runbios-mcp 0.2.1-dev.62

package/dist/http/app.js

@@ -0,0 +1,140 @@
+import express from "express";
+import { nullAudit } from "./audit.js";
+import { createOAuthRouter, validateAccessToken, sha256Hex } from "./oauth.js";
+import { createConsentRouter } from "./consent.js";
+import { createMcpPostHandler, methodNotAllowed } from "./mcp-handler.js";
+import { authorizationServerMetadata, protectedResourceMetadata } from "./metadata.js";
+import { verifyInternalToken } from "./internal-auth.js";
+/** True when a query value looks like a credential (api key, MCP token/code). */
+function looksLikeCredential(value) {
+    return value.startsWith("bios-") || value.startsWith("usf-") || value.startsWith("mcp_") || /^bearer\s/i.test(value);
+}
+function queryHasCredential(value) {
+    if (typeof value === "string")
+        return looksLikeCredential(value);
+    if (Array.isArray(value))
+        return value.some(queryHasCredential);
+    if (value && typeof value === "object") {
+        return Object.values(value).some(queryHasCredential);
+    }
+    return false;
+}
+export function createApp(deps) {
+    const { store, cfg } = deps;
+    const audit = deps.audit ?? nullAudit;
+    const app = express();
+    app.disable("x-powered-by");
+    // Behind the ALB + api-gateway; trust X-Forwarded-For for rate-limit keys.
+    app.set("trust proxy", true);
+    // Tokens must only ever travel in headers or bodies, never in URLs.
+    app.use((req, res, next) => {
+        if (queryHasCredential(req.query)) {
+            res.status(400).json({
+                error: "invalid_request",
+                error_description: "Credentials must not be sent in the URL.",
+            });
+            return;
+        }
+        next();
+    });
+    // CORS for browser-based MCP clients on the public endpoints
+    // (/mcp, /mcp/oauth/*, /.well-known/*). No credentials, wildcard origin.
+    app.use((req, res, next) => {
+        const isPublic = req.path === cfg.publicMcpPath ||
+            req.path.startsWith(`${cfg.publicMcpPath}/`) ||
+            req.path.startsWith("/.well-known/");
+        if (!isPublic) {
+            next();
+            return;
+        }
+        res.set("Access-Control-Allow-Origin", "*");
+        res.set("Access-Control-Allow-Methods", "GET,POST,DELETE,OPTIONS");
+        res.set("Access-Control-Allow-Headers", "Content-Type, Authorization, Mcp-Protocol-Version, Mcp-Session-Id, Last-Event-ID");
+        res.set("Access-Control-Expose-Headers", "Mcp-Session-Id, WWW-Authenticate");
+        res.set("Access-Control-Max-Age", "86400");
+        if (req.method === "OPTIONS") {
+            res.status(204).end();
+            return;
+        }
+        next();
+    });
+    app.use(express.json({ limit: "4mb" }));
+    app.use(express.urlencoded({ extended: false }));
+    /* ─── Health (ECS health check fetches "/" and requires res.ok) ─── */
+    app.get("/", (_req, res) => {
+        res.json({ status: "ok", service: "bios-mcp" });
+    });
+    /* ─── Discovery metadata ─── */
+    const serveResourceMeta = (_req, res) => {
+        res.json(protectedResourceMetadata(cfg));
+    };
+    const serveAsMeta = (_req, res) => {
+        res.json(authorizationServerMetadata(cfg));
+    };
+    app.get("/.well-known/oauth-protected-resource", serveResourceMeta);
+    app.get("/.well-known/oauth-protected-resource/mcp", serveResourceMeta);
+    app.get("/.well-known/oauth-authorization-server", serveAsMeta);
+    app.get("/.well-known/oauth-authorization-server/mcp", serveAsMeta);
+    app.get("/.well-known/openid-configuration", serveAsMeta);
+    app.get("/.well-known/openid-configuration/mcp", serveAsMeta);
+    /* ─── OAuth authorization server + consent API ─── */
+    app.use(createOAuthRouter({
+        store,
+        cfg,
+        audit,
+        registerLimiter: deps.registerLimiter,
+        tokenLimiter: deps.tokenLimiter,
+    }));
+    app.use(createConsentRouter({ store, cfg, audit }));
+    /* ─── Gateway-facing token introspection ─── */
+    app.post("/internal/oauth/introspect", async (req, res) => {
+        const internalToken = req.header("x-internal-token") ?? "";
+        if (!verifyInternalToken(internalToken, cfg.internalServiceKey)) {
+            res.status(401).json({ error: "unauthorized" });
+            return;
+        }
+        const body = (req.body ?? {});
+        const raw = typeof body.token === "string" ? body.token : "";
+        const access = raw ? await validateAccessToken(store, raw) : null;
+        if (!access) {
+            res.json({ active: false });
+            return;
+        }
+        const { grant } = access;
+        res.json({
+            active: true,
+            token_id: sha256Hex(raw).slice(0, 12),
+            grant_id: grant.id,
+            user_id: grant.user_id,
+            email: grant.user_email,
+            org_id: grant.org_id,
+            workspace_id: grant.workspace_id,
+            scopes: grant.scopes,
+        });
+    });
+    /* ─── MCP Streamable HTTP endpoint (stateless) ─── */
+    app.post(cfg.publicMcpPath, createMcpPostHandler({ store, cfg, audit }));
+    app.get(cfg.publicMcpPath, methodNotAllowed);
+    app.delete(cfg.publicMcpPath, methodNotAllowed);
+    /* ─── Fallbacks ─── */
+    app.use((_req, res) => {
+        res.status(404).json({ error: "not_found" });
+    });
+    // Central error handler: malformed bodies get a clean 400; anything else a
+    // generic 500. Error details never include request payloads or tokens.
+    app.use((err, _req, res, _next) => {
+        const isParseError = err instanceof SyntaxError ||
+            (typeof err === "object" && err !== null && err.type === "entity.parse.failed");
+        if (res.headersSent) {
+            res.end();
+            return;
+        }
+        if (isParseError) {
+            res.status(400).json({ error: "invalid_request", error_description: "Malformed request body" });
+            return;
+        }
+        res.status(500).json({ error: "server_error" });
+    });
+    return app;
+}
+//# sourceMappingURL=app.js.map

package/dist/http/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/http/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAAyE,MAAM,SAAS,CAAC;AAChG,OAAO,EAAE,SAAS,EAAqB,MAAM,YAAY,CAAC;AAG1D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,SAAS,EAA6B,MAAM,YAAY,CAAC;AAC1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAUzD,iFAAiF;AACjF,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IAEtC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,2EAA2E;IAC3E,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAE7B,oEAAoE;IACpE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC1D,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,0CAA0C;aAC9D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC1D,MAAM,QAAQ,GACZ,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,aAAa;YAC9B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,aAAa,GAAG,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,yBAAyB,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CACL,8BAA8B,EAC9B,kFAAkF,CACnF,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,+BAA+B,EAAE,kCAAkC,CAAC,CAAC;QAC7E,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAEjD,uEAAuE;IACvE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,gCAAgC;IAChC,MAAM,iBAAiB,GAAG,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACzD,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACnD,GAAG,CAAC,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,iBAAiB,CAAC,CAAC;IACpE,GAAG,CAAC,GAAG,CAAC,2CAA2C,EAAE,iBAAiB,CAAC,CAAC;IACxE,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,WAAW,CAAC,CAAC;IAChE,GAAG,CAAC,GAAG,CAAC,6CAA6C,EAAE,WAAW,CAAC,CAAC;IACpE,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,WAAW,CAAC,CAAC;IAC1D,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,WAAW,CAAC,CAAC;IAE9D,sDAAsD;IACtD,GAAG,CAAC,GAAG,CACL,iBAAiB,CAAC;QAChB,KAAK;QACL,GAAG;QACH,KAAK;QACL,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC,CACH,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAEpD,gDAAgD;IAChD,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3E,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACrC,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,UAAU;YACvB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,oBAAoB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAEhD,uBAAuB;IACvB,GAAG,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,uEAAuE;IACvE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,IAAa,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QAC1E,MAAM,YAAY,GAChB,GAAG,YAAY,WAAW;YAC1B,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAK,GAAyB,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;QACzG,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/http/audit.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Structured audit logging: single-line JSON on stdout, plus fire-and-forget
+ * mirroring to audit-service (POST /internal/audit/events, authenticated with
+ * the internal service JWT) when AUDIT_SERVICE_HOST is configured.
+ *
+ * Never pass raw tokens, codes, verifiers, api keys, or tool arguments into
+ * emit() — only identifiers and outcomes.
+ */
+export interface AuditEmitter {
+    emit(evt: string, fields: Record<string, unknown>): void;
+}
+export interface AuditOptions {
+    /** e.g. "http://bios-audit:7113"; empty disables mirroring. */
+    auditBaseUrl?: string;
+    internalServiceKey?: string;
+    /** Overridable for tests. */
+    fetchImpl?: typeof fetch;
+    out?: (line: string) => void;
+}
+export declare function createAudit(opts?: AuditOptions): AuditEmitter;
+/** No-op emitter for tests that do not assert on audit output. */
+export declare const nullAudit: AuditEmitter;
+//# sourceMappingURL=audit.d.ts.map

package/dist/http/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/http/audit.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAEH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,6BAA6B;IAC7B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,wBAAgB,WAAW,CAAC,IAAI,GAAE,YAAiB,GAAG,YAAY,CAqCjE;AAED,kEAAkE;AAClE,eAAO,MAAM,SAAS,EAAE,YAAiC,CAAC"}

package/dist/http/audit.js

@@ -0,0 +1,41 @@
+import { generateInternalToken } from "./internal-auth.js";
+export function createAudit(opts = {}) {
+    const write = opts.out ?? ((line) => process.stdout.write(`${line}\n`));
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    return {
+        emit(evt, fields) {
+            write(JSON.stringify({ ts: new Date().toISOString(), level: "info", evt, ...fields }));
+            if (!opts.auditBaseUrl || !opts.internalServiceKey)
+                return;
+            const payload = {
+                event_type: `mcp.${evt}`,
+                actor_type: fields.user_id ? "user" : "service",
+                actor_id: String(fields.user_id ?? fields.client_id ?? "bios-mcp"),
+                resource_type: "mcp",
+                resource_id: fields.grant_id != null
+                    ? String(fields.grant_id)
+                    : fields.client_id != null
+                        ? String(fields.client_id)
+                        : null,
+                workspace_id: fields.workspace_id != null ? String(fields.workspace_id) : null,
+                details: fields,
+                source_service: "bios-mcp",
+            };
+            try {
+                const token = generateInternalToken(opts.internalServiceKey, "bios-mcp");
+                void fetchImpl(`${opts.auditBaseUrl}/internal/audit/events`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json", "X-Internal-Token": token },
+                    body: JSON.stringify(payload),
+                    signal: AbortSignal.timeout(3_000),
+                }).catch(() => { });
+            }
+            catch {
+                // Audit mirroring is strictly best-effort.
+            }
+        },
+    };
+}
+/** No-op emitter for tests that do not assert on audit output. */
+export const nullAudit = { emit: () => { } };
+//# sourceMappingURL=audit.js.map

package/dist/http/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/http/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAwB3D,MAAM,UAAU,WAAW,CAAC,OAAqB,EAAE;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAE1C,OAAO;QACL,IAAI,CAAC,GAAW,EAAE,MAA+B;YAC/C,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;YAEvF,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,kBAAkB;gBAAE,OAAO;YAC3D,MAAM,OAAO,GAAG;gBACd,UAAU,EAAE,OAAO,GAAG,EAAE;gBACxB,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC/C,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC;gBAClE,aAAa,EAAE,KAAK;gBACpB,WAAW,EACT,MAAM,CAAC,QAAQ,IAAI,IAAI;oBACrB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;oBACzB,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI;wBACxB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;wBAC1B,CAAC,CAAC,IAAI;gBACZ,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC9E,OAAO,EAAE,MAAM;gBACf,cAAc,EAAE,UAAU;aAC3B,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;gBACzE,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,YAAY,wBAAwB,EAAE;oBAC3D,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,EAAE;oBAC1E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;iBACnC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,2CAA2C;YAC7C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,SAAS,GAAiB,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC"}

package/dist/http/config.d.ts

@@ -0,0 +1,23 @@
+/** Configuration for the hosted MCP HTTP service (ECS service "bios-mcp"). */
+export interface HostedConfig {
+    /** Port the HTTP server binds; default 7152. */
+    port: number;
+    /** Public origin the gateway/ALB serves, e.g. https://api-dev.runbios.ai. */
+    publicBaseUrl: string;
+    /** Public path of the MCP endpoint; default "/mcp". */
+    publicMcpPath: string;
+    /** Console origin used for the consent redirect, e.g. https://platform-dev.runbios.ai. */
+    consoleBaseUrl: string;
+    /** Internal api-gateway host/port used as the BiosClient base URL. */
+    apiGatewayHost: string;
+    apiGatewayPort: number;
+    /** Postgres connection string for the mcp schema. */
+    databaseUrl: string;
+    /** Shared internal service key (gateway stamp + internal JWTs). */
+    internalServiceKey: string;
+    /** Optional audit-service host; when empty, audit events go to stdout only. */
+    auditServiceHost: string;
+    auditServicePort: number;
+}
+export declare function loadHostedConfig(env?: NodeJS.ProcessEnv): HostedConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/http/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/http/config.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAE9E,MAAM,WAAW,YAAY;IAC3B,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,cAAc,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AA6BD,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CA4CnF"}

package/dist/http/config.js

@@ -0,0 +1,70 @@
+/** Configuration for the hosted MCP HTTP service (ECS service "bios-mcp"). */
+function stripTrailingSlash(value) {
+    return value.replace(/\/+$/, "");
+}
+/**
+ * The connection can be given either as a single MCP_DATABASE_URL (how the
+ * deployed secret is stored) or as discrete MCP_DB_* parts (how local dev
+ * configures it — repo files must never contain credential-bearing URLs).
+ */
+function resolveDatabaseUrl(env) {
+    const url = (env.MCP_DATABASE_URL ?? "").trim();
+    if (url)
+        return url;
+    const host = (env.MCP_DB_HOST ?? "").trim();
+    const password = env.MCP_DB_PASSWORD ?? "";
+    if (!host || !password)
+        return "";
+    const port = (env.MCP_DB_PORT ?? "").trim() || "5432";
+    const user = (env.MCP_DB_USER ?? "").trim() || "mcp_svc";
+    const name = (env.MCP_DB_NAME ?? "").trim() || "bios_saas";
+    const sslmode = (env.MCP_DB_SSLMODE ?? "").trim() || "disable";
+    const dsn = new URL(`postgres://${host}:${port}`);
+    dsn.username = user;
+    dsn.password = password;
+    dsn.pathname = `/${name}`;
+    dsn.search = sslmode === "disable" ? "sslmode=disable" : `uselibpqcompat=true&sslmode=${sslmode}`;
+    return dsn.toString();
+}
+export function loadHostedConfig(env = process.env) {
+    const missing = [];
+    const required = (name) => {
+        const value = (env[name] ?? "").trim();
+        if (!value)
+            missing.push(name);
+        return value;
+    };
+    const publicBaseUrl = stripTrailingSlash(required("PUBLIC_BASE_URL"));
+    const consoleBaseUrl = stripTrailingSlash(required("CONSOLE_BASE_URL"));
+    const databaseUrl = resolveDatabaseUrl(env);
+    if (!databaseUrl)
+        missing.push("MCP_DATABASE_URL (or MCP_DB_HOST + MCP_DB_PASSWORD)");
+    const internalServiceKey = required("INTERNAL_SERVICE_KEY");
+    if (missing.length > 0) {
+        throw new Error(`bios-mcp cannot start: missing required environment variable(s): ${missing.join(", ")}. ` +
+            `Set PUBLIC_BASE_URL (public origin), CONSOLE_BASE_URL (console origin), ` +
+            `MCP_DATABASE_URL or the MCP_DB_* parts (Postgres), and INTERNAL_SERVICE_KEY (shared internal key).`);
+    }
+    let publicMcpPath = (env.PUBLIC_MCP_PATH ?? "").trim() || "/mcp";
+    if (!publicMcpPath.startsWith("/"))
+        publicMcpPath = `/${publicMcpPath}`;
+    publicMcpPath = stripTrailingSlash(publicMcpPath) || "/mcp";
+    const port = Number.parseInt(env.MCP_PORT ?? "", 10) || 7152;
+    const apiGatewayHost = (env.API_GATEWAY_HOST ?? "").trim() || "localhost";
+    const apiGatewayPort = Number.parseInt(env.API_GATEWAY_PORT ?? "", 10) || 7100;
+    const auditServiceHost = (env.AUDIT_SERVICE_HOST ?? "").trim();
+    const auditServicePort = Number.parseInt(env.AUDIT_SERVICE_PORT ?? "", 10) || 7113;
+    return {
+        port,
+        publicBaseUrl,
+        publicMcpPath,
+        consoleBaseUrl,
+        apiGatewayHost,
+        apiGatewayPort,
+        databaseUrl,
+        internalServiceKey,
+        auditServiceHost,
+        auditServicePort,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/http/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/http/config.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAuB9E,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,GAAsB;IAChD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,WAAW,CAAC;IAC3D,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,cAAc,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAClD,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACxB,GAAG,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;IAC1B,GAAG,CAAC,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,+BAA+B,OAAO,EAAE,CAAC;IAClG,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;QACxC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACtE,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACtF,MAAM,kBAAkB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAE5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,oEAAoE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACxF,0EAA0E;YAC1E,oGAAoG,CACvG,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC;IACjE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;IACxE,aAAa,GAAG,kBAAkB,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC;IAE5D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IAC7D,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,WAAW,CAAC;IAC1E,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IAC/E,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IAEnF,OAAO;QACL,IAAI;QACJ,aAAa;QACb,aAAa;QACb,cAAc;QACd,cAAc;QACd,cAAc;QACd,WAAW;QACX,kBAAkB;QAClB,gBAAgB;QAChB,gBAAgB;KACjB,CAAC;AACJ,CAAC"}

package/dist/http/consent.d.ts

@@ -0,0 +1,18 @@
+import { Router } from "express";
+import type { AuditEmitter } from "./audit.js";
+import type { HostedConfig } from "./config.js";
+import type { McpStore } from "./store.js";
+/**
+ * Consent endpoints under /api/mcp/oauth/*. These are reached through the Go
+ * api-gateway, which authenticates the console user's JWT, validates
+ * workspace membership on X-Workspace-ID, stamps identity headers, and marks
+ * the request with X-Gateway-Auth = INTERNAL_SERVICE_KEY (the same contract
+ * every Go service trusts in its JWTAuth middleware).
+ */
+export interface ConsentRouterDeps {
+    store: McpStore;
+    cfg: HostedConfig;
+    audit: AuditEmitter;
+}
+export declare function createConsentRouter(deps: ConsentRouterDeps): Router;
+//# sourceMappingURL=consent.d.ts.map

package/dist/http/consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../../src/http/consent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkD,MAAM,SAAS,CAAC;AACjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAmB,MAAM,YAAY,CAAC;AAW5D;;;;;;GAMG;AAEH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,YAAY,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;CACrB;AAaD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAwJnE"}

package/dist/http/consent.js

@@ -0,0 +1,148 @@
+import { Router } from "express";
+import { AUTH_CODE_TTL_MS, newId, newRawToken, normalizeScopes, parseScopeParam, sha256Hex, timingSafeEqualStr, } from "./oauth.js";
+function str(value) {
+    return typeof value === "string" ? value : "";
+}
+export function createConsentRouter(deps) {
+    const { store, cfg, audit } = deps;
+    const router = Router();
+    const gatewayAuth = (req, res, next) => {
+        const stamp = req.header("x-gateway-auth") ?? "";
+        if (!stamp || !cfg.internalServiceKey || !timingSafeEqualStr(stamp, cfg.internalServiceKey)) {
+            res.status(401).json({ error: "unauthorized" });
+            return;
+        }
+        // Consent requires an interactive console session, never an API key or
+        // an OAuth token (an MCP client must not be able to approve itself).
+        if (req.header("x-auth-type") !== "jwt") {
+            res.status(403).json({ error: "forbidden", message: "Sign in to the console to review this connection." });
+            return;
+        }
+        if (!(req.header("x-user-id") ?? "").trim()) {
+            res.status(401).json({ error: "unauthorized" });
+            return;
+        }
+        next();
+    };
+    const identity = (req) => ({
+        userId: (req.header("x-user-id") ?? "").trim(),
+        userEmail: (req.header("x-user-email") ?? "").trim(),
+        orgId: (req.header("x-org-id") ?? "").trim(),
+        workspaceId: (req.header("x-workspace-id") ?? "").trim(),
+    });
+    const expireIfNeeded = async (row) => {
+        if (row.status === "pending" && row.expires_at.getTime() <= Date.now()) {
+            await store.setRequestStatus(row.id, "expired");
+            return { ...row, status: "expired" };
+        }
+        return row;
+    };
+    router.get("/api/mcp/oauth/request/:id", gatewayAuth, async (req, res) => {
+        const raw = await store.getRequest(req.params.id);
+        if (!raw) {
+            res.status(404).json({ error: "not_found" });
+            return;
+        }
+        const row = await expireIfNeeded(raw);
+        const client = await store.getClient(row.client_id);
+        let clientHost = "";
+        try {
+            clientHost = new URL(client?.redirect_uris[0] ?? row.redirect_uri).hostname;
+        }
+        catch {
+            clientHost = "";
+        }
+        res.json({
+            request_id: row.id,
+            client_name: client?.client_name ?? "MCP client",
+            client_host: clientHost,
+            requested_scopes: row.scope ? parseScopeParam(row.scope) : [],
+            status: row.status,
+            expires_at: row.expires_at.toISOString(),
+        });
+    });
+    router.post("/api/mcp/oauth/approve", gatewayAuth, async (req, res) => {
+        const body = (req.body ?? {});
+        const requestId = str(body.request_id);
+        const workspaceId = str(body.workspace_id).trim();
+        const raw = requestId ? await store.getRequest(requestId) : null;
+        if (!raw) {
+            res.status(404).json({ error: "not_found" });
+            return;
+        }
+        const row = await expireIfNeeded(raw);
+        if (row.status !== "pending") {
+            res.status(400).json({ error: "invalid_request", message: `This connection request is ${row.status}. Start again from your MCP client.` });
+            return;
+        }
+        const scopes = normalizeScopes(body.scopes);
+        if (!scopes) {
+            res.status(400).json({ error: "invalid_request", message: "Choose at least one valid permission for this connection." });
+            return;
+        }
+        const who = identity(req);
+        // The gateway already verified membership for the X-Workspace-ID header.
+        // Requiring the body value to equal that header makes the body value
+        // trustworthy without a second membership check here.
+        if (!workspaceId || workspaceId !== who.workspaceId) {
+            res.status(400).json({
+                error: "invalid_request",
+                message: "workspace_id must match the workspace this request was made from. Reload the page and try again.",
+            });
+            return;
+        }
+        const grantId = newId("grant");
+        await store.insertGrant({
+            id: grantId,
+            client_id: row.client_id,
+            user_id: who.userId,
+            user_email: who.userEmail,
+            org_id: who.orgId,
+            workspace_id: workspaceId,
+            scopes,
+        });
+        const code = newRawToken("mcp_ac_");
+        await store.insertCode({
+            code_hash: sha256Hex(code),
+            grant_id: grantId,
+            client_id: row.client_id,
+            redirect_uri: row.redirect_uri,
+            code_challenge: row.code_challenge,
+            code_challenge_method: row.code_challenge_method,
+            expires_at: new Date(Date.now() + AUTH_CODE_TTL_MS),
+        });
+        await store.setRequestStatus(row.id, "approved");
+        audit.emit("oauth_grant_created", {
+            grant_id: grantId,
+            user_id: who.userId,
+            workspace_id: workspaceId,
+            scopes,
+            client_id: row.client_id,
+        });
+        const redirect = new URL(row.redirect_uri);
+        redirect.searchParams.set("code", code);
+        if (row.state)
+            redirect.searchParams.set("state", row.state);
+        res.json({ redirect_url: redirect.toString() });
+    });
+    router.post("/api/mcp/oauth/deny", gatewayAuth, async (req, res) => {
+        const body = (req.body ?? {});
+        const requestId = str(body.request_id);
+        const raw = requestId ? await store.getRequest(requestId) : null;
+        if (!raw) {
+            res.status(404).json({ error: "not_found" });
+            return;
+        }
+        const row = await expireIfNeeded(raw);
+        if (row.status === "pending") {
+            await store.setRequestStatus(row.id, "denied");
+        }
+        const redirect = new URL(row.redirect_uri);
+        redirect.searchParams.set("error", "access_denied");
+        if (row.state)
+            redirect.searchParams.set("state", row.state);
+        res.json({ redirect_url: redirect.toString() });
+    });
+    return router;
+}
+//# sourceMappingURL=consent.js.map

package/dist/http/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/http/consent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkD,MAAM,SAAS,CAAC;AAIjF,OAAO,EACL,gBAAgB,EAChB,KAAK,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,SAAS,EACT,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAuBpB,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,WAAW,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC5E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,KAAK,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;YAC3G,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAmB,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC9C,SAAS,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACpD,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC5C,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;KACzD,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,KAAK,EAAE,GAAoB,EAA4B,EAAE;QAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACvE,MAAM,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAChD,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,4BAA4B,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC1F,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC;YACP,UAAU,EAAE,GAAG,CAAC,EAAE;YAClB,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,YAAY;YAChD,WAAW,EAAE,UAAU;YACvB,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;YAC7D,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;SACzC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;QAElD,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,8BAA8B,GAAG,CAAC,MAAM,qCAAqC,EAAE,CAAC,CAAC;YAC3I,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,2DAA2D,EAAE,CAAC,CAAC;YACzH,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1B,yEAAyE;QACzE,qEAAqE;QACrE,sDAAsD;QACtD,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;YACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,kGAAkG;aAC5G,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,KAAK,CAAC,WAAW,CAAC;YACtB,EAAE,EAAE,OAAO;YACX,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,MAAM;YACnB,UAAU,EAAE,GAAG,CAAC,SAAS;YACzB,MAAM,EAAE,GAAG,CAAC,KAAK;YACjB,YAAY,EAAE,WAAW;YACzB,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC,UAAU,CAAC;YACrB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;YAChD,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;SACpD,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAEjD,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE;YAChC,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,GAAG,CAAC,MAAM;YACnB,YAAY,EAAE,WAAW;YACzB,MAAM;YACN,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,IAAI,GAAG,CAAC,KAAK;YAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACpF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,KAAK;YAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/http/internal-auth.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Internal service-to-service JWT, mirroring the Go side
+ * (services/iam-service/internal/platform/auth.go):
+ *
+ * - GenerateInternalToken(key, source): HS256, claims { jti, sub: source,
+ *   iat, exp: iat+30s, iss: "bios-saas-internal" }.
+ * - ValidateInternalToken(token, key): signature must verify, issuer must be
+ *   "bios-saas-internal", expiry must not have passed.
+ *
+ * The verifier here is deliberately strict where Go is lax: only HS256 is
+ * accepted and `exp` is required. The only legitimate issuer (the gateway)
+ * always signs HS256 with a 30 second expiry, so the stricter check cannot
+ * reject valid traffic and fails closed on anything else.
+ */
+export declare const INTERNAL_ISSUER = "bios-saas-internal";
+export declare function generateInternalToken(serviceKey: string, sourceService: string, ttlSeconds?: number, now?: () => number): string;
+export interface InternalTokenClaims {
+    sub: string;
+}
+/** Returns the claims when the token is valid, null otherwise. Never throws. */
+export declare function verifyInternalToken(token: string, serviceKey: string, now?: () => number): InternalTokenClaims | null;
+//# sourceMappingURL=internal-auth.d.ts.map

package/dist/http/internal-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-auth.d.ts","sourceRoot":"","sources":["../../src/http/internal-auth.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,eAAe,uBAAuB,CAAC;AAgBpD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,UAAU,SAAK,EACf,GAAG,GAAE,MAAM,MAAiB,GAC3B,MAAM,CAcR;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,MAAiB,GAC3B,mBAAmB,GAAG,IAAI,CA6B5B"}

package/dist/http/internal-auth.js

@@ -0,0 +1,73 @@
+import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+/**
+ * Internal service-to-service JWT, mirroring the Go side
+ * (services/iam-service/internal/platform/auth.go):
+ *
+ * - GenerateInternalToken(key, source): HS256, claims { jti, sub: source,
+ *   iat, exp: iat+30s, iss: "bios-saas-internal" }.
+ * - ValidateInternalToken(token, key): signature must verify, issuer must be
+ *   "bios-saas-internal", expiry must not have passed.
+ *
+ * The verifier here is deliberately strict where Go is lax: only HS256 is
+ * accepted and `exp` is required. The only legitimate issuer (the gateway)
+ * always signs HS256 with a 30 second expiry, so the stricter check cannot
+ * reject valid traffic and fails closed on anything else.
+ */
+export const INTERNAL_ISSUER = "bios-saas-internal";
+const b64url = (buf) => buf.toString("base64url");
+function encodeSegment(value) {
+    return b64url(Buffer.from(JSON.stringify(value), "utf8"));
+}
+function decodeSegment(segment) {
+    try {
+        return JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function generateInternalToken(serviceKey, sourceService, ttlSeconds = 30, now = Date.now) {
+    const iat = Math.floor(now() / 1000);
+    const header = encodeSegment({ alg: "HS256", typ: "JWT" });
+    const payload = encodeSegment({
+        jti: randomUUID(),
+        sub: sourceService,
+        iat,
+        exp: iat + ttlSeconds,
+        iss: INTERNAL_ISSUER,
+    });
+    const signature = b64url(createHmac("sha256", serviceKey).update(`${header}.${payload}`).digest());
+    return `${header}.${payload}.${signature}`;
+}
+/** Returns the claims when the token is valid, null otherwise. Never throws. */
+export function verifyInternalToken(token, serviceKey, now = Date.now) {
+    if (!token || !serviceKey)
+        return null;
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return null;
+    const [headerB64, payloadB64, signatureB64] = parts;
+    const header = decodeSegment(headerB64);
+    if (!header || header.alg !== "HS256")
+        return null;
+    const expected = createHmac("sha256", serviceKey)
+        .update(`${headerB64}.${payloadB64}`)
+        .digest();
+    let provided;
+    try {
+        provided = Buffer.from(signatureB64, "base64url");
+    }
+    catch {
+        return null;
+    }
+    if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
+        return null;
+    }
+    const payload = decodeSegment(payloadB64);
+    if (!payload || payload.iss !== INTERNAL_ISSUER)
+        return null;
+    if (typeof payload.exp !== "number" || payload.exp * 1000 <= now())
+        return null;
+    return { sub: typeof payload.sub === "string" ? payload.sub : "" };
+}
+//# sourceMappingURL=internal-auth.js.map

package/dist/http/internal-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-auth.js","sourceRoot":"","sources":["../../src/http/internal-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE;;;;;;;;;;;;;GAaG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAEpD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAElE,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,aAAqB,EACrB,UAAU,GAAG,EAAE,EACf,MAAoB,IAAI,CAAC,GAAG;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,aAAa,CAAC;QAC5B,GAAG,EAAE,UAAU,EAAE;QACjB,GAAG,EAAE,aAAa;QAClB,GAAG;QACH,GAAG,EAAE,GAAG,GAAG,UAAU;QACrB,GAAG,EAAE,eAAe;KACrB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,CACtB,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CACzE,CAAC;IACF,OAAO,GAAG,MAAM,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;AAC7C,CAAC;AAMD,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,UAAkB,EAClB,MAAoB,IAAI,CAAC,GAAG;IAE5B,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;IAEpD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAA4B,CAAC;IACnE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC9C,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;SACpC,MAAM,EAAE,CAAC;IACZ,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAEhC,CAAC;IACT,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAEhF,OAAO,EAAE,GAAG,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACrE,CAAC"}

package/dist/http/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/http/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/http/main.ts"],"names":[],"mappings":""}