@axiom-lattice/gateway 4.9.0 → 4.9.2

package/dist/open-UVKMONVE.mjs

@@ -1,346 +0,0 @@
-import {
-  OpenAuditService,
-  OpenCredentialService
-} from "./chunk-JUA3VJE7.mjs";
-import {
-  buildTenantOpenPlugins,
-  mergeOpenCatalog
-} from "./chunk-NPHK4SZ6.mjs";
-import {
-  deleteSession,
-  getSession,
-  registerSession
-} from "./chunk-K32XEQLH.mjs";
-import {
-  collectExposedPluginUiResources
-} from "./chunk-3XIIQ6EK.mjs";
-import {
-  ActionNotFoundError,
-  GrantDeniedError,
-  ValidationError,
-  openLattice
-} from "./chunk-HVIKCUOF.mjs";
-import "./chunk-73QZQQOT.mjs";
-import "./chunk-EXPERMZR.mjs";
-import "./chunk-NFEGQTCC.mjs";
-
-// src/routes/open.ts
-import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
-import { getStoreLattice } from "@axiom-lattice/core";
-
-// src/services/open/openRateLimiter.ts
-var OpenRateLimiter = class {
-  constructor(options = {}) {
-    this.buckets = /* @__PURE__ */ new Map();
-    this.defaultPerMinute = options.defaultPerMinute ?? 60;
-    this.agentPerMinute = options.agentPerMinute ?? 10;
-  }
-  bucketClass(domain) {
-    return domain === "agent" ? "agent" : "default";
-  }
-  limitFor(domain) {
-    return domain === "agent" ? this.agentPerMinute : this.defaultPerMinute;
-  }
-  /** Consume one token; denied calls report how long to wait. */
-  check(credentialId, domain) {
-    const limit = this.limitFor(domain);
-    const key = `${this.bucketClass(domain)}:${credentialId}`;
-    const now = Date.now();
-    const bucket = this.buckets.get(key) ?? { tokens: limit, updatedAt: now };
-    const refillPerMs = limit / 6e4;
-    const elapsed = now - bucket.updatedAt;
-    bucket.tokens = Math.min(limit, bucket.tokens + elapsed * refillPerMs);
-    bucket.updatedAt = now;
-    if (bucket.tokens >= 1) {
-      bucket.tokens -= 1;
-      this.buckets.set(key, bucket);
-      return { allowed: true };
-    }
-    this.buckets.set(key, bucket);
-    const deficit = 1 - bucket.tokens;
-    return { allowed: false, retryAfterMs: Math.ceil(deficit / refillPerMs) };
-  }
-  /** Test helper. */
-  reset() {
-    this.buckets.clear();
-  }
-};
-
-// src/services/open/openMcpServer.ts
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { randomUUID } from "crypto";
-var OPEN_MCP_SERVER_INFO = {
-  name: "axiom-open",
-  version: "0.1.0"
-};
-async function buildSessionServer(options) {
-  const { credential, catalog, invoke, uiResources } = options;
-  const server = new McpServer(OPEN_MCP_SERVER_INFO, {
-    capabilities: {
-      // The SDK has no `extensions` field; MCP App hosts discover the UI
-      // extension through `experimental`.
-      experimental: { "io.modelcontextprotocol/ui": {} }
-    }
-  });
-  for (const tool of catalog) {
-    server.registerTool(
-      tool.toolName,
-      {
-        description: tool.description,
-        inputSchema: tool.schema,
-        annotations: {
-          readOnlyHint: tool.annotations.readOnlyHint,
-          destructiveHint: tool.annotations.destructiveHint
-        },
-        ...tool.ui ? { _meta: { ui: { resourceUri: tool.ui.resourceUri } } } : {}
-      },
-      async (args) => {
-        const result = await invoke(tool.toolName, args);
-        return { content: result.content, isError: result.isError };
-      }
-    );
-  }
-  for (const [uri, res] of uiResources ?? []) {
-    const mimeType = res.mimeType ?? "text/html;profile=mcp-app";
-    server.registerResource(
-      `mcp-app:${uri}`,
-      uri,
-      {
-        mimeType,
-        ...res.csp ? { _meta: { ui: { csp: res.csp } } } : {}
-      },
-      async (u) => {
-        const { html, csp } = await res.read();
-        return {
-          contents: [
-            {
-              uri: u.href,
-              mimeType,
-              text: html,
-              ...csp ? { _meta: { ui: { csp } } } : {}
-            }
-          ]
-        };
-      }
-    );
-  }
-  const transport = new StreamableHTTPServerTransport({
-    sessionIdGenerator: () => {
-      const sessionId = randomUUID();
-      void registerSession(
-        sessionId,
-        { credentialId: credential.credentialId, kind: credential.kind },
-        { server, transport }
-      );
-      return sessionId;
-    },
-    enableJsonResponse: true,
-    onsessionclosed: (closedId) => {
-      void import("./mcpTransportRegistry-VXUVJKBC.mjs").then(
-        ({ deleteSession: deleteSession2 }) => deleteSession2(closedId)
-      );
-    }
-  });
-  return { server, transport, tools: catalog };
-}
-
-// src/routes/open.ts
-function extractBearer(request) {
-  const header = request.headers.authorization;
-  if (!header?.startsWith("Bearer ")) return void 0;
-  return header.slice("Bearer ".length).trim() || void 0;
-}
-function readSessionId(request) {
-  const raw = request.headers["mcp-session-id"];
-  const value = Array.isArray(raw) ? raw[0] : raw;
-  return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function emptyTenantPlugins() {
-  return {
-    tools: [],
-    uiResources: /* @__PURE__ */ new Map(),
-    hasTool: () => false,
-    degraded: true,
-    invoke: async (toolName) => ({
-      content: [
-        { type: "text", text: `Tenant plugin catalog unavailable for ${toolName}` }
-      ],
-      isError: true
-    })
-  };
-}
-var RPC_ERROR = {
-  GRANT_DENIED: -32001,
-  ACTION_NOT_FOUND: -32002,
-  VALIDATION_FAILED: -32003,
-  EXECUTION_ERROR: -32004,
-  RATE_LIMITED: -32005
-};
-function registerOpenRoutes(app, deps = {}) {
-  const openAuth = deps.openAuth ?? new OpenCredentialService(
-    getStoreLattice("default", "a2aApiKey").store,
-    getStoreLattice("default", "project").store
-  );
-  const grantsSource = deps.grantsSource ?? ((ctx) => ctx.grants);
-  const audit = deps.audit ?? (() => {
-    try {
-      const store = getStoreLattice("default", "openAudit").store;
-      return new OpenAuditService(store);
-    } catch {
-      return void 0;
-    }
-  })();
-  const rateLimiter = deps.rateLimiter ?? new OpenRateLimiter();
-  app.post("/open/mcp", async (request, reply) => {
-    const context = await openAuth.resolve(extractBearer(request));
-    if (!context) {
-      return reply.status(401).send({ error: "AUTH_FAILED" });
-    }
-    const body = request.body;
-    const sessionId = readSessionId(request);
-    if (sessionId) {
-      const session = await getSession(sessionId);
-      if (!session || session.credential.credentialId !== context.credentialId) {
-        return reply.status(404).send({ error: "SESSION_NOT_FOUND" });
-      }
-      reply.hijack();
-      await session.transport.handleRequest(request.raw, reply.raw, body);
-      return;
-    }
-    if (!isInitializeRequest(body)) {
-      return reply.status(400).send({ error: "SESSION_REQUIRED" });
-    }
-    const grants = grantsSource(context);
-    const catalog = await openLattice.catalogFor(grants, { tenantId: context.tenantId });
-    const globalToolNames = new Set(catalog.map((t) => t.toolName));
-    const buildTenant = deps.tenantPlugins ?? ((tenantId, tenantGrants, reservedToolNames) => buildTenantOpenPlugins(tenantId, tenantGrants, { reservedToolNames }));
-    let tenant;
-    try {
-      tenant = await buildTenant(context.tenantId, grants, globalToolNames);
-      if (tenant.degraded) {
-        request.log.warn(
-          { tenantId: context.tenantId },
-          "open mcp: tenant plugin catalog degraded; serving global tools only"
-        );
-      }
-    } catch (error) {
-      request.log.warn(
-        { tenantId: context.tenantId, err: error },
-        "open mcp: tenant plugin catalog unavailable; serving global tools only"
-      );
-      tenant = emptyTenantPlugins();
-    }
-    const mergedCatalog = mergeOpenCatalog(catalog, tenant.tools);
-    const uiResources = new Map([
-      ...collectExposedPluginUiResources(grants),
-      ...tenant.uiResources
-    ]);
-    const built = await buildSessionServer({
-      credential: { credentialId: context.credentialId, kind: context.kind },
-      grants,
-      catalog: mergedCatalog,
-      uiResources,
-      invoke: async (toolName, args) => {
-        const startedAt = Date.now();
-        const sep = toolName.indexOf("_");
-        const auditDomain = sep > 0 ? toolName.slice(0, sep) : toolName;
-        const auditAction = sep > 0 ? toolName.slice(sep + 1) : "";
-        const decision = rateLimiter.check(context.credentialId, auditDomain);
-        if (!decision.allowed) {
-          await audit?.record({
-            tenantId: context.tenantId,
-            credentialId: context.credentialId,
-            credentialKind: context.kind,
-            projectId: context.projectId,
-            domain: auditDomain,
-            action: auditAction,
-            args,
-            status: "error",
-            errorCode: "RATE_LIMITED",
-            durationMs: Date.now() - startedAt
-          });
-          throw Object.assign(
-            new Error(
-              `RATE_LIMITED: retry after ${decision.retryAfterMs ?? 1e3}ms`
-            ),
-            { rpcCode: RPC_ERROR.RATE_LIMITED }
-          );
-        }
-        try {
-          const isTenantRoute = tenant.hasTool(toolName) && !globalToolNames.has(toolName);
-          const runConfig = {
-            sandboxName: context.sandboxName,
-            credentialId: context.credentialId,
-            depth: context.depth
-          };
-          const result = isTenantRoute ? await tenant.invoke(toolName, args, {
-            tenantId: context.tenantId,
-            projectId: context.projectId,
-            workspaceId: context.workspaceId,
-            runConfig
-          }) : await openLattice.invoke(
-            grants,
-            {
-              tenantId: context.tenantId,
-              projectId: context.projectId,
-              workspaceId: context.workspaceId,
-              runConfig
-            },
-            toolName,
-            args
-          );
-          await audit?.record({
-            tenantId: context.tenantId,
-            credentialId: context.credentialId,
-            credentialKind: context.kind,
-            projectId: context.projectId,
-            domain: auditDomain,
-            action: auditAction,
-            args,
-            status: result.isError ? "error" : "ok",
-            ...result.isError ? { errorCode: "EXECUTION_ERROR" } : {},
-            durationMs: Date.now() - startedAt
-          });
-          return result;
-        } catch (err) {
-          const code = err instanceof GrantDeniedError ? RPC_ERROR.GRANT_DENIED : err instanceof ActionNotFoundError ? RPC_ERROR.ACTION_NOT_FOUND : err instanceof ValidationError ? RPC_ERROR.VALIDATION_FAILED : RPC_ERROR.EXECUTION_ERROR;
-          await audit?.record({
-            tenantId: context.tenantId,
-            credentialId: context.credentialId,
-            credentialKind: context.kind,
-            projectId: context.projectId,
-            domain: auditDomain,
-            action: auditAction,
-            args,
-            status: "error",
-            errorCode: err instanceof GrantDeniedError ? "GRANT_DENIED" : err instanceof ActionNotFoundError ? "ACTION_NOT_FOUND" : err instanceof ValidationError ? "VALIDATION_FAILED" : "EXECUTION_ERROR",
-            durationMs: Date.now() - startedAt
-          });
-          throw Object.assign(
-            new Error(err instanceof Error ? err.message : String(err)),
-            { rpcCode: code }
-          );
-        }
-      }
-    });
-    await built.server.connect(built.transport);
-    reply.hijack();
-    await built.transport.handleRequest(request.raw, reply.raw, body);
-  });
-  app.delete(
-    "/open/mcp",
-    async (request, reply) => {
-      const sessionId = readSessionId(request);
-      if (!sessionId) {
-        return reply.status(400).send({ error: "SESSION_REQUIRED" });
-      }
-      await deleteSession(sessionId);
-      return reply.status(204).send();
-    }
-  );
-}
-export {
-  registerOpenRoutes
-};
-//# sourceMappingURL=open-UVKMONVE.mjs.map

package/dist/open-exposure-27ESFWTB.mjs

@@ -1,97 +0,0 @@
-import {
-  buildAgentCardForAssistant
-} from "./chunk-QUT2DS4R.mjs";
-import {
-  buildTenantOpenPlugins,
-  mergeOpenCatalog
-} from "./chunk-NPHK4SZ6.mjs";
-import {
-  openLattice
-} from "./chunk-HVIKCUOF.mjs";
-import "./chunk-73QZQQOT.mjs";
-import "./chunk-NFEGQTCC.mjs";
-
-// src/routes/open-exposure.ts
-import { getStoreLattice } from "@axiom-lattice/core";
-import { effectiveGrants } from "@axiom-lattice/protocols";
-function registerOpenExposureRoutes(app, deps = {}) {
-  app.get(
-    "/api/keys/:id/exposure",
-    async (request, reply) => {
-      const tenantId = request.user?.tenantId;
-      if (!tenantId) {
-        return reply.status(401).send({ success: false, error: "Unauthorized" });
-      }
-      const keyStore = getStoreLattice("default", "a2aApiKey").store;
-      const record = await keyStore.findById(request.params.id);
-      if (!record || record.tenantId !== tenantId) {
-        return reply.status(404).send({ success: false, error: "Key not found" });
-      }
-      const grants = effectiveGrants(record);
-      const forwardedHost = request.headers["x-forwarded-host"];
-      const host = (Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost) ?? (Array.isArray(request.headers.host) ? request.headers.host[0] : request.headers.host) ?? request.hostname;
-      const baseUrl = `${request.protocol}://${host}`;
-      const globalCatalog = await openLattice.catalogFor(grants, { tenantId });
-      let tenantTools = [];
-      let tenantCatalogDegraded = false;
-      try {
-        const tenant = await buildTenantOpenPlugins(tenantId, grants, {
-          ...deps.tenantPluginDeps,
-          reservedToolNames: new Set(globalCatalog.map((t) => t.toolName))
-        });
-        tenantTools = tenant.tools;
-        tenantCatalogDegraded = tenant.degraded;
-      } catch (error) {
-        tenantCatalogDegraded = true;
-        request.log.warn(
-          { tenantId, err: error },
-          "key exposure: tenant plugin catalog unavailable"
-        );
-      }
-      const tools = mergeOpenCatalog(globalCatalog, tenantTools).map((t) => ({
-        domain: t.domain,
-        toolName: t.toolName,
-        description: t.description,
-        annotations: t.annotations,
-        hasUi: Boolean(t.ui)
-      }));
-      const agentGrant = grants.find((g) => g.domain === "agent");
-      const assistantStore = getStoreLattice("default", "assistant").store;
-      const agents = [];
-      for (const assistantId of agentGrant?.items ?? []) {
-        const assistant = await assistantStore.getAssistantById(
-          tenantId,
-          assistantId
-        );
-        if (!assistant) continue;
-        agents.push({
-          assistantId,
-          cardUrl: `${baseUrl}/api/a2a/agents/${assistantId}/.well-known/agent-card.json`,
-          jsonrpcUrl: `${baseUrl}/api/a2a/agents/${assistantId}/jsonrpc`,
-          card: buildAgentCardForAssistant({ assistant, baseUrl })
-        });
-      }
-      return reply.status(200).send({
-        success: true,
-        data: {
-          tenantId,
-          projectId: record.projectId,
-          grants,
-          mcp: {
-            endpoint: `${baseUrl}/open/mcp`,
-            tools,
-            // Surfaced so the console can distinguish "no tenant tools granted"
-            // from "tenant catalog unreadable"; the live Open session degrades
-            // to globals-only either way.
-            tenantCatalogDegraded
-          },
-          a2a: { agents }
-        }
-      });
-    }
-  );
-}
-export {
-  registerOpenExposureRoutes
-};
-//# sourceMappingURL=open-exposure-27ESFWTB.mjs.map

package/dist/open-files-X3HXVEEM.mjs

@@ -1,146 +0,0 @@
-import {
-  OpenAuditService,
-  OpenCredentialService
-} from "./chunk-JUA3VJE7.mjs";
-import {
-  openLattice
-} from "./chunk-HVIKCUOF.mjs";
-import {
-  resolveContextSandbox
-} from "./chunk-URXZPI2F.mjs";
-import "./chunk-EXPERMZR.mjs";
-import "./chunk-NFEGQTCC.mjs";
-
-// src/routes/open-files.ts
-import { getStoreLattice } from "@axiom-lattice/core";
-function extractBearer(request) {
-  const header = request.headers.authorization;
-  if (!header?.startsWith("Bearer ")) return void 0;
-  return header.slice("Bearer ".length).trim() || void 0;
-}
-function safePath(raw) {
-  if (typeof raw !== "string" || raw.length === 0) return null;
-  if (raw.includes("..")) return null;
-  return raw.startsWith("/") ? raw : `/${raw}`;
-}
-function registerOpenFilesRoutes(app, deps = {}) {
-  const openAuth = deps.openAuth ?? new OpenCredentialService(
-    getStoreLattice("default", "a2aApiKey").store,
-    getStoreLattice("default", "project").store
-  );
-  const audit = deps.audit ?? (() => {
-    try {
-      const store = getStoreLattice("default", "openAudit").store;
-      return new OpenAuditService(store);
-    } catch {
-      return void 0;
-    }
-  })();
-  app.addContentTypeParser(
-    "application/octet-stream",
-    { parseAs: "buffer" },
-    (_req, body, done) => done(null, body)
-  );
-  app.get("/open/sandbox/files/download", async (request, reply) => {
-    const context = await openAuth.resolve(extractBearer(request));
-    if (!context) return reply.status(401).send({ error: "AUTH_FAILED" });
-    const path = safePath(request.query.path);
-    if (!path) return reply.status(400).send({ error: "PATH_REQUIRED" });
-    if (!openLattice.isAllowed(context.grants, "sandbox_files_read")) {
-      return reply.status(403).send({ error: "GRANT_DENIED" });
-    }
-    const startedAt = Date.now();
-    try {
-      const sandbox = await resolveContextSandbox({
-        tenantId: context.tenantId,
-        projectId: context.projectId,
-        workspaceId: context.workspaceId,
-        runConfig: {}
-      });
-      const data = await sandbox.file.downloadFile({ file: path });
-      await audit?.record({
-        tenantId: context.tenantId,
-        credentialId: context.credentialId,
-        credentialKind: context.kind,
-        projectId: context.projectId,
-        domain: "sandbox",
-        action: "files_read",
-        args: { path },
-        status: "ok",
-        durationMs: Date.now() - startedAt
-      });
-      return reply.status(200).type("application/octet-stream").header("Content-Disposition", "attachment").send(data);
-    } catch (err) {
-      await audit?.record({
-        tenantId: context.tenantId,
-        credentialId: context.credentialId,
-        credentialKind: context.kind,
-        projectId: context.projectId,
-        domain: "sandbox",
-        action: "files_read",
-        args: { path },
-        status: "error",
-        errorCode: "EXECUTION_ERROR",
-        durationMs: Date.now() - startedAt
-      });
-      return reply.status(502).send({
-        error: err instanceof Error ? err.message : "SANDBOX_ERROR"
-      });
-    }
-  });
-  app.post("/open/sandbox/files/upload", async (request, reply) => {
-    const context = await openAuth.resolve(extractBearer(request));
-    if (!context) return reply.status(401).send({ error: "AUTH_FAILED" });
-    const path = safePath(request.query.path);
-    if (!path) return reply.status(400).send({ error: "PATH_REQUIRED" });
-    if (!openLattice.isAllowed(context.grants, "sandbox_files_write")) {
-      return reply.status(403).send({ error: "GRANT_DENIED" });
-    }
-    const body = request.body;
-    if (!Buffer.isBuffer(body)) {
-      return reply.status(400).send({ error: "BINARY_BODY_REQUIRED" });
-    }
-    const startedAt = Date.now();
-    try {
-      const sandbox = await resolveContextSandbox({
-        tenantId: context.tenantId,
-        projectId: context.projectId,
-        workspaceId: context.workspaceId,
-        runConfig: {}
-      });
-      await sandbox.file.uploadFile({ file: path, data: body });
-      await audit?.record({
-        tenantId: context.tenantId,
-        credentialId: context.credentialId,
-        credentialKind: context.kind,
-        projectId: context.projectId,
-        domain: "sandbox",
-        action: "files_write",
-        args: { path, bytes: body.length },
-        status: "ok",
-        durationMs: Date.now() - startedAt
-      });
-      return reply.status(200).send({ success: true, path });
-    } catch (err) {
-      await audit?.record({
-        tenantId: context.tenantId,
-        credentialId: context.credentialId,
-        credentialKind: context.kind,
-        projectId: context.projectId,
-        domain: "sandbox",
-        action: "files_write",
-        args: { path, bytes: body.length },
-        status: "error",
-        errorCode: "EXECUTION_ERROR",
-        durationMs: Date.now() - startedAt
-      });
-      return reply.status(502).send({
-        error: err instanceof Error ? err.message : "SANDBOX_ERROR"
-      });
-    }
-  });
-}
-export {
-  registerOpenFilesRoutes
-};
-//# sourceMappingURL=open-files-X3HXVEEM.mjs.map

package/dist/sandboxProvider-DUYWHYJN.mjs

@@ -1,10 +0,0 @@
-import {
-  createOpenSandboxProvider,
-  resolveContextSandbox
-} from "./chunk-URXZPI2F.mjs";
-import "./chunk-NFEGQTCC.mjs";
-export {
-  createOpenSandboxProvider,
-  resolveContextSandbox
-};
-//# sourceMappingURL=sandboxProvider-DUYWHYJN.mjs.map