ts's auth gate) never read this field or mcpReq.
+        clientSupportsTasks: false,
+        mcpReq: { requestState: () => undefined },
+    };
+}
+/**
+ * Throws a 403 insufficient_scope McpError listing every scope this
+ * operation needs (not just the ones the caller is missing) — so a client
+ * can re-auth once with the full required set instead of round-tripping
+ * per missing scope.
+ */
+export function requireScope(ctx, canonicalUri, ...scopes) {
+    const held = scopes.every((s) => ctx.scopes.has(s));
+    if (held)
+        return;
+    throw insufficientScope(scopes, protectedResourceMetadataUrl(canonicalUri));
+}
+export { McpError };

package/dist/mcp/auth/self-hosted/browser.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { SelfHostedAuthProvider } from "../../../providers/auth/self-hosted.js";
+export declare function browserHandler(provider: SelfHostedAuthProvider): (req: IncomingMessage, res: ServerResponse, url: URL, body: unknown) => Promise<boolean>;

package/dist/mcp/auth/self-hosted/browser.js

@@ -0,0 +1,273 @@
+import { randomUUID, randomBytes } from "node:crypto";
+import { PostgresRateLimiter, RateLimitError } from "./rate-limit.js";
+import { logger } from "../../../core/logger.js";
+const authLog = logger.child({ module: "self-hosted-oauth" });
+const paths = new Set([
+    "/login",
+    "/consent",
+    "/logout",
+    "/authorize",
+    "/register",
+    "/token",
+    "/revoke",
+    "/.well-known/oauth-authorization-server",
+]);
+function escape(value) {
+    return value.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+// CORS-mode same-origin fetch retains Origin under no-referrer, unlike native form POSTs.
+const FORM_SCRIPT = `document.addEventListener('submit', async (event) => {
+  const form = event.target;
+  event.preventDefault();
+  const body = new URLSearchParams(new FormData(form, event.submitter));
+  try {
+    const response = await fetch(form.action, { method: 'POST', mode: 'cors', credentials: 'same-origin', headers: { 'accept': 'application/json' }, body });
+    const data = await response.json();
+    if (response.ok && typeof data.redirect === 'string') { location.assign(data.redirect); return; }
+  } catch {}
+  document.getElementById('auth-error').textContent = 'Unable to complete the request. Reload this page and try again.';
+});`;
+function html(res, content) {
+    const nonce = randomBytes(18).toString("base64");
+    res.setHeader("content-security-policy", `default-src 'none'; script-src 'nonce-${nonce}'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'`);
+    res
+        .writeHead(200, { "content-type": "text/html; charset=utf-8" })
+        .end('<!doctype html><html lang="en"><meta charset="utf-8"><title>wardby authorization</title><body>' +
+        content +
+        '<p id="auth-error" role="alert"></p><noscript>JavaScript is required for secure form submission.</noscript><script nonce="' +
+        nonce +
+        '">' +
+        FORM_SCRIPT +
+        "</script></body></html>");
+}
+function json(res, status, body) {
+    res.writeHead(status, { "content-type": "application/json" }).end(JSON.stringify(body));
+}
+function redirect(res, location, req) {
+    if (req?.method === "POST" && req.headers.accept === "application/json") {
+        json(res, 200, { redirect: location });
+        return;
+    }
+    res.writeHead(303, { location }).end();
+}
+function hidden(name, value) {
+    return `<input type="hidden" name="${name}" value="${escape(value)}">`;
+}
+export function browserHandler(provider) {
+    const canonical = new URL(provider.config.canonicalUri);
+    const secure = canonical.protocol === "https:";
+    const sessionName = secure ? "__Host-wardby-session" : "wardby-dev-session";
+    const loginName = secure ? "__Host-wardby-login" : "wardby-dev-login";
+    const limiter = new PostgresRateLimiter(provider.db, provider.credentials);
+    const cookie = (name, value, sameSite, age) => `${name}=${value}; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=${age}${secure ? "; Secure" : ""}`;
+    return async (req, res, url, body) => {
+        if (!paths.has(url.pathname))
+            return false;
+        res.setHeader("cache-control", "no-store");
+        res.setHeader("content-security-policy", "default-src 'none'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'");
+        res.setHeader("x-content-type-options", "nosniff");
+        res.setHeader("referrer-policy", "no-referrer");
+        try {
+            const cookies = new Map();
+            for (const part of (req.headers.cookie ?? "").split(";")) {
+                const [key, ...value] = part.trim().split("=");
+                if (cookies.has(key))
+                    throw new Error("duplicate cookie");
+                cookies.set(key, value.join("="));
+            }
+            for (const key of url.searchParams.keys())
+                if (url.searchParams.getAll(key).length !== 1)
+                    throw new Error("duplicate query parameter");
+            const ip = req.socket.remoteAddress ?? "unknown";
+            await limiter.check("auth-ip", ip, 120);
+            if (req.method === "GET" && url.pathname === "/.well-known/oauth-authorization-server") {
+                json(res, 200, provider.asMetadata());
+                return true;
+            }
+            if (req.method === "POST" && url.pathname === "/register") {
+                await limiter.check("registration", ip, 10);
+                if (!body || typeof body !== "object" || body instanceof URLSearchParams || Array.isArray(body))
+                    throw new Error("JSON object body required");
+                const p = body;
+                if (Object.keys(p).some((k) => ![
+                    "redirect_uris",
+                    "client_name",
+                    "grant_types",
+                    "token_endpoint_auth_method",
+                    "response_types",
+                    "scope",
+                    "application_type",
+                ].includes(k)))
+                    throw new Error("unsupported registration field");
+                if (p.response_types && JSON.stringify(p.response_types) !== '["code"]')
+                    throw new Error("unsupported response_types");
+                // Claude Code sends both of the following. Neither is stored.
+                // RFC 7591 `scope`: scopes are requested and consented per
+                // authorization at /authorize, never fixed at registration.
+                if (p.scope !== undefined && (typeof p.scope !== "string" || p.scope.length > 512))
+                    throw new Error("invalid scope");
+                // OIDC Dynamic Client Registration `application_type`: every client
+                // here is already a public PKCE client with validated redirect URIs.
+                if (p.application_type !== undefined && p.application_type !== "native" && p.application_type !== "web")
+                    throw new Error("unsupported application_type");
+                const registered = await provider.registerClient({
+                    redirectUris: p.redirect_uris,
+                    clientName: p.client_name,
+                    grantTypes: p.grant_types,
+                    tokenEndpointAuthMethod: p.token_endpoint_auth_method,
+                });
+                json(res, 201, {
+                    client_id: registered.clientId,
+                    token_endpoint_auth_method: "none",
+                    redirect_uris: p.redirect_uris,
+                });
+                return true;
+            }
+            if (req.method === "GET" && url.pathname === "/authorize") {
+                const p = url.searchParams;
+                if (p.has("subject") || p.get("response_type") !== "code")
+                    throw new Error("invalid authorize parameters");
+                const result = await provider.handleAuthorize({
+                    clientId: p.get("client_id") ?? "",
+                    redirectUri: p.get("redirect_uri") ?? "",
+                    codeChallenge: p.get("code_challenge") ?? "",
+                    codeChallengeMethod: p.get("code_challenge_method") ?? "",
+                    resource: p.get("resource") ?? provider.config.canonicalUri,
+                    scope: p.get("scope") ?? "",
+                    state: p.get("state") ?? undefined,
+                });
+                let target = "/login";
+                try {
+                    await provider.sessions.get(cookies.get(sessionName) ?? "");
+                    target = "/consent";
+                }
+                catch {
+                    /* No valid browser session. */
+                }
+                redirect(res, target + "?interaction=" + encodeURIComponent(result.interactionId));
+                return true;
+            }
+            if (req.method === "GET" && url.pathname === "/login") {
+                const interaction = url.searchParams.get("interaction") ?? "";
+                const nonce = provider.credentials.create("rvb").token;
+                const challenge = await provider.sessions.challenge("login", null, nonce + ":" + interaction);
+                res.setHeader("set-cookie", cookie(loginName, nonce, "Strict", 600));
+                html(res, '<h1>Sign in to wardby</h1><form method="post" action="/login">' +
+                    hidden("interaction", interaction) +
+                    hidden("csrf", challenge) +
+                    '<label>Login key <input type="password" name="login_key" required autocomplete="off"></label><button>Sign in</button></form>');
+                return true;
+            }
+            if (req.method === "POST" &&
+                ["/login", "/consent", "/logout"].includes(url.pathname) &&
+                req.headers.origin !== canonical.origin) {
+                json(res, 403, { error: "invalid_origin" });
+                return true;
+            }
+            if (req.method === "POST" && !(body instanceof URLSearchParams))
+                throw new Error("form body required");
+            const p = body instanceof URLSearchParams ? body : new URLSearchParams();
+            if (req.method === "POST" && url.pathname === "/login") {
+                if (p.has("subject"))
+                    throw new Error("subject parameter not allowed");
+                const key = p.get("login_key") ?? "";
+                await limiter.check("login-ip", ip, 10);
+                await limiter.check("login-key", provider.credentials.id(key, "rvk") ?? "invalid", 5);
+                const interaction = p.get("interaction") ?? "";
+                const nonce = cookies.get(loginName);
+                if (!nonce)
+                    throw new Error("missing login nonce");
+                const session = await provider.sessions.login(key, p.get("csrf") ?? "", nonce + ":" + interaction, cookies.get(sessionName));
+                res.setHeader("set-cookie", [
+                    cookie(sessionName, session, "Lax", 30 * 86400),
+                    cookie(loginName, "", "Strict", 0),
+                ]);
+                redirect(res, interaction ? "/consent?interaction=" + encodeURIComponent(interaction) : "/logout", req);
+                return true;
+            }
+            if (req.method === "GET" && url.pathname === "/consent") {
+                const id = url.searchParams.get("interaction") ?? "";
+                const { interaction, challenge } = await provider.consentPage(cookies.get(sessionName) ?? "", id);
+                const name = interaction.client.metadata.client_name;
+                html(res, "<h1>Authorize " +
+                    escape(name) +
+                    "</h1><p>Resource: " +
+                    escape(interaction.resource) +
+                    "</p><p>Scopes: " +
+                    escape(interaction.requestedScope) +
+                    '</p><form action="/consent" method="post">' +
+                    hidden("interaction", id) +
+                    hidden("csrf", challenge) +
+                    '<button name="decision" value="approve">Approve</button><button name="decision" value="deny">Deny</button></form>');
+                return true;
+            }
+            if (req.method === "POST" && url.pathname === "/consent") {
+                if (!["approve", "deny"].includes(p.get("decision") ?? ""))
+                    throw new Error("invalid consent decision");
+                redirect(res, await provider.consent(cookies.get(sessionName) ?? "", p.get("interaction") ?? "", p.get("csrf") ?? "", p.get("decision") === "approve"), req);
+                return true;
+            }
+            if (req.method === "GET" && url.pathname === "/logout") {
+                const session = await provider.sessions.get(cookies.get(sessionName) ?? "");
+                const challenge = await provider.sessions.challenge("logout", session.sessionId, "logout");
+                html(res, '<form action="/logout" method="post">' + hidden("csrf", challenge) + "<button>Sign out</button></form>");
+                return true;
+            }
+            if (req.method === "POST" && url.pathname === "/logout") {
+                await provider.sessions.logout(cookies.get(sessionName) ?? "", p.get("csrf") ?? "");
+                res.setHeader("set-cookie", cookie(sessionName, "", "Lax", 0));
+                redirect(res, "/login", req);
+                return true;
+            }
+            if (req.method === "POST" && ["/token", "/revoke"].includes(url.pathname)) {
+                if (req.headers.authorization)
+                    throw new Error("Authorization header not allowed (public clients only)");
+                if (p.has("client_secret") || p.has("client_assertion"))
+                    throw new Error("client credentials not allowed (public clients only)");
+                const clientId = p.get("client_id") ?? "";
+                if (url.pathname === "/revoke") {
+                    await provider.revoke(p.get("token") ?? "", clientId);
+                    json(res, 200, {});
+                    return true;
+                }
+                const grantType = p.get("grant_type");
+                if (grantType !== "authorization_code" && grantType !== "refresh_token")
+                    throw new Error("unsupported grant_type");
+                const common = { clientId, resource: p.get("resource") ?? undefined };
+                const token = await provider.handleToken(grantType === "refresh_token"
+                    ? { ...common, grantType, refreshToken: p.get("refresh_token") ?? "" }
+                    : {
+                        ...common,
+                        grantType,
+                        code: p.get("code") ?? "",
+                        codeVerifier: p.get("code_verifier") ?? "",
+                        redirectUri: p.get("redirect_uri") ?? "",
+                    });
+                json(res, 200, {
+                    access_token: token.accessToken,
+                    token_type: token.tokenType,
+                    expires_in: token.expiresIn,
+                    refresh_token: token.refreshToken,
+                    scope: token.scope,
+                });
+                return true;
+            }
+            json(res, 405, { error: "method_not_allowed" });
+        }
+        catch (err) {
+            if (err instanceof RateLimitError) {
+                res.setHeader("retry-after", "60");
+                json(res, 429, { error: "rate_limited" });
+            }
+            else {
+                // The id is returned to the client and logged with the reason, so a
+                // rejection reported by a client can be traced. Only the reason is
+                // logged - never request values, which include codes and tokens.
+                const id = randomUUID();
+                authLog.warn({ id, path: url.pathname, reason: err instanceof Error ? err.message || "unspecified" : "unspecified" }, "self-hosted OAuth request rejected");
+                json(res, 400, { error: url.pathname === "/token" ? "invalid_grant" : "invalid_request", id });
+            }
+        }
+        return true;
+    };
+}