Function buildDefaultAuthenticator

server/src/training-agent/index.ts:174–178

* Default `/mcp` route: presence-gated signature composition. Callers with no * `Signature-Input` header fall through to bearer auth (sandbox backward * compat — unsigned AAO API keys keep working). Callers that DO present a * signature header MUST produce a valid one: malformed/invalid signature

()

 * — it only changes behavior when a caller DOES present a signature header.
 */
function buildDefaultAuthenticator(): Authenticator | null {
  const bearerAuth = buildBearerAuthenticator();
  if (!bearerAuth) return null;
  return requireSignatureWhenPresent(lazySigningAuth(), bearerAuth);
}

/**
 * Presence-gated authenticator for all `/mcp-strict*` routes. Accepts a lazy