@cat-factory/server 0.262.0 → 0.263.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/agents/toolServers.d.ts.map +1 -1
- package/dist/agents/toolServers.js +62 -23
- package/dist/agents/toolServers.js.map +1 -1
- package/dist/modules/persistence/PersistenceController.d.ts.map +1 -1
- package/dist/modules/persistence/PersistenceController.js +59 -0
- package/dist/modules/persistence/PersistenceController.js.map +1 -1
- package/dist/modules/publicApi/PublicSpecController.d.ts.map +1 -1
- package/dist/modules/publicApi/PublicSpecController.js +90 -8
- package/dist/modules/publicApi/PublicSpecController.js.map +1 -1
- package/dist/modules/publicApi/openapiDocument.generated.d.ts +1 -1
- package/dist/modules/publicApi/openapiDocument.generated.d.ts.map +1 -1
- package/dist/modules/publicApi/openapiDocument.generated.js +1 -1
- package/dist/modules/publicApi/openapiDocument.generated.js.map +1 -1
- package/dist/modules/publicApi/specProjection.d.ts +17 -1
- package/dist/modules/publicApi/specProjection.d.ts.map +1 -1
- package/dist/modules/publicApi/specProjection.js +39 -9
- package/dist/modules/publicApi/specProjection.js.map +1 -1
- package/dist/modules/toolServers/mcpOAuthRedirect.d.ts +4 -2
- package/dist/modules/toolServers/mcpOAuthRedirect.d.ts.map +1 -1
- package/dist/modules/toolServers/mcpOAuthRedirect.js +4 -2
- package/dist/modules/toolServers/mcpOAuthRedirect.js.map +1 -1
- package/dist/modules/toolServers/probeToolServer.d.ts.map +1 -1
- package/dist/modules/toolServers/probeToolServer.js +32 -7
- package/dist/modules/toolServers/probeToolServer.js.map +1 -1
- package/dist/persistence/rpc-allowlist.d.ts.map +1 -1
- package/dist/persistence/rpc-allowlist.js +86 -31
- package/dist/persistence/rpc-allowlist.js.map +1 -1
- package/dist/persistence/rpc-scope.logic.d.ts +24 -1
- package/dist/persistence/rpc-scope.logic.d.ts.map +1 -1
- package/dist/persistence/rpc-scope.logic.js +62 -0
- package/dist/persistence/rpc-scope.logic.js.map +1 -1
- package/dist/persistence/rpc.d.ts +79 -0
- package/dist/persistence/rpc.d.ts.map +1 -1
- package/dist/persistence/rpc.js +17 -1
- package/dist/persistence/rpc.js.map +1 -1
- package/package.json +8 -8
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"openapiDocument.generated.js","sourceRoot":"","sources":["../../../src/modules/publicApi/openapiDocument.generated.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,8EAA8E;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG,
|
|
1
|
+
{"version":3,"file":"openapiDocument.generated.js","sourceRoot":"","sources":["../../../src/modules/publicApi/openapiDocument.generated.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,8FAA8F;AAC9F,8EAA8E;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG,4hwjBAA4hwjB,CAAA"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { type PublicServiceSpec, type PublicSpecAnchor, type PublicSpecProvenance, type ServiceSpecView } from '@cat-factory/contracts';
|
|
1
|
+
import { type PublicRunSpec, type PublicServiceSpec, type PublicSpecAnchor, type PublicSpecProvenance, type ServiceSpecView } from '@cat-factory/contracts';
|
|
2
2
|
/**
|
|
3
3
|
* Project a read view onto the wire, under `anchor`.
|
|
4
4
|
*
|
|
@@ -8,4 +8,20 @@ import { type PublicServiceSpec, type PublicSpecAnchor, type PublicSpecProvenanc
|
|
|
8
8
|
* make.
|
|
9
9
|
*/
|
|
10
10
|
export declare function toPublicServiceSpec(serviceId: string, anchor: PublicSpecAnchor, view: ServiceSpecView, provenance: PublicSpecProvenance): PublicServiceSpec;
|
|
11
|
+
/**
|
|
12
|
+
* Project a RUN's read onto the wire. `view`/`provenance` are null exactly for `not_read`, the one
|
|
13
|
+
* anchor state that describes the run rather than the branch.
|
|
14
|
+
*
|
|
15
|
+
* They travel together for that reason: an anchor of `not_read` with a provenance would name a
|
|
16
|
+
* branch nothing was read from, and any other anchor without one would serve a tree that cannot say
|
|
17
|
+
* where it came from. The signature makes both unrepresentable rather than leaving it to the caller
|
|
18
|
+
* to pair them correctly.
|
|
19
|
+
*/
|
|
20
|
+
export declare function toPublicRunSpec(runId: string, read: {
|
|
21
|
+
anchor: PublicSpecAnchor;
|
|
22
|
+
view: ServiceSpecView;
|
|
23
|
+
provenance: PublicSpecProvenance;
|
|
24
|
+
} | {
|
|
25
|
+
anchor: 'not_read';
|
|
26
|
+
}): PublicRunSpec;
|
|
11
27
|
//# sourceMappingURL=specProjection.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"specProjection.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/specProjection.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EAIzB,KAAK,eAAe,EAGrB,MAAM,wBAAwB,CAAA;
|
|
1
|
+
{"version":3,"file":"specProjection.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/specProjection.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EAIzB,KAAK,eAAe,EAGrB,MAAM,wBAAwB,CAAA;AAoN/B;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,oBAAoB,GAC/B,iBAAiB,CAEnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,IAAI,EACA;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,UAAU,EAAE,oBAAoB,CAAA;CAAE,GACrF;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACzB,aAAa,CAaf"}
|
|
@@ -162,14 +162,13 @@ function capIssues(issues) {
|
|
|
162
162
|
};
|
|
163
163
|
}
|
|
164
164
|
/**
|
|
165
|
-
*
|
|
165
|
+
* The bounded body of one read view, shared by both spec endpoints.
|
|
166
166
|
*
|
|
167
|
-
*
|
|
168
|
-
*
|
|
169
|
-
*
|
|
170
|
-
* make.
|
|
167
|
+
* One function rather than one per endpoint, because the caps are a property of the DOCUMENT and
|
|
168
|
+
* the two endpoints serve one document at two refs. A second copy is how the run read would come
|
|
169
|
+
* to bound the Gherkin differently from the service read of the same repository.
|
|
171
170
|
*/
|
|
172
|
-
|
|
171
|
+
function specBody(view) {
|
|
173
172
|
const capped = view.spec ? capTree(view.spec) : { spec: null, truncations: [] };
|
|
174
173
|
const features = capFeatures(view.features);
|
|
175
174
|
// An absent `diagnostics` means the producer diagnosed nothing, which on this path cannot
|
|
@@ -177,13 +176,44 @@ export function toPublicServiceSpec(serviceId, anchor, view, provenance) {
|
|
|
177
176
|
// throw on a view assembled by hand.
|
|
178
177
|
const issues = capIssues(view.diagnostics?.issues ?? []);
|
|
179
178
|
return {
|
|
180
|
-
serviceId,
|
|
181
|
-
anchor,
|
|
182
179
|
spec: capped.spec,
|
|
183
180
|
features: features.features,
|
|
184
|
-
provenance,
|
|
185
181
|
issues: issues.issues,
|
|
186
182
|
truncations: [...capped.truncations, ...features.truncations, ...issues.truncations],
|
|
187
183
|
};
|
|
188
184
|
}
|
|
185
|
+
/**
|
|
186
|
+
* Project a read view onto the wire, under `anchor`.
|
|
187
|
+
*
|
|
188
|
+
* The anchor is passed IN rather than re-derived: the caller is where the four outcomes are
|
|
189
|
+
* separated (an unreadable repository never reaches here at all), and a projection that recomputed
|
|
190
|
+
* it from `view.present` would be a second opinion on the one judgement this endpoint exists to
|
|
191
|
+
* make.
|
|
192
|
+
*/
|
|
193
|
+
export function toPublicServiceSpec(serviceId, anchor, view, provenance) {
|
|
194
|
+
return { serviceId, anchor, provenance, ...specBody(view) };
|
|
195
|
+
}
|
|
196
|
+
/**
|
|
197
|
+
* Project a RUN's read onto the wire. `view`/`provenance` are null exactly for `not_read`, the one
|
|
198
|
+
* anchor state that describes the run rather than the branch.
|
|
199
|
+
*
|
|
200
|
+
* They travel together for that reason: an anchor of `not_read` with a provenance would name a
|
|
201
|
+
* branch nothing was read from, and any other anchor without one would serve a tree that cannot say
|
|
202
|
+
* where it came from. The signature makes both unrepresentable rather than leaving it to the caller
|
|
203
|
+
* to pair them correctly.
|
|
204
|
+
*/
|
|
205
|
+
export function toPublicRunSpec(runId, read) {
|
|
206
|
+
if (read.anchor === 'not_read') {
|
|
207
|
+
return {
|
|
208
|
+
runId,
|
|
209
|
+
anchor: 'not_read',
|
|
210
|
+
spec: null,
|
|
211
|
+
features: [],
|
|
212
|
+
provenance: null,
|
|
213
|
+
issues: [],
|
|
214
|
+
truncations: [],
|
|
215
|
+
};
|
|
216
|
+
}
|
|
217
|
+
return { runId, anchor: read.anchor, provenance: read.provenance, ...specBody(read.view) };
|
|
218
|
+
}
|
|
189
219
|
//# sourceMappingURL=specProjection.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"specProjection.js","sourceRoot":"","sources":["../../../src/modules/publicApi/specProjection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,6BAA6B,EAC7B,mCAAmC,EACnC,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,
|
|
1
|
+
{"version":3,"file":"specProjection.js","sourceRoot":"","sources":["../../../src/modules/publicApi/specProjection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,6BAA6B,EAC7B,mCAAmC,EACnC,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,GAYtB,MAAM,wBAAwB,CAAA;AAE/B,oFAAoF;AACpF,EAAE;AACF,gGAAgG;AAChG,gGAAgG;AAChG,0DAA0D;AAC1D,EAAE;AACF,yCAAyC;AACzC,EAAE;AACF,mGAAmG;AACnG,iGAAiG;AACjG,kGAAkG;AAClG,+CAA+C;AAC/C,oGAAoG;AACpG,gGAAgG;AAChG,kGAAkG;AAClG,uBAAuB;AACvB,oGAAoG;AACpG,mGAAmG;AACnG,mGAAmG;AACnG,oGAAoG;AACpG,mGAAmG;AACnG,qGAAqG;AACrG,kGAAkG;AAClG,mGAAmG;AAEnG;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,IAAqB,EAAE,KAAa;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAA;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;IACtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,KAAK;QACL,UAAU;QACV,SAAS,EAAE,KAAK,GAAG,UAAU;KAC9B,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,KAAwB;IAI3C,MAAM,QAAQ,GAA4B,EAAE,CAAA;IAC5C,IAAI,UAAU,GAAG,mCAAmC,CAAA;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,6BAA6B,CAAC,EAAE,CAAC;QACjE,IAAI,UAAU,IAAI,CAAC;YAAE,MAAK;QAC1B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,6BAA6B,EAAE,UAAU,CAAC,CAAC,CAAA;QACvF,UAAU,IAAI,OAAO,CAAC,KAAK,CAAA;QAC3B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IACD,OAAO;QACL,QAAQ;QACR,WAAW,EACT,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;YAC5B,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YACxE,CAAC,CAAC,EAAE;KACT,CAAA;AACH,CAAC;AAED,4FAA4F;AAC5F,SAAS,QAAQ,CAAC,IAAiB;IACjC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;AACtE,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CAAC,MAA0B;IAK5C,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAA;QACnC,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACnD,YAAY,IAAI,CAAC,CAAA;YACjB,UAAU,IAAI,CAAC,WAAW,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAA;QACrD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,OAAO,CAAC,IAAiB;IAIhC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IACzC,MAAM,WAAW,GAA2B,EAAE,CAAA;IAC9C,IAAI,MAAM,CAAC,YAAY,GAAG,4BAA4B,EAAE,CAAC;QACvD,WAAW,CAAC,IAAI,CAAC;YACf,OAAO,EAAE,cAAc;YACvB,KAAK,EAAE,4BAA4B;YACnC,KAAK,EAAE,MAAM,CAAC,YAAY;SAC3B,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,GAAG,qBAAqB,EAAE,CAAC;QACzC,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;IAC3F,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,GAAG,0BAA0B,EAAE,CAAC;QACnD,WAAW,CAAC,IAAI,CAAC;YACf,OAAO,EAAE,YAAY;YACrB,KAAK,EAAE,0BAA0B;YACjC,KAAK,EAAE,MAAM,CAAC,UAAU;SACzB,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IAC1D,IAAI,iBAAiB,GAAG,4BAA4B,CAAA;IACpD,IAAI,UAAU,GAAG,qBAAqB,CAAA;IACtC,IAAI,gBAAgB,GAAG,0BAA0B,CAAA;IACjD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,GAAG,MAAM;QACT,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1C,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;iBAC5C,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;iBACxC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;gBACnB,MAAM,UAAU,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAA;gBACzF,gBAAgB,IAAI,UAAU,CAAC,MAAM,CAAA;gBACrC,OAAO,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,CAAA;YACvC,CAAC,CAAC,CAAA;YACJ,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAA;YACnE,iBAAiB,IAAI,YAAY,CAAC,MAAM,CAAA;YACxC,UAAU,IAAI,KAAK,CAAC,MAAM,CAAA;YAC1B,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;QAC1C,CAAC,CAAC;KACH,CAAC,CAAC,CAAA;IACH,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,CAAA;AACpD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,MAAuB;IAIxC,IAAI,MAAM,CAAC,MAAM,IAAI,sBAAsB;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAA;IAC/E,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC;QAC/C,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;KAC1F,CAAA;AACH,CAAC;AAUD;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,IAAqB;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAA;IAC/E,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC3C,0FAA0F;IAC1F,8FAA8F;IAC9F,qCAAqC;IACrC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC,CAAA;IACxD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;KACrF,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,MAAwB,EACxB,IAAqB,EACrB,UAAgC;IAEhC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAA;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,IAE0B;IAE1B,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK;YACL,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,EAAE;SAChB,CAAA;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;AAC5F,CAAC"}
|
|
@@ -7,8 +7,10 @@ import type { ServerContainer } from '../../http/env.js';
|
|
|
7
7
|
* which carries no bearer token, so a backend route receiving it could never tell who was
|
|
8
8
|
* completing the grant; the page re-presents the vendor's `code` and `state` over the authenticated
|
|
9
9
|
* API instead (`completeToolServerOAuthContract`), where the session, the user binding and the
|
|
10
|
-
* `secrets.manage` re-check all apply. Exported
|
|
11
|
-
*
|
|
10
|
+
* `secrets.manage` re-check all apply. Exported so every backend site that states the string
|
|
11
|
+
* derives it from one place. The SPA page at this path (`pages/mcp-oauth-callback.vue`) is the
|
|
12
|
+
* other half, and nothing pins the two together: renaming the page must change this constant too,
|
|
13
|
+
* or the operator's registered redirect URI 404s while everything on this side stays green.
|
|
12
14
|
*/
|
|
13
15
|
export declare const MCP_OAUTH_CALLBACK_PATH = "/mcp-oauth-callback";
|
|
14
16
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mcpOAuthRedirect.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/mcpOAuthRedirect.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD
|
|
1
|
+
{"version":3,"file":"mcpOAuthRedirect.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/mcpOAuthRedirect.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,wBAAwB,CAAA;AAE5D;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAW7E"}
|
|
@@ -7,8 +7,10 @@ import { UnavailableError } from '@cat-factory/kernel';
|
|
|
7
7
|
* which carries no bearer token, so a backend route receiving it could never tell who was
|
|
8
8
|
* completing the grant; the page re-presents the vendor's `code` and `state` over the authenticated
|
|
9
9
|
* API instead (`completeToolServerOAuthContract`), where the session, the user binding and the
|
|
10
|
-
* `secrets.manage` re-check all apply. Exported
|
|
11
|
-
*
|
|
10
|
+
* `secrets.manage` re-check all apply. Exported so every backend site that states the string
|
|
11
|
+
* derives it from one place. The SPA page at this path (`pages/mcp-oauth-callback.vue`) is the
|
|
12
|
+
* other half, and nothing pins the two together: renaming the page must change this constant too,
|
|
13
|
+
* or the operator's registered redirect URI 404s while everything on this side stays green.
|
|
12
14
|
*/
|
|
13
15
|
export const MCP_OAUTH_CALLBACK_PATH = '/mcp-oauth-callback';
|
|
14
16
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mcpOAuthRedirect.js","sourceRoot":"","sources":["../../../src/modules/toolServers/mcpOAuthRedirect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAGtD
|
|
1
|
+
{"version":3,"file":"mcpOAuthRedirect.js","sourceRoot":"","sources":["../../../src/modules/toolServers/mcpOAuthRedirect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAGtD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAA;AAE5D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAA0B;IACnE,MAAM,GAAG,GAAG,SAAS,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAA;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,gBAAgB,CACxB,0FAA0F;YACxF,8BAA8B,uBAAuB,mCAAmC;YACxF,gDAAgD,EAClD,uCAAuC,CACxC,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"probeToolServer.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/probeToolServer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,mBAAmB,EAGnB,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;
|
|
1
|
+
{"version":3,"file":"probeToolServer.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/probeToolServer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,mBAAmB,EAGnB,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAS5B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAEnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAG5D,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,eAAe,CAAA;AAuBrE,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,mBAAmB,CAAA;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4DAA4D;IAC5D,KAAK,CAAC,EAAE,YAAY,CAAA;CACrB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAqDjG"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { NotFoundError, isValidMcpToolName, noopLogger, runBestEffort } from '@cat-factory/kernel';
|
|
1
|
+
import { NotFoundError, isValidMcpToolName, mcpTransportCarriesCredential, noopLogger, runBestEffort, } from '@cat-factory/kernel';
|
|
2
2
|
import { isReservedPlatformEnvKey, reservedEnvKeyMessage } from '@cat-factory/contracts';
|
|
3
3
|
import { MCP_PROBE_TOOL_NAME_CAP } from '@cat-factory/contracts';
|
|
4
4
|
import { mergeHeaders } from '../../agents/toolServers.js';
|
|
@@ -149,14 +149,15 @@ async function resolveOAuthHeader(input, definition, serverUrl) {
|
|
|
149
149
|
/**
|
|
150
150
|
* Resolve the declared credentials into request headers, or report why the probe cannot proceed.
|
|
151
151
|
*
|
|
152
|
-
* This mirrors `resolveToolServers`'s `
|
|
153
|
-
*
|
|
152
|
+
* This mirrors `resolveToolServers`'s `admitCredentials` deliberately, including the ORDER: both
|
|
153
|
+
* floors are applied BEFORE the resolver is asked, because a floor must hold whatever a facade
|
|
154
154
|
* wired. It reports the offending KEY NAMES rather than a sentence, so the surface can point at the
|
|
155
155
|
* row in the credential checklist that needs a value.
|
|
156
156
|
*
|
|
157
|
-
*
|
|
158
|
-
*
|
|
159
|
-
*
|
|
157
|
+
* Keeping the two in step is the point of the mirror, not a tidiness preference. A probe exists to
|
|
158
|
+
* answer what a DISPATCH would do without spending a run to find out, so a probe that proceeded
|
|
159
|
+
* where the dispatch drops the server would report the one state the surface must never invent: a
|
|
160
|
+
* capability that works, for a run that will not get it.
|
|
160
161
|
*/
|
|
161
162
|
async function resolveCredentials(input, definition) {
|
|
162
163
|
const declared = definition.secretKeys ?? [];
|
|
@@ -180,7 +181,31 @@ async function resolveCredentials(input, definition) {
|
|
|
180
181
|
},
|
|
181
182
|
};
|
|
182
183
|
}
|
|
183
|
-
|
|
184
|
+
// An http server's credential rides a HEADER, so one that named none has nowhere to go: it would
|
|
185
|
+
// resolve, be folded into nothing, and the request would go out unauthenticated for the endpoint
|
|
186
|
+
// to answer 401, which this probe would then report as a WRONG credential. Boot validation
|
|
187
|
+
// refuses the declaration, so reaching this means the definition was authored by a process that
|
|
188
|
+
// did not boot this build.
|
|
189
|
+
const unusable = declared.filter((secret) => !mcpTransportCarriesCredential(definition.transport.kind, secret));
|
|
190
|
+
const requiredUnusable = unusable.filter((secret) => secret.required !== false);
|
|
191
|
+
for (const secret of unusable) {
|
|
192
|
+
input.logger?.warn('tool server credential cannot ride its transport; refusing to send it', {
|
|
193
|
+
toolServerId: definition.id,
|
|
194
|
+
credentialKey: secret.key,
|
|
195
|
+
transport: definition.transport.kind,
|
|
196
|
+
});
|
|
197
|
+
}
|
|
198
|
+
if (requiredUnusable.length) {
|
|
199
|
+
return {
|
|
200
|
+
ok: false,
|
|
201
|
+
failure: {
|
|
202
|
+
status: 'credential_unusable',
|
|
203
|
+
unusableCredentials: requiredUnusable.map((secret) => secret.key),
|
|
204
|
+
},
|
|
205
|
+
};
|
|
206
|
+
}
|
|
207
|
+
const skipped = new Set([...reserved, ...unusable]);
|
|
208
|
+
const keys = declared.filter((secret) => !skipped.has(secret));
|
|
184
209
|
const resolver = input.resolveToolSecrets;
|
|
185
210
|
const resolved = resolver && keys.length
|
|
186
211
|
? ((await runBestEffort(input.logger ?? noopLogger, 'resolve tool-server credentials for a probe', () => resolver.resolve({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"probeToolServer.js","sourceRoot":"","sources":["../../../src/modules/toolServers/probeToolServer.ts"],"names":[],"mappings":"AAOA,OAAO,
|
|
1
|
+
{"version":3,"file":"probeToolServer.js","sourceRoot":"","sources":["../../../src/modules/toolServers/probeToolServer.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,6BAA6B,EAC7B,UAAU,EACV,aAAa,GACd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAExF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAA;AACzF,OAAO,EAAqB,kBAAkB,EAAE,MAAM,eAAe,CAAA;AA+CrE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B;IAC/D,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAA;IAC9B,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAC9C,IAAI,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAA;IACtF,kGAAkG;IAClG,qEAAqE;IACrE,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAA;IACrF,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/D,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAA;IAChE,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IACrF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;IAExD,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC;QACE,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG;QAC7B,6FAA6F;QAC7F,+FAA+F;QAC/F,uFAAuF;QACvF,OAAO,EAAE,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE;QAC5C,4FAA4F;QAC5F,2FAA2F;QAC3F,qFAAqF;QACrF,yFAAyF;QACzF,wFAAwF;QACxF,iBAAiB,EAAE,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;KACtE,EACD,KAAK,CAAC,KAAK,CACZ,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE;YAC7C,YAAY,EAAE,QAAQ;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,EAAE,OAAO,CAAC,KAAK;SACtB,CAAC,CAAA;QACF,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAA;IACjC,CAAC;IACD,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;QAC/B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC;QACtD,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC;KACvE,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAA2B;IACjD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACxF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IACrE,OAAO,QAAQ,CAAC,UAAU,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,iBAAiB,CACxB,UAA+B,EAC/B,KAAe,EACf,aAAsB;IAEtB,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3F,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAC9B,OAAO;QACL,YAAY,EAAE;YACZ,QAAQ;YACR,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC7E,OAAO,EAAE,aAAa;SACvB;KACF,CAAA;AACH,CAAC;AAOD;;;;;;;;GAQG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAA2B,EAC3B,UAA+B,EAC/B,SAAiB;IAEjB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,CAAA;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,MAAM,EAAE,qBAAqB;gBAC7B,KAAK,EACH,sFAAsF;oBACtF,qDAAqD;aACxD;SACF,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,UAAU,CAAC,EAAE;QACvB,SAAS;QACT,KAAK;KACN,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAA;IAC3F,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAA;IAClE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,mDAAmD,EAAE;QACtE,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,MAAM,CAAC,KAAK;KACrB,CAAC,CAAA;IACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAA;AACtF,CAAC;AAYD;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAA2B,EAC3B,UAA+B;IAE/B,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE,CAAA;IAC5C,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IAEtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAClF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAA;IAC/E,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,wEAAwE,EAAE;YAC3F,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,aAAa,EAAE,MAAM,CAAC,GAAG;YACzB,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1C,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,MAAM,EAAE,oBAAoB;gBAC5B,kBAAkB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;aACjE;SACF,CAAA;IACH,CAAC;IAED,iGAAiG;IACjG,iGAAiG;IACjG,2FAA2F;IAC3F,gGAAgG;IAChG,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAC9B,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,6BAA6B,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAC9E,CAAA;IACD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAA;IAC/E,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,uEAAuE,EAAE;YAC1F,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,aAAa,EAAE,MAAM,CAAC,GAAG;YACzB,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI;SACrC,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,MAAM,EAAE,qBAAqB;gBAC7B,mBAAmB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;aAClE;SACF,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,kBAAkB,CAAA;IACzC,MAAM,QAAQ,GACZ,QAAQ,IAAI,IAAI,CAAC,MAAM;QACrB,CAAC,CAAC,CAAC,CAAC,MAAM,aAAa,CACnB,KAAK,CAAC,MAAM,IAAI,UAAU,EAC1B,6CAA6C,EAC7C,GAAG,EAAE,CACH,QAAQ,CAAC,OAAO,CAAC;YACf,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE;YACnD,IAAI;SACL,CAAC,EACJ,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAChC,CAAC,IAAI,EAAE,CAAC;QACX,CAAC,CAAC,EAAE,CAAA;IAER,gGAAgG;IAChG,kGAAkG;IAClG,mBAAmB;IACnB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3F,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE;gBACP,MAAM,EAAE,qBAAqB;gBAC7B,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;aAC3D;SACF,CAAA;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAA;AACjE,CAAC;AAED,sGAAsG;AACtG,SAAS,iBAAiB,CACxB,IAAoB,EACpB,QAAgC;IAEhC,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,SAAQ;QACtC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,cAAc;YAC5C,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC;YACpD,CAAC,CAAC,KAAK,CAAA;IACX,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rpc-allowlist.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAgBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,0BAA0B,EAAE,
|
|
1
|
+
{"version":3,"file":"rpc-allowlist.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAgBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,0BAA0B,EAAE,sBA00CxC,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,oCAAoC,YAC/C,yBAAyB,EACzB,gCAAgC,EAChC,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,kCAAkC,CAC1B,CAAA;AAEV,yEAAyE;AACzE,MAAM,MAAM,+BAA+B,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAA"}
|
|
@@ -513,6 +513,28 @@ export const REMOTE_PERSISTENCE_METHODS = {
|
|
|
513
513
|
get: { scope: { kind: 'workspace', arg: 0 } },
|
|
514
514
|
upsert: { scope: { kind: 'workspaceField', arg: 0 } },
|
|
515
515
|
},
|
|
516
|
+
// The parked-review question writeback's idempotency marker (`IssueWritebackService.
|
|
517
|
+
// postReviewQuestions`): one row per `(workspace, review, iteration, linked issue)`, claimed
|
|
518
|
+
// BEFORE the comment is posted so a replaying durable driver cannot post a review's findings onto
|
|
519
|
+
// the reporter's issue twice.
|
|
520
|
+
//
|
|
521
|
+
// The ENGINE writes it, so a mothership-mode node genuinely reaches it — and its failure mode was
|
|
522
|
+
// the quiet kind this bucket exists to prevent. `claim` answered `unknown_method`, which the
|
|
523
|
+
// caller's deliberate fallback reads as "someone else holds the claim", so every parked review on
|
|
524
|
+
// a local run silently skipped its ticket comment: the reporter is never asked the question, the
|
|
525
|
+
// run parks waiting for an answer to something nobody was told about, and the only trace is a
|
|
526
|
+
// `warn`. Its INBOUND sibling (`trackerCommentIngestRepository`) stays off for a different and
|
|
527
|
+
// permanent reason: a webhook delivery reaches the deployment holding the public URL, never a
|
|
528
|
+
// laptop, so there is nothing there to claim.
|
|
529
|
+
//
|
|
530
|
+
// All three methods take the `ReviewQuestionPostKey` as arg0, whose `workspaceId` is a FIELD →
|
|
531
|
+
// the `workspaceField` rule, exactly like the record-based `upsert`s above. The marker carries no
|
|
532
|
+
// secrets (a status, an attempt count, and a `redactSecrets`-scrubbed error string).
|
|
533
|
+
reviewQuestionPostRepository: {
|
|
534
|
+
claim: { scope: { kind: 'workspaceField', arg: 0 } },
|
|
535
|
+
settle: { scope: { kind: 'workspaceField', arg: 0 } },
|
|
536
|
+
get: { scope: { kind: 'workspaceField', arg: 0 } },
|
|
537
|
+
},
|
|
516
538
|
// The agent context resolves the block's provisioned environment per step
|
|
517
539
|
// (`resolveForBlock`/`get`, both workspace-keyed), and, since the secrets-delegation slice,
|
|
518
540
|
// a mothership-mode node PROVISIONS for real: the access handle and the provider's
|
|
@@ -1123,14 +1145,20 @@ export const REMOTE_PERSISTENCE_METHODS = {
|
|
|
1123
1145
|
// endpoints are member-level (account-tier routes guard on `requireMember`, NOT `requireAdmin`), so
|
|
1124
1146
|
// this follows the same member-level policy as the other settings/library panels above.
|
|
1125
1147
|
//
|
|
1126
|
-
//
|
|
1127
|
-
//
|
|
1128
|
-
// it is not on the SPA library-management path here.
|
|
1148
|
+
// `listBySource` (the repo-sync reconcile read) joins them: see the `librarySource` note on
|
|
1149
|
+
// `fragmentSourceRepository` below for why the sync surface is no longer deferred.
|
|
1129
1150
|
promptFragmentRepository: {
|
|
1130
1151
|
listByOwner: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
|
|
1131
1152
|
get: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
|
|
1132
1153
|
upsert: { scope: { kind: 'ownerField', arg: 0 } },
|
|
1133
1154
|
softDelete: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
|
|
1155
|
+
// The source-keyed reconcile pair, mirroring the skill and foundational-service libraries':
|
|
1156
|
+
// list a source's live fragments to diff against the repo listing, and tombstone all of them
|
|
1157
|
+
// in one write on unlink. Each method carries a source id and nothing else, so the
|
|
1158
|
+
// `librarySource` rule resolves that source's owning tier pair server-side (`fragmentSource`
|
|
1159
|
+
// names the table it lives in).
|
|
1160
|
+
listBySource: { scope: { kind: 'librarySource', arg: 0, entity: 'fragmentSource' } },
|
|
1161
|
+
softDeleteBySource: { scope: { kind: 'librarySource', arg: 0, entity: 'fragmentSource' } },
|
|
1134
1162
|
},
|
|
1135
1163
|
// Model-GENERATED condensed briefs for long standards (`FragmentBriefService`), read and
|
|
1136
1164
|
// written on the RUN path: a mothership-mode implementer dispatch resolves them alongside the
|
|
@@ -1147,24 +1175,32 @@ export const REMOTE_PERSISTENCE_METHODS = {
|
|
|
1147
1175
|
upsert: { scope: { kind: 'ownerField', arg: 0 } },
|
|
1148
1176
|
delete: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
|
|
1149
1177
|
},
|
|
1150
|
-
// The fragment-source (repo-linkage) library the SPA lists
|
|
1151
|
-
// scoped exactly like the fragments above. `listByOwner`
|
|
1152
|
-
// rule; the
|
|
1153
|
-
//
|
|
1154
|
-
// mothership owns (the source service needs a GitHub client, which a mothership node does not have),
|
|
1155
|
-
// so a later GitHub-sync-in-mothership slice opens them with a source→owner resolver.
|
|
1178
|
+
// The fragment-source (repo-linkage) library the SPA lists, links and SYNCS
|
|
1179
|
+
// (`FragmentSourceService`), owner scoped exactly like the fragments above. `listByOwner` is bound
|
|
1180
|
+
// by the `owner` rule; the sourceId-keyed sync methods by `librarySource`, which resolves a
|
|
1181
|
+
// source's owning `(ownerKind, ownerId)` pair server-side.
|
|
1156
1182
|
//
|
|
1157
|
-
//
|
|
1158
|
-
//
|
|
1159
|
-
//
|
|
1160
|
-
//
|
|
1161
|
-
//
|
|
1162
|
-
//
|
|
1163
|
-
//
|
|
1164
|
-
//
|
|
1183
|
+
// The sync half was deferred on a premise that is no longer true: that a mothership-mode node has
|
|
1184
|
+
// no GitHub client. Token delegation gave it one (`DelegatedAppTokenSource` mints the tier's App
|
|
1185
|
+
// token over the same machine API), which is what already made the SKILLS library's sync surface
|
|
1186
|
+
// remote — so these routes were reachable and broken, the state that is worse than either serving
|
|
1187
|
+
// them or hiding them. `librarySource` is `skillSource` generalised to a tier PAIR, because a
|
|
1188
|
+
// fragment source can be owned by a workspace as well as an account.
|
|
1189
|
+
//
|
|
1190
|
+
// `upsert(record)` takes `ownerFieldUpsert`, NOT the plain `ownerField` the fragments above use.
|
|
1191
|
+
// This is the gap the skills slice named and could not close: the write conflicts on the `id`
|
|
1192
|
+
// ALONE and never re-`SET`s the owner columns, so binding only the DECLARED owner would let an
|
|
1193
|
+
// in-scope caller name a foreign source id and repoint another tenant's link at a repo it
|
|
1194
|
+
// controls, whose Markdown bodies the victim's next sync folds into their prompts as standards.
|
|
1195
|
+
// The rule binds the STORED row's owner too; a create (no such row) still passes on the declared
|
|
1196
|
+
// half. `ownerFieldUpsert` is the owner-pair analogue of `accountFieldUpsert` above, and is what
|
|
1197
|
+
// any new id-keyed library upsert must use.
|
|
1165
1198
|
fragmentSourceRepository: {
|
|
1166
1199
|
listByOwner: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
|
|
1167
|
-
upsert: { scope: { kind: '
|
|
1200
|
+
upsert: { scope: { kind: 'ownerFieldUpsert', arg: 0, entity: 'fragmentSource' } },
|
|
1201
|
+
get: { scope: { kind: 'librarySource', arg: 0, entity: 'fragmentSource' } },
|
|
1202
|
+
updateSyncState: { scope: { kind: 'librarySource', arg: 0, entity: 'fragmentSource' } },
|
|
1203
|
+
softDelete: { scope: { kind: 'librarySource', arg: 0, entity: 'fragmentSource' } },
|
|
1168
1204
|
},
|
|
1169
1205
|
// --- Repo-sourced Claude Skills library (ADR 0024) ------------------------------
|
|
1170
1206
|
// Skills live in ONE tier — the ACCOUNT — so every method here binds on an accountId rather
|
|
@@ -1183,13 +1219,13 @@ export const REMOTE_PERSISTENCE_METHODS = {
|
|
|
1183
1219
|
// manifest of `{ path, sha, size }`); the resource BODIES are fetched from the repo at
|
|
1184
1220
|
// dispatch and never stored, so nothing credential-bearing crosses the machine API.
|
|
1185
1221
|
//
|
|
1186
|
-
//
|
|
1187
|
-
//
|
|
1188
|
-
//
|
|
1189
|
-
//
|
|
1190
|
-
//
|
|
1191
|
-
//
|
|
1192
|
-
// libraries
|
|
1222
|
+
// This was the FIRST library whose repo-SYNC surface went remote. A sync needs a GitHub client,
|
|
1223
|
+
// and a mothership-mode node HAS one (`DelegatedAppTokenSource` mints the account's App token
|
|
1224
|
+
// over the same machine API), so its `SkillSourceService` assembles and its link/sync/unlink
|
|
1225
|
+
// routes are live. Leaving the sourceId-keyed methods off would leave those routes reachable and
|
|
1226
|
+
// broken, which is worse than either serving them or hiding them. `skillSource` is the rule that
|
|
1227
|
+
// binds them (skills live in one tier, so it resolves a bare accountId); the sibling
|
|
1228
|
+
// libraries have since adopted it, in its owner-pair form (`librarySource`).
|
|
1193
1229
|
accountSkillRepository: {
|
|
1194
1230
|
// Catalog reads: the account library panel, the pipeline builder's skill picker, and the RUN
|
|
1195
1231
|
// path (`SkillCatalogService.list`/`get`, behind the per-account `skillCatalog` cache slice).
|
|
@@ -1246,11 +1282,11 @@ export const REMOTE_PERSISTENCE_METHODS = {
|
|
|
1246
1282
|
// already runs. `listByServiceIds` is the hot one (once per consumer dispatch) and is already a
|
|
1247
1283
|
// single chunked `IN` query, so it stays one round trip over the wire too.
|
|
1248
1284
|
//
|
|
1249
|
-
// The sourceId-keyed sync methods
|
|
1250
|
-
//
|
|
1251
|
-
//
|
|
1252
|
-
//
|
|
1253
|
-
//
|
|
1285
|
+
// The sourceId-keyed sync methods now bind through `librarySource` (see the fragment library
|
|
1286
|
+
// above: the same rule, the same dead premise, and the same node-side GitHub client). What stays
|
|
1287
|
+
// OFF is `foundationalServiceSourceRepository.listStale` (the autorefresh sweep's global query)
|
|
1288
|
+
// and `listByRepo` (the push-webhook fan-out's), both unscoped across tiers by construction and
|
|
1289
|
+
// both running where a delivery ARRIVES, which is never a laptop.
|
|
1254
1290
|
foundationalServiceRepository: {
|
|
1255
1291
|
listByOwner: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
|
|
1256
1292
|
get: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
|
|
@@ -1260,6 +1296,14 @@ export const REMOTE_PERSISTENCE_METHODS = {
|
|
|
1260
1296
|
// the same management surface, so it belongs on the same side of the boundary: leaving it off
|
|
1261
1297
|
// would let a mothership-mode board opt OUT of an account service with no way back in.
|
|
1262
1298
|
hardDelete: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
|
|
1299
|
+
// The source-keyed reconcile pair, mirroring `accountSkillRepository`'s: list a source's live
|
|
1300
|
+
// services to diff against the repo, and tombstone all of them in one write on unlink.
|
|
1301
|
+
listBySource: {
|
|
1302
|
+
scope: { kind: 'librarySource', arg: 0, entity: 'foundationalServiceSource' },
|
|
1303
|
+
},
|
|
1304
|
+
softDeleteBySource: {
|
|
1305
|
+
scope: { kind: 'librarySource', arg: 0, entity: 'foundationalServiceSource' },
|
|
1306
|
+
},
|
|
1263
1307
|
},
|
|
1264
1308
|
apiContractRepository: {
|
|
1265
1309
|
listManifestByOwner: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
|
|
@@ -1267,9 +1311,20 @@ export const REMOTE_PERSISTENCE_METHODS = {
|
|
|
1267
1311
|
replaceForService: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
|
|
1268
1312
|
deleteForService: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
|
|
1269
1313
|
},
|
|
1314
|
+
// `upsert` takes `ownerFieldUpsert` for exactly the reason `fragmentSourceRepository.upsert` does:
|
|
1315
|
+
// it conflicts on the `id` alone, so the declared owner does not decide which row is written.
|
|
1270
1316
|
foundationalServiceSourceRepository: {
|
|
1271
1317
|
listByOwner: { scope: { kind: 'owner', kindArg: 0, idArg: 1 } },
|
|
1272
|
-
upsert: {
|
|
1318
|
+
upsert: {
|
|
1319
|
+
scope: { kind: 'ownerFieldUpsert', arg: 0, entity: 'foundationalServiceSource' },
|
|
1320
|
+
},
|
|
1321
|
+
get: { scope: { kind: 'librarySource', arg: 0, entity: 'foundationalServiceSource' } },
|
|
1322
|
+
updateSyncState: {
|
|
1323
|
+
scope: { kind: 'librarySource', arg: 0, entity: 'foundationalServiceSource' },
|
|
1324
|
+
},
|
|
1325
|
+
softDelete: {
|
|
1326
|
+
scope: { kind: 'librarySource', arg: 0, entity: 'foundationalServiceSource' },
|
|
1327
|
+
},
|
|
1273
1328
|
},
|
|
1274
1329
|
// --- Account onboarding read surface --------------------------------------------
|
|
1275
1330
|
// The two account-scoped READS a mothership-mode SPA's account/members + email-settings panels
|