/**
 * Authentication overview for the root landing page.
 *
 * This lives at the top level of `/` so agents and humans can see every
 * credential path Neotoma accepts in one place, instead of burying auth
 * guidance inside the MCP panel. MCP and HTTP share the same tiers; CLI adds
 * a local/offline default.
 */
const OAUTH_TIER = {
    id: "oauth",
    label: "OAuth (recommended for agents)",
    summary: "Standard MCP OAuth 2.1 flow with PKCE. The MCP client negotiates tokens against /.well-known/oauth-authorization-server and attaches a Bearer token on every request.",
    whenToUse: "Use for hosted Neotoma instances (sandbox, personal, prod) from Cursor, Claude Code, Claude Desktop, ChatGPT, Codex, or OpenCaw.",
    verify: {
        format: "http",
        command: "GET /.well-known/oauth-protected-resource",
    },
    note: "Once authorized, `session.attribution.tier` is `software` or `hardware` per the token's key algorithm.",
};
const BEARER_TIER = {
    id: "bearer",
    label: "Bearer token (Personal Access Token)",
    summary: "Send `Authorization: Bearer <token>` on HTTP or MCP requests. Tokens are issued from the Inspector's Settings page and scoped to a single user.",
    whenToUse: "Use for CI, scripts, or MCP clients that cannot complete an OAuth flow. Keep the token out of version control and repo-local logs.",
    verify: {
        format: "bash",
        command: "curl -sH 'Authorization: Bearer $NEOTOMA_TOKEN' $BASE/me | jq .",
    },
};
const AAUTH_TIER = {
    id: "aauth",
    label: "AAuth (trusted agent writes)",
    summary: "RFC 9421 HTTP Message Signatures plus an `aa-agent+jwt` agent token. Verified requests earn a `software`/`hardware` trust badge and stable agent identity in provenance.",
    whenToUse: "Use for agent-to-agent (A2A) traffic, unattended ingestion pipelines, and any workflow where audit attribution must survive token rotation.",
    verify: {
        format: "bash",
        command: "neotoma auth session",
    },
    note: "AAuth is a signed-client identity path, not a bearer-token wrapper. Neotoma uses verified AAuth identity for trusted write attribution while OAuth and bearer tokens remain available as separate user-auth options.",
    details: [
        "Stable agent identity derived from the request's public-key thumbprint, plus the JWT's issuer and subject; falls back to `clientInfo.name` + `clientInfo.version` (rendered as `unverified_client`) when AAuth is absent.",
        "Trust tiers: `hardware` for ES256 / EdDSA keys, `software` for other algorithms, `unverified_client` for clientInfo-only callers, and `anonymous` for unidentified requests.",
        "Honoured uniformly on `/mcp`, direct write routes (`/store`, `/observations/create`, `/create_relationship`, `/correct`), and `/session` — the same identity threads into write-path provenance regardless of transport (HTTP `/mcp`, MCP stdio, CLI-over-MCP, or CLI-over-HTTP).",
        "Eligibility flag: `attribution.eligible_for_trusted_writes` on `/session` (and `attribution.tier`, `attribution.decision` for diagnostics) tells the caller whether the resolved identity is trusted before any write attempt.",
        "Preflight pattern: call `get_session_identity` (MCP) or `GET /session` from a new client / proxy and verify the tier resolved to `software` or `hardware` before enabling writes — sign deliberately, never spoof another agent's thumbprint or `clientInfo`.",
    ],
};
const PUBLIC_TIER = {
    id: "public",
    label: "Public discovery (unauthenticated)",
    summary: "`/`, `/health`, `/server-info`, `/openapi.yaml`, `/openapi_actions.yaml`, `/.well-known/*`, and (sandbox-only) `/sandbox/terms` are world-readable.",
    whenToUse: "Use for service discovery, uptime probes, marketing integrations, and sandbox exploration before pointing a harness at the server.",
    note: "Writes and entity reads still require an authenticated path — only discovery / liveness surfaces are anonymous.",
};
const INTROSPECTION_ENDPOINTS = [
    {
        method: "GET",
        path: "/me",
        description: "Authenticated user profile (returns 401 when the caller is anonymous).",
    },
    {
        method: "GET",
        path: "/session",
        description: "Full session + attribution block: OAuth scopes, AAuth thumbprint/tier, and `eligible_for_trusted_writes`.",
    },
];
const CAVEAT_BY_MODE = {
    sandbox: "Sandbox accepts anonymous MCP reads for demo flows and resets every Sunday 00:00 UTC. Writes still require OAuth, Bearer, or AAuth.",
    personal: "All writes and entity reads on this instance require OAuth, Bearer, or AAuth. Only discovery documents and health probes are anonymous.",
    prod: "All writes and entity reads on this instance require OAuth, Bearer, or AAuth. Only discovery documents and health probes are anonymous.",
    local: "Local dev trusts loopback for discovery; writes still resolve through the same OAuth/Bearer/AAuth tiers as hosted instances.",
};
export function buildAuthOverviewForMode(mode) {
    return {
        title: "Authentication",
        intro: "Neotoma uses the same credential tiers for MCP, HTTP, and the CLI. Pick the tier that matches your runtime; every write lands in provenance tagged by the resolved tier.",
        modeCaveat: CAVEAT_BY_MODE[mode],
        tiers: [OAUTH_TIER, BEARER_TIER, AAUTH_TIER, PUBLIC_TIER],
        introspection: {
            heading: "Verify your identity",
            endpoints: INTROSPECTION_ENDPOINTS,
        },
        links: [],
    };
}
//# sourceMappingURL=auth_overview.js.map