@axiom-lattice/gateway 8.3.0 → 9.0.0

package/dist/mcp-app-shares-SHPBJQXS.mjs

@@ -0,0 +1,300 @@
+import {
+  getRateLimitService
+} from "./chunk-A7YNAU5L.mjs";
+import "./chunk-NFEGQTCC.mjs";
+
+// src/routes/mcp-app-shares.ts
+import bcrypt from "bcryptjs";
+
+// src/services/mcp-app-shares/McpAppShareRuntimeService.ts
+var ShareRuntimeError = class extends Error {
+  /**
+   * @param status - HTTP status.
+   * @param code - Stable machine-readable code.
+   */
+  constructor(status, code) {
+    super(code);
+    this.status = status;
+    this.code = code;
+    this.name = "ShareRuntimeError";
+  }
+};
+var McpAppShareRuntimeService = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  /**
+   * Return the app identity and a fresh tool result for the hosted page.
+   *
+   * The share record stores only tool identity/arguments; the tool is executed
+   * on every bootstrap so no result is persisted.
+   */
+  async bootstrap(token, options = {}) {
+    const record = await this.resolve(token, { ...options, countAccess: true });
+    const app = record.address.app;
+    if (!app.toolName) throw new ShareRuntimeError(400, "TOOL_NAME_REQUIRED");
+    const result = await this.deps.handlers.rpc(
+      record.tenantId,
+      this.storedRef(record),
+      "tools/call",
+      { name: app.toolName, arguments: app.toolInput ?? {} },
+      {
+        tenantId: record.tenantId,
+        workspaceId: record.workspaceId,
+        projectId: record.projectId
+      }
+    );
+    if (result.status !== 200) {
+      throw new ShareRuntimeError(502, "TOOL_EXECUTION_FAILED");
+    }
+    return {
+      title: record.title,
+      visibility: record.visibility,
+      app: {
+        kind: app.kind,
+        toolName: app.toolName,
+        ref: this.publicRef(app),
+        ...app.toolInput !== void 0 ? { toolInput: app.toolInput } : {},
+        toolResult: result.body
+      }
+    };
+  }
+  /**
+   * Resolve the UI resource using the stored ref.
+   */
+  async resource(token, _clientRef, options = {}) {
+    const record = await this.resolve(token, options);
+    return this.deps.handlers.resource(record.tenantId, this.storedRef(record));
+  }
+  /**
+   * Proxy an allow-listed JSON-RPC method using the stored ref.
+   */
+  async rpc(token, method, params, options = {}) {
+    const record = await this.resolve(token, options);
+    return this.deps.handlers.rpc(record.tenantId, this.storedRef(record), method, params, {
+      tenantId: record.tenantId,
+      workspaceId: record.workspaceId,
+      projectId: record.projectId
+    });
+  }
+  /**
+   * Resolve and authorize a share record.
+   *
+   * @throws {ShareRuntimeError} when the token is unusable.
+   */
+  async resolve(token, options) {
+    const record = await this.deps.store.findByToken(token);
+    if (!record || record.kind !== "mcpApp") {
+      throw new ShareRuntimeError(404, "SHARE_NOT_FOUND");
+    }
+    if (record.revoked) throw new ShareRuntimeError(404, "SHARE_REVOKED");
+    if (record.expiresAt && record.expiresAt.getTime() < Date.now()) {
+      throw new ShareRuntimeError(410, "SHARE_EXPIRED");
+    }
+    if (record.visibility === "internal") {
+      throw new ShareRuntimeError(403, "INTERNAL_NOT_SUPPORTED");
+    }
+    if (record.visibility === "password" && options?.unlocked !== true) {
+      throw new ShareRuntimeError(401, "SHARE_PASSWORD_REQUIRED");
+    }
+    if (options?.countAccess) {
+      const ok = await this.deps.store.atomicIncrementAccess(token);
+      if (!ok) throw new ShareRuntimeError(410, "SHARE_ACCESS_LIMIT");
+    }
+    return record;
+  }
+  /** Build the public (scope-less) ref returned to the browser. */
+  publicRef(app) {
+    if (app.kind === "plugin") {
+      return {
+        kind: "plugin",
+        pluginType: app.pluginType,
+        resource: app.resource,
+        displayMode: app.displayMode ?? "inline",
+        ...app.title ? { title: app.title } : {},
+        ...app.toolName ? { toolName: app.toolName } : {}
+      };
+    }
+    return {
+      kind: "mcp",
+      serverKey: app.serverKey,
+      resourceUri: app.resourceUri,
+      displayMode: app.displayMode ?? "inline",
+      ...app.title ? { title: app.title } : {},
+      ...app.toolName ? { toolName: app.toolName } : {}
+    };
+  }
+  /** Build the server-side ref including the signed plugin scope. */
+  storedRef(record) {
+    const app = record.address.app;
+    if (app.kind === "plugin") {
+      return {
+        kind: "plugin",
+        pluginType: app.pluginType,
+        resource: app.resource,
+        displayMode: app.displayMode ?? "inline",
+        ...app.title ? { title: app.title } : {},
+        ...app.toolName ? { toolName: app.toolName } : {},
+        ...app.scope ? { scope: app.scope } : {}
+      };
+    }
+    return this.publicRef(app);
+  }
+};
+
+// src/routes/mcp-app-shares.ts
+function tokenOf(request) {
+  return request.params.token;
+}
+function unlockedOf(request, token) {
+  return (request.headers.cookie ?? "").includes(`mcp_app_unlock_${token}=1`);
+}
+function logDenied(request, token, error) {
+  request.log.warn({
+    event: "share.denied",
+    tokenPrefix: token.slice(0, 8),
+    code: error instanceof ShareRuntimeError ? error.code : "INTERNAL_ERROR"
+  }, "share denied");
+}
+function sendResult(reply, result) {
+  return reply.type("application/json").status(result.status).send(JSON.stringify(result.body));
+}
+function rateLimited(request, reply, decision, token) {
+  request.log.warn({
+    event: "share.rate_limited",
+    policy: decision.policy,
+    tokenPrefix: token.slice(0, 8),
+    ip: request.ip,
+    exceededDimension: decision.exceededDimension,
+    limit: decision.limit
+  }, "share rate limited");
+  return reply.header("Retry-After", String(decision.retryAfterSeconds)).status(429).send({
+    error: "RATE_LIMITED",
+    policy: decision.policy,
+    retryAfterSeconds: decision.retryAfterSeconds
+  });
+}
+function registerMcpAppShareRoutes(app, deps) {
+  const service = new McpAppShareRuntimeService(deps);
+  const rateLimits = deps.rateLimits ?? getRateLimitService();
+  const consume = async (request, reply, policy, token, dimensions) => {
+    const decision = await rateLimits.consume(policy, dimensions);
+    return decision.allowed ? null : rateLimited(request, reply, decision, token);
+  };
+  app.get("/api/mcp-app-shares/:token/bootstrap", async (request, reply) => {
+    const token = tokenOf(request);
+    const blocked = await consume(request, reply, "mcp-app-share.bootstrap", token, {
+      ip: request.ip
+    });
+    if (blocked) return blocked;
+    try {
+      const result = await service.bootstrap(token, {
+        unlocked: unlockedOf(request, token)
+      });
+      request.log.info({
+        event: "share.bootstrap",
+        tokenPrefix: token.slice(0, 8),
+        visibility: result.visibility,
+        ip: request.ip
+      }, "share bootstrap");
+      return result;
+    } catch (error) {
+      logDenied(request, token, error);
+      if (error instanceof ShareRuntimeError) {
+        return reply.status(error.status).send({ error: error.code });
+      }
+      request.log.error(error);
+      return reply.status(500).send({ error: "INTERNAL_ERROR" });
+    }
+  });
+  app.post("/api/mcp-app-shares/:token/resource", async (request, reply) => {
+    const token = tokenOf(request);
+    try {
+      const result = await service.resource(
+        token,
+        request.body?.ref,
+        { unlocked: unlockedOf(request, token) }
+      );
+      return sendResult(reply, result);
+    } catch (error) {
+      logDenied(request, token, error);
+      if (error instanceof ShareRuntimeError) {
+        return reply.status(error.status).send({ error: error.code });
+      }
+      request.log.error(error);
+      return reply.status(500).send({ error: "INTERNAL_ERROR" });
+    }
+  });
+  app.post("/api/mcp-app-shares/:token/rpc", async (request, reply) => {
+    const token = tokenOf(request);
+    const body = request.body ?? {};
+    const method = typeof body.method === "string" ? body.method : "";
+    const params = typeof body.params === "object" && body.params !== null && !Array.isArray(body.params) ? body.params : {};
+    const blocked = await consume(request, reply, "mcp-app-share.rpc", token, {
+      token,
+      ip: request.ip
+    });
+    if (blocked) return blocked;
+    try {
+      const result = await service.rpc(token, method, params, {
+        unlocked: unlockedOf(request, token)
+      });
+      request.log.info({
+        event: "share.rpc",
+        tokenPrefix: token.slice(0, 8),
+        method,
+        tool: typeof params.name === "string" ? params.name : void 0,
+        ok: result.status === 200
+      }, "share rpc");
+      return sendResult(reply, result);
+    } catch (error) {
+      logDenied(request, token, error);
+      if (error instanceof ShareRuntimeError) {
+        return reply.status(error.status).send({ error: error.code });
+      }
+      request.log.error(error);
+      return reply.status(500).send({ error: "INTERNAL_ERROR" });
+    }
+  });
+  app.post("/api/mcp-app-shares/:token/unlock", async (request, reply) => {
+    const token = tokenOf(request);
+    const blocked = await consume(request, reply, "mcp-app-share.unlock", token, {
+      token,
+      ip: request.ip
+    });
+    if (blocked) return blocked;
+    const record = await deps.store.findByToken(token);
+    if (!record || record.kind !== "mcpApp" || record.revoked || !record.passwordHash) {
+      return reply.status(404).send({ error: "SHARE_NOT_FOUND" });
+    }
+    if (record.expiresAt && record.expiresAt.getTime() < Date.now()) {
+      return reply.status(410).send({ error: "SHARE_EXPIRED" });
+    }
+    if (record.visibility === "internal") {
+      return reply.status(403).send({ error: "INTERNAL_NOT_SUPPORTED" });
+    }
+    const password = request.body?.password;
+    const ok = typeof password === "string" && await bcrypt.compare(password, record.passwordHash);
+    if (!ok) {
+      request.log.warn({
+        event: "share.unlock_failed",
+        tokenPrefix: token.slice(0, 8)
+      }, "share unlock failed");
+      return reply.status(401).send({ error: "SHARE_PASSWORD_INVALID" });
+    }
+    const secure = request.protocol === "https" ? "; Secure" : "";
+    reply.header(
+      "set-cookie",
+      `mcp_app_unlock_${token}=1; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400${secure}`
+    );
+    request.log.info({
+      event: "share.unlocked",
+      tokenPrefix: token.slice(0, 8)
+    }, "share unlocked");
+    return reply.send({ ok: true });
+  });
+}
+export {
+  registerMcpAppShareRoutes
+};
+//# sourceMappingURL=mcp-app-shares-SHPBJQXS.mjs.map

package/dist/mcp-app-shares-SHPBJQXS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/routes/mcp-app-shares.ts","../src/services/mcp-app-shares/McpAppShareRuntimeService.ts"],"sourcesContent":["/**\n * Public runtime routes for a shared MCP App.\n *\n * These routes are reached with only the share token (public/password). They are\n * exempt from console auth; each handler enforces revocation/expiry/password and\n * always uses the ref persisted in the share record.\n */\n\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from \"fastify\";\nimport type { SharedResourceStore } from \"@axiom-lattice/protocols\";\nimport bcrypt from \"bcryptjs\";\nimport { makeMcpAppHandlers, type McpAppHandlerResult } from \"./mcp-apps\";\nimport {\n  McpAppShareRuntimeService,\n  ShareRuntimeError,\n} from \"../services/mcp-app-shares/McpAppShareRuntimeService\";\nimport {\n  getRateLimitService,\n  type RateLimitService,\n} from \"../services/rate-limit/RateLimitService\";\nimport type { RateLimitDecision, RateLimitDimension } from \"../services/rate-limit/types\";\n\n/** Dependencies for the public MCP App share routes. */\nexport interface McpAppShareRouteDeps {\n  store: SharedResourceStore;\n  handlers: ReturnType<typeof makeMcpAppHandlers>;\n  /** Gateway rate limiter; defaults to the gateway policy set. */\n  rateLimits?: RateLimitService;\n}\n\n/** Read the token path parameter. */\nfunction tokenOf(request: FastifyRequest): string {\n  return (request.params as { token: string }).token;\n}\n\n/** True when the password unlock cookie for this token is present. */\nfunction unlockedOf(request: FastifyRequest, token: string): boolean {\n  return (request.headers.cookie ?? \"\").includes(`mcp_app_unlock_${token}=1`);\n}\n\n/** Log a denied request without leaking the token. */\nfunction logDenied(request: FastifyRequest, token: string, error: unknown): void {\n  request.log.warn({\n    event: \"share.denied\",\n    tokenPrefix: token.slice(0, 8),\n    code: error instanceof ShareRuntimeError ? error.code : \"INTERNAL_ERROR\",\n  }, \"share denied\");\n}\n\n/**\n * Send the result envelope returned by the pure MCP app handlers.\n *\n * Always JSON-encode the body: plugin tools may return a bare string, and the\n * runtime client (like the console client) always parses the response as JSON.\n */\nfunction sendResult(reply: FastifyReply, result: McpAppHandlerResult) {\n  return reply\n    .type(\"application/json\")\n    .status(result.status)\n    .send(JSON.stringify(result.body));\n}\n\n/** Build a 429 with the standard retry header. */\nfunction rateLimited(\n  request: FastifyRequest,\n  reply: FastifyReply,\n  decision: RateLimitDecision,\n  token: string,\n): FastifyReply {\n  request.log.warn({\n    event: \"share.rate_limited\",\n    policy: decision.policy,\n    tokenPrefix: token.slice(0, 8),\n    ip: request.ip,\n    exceededDimension: decision.exceededDimension,\n    limit: decision.limit,\n  }, \"share rate limited\");\n  return reply\n    .header(\"Retry-After\", String(decision.retryAfterSeconds))\n    .status(429)\n    .send({\n      error: \"RATE_LIMITED\",\n      policy: decision.policy,\n      retryAfterSeconds: decision.retryAfterSeconds,\n    });\n}\n\n/**\n * Register the public share runtime routes.\n */\nexport function registerMcpAppShareRoutes(\n  app: FastifyInstance,\n  deps: McpAppShareRouteDeps,\n): void {\n  const service = new McpAppShareRuntimeService(deps);\n  const rateLimits = deps.rateLimits ?? getRateLimitService();\n  const consume = async (\n    request: FastifyRequest,\n    reply: FastifyReply,\n    policy: string,\n    token: string,\n    dimensions: Partial<Record<RateLimitDimension, string | undefined>>,\n  ): Promise<FastifyReply | null> => {\n    const decision = await rateLimits.consume(policy, dimensions);\n    return decision.allowed ? null : rateLimited(request, reply, decision, token);\n  };\n\n  app.get(\"/api/mcp-app-shares/:token/bootstrap\", async (request, reply) => {\n    const token = tokenOf(request);\n    const blocked = await consume(request, reply, \"mcp-app-share.bootstrap\", token, {\n      ip: request.ip,\n    });\n    if (blocked) return blocked;\n    try {\n      const result = await service.bootstrap(token, {\n        unlocked: unlockedOf(request, token),\n      });\n      request.log.info({\n        event: \"share.bootstrap\",\n        tokenPrefix: token.slice(0, 8),\n        visibility: result.visibility,\n        ip: request.ip,\n      }, \"share bootstrap\");\n      return result;\n    } catch (error) {\n      logDenied(request, token, error);\n      if (error instanceof ShareRuntimeError) {\n        return reply.status(error.status).send({ error: error.code });\n      }\n      request.log.error(error);\n      return reply.status(500).send({ error: \"INTERNAL_ERROR\" });\n    }\n  });\n\n  app.post(\"/api/mcp-app-shares/:token/resource\", async (request, reply) => {\n    const token = tokenOf(request);\n    try {\n      const result = await service.resource(\n        token,\n        (request.body as { ref?: unknown } | undefined)?.ref,\n        { unlocked: unlockedOf(request, token) },\n      );\n      return sendResult(reply, result);\n    } catch (error) {\n      logDenied(request, token, error);\n      if (error instanceof ShareRuntimeError) {\n        return reply.status(error.status).send({ error: error.code });\n      }\n      request.log.error(error);\n      return reply.status(500).send({ error: \"INTERNAL_ERROR\" });\n    }\n  });\n\n  app.post(\"/api/mcp-app-shares/:token/rpc\", async (request, reply) => {\n    const token = tokenOf(request);\n    const body = (request.body ?? {}) as {\n      method?: unknown;\n      params?: unknown;\n    };\n    const method = typeof body.method === \"string\" ? body.method : \"\";\n    const params =\n      typeof body.params === \"object\" && body.params !== null && !Array.isArray(body.params)\n        ? (body.params as Record<string, unknown>)\n        : {};\n    const blocked = await consume(request, reply, \"mcp-app-share.rpc\", token, {\n      token,\n      ip: request.ip,\n    });\n    if (blocked) return blocked;\n    try {\n      const result = await service.rpc(token, method, params, {\n        unlocked: unlockedOf(request, token),\n      });\n      request.log.info({\n        event: \"share.rpc\",\n        tokenPrefix: token.slice(0, 8),\n        method,\n        tool: typeof params.name === \"string\" ? params.name : undefined,\n        ok: result.status === 200,\n      }, \"share rpc\");\n      return sendResult(reply, result);\n    } catch (error) {\n      logDenied(request, token, error);\n      if (error instanceof ShareRuntimeError) {\n        return reply.status(error.status).send({ error: error.code });\n      }\n      request.log.error(error);\n      return reply.status(500).send({ error: \"INTERNAL_ERROR\" });\n    }\n  });\n\n  app.post(\"/api/mcp-app-shares/:token/unlock\", async (request, reply) => {\n    const token = tokenOf(request);\n    const blocked = await consume(request, reply, \"mcp-app-share.unlock\", token, {\n      token,\n      ip: request.ip,\n    });\n    if (blocked) return blocked;\n    const record = await deps.store.findByToken(token);\n    if (!record || record.kind !== \"mcpApp\" || record.revoked || !record.passwordHash) {\n      return reply.status(404).send({ error: \"SHARE_NOT_FOUND\" });\n    }\n    if (record.expiresAt && record.expiresAt.getTime() < Date.now()) {\n      return reply.status(410).send({ error: \"SHARE_EXPIRED\" });\n    }\n    if ((record.visibility as string) === \"internal\") {\n      return reply.status(403).send({ error: \"INTERNAL_NOT_SUPPORTED\" });\n    }\n    const password = (request.body as { password?: unknown } | undefined)?.password;\n    const ok =\n      typeof password === \"string\" &&\n      (await bcrypt.compare(password, record.passwordHash));\n    if (!ok) {\n      request.log.warn({\n        event: \"share.unlock_failed\",\n        tokenPrefix: token.slice(0, 8),\n      }, \"share unlock failed\");\n      return reply.status(401).send({ error: \"SHARE_PASSWORD_INVALID\" });\n    }\n    const secure = request.protocol === \"https\" ? \"; Secure\" : \"\";\n    reply.header(\n      \"set-cookie\",\n      `mcp_app_unlock_${token}=1; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400${secure}`,\n    );\n    request.log.info({\n      event: \"share.unlocked\",\n      tokenPrefix: token.slice(0, 8),\n    }, \"share unlocked\");\n    return reply.send({ ok: true });\n  });\n}\n","/**\n * Runtime access to a shared MCP App.\n *\n * A share token is the only credential for public/password shares. The service\n * always reconstructs the UI ref from the persisted record; client-supplied refs\n * are ignored so a token can never be used to reach another plugin/server.\n */\n\nimport type {\n  McpAppShareApp,\n  McpAppShareBootstrap,\n  McpAppShareRecord,\n  McpAppShareTarget,\n  McpUiRef,\n  ShareRecord,\n  SharedResourceStore,\n} from \"@axiom-lattice/protocols\";\nimport type { McpAppHandlerResult, McpAppRunContext } from \"../../routes/mcp-apps\";\nimport { makeMcpAppHandlers } from \"../../routes/mcp-apps\";\n\n/** Stable runtime error surfaced by the public share routes. */\nexport class ShareRuntimeError extends Error {\n  /**\n   * @param status - HTTP status.\n   * @param code - Stable machine-readable code.\n   */\n  constructor(\n    readonly status: number,\n    readonly code: string,\n  ) {\n    super(code);\n    this.name = \"ShareRuntimeError\";\n  }\n}\n\n/** Dependencies used by {@link McpAppShareRuntimeService}. */\nexport interface McpAppShareRuntimeServiceDeps {\n  store: SharedResourceStore;\n  handlers: ReturnType<typeof makeMcpAppHandlers>;\n}\n\n/** Options shared by bootstrap/resource/rpc. */\nexport interface McpAppShareAccessOptions {\n  /** True when the password unlock cookie is present. */\n  unlocked?: boolean;\n  /** Count one access (bootstrap only). */\n  countAccess?: boolean;\n}\n\n/**\n * Resolve a share token into its app payload and proxy runtime calls.\n */\nexport class McpAppShareRuntimeService {\n  constructor(private readonly deps: McpAppShareRuntimeServiceDeps) {}\n\n  /**\n   * Return the app identity and a fresh tool result for the hosted page.\n   *\n   * The share record stores only tool identity/arguments; the tool is executed\n   * on every bootstrap so no result is persisted.\n   */\n  async bootstrap(\n    token: string,\n    options: McpAppShareAccessOptions = {},\n  ): Promise<McpAppShareBootstrap> {\n    const record = await this.resolve(token, { ...options, countAccess: true });\n    const app = (record.address as McpAppShareTarget).app;\n    if (!app.toolName) throw new ShareRuntimeError(400, \"TOOL_NAME_REQUIRED\");\n\n    const result = await this.deps.handlers.rpc(\n      record.tenantId,\n      this.storedRef(record),\n      \"tools/call\",\n      { name: app.toolName, arguments: app.toolInput ?? {} },\n      {\n        tenantId: record.tenantId,\n        workspaceId: record.workspaceId,\n        projectId: record.projectId,\n      },\n    );\n    if (result.status !== 200) {\n      throw new ShareRuntimeError(502, \"TOOL_EXECUTION_FAILED\");\n    }\n\n    return {\n      title: record.title,\n      visibility: record.visibility,\n      app: {\n        kind: app.kind,\n        toolName: app.toolName,\n        ref: this.publicRef(app),\n        ...(app.toolInput !== undefined ? { toolInput: app.toolInput } : {}),\n        toolResult: result.body,\n      },\n    };\n  }\n\n  /**\n   * Resolve the UI resource using the stored ref.\n   */\n  async resource(\n    token: string,\n    _clientRef: unknown,\n    options: McpAppShareAccessOptions = {},\n  ): Promise<McpAppHandlerResult> {\n    const record = await this.resolve(token, options);\n    return this.deps.handlers.resource(record.tenantId, this.storedRef(record));\n  }\n\n  /**\n   * Proxy an allow-listed JSON-RPC method using the stored ref.\n   */\n  async rpc(\n    token: string,\n    method: string,\n    params: Record<string, unknown>,\n    options: McpAppShareAccessOptions = {},\n  ): Promise<McpAppHandlerResult> {\n    const record = await this.resolve(token, options);\n    return this.deps.handlers.rpc(record.tenantId, this.storedRef(record), method, params, {\n      tenantId: record.tenantId,\n      workspaceId: record.workspaceId,\n      projectId: record.projectId,\n    } satisfies McpAppRunContext);\n  }\n\n  /**\n   * Resolve and authorize a share record.\n   *\n   * @throws {ShareRuntimeError} when the token is unusable.\n   */\n  private async resolve(\n    token: string,\n    options?: McpAppShareAccessOptions,\n  ): Promise<McpAppShareRecord> {\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.kind !== \"mcpApp\") {\n      throw new ShareRuntimeError(404, \"SHARE_NOT_FOUND\");\n    }\n    if (record.revoked) throw new ShareRuntimeError(404, \"SHARE_REVOKED\");\n    if (record.expiresAt && record.expiresAt.getTime() < Date.now()) {\n      throw new ShareRuntimeError(410, \"SHARE_EXPIRED\");\n    }\n    if ((record.visibility as string) === \"internal\") {\n      throw new ShareRuntimeError(403, \"INTERNAL_NOT_SUPPORTED\");\n    }\n    if (record.visibility === \"password\" && options?.unlocked !== true) {\n      throw new ShareRuntimeError(401, \"SHARE_PASSWORD_REQUIRED\");\n    }\n    if (options?.countAccess) {\n      const ok = await this.deps.store.atomicIncrementAccess(token);\n      if (!ok) throw new ShareRuntimeError(410, \"SHARE_ACCESS_LIMIT\");\n    }\n    return record;\n  }\n\n  /** Build the public (scope-less) ref returned to the browser. */\n  private publicRef(app: McpAppShareApp): McpUiRef {\n    if (app.kind === \"plugin\") {\n      return {\n        kind: \"plugin\",\n        pluginType: app.pluginType!,\n        resource: app.resource!,\n        displayMode: app.displayMode ?? \"inline\",\n        ...(app.title ? { title: app.title } : {}),\n        ...(app.toolName ? { toolName: app.toolName } : {}),\n      };\n    }\n    return {\n      kind: \"mcp\",\n      serverKey: app.serverKey!,\n      resourceUri: app.resourceUri!,\n      displayMode: app.displayMode ?? \"inline\",\n      ...(app.title ? { title: app.title } : {}),\n      ...(app.toolName ? { toolName: app.toolName } : {}),\n    };\n  }\n\n  /** Build the server-side ref including the signed plugin scope. */\n  private storedRef(record: McpAppShareRecord): McpUiRef {\n    const app = (record.address as McpAppShareTarget).app;\n    if (app.kind === \"plugin\") {\n      return {\n        kind: \"plugin\",\n        pluginType: app.pluginType!,\n        resource: app.resource!,\n        displayMode: app.displayMode ?? \"inline\",\n        ...(app.title ? { title: app.title } : {}),\n        ...(app.toolName ? { toolName: app.toolName } : {}),\n        ...(app.scope ? { scope: app.scope } : {}),\n      };\n    }\n    return this.publicRef(app);\n  }\n}\n\n/** Type guard used by tests/callers that need to narrow a share record. */\nexport function isMcpAppShareRecord(record: ShareRecord): record is McpAppShareRecord {\n  return record.kind === \"mcpApp\";\n}\n"],"mappings":";;;;;;AAUA,OAAO,YAAY;;;ACWZ,IAAM,oBAAN,cAAgC,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3C,YACW,QACA,MACT;AACA,UAAM,IAAI;AAHD;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AAmBO,IAAM,4BAAN,MAAgC;AAAA,EACrC,YAA6B,MAAqC;AAArC;AAAA,EAAsC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQnE,MAAM,UACJ,OACA,UAAoC,CAAC,GACN;AAC/B,UAAM,SAAS,MAAM,KAAK,QAAQ,OAAO,EAAE,GAAG,SAAS,aAAa,KAAK,CAAC;AAC1E,UAAM,MAAO,OAAO,QAA8B;AAClD,QAAI,CAAC,IAAI,SAAU,OAAM,IAAI,kBAAkB,KAAK,oBAAoB;AAExE,UAAM,SAAS,MAAM,KAAK,KAAK,SAAS;AAAA,MACtC,OAAO;AAAA,MACP,KAAK,UAAU,MAAM;AAAA,MACrB;AAAA,MACA,EAAE,MAAM,IAAI,UAAU,WAAW,IAAI,aAAa,CAAC,EAAE;AAAA,MACrD;AAAA,QACE,UAAU,OAAO;AAAA,QACjB,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,MACpB;AAAA,IACF;AACA,QAAI,OAAO,WAAW,KAAK;AACzB,YAAM,IAAI,kBAAkB,KAAK,uBAAuB;AAAA,IAC1D;AAEA,WAAO;AAAA,MACL,OAAO,OAAO;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,KAAK;AAAA,QACH,MAAM,IAAI;AAAA,QACV,UAAU,IAAI;AAAA,QACd,KAAK,KAAK,UAAU,GAAG;AAAA,QACvB,GAAI,IAAI,cAAc,SAAY,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC;AAAA,QAClE,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SACJ,OACA,YACA,UAAoC,CAAC,GACP;AAC9B,UAAM,SAAS,MAAM,KAAK,QAAQ,OAAO,OAAO;AAChD,WAAO,KAAK,KAAK,SAAS,SAAS,OAAO,UAAU,KAAK,UAAU,MAAM,CAAC;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IACJ,OACA,QACA,QACA,UAAoC,CAAC,GACP;AAC9B,UAAM,SAAS,MAAM,KAAK,QAAQ,OAAO,OAAO;AAChD,WAAO,KAAK,KAAK,SAAS,IAAI,OAAO,UAAU,KAAK,UAAU,MAAM,GAAG,QAAQ,QAAQ;AAAA,MACrF,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,IACpB,CAA4B;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,QACZ,OACA,SAC4B;AAC5B,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,SAAS,UAAU;AACvC,YAAM,IAAI,kBAAkB,KAAK,iBAAiB;AAAA,IACpD;AACA,QAAI,OAAO,QAAS,OAAM,IAAI,kBAAkB,KAAK,eAAe;AACpE,QAAI,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAG;AAC/D,YAAM,IAAI,kBAAkB,KAAK,eAAe;AAAA,IAClD;AACA,QAAK,OAAO,eAA0B,YAAY;AAChD,YAAM,IAAI,kBAAkB,KAAK,wBAAwB;AAAA,IAC3D;AACA,QAAI,OAAO,eAAe,cAAc,SAAS,aAAa,MAAM;AAClE,YAAM,IAAI,kBAAkB,KAAK,yBAAyB;AAAA,IAC5D;AACA,QAAI,SAAS,aAAa;AACxB,YAAM,KAAK,MAAM,KAAK,KAAK,MAAM,sBAAsB,KAAK;AAC5D,UAAI,CAAC,GAAI,OAAM,IAAI,kBAAkB,KAAK,oBAAoB;AAAA,IAChE;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,UAAU,KAA+B;AAC/C,QAAI,IAAI,SAAS,UAAU;AACzB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,YAAY,IAAI;AAAA,QAChB,UAAU,IAAI;AAAA,QACd,aAAa,IAAI,eAAe;AAAA,QAChC,GAAI,IAAI,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,CAAC;AAAA,QACxC,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,MACnD;AAAA,IACF;AACA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,WAAW,IAAI;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,aAAa,IAAI,eAAe;AAAA,MAChC,GAAI,IAAI,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,CAAC;AAAA,MACxC,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,IACnD;AAAA,EACF;AAAA;AAAA,EAGQ,UAAU,QAAqC;AACrD,UAAM,MAAO,OAAO,QAA8B;AAClD,QAAI,IAAI,SAAS,UAAU;AACzB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,YAAY,IAAI;AAAA,QAChB,UAAU,IAAI;AAAA,QACd,aAAa,IAAI,eAAe;AAAA,QAChC,GAAI,IAAI,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,CAAC;AAAA,QACxC,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,QACjD,GAAI,IAAI,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,CAAC;AAAA,MAC1C;AAAA,IACF;AACA,WAAO,KAAK,UAAU,GAAG;AAAA,EAC3B;AACF;;;ADnKA,SAAS,QAAQ,SAAiC;AAChD,SAAQ,QAAQ,OAA6B;AAC/C;AAGA,SAAS,WAAW,SAAyB,OAAwB;AACnE,UAAQ,QAAQ,QAAQ,UAAU,IAAI,SAAS,kBAAkB,KAAK,IAAI;AAC5E;AAGA,SAAS,UAAU,SAAyB,OAAe,OAAsB;AAC/E,UAAQ,IAAI,KAAK;AAAA,IACf,OAAO;AAAA,IACP,aAAa,MAAM,MAAM,GAAG,CAAC;AAAA,IAC7B,MAAM,iBAAiB,oBAAoB,MAAM,OAAO;AAAA,EAC1D,GAAG,cAAc;AACnB;AAQA,SAAS,WAAW,OAAqB,QAA6B;AACpE,SAAO,MACJ,KAAK,kBAAkB,EACvB,OAAO,OAAO,MAAM,EACpB,KAAK,KAAK,UAAU,OAAO,IAAI,CAAC;AACrC;AAGA,SAAS,YACP,SACA,OACA,UACA,OACc;AACd,UAAQ,IAAI,KAAK;AAAA,IACf,OAAO;AAAA,IACP,QAAQ,SAAS;AAAA,IACjB,aAAa,MAAM,MAAM,GAAG,CAAC;AAAA,IAC7B,IAAI,QAAQ;AAAA,IACZ,mBAAmB,SAAS;AAAA,IAC5B,OAAO,SAAS;AAAA,EAClB,GAAG,oBAAoB;AACvB,SAAO,MACJ,OAAO,eAAe,OAAO,SAAS,iBAAiB,CAAC,EACxD,OAAO,GAAG,EACV,KAAK;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ,SAAS;AAAA,IACjB,mBAAmB,SAAS;AAAA,EAC9B,CAAC;AACL;AAKO,SAAS,0BACd,KACA,MACM;AACN,QAAM,UAAU,IAAI,0BAA0B,IAAI;AAClD,QAAM,aAAa,KAAK,cAAc,oBAAoB;AAC1D,QAAM,UAAU,OACd,SACA,OACA,QACA,OACA,eACiC;AACjC,UAAM,WAAW,MAAM,WAAW,QAAQ,QAAQ,UAAU;AAC5D,WAAO,SAAS,UAAU,OAAO,YAAY,SAAS,OAAO,UAAU,KAAK;AAAA,EAC9E;AAEA,MAAI,IAAI,wCAAwC,OAAO,SAAS,UAAU;AACxE,UAAM,QAAQ,QAAQ,OAAO;AAC7B,UAAM,UAAU,MAAM,QAAQ,SAAS,OAAO,2BAA2B,OAAO;AAAA,MAC9E,IAAI,QAAQ;AAAA,IACd,CAAC;AACD,QAAI,QAAS,QAAO;AACpB,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,UAAU,OAAO;AAAA,QAC5C,UAAU,WAAW,SAAS,KAAK;AAAA,MACrC,CAAC;AACD,cAAQ,IAAI,KAAK;AAAA,QACf,OAAO;AAAA,QACP,aAAa,MAAM,MAAM,GAAG,CAAC;AAAA,QAC7B,YAAY,OAAO;AAAA,QACnB,IAAI,QAAQ;AAAA,MACd,GAAG,iBAAiB;AACpB,aAAO;AAAA,IACT,SAAS,OAAO;AACd,gBAAU,SAAS,OAAO,KAAK;AAC/B,UAAI,iBAAiB,mBAAmB;AACtC,eAAO,MAAM,OAAO,MAAM,MAAM,EAAE,KAAK,EAAE,OAAO,MAAM,KAAK,CAAC;AAAA,MAC9D;AACA,cAAQ,IAAI,MAAM,KAAK;AACvB,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,IAC3D;AAAA,EACF,CAAC;AAED,MAAI,KAAK,uCAAuC,OAAO,SAAS,UAAU;AACxE,UAAM,QAAQ,QAAQ,OAAO;AAC7B,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ;AAAA,QAC3B;AAAA,QACC,QAAQ,MAAwC;AAAA,QACjD,EAAE,UAAU,WAAW,SAAS,KAAK,EAAE;AAAA,MACzC;AACA,aAAO,WAAW,OAAO,MAAM;AAAA,IACjC,SAAS,OAAO;AACd,gBAAU,SAAS,OAAO,KAAK;AAC/B,UAAI,iBAAiB,mBAAmB;AACtC,eAAO,MAAM,OAAO,MAAM,MAAM,EAAE,KAAK,EAAE,OAAO,MAAM,KAAK,CAAC;AAAA,MAC9D;AACA,cAAQ,IAAI,MAAM,KAAK;AACvB,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,IAC3D;AAAA,EACF,CAAC;AAED,MAAI,KAAK,kCAAkC,OAAO,SAAS,UAAU;AACnE,UAAM,QAAQ,QAAQ,OAAO;AAC7B,UAAM,OAAQ,QAAQ,QAAQ,CAAC;AAI/B,UAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;AAC/D,UAAM,SACJ,OAAO,KAAK,WAAW,YAAY,KAAK,WAAW,QAAQ,CAAC,MAAM,QAAQ,KAAK,MAAM,IAChF,KAAK,SACN,CAAC;AACP,UAAM,UAAU,MAAM,QAAQ,SAAS,OAAO,qBAAqB,OAAO;AAAA,MACxE;AAAA,MACA,IAAI,QAAQ;AAAA,IACd,CAAC;AACD,QAAI,QAAS,QAAO;AACpB,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,IAAI,OAAO,QAAQ,QAAQ;AAAA,QACtD,UAAU,WAAW,SAAS,KAAK;AAAA,MACrC,CAAC;AACD,cAAQ,IAAI,KAAK;AAAA,QACf,OAAO;AAAA,QACP,aAAa,MAAM,MAAM,GAAG,CAAC;AAAA,QAC7B;AAAA,QACA,MAAM,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,QACtD,IAAI,OAAO,WAAW;AAAA,MACxB,GAAG,WAAW;AACd,aAAO,WAAW,OAAO,MAAM;AAAA,IACjC,SAAS,OAAO;AACd,gBAAU,SAAS,OAAO,KAAK;AAC/B,UAAI,iBAAiB,mBAAmB;AACtC,eAAO,MAAM,OAAO,MAAM,MAAM,EAAE,KAAK,EAAE,OAAO,MAAM,KAAK,CAAC;AAAA,MAC9D;AACA,cAAQ,IAAI,MAAM,KAAK;AACvB,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,IAC3D;AAAA,EACF,CAAC;AAED,MAAI,KAAK,qCAAqC,OAAO,SAAS,UAAU;AACtE,UAAM,QAAQ,QAAQ,OAAO;AAC7B,UAAM,UAAU,MAAM,QAAQ,SAAS,OAAO,wBAAwB,OAAO;AAAA,MAC3E;AAAA,MACA,IAAI,QAAQ;AAAA,IACd,CAAC;AACD,QAAI,QAAS,QAAO;AACpB,UAAM,SAAS,MAAM,KAAK,MAAM,YAAY,KAAK;AACjD,QAAI,CAAC,UAAU,OAAO,SAAS,YAAY,OAAO,WAAW,CAAC,OAAO,cAAc;AACjF,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AACA,QAAI,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAG;AAC/D,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,CAAC;AAAA,IAC1D;AACA,QAAK,OAAO,eAA0B,YAAY;AAChD,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAA,IACnE;AACA,UAAM,WAAY,QAAQ,MAA6C;AACvE,UAAM,KACJ,OAAO,aAAa,YACnB,MAAM,OAAO,QAAQ,UAAU,OAAO,YAAY;AACrD,QAAI,CAAC,IAAI;AACP,cAAQ,IAAI,KAAK;AAAA,QACf,OAAO;AAAA,QACP,aAAa,MAAM,MAAM,GAAG,CAAC;AAAA,MAC/B,GAAG,qBAAqB;AACxB,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAA,IACnE;AACA,UAAM,SAAS,QAAQ,aAAa,UAAU,aAAa;AAC3D,UAAM;AAAA,MACJ;AAAA,MACA,kBAAkB,KAAK,oDAAoD,MAAM;AAAA,IACnF;AACA,YAAQ,IAAI,KAAK;AAAA,MACf,OAAO;AAAA,MACP,aAAa,MAAM,MAAM,GAAG,CAAC;AAAA,IAC/B,GAAG,gBAAgB;AACnB,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC,CAAC;AACH;","names":[]}

package/dist/mcp-apps-QVUK6UBA.mjs

@@ -0,0 +1,26 @@
+import {
+  McpAppScopeError,
+  PluginMethodNotSupportedError,
+  callPluginTool,
+  fetchPluginUiResource,
+  getMcpUiResourceResolver,
+  makeMcpAppHandlers,
+  registerMcpAppRoutes,
+  resolveMcpAppDeps
+} from "./chunk-T2HIWZGP.mjs";
+import {
+  PluginToolScopeError
+} from "./chunk-XUWD4VKY.mjs";
+import "./chunk-NFEGQTCC.mjs";
+export {
+  McpAppScopeError,
+  PluginMethodNotSupportedError,
+  PluginToolScopeError,
+  callPluginTool,
+  fetchPluginUiResource,
+  getMcpUiResourceResolver,
+  makeMcpAppHandlers,
+  registerMcpAppRoutes,
+  resolveMcpAppDeps
+};
+//# sourceMappingURL=mcp-apps-QVUK6UBA.mjs.map

package/dist/{open-7ED27I5B.mjs → open-27ZPLBIW.mjs}

@@ -5,27 +5,69 @@ import {
 import {
   buildTenantOpenPlugins,
   mergeOpenCatalog
-} from "./chunk-L6MBEEII.mjs";
-import {
-  OpenRateLimiter
-} from "./chunk-GXZFO3VU.mjs";
+} from "./chunk-JGQURU44.mjs";
 import {
   collectExposedPluginUiResources
-} from "./chunk-3XIIQ6EK.mjs";
+} from "./chunk-BOPNXTMO.mjs";
+import "./chunk-Y7OVVPVU.mjs";
+import "./chunk-EXPERMZR.mjs";
+import "./chunk-XUWD4VKY.mjs";
 import {
   ActionNotFoundError,
+  ConnectionNotAllowedError,
   GrantDeniedError,
   ValidationError,
-  openLattice
-} from "./chunk-HVIKCUOF.mjs";
-import "./chunk-XUWD4VKY.mjs";
-import "./chunk-EXPERMZR.mjs";
+  openLattice,
+  resolveCoveringConnectionKeys
+} from "./chunk-MFWTGNQR.mjs";
 import "./chunk-NFEGQTCC.mjs";
 
 // src/routes/open.ts
-import { getReplicaId, getStoreLattice } from "@axiom-lattice/core";
+import {
+  getReplicaId,
+  getStoreLattice,
+  resolvePluginConnections
+} from "@axiom-lattice/core";
 import { REPLICA_HEADER } from "@axiom-lattice/protocols";
 
+// src/services/open/openRateLimiter.ts
+var OpenRateLimiter = class {
+  constructor(options = {}) {
+    this.buckets = /* @__PURE__ */ new Map();
+    this.defaultPerMinute = options.defaultPerMinute ?? 6e4;
+    this.agentPerMinute = options.agentPerMinute ?? 2e3;
+  }
+  bucketClass(domain) {
+    return domain === "agent" ? "agent" : "default";
+  }
+  limitFor(domain) {
+    return domain === "agent" ? this.agentPerMinute : this.defaultPerMinute;
+  }
+  /** Consume one token; denied calls report how long to wait. */
+  check(credentialId, domain) {
+    const limit = this.limitFor(domain);
+    const key = `${this.bucketClass(domain)}:${credentialId}`;
+    const now = Date.now();
+    const bucket = this.buckets.get(key) ?? { tokens: limit, updatedAt: now };
+    const refillPerMs = limit / 6e4;
+    const elapsed = now - bucket.updatedAt;
+    bucket.tokens = Math.min(limit, bucket.tokens + elapsed * refillPerMs);
+    bucket.updatedAt = now;
+    if (bucket.tokens >= 1) {
+      bucket.tokens -= 1;
+      this.buckets.set(key, bucket);
+      return { allowed: true };
+    }
+    this.buckets.set(key, bucket);
+    const deficit = 1 - bucket.tokens;
+    return { allowed: false, retryAfterMs: Math.ceil(deficit / refillPerMs) };
+  }
+  /** Test helper. */
+  reset() {
+    this.buckets.clear();
+  }
+};
+
 // src/services/open/openMcpServer.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -116,7 +158,8 @@ var RPC_ERROR = {
   ACTION_NOT_FOUND: -32002,
   VALIDATION_FAILED: -32003,
   EXECUTION_ERROR: -32004,
-  RATE_LIMITED: -32005
+  RATE_LIMITED: -32005,
+  CONNECTION_NOT_ALLOWED: -32006
 };
 function registerOpenRoutes(app, deps = {}) {
   const openAuth = deps.openAuth ?? new OpenCredentialService(
@@ -133,6 +176,26 @@ function registerOpenRoutes(app, deps = {}) {
     }
   })();
   const rateLimiter = deps.rateLimiter ?? new OpenRateLimiter();
+  const rateLimits = deps.rateLimits;
+  const resolveConnections = deps.resolveConnections ?? resolvePluginConnections;
+  const selectedConnectionKeys = async (grants, domain, action, tenantId) => {
+    const keys = resolveCoveringConnectionKeys(grants, domain, action);
+    if (!keys) return void 0;
+    let resolved;
+    try {
+      resolved = await resolveConnections(domain, { connections: keys }, { tenantId });
+    } catch {
+      throw new ConnectionNotAllowedError(`connection store unavailable for ${domain}`);
+    }
+    const found = new Set(resolved.map((entry) => entry.key));
+    const missing = keys.filter((key) => !found.has(key));
+    if (missing.length > 0) {
+      throw new ConnectionNotAllowedError(
+        `unknown connection(s) for ${domain}: ${missing.join(", ")}`
+      );
+    }
+    return keys;
+  };
   const markReplica = (reply) => {
     const replica = getReplicaId();
     reply.header(REPLICA_HEADER, replica);
@@ -174,8 +237,21 @@ function registerOpenRoutes(app, deps = {}) {
         const sep = toolName.indexOf("_");
         const auditDomain = sep > 0 ? toolName.slice(0, sep) : toolName;
         const auditAction = sep > 0 ? toolName.slice(sep + 1) : "";
-        const decision = rateLimiter.check(context.credentialId, auditDomain);
-        if (!decision.allowed) {
+        let allowed;
+        let retryAfterMs;
+        if (rateLimits) {
+          const decision = await rateLimits.consume(
+            auditDomain === "agent" ? "open.agent" : "open.api",
+            { credential: context.credentialId }
+          );
+          allowed = decision.allowed;
+          retryAfterMs = decision.allowed ? void 0 : decision.retryAfterSeconds * 1e3;
+        } else {
+          const decision = rateLimiter.check(context.credentialId, auditDomain);
+          allowed = decision.allowed;
+          retryAfterMs = decision.retryAfterMs;
+        }
+        if (!allowed) {
           await audit?.record({
             tenantId: context.tenantId,
             credentialId: context.credentialId,
@@ -190,12 +266,18 @@ function registerOpenRoutes(app, deps = {}) {
           });
           throw Object.assign(
             new Error(
-              `RATE_LIMITED: retry after ${decision.retryAfterMs ?? 1e3}ms`
+              `RATE_LIMITED: retry after ${retryAfterMs ?? 1e3}ms`
             ),
             { rpcCode: RPC_ERROR.RATE_LIMITED }
           );
         }
         try {
+          const connectionKeys = await selectedConnectionKeys(
+            grants,
+            auditDomain,
+            auditAction,
+            context.tenantId
+          );
           const isTenantRoute = tenant.hasTool(toolName) && !globalToolNames.has(toolName);
           const runConfig = {
             sandboxName: context.sandboxName,
@@ -206,7 +288,8 @@ function registerOpenRoutes(app, deps = {}) {
             tenantId: context.tenantId,
             projectId: context.projectId,
             workspaceId: context.workspaceId,
-            runConfig
+            runConfig,
+            ...connectionKeys ? { connectionKeys } : {}
           }) : await openLattice.invoke(
             grants,
             {
@@ -232,7 +315,7 @@ function registerOpenRoutes(app, deps = {}) {
           });
           return result;
         } catch (err) {
-          const code = err instanceof GrantDeniedError ? RPC_ERROR.GRANT_DENIED : err instanceof ActionNotFoundError ? RPC_ERROR.ACTION_NOT_FOUND : err instanceof ValidationError ? RPC_ERROR.VALIDATION_FAILED : RPC_ERROR.EXECUTION_ERROR;
+          const code = err instanceof ConnectionNotAllowedError ? RPC_ERROR.CONNECTION_NOT_ALLOWED : err instanceof GrantDeniedError ? RPC_ERROR.GRANT_DENIED : err instanceof ActionNotFoundError ? RPC_ERROR.ACTION_NOT_FOUND : err instanceof ValidationError ? RPC_ERROR.VALIDATION_FAILED : RPC_ERROR.EXECUTION_ERROR;
           await audit?.record({
             tenantId: context.tenantId,
             credentialId: context.credentialId,
@@ -242,7 +325,7 @@ function registerOpenRoutes(app, deps = {}) {
             action: auditAction,
             args,
             status: "error",
-            errorCode: err instanceof GrantDeniedError ? "GRANT_DENIED" : err instanceof ActionNotFoundError ? "ACTION_NOT_FOUND" : err instanceof ValidationError ? "VALIDATION_FAILED" : "EXECUTION_ERROR",
+            errorCode: err instanceof ConnectionNotAllowedError ? "CONNECTION_NOT_ALLOWED" : err instanceof GrantDeniedError ? "GRANT_DENIED" : err instanceof ActionNotFoundError ? "ACTION_NOT_FOUND" : err instanceof ValidationError ? "VALIDATION_FAILED" : "EXECUTION_ERROR",
             durationMs: Date.now() - startedAt
           });
           throw Object.assign(
@@ -288,4 +371,4 @@ function registerOpenRoutes(app, deps = {}) {
 export {
   registerOpenRoutes
 };
-//# sourceMappingURL=open-7ED27I5B.mjs.map
+//# sourceMappingURL=open-27ZPLBIW.mjs.map

package/dist/open-27ZPLBIW.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/routes/open.ts","../src/services/open/openRateLimiter.ts","../src/services/open/openMcpServer.ts"],"sourcesContent":["/**\n * Open API surface routes: GET/POST/DELETE /open/mcp.\n *\n * The route is a thin shell — credential resolution (OpenAuthService),\n * catalog filtering and invocation (OpenLattice), and stateless MCP server\n * construction live in services/open/*. The transport writes the response\n * itself, so the reply is hijacked (same precedent as the Project Room SSE\n * route).\n */\n\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from \"fastify\";\nimport {\n  getReplicaId,\n  getStoreLattice,\n  resolvePluginConnections,\n} from \"@axiom-lattice/core\";\nimport { REPLICA_HEADER, type A2AApiKeyStore, type OpenAuditStore, type OpenGrant, type ProjectStore } from \"@axiom-lattice/protocols\";\nimport { OpenCredentialService } from \"../services/open/openCredentialService\";\nimport { OpenAuditService } from \"../services/open/openAuditService\";\nimport { OpenRateLimiter } from \"../services/open/openRateLimiter\";\nimport type { RateLimitService } from \"../services/rate-limit/RateLimitService\";\nimport type { OpenCredential } from \"../services/open/openCredentialService\";\nimport {\n  openLattice,\n  ActionNotFoundError,\n  ConnectionNotAllowedError,\n  GrantDeniedError,\n  ValidationError,\n  resolveCoveringConnectionKeys,\n} from \"../services/open/openLattice\";\nimport { buildSessionServer } from \"../services/open/openMcpServer\";\nimport { collectExposedPluginUiResources } from \"../services/open/registerExposedPlugins\";\nimport {\n  buildTenantOpenPlugins,\n  mergeOpenCatalog,\n  type TenantOpenPlugins,\n} from \"../services/open/tenantOpenPlugins\";\n\nexport interface OpenRouteDeps {\n  openAuth?: OpenCredentialService;\n  grantsSource?: (ctx: OpenCredential) => OpenGrant[];\n  audit?: OpenAuditService;\n  /** Legacy in-memory limiter; used only when `rateLimits` is absent. */\n  rateLimiter?: OpenRateLimiter;\n  /** Gateway rate limiter; preferred when provided. */\n  rateLimits?: RateLimitService;\n  /**\n   * Test seam: build the credential's tenant sandbox plugin bundle. Defaults to\n   * {@link buildTenantOpenPlugins} with the global catalog's tool names reserved\n   * so a tenant tool can never shadow a global/built-in one.\n   */\n  tenantPlugins?: (\n    tenantId: string,\n    grants: OpenGrant[],\n    reservedToolNames: ReadonlySet<string>,\n  ) => Promise<TenantOpenPlugins>;\n  /** Test seam for grant-pinned connection validation. */\n  resolveConnections?: typeof resolvePluginConnections;\n}\n\nfunction extractBearer(request: FastifyRequest): string | undefined {\n  const header = request.headers.authorization;\n  if (!header?.startsWith(\"Bearer \")) return undefined;\n  return header.slice(\"Bearer \".length).trim() || undefined;\n}\n\n/**\n * Degraded tenant plugin bundle used when the sandbox catalog cannot be read.\n *\n * A catalog read failure must not 500 the session: the MCP server still builds\n * and serves the global tools. `invoke` is unreachable through normal routing\n * (`hasTool` is always false, so calls route to OpenLattice) but returns an\n * error result if it is ever reached.\n */\nfunction emptyTenantPlugins(): TenantOpenPlugins {\n  return {\n    tools: [],\n    uiResources: new Map(),\n    hasTool: () => false,\n    degraded: true,\n    invoke: async (toolName) => ({\n      content: [\n        { type: \"text\", text: `Tenant plugin catalog unavailable for ${toolName}` },\n      ],\n      isError: true,\n    }),\n  };\n}\n\n/** JSON-RPC error codes used on the Open surface. */\nconst RPC_ERROR = {\n  GRANT_DENIED: -32001,\n  ACTION_NOT_FOUND: -32002,\n  VALIDATION_FAILED: -32003,\n  EXECUTION_ERROR: -32004,\n  RATE_LIMITED: -32005,\n  CONNECTION_NOT_ALLOWED: -32006,\n} as const;\n\nexport function registerOpenRoutes(\n  app: FastifyInstance,\n  deps: OpenRouteDeps = {},\n): void {\n  const openAuth =\n    deps.openAuth ??\n    new OpenCredentialService(\n      getStoreLattice(\"default\", \"a2aApiKey\").store as A2AApiKeyStore,\n      getStoreLattice(\"default\", \"project\").store as ProjectStore,\n    );\n  const grantsSource =\n    deps.grantsSource ?? ((ctx: OpenCredential) => ctx.grants);\n  const audit =\n    deps.audit ??\n    (() => {\n      try {\n        const store = getStoreLattice(\"default\", \"openAudit\").store as OpenAuditStore;\n        return new OpenAuditService(store);\n      } catch {\n        return undefined;\n      }\n    })();\n\n  const rateLimiter = deps.rateLimiter ?? new OpenRateLimiter();\n  const rateLimits = deps.rateLimits;\n\n  const resolveConnections = deps.resolveConnections ?? resolvePluginConnections;\n\n  /**\n   * Resolve and validate the connection keys pinned by the covering grant.\n   *\n   * The credential tenant is authoritative; a selected key that is missing or\n   * belongs to another tenant/type fails closed.\n   */\n  const selectedConnectionKeys = async (\n    grants: OpenGrant[],\n    domain: string,\n    action: string,\n    tenantId: string,\n  ): Promise<string[] | undefined> => {\n    const keys = resolveCoveringConnectionKeys(grants, domain, action);\n    if (!keys) return undefined;\n    let resolved: Awaited<ReturnType<typeof resolvePluginConnections>>;\n    try {\n      resolved = await resolveConnections(domain, { connections: keys }, { tenantId });\n    } catch {\n      throw new ConnectionNotAllowedError(`connection store unavailable for ${domain}`);\n    }\n    const found = new Set(resolved.map((entry) => entry.key));\n    const missing = keys.filter((key) => !found.has(key));\n    if (missing.length > 0) {\n      throw new ConnectionNotAllowedError(\n        `unknown connection(s) for ${domain}: ${missing.join(\", \")}`,\n      );\n    }\n    return keys;\n  };\n\n  const markReplica = (reply: FastifyReply): void => {\n    const replica = getReplicaId();\n    reply.header(REPLICA_HEADER, replica);\n    reply.raw.setHeader(REPLICA_HEADER, replica);\n  };\n\n  const buildServerFor = async (\n    context: OpenCredential,\n    log: FastifyRequest[\"log\"],\n  ) => {\n    const grants = grantsSource(context);\n    const catalog = await openLattice.catalogFor(grants, { tenantId: context.tenantId });\n    // Tenant sandbox plugins are volume-resident and outside the OpenLattice\n    // registry; merge their grant-filtered tools/UI alongside the globals.\n    // Global/built-in tool names are reserved so a tenant plugin of the same\n    // type (kb/sandbox/agent) can neither crash `registerTool` with a duplicate\n    // nor capture the invoke routing for a global tool.\n    const globalToolNames = new Set(catalog.map((t) => t.toolName));\n    const buildTenant =\n      deps.tenantPlugins ??\n      ((tenantId, tenantGrants, reservedToolNames) =>\n        buildTenantOpenPlugins(tenantId, tenantGrants, { reservedToolNames }));\n    let tenant: TenantOpenPlugins;\n    try {\n      tenant = await buildTenant(context.tenantId, grants, globalToolNames);\n      if (tenant.degraded) {\n        // The catalog's common failure mode is a diagnostic, not a throw\n        // (`ensureLoaded` returns error-level diagnostics). Surface it and\n        // serve global tools only.\n        log.warn(\n          { tenantId: context.tenantId },\n          \"open mcp: tenant plugin catalog degraded; serving global tools only\",\n        );\n      }\n    } catch (error) {\n      // Sandbox catalogs are volume-resident and can be transiently\n      // unavailable; degrade to globals-only rather than failing the whole\n      // session so external hosts can still connect. `err` keeps the stack.\n      log.warn(\n        { tenantId: context.tenantId, err: error },\n        \"open mcp: tenant plugin catalog unavailable; serving global tools only\",\n      );\n      tenant = emptyTenantPlugins();\n    }\n    const mergedCatalog = mergeOpenCatalog(catalog, tenant.tools);\n    const uiResources = new Map([\n      ...collectExposedPluginUiResources(grants),\n      ...tenant.uiResources,\n    ]);\n    const built = await buildSessionServer({\n      credential: { credentialId: context.credentialId, kind: context.kind },\n      grants,\n      catalog: mergedCatalog,\n      uiResources,\n      invoke: async (toolName, args) => {\n        const startedAt = Date.now();\n        const sep = toolName.indexOf(\"_\");\n        const auditDomain = sep > 0 ? toolName.slice(0, sep) : toolName;\n        const auditAction = sep > 0 ? toolName.slice(sep + 1) : \"\";\n\n        let allowed: boolean;\n        let retryAfterMs: number | undefined;\n        if (rateLimits) {\n          const decision = await rateLimits.consume(\n            auditDomain === \"agent\" ? \"open.agent\" : \"open.api\",\n            { credential: context.credentialId },\n          );\n          allowed = decision.allowed;\n          retryAfterMs = decision.allowed\n            ? undefined\n            : decision.retryAfterSeconds * 1000;\n        } else {\n          const decision = rateLimiter.check(context.credentialId, auditDomain);\n          allowed = decision.allowed;\n          retryAfterMs = decision.retryAfterMs;\n        }\n        if (!allowed) {\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: \"error\",\n            errorCode: \"RATE_LIMITED\",\n            durationMs: Date.now() - startedAt,\n          });\n          throw Object.assign(\n            new Error(\n              `RATE_LIMITED: retry after ${retryAfterMs ?? 1000}ms`,\n            ),\n            { rpcCode: RPC_ERROR.RATE_LIMITED },\n          );\n        }\n\n        try {\n          const connectionKeys = await selectedConnectionKeys(\n            grants,\n            auditDomain,\n            auditAction,\n            context.tenantId,\n          );\n          const isTenantRoute = tenant.hasTool(toolName) && !globalToolNames.has(toolName);\n          const runConfig: Record<string, unknown> = {\n            sandboxName: context.sandboxName,\n            credentialId: context.credentialId,\n            depth: context.depth,\n          };\n          const result = isTenantRoute\n            ? await tenant.invoke(toolName, args, {\n                tenantId: context.tenantId,\n                projectId: context.projectId,\n                workspaceId: context.workspaceId,\n                runConfig,\n                ...(connectionKeys ? { connectionKeys } : {}),\n              })\n            : await openLattice.invoke(\n                grants,\n                {\n                  tenantId: context.tenantId,\n                  projectId: context.projectId,\n                  workspaceId: context.workspaceId,\n                  runConfig,\n                },\n                toolName,\n                args,\n              );\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: result.isError ? \"error\" : \"ok\",\n            ...(result.isError ? { errorCode: \"EXECUTION_ERROR\" } : {}),\n            durationMs: Date.now() - startedAt,\n          });\n          return result;\n        } catch (err) {\n          const code =\n            err instanceof ConnectionNotAllowedError\n              ? RPC_ERROR.CONNECTION_NOT_ALLOWED\n              : err instanceof GrantDeniedError\n                ? RPC_ERROR.GRANT_DENIED\n                : err instanceof ActionNotFoundError\n                  ? RPC_ERROR.ACTION_NOT_FOUND\n                  : err instanceof ValidationError\n                    ? RPC_ERROR.VALIDATION_FAILED\n                    : RPC_ERROR.EXECUTION_ERROR;\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: \"error\",\n            errorCode:\n              err instanceof ConnectionNotAllowedError\n                ? \"CONNECTION_NOT_ALLOWED\"\n                : err instanceof GrantDeniedError\n                  ? \"GRANT_DENIED\"\n                  : err instanceof ActionNotFoundError\n                    ? \"ACTION_NOT_FOUND\"\n                    : err instanceof ValidationError\n                      ? \"VALIDATION_FAILED\"\n                      : \"EXECUTION_ERROR\",\n            durationMs: Date.now() - startedAt,\n          });\n          throw Object.assign(\n            new Error(err instanceof Error ? err.message : String(err)),\n            { rpcCode: code },\n          );\n        }\n      },\n    });\n    return built;\n  };\n\n  const handleOpenMcpPost = async (\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ) => {\n    markReplica(reply);\n    const context = await openAuth.resolve(extractBearer(request));\n    if (!context) {\n      return reply.status(401).send({ error: \"AUTH_FAILED\" });\n    }\n\n    const built = await buildServerFor(context, request.log);\n    await built.server.connect(built.transport);\n    reply.hijack();\n    const close = (): void => {\n      void built.transport.close().catch(() => undefined);\n      void built.server.close().catch(() => undefined);\n    };\n    reply.raw.once(\"close\", close);\n    await built.transport.handleRequest(request.raw, reply.raw, request.body);\n  };\n\n  const methodNotAllowed = async (\n    _request: FastifyRequest,\n    reply: FastifyReply,\n  ) => {\n    reply.header(\"Allow\", \"POST\");\n    return reply.status(405).send({ error: \"METHOD_NOT_ALLOWED\" });\n  };\n\n  app.post(\"/open/mcp\", handleOpenMcpPost);\n  // Canonical MCP surface aliases the unified Open MCP server.\n  app.post(\"/mcp\", handleOpenMcpPost);\n  app.post(\"/mcp/\", handleOpenMcpPost);\n  app.get(\"/mcp\", methodNotAllowed);\n  app.get(\"/mcp/\", methodNotAllowed);\n\n  // Stateless Streamable HTTP has no server→client GET stream or session\n  // DELETE. A 404 is not a recognized \"not supported\" signal: the official\n  // client transport tolerates 405 (`Allow` set) and continues.\n  app.get(\"/open/mcp\", methodNotAllowed);\n  app.get(\"/open/mcp/\", methodNotAllowed);\n  app.delete(\"/open/mcp\", methodNotAllowed);\n  app.delete(\"/mcp\", methodNotAllowed);\n  app.delete(\"/mcp/\", methodNotAllowed);\n\n}\n","/**\n * In-memory per-credential rate limiter (token bucket). The agent domain gets\n * a stricter bucket because each call consumes LLM budget.\n *\n * Process-local by design (V1 single-gateway); a distributed limiter is V2.\n */\n\nexport interface RateLimitDecision {\n  allowed: boolean;\n  retryAfterMs?: number;\n}\n\ninterface Bucket {\n  tokens: number;\n  updatedAt: number;\n}\n\nexport interface OpenRateLimiterOptions {\n  /** Default requests per minute per credential. */\n  defaultPerMinute?: number;\n  /** Stricter limit for the agent domain. */\n  agentPerMinute?: number;\n}\n\nexport class OpenRateLimiter {\n  private readonly buckets = new Map<string, Bucket>();\n  private readonly defaultPerMinute: number;\n  private readonly agentPerMinute: number;\n\n  constructor(options: OpenRateLimiterOptions = {}) {\n    this.defaultPerMinute = options.defaultPerMinute ?? 60000;\n    this.agentPerMinute = options.agentPerMinute ?? 2000;\n  }\n\n  private bucketClass(domain: string): string {\n    return domain === \"agent\" ? \"agent\" : \"default\";\n  }\n\n  private limitFor(domain: string): number {\n    return domain === \"agent\" ? this.agentPerMinute : this.defaultPerMinute;\n  }\n\n  /** Consume one token; denied calls report how long to wait. */\n  check(credentialId: string, domain: string): RateLimitDecision {\n    const limit = this.limitFor(domain);\n    const key = `${this.bucketClass(domain)}:${credentialId}`;\n    const now = Date.now();\n    const bucket = this.buckets.get(key) ?? { tokens: limit, updatedAt: now };\n\n    const refillPerMs = limit / 60_000;\n    const elapsed = now - bucket.updatedAt;\n    bucket.tokens = Math.min(limit, bucket.tokens + elapsed * refillPerMs);\n    bucket.updatedAt = now;\n\n    if (bucket.tokens >= 1) {\n      bucket.tokens -= 1;\n      this.buckets.set(key, bucket);\n      return { allowed: true };\n    }\n\n    this.buckets.set(key, bucket);\n    const deficit = 1 - bucket.tokens;\n    return { allowed: false, retryAfterMs: Math.ceil(deficit / refillPerMs) };\n  }\n\n  /** Test helper. */\n  reset(): void {\n    this.buckets.clear();\n  }\n}\n","/**\n * Builds a stateless MCP server instance whose tool list is the\n * credential-filtered OpenLattice catalog. A fresh instance is built per HTTP\n * request so no server/session state is shared between replicas.\n *\n * The transport uses `sessionIdGenerator: undefined`: it never issues\n * `Mcp-Session-Id`, and every request is self-contained. Credential-scoped\n * tool lists therefore stay per-request without a session registry.\n *\n * Every tool executor routes through the OpenLattice invoke kernel, so\n * authorization is re-checked on each invocation (default-deny, live grants).\n */\n\nimport { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { StreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport type { McpUiCsp, OpenGrant } from \"@axiom-lattice/protocols\";\nimport type { OpenToolDescriptor } from \"./openLattice\";\n\nexport const OPEN_MCP_SERVER_INFO = {\n  name: \"axiom-open\",\n  version: \"0.1.0\",\n} as const;\n\n/**\n * A `ui://` HTML resource served by the session. `read` is invoked per\n * `resources/read`, so the caller can fetch plugin UI lazily.\n */\nexport interface OpenUiResource {\n  /** MIME for the resource; defaults to \"text/html;profile=mcp-app\". */\n  mimeType?: string;\n  csp?: McpUiCsp;\n  read: () => Promise<{ html: string; csp?: McpUiCsp }>;\n}\n\nexport interface BuiltSession {\n  server: McpServer;\n  transport: StreamableHTTPServerTransport;\n  tools: OpenToolDescriptor[];\n}\n\n/**\n * Builds (but does not connect) a stateless MCP server. The caller MUST\n * connect it to a transport (`await built.server.connect(built.transport)`)\n * before handling a request — otherwise the transport has no onmessage\n * handler and the request is swallowed. Deferring connect is what lets tests\n * attach the server to an `InMemoryTransport`.\n */\nexport async function buildSessionServer(options: {\n  credential: { credentialId: string; kind: string };\n  grants: OpenGrant[];\n  catalog: OpenToolDescriptor[];\n  invoke: (\n    toolName: string,\n    args: unknown,\n  ) => Promise<{\n    content: Array<{ type: \"text\"; text: string }>;\n    isError?: boolean;\n  }>;\n  uiResources?: Map<string, OpenUiResource>;\n}): Promise<BuiltSession> {\n  const { catalog, invoke, uiResources } = options;\n  const server = new McpServer(OPEN_MCP_SERVER_INFO, {\n    capabilities: {\n      // The SDK has no `extensions` field; MCP App hosts discover the UI\n      // extension through `experimental`.\n      experimental: { \"io.modelcontextprotocol/ui\": {} },\n    },\n  });\n  for (const tool of catalog) {\n    server.registerTool(\n      tool.toolName,\n      {\n        description: tool.description,\n        inputSchema: tool.schema,\n        annotations: {\n          readOnlyHint: tool.annotations.readOnlyHint,\n          destructiveHint: tool.annotations.destructiveHint,\n        },\n        ...(tool.ui ? { _meta: { ui: { resourceUri: tool.ui.resourceUri } } } : {}),\n      },\n      async (args: unknown) => {\n        const result = await invoke(tool.toolName, args);\n        return { content: result.content, isError: result.isError };\n      },\n    );\n  }\n  for (const [uri, res] of uiResources ?? []) {\n    const mimeType = res.mimeType ?? \"text/html;profile=mcp-app\";\n    server.registerResource(\n      `mcp-app:${uri}`,\n      uri,\n      {\n        mimeType,\n        ...(res.csp ? { _meta: { ui: { csp: res.csp } } } : {}),\n      },\n      async (u) => {\n        const { html, csp } = await res.read();\n        return {\n          contents: [\n            {\n              uri: u.href,\n              mimeType,\n              text: html,\n              ...(csp ? { _meta: { ui: { csp } } } : {}),\n            },\n          ],\n        };\n      },\n    );\n  }\n  const transport = new StreamableHTTPServerTransport({\n    sessionIdGenerator: undefined,\n    enableJsonResponse: true,\n  });\n  return { server, transport, tools: catalog };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAWA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAmG;;;ACQrG,IAAM,kBAAN,MAAsB;AAAA,EAK3B,YAAY,UAAkC,CAAC,GAAG;AAJlD,SAAiB,UAAU,oBAAI,IAAoB;AAKjD,SAAK,mBAAmB,QAAQ,oBAAoB;AACpD,SAAK,iBAAiB,QAAQ,kBAAkB;AAAA,EAClD;AAAA,EAEQ,YAAY,QAAwB;AAC1C,WAAO,WAAW,UAAU,UAAU;AAAA,EACxC;AAAA,EAEQ,SAAS,QAAwB;AACvC,WAAO,WAAW,UAAU,KAAK,iBAAiB,KAAK;AAAA,EACzD;AAAA;AAAA,EAGA,MAAM,cAAsB,QAAmC;AAC7D,UAAM,QAAQ,KAAK,SAAS,MAAM;AAClC,UAAM,MAAM,GAAG,KAAK,YAAY,MAAM,CAAC,IAAI,YAAY;AACvD,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,SAAS,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,QAAQ,OAAO,WAAW,IAAI;AAExE,UAAM,cAAc,QAAQ;AAC5B,UAAM,UAAU,MAAM,OAAO;AAC7B,WAAO,SAAS,KAAK,IAAI,OAAO,OAAO,SAAS,UAAU,WAAW;AACrE,WAAO,YAAY;AAEnB,QAAI,OAAO,UAAU,GAAG;AACtB,aAAO,UAAU;AACjB,WAAK,QAAQ,IAAI,KAAK,MAAM;AAC5B,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAEA,SAAK,QAAQ,IAAI,KAAK,MAAM;AAC5B,UAAM,UAAU,IAAI,OAAO;AAC3B,WAAO,EAAE,SAAS,OAAO,cAAc,KAAK,KAAK,UAAU,WAAW,EAAE;AAAA,EAC1E;AAAA;AAAA,EAGA,QAAc;AACZ,SAAK,QAAQ,MAAM;AAAA,EACrB;AACF;;;ACxDA,SAAS,iBAAiB;AAC1B,SAAS,qCAAqC;AAIvC,IAAM,uBAAuB;AAAA,EAClC,MAAM;AAAA,EACN,SAAS;AACX;AA0BA,eAAsB,mBAAmB,SAYf;AACxB,QAAM,EAAE,SAAS,QAAQ,YAAY,IAAI;AACzC,QAAM,SAAS,IAAI,UAAU,sBAAsB;AAAA,IACjD,cAAc;AAAA;AAAA;AAAA,MAGZ,cAAc,EAAE,8BAA8B,CAAC,EAAE;AAAA,IACnD;AAAA,EACF,CAAC;AACD,aAAW,QAAQ,SAAS;AAC1B,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,QACE,aAAa,KAAK;AAAA,QAClB,aAAa,KAAK;AAAA,QAClB,aAAa;AAAA,UACX,cAAc,KAAK,YAAY;AAAA,UAC/B,iBAAiB,KAAK,YAAY;AAAA,QACpC;AAAA,QACA,GAAI,KAAK,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,KAAK,GAAG,YAAY,EAAE,EAAE,IAAI,CAAC;AAAA,MAC3E;AAAA,MACA,OAAO,SAAkB;AACvB,cAAM,SAAS,MAAM,OAAO,KAAK,UAAU,IAAI;AAC/C,eAAO,EAAE,SAAS,OAAO,SAAS,SAAS,OAAO,QAAQ;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,KAAK,GAAG,KAAK,eAAe,CAAC,GAAG;AAC1C,UAAM,WAAW,IAAI,YAAY;AACjC,WAAO;AAAA,MACL,WAAW,GAAG;AAAA,MACd;AAAA,MACA;AAAA,QACE;AAAA,QACA,GAAI,IAAI,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,MACvD;AAAA,MACA,OAAO,MAAM;AACX,cAAM,EAAE,MAAM,IAAI,IAAI,MAAM,IAAI,KAAK;AACrC,eAAO;AAAA,UACL,UAAU;AAAA,YACR;AAAA,cACE,KAAK,EAAE;AAAA,cACP;AAAA,cACA,MAAM;AAAA,cACN,GAAI,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,YAC1C;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,IAAI,8BAA8B;AAAA,IAClD,oBAAoB;AAAA,IACpB,oBAAoB;AAAA,EACtB,CAAC;AACD,SAAO,EAAE,QAAQ,WAAW,OAAO,QAAQ;AAC7C;;;AFvDA,SAAS,cAAc,SAA6C;AAClE,QAAM,SAAS,QAAQ,QAAQ;AAC/B,MAAI,CAAC,QAAQ,WAAW,SAAS,EAAG,QAAO;AAC3C,SAAO,OAAO,MAAM,UAAU,MAAM,EAAE,KAAK,KAAK;AAClD;AAUA,SAAS,qBAAwC;AAC/C,SAAO;AAAA,IACL,OAAO,CAAC;AAAA,IACR,aAAa,oBAAI,IAAI;AAAA,IACrB,SAAS,MAAM;AAAA,IACf,UAAU;AAAA,IACV,QAAQ,OAAO,cAAc;AAAA,MAC3B,SAAS;AAAA,QACP,EAAE,MAAM,QAAQ,MAAM,yCAAyC,QAAQ,GAAG;AAAA,MAC5E;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAGA,IAAM,YAAY;AAAA,EAChB,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,wBAAwB;AAC1B;AAEO,SAAS,mBACd,KACA,OAAsB,CAAC,GACjB;AACN,QAAM,WACJ,KAAK,YACL,IAAI;AAAA,IACF,gBAAgB,WAAW,WAAW,EAAE;AAAA,IACxC,gBAAgB,WAAW,SAAS,EAAE;AAAA,EACxC;AACF,QAAM,eACJ,KAAK,iBAAiB,CAAC,QAAwB,IAAI;AACrD,QAAM,QACJ,KAAK,UACJ,MAAM;AACL,QAAI;AACF,YAAM,QAAQ,gBAAgB,WAAW,WAAW,EAAE;AACtD,aAAO,IAAI,iBAAiB,KAAK;AAAA,IACnC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF,GAAG;AAEL,QAAM,cAAc,KAAK,eAAe,IAAI,gBAAgB;AAC5D,QAAM,aAAa,KAAK;AAExB,QAAM,qBAAqB,KAAK,sBAAsB;AAQtD,QAAM,yBAAyB,OAC7B,QACA,QACA,QACA,aACkC;AAClC,UAAM,OAAO,8BAA8B,QAAQ,QAAQ,MAAM;AACjE,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,mBAAmB,QAAQ,EAAE,aAAa,KAAK,GAAG,EAAE,SAAS,CAAC;AAAA,IACjF,QAAQ;AACN,YAAM,IAAI,0BAA0B,oCAAoC,MAAM,EAAE;AAAA,IAClF;AACA,UAAM,QAAQ,IAAI,IAAI,SAAS,IAAI,CAAC,UAAU,MAAM,GAAG,CAAC;AACxD,UAAM,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC;AACpD,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,6BAA6B,MAAM,KAAK,QAAQ,KAAK,IAAI,CAAC;AAAA,MAC5D;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,CAAC,UAA8B;AACjD,UAAM,UAAU,aAAa;AAC7B,UAAM,OAAO,gBAAgB,OAAO;AACpC,UAAM,IAAI,UAAU,gBAAgB,OAAO;AAAA,EAC7C;AAEA,QAAM,iBAAiB,OACrB,SACA,QACG;AACH,UAAM,SAAS,aAAa,OAAO;AACnC,UAAM,UAAU,MAAM,YAAY,WAAW,QAAQ,EAAE,UAAU,QAAQ,SAAS,CAAC;AAMnF,UAAM,kBAAkB,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;AAC9D,UAAM,cACJ,KAAK,kBACJ,CAAC,UAAU,cAAc,sBACxB,uBAAuB,UAAU,cAAc,EAAE,kBAAkB,CAAC;AACxE,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,YAAY,QAAQ,UAAU,QAAQ,eAAe;AACpE,UAAI,OAAO,UAAU;AAInB,YAAI;AAAA,UACF,EAAE,UAAU,QAAQ,SAAS;AAAA,UAC7B;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AAId,UAAI;AAAA,QACF,EAAE,UAAU,QAAQ,UAAU,KAAK,MAAM;AAAA,QACzC;AAAA,MACF;AACA,eAAS,mBAAmB;AAAA,IAC9B;AACA,UAAM,gBAAgB,iBAAiB,SAAS,OAAO,KAAK;AAC5D,UAAM,cAAc,IAAI,IAAI;AAAA,MAC1B,GAAG,gCAAgC,MAAM;AAAA,MACzC,GAAG,OAAO;AAAA,IACZ,CAAC;AACD,UAAM,QAAQ,MAAM,mBAAmB;AAAA,MACrC,YAAY,EAAE,cAAc,QAAQ,cAAc,MAAM,QAAQ,KAAK;AAAA,MACrE;AAAA,MACA,SAAS;AAAA,MACT;AAAA,MACA,QAAQ,OAAO,UAAU,SAAS;AAChC,cAAM,YAAY,KAAK,IAAI;AAC3B,cAAM,MAAM,SAAS,QAAQ,GAAG;AAChC,cAAM,cAAc,MAAM,IAAI,SAAS,MAAM,GAAG,GAAG,IAAI;AACvD,cAAM,cAAc,MAAM,IAAI,SAAS,MAAM,MAAM,CAAC,IAAI;AAExD,YAAI;AACJ,YAAI;AACJ,YAAI,YAAY;AACd,gBAAM,WAAW,MAAM,WAAW;AAAA,YAChC,gBAAgB,UAAU,eAAe;AAAA,YACzC,EAAE,YAAY,QAAQ,aAAa;AAAA,UACrC;AACA,oBAAU,SAAS;AACnB,yBAAe,SAAS,UACpB,SACA,SAAS,oBAAoB;AAAA,QACnC,OAAO;AACL,gBAAM,WAAW,YAAY,MAAM,QAAQ,cAAc,WAAW;AACpE,oBAAU,SAAS;AACnB,yBAAe,SAAS;AAAA,QAC1B;AACA,YAAI,CAAC,SAAS;AACZ,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ;AAAA,YACR,WAAW;AAAA,YACX,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,gBAAM,OAAO;AAAA,YACX,IAAI;AAAA,cACF,6BAA6B,gBAAgB,GAAI;AAAA,YACnD;AAAA,YACA,EAAE,SAAS,UAAU,aAAa;AAAA,UACpC;AAAA,QACF;AAEA,YAAI;AACF,gBAAM,iBAAiB,MAAM;AAAA,YAC3B;AAAA,YACA;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV;AACA,gBAAM,gBAAgB,OAAO,QAAQ,QAAQ,KAAK,CAAC,gBAAgB,IAAI,QAAQ;AAC/E,gBAAM,YAAqC;AAAA,YACzC,aAAa,QAAQ;AAAA,YACrB,cAAc,QAAQ;AAAA,YACtB,OAAO,QAAQ;AAAA,UACjB;AACA,gBAAM,SAAS,gBACX,MAAM,OAAO,OAAO,UAAU,MAAM;AAAA,YAClC,UAAU,QAAQ;AAAA,YAClB,WAAW,QAAQ;AAAA,YACnB,aAAa,QAAQ;AAAA,YACrB;AAAA,YACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,UAC7C,CAAC,IACD,MAAM,YAAY;AAAA,YAChB;AAAA,YACA;AAAA,cACE,UAAU,QAAQ;AAAA,cAClB,WAAW,QAAQ;AAAA,cACnB,aAAa,QAAQ;AAAA,cACrB;AAAA,YACF;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACJ,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ,OAAO,UAAU,UAAU;AAAA,YACnC,GAAI,OAAO,UAAU,EAAE,WAAW,kBAAkB,IAAI,CAAC;AAAA,YACzD,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,iBAAO;AAAA,QACT,SAAS,KAAK;AACZ,gBAAM,OACJ,eAAe,4BACX,UAAU,yBACV,eAAe,mBACb,UAAU,eACV,eAAe,sBACb,UAAU,mBACV,eAAe,kBACb,UAAU,oBACV,UAAU;AACtB,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ;AAAA,YACR,WACE,eAAe,4BACX,2BACA,eAAe,mBACb,iBACA,eAAe,sBACb,qBACA,eAAe,kBACb,sBACA;AAAA,YACZ,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,gBAAM,OAAO;AAAA,YACX,IAAI,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,YAC1D,EAAE,SAAS,KAAK;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT;AAEA,QAAM,oBAAoB,OACxB,SACA,UACG;AACH,gBAAY,KAAK;AACjB,UAAM,UAAU,MAAM,SAAS,QAAQ,cAAc,OAAO,CAAC;AAC7D,QAAI,CAAC,SAAS;AACZ,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,cAAc,CAAC;AAAA,IACxD;AAEA,UAAM,QAAQ,MAAM,eAAe,SAAS,QAAQ,GAAG;AACvD,UAAM,MAAM,OAAO,QAAQ,MAAM,SAAS;AAC1C,UAAM,OAAO;AACb,UAAM,QAAQ,MAAY;AACxB,WAAK,MAAM,UAAU,MAAM,EAAE,MAAM,MAAM,MAAS;AAClD,WAAK,MAAM,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,IACjD;AACA,UAAM,IAAI,KAAK,SAAS,KAAK;AAC7B,UAAM,MAAM,UAAU,cAAc,QAAQ,KAAK,MAAM,KAAK,QAAQ,IAAI;AAAA,EAC1E;AAEA,QAAM,mBAAmB,OACvB,UACA,UACG;AACH,UAAM,OAAO,SAAS,MAAM;AAC5B,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,EAC/D;AAEA,MAAI,KAAK,aAAa,iBAAiB;AAEvC,MAAI,KAAK,QAAQ,iBAAiB;AAClC,MAAI,KAAK,SAAS,iBAAiB;AACnC,MAAI,IAAI,QAAQ,gBAAgB;AAChC,MAAI,IAAI,SAAS,gBAAgB;AAKjC,MAAI,IAAI,aAAa,gBAAgB;AACrC,MAAI,IAAI,cAAc,gBAAgB;AACtC,MAAI,OAAO,aAAa,gBAAgB;AACxC,MAAI,OAAO,QAAQ,gBAAgB;AACnC,MAAI,OAAO,SAAS,gBAAgB;AAEtC;","names":[]}