@cogenta/mcp 0.1.4 → 0.3.0

package/dist/registry/store.js

@@ -0,0 +1,272 @@
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
+import { CogentaError, identifier, newId, sql } from '@cogenta/core';
+import { MCP_CONNECTION_TABLE } from './tables.js';
+const KEY_DERIVATION_SALT = 'cogenta-mcp-connection-secrets-v1';
+const ALGORITHM = 'aes-256-gcm';
+function deriveKey(signingKey) {
+    return scryptSync(signingKey, KEY_DERIVATION_SALT, 32);
+}
+function connectionNotFound(id) {
+    return new CogentaError({
+        code: 'MCP_CONNECTION_NOT_FOUND',
+        message: `No MCP connection with id "${id}".`,
+        hint: 'Check the id against the admin\'s "MCP Clients" screen.',
+    });
+}
+function confirmationRequired() {
+    return new CogentaError({
+        code: 'MCP_CONNECTION_CONFIRMATION_REQUIRED',
+        message: 'A "stdio" MCP connection must explicitly confirm it runs an unsandboxed third-party executable with the full OS privileges of the Cogenta server process.',
+        hint: 'Pass confirmUnsandboxed: true only after the operator has actually seen and accepted that warning.',
+    });
+}
+function toolNotDiscovered(id, remoteName) {
+    return new CogentaError({
+        code: 'MCP_CONNECTION_TOOL_NOT_DISCOVERED',
+        message: `"${remoteName}" was not in the last discovered tool list for connection "${id}".`,
+        hint: 'Run "test connection" again, then choose only from the tools it actually returned.',
+    });
+}
+function toSummary(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        transport: row.transport,
+        ...(row.command === null ? {} : { command: row.command }),
+        args: row.args_json === null ? [] : JSON.parse(row.args_json),
+        ...(row.url === null ? {} : { url: row.url }),
+        env: row.env_json === null ? {} : JSON.parse(row.env_json),
+        authKind: row.auth_kind,
+        hasSecret: row.secret_ciphertext !== null,
+        ...(row.secret_env_var === null ? {} : { secretEnvVar: row.secret_env_var }),
+        confirmedUnsandboxed: Boolean(row.confirmed_unsandboxed),
+        enabled: Boolean(row.enabled),
+        status: row.status,
+        ...(row.last_error === null ? {} : { lastError: row.last_error }),
+        discoveredTools: row.discovered_tools_json === null
+            ? []
+            : JSON.parse(row.discovered_tools_json),
+        ...(row.last_discovered_at === null ? {} : { lastDiscoveredAt: row.last_discovered_at }),
+        exposedTools: JSON.parse(row.exposed_tools_json),
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    };
+}
+export function createMcpConnectionStore(db, options) {
+    const now = options.now ?? Date.now;
+    const key = deriveKey(options.signingKey);
+    const table = identifier(MCP_CONNECTION_TABLE, db.dialect);
+    function encrypt(plaintext) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv(ALGORITHM, key, iv);
+        const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+        return {
+            iv: iv.toString('base64'),
+            authTag: cipher.getAuthTag().toString('base64'),
+            ciphertext: ciphertext.toString('base64'),
+        };
+    }
+    function decrypt(row) {
+        if (row.secret_iv === null || row.secret_auth_tag === null || row.secret_ciphertext === null) {
+            throw new CogentaError({
+                code: 'MCP_CONNECTION_AUTH_INVALID',
+                message: `Connection "${row.id}" has no saved secret.`,
+                hint: `Its authKind is "${row.auth_kind}" — save one from the admin's "MCP Clients" screen first.`,
+            });
+        }
+        const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(row.secret_iv, 'base64'));
+        decipher.setAuthTag(Buffer.from(row.secret_auth_tag, 'base64'));
+        const plaintext = Buffer.concat([
+            decipher.update(Buffer.from(row.secret_ciphertext, 'base64')),
+            decipher.final(),
+        ]);
+        return plaintext.toString('utf8');
+    }
+    async function findRow(id) {
+        const result = await db.query(sql `select * from ${table} where id = ${id}`);
+        return result.rows[0];
+    }
+    return {
+        async list() {
+            const result = await db.query(sql `select * from ${table} order by created_at asc`);
+            return result.rows.map(toSummary);
+        },
+        async get(id) {
+            const row = await findRow(id);
+            return row === undefined ? undefined : toSummary(row);
+        },
+        async create(input) {
+            if (input.transport === 'stdio' && input.confirmUnsandboxed !== true) {
+                throw confirmationRequired();
+            }
+            const authKind = input.authKind ?? 'none';
+            let secretFields;
+            if (authKind !== 'none' && input.secret !== undefined) {
+                const encrypted = encrypt(input.secret);
+                secretFields = {
+                    secret_iv: encrypted.iv,
+                    secret_auth_tag: encrypted.authTag,
+                    secret_ciphertext: encrypted.ciphertext,
+                };
+            }
+            else {
+                secretFields = { secret_iv: null, secret_auth_tag: null, secret_ciphertext: null };
+            }
+            const nowIso = new Date(now()).toISOString();
+            const row = {
+                id: newId(now),
+                name: input.name,
+                transport: input.transport,
+                command: input.command ?? null,
+                args_json: input.args === undefined ? null : JSON.stringify(input.args),
+                url: input.url ?? null,
+                env_json: input.env === undefined ? null : JSON.stringify(input.env),
+                auth_kind: authKind,
+                secret_env_var: input.secretEnvVar ?? null,
+                ...secretFields,
+                // Reaching this point means either the transport is `http` (nothing
+                // is spawned, so there is nothing to confirm) or it is `stdio` and
+                // the guard above already required `confirmUnsandboxed === true`.
+                confirmed_unsandboxed: true,
+                enabled: true,
+                status: 'unverified',
+                last_error: null,
+                exposed_tools_json: '[]',
+                created_at: nowIso,
+                updated_at: nowIso,
+            };
+            await db.query(sql `
+        insert into ${table} (
+          id, name, transport, command, args_json, url, env_json, auth_kind,
+          secret_env_var, secret_iv, secret_auth_tag, secret_ciphertext,
+          confirmed_unsandboxed, enabled, status, last_error,
+          discovered_tools_json, last_discovered_at, exposed_tools_json,
+          created_at, updated_at
+        ) values (
+          ${row.id}, ${row.name}, ${row.transport}, ${row.command}, ${row.args_json}, ${row.url}, ${row.env_json}, ${row.auth_kind},
+          ${row.secret_env_var}, ${row.secret_iv}, ${row.secret_auth_tag}, ${row.secret_ciphertext},
+          ${row.confirmed_unsandboxed}, ${row.enabled}, ${row.status}, ${row.last_error},
+          ${null}, ${null}, ${row.exposed_tools_json},
+          ${row.created_at}, ${row.updated_at}
+        )`);
+            const saved = await findRow(row.id);
+            if (saved === undefined)
+                throw connectionNotFound(row.id);
+            return toSummary(saved);
+        },
+        async remove(id) {
+            await db.query(sql `delete from ${table} where id = ${id}`);
+        },
+        async setEnabled(id, enabled) {
+            const row = await findRow(id);
+            if (row === undefined)
+                throw connectionNotFound(id);
+            const updatedAt = new Date(now()).toISOString();
+            await db.query(sql `update ${table} set enabled = ${enabled}, updated_at = ${updatedAt} where id = ${id}`);
+            return toSummary({ ...row, enabled, updated_at: updatedAt });
+        },
+        async update(id, patch) {
+            const row = await findRow(id);
+            if (row === undefined)
+                throw connectionNotFound(id);
+            const name = patch.name ?? row.name;
+            const command = patch.command === undefined ? row.command : patch.command;
+            const args_json = patch.args === undefined ? row.args_json : JSON.stringify(patch.args);
+            const url = patch.url === undefined ? row.url : patch.url;
+            const env_json = patch.env === undefined ? row.env_json : JSON.stringify(patch.env);
+            const authKind = patch.authKind ?? row.auth_kind;
+            const secretEnvVar = patch.secretEnvVar === undefined ? row.secret_env_var : patch.secretEnvVar;
+            let secretFields;
+            if (authKind === 'none') {
+                secretFields = { secret_iv: null, secret_auth_tag: null, secret_ciphertext: null };
+            }
+            else if (patch.secret !== undefined) {
+                const encrypted = encrypt(patch.secret);
+                secretFields = {
+                    secret_iv: encrypted.iv,
+                    secret_auth_tag: encrypted.authTag,
+                    secret_ciphertext: encrypted.ciphertext,
+                };
+            }
+            else {
+                secretFields = {
+                    secret_iv: row.secret_iv,
+                    secret_auth_tag: row.secret_auth_tag,
+                    secret_ciphertext: row.secret_ciphertext,
+                };
+            }
+            const updatedAt = new Date(now()).toISOString();
+            await db.query(sql `
+        update ${table}
+        set name = ${name}, command = ${command}, args_json = ${args_json}, url = ${url},
+            env_json = ${env_json}, auth_kind = ${authKind}, secret_env_var = ${secretEnvVar},
+            secret_iv = ${secretFields.secret_iv}, secret_auth_tag = ${secretFields.secret_auth_tag},
+            secret_ciphertext = ${secretFields.secret_ciphertext}, updated_at = ${updatedAt}
+        where id = ${id}`);
+            return toSummary({
+                ...row,
+                name,
+                command,
+                args_json,
+                url,
+                env_json,
+                auth_kind: authKind,
+                secret_env_var: secretEnvVar,
+                ...secretFields,
+                updated_at: updatedAt,
+            });
+        },
+        async recordDiscovery(id, result) {
+            const row = await findRow(id);
+            if (row === undefined)
+                throw connectionNotFound(id);
+            const updatedAt = new Date(now()).toISOString();
+            if (result.status === 'ok') {
+                const discoveredJson = JSON.stringify(result.tools);
+                await db.query(sql `
+          update ${table}
+          set status = ${'ok'}, last_error = ${null},
+              discovered_tools_json = ${discoveredJson}, last_discovered_at = ${updatedAt},
+              updated_at = ${updatedAt}
+          where id = ${id}`);
+                return toSummary({
+                    ...row,
+                    status: 'ok',
+                    last_error: null,
+                    discovered_tools_json: discoveredJson,
+                    last_discovered_at: updatedAt,
+                    updated_at: updatedAt,
+                });
+            }
+            await db.query(sql `
+        update ${table} set status = ${'error'}, last_error = ${result.error}, updated_at = ${updatedAt}
+        where id = ${id}`);
+            return toSummary({ ...row, status: 'error', last_error: result.error, updated_at: updatedAt });
+        },
+        async setExposedTools(id, tools) {
+            const row = await findRow(id);
+            if (row === undefined)
+                throw connectionNotFound(id);
+            const discovered = new Set((row.discovered_tools_json === null
+                ? []
+                : JSON.parse(row.discovered_tools_json)).map((tool) => tool.name));
+            for (const tool of tools) {
+                if (!discovered.has(tool.remoteName))
+                    throw toolNotDiscovered(id, tool.remoteName);
+            }
+            const updatedAt = new Date(now()).toISOString();
+            const exposedJson = JSON.stringify(tools);
+            await db.query(sql `
+        update ${table} set exposed_tools_json = ${exposedJson}, updated_at = ${updatedAt}
+        where id = ${id}`);
+            return toSummary({ ...row, exposed_tools_json: exposedJson, updated_at: updatedAt });
+        },
+        async decryptSecret(id) {
+            const row = await findRow(id);
+            if (row === undefined)
+                throw connectionNotFound(id);
+            return decrypt(row);
+        },
+    };
+}
+//# sourceMappingURL=store.js.map

package/dist/registry/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/registry/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACvF,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAuKlD,MAAM,mBAAmB,GAAG,mCAAmC,CAAA;AAC/D,MAAM,SAAS,GAAG,aAAa,CAAA;AAE/B,SAAS,SAAS,CAAC,UAAkB;IACnC,OAAO,UAAU,CAAC,UAAU,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,kBAAkB,CAAC,EAAU;IACpC,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,8BAA8B,EAAE,IAAI;QAC7C,IAAI,EAAE,yDAAyD;KAChE,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EACL,2JAA2J;QAC7J,IAAI,EAAE,oGAAoG;KAC3G,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAU,EAAE,UAAkB;IACvD,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,IAAI,UAAU,8DAA8D,EAAE,IAAI;QAC3F,IAAI,EAAE,oFAAoF;KAC3F,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAkB;IACnC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAyB;QACxC,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QACzD,IAAI,EAAE,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAuB;QACpF,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAC7C,GAAG,EACD,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAsC;QAC7F,QAAQ,EAAE,GAAG,CAAC,SAAwB;QACtC,SAAS,EAAE,GAAG,CAAC,iBAAiB,KAAK,IAAI;QACzC,GAAG,CAAC,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;QAC5E,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACxD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,MAA6B;QACzC,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;QACjE,eAAe,EACb,GAAG,CAAC,qBAAqB,KAAK,IAAI;YAChC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAkC;QAC7E,GAAG,CAAC,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACxF,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAA8B;QAC7E,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC;AAQD,MAAM,UAAU,wBAAwB,CACtC,EAAkB,EAClB,OAAsC;IAEtC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,oBAAoB,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAE1D,SAAS,OAAO,CAAC,SAAiB;QAChC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC1B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QACpF,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC1C,CAAA;IACH,CAAC;IAED,SAAS,OAAO,CAAC,GAAkB;QACjC,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,eAAe,KAAK,IAAI,IAAI,GAAG,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC7F,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,eAAe,GAAG,CAAC,EAAE,wBAAwB;gBACtD,IAAI,EAAE,oBAAoB,GAAG,CAAC,SAAS,2DAA2D;aACnG,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAA;QACvF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;YAC7D,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAA;QACF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,EAAU;QAC/B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAgB,GAAG,CAAA,iBAAiB,KAAK,eAAe,EAAE,EAAE,CAAC,CAAA;QAC1F,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,0BAA0B,CACpD,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACnC,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAA;YAC7B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACvD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;gBACrE,MAAM,oBAAoB,EAAE,CAAA;YAC9B,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAA;YACzC,IAAI,YAAwF,CAAA;YAC5F,IAAI,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACtD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBACvC,YAAY,GAAG;oBACb,SAAS,EAAE,SAAS,CAAC,EAAE;oBACvB,eAAe,EAAE,SAAS,CAAC,OAAO;oBAClC,iBAAiB,EAAE,SAAS,CAAC,UAAU;iBACxC,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,YAAY,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAA;YACpF,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAC5C,MAAM,GAAG,GAAwE;gBAC/E,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC;gBACd,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;gBAC9B,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;gBACvE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI;gBACtB,QAAQ,EAAE,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC;gBACpE,SAAS,EAAE,QAAQ;gBACnB,cAAc,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;gBAC1C,GAAG,YAAY;gBACf,oEAAoE;gBACpE,mEAAmE;gBACnE,kEAAkE;gBAClE,qBAAqB,EAAE,IAAI;gBAC3B,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,YAAY;gBACpB,UAAU,EAAE,IAAI;gBAChB,kBAAkB,EAAE,IAAI;gBACxB,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,MAAM;aACnB,CAAA;YAED,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,KAAK;;;;;;;YAOf,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,SAAS;YACtH,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,iBAAiB;YACtF,GAAG,CAAC,qBAAqB,KAAK,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,UAAU;YAC3E,IAAI,KAAK,IAAI,KAAK,GAAG,CAAC,kBAAkB;YACxC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU;UACnC,CAAC,CAAA;YAEL,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACnC,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACzD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAA;QACzB,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,eAAe,KAAK,eAAe,EAAE,EAAE,CAAC,CAAA;QAC5D,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO;YAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAA;YAC7B,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAA;YACnD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAC/C,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,KAAK,kBAAkB,OAAO,kBAAkB,SAAS,eAAe,EAAE,EAAE,CAC1F,CAAA;YACD,OAAO,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;QAC9D,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK;YACpB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAA;YAC7B,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAA;YAEnD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAA;YACnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;YACzE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACvF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA;YACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACnF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAK,GAAG,CAAC,SAAyB,CAAA;YACjE,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAA;YAE5E,IAAI,YAAwF,CAAA;YAC5F,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,YAAY,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAA;YACpF,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBACvC,YAAY,GAAG;oBACb,SAAS,EAAE,SAAS,CAAC,EAAE;oBACvB,eAAe,EAAE,SAAS,CAAC,OAAO;oBAClC,iBAAiB,EAAE,SAAS,CAAC,UAAU;iBACxC,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,YAAY,GAAG;oBACb,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;oBACpC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;iBACzC,CAAA;YACH,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iBACP,KAAK;qBACD,IAAI,eAAe,OAAO,iBAAiB,SAAS,WAAW,GAAG;yBAC9D,QAAQ,iBAAiB,QAAQ,sBAAsB,YAAY;0BAClE,YAAY,CAAC,SAAS,uBAAuB,YAAY,CAAC,eAAe;kCACjE,YAAY,CAAC,iBAAiB,kBAAkB,SAAS;qBACtE,EAAE,EAAE,CAAC,CAAA;YAEpB,OAAO,SAAS,CAAC;gBACf,GAAG,GAAG;gBACN,IAAI;gBACJ,OAAO;gBACP,SAAS;gBACT,GAAG;gBACH,QAAQ;gBACR,SAAS,EAAE,QAAQ;gBACnB,cAAc,EAAE,YAAY;gBAC5B,GAAG,YAAY;gBACf,UAAU,EAAE,SAAS;aACtB,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM;YAC9B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAA;YAC7B,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAA;YACnD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACnD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;mBACP,KAAK;yBACC,IAAI,kBAAkB,IAAI;wCACX,cAAc,0BAA0B,SAAS;6BAC5D,SAAS;uBACf,EAAE,EAAE,CAAC,CAAA;gBACpB,OAAO,SAAS,CAAC;oBACf,GAAG,GAAG;oBACN,MAAM,EAAE,IAAI;oBACZ,UAAU,EAAE,IAAI;oBAChB,qBAAqB,EAAE,cAAc;oBACrC,kBAAkB,EAAE,SAAS;oBAC7B,UAAU,EAAE,SAAS;iBACtB,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iBACP,KAAK,iBAAiB,OAAO,kBAAkB,MAAM,CAAC,KAAK,kBAAkB,SAAS;qBAClF,EAAE,EAAE,CAAC,CAAA;YACpB,OAAO,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;QAChG,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK;YAC7B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAA;YAC7B,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAA;YACnD,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,CAAC,GAAG,CAAC,qBAAqB,KAAK,IAAI;gBACjC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAkC,CAC1E,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3B,CAAA;YACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;oBAAE,MAAM,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YACpF,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YACzC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iBACP,KAAK,6BAA6B,WAAW,kBAAkB,SAAS;qBACpE,EAAE,EAAE,CAAC,CAAA;YACpB,OAAO,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;QACtF,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE;YACpB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAA;YAC7B,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAA;YACnD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAA;QACrB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/registry/tables.d.ts

@@ -0,0 +1,24 @@
+import { type DatabaseHandle } from '@cogenta/core';
+export declare const MCP_CONNECTION_TABLE = "mcp_connections";
+/**
+ * Fiche 58 task 2. Owned by `@cogenta/mcp`, following `@cogenta/plugins`'s
+ * `ensurePluginTables` pattern exactly: `create table if not exists`, run
+ * once at startup, no separate migration file — this is registry/config
+ * state for the current running process, not Contract A content.
+ *
+ * One row per configured external MCP connection. Everything a `stdio`
+ * connection needs to actually spawn (`command`/`args`/`env`) lives here in
+ * the clear — none of it is a secret by itself — while `secret_*` (the
+ * bearer/API key/OAuth token this *connection* authenticates itself with,
+ * for `auth_kind !== 'none'`) is the one thing encrypted at rest, same
+ * AES-256-GCM scheme as `@cogenta/agents`' `ProviderConfigStore` (R7: key
+ * derived from `COGENTA_AUTH_SIGNING_KEY`, no second secret to manage).
+ *
+ * `exposed_tools_json` is the admin's own checkbox decision (task 3) — the
+ * whole reason this is not simply "every tool `tools/list` returns is
+ * available": "absent, pas refusée" (fiche's own words, borrowed from
+ * `@cogenta/plugins`'s capability model) — a tool never checked here is
+ * never wrapped, never in an agent's manifest, full stop.
+ */
+export declare function ensureMcpConnectionTables(db: DatabaseHandle): Promise<void>;
+//# sourceMappingURL=tables.d.ts.map

package/dist/registry/tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../../src/registry/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EAKpB,MAAM,eAAe,CAAA;AAEtB,eAAO,MAAM,oBAAoB,oBAAoB,CAAA;AAWrD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,yBAAyB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCjF"}

package/dist/registry/tables.js

@@ -0,0 +1,65 @@
+import { identifier, sql, unsafeRaw, } from '@cogenta/core';
+export const MCP_CONNECTION_TABLE = 'mcp_connections';
+function textColumn(dialect, length) {
+    return unsafeRaw(dialect === 'sqlite' ? 'text' : `varchar(${length})`);
+}
+/** Same convention `@cogenta/auth`'s `tables.ts` already uses. */
+function booleanColumn(dialect) {
+    return unsafeRaw(dialect === 'postgres' ? 'boolean' : 'tinyint');
+}
+/**
+ * Fiche 58 task 2. Owned by `@cogenta/mcp`, following `@cogenta/plugins`'s
+ * `ensurePluginTables` pattern exactly: `create table if not exists`, run
+ * once at startup, no separate migration file — this is registry/config
+ * state for the current running process, not Contract A content.
+ *
+ * One row per configured external MCP connection. Everything a `stdio`
+ * connection needs to actually spawn (`command`/`args`/`env`) lives here in
+ * the clear — none of it is a secret by itself — while `secret_*` (the
+ * bearer/API key/OAuth token this *connection* authenticates itself with,
+ * for `auth_kind !== 'none'`) is the one thing encrypted at rest, same
+ * AES-256-GCM scheme as `@cogenta/agents`' `ProviderConfigStore` (R7: key
+ * derived from `COGENTA_AUTH_SIGNING_KEY`, no second secret to manage).
+ *
+ * `exposed_tools_json` is the admin's own checkbox decision (task 3) — the
+ * whole reason this is not simply "every tool `tools/list` returns is
+ * available": "absent, pas refusée" (fiche's own words, borrowed from
+ * `@cogenta/plugins`'s capability model) — a tool never checked here is
+ * never wrapped, never in an agent's manifest, full stop.
+ */
+export async function ensureMcpConnectionTables(db) {
+    const d = db.dialect;
+    const connections = identifier(MCP_CONNECTION_TABLE, d);
+    const t255 = textColumn(d, 255);
+    const t2048 = textColumn(d, 2048);
+    const tText = unsafeRaw('text');
+    const tBool = booleanColumn(d);
+    await db.query(sql `
+    create table if not exists ${connections} (
+      id ${t255} not null primary key,
+      name ${t255} not null,
+      transport ${t255} not null,
+      command ${t2048},
+      args_json ${tText},
+      url ${t2048},
+      env_json ${tText},
+      auth_kind ${t255} not null,
+      secret_env_var ${t255},
+      secret_iv ${t255},
+      secret_auth_tag ${t255},
+      secret_ciphertext ${tText},
+      confirmed_unsandboxed ${tBool} not null,
+      enabled ${tBool} not null,
+      status ${t255} not null,
+      last_error ${tText},
+      discovered_tools_json ${tText},
+      last_discovered_at ${t255},
+      exposed_tools_json ${tText} not null,
+      created_at ${t255} not null,
+      updated_at ${t255} not null
+    )`);
+    await db
+        .query(sql `create index ${identifier('cogenta_mcp_connections_name', d)} on ${connections} (name)`)
+        .catch(() => undefined); // already there — no portable "if not exists" for indexes
+}
+//# sourceMappingURL=tables.js.map

package/dist/registry/tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../../src/registry/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,EAEV,GAAG,EACH,SAAS,GACV,MAAM,eAAe,CAAA;AAEtB,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAA;AAErD,SAAS,UAAU,CAAC,OAAwB,EAAE,MAAc;IAC1D,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC,CAAA;AACxE,CAAC;AAED,kEAAkE;AAClE,SAAS,aAAa,CAAC,OAAwB;IAC7C,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAAkB;IAChE,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAA;IACpB,MAAM,WAAW,GAAG,UAAU,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAA;IACvD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACjC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;IAE9B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,WAAW;WACjC,IAAI;aACF,IAAI;kBACC,IAAI;gBACN,KAAK;kBACH,KAAK;YACX,KAAK;iBACA,KAAK;kBACJ,IAAI;uBACC,IAAI;kBACT,IAAI;wBACE,IAAI;0BACF,KAAK;8BACD,KAAK;gBACnB,KAAK;eACN,IAAI;mBACA,KAAK;8BACM,KAAK;2BACR,IAAI;2BACJ,KAAK;mBACb,IAAI;mBACJ,IAAI;MACjB,CAAC,CAAA;IAEL,MAAM,EAAE;SACL,KAAK,CACJ,GAAG,CAAA,gBAAgB,UAAU,CAAC,8BAA8B,EAAE,CAAC,CAAC,OAAO,WAAW,SAAS,CAC5F;SACA,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA,CAAC,0DAA0D;AACtF,CAAC"}

package/dist/registry/tool-definitions.d.ts

@@ -0,0 +1,53 @@
+import type { ToolDefinition } from '@cogenta/agents';
+import type { Logger } from '@cogenta/core';
+import { type McpStdioClientOptions } from '../client/stdio-client.js';
+import type { McpConnectionStore } from './store.js';
+/**
+ * Fiche 58 task 4's runtime wiring. Structurally, the fiche names
+ * `packages/agents/src/runtime/` for this — it lives here in `@cogenta/mcp`
+ * instead, and the discrepancy is deliberate, signalled rather than
+ * silently worked around: `@cogenta/mcp` already depends on
+ * `@cogenta/agents` (for `ToolDefinition`/`defineTool` — `../client/
+ * wrap-tool.js`), so a reverse dependency the fiche's own path would
+ * require is a package cycle. `packages/cli/src/commands/agent-runtime.ts`
+ * — which already depends on both packages, the same way it already
+ * builds this site's real `ToolRegistry` — is where this assembly's
+ * `definitions` are actually merged in; see that file's own comment at the
+ * call site.
+ *
+ * One `McpClient` per enabled connection that has at least one exposed
+ * tool, built once and shared by every `wrapMcpTool` for that connection —
+ * never one spawned process per tool. A connection that fails to
+ * `initialize()` here is logged and skipped, never thrown: one
+ * misbehaving external server must not keep the rest of a site's agents
+ * and tools from starting at all (the same posture L22 task 1's
+ * `resolveProvider` already takes for a missing LLM provider — R2's
+ * "runs refuse, the rest of the CMS does not").
+ *
+ * **Known, accepted limitation**: `wrapMcpTool` requires a static Zod
+ * input/output schema per tool, because Contract C's `ToolDefinition`
+ * always has one — there is no JSON-Schema-to-Zod translator in this
+ * repository (adding one would be a new dependency, R9), so a
+ * dynamically-discovered remote tool is wrapped with a permissive
+ * `z.record(...)` input rather than the real schema the remote server
+ * declared in `tools/list`. Local validation is therefore looser than the
+ * remote tool's own; the remote server still validates its own call and
+ * reports `isError: true` on a bad one, exactly like every other MCP tool
+ * failure. The JSON schema shown to the model (`manifest.ts`'s
+ * `z.toJSONSchema`) is correspondingly generic, not the remote's richer
+ * one — a real usability gap, honestly documented rather than hidden.
+ */
+export interface BuildMcpToolDefinitionsOptions {
+    readonly store: McpConnectionStore;
+    readonly logger?: Logger;
+    readonly callTimeoutMs?: number;
+    /** Injectable for tests — defaults to a real spawned process (see `McpStdioClientOptions.spawnFn`). */
+    readonly spawnFn?: McpStdioClientOptions['spawnFn'];
+}
+export interface McpToolDefinitionsAssembly {
+    readonly definitions: readonly ToolDefinition[];
+    /** Closes every underlying `McpClient` and removes every sandbox working directory this assembly created — call once, on shutdown. */
+    dispose(): Promise<void>;
+}
+export declare function buildMcpToolDefinitions(options: BuildMcpToolDefinitionsOptions): Promise<McpToolDefinitionsAssembly>;
+//# sourceMappingURL=tool-definitions.d.ts.map

package/dist/registry/tool-definitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-definitions.d.ts","sourceRoot":"","sources":["../../src/registry/tool-definitions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAG3C,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AAG5F,OAAO,KAAK,EAAE,kBAAkB,EAAwB,MAAM,YAAY,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,uGAAuG;IACvG,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAA;CACpD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IAC/C,sIAAsI;IACtI,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAaD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,0BAA0B,CAAC,CA4FrC"}

package/dist/registry/tool-definitions.js

@@ -0,0 +1,98 @@
+import { z } from 'zod';
+import { createSandboxWorkDir } from '../client/sandbox.js';
+import { createMcpStdioClient } from '../client/stdio-client.js';
+import { wrapMcpTool } from '../client/wrap-tool.js';
+const OPAQUE_INPUT = z.record(z.string(), z.unknown());
+function localToolName(connection, localName) {
+    return `mcp.external.${connection.id}.${localName}`;
+}
+/** Fiche 58 task 6's settled taxonomy: one permission per checked remote tool, never per connection. */
+function permissionFor(connection, remoteName) {
+    return `mcp.external:${connection.id}.${remoteName}`;
+}
+export async function buildMcpToolDefinitions(options) {
+    const connections = (await options.store.list()).filter((connection) => connection.enabled && connection.exposedTools.length > 0);
+    const definitions = [];
+    const clients = [];
+    const sandboxes = [];
+    for (const connection of connections) {
+        if (connection.transport !== 'stdio') {
+            options.logger?.warn('mcp registry: skipping connection with unsupported transport', {
+                connection: connection.id,
+                transport: connection.transport,
+            });
+            continue;
+        }
+        if (connection.command === undefined) {
+            options.logger?.warn('mcp registry: skipping connection with no command configured', {
+                connection: connection.id,
+            });
+            continue;
+        }
+        let secret;
+        if (connection.authKind !== 'none' && connection.hasSecret) {
+            try {
+                secret = await options.store.decryptSecret(connection.id);
+            }
+            catch (error) {
+                options.logger?.error('mcp registry: could not decrypt connection secret, skipping', {
+                    connection: connection.id,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                continue;
+            }
+        }
+        const env = { ...connection.env };
+        if (connection.secretEnvVar !== undefined && secret !== undefined) {
+            env[connection.secretEnvVar] = secret;
+        }
+        const sandbox = await createSandboxWorkDir();
+        let client;
+        try {
+            client = createMcpStdioClient({
+                command: connection.command,
+                args: connection.args,
+                env,
+                cwd: sandbox.path,
+                ...(options.logger === undefined ? {} : { logger: options.logger }),
+                ...(options.callTimeoutMs === undefined ? {} : { callTimeoutMs: options.callTimeoutMs }),
+                ...(options.spawnFn === undefined ? {} : { spawnFn: options.spawnFn }),
+            });
+            await client.initialize();
+        }
+        catch (error) {
+            options.logger?.error('mcp registry: connection failed to initialize, skipping', {
+                connection: connection.id,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            await sandbox.cleanup();
+            continue;
+        }
+        clients.push(client);
+        sandboxes.push(sandbox);
+        for (const tool of connection.exposedTools) {
+            definitions.push(wrapMcpTool({
+                client,
+                remoteName: tool.remoteName,
+                name: localToolName(connection, tool.localName),
+                version: '1.0.0',
+                description: tool.description,
+                input: OPAQUE_INPUT,
+                output: z.unknown(),
+                permissions: [permissionFor(connection, tool.remoteName)],
+                sideEffects: tool.sideEffects,
+                reversible: tool.reversible,
+                cost: tool.cost,
+            }));
+        }
+    }
+    return {
+        definitions,
+        async dispose() {
+            for (const client of clients)
+                client.close();
+            await Promise.all(sandboxes.map((sandbox) => sandbox.cleanup()));
+        },
+    };
+}
+//# sourceMappingURL=tool-definitions.js.map

package/dist/registry/tool-definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-definitions.js","sourceRoot":"","sources":["../../src/registry/tool-definitions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,oBAAoB,EAAuB,MAAM,sBAAsB,CAAA;AAChF,OAAO,EAAE,oBAAoB,EAA8B,MAAM,2BAA2B,CAAA;AAE5F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAqDpD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AAEtD,SAAS,aAAa,CAAC,UAAgC,EAAE,SAAiB;IACxE,OAAO,gBAAgB,UAAU,CAAC,EAAE,IAAI,SAAS,EAAE,CAAA;AACrD,CAAC;AAED,wGAAwG;AACxG,SAAS,aAAa,CAAC,UAAgC,EAAE,UAAkB;IACzE,OAAO,gBAAgB,UAAU,CAAC,EAAE,IAAI,UAAU,EAAE,CAAA;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAuC;IAEvC,MAAM,WAAW,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACrD,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CACzE,CAAA;IAED,MAAM,WAAW,GAAqB,EAAE,CAAA;IACxC,MAAM,OAAO,GAAgB,EAAE,CAAA;IAC/B,MAAM,SAAS,GAAqB,EAAE,CAAA;IAEtC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,8DAA8D,EAAE;gBACnF,UAAU,EAAE,UAAU,CAAC,EAAE;gBACzB,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,8DAA8D,EAAE;gBACnF,UAAU,EAAE,UAAU,CAAC,EAAE;aAC1B,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,IAAI,MAA0B,CAAA;QAC9B,IAAI,UAAU,CAAC,QAAQ,KAAK,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YAC3D,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,6DAA6D,EAAE;oBACnF,UAAU,EAAE,UAAU,CAAC,EAAE;oBACzB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAA2B,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAA;QACzD,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAClE,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,MAAM,CAAA;QACvC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAA;QAC5C,IAAI,MAAiB,CAAA;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,oBAAoB,CAAC;gBAC5B,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,GAAG;gBACH,GAAG,EAAE,OAAO,CAAC,IAAI;gBACjB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnE,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;gBACxF,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;aACvE,CAAC,CAAA;YACF,MAAM,MAAM,CAAC,UAAU,EAAE,CAAA;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,yDAAyD,EAAE;gBAC/E,UAAU,EAAE,UAAU,CAAC,EAAE;gBACzB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAA;YACF,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;YACvB,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACpB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAEvB,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC3C,WAAW,CAAC,IAAI,CACd,WAAW,CAAC;gBACV,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,IAAI,EAAE,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC/C,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;gBACnB,WAAW,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzD,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CACH,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW;QACX,KAAK,CAAC,OAAO;YACX,KAAK,MAAM,MAAM,IAAI,OAAO;gBAAE,MAAM,CAAC,KAAK,EAAE,CAAA;YAC5C,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QAClE,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cogenta/mcp",
-  "version": "0.1.4",
+  "version": "0.3.0",
   "description": "MCP (Model Context Protocol) server and client — the tool registry, exposed.",
   "license": "MPL-2.0",
   "type": "module",
@@ -28,8 +28,8 @@
   },
   "dependencies": {
     "zod": "^4.4.3",
-    "@cogenta/agents": "0.2.1",
-    "@cogenta/core": "0.4.0"
+    "@cogenta/agents": "0.4.0",
+    "@cogenta/core": "0.6.0"
   },
   "devDependencies": {
     "typescript": "^7.0.2",