runbios-mcp 0.2.1-dev.62

package/dist/http/main.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+import pg from "pg";
+import { loadHostedConfig } from "./config.js";
+import { logServiceHostProblems } from "./serviceHostGuard.js";
+import { PgStore } from "./store.js";
+import { createApp } from "./app.js";
+import { createAudit } from "./audit.js";
+/** Entry point for the hosted MCP HTTP service (ECS service "bios-mcp"). */
+function logLine(level, evt, fields = {}) {
+    process.stdout.write(`${JSON.stringify({ ts: new Date().toISOString(), level, evt, ...fields })}\n`);
+}
+async function main() {
+    const cfg = loadHostedConfig();
+    // Non-fatal ECS boot guard: warn loudly if internal peers would fall back to
+    // localhost under ECS. No-op locally. Never throws.
+    logServiceHostProblems();
+    const pool = new pg.Pool({
+        connectionString: cfg.databaseUrl,
+        max: 10,
+        idleTimeoutMillis: 30_000,
+        connectionTimeoutMillis: 10_000,
+    });
+    pool.on("error", (err) => {
+        logLine("error", "pg_pool_error", { error: err.message });
+    });
+    const store = new PgStore(pool);
+    await store.migrate();
+    const audit = createAudit({
+        auditBaseUrl: cfg.auditServiceHost ? `http://${cfg.auditServiceHost}:${cfg.auditServicePort}` : "",
+        internalServiceKey: cfg.internalServiceKey,
+    });
+    const app = createApp({ store, cfg, audit });
+    const server = app.listen(cfg.port, "0.0.0.0", () => {
+        logLine("info", "server_started", { port: cfg.port, mcp_path: cfg.publicMcpPath });
+    });
+    server.requestTimeout = 0; // long-lived MCP requests; the transport manages its own lifecycle
+    server.headersTimeout = 65_000;
+    const sweep = setInterval(() => {
+        void store.cleanupExpired().catch((err) => {
+            logLine("warn", "cleanup_failed", { error: err instanceof Error ? err.message : "unknown" });
+        });
+    }, 3600_000);
+    sweep.unref();
+    let shuttingDown = false;
+    const shutdown = (signal) => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        logLine("info", "shutting_down", { signal });
+        clearInterval(sweep);
+        server.close(() => {
+            void pool.end().finally(() => process.exit(0));
+        });
+        // Do not hang forever on stuck connections.
+        setTimeout(() => process.exit(0), 25_000).unref();
+    };
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+    process.on("SIGINT", () => shutdown("SIGINT"));
+}
+main().catch((err) => {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`bios-mcp failed to start: ${message}`);
+    process.exit(1);
+});
+//# sourceMappingURL=main.js.map

package/dist/http/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/http/main.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,4EAA4E;AAE5E,SAAS,OAAO,CAAC,KAAa,EAAE,GAAW,EAAE,SAAkC,EAAE;IAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;AACvG,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAE/B,6EAA6E;IAC7E,oDAAoD;IACpD,sBAAsB,EAAE,CAAC;IAEzB,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC;QACvB,gBAAgB,EAAE,GAAG,CAAC,WAAW;QACjC,GAAG,EAAE,EAAE;QACP,iBAAiB,EAAE,MAAM;QACzB,uBAAuB,EAAE,MAAM;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACvB,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IAEtB,MAAM,KAAK,GAAG,WAAW,CAAC;QACxB,YAAY,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE;QAClG,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;KAC3C,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;QAClD,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,mEAAmE;IAC9F,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;IAE/B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACjD,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,QAAQ,CAAC,CAAC;IACb,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;QACxC,IAAI,YAAY;YAAE,OAAO;QACzB,YAAY,GAAG,IAAI,CAAC;QACpB,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,4CAA4C;QAC5C,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/http/mcp-handler.d.ts

@@ -0,0 +1,12 @@
+import type { Request, Response } from "express";
+import type { AuditEmitter } from "./audit.js";
+import type { HostedConfig } from "./config.js";
+import type { McpStore } from "./store.js";
+export interface McpHandlerDeps {
+    store: McpStore;
+    cfg: HostedConfig;
+    audit: AuditEmitter;
+}
+export declare function createMcpPostHandler(deps: McpHandlerDeps): (req: Request, res: Response) => Promise<void>;
+export declare function methodNotAllowed(req: Request, res: Response): void;
+//# sourceMappingURL=mcp-handler.d.ts.map

package/dist/http/mcp-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-handler.d.ts","sourceRoot":"","sources":["../../src/http/mcp-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AA6B3C,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,YAAY,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;CACrB;AAgBD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,IAGnB,KAAK,OAAO,EAAE,KAAK,QAAQ,KAAG,OAAO,CAAC,IAAI,CAAC,CAwDhF;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CASlE"}

package/dist/http/mcp-handler.js

@@ -0,0 +1,103 @@
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { BiosClient } from "../api-client.js";
+import { createBiosMcpServer, VERSION } from "../server.js";
+import { validateAccessToken } from "./oauth.js";
+/**
+ * The hosted MCP endpoint is fully stateless: every POST validates the
+ * bearer token, builds a per-request BiosClient pointed at the internal
+ * api-gateway (which re-checks the token, scopes, and workspace membership
+ * on every downstream call), runs the request through a fresh server +
+ * transport pair, and tears both down when the response ends.
+ */
+/**
+ * Hosted variant of BiosClient. The control-plane API never returns a
+ * deployment's serving credential after creation (keys are shown exactly
+ * once at create/rotate time), so chat_with_inference cannot resolve one
+ * lazily. Fail with a clear, hosted-appropriate message instead of the
+ * stdio error that points at a local environment variable. The stdio path
+ * keeps using BiosClient unchanged.
+ */
+class HostedBiosClient extends BiosClient {
+    async inferenceApi() {
+        throw new Error("chat_with_inference is not available on the hosted MCP connection. " +
+            "Create an inference key from the deployment page in the console, then call the " +
+            "endpoint's OpenAI-compatible API directly with that key.");
+    }
+}
+function unauthorized(res, cfg) {
+    res
+        .status(401)
+        .set("WWW-Authenticate", `Bearer resource_metadata="${cfg.publicBaseUrl}/.well-known/oauth-protected-resource/mcp", error="invalid_token"`)
+        .json({
+        jsonrpc: "2.0",
+        error: { code: -32001, message: "Unauthorized: a valid access token is required" },
+        id: null,
+    });
+}
+export function createMcpPostHandler(deps) {
+    const { store, cfg, audit } = deps;
+    return async function handleMcpPost(req, res) {
+        const header = req.header("authorization") ?? "";
+        const match = /^Bearer\s+(.+)$/i.exec(header);
+        const rawToken = match ? match[1].trim() : "";
+        const access = rawToken ? await validateAccessToken(store, rawToken) : null;
+        if (!access) {
+            unauthorized(res, cfg);
+            return;
+        }
+        const { grant } = access;
+        const client = new HostedBiosClient({
+            baseUrl: `http://${cfg.apiGatewayHost}:${cfg.apiGatewayPort}`,
+            authHeaders: { Authorization: `Bearer ${rawToken}` },
+            workspaceId: grant.workspace_id,
+            orgId: grant.org_id || undefined,
+            userAgent: `bios-mcp-hosted/${VERSION}`,
+        });
+        const server = createBiosMcpServer(client, {
+            onToolCall: (info) => audit.emit("mcp_tool_call", {
+                tool: info.tool,
+                ok: info.ok,
+                ms: info.ms,
+                user_id: grant.user_id,
+                workspace_id: grant.workspace_id,
+                grant_id: grant.id,
+                ...(info.error ? { error: info.error } : {}),
+            }),
+        });
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: undefined,
+            enableJsonResponse: true,
+        });
+        res.on("close", () => {
+            void transport.close().catch(() => { });
+            void server.close().catch(() => { });
+        });
+        try {
+            await server.connect(transport);
+            await transport.handleRequest(req, res, req.body);
+        }
+        catch {
+            if (!res.headersSent) {
+                res.status(500).json({
+                    jsonrpc: "2.0",
+                    error: { code: -32603, message: "Internal server error" },
+                    id: null,
+                });
+            }
+            else if (!res.writableEnded) {
+                res.end();
+            }
+        }
+    };
+}
+export function methodNotAllowed(req, res) {
+    res
+        .status(405)
+        .set("Allow", "POST")
+        .json({
+        jsonrpc: "2.0",
+        error: { code: -32000, message: "Method not allowed: this MCP endpoint is stateless, use POST" },
+        id: null,
+    });
+}
+//# sourceMappingURL=mcp-handler.js.map

package/dist/http/mcp-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-handler.js","sourceRoot":"","sources":["../../src/http/mcp-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAI5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;GAMG;AAEH;;;;;;;GAOG;AACH,MAAM,gBAAiB,SAAQ,UAAU;IAC9B,KAAK,CAAC,YAAY;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,iFAAiF;YACjF,0DAA0D,CAC7D,CAAC;IACJ,CAAC;CACF;AAQD,SAAS,YAAY,CAAC,GAAa,EAAE,GAAiB;IACpD,GAAG;SACA,MAAM,CAAC,GAAG,CAAC;SACX,GAAG,CACF,kBAAkB,EAClB,6BAA6B,GAAG,CAAC,aAAa,mEAAmE,CAClH;SACA,IAAI,CAAC;QACJ,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE;QAClF,EAAE,EAAE,IAAI;KACT,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAoB;IACvD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAEnC,OAAO,KAAK,UAAU,aAAa,CAAC,GAAY,EAAE,GAAa;QAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAEzB,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC;YAClC,OAAO,EAAE,UAAU,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,EAAE;YAC7D,WAAW,EAAE,EAAE,aAAa,EAAE,UAAU,QAAQ,EAAE,EAAE;YACpD,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;YAChC,SAAS,EAAE,mBAAmB,OAAO,EAAE;SACxC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE;YACzC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE;gBAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,QAAQ,EAAE,KAAK,CAAC,EAAE;gBAClB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAC;SACL,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACvC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE;oBACzD,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;gBAC9B,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,GAAa;IAC1D,GAAG;SACA,MAAM,CAAC,GAAG,CAAC;SACX,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;SACpB,IAAI,CAAC;QACJ,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,8DAA8D,EAAE;QAChG,EAAE,EAAE,IAAI;KACT,CAAC,CAAC;AACP,CAAC"}

package/dist/http/metadata.d.ts

@@ -0,0 +1,6 @@
+import type { HostedConfig } from "./config.js";
+/** RFC 9728 protected resource metadata. */
+export declare function protectedResourceMetadata(cfg: HostedConfig): Record<string, unknown>;
+/** RFC 8414 authorization server metadata (also served as openid-configuration). */
+export declare function authorizationServerMetadata(cfg: HostedConfig): Record<string, unknown>;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/http/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/http/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQhD,4CAA4C;AAC5C,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASpF;AAED,oFAAoF;AACpF,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAatF"}

package/dist/http/metadata.js

@@ -0,0 +1,32 @@
+import { CANONICAL_SCOPES } from "./oauth.js";
+// Docs live on the console; the origin is derived per environment from the
+// hosted config's public base when available, with the production console as
+// the default for published builds (customers use prod).
+const DOCS_URL = `${(process.env.RUNBIOS_PLATFORM_ORIGIN || process.env.BIOS_PLATFORM_ORIGIN || "https://platform-dev.runbios.ai").replace(/\/$/, "")}/docs/mcp`;
+/** RFC 9728 protected resource metadata. */
+export function protectedResourceMetadata(cfg) {
+    return {
+        resource: `${cfg.publicBaseUrl}${cfg.publicMcpPath}`,
+        authorization_servers: [cfg.publicBaseUrl],
+        scopes_supported: [...CANONICAL_SCOPES],
+        bearer_methods_supported: ["header"],
+        resource_name: "Run BiOS",
+        resource_documentation: DOCS_URL,
+    };
+}
+/** RFC 8414 authorization server metadata (also served as openid-configuration). */
+export function authorizationServerMetadata(cfg) {
+    return {
+        issuer: cfg.publicBaseUrl,
+        authorization_endpoint: `${cfg.publicBaseUrl}/mcp/oauth/authorize`,
+        token_endpoint: `${cfg.publicBaseUrl}/mcp/oauth/token`,
+        registration_endpoint: `${cfg.publicBaseUrl}/mcp/oauth/register`,
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["none", "client_secret_basic", "client_secret_post"],
+        scopes_supported: [...CANONICAL_SCOPES],
+        service_documentation: DOCS_URL,
+    };
+}
+//# sourceMappingURL=metadata.js.map

package/dist/http/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/http/metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,2EAA2E;AAC3E,6EAA6E;AAC7E,yDAAyD;AACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,iCAAiC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC;AAEjK,4CAA4C;AAC5C,MAAM,UAAU,yBAAyB,CAAC,GAAiB;IACzD,OAAO;QACL,QAAQ,EAAE,GAAG,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,EAAE;QACpD,qBAAqB,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;QAC1C,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACvC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,aAAa,EAAE,UAAU;QACzB,sBAAsB,EAAE,QAAQ;KACjC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CAAC,GAAiB;IAC3D,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,aAAa;QACzB,sBAAsB,EAAE,GAAG,GAAG,CAAC,aAAa,sBAAsB;QAClE,cAAc,EAAE,GAAG,GAAG,CAAC,aAAa,kBAAkB;QACtD,qBAAqB,EAAE,GAAG,GAAG,CAAC,aAAa,qBAAqB;QAChE,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,CAAC;QAC5F,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACvC,qBAAqB,EAAE,QAAQ;KAChC,CAAC;AACJ,CAAC"}

package/dist/http/oauth.d.ts

@@ -0,0 +1,56 @@
+import { Router } from "express";
+import type { AuditEmitter } from "./audit.js";
+import type { HostedConfig } from "./config.js";
+import type { McpStore, OAuthGrantRow, OAuthTokenRow } from "./store.js";
+export declare const CANONICAL_SCOPES: readonly ["models:read", "datasets:read", "datasets:write", "training:read", "training:write", "deployments:read", "deployments:write", "billing:read", "analytics:read", "integrations:read", "integrations:write", "serverless"];
+/**
+ * Validates a scope list: non-empty, every scope canonical, no duplicates.
+ * Returns the scopes in catalog order (deterministic, like the Go side), or
+ * null when invalid.
+ */
+export declare function normalizeScopes(scopes: unknown): string[] | null;
+/** Splits a space-separated scope parameter (RFC 6749 §3.3). */
+export declare function parseScopeParam(scope: string): string[];
+export declare function sha256Hex(value: string): string;
+/** Constant-time string equality (hash both sides to normalize length). */
+export declare function timingSafeEqualStr(a: string, b: string): boolean;
+export declare function newRawToken(prefix: string): string;
+export declare function newId(prefix: string): string;
+export declare function verifyPkceS256(codeVerifier: string, codeChallenge: string): boolean;
+/**
+ * Registered redirect URIs must be https, or http with a loopback hostname
+ * (localhost / 127.0.0.1) for native clients, and must not carry a fragment.
+ */
+export declare function isValidRedirectUri(uri: string): boolean;
+export declare const ACCESS_TOKEN_TTL_S = 3600;
+export declare const REFRESH_TOKEN_TTL_MS: number;
+export declare const AUTH_CODE_TTL_MS: number;
+export declare const AUTH_REQUEST_TTL_MS: number;
+export interface ValidatedAccess {
+    token: OAuthTokenRow;
+    grant: OAuthGrantRow;
+}
+export declare function validateAccessToken(store: McpStore, rawToken: string): Promise<ValidatedAccess | null>;
+export interface IssuedPair {
+    accessToken: string;
+    refreshToken: string;
+    refreshTokenHash: string;
+}
+export declare function issueTokenPair(store: McpStore, grantId: string, familyId?: string): Promise<IssuedPair>;
+export declare class SlidingWindowLimiter {
+    private readonly limit;
+    private readonly windowMs;
+    private readonly now;
+    private readonly hits;
+    constructor(limit: number, windowMs: number, now?: () => number);
+    allow(key: string): boolean;
+}
+export interface OAuthRouterDeps {
+    store: McpStore;
+    cfg: HostedConfig;
+    audit: AuditEmitter;
+    registerLimiter?: SlidingWindowLimiter;
+    tokenLimiter?: SlidingWindowLimiter;
+}
+export declare function createOAuthRouter(deps: OAuthRouterDeps): Router;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/http/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/http/oauth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAkB,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIzF,eAAO,MAAM,gBAAgB,oOAiBnB,CAAC;AAIX;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAUhE;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvD;AAID,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAIhE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE5C;AAMD,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAInF;AAID;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAcvD;AAID,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,oBAAoB,QAAqB,CAAC;AACvD,eAAO,MAAM,gBAAgB,QAAc,CAAC;AAC5C,eAAO,MAAM,mBAAmB,QAAc,CAAC;AAI/C,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,aAAa,CAAC;CACtB;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAUjC;AAID,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,QAAQ,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAAqB,GAC9B,OAAO,CAAC,UAAU,CAAC,CAoBrB;AAID,qBAAa,oBAAoB;IAI7B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;gBAGjC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB;IAG/C,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;CAiB5B;AAID,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,YAAY,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC;AAyFD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAwS/D"}