keywordgraph-mcp-server 1.6.1

package/bin/mcp-server.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import * as dotenv from 'dotenv';
+import createServer from '../dist/index.js';
+import { brand, brandApiKey, brandApiBase } from '../dist/config/brand.js';
+
+// Main function for CLI execution
+async function main() {
+    // Load environment variables
+    dotenv.config();
+
+    // Brand (and thus API env vars / tool set) is selected by the BRAND env var.
+    const config = {
+        apiKey: brandApiKey(),
+        apiBase: brandApiBase(),
+    };
+
+    // Validate config
+    if (!config.apiKey) {
+        console.error(
+            `WARNING: Set ${brand.envPrefix}_API_KEY in environment variables to ensure you don't hit the rate limit`
+        );
+    }
+
+    // Create server with config
+    const server = createServer({ config });
+
+    // Create STDIO transport
+    const transport = new StdioServerTransport();
+
+    // Handle graceful shutdown
+    process.on("SIGINT", async () => {
+        await server.close();
+        process.exit(0);
+    });
+
+    process.on("SIGTERM", async () => {
+        await server.close();
+        process.exit(0);
+    });
+
+    try {
+        await server.connect(transport);
+        // Server is running - no console output to avoid protocol interference
+    } catch (error) {
+        console.error("ERROR: MCP server failed to connect", error);
+        process.exit(1);
+    }
+}
+
+// Run the main function
+main().catch((error) => {
+    console.error("ERROR: Fatal error of MCP server", error);
+    process.exit(1);
+});

package/dist/api/client.d.ts

@@ -0,0 +1,3 @@
+import { GraphResponse } from "../types/index.js";
+export declare function makeInfraNodusRequest(endpoint: string, body: any, method?: string): Promise<GraphResponse>;
+//# sourceMappingURL=client.d.ts.map

package/dist/api/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGlD,wBAAsB,qBAAqB,CAC1C,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,GAAG,EACT,MAAM,GAAE,MAAe,GACrB,OAAO,CAAC,aAAa,CAAC,CAgCxB"}

package/dist/api/client.js

@@ -0,0 +1,30 @@
+import { getConfig } from "./config-store.js";
+export async function makeInfraNodusRequest(endpoint, body, method = "POST") {
+    try {
+        const config = getConfig();
+        const requestBody = { ...body, modal: "mcp_server" };
+        const response = await fetch(`${config.apiBase}${endpoint}`, {
+            method,
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${config.apiKey}`,
+            },
+            ...(method !== "GET" && { body: JSON.stringify(requestBody) }),
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            throw new Error(`API request failed (${response.status}): ${errorText}`);
+        }
+        const data = await response.json();
+        // Handle wrapped response format
+        if (data.entriesAndGraphOfContext) {
+            return data.entriesAndGraphOfContext;
+        }
+        return data;
+    }
+    catch (error) {
+        // Don't log to console as it interferes with MCP protocol
+        throw error;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/api/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,QAAgB,EAChB,IAAS,EACT,SAAiB,MAAM;IAEvB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAE3B,MAAM,WAAW,GAAG,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAErD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,GAAG,QAAQ,EAAE,EAAE;YAC5D,MAAM;YACN,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE;aACxC;YACD,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEnC,iCAAiC;QACjC,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,wBAAwB,CAAC;QACtC,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,0DAA0D;QAC1D,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC"}

package/dist/api/config-store.d.ts

@@ -0,0 +1,4 @@
+import { Config } from "../config/index.js";
+export declare function runWithConfig<T>(config: Config, fn: () => T): T;
+export declare function getConfig(): Config;
+//# sourceMappingURL=config-store.d.ts.map

package/dist/api/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../src/api/config-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAK5C,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAE/D;AAED,wBAAgB,SAAS,IAAI,MAAM,CAMlC"}

package/dist/api/config-store.js

@@ -0,0 +1,12 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { brandApiBase } from "../config/brand.js";
+const configStorage = new AsyncLocalStorage();
+export function runWithConfig(config, fn) {
+    return configStorage.run(config, fn);
+}
+export function getConfig() {
+    return (configStorage.getStore() ??
+        global.brandConfig ??
+        { apiKey: "", apiBase: brandApiBase() });
+}
+//# sourceMappingURL=config-store.js.map

package/dist/api/config-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/api/config-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,aAAa,GAAG,IAAI,iBAAiB,EAAU,CAAC;AAEtD,MAAM,UAAU,aAAa,CAAI,MAAc,EAAE,EAAW;IAC3D,OAAO,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,SAAS;IACxB,OAAO,CACN,aAAa,CAAC,QAAQ,EAAE;QACvB,MAAc,CAAC,WAAW;QAC3B,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CACvC,CAAC;AACH,CAAC"}

package/dist/auth/oauth-provider.d.ts

@@ -0,0 +1,56 @@
+/**
+ * OAuth2-style authentication provider for the MCP HTTP server
+ * Validates API keys and issues JWT access tokens
+ */
+import { InfraNodusUserInfo, TokenResponse, AuthenticatedRequest, RegisteredClient, ClientRegistrationRequest, ClientRegistrationResponse } from "./types.js";
+/**
+ * Validate an API key by calling the /api/v1/userId endpoint
+ * Returns user info if valid, null if invalid
+ */
+export declare function validateApiKey(apiKey: string): Promise<InfraNodusUserInfo | null>;
+/**
+ * Exchange an API key for a JWT access token
+ */
+export declare function exchangeApiKeyForToken(apiKey: string): Promise<TokenResponse | null>;
+/**
+ * Verify a JWT access token and return the authenticated request context
+ * This is now stateless - all info is in the JWT itself
+ */
+export declare function verifyAccessToken(token: string): AuthenticatedRequest | null;
+/**
+ * Revoke a session (logout)
+ */
+export declare function revokeSession(sessionId: string): boolean;
+/**
+ * Get session count (for monitoring)
+ */
+export declare function getSessionCount(): number;
+/**
+ * Clean up expired sessions (call periodically)
+ */
+export declare function cleanupExpiredSessions(): number;
+/**
+ * Register a new OAuth2 client
+ */
+export declare function registerClient(request: ClientRegistrationRequest): ClientRegistrationResponse;
+/**
+ * Get a registered client by ID
+ */
+export declare function getClient(clientId: string): RegisteredClient | null;
+/**
+ * Validate client credentials
+ */
+export declare function validateClient(clientId: string, clientSecret?: string): boolean;
+/**
+ * Validate redirect URI for a client
+ */
+export declare function validateRedirectUri(clientId: string, redirectUri: string): boolean;
+/**
+ * Create an authorization code (as a signed JWT for stateless validation across instances)
+ */
+export declare function createAuthorizationCode(clientId: string, redirectUri: string, apiKey: string, scope?: string, codeChallenge?: string, codeChallengeMethod?: string): string;
+/**
+ * Exchange authorization code for token
+ */
+export declare function exchangeAuthorizationCode(code: string, clientId: string, redirectUri: string, codeVerifier?: string): Promise<TokenResponse | null>;
+//# sourceMappingURL=oauth-provider.d.ts.map

package/dist/auth/oauth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-provider.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EACN,kBAAkB,EAElB,aAAa,EAEb,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAE1B,MAAM,YAAY,CAAC;AAmBpB;;;GAGG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAmCvF;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA4B1F;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAmC5E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAa/C;AAYD;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,yBAAyB,GAAG,0BAA0B,CA0B7F;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAEnE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAK/E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAIlF;AAQD;;GAEG;AACH,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,mBAAmB,CAAC,EAAE,MAAM,GAC1B,MAAM,CAcR;AAeD;;GAEG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAwC/B"}

package/dist/auth/oauth-provider.js

@@ -0,0 +1,295 @@
+/**
+ * OAuth2-style authentication provider for the MCP HTTP server
+ * Validates API keys and issues JWT access tokens
+ */
+import jwt from "jsonwebtoken";
+import crypto from "crypto";
+import { brandApiBase } from "../config/brand.js";
+// In-memory stores
+const sessions = new Map();
+const clients = new Map();
+const authorizationCodes = new Map();
+// Configuration
+const JWT_SECRET = process.env.JWT_SECRET || crypto.randomBytes(32).toString("hex");
+const TOKEN_EXPIRY_SECONDS = 86400 * 365 * 100; // 100 years - effectively never expires
+const BRAND_API_BASE = brandApiBase();
+/**
+ * Hash an API key for storage in JWT (we don't store the actual key in the token)
+ */
+function hashApiKey(apiKey) {
+    return crypto.createHash("sha256").update(apiKey).digest("hex").slice(0, 16);
+}
+/**
+ * Validate an API key by calling the /api/v1/userId endpoint
+ * Returns user info if valid, null if invalid
+ */
+export async function validateApiKey(apiKey) {
+    try {
+        const response = await fetch(`${BRAND_API_BASE}/userId`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${apiKey}`,
+            },
+            body: JSON.stringify({}),
+        });
+        if (!response.ok) {
+            return null;
+        }
+        const data = await response.json();
+        // Check for valid response format: {"userId": 486, "userName": "circadian"}
+        if (data && typeof data.userId === "number" && typeof data.userName === "string") {
+            return {
+                userId: data.userId,
+                userName: data.userName,
+            };
+        }
+        // Check for error indicators
+        if (!data || data.error || typeof data === "string") {
+            return null;
+        }
+        return null;
+    }
+    catch (error) {
+        // Network error or invalid response
+        return null;
+    }
+}
+/**
+ * Exchange an API key for a JWT access token
+ */
+export async function exchangeApiKeyForToken(apiKey) {
+    // Validate the API key against the brand API
+    const userInfo = await validateApiKey(apiKey);
+    if (!userInfo) {
+        return null;
+    }
+    // Create a stateless session ID (just for tracking, not stored in memory)
+    const sessionId = crypto.randomUUID();
+    // Create JWT payload - include API key directly for stateless verification
+    // The JWT is signed so it can't be tampered with
+    const payload = {
+        type: "access_token",
+        userId: userInfo.userId,
+        userName: userInfo.userName,
+        apiKey: apiKey, // Include API key for stateless verification
+        sessionId: sessionId,
+    };
+    // Sign JWT
+    const accessToken = jwt.sign(payload, JWT_SECRET, { expiresIn: TOKEN_EXPIRY_SECONDS });
+    return {
+        access_token: accessToken,
+        token_type: "Bearer",
+        expires_in: TOKEN_EXPIRY_SECONDS,
+    };
+}
+/**
+ * Verify a JWT access token and return the authenticated request context
+ * This is now stateless - all info is in the JWT itself
+ */
+export function verifyAccessToken(token) {
+    try {
+        const decoded = jwt.verify(token, JWT_SECRET);
+        // Check if this is an auth_code being used as access token (wrong!)
+        if (decoded.type === "auth_code") {
+            console.log(`[AUTH] Received auth_code instead of access_token`);
+            return null;
+        }
+        // Need API key in the token for stateless verification
+        if (!decoded.apiKey) {
+            console.log(`[AUTH] Token missing apiKey - old format token, needs re-auth`);
+            return null;
+        }
+        // All info is in the JWT - no need to look up session
+        return {
+            userId: decoded.userId,
+            userName: decoded.userName,
+            apiKey: decoded.apiKey,
+            sessionId: decoded.sessionId,
+        };
+    }
+    catch (error) {
+        // Invalid or expired token
+        console.log(`[AUTH] JWT verification error: ${error.message}`);
+        return null;
+    }
+}
+/**
+ * Revoke a session (logout)
+ */
+export function revokeSession(sessionId) {
+    return sessions.delete(sessionId);
+}
+/**
+ * Get session count (for monitoring)
+ */
+export function getSessionCount() {
+    return sessions.size;
+}
+/**
+ * Clean up expired sessions (call periodically)
+ */
+export function cleanupExpiredSessions() {
+    const now = Date.now();
+    const expiryMs = TOKEN_EXPIRY_SECONDS * 1000;
+    let cleaned = 0;
+    for (const [sessionId, session] of sessions.entries()) {
+        if (now - session.createdAt > expiryMs) {
+            sessions.delete(sessionId);
+            cleaned++;
+        }
+    }
+    return cleaned;
+}
+// Start periodic cleanup every 10 minutes
+setInterval(() => {
+    cleanupExpiredSessions();
+    cleanupExpiredAuthCodes();
+}, 10 * 60 * 1000);
+// ============================================================================
+// OAuth2 Dynamic Client Registration (RFC 7591)
+// ============================================================================
+/**
+ * Register a new OAuth2 client
+ */
+export function registerClient(request) {
+    const clientId = crypto.randomUUID();
+    const clientSecret = crypto.randomBytes(32).toString("hex");
+    const client = {
+        client_id: clientId,
+        client_secret: clientSecret,
+        redirect_uris: request.redirect_uris,
+        client_name: request.client_name,
+        created_at: Date.now(),
+    };
+    clients.set(clientId, client);
+    return {
+        client_id: clientId,
+        client_secret: clientSecret,
+        client_id_issued_at: Math.floor(Date.now() / 1000),
+        client_secret_expires_at: 0, // Never expires
+        redirect_uris: request.redirect_uris,
+        client_name: request.client_name,
+        token_endpoint_auth_method: request.token_endpoint_auth_method || "client_secret_post",
+        grant_types: request.grant_types || ["authorization_code"],
+        response_types: request.response_types || ["code"],
+        scope: request.scope,
+    };
+}
+/**
+ * Get a registered client by ID
+ */
+export function getClient(clientId) {
+    return clients.get(clientId) || null;
+}
+/**
+ * Validate client credentials
+ */
+export function validateClient(clientId, clientSecret) {
+    const client = clients.get(clientId);
+    if (!client)
+        return false;
+    if (clientSecret && client.client_secret !== clientSecret)
+        return false;
+    return true;
+}
+/**
+ * Validate redirect URI for a client
+ */
+export function validateRedirectUri(clientId, redirectUri) {
+    const client = clients.get(clientId);
+    if (!client)
+        return false;
+    return client.redirect_uris.includes(redirectUri);
+}
+// ============================================================================
+// OAuth2 Authorization Code Flow
+// ============================================================================
+const AUTH_CODE_EXPIRY_SECONDS = 600; // 10 minutes
+/**
+ * Create an authorization code (as a signed JWT for stateless validation across instances)
+ */
+export function createAuthorizationCode(clientId, redirectUri, apiKey, scope, codeChallenge, codeChallengeMethod) {
+    // Create a JWT-based authorization code that can be validated by any instance
+    const payload = {
+        type: "auth_code",
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        api_key: apiKey, // Encrypted or hashed in production
+        scope,
+        code_challenge: codeChallenge,
+        code_challenge_method: codeChallengeMethod,
+    };
+    const code = jwt.sign(payload, JWT_SECRET, { expiresIn: AUTH_CODE_EXPIRY_SECONDS });
+    return code;
+}
+// Track used codes to prevent replay — stores hash → timestamp for TTL cleanup
+const usedCodes = new Map();
+/**
+ * Exchange authorization code for token
+ */
+export async function exchangeAuthorizationCode(code, clientId, redirectUri, codeVerifier) {
+    try {
+        // Decode the JWT-based authorization code
+        const authCode = jwt.verify(code, JWT_SECRET);
+        // Validate it's an auth code
+        if (authCode.type !== "auth_code")
+            return null;
+        // Validate client_id and redirect_uri match
+        if (authCode.client_id !== clientId)
+            return null;
+        if (authCode.redirect_uri !== redirectUri)
+            return null;
+        // Check if code was already used (replay protection)
+        const codeHash = crypto.createHash("sha256").update(code).digest("hex").slice(0, 16);
+        if (usedCodes.has(codeHash))
+            return null;
+        usedCodes.set(codeHash, Date.now());
+        // Validate PKCE if used
+        if (authCode.code_challenge) {
+            if (!codeVerifier)
+                return null;
+            let computedChallenge;
+            if (authCode.code_challenge_method === "S256") {
+                computedChallenge = crypto
+                    .createHash("sha256")
+                    .update(codeVerifier)
+                    .digest("base64url");
+            }
+            else {
+                computedChallenge = codeVerifier; // plain method
+            }
+            if (computedChallenge !== authCode.code_challenge)
+                return null;
+        }
+        // Exchange the API key for a token
+        return exchangeApiKeyForToken(authCode.api_key);
+    }
+    catch (error) {
+        // Invalid or expired JWT
+        return null;
+    }
+}
+/**
+ * Clean up expired authorization codes
+ */
+function cleanupExpiredAuthCodes() {
+    const now = Date.now();
+    let cleaned = 0;
+    for (const [code, authCode] of authorizationCodes.entries()) {
+        if (authCode.expires_at < now) {
+            authorizationCodes.delete(code);
+            cleaned++;
+        }
+    }
+    // Clean up used code hashes older than the auth code expiry window
+    const usedCodeTtlMs = AUTH_CODE_EXPIRY_SECONDS * 1000;
+    for (const [hash, timestamp] of usedCodes.entries()) {
+        if (now - timestamp > usedCodeTtlMs) {
+            usedCodes.delete(hash);
+            cleaned++;
+        }
+    }
+    return cleaned;
+}
+//# sourceMappingURL=oauth-provider.js.map

package/dist/auth/oauth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../../src/auth/oauth-provider.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAalD,mBAAmB;AACnB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;AAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;AACpD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA6B,CAAC;AAEhE,gBAAgB;AAChB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpF,MAAM,oBAAoB,GAAG,KAAK,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,wCAAwC;AACxF,MAAM,cAAc,GAAG,YAAY,EAAE,CAAC;AAEtC;;GAEG;AACH,SAAS,UAAU,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IAClD,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,SAAS,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aACjC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEnC,4EAA4E;QAC5E,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClF,OAAO;gBACN,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACvB,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACb,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,oCAAoC;QACpC,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAc;IAC1D,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACb,CAAC;IAED,0EAA0E;IAC1E,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEtC,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,OAAO,GAAG;QACf,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,MAAM,EAAE,6CAA6C;QAC7D,SAAS,EAAE,SAAS;KACpB,CAAC;IAEF,WAAW;IACX,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAEvF,OAAO;QACN,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,oBAAoB;KAChC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC9C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAO3C,CAAC;QAEF,oEAAoE;QACpE,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACb,CAAC;QAED,uDAAuD;QACvD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;YAC7E,OAAO,IAAI,CAAC;QACb,CAAC;QAED,sDAAsD;QACtD,OAAO;YACN,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC5B,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACrB,2BAA2B;QAC3B,OAAO,CAAC,GAAG,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC9C,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,oBAAoB,GAAG,IAAI,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,EAAE,CAAC;YACxC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,0CAA0C;AAC1C,WAAW,CAAC,GAAG,EAAE;IAChB,sBAAsB,EAAE,CAAC;IACzB,uBAAuB,EAAE,CAAC;AAC3B,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAEnB,+EAA+E;AAC/E,gDAAgD;AAChD,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,OAAkC;IAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5D,MAAM,MAAM,GAAqB;QAChC,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;QAC3B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE9B,OAAO;QACN,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;QAC3B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,wBAAwB,EAAE,CAAC,EAAE,gBAAgB;QAC7C,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,0BAA0B,EAAE,OAAO,CAAC,0BAA0B,IAAI,oBAAoB;QACtF,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,CAAC,oBAAoB,CAAC;QAC1D,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC;QAClD,KAAK,EAAE,OAAO,CAAC,KAAK;KACpB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,YAAqB;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,YAAY,IAAI,MAAM,CAAC,aAAa,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,WAAmB;IACxE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC;AAED,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E,MAAM,wBAAwB,GAAG,GAAG,CAAC,CAAC,aAAa;AAEnD;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACtC,QAAgB,EAChB,WAAmB,EACnB,MAAc,EACd,KAAc,EACd,aAAsB,EACtB,mBAA4B;IAE5B,8EAA8E;IAC9E,MAAM,OAAO,GAAG;QACf,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,WAAW;QACzB,OAAO,EAAE,MAAM,EAAE,oCAAoC;QACrD,KAAK;QACL,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,mBAAmB;KAC1C,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC;AACb,CAAC;AAYD,+EAA+E;AAC/E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE5C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,IAAY,EACZ,QAAgB,EAChB,WAAmB,EACnB,YAAqB;IAErB,IAAI,CAAC;QACJ,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAoB,CAAC;QAEjE,6BAA6B;QAC7B,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAE/C,4CAA4C;QAC5C,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,QAAQ,CAAC,YAAY,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAEvD,qDAAqD;QACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAEpC,wBAAwB;QACxB,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7B,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC;YAE/B,IAAI,iBAAyB,CAAC;YAC9B,IAAI,QAAQ,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;gBAC/C,iBAAiB,GAAG,MAAM;qBACxB,UAAU,CAAC,QAAQ,CAAC;qBACpB,MAAM,CAAC,YAAY,CAAC;qBACpB,MAAM,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACP,iBAAiB,GAAG,YAAY,CAAC,CAAC,eAAe;YAClD,CAAC;YAED,IAAI,iBAAiB,KAAK,QAAQ,CAAC,cAAc;gBAAE,OAAO,IAAI,CAAC;QAChE,CAAC;QAED,mCAAmC;QACnC,OAAO,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,yBAAyB;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7D,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YAC/B,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;IAED,mEAAmE;IACnE,MAAM,aAAa,GAAG,wBAAwB,GAAG,IAAI,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,GAAG,GAAG,SAAS,GAAG,aAAa,EAAE,CAAC;YACrC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Auth-related types for the HTTP server
+ */
+export interface InfraNodusUserInfo {
+    userId: number;
+    userName: string;
+}
+export interface TokenPayload {
+    userId: number;
+    userName: string;
+    apiKeyHash: string;
+    iat: number;
+    exp: number;
+}
+export interface TokenResponse {
+    access_token: string;
+    token_type: "Bearer";
+    expires_in: number;
+}
+export interface TokenRequest {
+    api_key: string;
+    grant_type?: "api_key";
+}
+export interface SessionData {
+    userId: number;
+    userName: string;
+    apiKey: string;
+    createdAt: number;
+}
+export interface AuthenticatedRequest {
+    userId: number;
+    userName: string;
+    apiKey: string;
+    sessionId: string;
+}
+export interface ErrorResponse {
+    error: string;
+    error_description?: string;
+}
+export interface ClientRegistrationRequest {
+    redirect_uris: string[];
+    client_name?: string;
+    token_endpoint_auth_method?: string;
+    grant_types?: string[];
+    response_types?: string[];
+    scope?: string;
+}
+export interface ClientRegistrationResponse {
+    client_id: string;
+    client_secret?: string;
+    client_id_issued_at?: number;
+    client_secret_expires_at?: number;
+    redirect_uris: string[];
+    client_name?: string;
+    token_endpoint_auth_method: string;
+    grant_types: string[];
+    response_types: string[];
+    scope?: string;
+}
+export interface RegisteredClient {
+    client_id: string;
+    client_secret: string;
+    redirect_uris: string[];
+    client_name?: string;
+    created_at: number;
+}
+export interface AuthorizationRequest {
+    response_type: string;
+    client_id: string;
+    redirect_uri: string;
+    scope?: string;
+    state?: string;
+    code_challenge?: string;
+    code_challenge_method?: string;
+}
+export interface AuthorizationCode {
+    code: string;
+    client_id: string;
+    redirect_uri: string;
+    api_key: string;
+    scope?: string;
+    code_challenge?: string;
+    code_challenge_method?: string;
+    expires_at: number;
+}
+export interface TokenRequestAuthCode {
+    grant_type: "authorization_code";
+    code: string;
+    redirect_uri: string;
+    client_id: string;
+    code_verifier?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,kBAAkB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,aAAa;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAGD,MAAM,WAAW,yBAAyB;IACzC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B,EAAE,MAAM,CAAC;IACnC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,oBAAoB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACpC,UAAU,EAAE,oBAAoB,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/dist/auth/types.js

@@ -0,0 +1,5 @@
+/**
+ * Auth-related types for the HTTP server
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/config/brand.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Brand configuration.
+ *
+ * One codebase ships as multiple branded MCP servers. The active brand is
+ * selected at runtime by the BRAND environment variable (set per deploy target,
+ * e.g. in each Fly app's [env] block). This keeps a single source tree and a
+ * single built image — only BRAND (and the per-app secrets) differ between
+ * deployments.
+ *
+ * Defaults to "infranodus" (the full product, all tools exposed) when BRAND is
+ * unset, so a missing BRAND never silently hides tools.
+ */
+export type BrandId = "infranodus" | "keywordgraph";
+export interface BrandDef {
+    id: BrandId;
+    /** Human-facing product name shown in titles, resources, and auth pages. */
+    name: string;
+    /** Bare domain, e.g. for links and copy. */
+    domain: string;
+    /** Default API base when the brand's *_API_BASE env var is unset. */
+    apiBase: string;
+    /** Prefix for this brand's env vars: `${envPrefix}_API_KEY`, `${envPrefix}_API_BASE`. */
+    envPrefix: string;
+    /** MCP server identifier reported to clients. */
+    serverName: string;
+    /**
+     * Tool `name` values NOT registered for this brand. Every tool file is always
+     * compiled in; this list is the single source of truth for which ones a brand
+     * exposes. New upstream tools appear in every brand automatically unless added
+     * here.
+     */
+    excludedTools: string[];
+    /**
+     * npm publish identity. The committed package.json holds one brand; the
+     * publish script (scripts/publish-brand.mjs) rewrites these fields for the
+     * brand being published, then restores. `binName` must match a launcher in
+     * bin/ that bakes in this brand's BRAND value.
+     */
+    npm: {
+        packageName: string;
+        binName: string;
+        description: string;
+        repository: string;
+        keywords: string[];
+    };
+}
+export declare const brand: BrandDef;
+/**
+ * API key for the active brand. Prefers the brand-specific var
+ * (`${envPrefix}_API_KEY`) and falls back to the other brand's var so a single
+ * key works in mixed local setups.
+ */
+export declare function brandApiKey(): string;
+/** API base for the active brand: brand-specific env var, else the brand default. */
+export declare function brandApiBase(): string;
+/** Whether a tool (by its MCP `name`) is exposed for the active brand. */
+export declare function isToolEnabled(name: string): boolean;
+//# sourceMappingURL=brand.d.ts.map

package/dist/config/brand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brand.d.ts","sourceRoot":"","sources":["../../src/config/brand.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,cAAc,CAAC;AAEpD,MAAM,WAAW,QAAQ;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,GAAG,EAAE;QACJ,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;CACF;AAsED,eAAO,MAAM,KAAK,EAAE,QAAyB,CAAC;AAE9C;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAOpC;AAED,qFAAqF;AACrF,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD"}