toolroll 0.9.45 → 0.9.47

package/dist/flow-live.js

@@ -2,9 +2,9 @@
  * The live canvas (v88): a flow open in several browsers stays the same in
  * all of them, and each shows who else has it open.
  *
- * - A change nudge. While anyone has a flow open, one cheap query a second
- *   reads the flow's fingerprint (its revision, cards, moves, comments,
- *   watchers, step runs and triggers); when it changes, every open page
+ * - A change nudge. While anyone has a flow open, a small read each second
+ *   checks the flow's fingerprint (its revision, cards, moves, comments,
+ *   watchers, step runs, linked task progress and triggers); when it changes, every open page
  *   hears "change" and reads the flow again the usual way. The nudge
  *   carries no card data: what a page shows is always what its own read
  *   returned, under its own checks.
@@ -20,17 +20,78 @@ const TICK_MS = 1_000;
 const CHECK_EVERY = 15;
 const HEARTBEAT_EVERY = 15;
 const PRESENCE_SETTLE_MS = 150;
-/** What changes when anything on the canvas changes: one row, one read, kept short and opaque. */
-export function flowFingerprint(store, flow) {
-    const row = store.handle.prepare(`SELECT f.state || '|' || f.revision || '|' || f.updated_at || '|' || coalesce(f.owner, '') AS head,
+// Statements belong to their database, without keeping closed Stores alive.
+const fingerprintStatements = new WeakMap();
+function fingerprintStatement(store) {
+    const cached = fingerprintStatements.get(store.handle);
+    if (cached !== undefined)
+        return cached;
+    // Match Store.taskFamilyOf/taskFamilyProjection: built-in tasks, same-repo
+    // edges, a revision brief bound to the parent's run, and at most 63 edges.
+    // Walk up only from active cards, then down from their proven roots. A
+    // missing/invalid/cyclic/over-depth ancestry leaves the linked task alone.
+    const statement = store.handle.prepare(`WITH RECURSIVE linked AS MATERIALIZED (
+      SELECT DISTINCT tr.id AS ref_id, tr.external_id AS id, tr.repo, tr.revision_of, tr.revision_brief_artifact
+      FROM flow_card c JOIN task_ref tr ON tr.external_id = c.task AND tr.backend = 'built-in'
+      JOIN task t ON t.id = tr.external_id
+      WHERE c.flow = $flow AND c.state = 'active' AND tr.repo IS NOT NULL
+    ), ancestors(linked_ref, ref_id, id, repo, revision_of, revision_brief_artifact, depth) AS (
+      SELECT ref_id, ref_id, id, repo, revision_of, revision_brief_artifact, 0 FROM linked
+      UNION ALL
+      SELECT child.linked_ref, parent.id, parent.external_id, parent.repo, parent.revision_of, parent.revision_brief_artifact, child.depth + 1
+      FROM ancestors child
+      JOIN task_ref parent ON parent.backend = 'built-in' AND parent.external_id = child.revision_of AND parent.repo IS child.repo
+      JOIN task t ON t.id = parent.external_id
+      JOIN artifact brief ON brief.id = child.revision_brief_artifact AND brief.kind = 'revision-brief'
+      JOIN run source_run ON source_run.id = brief.run AND source_run.task_ref = parent.id
+      WHERE child.depth < 63
+    ), roots AS MATERIALIZED (
+      SELECT DISTINCT ref_id, id, repo FROM ancestors WHERE revision_of IS NULL
+    ), descendants(ref_id, id, repo, depth) AS (
+      SELECT ref_id, id, repo, 0 FROM roots
+      UNION ALL
+      SELECT child.id, child.external_id, child.repo, parent.depth + 1 FROM descendants parent
+      JOIN task_ref child ON child.backend = 'built-in' AND child.revision_of = parent.id AND child.repo IS parent.repo
+      JOIN task t ON t.id = child.external_id
+      JOIN artifact brief ON brief.id = child.revision_brief_artifact AND brief.kind = 'revision-brief'
+      JOIN run source_run ON source_run.id = brief.run AND source_run.task_ref = parent.ref_id
+      WHERE parent.depth < 63
+    ), members AS (
+      SELECT ref_id FROM descendants
+      UNION
+      SELECT ref_id FROM linked WHERE NOT EXISTS (
+        SELECT 1 FROM ancestors WHERE linked_ref = linked.ref_id AND revision_of IS NULL
+      )
+    ) SELECT f.state || '|' || f.revision || '|' || f.updated_at || '|' || coalesce(f.owner, '') AS head,
     (SELECT count(*) || ':' || coalesce(max(updated_at), '') FROM flow_card WHERE flow = f.id) AS cards,
     (SELECT coalesce(max(e.id), 0) FROM flow_event e JOIN flow_card c ON c.id = e.card WHERE c.flow = f.id) AS moves,
     (SELECT coalesce(max(m.id), 0) FROM flow_comment m JOIN flow_card c ON c.id = m.card WHERE c.flow = f.id) AS comments,
     (SELECT count(*) || ':' || coalesce(max(w.added_at), '') FROM flow_card_watcher w JOIN flow_card c ON c.id = w.card WHERE c.flow = f.id) AS watchers,
     (SELECT count(*) || ':' || coalesce(sum(r.attempts), 0) || ':' || coalesce(max(coalesce(r.finished_at, r.started_at)), '') || ':' || coalesce(sum(r.state = 'running'), 0)
        FROM flow_step_run r JOIN flow_card c ON c.id = r.card WHERE c.flow = f.id) AS runs,
-    (SELECT count(*) || ':' || coalesce(max(updated_at), '') || ':' || coalesce(max(last_at), '') || ':' || coalesce(sum(failures), 0) FROM flow_trigger WHERE flow = f.id) AS triggers
-    FROM flow f WHERE f.id = ?`).get(flow);
+    (SELECT count(*) || ':' || coalesce(max(updated_at), '') || ':' || coalesce(max(last_at), '') || ':' || coalesce(sum(failures), 0) FROM flow_trigger WHERE flow = f.id) AS triggers,
+    (SELECT json_group_array(json_array(tr.id, t.id, t.state, t.updated_at, tr.plan,
+       s.digest, s.approved_digest, s.approved_at,
+       (SELECT max(p.id) FROM run_checkpoint p WHERE p.task_ref = tr.id),
+       (SELECT q.lease_id FROM claim q WHERE q.task_ref = tr.id AND q.released_at IS NULL AND q.expires_at > $now ORDER BY q.lease_generation DESC LIMIT 1),
+       (SELECT json_group_array(json_array(r.id, r.outcome, r.finished_at, r.reason,
+          (SELECT json_array(k.status, k.exit_code, k.updated_at) FROM run_check k WHERE k.run = r.id)) ORDER BY r.id) FROM run r WHERE r.task_ref = tr.id),
+       (SELECT json_group_array(json_array(d.id, d.state, d.question, d.answered_at) ORDER BY d.id) FROM decision d JOIN run r ON r.id = d.run WHERE r.task_ref = tr.id),
+       (SELECT json_group_array(json_array(h.id, h.reason) ORDER BY h.id) FROM hold h WHERE h.task_ref = tr.id AND (h.until IS NULL OR h.until > $now)),
+       (SELECT max(a.id) FROM action_ledger a WHERE a.task_id = t.id)) ORDER BY tr.id)
+     FROM task_ref tr JOIN task t ON t.id = tr.external_id
+     LEFT JOIN task_scope s ON s.task_id = t.id
+     WHERE tr.id IN (SELECT ref_id FROM members)) AS tasks
+    FROM flow f WHERE f.id = $flow`);
+    fingerprintStatements.set(store.handle, statement);
+    return statement;
+}
+/** What changes when anything on the canvas changes: metadata only, kept short and opaque. */
+export function flowFingerprint(store, flow, now = new Date()) {
+    // A revision can progress while its card still links to the original task,
+    // including a build in another project. The page read admits the viewer;
+    // this stream only carries a hash. No evidence files or logs are read.
+    const row = fingerprintStatement(store).get({ $flow: flow, $now: now.toISOString() });
     return row === undefined ? null : createHash("sha256").update(Object.values(row).map(String).join("|")).digest("hex").slice(0, 16);
 }
 export function createFlowRooms(fingerprint, tickMs = TICK_MS) {

package/dist/flows-ui.js

@@ -14,6 +14,8 @@ import { mailboxReady } from "./mailbox.js";
 import { labelOf, nameOf } from "./teammate-admin.js";
 import { callWords, receiptWords } from "./teammate-tools.js";
 import { undoFor } from "./teammate-week.js";
+import { flowCardTaskLine } from "./flow-card-task.js";
+import { readFlowSecrets } from "./flow-secrets.js";
 const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 const projectName = (repo) => repo.split(/[\\/]/).filter(Boolean).pop() ?? repo;
 export const FLOWS_CSS = `.flows{max-width:880px;min-width:0}.flows .card{padding:16px 18px;margin:12px 0}.flows .flow-row{display:flex;justify-content:space-between;align-items:baseline;gap:12px;flex-wrap:wrap}.flows .flow-row h2{font-size:1.05rem;margin:0}.flows .flow-counts{font-size:.85rem;color:var(--so-muted)}.flows form{display:grid;gap:10px;margin:0}.flows label{display:grid;gap:6px}.flows input,.flows select{box-sizing:border-box;width:100%;max-width:100%}.flows button{justify-self:start;min-height:44px}.flows .flow-fallback ol{padding-left:20px}.flows summary{cursor:pointer;min-height:44px;display:flex;align-items:center;font-weight:600}.flows .flow-buttons{display:flex;flex-wrap:wrap;align-items:center;gap:8px;margin:10px 0 0}.flows .flow-import{margin-top:18px;padding-top:14px;border-top:1px solid var(--so-line)}.flows .flow-import h3{font-size:.95rem;margin:0}.flows .flow-terms{list-style:none;padding:0;margin:8px 0 16px;display:grid;gap:10px}.flows .flow-terms li{white-space:pre-line;overflow-wrap:anywhere}.flows .flow-terms pre{white-space:pre-wrap;overflow-wrap:anywhere;font-size:.8rem;margin:6px 0 0}.flows .flow-import-preview h2{font-size:1rem;margin:20px 0 4px}.flows .flow-untrusted{font-weight:600}.flows button.primary{background:var(--primary);color:var(--primary-foreground);border-color:var(--primary)}.flows fieldset{border:0;padding:0;margin:0;display:grid;gap:10px;min-width:0}.flows legend{font-weight:600;padding:0;margin-bottom:6px}.flows textarea[hidden]{display:none}.flows button.secondary{background:transparent;color:var(--foreground);border:1px solid var(--border)}@media(max-width:600px){.flows input,.flows select{font-size:16px}}@media(max-width:760px){.flows .card{padding:10px 12px;margin:8px 0;position:relative}.flows .flow-row{row-gap:2px}.flows .flow-row h2 a::after{content:"";position:absolute;inset:0;border-radius:inherit}.flows .flow-counts{line-height:1.35}}`;
@@ -84,9 +86,19 @@ export function flowView(store, flow, viewer, selectedCard, setup = { dir: null,
     const sortZones = new Set(stages.filter(one => one.kind === "sort").map(one => one.id));
     const decisions = sortZones.size === 0 ? new Map() : store.flowSortDecisions(flow.id);
     const mates = new Map(store.teammates([flow.repo]).map(one => [one.id, one]));
+    const taskSecrets = new Map();
+    const secretsFor = (repo) => {
+        if (!taskSecrets.has(repo))
+            taskSecrets.set(repo, Object.values(readFlowSecrets(setup.dir, repo)));
+        return taskSecrets.get(repo);
+    };
+    const now = new Date();
     const cards = store.flowCards(flow.id, true).filter(card => card.state === "active" || Date.now() - Date.parse(card.updatedAt) < 7 * 86_400_000).map((card) => {
         const stage = stages.find(one => one.id === card.stage);
         const task = card.task ?? card.primaryTask;
+        // Build zones may file into another project; the flow alone does not admit its task's detail.
+        const taskRepo = card.task === null ? null : store.lookupRef(card.task)?.repo ?? null;
+        const canReadTask = taskRepo !== null && (taskRepo === flow.repo || (setup.repos.includes(taskRepo) && store.accountCanAccess(viewer.name, taskRepo)));
         const discussion = store.flowComments(card.id);
         const watchers = store.flowCardWatchers(card.id);
         const decider = stage?.kind === "approval" ? deciderOf(stage, flow) : null;
@@ -136,7 +148,9 @@ export function flowView(store, flow, viewer, selectedCard, setup = { dir: null,
             ...(content.items === undefined ? {} : { items: content.items.map((item, index) => ({ number: index + 1, title: item.title, lines: whyLines(item.why), source: item.source, url: item.url,
                     image: item.shot === null || content.shots === null ? null : { src: `/r/${content.shots.run}/evidence/${item.shot}`, caption: itemCaption(index + 1, item) } })) }) });
         return {
-            id: card.id, title: card.title, description: card.description, stage: card.stage, state: card.state, waiting: card.waiting,
+            id: card.id, title: card.title, description: card.description, stage: card.stage, state: card.state,
+            waiting: card.state === "active" && card.task !== null && (stage?.kind === "task" || stage?.kind === "report")
+                ? canReadTask ? flowCardTaskLine(store, card.task, taskRepo, now, secretsFor(taskRepo)) : "Task unavailable" : card.waiting,
             task: task === null ? null : { id: task, href: `/t/${encodeURIComponent(task)}` },
             createdBy: card.createdBy, updatedAt: card.updatedAt,
             canDecide,

package/dist/live.d.ts

@@ -25,6 +25,20 @@ export declare function liveDir(root: string): string;
 /** The exact filename, from the numeric id and nothing else — no user
  * input is ever parsed into this path. */
 export declare function liveLogPath(root: string, runId: number): string;
+/**
+ * The fixed tool vocabulary. Known harness tools map to OUR kinds and
+ * phrases; anything unrecognized gets the generic one. The tool's own
+ * name, arguments, and metadata never reach the file: a tool named after
+ * a secret stays unspoken.
+ */
+export type LiveActivityKind = "session" | "message" | "edit" | "command" | "read" | "search" | "lookup" | "plan" | "delegate" | "tool";
+export declare const LIVE_ACTIVITY_KINDS: readonly LiveActivityKind[];
+/**
+ * What one stream event says the agent just did, as one fixed kind: the
+ * last-activity line's only input. Never text, names or arguments; an
+ * event that says nothing (results, deltas, subagent chatter) is null.
+ */
+export declare function liveActivityKind(event: Record<string, unknown>): LiveActivityKind | null;
 /**
  * One stream event → zero or more display lines, in the fixed vocabulary.
  * Assistant TEXT is the agent's own words (sanitized below); tool use is a

package/dist/live.js

@@ -32,28 +32,77 @@ export function liveDir(root) {
 export function liveLogPath(root, runId) {
     return join(liveDir(root), `${Math.trunc(runId)}.log`);
 }
+export const LIVE_ACTIVITY_KINDS = ["session", "message", "edit", "command", "read", "search", "lookup", "plan", "delegate", "tool"];
+const TOOL_KINDS = new Map([
+    ["Edit", "edit"],
+    ["Write", "edit"],
+    ["MultiEdit", "edit"],
+    ["NotebookEdit", "edit"],
+    ["Bash", "command"],
+    ["Read", "read"],
+    ["Glob", "search"],
+    ["Grep", "search"],
+    ["LS", "read"],
+    ["WebFetch", "lookup"],
+    ["WebSearch", "lookup"],
+    ["TodoWrite", "plan"],
+    ["Task", "delegate"],
+]);
+const KIND_HEADLINES = {
+    session: "the agent session started",
+    message: "",
+    edit: "→ editing files",
+    command: "→ running a command",
+    read: "→ reading the code",
+    search: "→ searching the code",
+    lookup: "→ looking something up",
+    plan: "→ organizing its plan",
+    delegate: "→ delegating to a helper",
+    tool: "→ using a tool",
+};
+const toolKind = (name) => TOOL_KINDS.get(typeof name === "string" ? name : "") ?? "tool";
 /**
- * The fixed tool-headline vocabulary. Known harness tools map to OUR
- * phrases; anything unrecognized gets the generic line. The tool's own
- * name, arguments, and metadata never reach the file: a tool named after
- * a secret stays unspoken.
+ * What one stream event says the agent just did, as one fixed kind: the
+ * last-activity line's only input. Never text, names or arguments; an
+ * event that says nothing (results, deltas, subagent chatter) is null.
  */
-const TOOL_HEADLINES = new Map([
-    ["Edit", "→ editing files"],
-    ["Write", "→ editing files"],
-    ["MultiEdit", "→ editing files"],
-    ["NotebookEdit", "→ editing files"],
-    ["Bash", "→ running a command"],
-    ["Read", "→ reading the code"],
-    ["Glob", "→ searching the code"],
-    ["Grep", "→ searching the code"],
-    ["LS", "→ reading the code"],
-    ["WebFetch", "→ looking something up"],
-    ["WebSearch", "→ looking something up"],
-    ["TodoWrite", "→ organizing its plan"],
-    ["Task", "→ delegating to a helper"],
-]);
-const TOOL_HEADLINE_GENERIC = "→ using a tool";
+export function liveActivityKind(event) {
+    try {
+        const type = String(event["type"] ?? "");
+        if ((type === "system" && String(event["subtype"] ?? "") === "init") || type === "thread.started" || type === "init")
+            return "session";
+        if (type === "item.completed") {
+            const item = event["item"];
+            const kind = item === undefined || item === null ? "" : String(item["type"] ?? "");
+            return kind === "agent_message" ? "message" : kind === "command_execution" ? "command" : kind === "file_change" ? "edit" : kind === "web_search" ? "lookup" : null;
+        }
+        if (type === "message")
+            return String(event["role"] ?? "") === "assistant" && event["delta"] !== true ? "message" : null;
+        if (type === "tool_call" || type === "tool_use")
+            return toolKind(event["name"] ?? event["tool"]?.["name"]);
+        if (type !== "assistant")
+            return null;
+        const parent = event["parent_tool_use_id"];
+        if (parent !== undefined && parent !== null)
+            return null;
+        const content = event["message"]?.["content"];
+        if (!Array.isArray(content))
+            return null;
+        let last = null;
+        for (const block of content) {
+            if (block === null || typeof block !== "object")
+                continue;
+            if (block["type"] === "tool_use")
+                last = toolKind(block["name"]);
+            else if (block["type"] === "text" && typeof block["text"] === "string" && block["text"].trim() !== "")
+                last = "message";
+        }
+        return last;
+    }
+    catch {
+        return null;
+    }
+}
 /** Strip ANSI escapes and every control character; tabs become spaces. */
 function stripControls(text) {
     return text
@@ -108,7 +157,7 @@ export function renderTranscriptLines(event) {
     }
     if (type === "tool_call" || type === "tool_use") {
         const name = event["name"] ?? event["tool"]?.["name"];
-        return [TOOL_HEADLINES.get(typeof name === "string" ? name : "") ?? TOOL_HEADLINE_GENERIC];
+        return [KIND_HEADLINES[toolKind(name)]];
     }
     if (type !== "assistant")
         return [];
@@ -136,7 +185,7 @@ export function renderTranscriptLines(event) {
         }
         else if (kind === "tool_use") {
             const name = block["name"];
-            lines.push(TOOL_HEADLINES.get(typeof name === "string" ? name : "") ?? TOOL_HEADLINE_GENERIC);
+            lines.push(KIND_HEADLINES[toolKind(name)]);
         }
     }
     return lines;

package/dist/mcp-http.d.ts

@@ -11,7 +11,8 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Store } from "./store.js";
-import { type RunOperateAs } from "./mcp-person.js";
+import { type Person, type RunOperateAs } from "./mcp-person.js";
+import { type Admission } from "./request-budget.js";
 export type McpHttpOptions = {
     store: Store;
     clock: () => Date;
@@ -20,7 +21,11 @@ export type McpHttpOptions = {
     evidenceRoot?: string;
     /** The console's own sign-in for an `so_` bearer: the address's tries, expiry, revocation, a removed account. */
     signedIn: (request: IncomingMessage) => boolean;
+    /** Where an MCP client finds how to sign in (mcp-oauth.ts), named on a 401; null when this address offers none. */
+    resourceMetadata?: (request: IncomingMessage) => string | null;
     /** Runs a person's command on the server (operate.ts); resolved from operate.ts when not injected. */
     runAs?: RunOperateAs;
+    /** A person token's request budget (request-budget.ts), charged once per request before its body is read. */
+    admit?: (person: Person) => Admission;
 };
 export declare function createMcpHttp(options: McpHttpOptions): (request: IncomingMessage, response: ServerResponse) => Promise<void>;

package/dist/mcp-http.js

@@ -10,10 +10,12 @@
  * Host check runs before this route. A revoked or expired token answers 401 on its next request.
  */
 import { PACKAGE_VERSION } from "./version.js";
-import { parseApiToken, secretMatches } from "./api-tokens.js";
+import { parseApiToken, secretMatches, tokenLive, tokenProjects } from "./api-tokens.js";
+import { oauthProjects, oauthTokenAllowed, RESOURCE_PATH } from "./mcp-oauth.js";
 import { authenticateCoordinator } from "./coordinator.js";
 import { LEGACY, MAX_REQUEST, META_CAPABILITIES, META_SERVER, META_VERSION, MODERN, TOOLS, UNSUPPORTED_VERSION, callCoordinatorTool, capabilitiesShape, readMessage, shapeResult, toolsPayload, } from "./mcp-core.js";
 import { callPersonTool, personTools } from "./mcp-person.js";
+import { limitWords } from "./request-budget.js";
 /** The most decisions a coordinator credential is remembered to have read (propose_answer needs one). */
 const READ_DECISIONS_KEPT = 200;
 export function createMcpHttp(options) {
@@ -38,15 +40,20 @@ export function createMcpHttp(options) {
             // The secret is checked here too, so this door never rests on how signedIn reads the request.
             if (parsed === null || kept === null || !secretMatches(parsed.secret, kept.secretHash))
                 return null;
-            if (kept.row.revokedAt !== null || Date.parse(kept.row.expiresAt) <= options.clock().getTime())
+            if (!tokenLive(kept.row, options.clock().getTime()))
                 return null;
             const account = store.accountOf(kept.row.account);
             if (account === null || account.revokedAt !== null)
                 return null;
+            // An MCP sign-in's token: only while its access is fresh, and only in the projects the person chose (mcp-oauth.ts).
+            if (!oauthTokenAllowed(store, kept.row.id, RESOURCE_PATH, options.clock()))
+                return null;
+            const granted = oauthProjects(store, kept.row.id);
+            const projects = tokenProjects(tokenProjects(account.projects, kept.row.projects), granted);
             return {
                 kind: "person",
                 person: {
-                    principal: { kind: "person", account: kept.row.account, generation: account.generation, scope: kept.row.access, tokenId: kept.row.id, projects: account.projects === null ? null : [...account.projects] },
+                    principal: { kind: "person", account: kept.row.account, generation: account.generation, scope: kept.row.access, tokenId: kept.row.id, projects },
                     role: account.role,
                     tokenName: kept.row.name,
                 },
@@ -100,7 +107,18 @@ export function createMcpHttp(options) {
             return refuse(response, 403, "browser requests are refused — connect an MCP client with your API token");
         const caller = callerOf(request);
         if (caller === null) {
-            return refuse(response, 401, "sign in with your API token (Authorization: Bearer so_…) or a coordinator credential — passwords and cookies are not accepted here", { "www-authenticate": 'Bearer realm="toolroll-mcp"' });
+            const metadata = options.resourceMetadata?.(request) ?? null;
+            return refuse(response, 401, "sign in with your API token (Authorization: Bearer so_…) or a coordinator credential — passwords and cookies are not accepted here", { "www-authenticate": `Bearer realm="toolroll-mcp"${metadata === null ? "" : `, resource_metadata="${metadata}"`}` });
+        }
+        // A person's token is counted once per request, notifications included; a coordinator keeps its own proposal limit.
+        if (caller.kind === "person" && options.admit !== undefined) {
+            const admitted = options.admit(caller.person);
+            if (!admitted.ok && admitted.status === 503)
+                return refuse(response, 503, "request limits could not be checked; nothing ran — try again shortly");
+            if (!admitted.ok) {
+                request.resume();
+                return send(response, 429, { jsonrpc: "2.0", id: null, error: { code: -32000, message: limitWords(admitted.limit, admitted.retryAfter), data: { limit: admitted.limit, retryAfter: admitted.retryAfter } } }, { "retry-after": String(admitted.retryAfter) });
+            }
         }
         if (!/^application\/json\s*(;|$)/i.test(request.headers["content-type"] ?? ""))
             return refuse(response, 415, "send the JSON-RPC message as application/json");

package/dist/mcp-oauth.d.ts

@@ -0,0 +1,82 @@
+/**
+ * MCP sign-in: OAuth 2.1 for /mcp, as the MCP authorization spec describes, so an engineer's MCP client connects
+ * without a pasted token. This console is both the authorization server and the protected resource.
+ *
+ *   /mcp's 401 names /.well-known/oauth-protected-resource/mcp (RFC 9728), which names this console's
+ *   /.well-known/oauth-authorization-server (RFC 8414). A client registers itself (RFC 7591, public clients only),
+ *   sends the person to /oauth/authorize with a S256 PKCE challenge and resource=<origin>/mcp, and trades the code
+ *   at /oauth/token for a short-lived access token and a refresh secret that rotates on every use.
+ *
+ * The person signs in with the console's own sign-in (password or identity provider, unchanged), then consents on
+ * one page: read or act, and which of their projects, confirmed with their password or a fresh provider check, the
+ * same step-up as making an API token. Nothing is granted without that form, its session CSRF value and a same-site
+ * post.
+ *
+ * A grant is an ordinary API token (api-tokens.ts): its access token is `so_<id>_<secret>`, it is listed and revoked
+ * with every other token (console Sessions & tokens, `toolroll tokens`), and /mcp runs it through the same person
+ * path. Its v113 binding (store.oauthGrant) adds what an ordinary token doesn't have: it works only at /mcp, its
+ * access secret lasts an hour, it is tied to the account generation that consented, and it reaches only the projects
+ * chosen (still intersected with the person's live access on every call). Only hashes are kept: of codes, access
+ * secrets and refresh secrets. Approvals, people and policy are never reachable: those have no tool and no scope.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { Store } from "./store.js";
+/** How long each piece lives. A code is spent at once; a grant ends after 30 days and the person consents again. */
+export declare const OAUTH_TIMES: {
+    readonly requestMs: number;
+    readonly codeMs: 60000;
+    readonly accessSeconds: 3600;
+    readonly grantDays: 30;
+};
+/** The most sign-ins waiting at once, and registered clients kept. */
+export declare const OAUTH_LIMITS: {
+    readonly requests: 200;
+    readonly requestsPerSource: 20;
+    readonly clients: 500;
+    readonly clientsPerSource: 20;
+};
+export declare const OAUTH_SCOPES: readonly ["read", "act"];
+export declare const RESOURCE_PATH = "/mcp";
+export declare const resourceMetadataUrl: (origin: string) => string;
+/**
+ * Whether an API token may sign in to this request's path now. An ordinary token: yes (its own checks are elsewhere).
+ * An MCP sign-in's token: only at /mcp, only while its access secret is fresh and the account is at the generation
+ * that consented.
+ */
+export declare function oauthTokenAllowed(store: Store, tokenId: string, path: string, now: Date): boolean;
+/** The projects an MCP sign-in's token was granted (the person's live access still applies), or null for an ordinary token. */
+export declare const oauthProjects: (store: Store, tokenId: string) => string[] | null;
+export type OAuthSession = {
+    name: string;
+    role: "approver" | "viewer";
+    csrf: string;
+    /** Signed in with an identity provider: its name, and whether it checked the person in the last ten minutes. */
+    sso: {
+        label: string;
+        fresh: boolean;
+    } | null;
+};
+export type OAuthHttpOptions = {
+    store: Store;
+    clock: () => Date;
+    /** This console's canonical origin for the request (the https public address, or this computer's loopback one); null: no sign-in here. */
+    originOf: (request: IncomingMessage) => string | null;
+    /** Trusted direct peer, or the last hop appended by the console's loopback proxy. */
+    requesterKey: (request: IncomingMessage) => string;
+    /** The browser session signed in by cookie, or null. A bearer never consents. */
+    session: (request: IncomingMessage) => OAuthSession | null;
+    /** A posted form came from a page of this console (its Origin, or Referer, names an allowed host). */
+    sameSite: (request: IncomingMessage) => boolean;
+    /** The step-up: the person's password, or (empty) a fresh identity-provider check. */
+    confirm: (session: OAuthSession, typed: string) => boolean;
+    /** The projects this person may choose: each a project the server knows that they can use now. */
+    projectsFor: (account: string) => string[];
+};
+/**
+ * A redirect a client may register: https anywhere, or http on 127.0.0.1 / [::1] (RFC 8252 §7.3), with no
+ * credentials or fragment.
+ */
+export declare function redirectAllowed(value: string): boolean;
+/** A redirect matches a registered one exactly; on a loopback http address any port does (RFC 8252 §7.3). */
+export declare function redirectMatches(presented: string, registered: readonly string[]): string | null;
+export declare function createOAuthHttp(options: OAuthHttpOptions): (request: IncomingMessage, response: ServerResponse, url: URL) => Promise<boolean>;