nowaikit 4.1.6 → 4.4.1

package/dist/utils/request-context.js

@@ -0,0 +1,71 @@
+/**
+ * Per-request delegated-auth context (DELEGATED_AUTH mode).
+ *
+ * When NowAIKit runs behind the NowAIKit Gateway (or any trusted upstream that
+ * performs per-user identity), each inbound HTTP request can carry the user's
+ * ServiceNow token and a resolved permission policy. This module threads that
+ * per-request context to the ServiceNow client and the permission checks via
+ * AsyncLocalStorage — without changing any tool signatures.
+ *
+ * Fully opt-in: only active when DELEGATED_AUTH=true AND a context is present.
+ * In stdio / normal single-user mode there is no context, so behaviour is
+ * identical to before (env-var driven).
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { timingSafeEqual } from 'node:crypto';
+const store = new AsyncLocalStorage();
+/** True when delegated-auth mode is switched on. */
+export function isDelegatedAuthEnabled() {
+    return process.env.DELEGATED_AUTH === 'true';
+}
+/** Run `fn` with the given delegated-auth context bound for its async lifetime. */
+export function runWithDelegatedAuth(ctx, fn) {
+    return store.run(ctx, fn);
+}
+/** The current request's delegated-auth context, or undefined outside one. */
+export function getDelegatedAuth() {
+    return store.getStore();
+}
+/**
+ * When NOWAIKIT_DELEGATED_SECRET is set, delegated-auth headers are only trusted if the
+ * request carries a matching x-nowaikit-gateway-secret (constant-time compared). This
+ * proves the request came from the trusted gateway and not from a client forging its own
+ * permission flags. If the secret is unset, behaviour is unchanged (back-compat), and the
+ * permission tiers still cap every delegated flag to the server's env ceiling.
+ */
+function gatewaySecretOk(get) {
+    const expected = process.env.NOWAIKIT_DELEGATED_SECRET;
+    if (!expected)
+        return true;
+    const got = get('x-nowaikit-gateway-secret') || '';
+    const a = Buffer.from(got);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/** Build a delegated-auth context from inbound (lowercased) HTTP headers. */
+export function parseDelegatedAuthHeaders(headers) {
+    const h = (k) => {
+        const v = headers[k];
+        return Array.isArray(v) ? v[0] : v;
+    };
+    // Fail closed: a request without the gateway secret gets no token and no flags, so it
+    // can neither reach ServiceNow as a delegated user nor self-assert a capability tier.
+    if (!gatewaySecretOk(h)) {
+        return { flags: {} };
+    }
+    const bool = (k) => h(k) === 'true';
+    return {
+        bearerToken: h('x-servicenow-token'),
+        instanceUrl: h('x-servicenow-instance-url'),
+        toolPackage: h('x-nowaikit-tool-package'),
+        user: h('x-nowaikit-user'),
+        flags: {
+            write: bool('x-nowaikit-write-enabled'),
+            cmdbWrite: bool('x-nowaikit-cmdb-write-enabled'),
+            scripting: bool('x-nowaikit-scripting-enabled'),
+            atf: bool('x-nowaikit-atf-enabled'),
+            nowAssist: bool('x-nowaikit-now-assist-enabled'),
+        },
+    };
+}
+//# sourceMappingURL=request-context.js.map

package/dist/utils/request-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/utils/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAuB9C,MAAM,KAAK,GAAG,IAAI,iBAAiB,EAAiB,CAAC;AAErD,oDAAoD;AACpD,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAAI,GAAkB,EAAE,EAAW;IACrE,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAsC;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,yBAAyB,CACvC,OAAsD;IAEtD,MAAM,CAAC,GAAG,CAAC,CAAS,EAAsB,EAAE;QAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,sFAAsF;IACtF,sFAAsF;IACtF,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;IACrD,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,oBAAoB,CAAC;QACpC,WAAW,EAAE,CAAC,CAAC,2BAA2B,CAAC;QAC3C,WAAW,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzC,IAAI,EAAE,CAAC,CAAC,iBAAiB,CAAC;QAC1B,KAAK,EAAE;YACL,KAAK,EAAE,IAAI,CAAC,0BAA0B,CAAC;YACvC,SAAS,EAAE,IAAI,CAAC,+BAA+B,CAAC;YAChD,SAAS,EAAE,IAAI,CAAC,8BAA8B,CAAC;YAC/C,GAAG,EAAE,IAAI,CAAC,wBAAwB,CAAC;YACnC,SAAS,EAAE,IAAI,CAAC,+BAA+B,CAAC;SACjD;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "nowaikit",
   "mcpName": "io.github.aartiq/nowaikit",
-  "version": "4.1.6",
-  "description": "The Most Comprehensive ServiceNow AI Toolkit \u2014 450+ MCP tools + 26 AI capabilities (scan, review, build, ops, docs) + direct BYOK mode. Integrates with Claude, ChatGPT, Gemini, Cursor, GitHub Copilot and any LLM.",
+  "version": "4.4.1",
+  "description": "The Most Comprehensive ServiceNow AI Toolkit — 450+ MCP tools + 26 AI capabilities (scan, review, build, ops, docs) + direct BYOK mode. Integrates with Claude, ChatGPT, Gemini, Cursor, GitHub Copilot and any LLM.",
   "main": "dist/server.js",
   "types": "dist/server.d.ts",
   "exports": {
@@ -10,6 +10,10 @@
       "types": "./dist/server.d.ts",
       "import": "./dist/server.js"
     },
+    "./embed": {
+      "types": "./dist/embed.d.ts",
+      "import": "./dist/embed.js"
+    },
     "./sdk": {
       "types": "./dist/sdk/index.d.ts",
       "import": "./dist/sdk/index.js"
@@ -24,7 +28,8 @@
     }
   },
   "bin": {
-    "nowaikit": "dist/cli/index.js"
+    "nowaikit": "dist/cli/index.js",
+    "nowaikit-mcp": "dist/server.js"
   },
   "type": "module",
   "files": [