@caelo-cms/mcp-server 0.10.27 → 0.10.29
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +13 -0
- package/dist/admin-server.d.ts +11 -0
- package/dist/admin-server.d.ts.map +1 -1
- package/dist/admin-server.js +16 -3
- package/dist/admin-server.js.map +1 -1
- package/dist/http.d.ts +0 -9
- package/dist/http.d.ts.map +1 -1
- package/dist/http.js +14 -1
- package/dist/http.js.map +1 -1
- package/dist/image-upload.d.ts.map +1 -1
- package/dist/image-upload.js +10 -3
- package/dist/image-upload.js.map +1 -1
- package/dist/ingress-auth.d.ts +27 -0
- package/dist/ingress-auth.d.ts.map +1 -0
- package/dist/ingress-auth.js +126 -0
- package/dist/ingress-auth.js.map +1 -0
- package/dist/server.d.ts +9 -0
- package/dist/server.d.ts.map +1 -1
- package/dist/server.js +12 -2
- package/dist/server.js.map +1 -1
- package/package.json +2 -1
package/README.md
CHANGED
|
@@ -42,6 +42,19 @@ with these env vars set:
|
|
|
42
42
|
|---|---|---|
|
|
43
43
|
| `CAELO_ADMIN_URL` | yes | `https://admin.example.com` — point at your install. |
|
|
44
44
|
| `CAELO_MCP_TOKEN` | yes | Bearer minted at `/security/mcp`. |
|
|
45
|
+
| `CAELO_IAP_SERVICE_ACCOUNT` | on GCP installs | The admin's MCP service account. `/security/mcp` includes it in the `claude mcp add` command when the admin is behind Google IAP. |
|
|
46
|
+
|
|
47
|
+
### Installs behind Google IAP (GCP)
|
|
48
|
+
|
|
49
|
+
On `gcp` and `gcp-firebase` installs the admin sits behind Identity-Aware Proxy, which rejects every request before Caelo sees it unless it carries a Google credential. With `CAELO_IAP_SERVICE_ACCOUNT` set, the server signs a short-lived JWT as that service account (IAM Credentials `signJwt`, using your Application Default Credentials) and sends it in `Authorization` next to `x-caelo-mcp-token`: IAP checks the first, Caelo the second.
|
|
50
|
+
|
|
51
|
+
One-time setup on your machine:
|
|
52
|
+
|
|
53
|
+
```bash
|
|
54
|
+
gcloud auth application-default login
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
The provisioner creates the service account (`caelo-mcp@<project>`), allowlists it on IAP and lets everyone on the IAP allowlist sign as it — on new installs via Pulumi, on existing ones during `cms-provision upgrade`. No service-account keys are involved.
|
|
45
58
|
|
|
46
59
|
## The `caelo_chat` tool
|
|
47
60
|
|
package/dist/admin-server.d.ts
CHANGED
|
@@ -1,6 +1,17 @@
|
|
|
1
|
+
import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
|
|
1
2
|
export interface StartAdminOpts {
|
|
2
3
|
readonly adminUrl: string;
|
|
3
4
|
readonly token: string;
|
|
5
|
+
/** Defaults to stdio; tests pass an in-memory transport. */
|
|
6
|
+
readonly transport?: Transport;
|
|
4
7
|
}
|
|
8
|
+
/**
|
|
9
|
+
* MCP `instructions` for the admin server (#552). Clients such as Claude
|
|
10
|
+
* Code put this into the agent's context on connect, so a freshly
|
|
11
|
+
* connected agent knows the session protocol without the operator
|
|
12
|
+
* pasting anything: without a session every write fails, without the
|
|
13
|
+
* context it works without the site's rules and brand voice.
|
|
14
|
+
*/
|
|
15
|
+
export declare const ADMIN_MCP_INSTRUCTIONS: string;
|
|
5
16
|
export declare function startAdminMcpServer(opts: StartAdminOpts): Promise<void>;
|
|
6
17
|
//# sourceMappingURL=admin-server.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"admin-server.d.ts","sourceRoot":"","sources":["../src/admin-server.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"admin-server.d.ts","sourceRoot":"","sources":["../src/admin-server.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAM/E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,QAMvB,CAAC;AAyEb,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAuI7E"}
|
package/dist/admin-server.js
CHANGED
|
@@ -27,6 +27,20 @@ import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprot
|
|
|
27
27
|
import { z } from "zod";
|
|
28
28
|
import { postAdmin, resolveTimeoutMs } from "./http.js";
|
|
29
29
|
import { UPLOAD_IMAGES_TOOL, uploadImages } from "./image-upload.js";
|
|
30
|
+
/**
|
|
31
|
+
* MCP `instructions` for the admin server (#552). Clients such as Claude
|
|
32
|
+
* Code put this into the agent's context on connect, so a freshly
|
|
33
|
+
* connected agent knows the session protocol without the operator
|
|
34
|
+
* pasting anything: without a session every write fails, without the
|
|
35
|
+
* context it works without the site's rules and brand voice.
|
|
36
|
+
*/
|
|
37
|
+
export const ADMIN_MCP_INSTRUCTIONS = [
|
|
38
|
+
"This server edits a Caelo CMS site. Before any other caelo tool:",
|
|
39
|
+
"1. Call caelo_open_session once (pass chatSessionId to resume an earlier session). Every write lands on that session's preview branch; nothing reaches the live site until the operator reviews and publishes in the Caelo admin.",
|
|
40
|
+
"2. Call caelo_get_context once and follow it: it carries the site model, tool playbook, staging rules, site memory (brand voice, glossary) and the skills index.",
|
|
41
|
+
"3. Load every skill the context marks ALWAYS APPLIES with load_skill before the work it covers (e.g. before writing any visitor-facing copy).",
|
|
42
|
+
"Tool errors name the next step to take; follow them instead of retrying unchanged.",
|
|
43
|
+
].join("\n");
|
|
30
44
|
const openSessionInput = z
|
|
31
45
|
.object({
|
|
32
46
|
title: z.string().min(1).max(200).optional(),
|
|
@@ -71,7 +85,7 @@ export async function startAdminMcpServer(opts) {
|
|
|
71
85
|
});
|
|
72
86
|
const remoteByName = new Map(catalogue.tools.map((t) => [t.name, t]));
|
|
73
87
|
let currentSession = null;
|
|
74
|
-
const server = new Server({ name: "caelo-admin-mcp", version: "0.1.0" }, { capabilities: { tools: {} } });
|
|
88
|
+
const server = new Server({ name: "caelo-admin-mcp", version: "0.1.0" }, { capabilities: { tools: {} }, instructions: ADMIN_MCP_INSTRUCTIONS });
|
|
75
89
|
server.setRequestHandler(ListToolsRequestSchema, async () => ({
|
|
76
90
|
tools: [
|
|
77
91
|
UPLOAD_IMAGES_TOOL,
|
|
@@ -178,8 +192,7 @@ export async function startAdminMcpServer(opts) {
|
|
|
178
192
|
return errorResult(`${name} failed: ${msg}`);
|
|
179
193
|
}
|
|
180
194
|
});
|
|
181
|
-
|
|
182
|
-
await server.connect(transport);
|
|
195
|
+
await server.connect(opts.transport ?? new StdioServerTransport());
|
|
183
196
|
}
|
|
184
197
|
function errorResult(text) {
|
|
185
198
|
return { isError: true, content: [{ type: "text", text }] };
|
package/dist/admin-server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"admin-server.js","sourceRoot":"","sources":["../src/admin-server.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;
|
|
1
|
+
{"version":3,"file":"admin-server.js","sourceRoot":"","sources":["../src/admin-server.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AASrE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,kEAAkE;IAClE,mOAAmO;IACnO,kKAAkK;IAClK,+IAA+I;IAC/I,oFAAoF;CACrF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAoCb,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,iBAAiB,GAAG;IACxB,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EACT,sGAAsG;QACtG,wGAAwG;QACxG,mGAAmG;QACnG,yEAAyE;IAC3E,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mDAAmD,EAAE;YAC3F,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4CAA4C,EAAE;YACrF,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,6DAA6D;aAC3E;SACF;KACF;CACO,CAAC;AAEX,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,mBAAmB;IACzB,WAAW,EACT,qGAAqG;QACrG,qGAAqG;QACrG,0FAA0F;IAC5F,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;CACvC,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAoB;IAC5D,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,SAAS,GAAG,MAAM,SAAS,CAA0B;QACzD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,EAAE;QACR,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtE,IAAI,cAAc,GAA+B,IAAI,CAAC;IAEtD,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,EAC7C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,sBAAsB,EAAE,CACtE,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE;YACL,kBAAkB;YAClB,iBAAiB;YACjB,gBAAgB;YAChB,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC,CAAC;SACJ;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,IAAI,KAAK,kBAAkB,CAAC,IAAI;gBAAE,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5F,IAAI,IAAI,KAAK,iBAAiB,CAAC,IAAI,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;gBACtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,OAAO,WAAW,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnE,CAAC;gBACD,cAAc,GAAG,MAAM,SAAS,CAAsB;oBACpD,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,IAAI,EAAE,kBAAkB;oBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC;iBACpC,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EACF,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;gCACvC,+EAA+E;gCAC/E,sDAAsD;yBACzD;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,KAAK,gBAAgB,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAqB;oBAClD,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,IAAI,EAAE,kBAAkB;oBACxB,IAAI,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE;oBACnC,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC;iBACpC,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE;wBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE;wBAC7C;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAC1D,IAAI,EACJ,CAAC,CACF;yBACF;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,WAAW,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,WAAW,CAChB,qFAAqF;oBACnF,qEAAqE,CACxE,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAsB;gBAClD,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE;oBACJ,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE;oBAChC,aAAa,EAAE,cAAc,CAAC,aAAa;iBAC5C;gBACD,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;YACH,OAAO;gBACL,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACvC,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE;oBACtC,GAAG,CAAC,MAAM,CAAC,KAAK;wBACd,CAAC,CAAC;4BACE;gCACE,IAAI,EAAE,OAAgB;gCACtB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;gCACzB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;6BACjC;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC9E,CAAC;qBACH;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,WAAW,CAAC,GAAG,IAAI,YAAY,GAAG,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAI/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC"}
|
package/dist/http.d.ts
CHANGED
|
@@ -1,12 +1,3 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Shared HTTP plumbing for both MCP surfaces (chat + admin). One POST
|
|
3
|
-
* per call against the admin install's /api/mcp/* endpoints, bearer in
|
|
4
|
-
* the `x-caelo-mcp-token` header, with an abortable client-side timeout.
|
|
5
|
-
*
|
|
6
|
-
* Timeouts default per call site (chat 30s, tool execution 120s — bulk
|
|
7
|
-
* ops and media imports legitimately run long) and can be overridden
|
|
8
|
-
* globally via `CAELO_MCP_TIMEOUT_MS`.
|
|
9
|
-
*/
|
|
10
1
|
export interface AdminPostOpts {
|
|
11
2
|
readonly adminUrl: string;
|
|
12
3
|
readonly token: string;
|
package/dist/http.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAK1D;AAED,wBAAsB,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,CAgClE"}
|
package/dist/http.js
CHANGED
|
@@ -1,4 +1,16 @@
|
|
|
1
1
|
// SPDX-License-Identifier: MPL-2.0
|
|
2
|
+
/**
|
|
3
|
+
* Shared HTTP plumbing for both MCP surfaces (chat + admin). One POST
|
|
4
|
+
* per call against the admin install's /api/mcp/* endpoints, bearer in
|
|
5
|
+
* the `x-caelo-mcp-token` header, with an abortable client-side timeout.
|
|
6
|
+
* On IAP-protected installs the IAP credential rides along in
|
|
7
|
+
* `authorization` (see ingress-auth.ts).
|
|
8
|
+
*
|
|
9
|
+
* Timeouts default per call site (chat 30s, tool execution 120s — bulk
|
|
10
|
+
* ops and media imports legitimately run long) and can be overridden
|
|
11
|
+
* globally via `CAELO_MCP_TIMEOUT_MS`.
|
|
12
|
+
*/
|
|
13
|
+
import { describeIapRejection, ingressHeaders } from "./ingress-auth.js";
|
|
2
14
|
/** The per-call default unless the operator set `CAELO_MCP_TIMEOUT_MS`. */
|
|
3
15
|
export function resolveTimeoutMs(defaultMs) {
|
|
4
16
|
const raw = process.env.CAELO_MCP_TIMEOUT_MS;
|
|
@@ -15,6 +27,7 @@ export async function postAdmin(opts) {
|
|
|
15
27
|
const res = await fetch(url, {
|
|
16
28
|
method: "POST",
|
|
17
29
|
headers: {
|
|
30
|
+
...(await ingressHeaders()),
|
|
18
31
|
"content-type": "application/json",
|
|
19
32
|
"x-caelo-mcp-token": opts.token,
|
|
20
33
|
},
|
|
@@ -23,7 +36,7 @@ export async function postAdmin(opts) {
|
|
|
23
36
|
});
|
|
24
37
|
if (!res.ok) {
|
|
25
38
|
const body = await safeText(res);
|
|
26
|
-
throw new Error(`HTTP ${res.status}: ${body || res.statusText}`);
|
|
39
|
+
throw new Error(describeIapRejection(res, body) ?? `HTTP ${res.status}: ${body || res.statusText}`);
|
|
27
40
|
}
|
|
28
41
|
return (await res.json());
|
|
29
42
|
}
|
package/dist/http.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,mCAAmC;
|
|
1
|
+
{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAWzE,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAI,IAAmB;IACpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,CAAC,MAAM,cAAc,EAAE,CAAC;gBAC3B,cAAc,EAAE,kBAAkB;gBAClC,mBAAmB,EAAE,IAAI,CAAC,KAAK;aAChC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,QAAQ,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CACnF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,CAAC,SAAS,GAAG,IAAI,wCAAwC,CAC/E,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"image-upload.d.ts","sourceRoot":"","sources":["../src/image-upload.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"image-upload.d.ts","sourceRoot":"","sources":["../src/image-upload.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,wFAAwF;AACxF,eAAO,MAAM,mBAAmB;;;;;;;;;kBAMrB,CAAC;AAoBZ,oFAAoF;AACpF,eAAO,MAAM,iBAAiB;;;;;;;;kBAAmE,CAAC;AAElG,yEAAyE;AACzE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4C9B,CAAC;AAEF,gGAAgG;AAChG,wBAAsB,YAAY,CAAC,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,OAAO;;;;;;GA4E3F"}
|
package/dist/image-upload.js
CHANGED
|
@@ -5,6 +5,7 @@ import { open } from "node:fs/promises";
|
|
|
5
5
|
import { basename } from "node:path";
|
|
6
6
|
import { z } from "zod";
|
|
7
7
|
import { resolveTimeoutMs } from "./http.js";
|
|
8
|
+
import { describeIapRejection, ingressHeaders } from "./ingress-auth.js";
|
|
8
9
|
const MAX_BYTES = 5 * 1024 * 1024;
|
|
9
10
|
/** Uploaded media references accepted by caelo_chat; never accept object-store keys. */
|
|
10
11
|
export const uploadedImageSchema = z
|
|
@@ -118,12 +119,18 @@ export async function uploadImages(opts, input) {
|
|
|
118
119
|
query.set("visibility", "reference");
|
|
119
120
|
const response = await fetch(`${opts.adminUrl.replace(/\/+$/, "")}/api/mcp/images?${query}`, {
|
|
120
121
|
method: "POST",
|
|
121
|
-
headers: {
|
|
122
|
+
headers: {
|
|
123
|
+
...(await ingressHeaders()),
|
|
124
|
+
"x-caelo-mcp-token": opts.token,
|
|
125
|
+
"content-type": "application/octet-stream",
|
|
126
|
+
},
|
|
122
127
|
body: new Uint8Array(bytes),
|
|
123
128
|
signal: AbortSignal.timeout(resolveTimeoutMs(120_000)),
|
|
124
129
|
});
|
|
125
|
-
if (!response.ok)
|
|
126
|
-
|
|
130
|
+
if (!response.ok) {
|
|
131
|
+
const text = await response.text();
|
|
132
|
+
throw new Error(describeIapRejection(response, text) ?? `HTTP ${response.status}: ${text.slice(0, 500)}`);
|
|
133
|
+
}
|
|
127
134
|
const value = (await response.json());
|
|
128
135
|
const attachment = uploadedImageSchema.parse({
|
|
129
136
|
assetId: value.assetId,
|
package/dist/image-upload.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"image-upload.js","sourceRoot":"","sources":["../src/image-upload.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC,mEAAmE;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"image-upload.js","sourceRoot":"","sources":["../src/image-upload.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC,mEAAmE;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEzE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAClC,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACpE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;SACjC,KAAK,CAAC,kEAAkE,CAAC;SACzE,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAC9D,0CAA0C,CAC3C,CAAC;AACJ,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAElG,yEAAyE;AACzE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACT,oFAAoF;QACpF,+GAA+G;QAC/G,mHAAmH;QACnH,sGAAsG;QACtG,qCAAqC;QACrC,yFAAyF;QACzF,yGAAyG;IAC3G,WAAW,EAAE;QACX,IAAI,EAAE,QAAiB;QACvB,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,oBAAoB,EAAE,KAAK;QAC3B,UAAU,EAAE;YACV,MAAM,EAAE;gBACN,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,CAAC;gBACX,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,oBAAoB,EAAE,KAAK;oBAC3B,UAAU,EAAE;wBACV,QAAQ,EAAE;4BACR,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,iEAAiE;yBAC/E;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,8DAA8D;yBAC5E;wBACD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE;wBACrE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oCAAoC,EAAE;wBAC1E,SAAS,EAAE;4BACT,IAAI,EAAE,SAAS;4BACf,WAAW,EACT,sFAAsF;yBACzF;qBACF;oBACD,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;iBAC9D;aACF;SACF;KACF;CACF,CAAC;AAEF,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAyC,EAAE,KAAc;IAC1F,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,OAAO,GAGT,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,IAAI,KAAiB,CAAC;YACtB,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;gBACnF,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,SAAS;wBAC5D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;oBAC/D,0DAA0D;oBAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;oBAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;oBACd,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;wBAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;wBAClF,IAAI,CAAC,SAAS;4BAAE,MAAM;wBACtB,KAAK,IAAI,SAAS,CAAC;oBACrB,CAAC;oBACD,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACpC,CAAC;wBAAS,CAAC;oBACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBACvE,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;gBAC3C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACzF,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChD,IAAI,KAAK,CAAC,GAAG;gBAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,KAAK,EAAE,EAAE;gBAC3F,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,GAAG,CAAC,MAAM,cAAc,EAAE,CAAC;oBAC3B,mBAAmB,EAAE,IAAI,CAAC,KAAK;oBAC/B,cAAc,EAAE,0BAA0B;iBAC3C;gBACD,IAAI,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC;gBAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,QAAQ,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACzF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YACjE,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC;gBAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,QAAQ;aAC3B,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO;oBACP,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;iBAC/E,CAAC;aACH;SACF;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
export interface IngressAuth {
|
|
2
|
+
/** Extra request headers that get the request through IAP. */
|
|
3
|
+
headers(): Promise<Record<string, string>>;
|
|
4
|
+
readonly serviceAccount: string;
|
|
5
|
+
}
|
|
6
|
+
export interface IngressAuthDeps {
|
|
7
|
+
/** OAuth access token of the operator's Application Default Credentials. */
|
|
8
|
+
getAccessToken?: () => Promise<string>;
|
|
9
|
+
fetch?: typeof fetch;
|
|
10
|
+
/** Seconds since epoch. */
|
|
11
|
+
now?: () => number;
|
|
12
|
+
}
|
|
13
|
+
/** `https://admin.example.com/anything` → `https://admin.example.com/*` (the JWT `aud`). */
|
|
14
|
+
export declare function iapAudience(adminUrl: string): string;
|
|
15
|
+
export declare function createIngressAuth(env: {
|
|
16
|
+
readonly CAELO_IAP_SERVICE_ACCOUNT?: string;
|
|
17
|
+
readonly CAELO_ADMIN_URL?: string;
|
|
18
|
+
}, deps?: IngressAuthDeps): IngressAuth | null;
|
|
19
|
+
/** Ingress headers for this process, configured from `process.env` on first use. */
|
|
20
|
+
export declare function ingressHeaders(): Promise<Record<string, string>>;
|
|
21
|
+
/**
|
|
22
|
+
* Turns IAP's own rejection (`x-goog-iap-generated-response: true`) into an
|
|
23
|
+
* actionable message — otherwise the operator only sees "Invalid IAP
|
|
24
|
+
* credentials: empty token" and has no idea which knob to turn.
|
|
25
|
+
*/
|
|
26
|
+
export declare function describeIapRejection(res: Response, body: string): string | null;
|
|
27
|
+
//# sourceMappingURL=ingress-auth.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ingress-auth.d.ts","sourceRoot":"","sources":["../src/ingress-auth.ts"],"names":[],"mappings":"AAgCA,MAAM,WAAW,WAAW;IAC1B,8DAA8D;IAC9D,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,2BAA2B;IAC3B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AASD,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE;IAAE,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,EACvF,IAAI,GAAE,eAAoB,GACzB,WAAW,GAAG,IAAI,CAqEpB;AAID,oFAAoF;AACpF,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAOtE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM/E"}
|
|
@@ -0,0 +1,126 @@
|
|
|
1
|
+
// SPDX-License-Identifier: MPL-2.0
|
|
2
|
+
/**
|
|
3
|
+
* IAP ingress for GCP installs (issue #37).
|
|
4
|
+
*
|
|
5
|
+
* On `gcp` / `gcp-firebase` installs the admin app sits behind Google
|
|
6
|
+
* Identity-Aware Proxy. IAP rejects every request that doesn't carry a
|
|
7
|
+
* Google-signed credential BEFORE Caelo's own `x-caelo-mcp-token` check
|
|
8
|
+
* runs, so the shim has to satisfy both gates: IAP first, Caelo second
|
|
9
|
+
* (CLAUDE.md §11.B — IAP stays the first line of defense).
|
|
10
|
+
*
|
|
11
|
+
* Cloud Run native IAP uses a Google-managed OAuth client, which does not
|
|
12
|
+
* allow programmatic access with user tokens. What it does accept is a
|
|
13
|
+
* JWT signed by an allowlisted service account (Google's documented
|
|
14
|
+
* "service account JWT" path): `iss`/`sub` = the SA, `aud` = the admin
|
|
15
|
+
* origin with a path wildcard, signed via the IAM Credentials `signJwt`
|
|
16
|
+
* API. The provisioner creates that SA (`caelo-mcp@<project>`), allowlists
|
|
17
|
+
* it on IAP and lets every IAP-allowlisted operator impersonate it, so the
|
|
18
|
+
* operator's own `gcloud auth application-default login` is all the shim
|
|
19
|
+
* needs — no service-account keys on laptops (CLAUDE.md §11.C).
|
|
20
|
+
*
|
|
21
|
+
* Active only when `CAELO_IAP_SERVICE_ACCOUNT` is set (the admin's
|
|
22
|
+
* /security/mcp page puts it into the `claude mcp add` command on IAP
|
|
23
|
+
* installs); otherwise requests go out exactly as before.
|
|
24
|
+
*/
|
|
25
|
+
import { GoogleAuth } from "google-auth-library";
|
|
26
|
+
/** Signed JWTs live at most 1 hour; refresh a minute before expiry. */
|
|
27
|
+
const TOKEN_LIFETIME_S = 3600;
|
|
28
|
+
const REFRESH_MARGIN_S = 60;
|
|
29
|
+
/** `https://admin.example.com/anything` → `https://admin.example.com/*` (the JWT `aud`). */
|
|
30
|
+
export function iapAudience(adminUrl) {
|
|
31
|
+
return `${new URL(adminUrl).origin}/*`;
|
|
32
|
+
}
|
|
33
|
+
async function adcAccessToken() {
|
|
34
|
+
const auth = new GoogleAuth({ scopes: ["https://www.googleapis.com/auth/cloud-platform"] });
|
|
35
|
+
const token = await auth.getAccessToken();
|
|
36
|
+
if (!token)
|
|
37
|
+
throw new Error("Application Default Credentials returned no access token");
|
|
38
|
+
return token;
|
|
39
|
+
}
|
|
40
|
+
export function createIngressAuth(env, deps = {}) {
|
|
41
|
+
const configured = env.CAELO_IAP_SERVICE_ACCOUNT?.trim();
|
|
42
|
+
if (!configured)
|
|
43
|
+
return null;
|
|
44
|
+
const serviceAccount = configured;
|
|
45
|
+
if (!env.CAELO_ADMIN_URL)
|
|
46
|
+
throw new Error("CAELO_IAP_SERVICE_ACCOUNT is set but CAELO_ADMIN_URL is not");
|
|
47
|
+
const audience = iapAudience(env.CAELO_ADMIN_URL);
|
|
48
|
+
const getAccessToken = deps.getAccessToken ?? adcAccessToken;
|
|
49
|
+
const doFetch = deps.fetch ?? fetch;
|
|
50
|
+
const now = deps.now ?? (() => Math.floor(Date.now() / 1000));
|
|
51
|
+
let cached = null;
|
|
52
|
+
let inflight = null;
|
|
53
|
+
async function mint() {
|
|
54
|
+
const iat = now();
|
|
55
|
+
const exp = iat + TOKEN_LIFETIME_S;
|
|
56
|
+
let accessToken;
|
|
57
|
+
try {
|
|
58
|
+
accessToken = await getAccessToken();
|
|
59
|
+
}
|
|
60
|
+
catch (e) {
|
|
61
|
+
throw new Error(`IAP: no Google credentials for signing the access token (${e instanceof Error ? e.message : String(e)}). ` +
|
|
62
|
+
"Run `gcloud auth application-default login` with an account that is allowed on this Caelo install.");
|
|
63
|
+
}
|
|
64
|
+
const res = await doFetch(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(serviceAccount)}:signJwt`, {
|
|
65
|
+
method: "POST",
|
|
66
|
+
headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" },
|
|
67
|
+
body: JSON.stringify({
|
|
68
|
+
payload: JSON.stringify({
|
|
69
|
+
iss: serviceAccount,
|
|
70
|
+
sub: serviceAccount,
|
|
71
|
+
aud: audience,
|
|
72
|
+
iat,
|
|
73
|
+
exp,
|
|
74
|
+
}),
|
|
75
|
+
}),
|
|
76
|
+
});
|
|
77
|
+
if (!res.ok) {
|
|
78
|
+
const detail = await res.text().catch(() => "");
|
|
79
|
+
throw new Error(`IAP: could not sign an access token as ${serviceAccount} (HTTP ${res.status}). ` +
|
|
80
|
+
"Your Google account needs roles/iam.serviceAccountTokenCreator on that service account — " +
|
|
81
|
+
"`cms-provision upgrade` grants it to every IAP-allowlisted user. " +
|
|
82
|
+
detail.slice(0, 300));
|
|
83
|
+
}
|
|
84
|
+
const { signedJwt } = (await res.json());
|
|
85
|
+
if (!signedJwt)
|
|
86
|
+
throw new Error("IAP: signJwt response carried no signedJwt");
|
|
87
|
+
cached = { jwt: signedJwt, exp };
|
|
88
|
+
return signedJwt;
|
|
89
|
+
}
|
|
90
|
+
return {
|
|
91
|
+
serviceAccount,
|
|
92
|
+
async headers() {
|
|
93
|
+
if (!cached || cached.exp - REFRESH_MARGIN_S <= now()) {
|
|
94
|
+
inflight ??= mint().finally(() => {
|
|
95
|
+
inflight = null;
|
|
96
|
+
});
|
|
97
|
+
await inflight;
|
|
98
|
+
}
|
|
99
|
+
return { authorization: `Bearer ${cached.jwt}` };
|
|
100
|
+
},
|
|
101
|
+
};
|
|
102
|
+
}
|
|
103
|
+
let processIngress;
|
|
104
|
+
/** Ingress headers for this process, configured from `process.env` on first use. */
|
|
105
|
+
export async function ingressHeaders() {
|
|
106
|
+
if (processIngress === undefined)
|
|
107
|
+
processIngress = createIngressAuth({
|
|
108
|
+
CAELO_IAP_SERVICE_ACCOUNT: process.env.CAELO_IAP_SERVICE_ACCOUNT,
|
|
109
|
+
CAELO_ADMIN_URL: process.env.CAELO_ADMIN_URL,
|
|
110
|
+
});
|
|
111
|
+
return processIngress ? processIngress.headers() : {};
|
|
112
|
+
}
|
|
113
|
+
/**
|
|
114
|
+
* Turns IAP's own rejection (`x-goog-iap-generated-response: true`) into an
|
|
115
|
+
* actionable message — otherwise the operator only sees "Invalid IAP
|
|
116
|
+
* credentials: empty token" and has no idea which knob to turn.
|
|
117
|
+
*/
|
|
118
|
+
export function describeIapRejection(res, body) {
|
|
119
|
+
if (res.headers.get("x-goog-iap-generated-response") !== "true")
|
|
120
|
+
return null;
|
|
121
|
+
const configured = Boolean(process.env.CAELO_IAP_SERVICE_ACCOUNT?.trim());
|
|
122
|
+
return configured
|
|
123
|
+
? `HTTP ${res.status} from Google IAP: ${body.trim()} — the service account in CAELO_IAP_SERVICE_ACCOUNT is not allowed on this install's IAP. Run \`cms-provision upgrade\` (it allowlists the MCP service account) or check the value against /security/mcp.`
|
|
124
|
+
: `HTTP ${res.status} from Google IAP: ${body.trim()} — this admin is protected by Google IAP. Copy the \`claude mcp add\` command from /security/mcp again (it includes CAELO_IAP_SERVICE_ACCOUNT on IAP installs) and run \`gcloud auth application-default login\`.`;
|
|
125
|
+
}
|
|
126
|
+
//# sourceMappingURL=ingress-auth.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"ingress-auth.js","sourceRoot":"","sources":["../src/ingress-auth.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAgB5B,4FAA4F;AAC5F,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,IAAI,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,gDAAgD,CAAC,EAAE,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAuF,EACvF,OAAwB,EAAE;IAE1B,MAAM,UAAU,GAAG,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,cAAc,GAAW,UAAU,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,eAAe;QACtB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAE9D,IAAI,MAAM,GAAwC,IAAI,CAAC;IACvD,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAE5C,KAAK,UAAU,IAAI;QACjB,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,GAAG,gBAAgB,CAAC;QACnC,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,cAAc,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,4DAA4D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;gBACzG,oGAAoG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,uEAAuE,kBAAkB,CAAC,cAAc,CAAC,UAAU,EACnH;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACvF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;oBACtB,GAAG,EAAE,cAAc;oBACnB,GAAG,EAAE,cAAc;oBACnB,GAAG,EAAE,QAAQ;oBACb,GAAG;oBACH,GAAG;iBACJ,CAAC;aACH,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,0CAA0C,cAAc,UAAU,GAAG,CAAC,MAAM,KAAK;gBAC/E,2FAA2F;gBAC3F,mEAAmE;gBACnE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CACvB,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;QACnE,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC9E,MAAM,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,cAAc;QACd,KAAK,CAAC,OAAO;YACX,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,GAAG,gBAAgB,IAAI,GAAG,EAAE,EAAE,CAAC;gBACtD,QAAQ,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC/B,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC,CAAC,CAAC;gBACH,MAAM,QAAQ,CAAC;YACjB,CAAC;YACD,OAAO,EAAE,aAAa,EAAE,UAAW,MAA0B,CAAC,GAAG,EAAE,EAAE,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,IAAI,cAA8C,CAAC;AAEnD,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,cAAc,KAAK,SAAS;QAC9B,cAAc,GAAG,iBAAiB,CAAC;YACjC,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;YAChE,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;SAC7C,CAAC,CAAC;IACL,OAAO,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAa,EAAE,IAAY;IAC9D,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,OAAO,UAAU;QACf,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,qBAAqB,IAAI,CAAC,IAAI,EAAE,2MAA2M;QAC/P,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,qBAAqB,IAAI,CAAC,IAAI,EAAE,mNAAmN,CAAC;AAC5Q,CAAC"}
|
package/dist/server.d.ts
CHANGED
|
@@ -1,6 +1,15 @@
|
|
|
1
|
+
import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
|
|
1
2
|
export interface StartOpts {
|
|
2
3
|
readonly adminUrl: string;
|
|
3
4
|
readonly token: string;
|
|
5
|
+
/** Defaults to stdio; tests pass an in-memory transport. */
|
|
6
|
+
readonly transport?: Transport;
|
|
4
7
|
}
|
|
8
|
+
/**
|
|
9
|
+
* MCP `instructions` for the chat-scope server (#552), injected into the
|
|
10
|
+
* connecting agent's context so it uses caelo_chat as a conversation with
|
|
11
|
+
* the site's own agent rather than a one-shot command.
|
|
12
|
+
*/
|
|
13
|
+
export declare const CHAT_MCP_INSTRUCTIONS: string;
|
|
5
14
|
export declare function startMcpServer(opts: StartOpts): Promise<void>;
|
|
6
15
|
//# sourceMappingURL=server.d.ts.map
|
package/dist/server.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAM/E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAItB,CAAC;AAWb,wBAAsB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA+GnE"}
|
package/dist/server.js
CHANGED
|
@@ -14,6 +14,16 @@ import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprot
|
|
|
14
14
|
import { z } from "zod";
|
|
15
15
|
import { sendChat } from "./chat-bridge.js";
|
|
16
16
|
import { UPLOAD_IMAGES_TOOL, uploadedImageSchema, uploadImages } from "./image-upload.js";
|
|
17
|
+
/**
|
|
18
|
+
* MCP `instructions` for the chat-scope server (#552), injected into the
|
|
19
|
+
* connecting agent's context so it uses caelo_chat as a conversation with
|
|
20
|
+
* the site's own agent rather than a one-shot command.
|
|
21
|
+
*/
|
|
22
|
+
export const CHAT_MCP_INSTRUCTIONS = [
|
|
23
|
+
"This server talks to a Caelo CMS site's own AI agent through caelo_chat; describe the outcome you want and the agent decides how to build it.",
|
|
24
|
+
"Pass the chatSessionId from a reply to continue the same conversation; omit it only to start a new one.",
|
|
25
|
+
"Changes land on that chat's preview branch; nothing reaches the live site until the operator publishes in the Caelo admin. Some actions wait for the operator's approval click there.",
|
|
26
|
+
].join("\n");
|
|
17
27
|
const caeloChatInputSchema = z
|
|
18
28
|
.object({
|
|
19
29
|
attachments: z.array(uploadedImageSchema).max(4).optional(),
|
|
@@ -28,6 +38,7 @@ export async function startMcpServer(opts) {
|
|
|
28
38
|
version: "0.1.0",
|
|
29
39
|
}, {
|
|
30
40
|
capabilities: { tools: {} },
|
|
41
|
+
instructions: CHAT_MCP_INSTRUCTIONS,
|
|
31
42
|
});
|
|
32
43
|
server.setRequestHandler(ListToolsRequestSchema, async () => ({
|
|
33
44
|
tools: [
|
|
@@ -120,7 +131,6 @@ export async function startMcpServer(opts) {
|
|
|
120
131
|
};
|
|
121
132
|
}
|
|
122
133
|
});
|
|
123
|
-
|
|
124
|
-
await server.connect(transport);
|
|
134
|
+
await server.connect(opts.transport ?? new StdioServerTransport());
|
|
125
135
|
}
|
|
126
136
|
//# sourceMappingURL=server.js.map
|
package/dist/server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;
|
|
1
|
+
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAS1F;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,+IAA+I;IAC/I,yGAAyG;IACzG,uLAAuL;CACxL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAe;IAClD,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,OAAO;KACjB,EACD;QACE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3B,YAAY,EAAE,qBAAqB;KACpC,CACF,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE;YACL,kBAAkB;YAClB;gBACE,IAAI,EAAE,YAAY;gBAClB,WAAW,EACT,wVAAwV;gBAC1V,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,CAAC,SAAS,CAAC;oBACrB,UAAU,EAAE;wBACV,WAAW,EAAE;4BACX,IAAI,EAAE,OAAO;4BACb,QAAQ,EAAE,CAAC;4BACX,WAAW,EAAE,8CAA8C;4BAC3D,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,mBAAmB,CAAC;yBAC3C;wBACD,OAAO,EAAE;4BACP,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,0CAA0C;yBACxD;wBACD,aAAa,EAAE;4BACb,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,mFAAmF;yBACtF;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,sHAAsH;yBACzH;qBACF;iBACF;aACF;SACF;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACrC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;aACtE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;aAChF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;gBAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;gBAC5B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YACH,6DAA6D;YAC7D,uDAAuD;YACvD,kDAAkD;YAClD,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE;oBACxC;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;4BACE,aAAa,EAAE,MAAM,CAAC,aAAa;4BACnC,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;4BACzC,cAAc,EAAE,MAAM,CAAC,cAAc;yBACtC,EACD,IAAI,EACJ,CAAC,CACF;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,GAAG,EAAE,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACrE,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@caelo-cms/mcp-server",
|
|
3
|
-
"version": "0.10.
|
|
3
|
+
"version": "0.10.29",
|
|
4
4
|
"private": false,
|
|
5
5
|
"license": "MPL-2.0",
|
|
6
6
|
"description": "MCP servers for Caelo CMS: `caelo_chat` (talk to Caelo's own AI) and the admin-scoped Power-MCP (the full chat-runner tool catalogue, driven by your own agent). Lets Claude Code (or any MCP-aware client) drive a Caelo install from outside the browser.",
|
|
@@ -37,6 +37,7 @@
|
|
|
37
37
|
},
|
|
38
38
|
"dependencies": {
|
|
39
39
|
"@modelcontextprotocol/sdk": "1.31.0",
|
|
40
|
+
"google-auth-library": "11.1.0",
|
|
40
41
|
"zod": "4.6.5"
|
|
41
42
|
},
|
|
42
43
|
"publishConfig": {
|