@decionis/mcp 0.3.0 → 0.4.0

package/dist/{chunk-ABHNQFWI.js → chunk-GCE6PUYD.js}

@@ -3,7 +3,7 @@ import {
   LocalDecionisGateway,
   PolicyFileRepository,
   normalizeVerdict
-} from "./chunk-LIVLO4MV.js";
+} from "./chunk-5Q6BCK32.js";
 
 // src/agent/AgentContracts.ts
 var AgentHookInputError = class extends Error {
@@ -498,4 +498,4 @@ export {
   AgentHostRegistry,
   AgentHookCommand
 };
-//# sourceMappingURL=chunk-ABHNQFWI.js.map
+//# sourceMappingURL=chunk-GCE6PUYD.js.map

package/dist/index.js

@@ -5,12 +5,12 @@ import {
   external_exports,
   normalizeVerdict,
   sha256Hex
-} from "./chunk-LIVLO4MV.js";
+} from "./chunk-5Q6BCK32.js";
 
 // src/Server.ts
 import { createInterface } from "readline";
 var SUPPORTED_PROTOCOL_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
-var MCP_SERVER_VERSION = "0.3.0";
+var MCP_SERVER_VERSION = "0.4.0";
 var DEFAULT_PROTOCOL_VERSION = "2025-11-25";
 var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function rpcResult(id, result) {
@@ -606,7 +606,7 @@ function createDecionisTools(gateway2, additionalTools = [], options = {}) {
 // src/kubernetes/KubernetesActionPlanner.ts
 import { randomUUID } from "crypto";
 
-// ../../packages/sdk-node/dist/index.js
+// ../../../Decionis/packages/sdk-node/dist/index.js
 import { createHash as createHash2 } from "crypto";
 import { createHash as createHash3 } from "crypto";
 var DEFAULT_SKEW_MS = 6 * 60 * 60 * 1e3;
@@ -733,16 +733,10 @@ var authorityVerificationRequirementsSchema = external_exports.object({
     });
   }
 });
-var authorityApprovalTierSchema = external_exports.object({
-  priority: external_exports.number().int().min(1).max(5),
-  principal_ids: external_exports.array(external_exports.string().min(1).max(200)).min(1).max(10)
-}).strict();
 var authorityResolutionPolicySchema = external_exports.object({
   quorum: external_exports.literal(1),
   delegation: external_exports.enum(["DISALLOWED", "REQUIREMENT_REFRESH"]),
-  fallback_role_ids: external_exports.array(external_exports.string().regex(/^[A-Z][A-Z0-9_]{1,63}$/)).max(10).default([]),
-  /** An approval chain: one valid proof from every tier satisfies the requirement. */
-  tiers: external_exports.array(authorityApprovalTierSchema).min(1).max(5).optional()
+  fallback_role_ids: external_exports.array(external_exports.string().regex(/^[A-Z][A-Z0-9_]{1,63}$/)).max(10).default([])
 }).strict().superRefine((policy, context) => {
   if (new Set(policy.fallback_role_ids).size !== policy.fallback_role_ids.length) {
     context.addIssue({
@@ -751,24 +745,6 @@ var authorityResolutionPolicySchema = external_exports.object({
       message: "fallback role ids must be unique"
     });
   }
-  if (policy.tiers) {
-    const priorities = policy.tiers.map((tier) => tier.priority);
-    if (priorities.some((priority, index) => index > 0 && priority <= priorities[index - 1])) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["tiers"],
-        message: "tier priorities must be unique and ascending"
-      });
-    }
-    const principals = policy.tiers.flatMap((tier) => tier.principal_ids);
-    if (new Set(principals).size !== principals.length) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["tiers"],
-        message: "a principal belongs to one tier only"
-      });
-    }
-  }
 });
 var originatorSchema = external_exports.object({
   organization_id: external_exports.string().min(1).max(200),
@@ -834,13 +810,6 @@ var decionisAuthorityRequirementSchema = external_exports.object({
       message: "fallback roles must not repeat the primary role"
     });
   }
-  if (requirement.resolution.tiers && requirement.selector.kind !== "ROLE") {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["resolution", "tiers"],
-      message: "an approval chain names its members' trusted role through a ROLE selector"
-    });
-  }
   if (requirement.orchestration?.mode === "MANAGED" && requirement.selector.kind === "PRINCIPAL" && requirement.selector.role_id === void 0) {
     context.addIssue({
       code: external_exports.ZodIssueCode.custom,
@@ -1023,25 +992,13 @@ function expectedManagedEscalationOutcome(status) {
   if (["EXPIRED", "REJECTED", "BLOCKED", "CANCELLED"].includes(status)) return "BLOCK";
   return "ESCALATE_PENDING";
 }
-var managedApprovalTierSchema = external_exports.object({
-  tier: external_exports.number().int().min(1).max(5),
-  tier_count: external_exports.number().int().min(1).max(5),
-  principal_id: external_exports.string().min(1).max(200)
-}).strict();
-var managedApprovalChainSchema = external_exports.object({
-  chain_id: external_exports.string().max(200),
-  tier_count: external_exports.number().int().min(1).max(5),
-  tiers_approved: external_exports.number().int().min(0).max(5)
-}).strict();
 var managedEscalationReferenceSchema = external_exports.object({
   outcome: managedEscalationOutcomeSchema,
   escalation_id: external_exports.string().min(8).max(200),
   intent_id: external_exports.string().min(1).max(200),
   status: managedEscalationStatusSchema,
   expires_at: external_exports.string().datetime(),
-  reason_codes: external_exports.array(external_exports.string().min(1).max(200)).max(50),
-  approval_tier: managedApprovalTierSchema.nullable().optional().default(null),
-  approval_chain: managedApprovalChainSchema.nullable().optional().default(null)
+  reason_codes: external_exports.array(external_exports.string().min(1).max(200)).max(50)
 }).strict().superRefine((reference, context) => {
   if (reference.outcome !== expectedManagedEscalationOutcome(reference.status)) {
     context.addIssue({
@@ -1092,8 +1049,6 @@ var managedEscalationViewSchema = external_exports.object({
   outcome: managedEscalationOutcomeSchema,
   expires_at: external_exports.string().datetime(),
   reason_codes: external_exports.array(external_exports.string().min(1).max(200)).max(50),
-  approval_tier: managedApprovalTierSchema.nullable().optional().default(null),
-  approval_chain: managedApprovalChainSchema.nullable().optional().default(null),
   decision: authorityDecisionSchema.nullable()
 }).strict().superRefine((view, context) => {
   if (view.outcome !== expectedManagedEscalationOutcome(view.status)) {
@@ -1379,7 +1334,6 @@ var DecionisExecutionClient = class {
         claim_token: claimToken,
         claim_validated_at: claimValidatedAt,
         claim_lease_expires_at: claimLeaseExpiresAt,
-        ...typeof body.claim_attestation === "string" && body.claim_attestation.length > 0 ? { claim_attestation: body.claim_attestation } : {},
         ...body.evidence && typeof body.evidence === "object" ? { evidence: body.evidence } : {}
       };
       if (executionAuthorityProtocolSemantics(redemption) === "UNSUPPORTED") {
@@ -2356,7 +2310,7 @@ var KubectlCommandRunner = class {
 // src/kubernetes/KubernetesOperations.ts
 import { createHash as createHash4 } from "crypto";
 
-// ../../packages/dossier-verify/dist/chunk-WNX2CYWD.js
+// ../../../Decionis/packages/dossier-verify/dist/chunk-WNX2CYWD.js
 import { createHash, createPublicKey, verify as verifyEd25519 } from "crypto";
 import { lookup } from "dns/promises";
 import { request as httpsRequest } from "https";
@@ -8465,16 +8419,90 @@ var networkRead = {
 function createShieldPairTool(options = {}) {
   const store = options.store ?? new ShieldCredentialStore();
   const fetchImpl = options.fetch ?? fetch;
-  const baseUrl = () => (options.baseUrl?.() ?? process.env.DECIONIS_SHIELD_API_URL?.trim() ?? "").replace(/\/+$/, "") || "https://api.shield.decionis.com";
+  const baseUrl = () => (options.baseUrl?.() ?? process.env.DECIONIS_SHIELD_API_URL?.trim() ?? "").replace(
+    /\/+$/,
+    ""
+  ) || "https://api.shield.decionis.com";
+  const pendingEmail = /* @__PURE__ */ new Map();
+  const post = async (path, body) => fetchImpl(`${baseUrl()}${path}`, {
+    method: "POST",
+    headers: {
+      accept: "application/json",
+      "content-type": "application/json",
+      "x-shield-surface": "mcp"
+    },
+    body: JSON.stringify(body)
+  });
+  const unreachable = (error) => ({
+    content: text4({
+      error: "SHIELD_PAIRING_UNREACHABLE",
+      message: `Could not reach Shield: ${error instanceof Error ? error.message : String(error)}. Nothing was paired.`
+    }),
+    isError: true
+  });
+  const keep = async (response, displayName, agentId, hints) => {
+    const payload = await response.json().catch(() => null);
+    if (response.ok && payload?.upgrade_required === true) {
+      return {
+        content: text4({
+          error: "SHIELD_SOURCE_LIMIT",
+          message: "The user's free Shield already covers its limit of spending sources. They can remove one in the Shield app or upgrade; nothing was paired."
+        }),
+        isError: true
+      };
+    }
+    if (!response.ok || !payload || typeof payload.api_key !== "string" || typeof payload.app_id !== "string") {
+      const code_ = payload && typeof payload.error === "string" ? payload.error : `HTTP ${response.status}`;
+      return {
+        content: text4({ error: code_, message: hints[code_] ?? "Nothing was paired." }),
+        isError: true
+      };
+    }
+    const integration = payload.integration ?? {};
+    const credential = {
+      apiKey: payload.api_key,
+      appId: payload.app_id,
+      baseUrl: baseUrl(),
+      integrationId: typeof integration.integrationId === "string" ? integration.integrationId : void 0,
+      displayName,
+      agentId,
+      pairedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    store.write(credential);
+    const limit = typeof payload.weekly_limit === "number" ? payload.weekly_limit : null;
+    return {
+      content: text4({
+        paired: true,
+        rotated: payload.rotated === true,
+        displayName,
+        weeklyLimit: limit,
+        storedAt: store.location(),
+        next: "The shield.* tools now ask this user's own Shield. Before any purchase, call shield.request_purchase; execute only on ALLOW."
+      })
+    };
+  };
   return {
     name: "shield.pair",
     title: "Pair with the user's Shield",
-    description: "Bind this assistant to the user's Decionis Shield with the six-character pairing code shown in the Shield app (AI spending allowance \u2192 Bind your own agent). Ask the user for the code; never guess one. After pairing, shield.request_purchase and the other shield.* tools ask the user's own spending rules.",
+    description: "Bind this assistant to the user's Decionis Shield, one of two ways. (1) The six-character pairing code shown in the Shield app (AI spending allowance \u2192 Bind your own agent): pass it as code. (2) The user's email: pass email, and Shield emails them a 6-digit code; ask the user for it, then call again with email and emailCode. Ask the user; never guess a code. After pairing, shield.request_purchase and the other shield.* tools ask the user's own spending rules.",
     inputSchema: {
       type: "object",
-      required: ["code"],
       properties: {
-        code: { type: "string", pattern: "^[A-Za-z0-9]{6,8}$", description: "The code from the Shield app." },
+        code: {
+          type: "string",
+          pattern: "^[A-Za-z0-9]{6,8}$",
+          description: "The pairing code from the Shield app."
+        },
+        email: {
+          type: "string",
+          maxLength: 254,
+          description: "The user's Shield email, to be sent a sign-in code."
+        },
+        emailCode: {
+          type: "string",
+          pattern: "^[0-9]{6}$",
+          description: "The 6-digit code Shield emailed to the user."
+        },
         displayName: {
           type: "string",
           maxLength: 120,
@@ -8485,63 +8513,94 @@ function createShieldPairTool(options = {}) {
     },
     annotations: networkMutation,
     handler: async (args) => {
-      const code = typeof args.code === "string" ? args.code.trim().toUpperCase() : "";
-      if (!/^[A-Z0-9]{6,8}$/.test(code)) {
-        return { content: text4("A pairing code is 6 to 8 letters and digits. Ask the user for the code shown in the Shield app."), isError: true };
-      }
       const displayName = typeof args.displayName === "string" && args.displayName.trim() ? args.displayName.trim().slice(0, 120) : defaultAgentDisplayName(options.clientName?.());
-      const agentId = store.agentId();
-      let response;
-      try {
-        response = await fetchImpl(`${baseUrl()}/v1/consumer/pairing/claim`, {
-          method: "POST",
-          headers: {
-            accept: "application/json",
-            "content-type": "application/json",
-            "x-shield-surface": "mcp"
-          },
-          body: JSON.stringify({
-            code,
-            agent: { app_id: SHIELD_MCP_APP_ID, agent_id: agentId, display_name: displayName }
-          })
+      const agent = {
+        app_id: SHIELD_MCP_APP_ID,
+        agent_id: store.agentId(),
+        display_name: displayName
+      };
+      const email = typeof args.email === "string" ? args.email.trim().toLowerCase() : "";
+      const emailCode = typeof args.emailCode === "string" ? args.emailCode.trim() : "";
+      if (email) {
+        if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+          return {
+            content: text4(
+              "That is not an email address. Ask the user for the email they use with Shield."
+            ),
+            isError: true
+          };
+        }
+        if (!emailCode) {
+          let response3;
+          try {
+            response3 = await post("/v1/consumer/auth/start", { email, scope: "agent" });
+          } catch (error) {
+            return unreachable(error);
+          }
+          const payload = await response3.json().catch(() => null);
+          if (!response3.ok || !payload || typeof payload.challenge_id !== "string") {
+            return {
+              content: text4({
+                error: response3.status === 429 ? "SHIELD_TOO_MANY_CODES" : `HTTP ${response3.status}`,
+                message: response3.status === 429 ? "Shield has sent several codes already. Wait a minute, then try again." : "Shield could not send a code right now. Nothing was paired."
+              }),
+              isError: true
+            };
+          }
+          pendingEmail.set(email, payload.challenge_id);
+          return {
+            content: text4({
+              emailed: true,
+              email,
+              next: `Ask the user for the 6-digit code Shield just emailed to ${email}, then call shield.pair again with email and emailCode.`
+            })
+          };
+        }
+        if (!/^[0-9]{6}$/.test(emailCode)) {
+          return {
+            content: text4(
+              "The emailed code is 6 digits. Ask the user to read it from the Shield email."
+            ),
+            isError: true
+          };
+        }
+        let response2;
+        try {
+          response2 = await post("/v1/consumer/auth/verify", {
+            email,
+            code: emailCode,
+            ...pendingEmail.has(email) ? { challenge_id: pendingEmail.get(email) } : {},
+            scope: "agent",
+            agent
+          });
+        } catch (error) {
+          return unreachable(error);
+        }
+        if (response2.ok) pendingEmail.delete(email);
+        return keep(response2, displayName, agent.agent_id, {
+          INVALID_CODE: "The code is wrong or has expired (five minutes). Ask the user for the newest code, or call shield.pair with email again to send a fresh one.",
+          OTP_TOO_MANY_ATTEMPTS: "Too many wrong codes for that email. Call shield.pair with email again to send a fresh one.",
+          CHALLENGE_NOT_FOUND: "No code is waiting for that email. Call shield.pair with email first."
         });
-      } catch (error) {
+      }
+      const code = typeof args.code === "string" ? args.code.trim().toUpperCase() : "";
+      if (!/^[A-Z0-9]{6,8}$/.test(code)) {
         return {
-          content: text4({
-            error: "SHIELD_PAIRING_UNREACHABLE",
-            message: `Could not reach Shield: ${error instanceof Error ? error.message : String(error)}. Nothing was paired.`
-          }),
+          content: text4(
+            "Give either the pairing code shown in the Shield app (6 to 8 letters and digits) or the user's email. Ask the user; never guess."
+          ),
           isError: true
         };
       }
-      const payload = await response.json().catch(() => null);
-      if (!response.ok || !payload || typeof payload.api_key !== "string" || typeof payload.app_id !== "string") {
-        const code_ = payload && typeof payload.error === "string" ? payload.error : `HTTP ${response.status}`;
-        const hint = code_ === "PAIRING_CODE_INVALID" ? "The code is wrong, expired (ten minutes) or already used. Ask the user for a fresh one from the Shield app." : "Nothing was paired.";
-        return { content: text4({ error: code_, message: hint }), isError: true };
+      let response;
+      try {
+        response = await post("/v1/consumer/pairing/claim", { code, agent });
+      } catch (error) {
+        return unreachable(error);
       }
-      const integration = payload.integration ?? {};
-      const credential = {
-        apiKey: payload.api_key,
-        appId: payload.app_id,
-        baseUrl: baseUrl(),
-        integrationId: typeof integration.integrationId === "string" ? integration.integrationId : void 0,
-        displayName,
-        agentId,
-        pairedAt: (/* @__PURE__ */ new Date()).toISOString()
-      };
-      store.write(credential);
-      const limit = typeof payload.weekly_limit === "number" ? payload.weekly_limit : null;
-      return {
-        content: text4({
-          paired: true,
-          rotated: payload.rotated === true,
-          displayName,
-          weeklyLimit: limit,
-          storedAt: store.location(),
-          next: "The shield.* tools now ask this user's own Shield. Before any purchase, call shield.request_purchase; execute only on ALLOW."
-        })
-      };
+      return keep(response, displayName, agent.agent_id, {
+        PAIRING_CODE_INVALID: "The code is wrong, expired (ten minutes) or already used. Ask the user for a fresh one from the Shield app."
+      });
     }
   };
 }