@xignet/payload 0.1.0-beta.0 → 0.1.0-beta.2

package/dist/native-session.js

@@ -5,30 +5,30 @@ export const SESSION_COLLECTION = 'xignet-sessions';
 export const SESSION_CLAIM = '__xignet_sso';
 // Match Payload 3.93's credential precedence and CSRF rules. extractJWT is
 // not a public export, so the pinned adapter tests native browser auth.
-function selectedToken(req) {
+function selectedToken(req, headers = req.headers) {
     for (const method of req.payload.config.auth.jwtOrder) {
         if (method === 'Bearer' || method === 'JWT') {
-            const header = req.headers.get('authorization');
+            const header = headers.get('authorization');
             if (header?.startsWith(`${method} `))
                 return header.slice(method.length + 1);
         }
         else {
-            const token = parseCookies(req.headers).get(`${req.payload.config.cookiePrefix}-token`);
+            const token = parseCookies(headers).get(`${req.payload.config.cookiePrefix}-token`);
             if (!token)
                 continue;
-            const origin = req.headers.get('origin');
+            const origin = headers.get('origin');
             const csrf = req.payload.config.csrf;
             if (origin
                 ? csrf.length === 0 || csrf.includes(origin)
                 : csrf.length === 0 ||
-                    ['same-origin', 'same-site', 'none'].includes(req.headers.get('sec-fetch-site') ?? ''))
+                    ['same-origin', 'same-site', 'none'].includes(headers.get('sec-fetch-site') ?? ''))
                 return token;
         }
     }
     return undefined;
 }
-async function reference(req) {
-    const token = selectedToken(req);
+async function reference(req, headers = req.headers) {
+    const token = selectedToken(req, headers);
     if (!token)
         return undefined;
     try {
@@ -47,6 +47,7 @@ async function reference(req) {
 export function createNativeSessions(options) {
     const maxAge = options.login?.session.maxAgeSeconds ?? 7200;
     const absoluteMaxAge = options.login?.session.absoluteMaxAgeSeconds ?? 7200;
+    const xignetOnly = options.sessionAuthentication === 'xignet-only';
     if (![maxAge, absoluteMaxAge].every((n) => Number.isInteger(n) && n > 0 && n <= 604800) ||
         maxAge > absoluteMaxAge)
         throw new Error('Invalid SSO session lifetimes');
@@ -188,12 +189,66 @@ export function createNativeSessions(options) {
     const enhanceUser = (config) => {
         const auth = typeof config.auth === 'object' ? config.auth : {};
         if (!config.auth ||
-            auth.disableLocalStrategy ||
+            (auth.disableLocalStrategy && !xignetOnly) ||
             auth.useSessions === false) {
-            if (options.login?.enabled)
+            if (options.login?.enabled || xignetOnly)
                 throw new Error('SSO requires native Payload auth with sessions');
             return config;
         }
+        if (xignetOnly &&
+            ((auth.useAPIKey && !options.legacyAPIKeys) || auth.strategies?.length))
+            throw new Error('Xignet-only sessions cannot compose API-key or other authentication strategies');
+        const strategy = {
+            name: 'xignet-session',
+            authenticate: async ({ headers, payload, req: incomingReq }) => {
+                const req = incomingReq ??
+                    (await createLocalReq({
+                        req: new Request(options.resource, { headers }),
+                    }, payload));
+                if (/^Bearer(?:\s|$)/i.test(headers.get('authorization') ?? ''))
+                    return { user: null };
+                try {
+                    const ref = await reference(req, headers);
+                    if (!ref ||
+                        ref.collection !== options.userCollection ||
+                        !['string', 'number'].includes(typeof ref.id) ||
+                        typeof ref.sid !== 'string')
+                        return { user: null };
+                    const entry = await record(req, ref.sid);
+                    if (!entry || !(await allowed(req, entry, ref.id))) {
+                        await revokeSession(req, ref.id, ref.sid);
+                        return { user: null };
+                    }
+                    const user = (await payload.findByID({
+                        collection: options.userCollection,
+                        id: ref.id,
+                        req,
+                        overrideAccess: true,
+                        depth: 0,
+                        disableErrors: true,
+                    }));
+                    if ((auth.verify && user?._verified !== true) ||
+                        !user?.sessions?.some((s) => s.id === ref.sid &&
+                            Date.parse(String(s.expiresAt)) > Date.now()))
+                        return { user: null };
+                    return {
+                        user: {
+                            ...user,
+                            collection: options.userCollection,
+                            _sid: ref.sid,
+                            _strategy: 'xignet-session',
+                        },
+                    };
+                }
+                catch (error) {
+                    payload.logger.error({
+                        event: 'xignet_session_authentication_failed',
+                        category: error instanceof Error ? error.name : 'unknown',
+                    });
+                    throw new APIError('Xignet session authentication unavailable', 503);
+                }
+            },
+        };
         const previousRefresh = config.hooks?.refresh ?? [];
         const refresh = async (args) => {
             const ref = await reference(args.args.req);
@@ -266,6 +321,13 @@ export function createNativeSessions(options) {
             ...config,
             auth: {
                 ...auth,
+                ...(xignetOnly
+                    ? {
+                        disableLocalStrategy: { enableFields: true },
+                        useAPIKey: options.legacyAPIKeys === true,
+                        strategies: [strategy],
+                    }
+                    : {}),
                 useSessions: true,
                 cookies: {
                     ...auth.cookies,
@@ -277,7 +339,23 @@ export function createNativeSessions(options) {
             },
             hooks: {
                 ...config.hooks,
-                afterRead: [...(config.hooks?.afterRead ?? []), protectSession],
+                beforeValidate: [
+                    ...(xignetOnly
+                        ? [
+                            ({ data }) => {
+                                if (data &&
+                                    ['password', 'hash', 'salt'].some((key) => data[key] != null))
+                                    throw new APIError('Password credentials are disabled for Xignet-only users', 400);
+                                return data;
+                            },
+                        ]
+                        : []),
+                    ...(config.hooks?.beforeValidate ?? []),
+                ],
+                afterRead: [
+                    ...(config.hooks?.afterRead ?? []),
+                    ...(xignetOnly ? [] : [protectSession]),
+                ],
                 refresh: [refresh],
                 afterLogout: [
                     ...(config.hooks?.afterLogout ?? []),

package/dist/next.js

@@ -8,7 +8,17 @@ export function createXignetRouteHandlers(integration, options) {
         callback: async (request) => {
             if (!integration.loginEnabled || !options)
                 return new Response(null, { status: 404 });
-            return integration.callback(request, await options.getPayload());
+            const payload = await options.getPayload();
+            if (!payload.config.serverURL)
+                return integration.callback(request, payload);
+            // Standalone Next requests may use an internal hostname and port.
+            // Only configured serverURL supplies the public origin, never headers.
+            const incoming = new URL(request.url);
+            const callback = new URL(payload.config.serverURL);
+            callback.pathname = incoming.pathname;
+            callback.search = incoming.search;
+            callback.hash = incoming.hash;
+            return integration.callback(new Request(callback, request), payload);
         },
     };
 }

package/dist/plugin.d.ts

@@ -0,0 +1,29 @@
+import type { DirectoryClient } from '@xignet/client/directory';
+import type { Plugin, TypedUser } from 'payload';
+import { type ManagedUsersOptions } from './managed-users.js';
+import type { XignetPayloadIntegration, XignetPayloadOptions } from './types.js';
+/** The production AS currently advertises this issuer in discovery and tokens. */
+export declare const XIGNET_PROVIDER: Readonly<{
+    issuer: "https://signet.marxbio.tech";
+    jwksUri: "https://signet.marxbio.tech/.well-known/jwks.json";
+}>;
+export type XignetPluginOptions<TUser extends TypedUser = TypedUser> = Omit<XignetPayloadOptions<TUser>, 'issuer' | 'jwksUri' | 'resolveUser' | 'sessionAuthentication'> & {
+    /** Explicit override for tests or a self-hosted Xignet AS. */
+    readonly provider?: {
+        readonly issuer: string;
+        readonly jwksUri: string;
+    };
+    readonly users: ManagedUsersOptions<TUser>;
+    /** Server-only directory client. Omit to disable account provisioning. */
+    readonly directory?: DirectoryClient;
+    readonly admin?: {
+        readonly loginPath?: string;
+        readonly label?: string;
+    };
+};
+export type XignetPlugin = Plugin & XignetPayloadIntegration;
+/** A standard Payload plugin with managed bindings and Xignet-only sessions. */
+export declare function xignetPlugin<TUser extends TypedUser>(input: XignetPluginOptions<TUser>): XignetPlugin;
+export type { ManagedUsersOptions } from './managed-users.js';
+export { isXignetService } from './rest.js';
+export type { RestOptions, RestEntityPolicy } from './rest.js';

package/dist/plugin.js

@@ -0,0 +1,64 @@
+import { createManagedUsers, } from './managed-users.js';
+import { createXignetPayload } from './v3.js';
+/** The production AS currently advertises this issuer in discovery and tokens. */
+export const XIGNET_PROVIDER = Object.freeze({
+    issuer: 'https://signet.marxbio.tech',
+    jwksUri: 'https://signet.marxbio.tech/.well-known/jwks.json',
+});
+/** A standard Payload plugin with managed bindings and Xignet-only sessions. */
+export function xignetPlugin(input) {
+    const userCollection = input.userCollection;
+    const loginLabel = input.admin?.label ?? 'Sign in with Xignet';
+    const provider = Object.freeze({ ...(input.provider ?? XIGNET_PROVIDER) });
+    const managed = createManagedUsers({
+        ...provider,
+        resource: input.resource,
+        directory: input.directory,
+        userCollection,
+        policy: Object.freeze({
+            ...input.users,
+            revokeOnFields: Object.freeze([...(input.users.revokeOnFields ?? [])]),
+        }),
+        revoke: (args) => integration.revokeUserSessions(args),
+    });
+    const integration = createXignetPayload({
+        ...input,
+        ...provider,
+        sessionAuthentication: 'xignet-only',
+        resolveUser: managed.resolveUser,
+    });
+    const apply = integration.plugin();
+    const loginPath = input.admin?.loginPath ?? '/auth/xignet/login';
+    if (!loginPath.startsWith('/') ||
+        loginPath.startsWith('//') ||
+        new URL(loginPath, 'https://cms.invalid').origin !== 'https://cms.invalid')
+        throw new Error('Xignet loginPath must be a local absolute path');
+    const plugin = async (config) => {
+        const enhanced = await apply({
+            ...config,
+            collections: (config.collections ?? []).map((collection) => collection.slug === userCollection
+                ? managed.enhanceUser(collection)
+                : collection),
+        });
+        enhanced.admin = {
+            ...enhanced.admin,
+            components: {
+                ...enhanced.admin?.components,
+                beforeLogin: [
+                    ...(enhanced.admin?.components?.beforeLogin ?? []),
+                    {
+                        path: '@xignet/payload/components#XignetLogin',
+                        serverProps: {
+                            enabled: integration.loginEnabled,
+                            loginPath,
+                            label: loginLabel,
+                        },
+                    },
+                ],
+            },
+        };
+        return enhanced;
+    };
+    return Object.assign(plugin, integration, { plugin: () => plugin });
+}
+export { isXignetService } from './rest.js';

package/dist/rest.d.ts

@@ -0,0 +1,34 @@
+import type { Config, Payload, TypedUser } from 'payload';
+import type { XignetPayloadOptions } from './types.js';
+export interface RestEntityPolicy {
+    readonly read?: readonly string[];
+    readonly create?: readonly string[];
+    readonly update?: readonly string[];
+}
+export interface RestOptions {
+    readonly enabled: boolean;
+    /** Separate audience from MCP, e.g. https://cms.example.com/api. */
+    readonly resource: string;
+    readonly admissionScopes: readonly string[];
+    readonly collections: Readonly<Record<string, RestEntityPolicy>>;
+    readonly globals?: Readonly<Record<string, Omit<RestEntityPolicy, 'create'>>>;
+    /** Exact custom paths relative to the API root; no wildcard or inherited permission. */
+    readonly endpoints?: readonly {
+        readonly path: string;
+        readonly method: 'GET' | 'POST';
+        readonly scopes: readonly string[];
+    }[];
+    /** Locally approved machine identities. No human user or admin role is assigned. */
+    readonly services?: readonly {
+        readonly subject: string;
+        readonly clientId: string;
+    }[];
+}
+/** Only true for an authenticated service principal created by this adapter. */
+export declare function isXignetService(req: {
+    user?: TypedUser | null;
+}): boolean;
+export declare function createRest<TUser extends TypedUser>(options: XignetPayloadOptions<TUser>): {
+    handle(request: Request, payload: Payload, next: () => Promise<Response>): Promise<Response>;
+    enhance(config: Config): Config;
+};

package/dist/rest.js

@@ -0,0 +1,272 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { randomUUID } from 'node:crypto';
+import { createTokenVerifier, hasAllScopes, trustedUrl, } from '@xignet/core';
+import { validateScopes } from '@xignet/core/oauth';
+const principals = new WeakMap();
+const key = '__xignetRest';
+function principal(req) {
+    const marker = req.user?.[key];
+    return marker && typeof marker === 'object'
+        ? principals.get(marker)
+        : undefined;
+}
+/** Only true for an authenticated service principal created by this adapter. */
+export function isXignetService(req) {
+    return principal(req)?.service === true;
+}
+class Refused extends Error {
+    status;
+    category;
+    constructor(status, category = status ===
+        401
+        ? 'invalid_token'
+        : 'permission_denied') {
+        super('Xignet REST access refused');
+        this.status = status;
+        this.category = category;
+    }
+}
+const bearer = (headers) => /^Bearer(?:\s|$)/i.test(headers.get('authorization') ?? '');
+export function createRest(options) {
+    const authenticated = new AsyncLocalStorage();
+    // Snapshot authorization policy; caller mutation must not expand active grants.
+    const rest = options.rest && JSON.parse(JSON.stringify(options.rest));
+    const scopes = (value) => {
+        validateScopes(value);
+        if (!value.length)
+            throw new Error('REST policy requires explicit scopes');
+    };
+    if (rest) {
+        scopes(rest.admissionScopes);
+        for (const policy of [
+            ...Object.values(rest.collections),
+            ...Object.values(rest.globals ?? {}),
+        ])
+            for (const value of Object.values(policy))
+                scopes(value);
+        for (const endpoint of rest.endpoints ?? []) {
+            if (!/^\/[a-zA-Z0-9/_-]+$/.test(endpoint.path) ||
+                !['GET', 'POST'].includes(endpoint.method))
+                throw new Error('REST custom endpoint requires an exact path and method');
+            scopes(endpoint.scopes);
+        }
+        for (const service of rest.services ?? [])
+            if (!service.subject.startsWith('service:') ||
+                service.subject !== service.clientId)
+                throw new Error('Xignet service subject must equal its service client ID');
+        const resource = trustedUrl(rest.resource, options.allowInsecureLoopback);
+        if (resource.origin !== new URL(options.resource).origin ||
+            rest.resource === options.resource)
+            throw new Error('REST requires a separate audience on the CMS origin');
+    }
+    const verifier = rest && createTokenVerifier({ ...options, audience: rest.resource });
+    function route(request) {
+        if (!rest)
+            return;
+        const path = new URL(request.url).pathname;
+        const root = new URL(rest.resource).pathname;
+        if (!path.startsWith(`${root}/`) || /%|\\|\/\//.test(path))
+            return;
+        const relative = path.slice(root.length);
+        const endpoint = rest.endpoints?.find((e) => e.path === relative && e.method === request.method);
+        if (endpoint)
+            return endpoint.scopes;
+        const parts = relative.slice(1).split('/');
+        if (parts[0] === 'globals' && parts.length === 2) {
+            const policy = rest.globals?.[parts[1]];
+            return request.method === 'GET'
+                ? policy?.read
+                : request.method === 'POST'
+                    ? policy?.update
+                    : undefined;
+        }
+        const policy = rest.collections[parts[0]];
+        if (!policy || (parts.length !== 1 && parts.length !== 2))
+            return;
+        // Only native document IDs. Excludes auth, versions, access and custom routes.
+        if (parts.length === 2 &&
+            !/^(?:[0-9]+|[a-fA-F0-9]{24}|[a-fA-F0-9-]{36})$/.test(parts[1]))
+            return;
+        if (request.method === 'GET')
+            return policy.read;
+        if (parts.length === 1 && request.method === 'POST')
+            return policy.create;
+        if (parts.length === 2 && request.method === 'PATCH')
+            return policy.update;
+    }
+    async function authenticate(headers, payload) {
+        if (!rest?.enabled || !verifier)
+            throw new Refused(401);
+        const token = headers
+            .get('authorization')
+            ?.match(/^Bearer ([^\s,]+)$/i)?.[1];
+        if (!token)
+            throw new Refused(401);
+        const verified = await verifier.verifyAccessToken(token);
+        if (!verified.ok)
+            throw new Refused(verified.kind === 'verification_unavailable' ? 503 : 401, verified.kind === 'verification_unavailable'
+                ? 'jwks_unavailable'
+                : 'invalid_token');
+        const identity = verified.identity;
+        if (!hasAllScopes(identity, rest.admissionScopes))
+            throw new Refused(403);
+        const service = identity.subject.startsWith('service:');
+        let user;
+        if (service) {
+            if (!rest.services?.some((s) => s.subject === identity.subject && s.clientId === identity.clientId))
+                throw new Refused(403);
+            user = {
+                id: identity.subject,
+                collection: 'xignet-services',
+            };
+        }
+        else {
+            const resolved = await options.resolveUser({
+                identity,
+                channel: 'rest',
+                payload,
+            });
+            if (resolved.status !== 'allowed' ||
+                resolved.user.collection !== options.userCollection)
+                throw new Refused(403);
+            user = resolved.user;
+        }
+        const marker = Object.freeze({});
+        principals.set(marker, { identity, service });
+        return { ...user, _strategy: 'xignet-rest', [key]: marker };
+    }
+    const guard = (existing, required) => async (args) => {
+        const p = principal(args.req);
+        if (p && (!required || !hasAllScopes(p.identity, required)))
+            return false;
+        // Keep all application access filters, including explicit local service policy.
+        return existing ? existing(args) : Boolean(args.req.user);
+    };
+    return {
+        async handle(request, payload, next) {
+            // MCP owns its own Bearer validation and audience.
+            if (!bearer(request.headers) ||
+                new URL(request.url).pathname === new URL(options.resource).pathname)
+                return next();
+            const requestId = randomUUID();
+            let user;
+            try {
+                user = await authenticate(request.headers, payload);
+                const required = route(request);
+                if (!required || !hasAllScopes(principal({ user }).identity, required))
+                    throw new Refused(403);
+            }
+            catch (error) {
+                const status = error instanceof Refused ? error.status : 503;
+                const category = error instanceof Refused
+                    ? error.category
+                    : 'authentication_internal_error';
+                const entry = {
+                    event: 'xignet_rest_denied',
+                    requestId,
+                    status,
+                    category,
+                };
+                if (status === 503)
+                    payload.logger.error(entry);
+                else
+                    payload.logger.info(entry);
+                return Response.json({
+                    error: status === 503
+                        ? 'authentication_unavailable'
+                        : status === 401
+                            ? 'invalid_token'
+                            : 'insufficient_permission',
+                }, {
+                    status,
+                    headers: {
+                        'cache-control': 'no-store',
+                        'x-request-id': requestId,
+                        ...(status === 401
+                            ? { 'www-authenticate': 'Bearer error="invalid_token"' }
+                            : {}),
+                    },
+                });
+            }
+            const response = await authenticated.run({ authorization: request.headers.get('authorization'), user }, next);
+            payload.logger.info({
+                event: 'xignet_rest_request',
+                requestId,
+                method: request.method,
+                subject: principal({ user }).identity.subject,
+                clientId: principal({ user }).identity.clientId,
+                status: response.status,
+            });
+            return response;
+        },
+        enhance(config) {
+            if (!rest?.enabled)
+                return config;
+            if (new URL(rest.resource).pathname !== (config.routes?.api ?? '/api'))
+                throw new Error('REST resource must equal the Payload API root');
+            for (const slug of Object.keys(rest.collections)) {
+                const collection = config.collections?.find((c) => c.slug === slug);
+                if (!collection || collection.auth)
+                    throw new Error(`REST requires a non-auth content collection: ${slug}`);
+            }
+            for (const slug of Object.keys(rest.globals ?? {}))
+                if (!config.globals?.some((g) => g.slug === slug))
+                    throw new Error(`Unknown REST global: ${slug}`);
+            return {
+                ...config,
+                collections: config.collections?.map((c) => ({
+                    ...c,
+                    ...(c.slug === options.userCollection
+                        ? {
+                            auth: {
+                                ...(typeof c.auth === 'object' ? c.auth : {}),
+                                strategies: [
+                                    {
+                                        name: 'xignet-rest',
+                                        authenticate: async ({ headers, payload, req, isGraphQL, }) => {
+                                            if (!bearer(headers) ||
+                                                isGraphQL ||
+                                                (req &&
+                                                    req.pathname === new URL(options.resource).pathname))
+                                                return { user: null };
+                                            const current = authenticated.getStore();
+                                            if (current &&
+                                                current.authorization === headers.get('authorization'))
+                                                return { user: current.user };
+                                            try {
+                                                return { user: await authenticate(headers, payload) };
+                                            }
+                                            catch {
+                                                return { user: null };
+                                            } // HTTP failures are handled before Payload dispatch by handle().
+                                        },
+                                    },
+                                    ...(typeof c.auth === 'object'
+                                        ? (c.auth.strategies ?? [])
+                                        : []),
+                                ],
+                            },
+                        }
+                        : {}),
+                    access: {
+                        ...c.access,
+                        read: guard(c.access?.read, rest.collections[c.slug]?.read),
+                        create: guard(c.access?.create, rest.collections[c.slug]?.create),
+                        update: guard(c.access?.update, rest.collections[c.slug]?.update),
+                        delete: guard(c.access?.delete),
+                        readVersions: guard(c.access?.readVersions),
+                    },
+                })),
+                globals: config.globals?.map((g) => ({
+                    ...g,
+                    access: {
+                        ...g.access,
+                        read: guard(g.access?.read, rest.globals?.[g.slug]?.read),
+                        update: guard(g.access?.update, rest.globals?.[g.slug]?.update),
+                        readVersions: guard(g.access?.readVersions),
+                    },
+                })),
+            };
+        },
+    };
+}

package/dist/types.d.ts

@@ -9,7 +9,7 @@ export type UserResolution<TUser extends TypedUser = TypedUser> = {
 };
 export type ResolveUser<TUser extends TypedUser = TypedUser> = (input: {
     identity: VerifiedIdentity;
-    channel: 'login' | 'mcp' | 'session';
+    channel: 'login' | 'mcp' | 'session' | 'rest';
     payload: Payload;
     login?: {
         idTokenClaims: Readonly<Record<string, unknown>>;
@@ -35,10 +35,15 @@ export interface EntityPolicy {
     readonly mutationPolicy?: MutationPolicy;
 }
 export interface XignetPayloadOptions<TUser extends TypedUser = TypedUser> extends Omit<TokenVerifierOptions, 'audience'> {
+    /** Transitional opt-in. Disable after all API-key consumers have migrated. */
+    readonly legacyAPIKeys?: boolean;
+    readonly rest?: import('./rest.js').RestOptions;
     readonly resource: string;
     readonly admissionScopes: readonly string[];
     readonly userCollection: CollectionSlug;
     readonly resolveUser: ResolveUser<TUser>;
+    /** xignet-only disables passwords; API keys require the explicit legacyAPIKeys bridge. */
+    readonly sessionAuthentication?: 'mixed' | 'xignet-only';
     readonly login?: {
         readonly enabled: boolean;
         readonly clientId: string;
@@ -63,6 +68,8 @@ export interface XignetPayloadOptions<TUser extends TypedUser = TypedUser> exten
 }
 export interface XignetPayloadIntegration {
     readonly loginEnabled: boolean;
+    /** Wrap every Payload REST method to reject Bearer failures before dispatch. */
+    rest(request: Request, payload: Payload, next: () => Promise<Response>): Promise<Response>;
     plugin(): Plugin;
     /** HTTP metadata response; mount at the resource's well-known path. */
     metadata(): Response;

package/dist/v3.js

@@ -4,6 +4,7 @@ import { createBearerChallenge, createProtectedResourceMetadata, validateScopes,
 import { mcpPlugin, } from '@payloadcms/plugin-mcp';
 import { APIError, } from 'payload';
 import { createNativeSessions, SESSION_COLLECTION } from './native-session.js';
+import { createRest } from './rest.js';
 import { createLogin } from './login.js';
 import { inspectRpc, observeRpc, rpcMethod } from './rpc-audit.js';
 class ResourceError extends Error {
@@ -47,6 +48,9 @@ function snapshot(input = {}) {
 }
 /** Compose official v3 MCP transport with request-scoped Xignet authorization. */
 export function createXignetPayload(input) {
+    if (input.sessionAuthentication !== undefined &&
+        !['mixed', 'xignet-only'].includes(input.sessionAuthentication))
+        throw new Error('Invalid Xignet sessionAuthentication mode');
     const options = Object.freeze({
         ...input,
         login: input.login
@@ -234,6 +238,7 @@ export function createXignetPayload(input) {
         req.context = { ...req.context, [contextKey]: marker };
         return p;
     };
+    const rest = createRest(options);
     const sessions = createNativeSessions(options);
     const login = createLogin(options, sessions);
     const tools = new Map();
@@ -274,7 +279,13 @@ export function createXignetPayload(input) {
         metadata: () => enabled
             ? Response.json(metadata, { headers: { 'cache-control': 'no-store' } })
             : new Response(null, { status: 404 }),
+        rest: rest.handle,
         plugin: () => async (config) => {
+            if (options.sessionAuthentication === 'xignet-only' &&
+                config.admin?.autoLogin &&
+                (typeof config.admin.autoLogin !== 'object' ||
+                    !config.admin.autoLogin.prefillOnly))
+                throw new Error('Xignet-only authentication requires admin autoLogin to be disabled');
             const apiPath = `${config.routes?.api ?? '/api'}/mcp`;
             if (resource.pathname !== apiPath)
                 throw new Error(`MCP resource path must equal ${apiPath}`);
@@ -337,7 +348,7 @@ export function createXignetPayload(input) {
             const original = (config.endpoints ?? []).filter((e) => e.path === '/mcp');
             if (original.length)
                 throw new Error('Install Xignet MCP once; another /mcp endpoint already exists');
-            const result = await mcpPlugin(mcpOptions)(config);
+            const result = rest.enhance(await mcpPlugin(mcpOptions)(config));
             if (!enabled)
                 return result;
             result.collections = result.collections?.map((c) => {