@ekanos/sdk 0.1.1 → 0.1.3

package/eslint.preset.mjs

@@ -0,0 +1,373 @@
+/**
+ * @ekanos/sdk/eslint — the capability ESLint preset ("R5").
+ *
+ * This is a SECURITY CONTROL, not a style preset. Partner integration code
+ * runs UNSANDBOXED, in-process, inside the host: the generated
+ * `partner-integration-bootstrap.ts` statically imports each partner package,
+ * so a partner module graph evaluates with full host authority before any
+ * validation runs.
+ *
+ * The accepted T1 trust tier rests on exactly two controls:
+ *
+ *   1. the promotion gate — a human reads the SOURCE before it is built, and
+ *   2. THIS PRESET — which bans the escapes that route around the capability
+ *      layer, so "reads the source" is a tractable review rather than an
+ *      invitation to spot `globalThis.fetch` by eye.
+ *
+ * Runtime SANDBOXING of handlers is the deferred T3 tier. Until it exists,
+ * every rule below is load-bearing.
+ *
+ * ── Why it lives here ────────────────────────────────────────────────────
+ * A partner already installs `@ekanos/sdk`, so the control ships with the
+ * surface it protects and versions in lockstep with it: the day `ctx.fetch`
+ * grows a documented client-side twin, the fetch rule relaxes in the same
+ * release. It is dependency-free — every rule below is core ESLint — so it
+ * adds nothing to the SDK's build, `api-report`, or `pack:test`.
+ *
+ * ── Usage (a partner's eslint.config.mjs) ────────────────────────────────
+ *
+ *   import capabilityPreset from '@ekanos/sdk/eslint';
+ *
+ *   export default [
+ *     ...someBaseConfig,
+ *     ...capabilityPreset,
+ *   ];
+ *
+ * ── Inline disables do not work, by design ───────────────────────────────
+ * The preset sets `linterOptions.noInlineConfig` over the source glob, so
+ * `// eslint-disable-next-line` cannot silence these rules from partner
+ * source — otherwise the control would be opt-out by the very code it
+ * constrains. A genuine exception must be a FILE-SCOPED OVERRIDE in the
+ * package's own `eslint.config.mjs`, where a reviewer reads it. Both
+ * exceptions currently granted in this repo live in the example packages'
+ * configs and are recorded there with the reason.
+ */
+
+/**
+ * Glob for partner integration SOURCE. Build tooling — `vitest.config.ts`,
+ * `eslint.config.mjs`, `tsup.config.ts` — is deliberately OUT of scope: it
+ * runs on the partner's build machine, never in the host process, and it
+ * legitimately imports `node:path`/`node:url`. Narrowing the preset to source
+ * is what keeps it free of the false positives that get a control disabled.
+ */
+const SOURCE_GLOB = ['src/**/*.ts', 'src/**/*.tsx'];
+
+const CTX_FETCH_REMEDIATION =
+  'Use `ctx.fetch` from the capability context (`IntegrationContext`) instead, ' +
+  "and declare every origin you call in your integration's `egress` " +
+  'allowlist — `defineIntegration({ egress: [...] })`. `ctx.fetch` refuses an ' +
+  'undeclared origin before any I/O, re-checks every redirect hop, and pins ' +
+  'the vetted IP addresses so an allowlisted hostname cannot be rebound to a ' +
+  'host-internal address. A global fetch has none of that, so it is an egress ' +
+  'bypass. Widening `egress` is a reviewed security-posture change, not a ' +
+  'config tweak.';
+
+const CTX_SECRETS_REMEDIATION =
+  'Use `ctx.secrets.get(name)` from the capability context instead, and ' +
+  "declare the credential in your integration's activation schema. The host " +
+  "process environment holds the platform's own credentials — it is not your " +
+  'configuration store, and reading it is how an integration gets a secret it ' +
+  'was never granted.';
+
+/**
+ * Node builtins a partner integration must never reach, each with the
+ * capability that replaces it. Every entry is listed twice — bare and
+ * `node:`-prefixed — because both resolve.
+ *
+ * This is an explicit list rather than a blanket `node:*` ban on purpose: the
+ * SDK surface is isomorphic, and `node:crypto`/`node:url`-shaped imports are
+ * neither an escape nor worth training a partner to reach for a disable
+ * comment over. The generic escape hatch — a computed dynamic `import()` — is
+ * closed separately in `no-restricted-syntax` below, so the list cannot be
+ * routed around by building the specifier at runtime.
+ */
+const BANNED_MODULES = [
+  {
+    names: ['fs', 'node:fs', 'fs/promises', 'node:fs/promises'],
+    message:
+      'The host filesystem is not part of the capability surface. Use ' +
+      '`ctx.storage.account` / `ctx.storage.user` for integration state — it ' +
+      'is scoped to the account the request is authorized for, quota-bounded, ' +
+      'and schema-validated. Filesystem access reads and writes host state ' +
+      'that no account owns.',
+  },
+  {
+    names: ['child_process', 'node:child_process'],
+    message:
+      'Spawning a process escapes every capability control at once. There is ' +
+      'no replacement: an integration is data-in / data-out. If you need work ' +
+      "the SDK cannot express, raise it as an SDK gap in your integration's " +
+      'README rather than shelling out.',
+  },
+  {
+    names: [
+      'net',
+      'node:net',
+      'tls',
+      'node:tls',
+      'dgram',
+      'node:dgram',
+      'http',
+      'node:http',
+      'https',
+      'node:https',
+      'http2',
+      'node:http2',
+    ],
+    message:
+      'Raw sockets and the `http`/`https` clients bypass the egress allowlist ' +
+      'and its address guard entirely. ' +
+      CTX_FETCH_REMEDIATION,
+  },
+  {
+    names: ['dns', 'node:dns', 'dns/promises', 'node:dns/promises'],
+    message:
+      'Resolving hostnames yourself is the first half of a DNS-rebinding ' +
+      'egress bypass — `ctx.fetch` resolves ONCE and pins the vetted ' +
+      'addresses precisely so that a name cannot resolve differently between ' +
+      'the check and the connection. ' +
+      CTX_FETCH_REMEDIATION,
+  },
+  {
+    names: ['worker_threads', 'node:worker_threads'],
+    message:
+      'A worker thread runs on a path where the capability context does not ' +
+      'exist, so nothing inside it can reach `ctx.fetch`, `ctx.secrets` or ' +
+      '`ctx.storage`. Do the work in the handler, with `ctx`, and let the ' +
+      'host own concurrency — batch or paginate rather than fanning out.',
+  },
+  {
+    names: ['vm', 'node:vm'],
+    message:
+      '`vm` executes code from a string, which makes the source a reviewer ' +
+      'reads no longer the code that runs — the assumption the T1 trust tier ' +
+      'is built on. Write the logic as source.',
+  },
+  {
+    names: ['module', 'node:module'],
+    message:
+      '`node:module` (`createRequire`) is a loader escape hatch: it resolves ' +
+      'modules this preset bans by name at runtime. Use a static `import` of ' +
+      'a package you declare in `dependencies`.',
+  },
+  {
+    names: ['process', 'node:process'],
+    message:
+      'Importing `process` reaches the host environment. ' +
+      CTX_SECRETS_REMEDIATION,
+  },
+  {
+    names: ['os', 'node:os'],
+    message:
+      '`node:os` reports the host machine — hostname, users, network ' +
+      'interfaces, home directories. None of it describes the account your ' +
+      'integration is running for, and all of it is host reconnaissance. ' +
+      'Read what you need from the capability context instead: ' +
+      '`ctx.accountId` for who this run is for, `ctx.storage` for state you ' +
+      'persisted, `ctx.logger` for diagnostics.',
+  },
+  {
+    names: ['undici', 'node-fetch', 'axios', 'got', 'superagent', 'request'],
+    message:
+      'A third-party HTTP client issues requests the egress allowlist never ' +
+      'sees, which is the same bypass as a global `fetch` with an extra ' +
+      'dependency. ' +
+      CTX_FETCH_REMEDIATION,
+  },
+  {
+    names: ['react-i18next'],
+    importNames: ['Trans'],
+    message:
+      'Use `Trans` from `@ekanos/ui/trans` instead — it is wired to the ' +
+      "host's i18n instance, so your strings resolve against the same " +
+      'namespaces and language the surrounding page already loaded.',
+  },
+];
+
+/** Globals that reach the network without passing through `ctx.fetch`. */
+const EGRESS_GLOBALS = ['fetch', 'XMLHttpRequest', 'WebSocket', 'EventSource'];
+
+/** Objects a `globalThis.fetch`-style member access can hide behind. */
+const GLOBAL_OBJECTS = 'globalThis|window|self|global';
+
+/** Members of those objects that are the very escapes banned as bare globals. */
+const GLOBAL_ESCAPE_MEMBERS =
+  'fetch|XMLHttpRequest|WebSocket|EventSource|process|eval|require|Function';
+
+/**
+ * `@kit/*` is checked with a PATTERN rather than a path so every subpath is
+ * covered (`@kit/ui/badge`, `@kit/next/actions`, …). This is the rule that
+ * catches, at lint time in the partner's own editor, the failure that
+ * otherwise surfaces as an unresolvable module at install time — which is
+ * exactly how our own reference example turned out to be unbuildable outside
+ * the monorepo.
+ */
+const KIT_PATTERN = {
+  group: ['@kit/*', '@kit/*/**'],
+  message:
+    '`@kit/*` packages are workspace-internal to the Fusion monorepo and do ' +
+    'not exist on any registry, so this import cannot resolve for anyone ' +
+    'outside it — including in the clean-room build your submission is gated ' +
+    'on. Import UI primitives from `@ekanos/ui/*` (badge, button, card, form, ' +
+    'input, select, icon, utils, …), integration surfaces from `@ekanos/sdk` ' +
+    'and its `/components`, `/hooks`, `/mcp`, `/context`, `/integration` ' +
+    'entrypoints, and nothing else from the host.',
+};
+
+const SUPABASE_PATTERN = {
+  group: ['@supabase/*', '@supabase/*/**'],
+  message:
+    'A direct Supabase client talks to the database with whatever key it is ' +
+    'given, outside the account scoping and RLS the host applies for you. Use ' +
+    '`ctx.storage.account` / `ctx.storage.user` for integration state — ' +
+    'authorized for the account in the request and validated against your ' +
+    'declared schema.',
+};
+
+/** Flattens BANNED_MODULES into `no-restricted-imports` `paths` entries. */
+function bannedPaths() {
+  return BANNED_MODULES.flatMap((entry) =>
+    entry.names.map((name) => ({
+      name,
+      message: entry.message,
+      ...(entry.importNames ? { importNames: entry.importNames } : {}),
+    })),
+  );
+}
+
+/**
+ * The rules, exported separately so a consumer can compose them into its own
+ * config block (a different `files` glob, say) without re-deriving them.
+ */
+export const capabilityRules = {
+  /**
+   * Bare global references only. ESLint resolves scope first, so a parameter
+   * or local named `fetch` — the SDK's own `IntegrationFetch` injection
+   * pattern, `getJson(fetch, url)` — is NOT reported. That is the intended
+   * shape: pass the mediated fetch in as a value.
+   */
+  'no-restricted-globals': [
+    'error',
+    ...EGRESS_GLOBALS.map((name) => ({
+      name,
+      message: `\`${name}\` reaches the network outside the capability layer. ${CTX_FETCH_REMEDIATION}`,
+    })),
+    {
+      name: 'process',
+      message: `\`process\` (including \`process.env\`) is host state, not integration state. ${CTX_SECRETS_REMEDIATION}`,
+    },
+    {
+      name: 'require',
+      message:
+        '`require` resolves modules at runtime, so no reviewer and no import ' +
+        'rule can see what is actually loaded. Use a static `import` of a ' +
+        'package declared in `dependencies`.',
+    },
+    {
+      name: 'eval',
+      message:
+        '`eval` runs code built at runtime, so the source a reviewer reads ' +
+        'stops being the code that runs — and human review of source is half ' +
+        'of what makes running your integration in-process acceptable. Write ' +
+        'the logic as source.',
+    },
+  ],
+
+  'no-restricted-imports': [
+    'error',
+    { paths: bannedPaths(), patterns: [KIT_PATTERN, SUPABASE_PATTERN] },
+  ],
+
+  'no-restricted-syntax': [
+    'error',
+    {
+      // Closes the hole in no-restricted-globals: that rule resolves
+      // identifiers, so `globalThis.fetch` (a member access, not a global
+      // reference) is invisible to it.
+      selector: `MemberExpression[object.name=/^(${GLOBAL_OBJECTS})$/][property.name=/^(${GLOBAL_ESCAPE_MEMBERS})$/]`,
+      message:
+        'Reaching an escape through the global object is the same bypass as ' +
+        'naming it directly, and it is how a capability control gets routed ' +
+        'around without tripping an import rule. Use the capability context: ' +
+        '`ctx.fetch` for network calls (with the origin declared in `egress`) ' +
+        'and `ctx.secrets` for credentials.',
+    },
+    {
+      // Computed-string member access, e.g. `globalThis['fetch']`.
+      selector: `MemberExpression[computed=true][object.name=/^(${GLOBAL_OBJECTS})$/]`,
+      message:
+        'Indexing the global object with a computed key hides which global is ' +
+        'being reached, which defeats every rule in this preset. Reference ' +
+        'what you need directly, through the capability context — `ctx.fetch` ' +
+        'for network calls, `ctx.secrets` for credentials, `ctx.storage` for ' +
+        'state.',
+    },
+    {
+      selector: 'NewExpression[callee.name="Function"]',
+      message:
+        '`new Function` compiles code from a string — the same problem as ' +
+        '`eval`: the source under review is no longer the code that runs. ' +
+        'Write the logic as source.',
+    },
+    {
+      selector: 'CallExpression[callee.name="Function"]',
+      message:
+        '`Function(...)` compiles code from a string — the same problem as ' +
+        '`eval`: the source under review is no longer the code that runs. ' +
+        'Write the logic as source.',
+    },
+    {
+      // The generic route around no-restricted-imports: build the specifier
+      // at runtime and the import rule has nothing to match.
+      selector: 'ImportExpression[source.type!="Literal"]',
+      message:
+        'A dynamic `import()` with a computed specifier hides what is loaded ' +
+        'from both the import rules and the human promotion review. Use a ' +
+        'static `import`, or `import("literal-specifier")` if you genuinely ' +
+        'need lazy loading.',
+    },
+    {
+      // `no-restricted-imports` does not inspect dynamic import specifiers,
+      // so the banned module list is re-applied to literal ones here.
+      selector:
+        'ImportExpression[source.value=/^(node:)?(fs|child_process|net|tls|dgram|dns|http|https|http2|worker_threads|vm|module|process|os)$/]',
+      message:
+        'This Node builtin is banned for integration code whether it is ' +
+        'imported statically or dynamically — a dynamic `import()` of it is ' +
+        'the same capability escape. See the static-import message for the ' +
+        'capability that replaces it (`ctx.fetch`, `ctx.secrets`, ' +
+        '`ctx.storage`).',
+    },
+    {
+      // The `/promises` faces of the same builtins. Split out because a `/`
+      // cannot appear inside an esquery regex-literal attribute value.
+      selector:
+        'ImportExpression[source.value=/^(node:)?(fs|dns)\\u002Fpromises$/]',
+      message:
+        'This Node builtin is banned for integration code whether it is ' +
+        'imported statically or dynamically. Use `ctx.storage` for state and ' +
+        '`ctx.fetch` for network calls.',
+    },
+  ],
+};
+
+/**
+ * The preset. Spread it AFTER any base config: it deliberately replaces a
+ * base `no-restricted-imports` / `no-restricted-globals` /
+ * `no-restricted-syntax` setting rather than merging with it (flat config does
+ * not merge rule options), and it re-states the one entry the Fusion base
+ * config carries — `react-i18next`'s `Trans` — in its partner-correct form.
+ */
+export default [
+  {
+    name: '@ekanos/sdk/eslint:capabilities',
+    files: SOURCE_GLOB,
+    linterOptions: {
+      // A control the constrained code can switch off is not a control.
+      // Exceptions belong in the consumer's config, where review sees them.
+      // See the header.
+      noInlineConfig: true,
+    },
+    rules: capabilityRules,
+  },
+];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ekanos/sdk",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "description": "The official SDK for building Ekanos integrations.",
   "license": "MIT",
@@ -12,8 +12,11 @@
   ],
   "files": [
     "dist",
+    "!dist/mcp",
     "README.md",
-    "LICENSE"
+    "api-report.md",
+    "LICENSE",
+    "eslint.preset.mjs"
   ],
   "exports": {
     ".": {
@@ -28,10 +31,6 @@
       "types": "./dist/hooks/index.d.ts",
       "default": "./dist/hooks/index.js"
     },
-    "./mcp": {
-      "types": "./dist/mcp/index.d.ts",
-      "default": "./dist/mcp/index.js"
-    },
     "./context": {
       "types": "./dist/context/index.d.ts",
       "default": "./dist/context/index.js"
@@ -43,16 +42,17 @@
     "./integration": {
       "types": "./dist/integration/index.d.ts",
       "default": "./dist/integration/index.js"
-    }
+    },
+    "./eslint": "./eslint.preset.mjs"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
+    "@ekanos/integration-schema": "0.1.3",
+    "@ekanos/ui": "0.1.3",
     "@supabase/supabase-js": "2.87.1",
-    "server-only": "^0.0.1",
-    "@ekanos/integration-schema": "0.1.1",
-    "@ekanos/ui": "0.1.1"
+    "server-only": "^0.0.1"
   },
   "peerDependencies": {
     "@hookform/resolvers": "^5.2.2",
@@ -63,18 +63,18 @@
     "zod": "^3.25.76"
   },
   "devDependencies": {
-    "@hookform/resolvers": "^5.2.2",
-    "@tanstack/react-query": "5.101.4",
+    "@hookform/resolvers": "^5.9.1",
+    "@kit/eslint-config": "0.2.0",
+    "@kit/prettier-config": "0.1.0",
+    "@kit/tsconfig": "0.1.0",
+    "@tanstack/react-query": "5.102.8",
     "@types/react": "19.2.18",
-    "next": "16.3.1",
+    "next": "16.3.3",
     "react": "19.2.8",
-    "react-hook-form": "^7.68.0",
+    "react-hook-form": "^7.87.0",
     "typescript": "^5.9.3",
     "vitest": "4.1.10",
-    "zod": "^3.25.74",
-    "@kit/eslint-config": "0.2.0",
-    "@kit/prettier-config": "0.1.0",
-    "@kit/tsconfig": "0.1.0"
+    "zod": "3.25.76"
   },
   "prettier": "@kit/prettier-config",
   "typesVersions": {

package/dist/mcp/guards.d.ts

@@ -1,40 +0,0 @@
-import type { ToolContext } from './types.js';
-/**
- * Account-resolution and membership guards for MCP tool modules.
- *
- * Every tool module MUST resolve the acting account via `getAccountId` and
- * verify access with `ensureAccountMembership` (or the group variant) before
- * touching data. Moved here from `@kit/integrations-core/mcp` by the SDK
- * inversion; the HOST-only tool machinery (partner/first-party branding,
- * account_slug schema injection) deliberately stays in integrations-core —
- * branding is the host's provenance pen and must not ship in the
- * partner-facing SDK.
- */
-/**
- * Resolve the account ID from context.
- *
- * Machine principal (Workflow Gateway): the account is fixed by the gateway
- * token grant — never derived from args or the user. Otherwise: uses the
- * pre-injected accountId from the MCP route, falling back to the user's
- * personal account. See context/N8N_INTEGRATION_PLAN.md "Machine-principal design".
- */
-export declare function getAccountId(ctx: ToolContext): string;
-/**
- * Verify the caller has access to the specified account.
- *
- * Machine principal (Workflow Gateway): access is granted iff the requested
- * account matches the token's bound account — the token is the authorization,
- * so no DB membership lookup is performed (and none would be correct, since a
- * machine call has no signed-in user).
- *
- * User principal (default): unchanged — true for personal accounts
- * (accountId === user.id) or a valid team membership row.
- */
-export declare function ensureAccountMembership(ctx: ToolContext, accountId: string): Promise<boolean>;
-/**
- * Verify user is a member of a named group within the account.
- * Returns true only if the named group exists AND the user is a member.
- * Returns false if the group doesn't exist (deny by default — the group
- * must be created and the user added before they gain access).
- */
-export declare function ensureGroupMembership(ctx: ToolContext, accountId: string, groupName: string): Promise<boolean>;

package/dist/mcp/guards.js

@@ -1,99 +0,0 @@
-/**
- * Account-resolution and membership guards for MCP tool modules.
- *
- * Every tool module MUST resolve the acting account via `getAccountId` and
- * verify access with `ensureAccountMembership` (or the group variant) before
- * touching data. Moved here from `@kit/integrations-core/mcp` by the SDK
- * inversion; the HOST-only tool machinery (partner/first-party branding,
- * account_slug schema injection) deliberately stays in integrations-core —
- * branding is the host's provenance pen and must not ship in the
- * partner-facing SDK.
- */
-/**
- * Resolve the account ID from context.
- *
- * Machine principal (Workflow Gateway): the account is fixed by the gateway
- * token grant — never derived from args or the user. Otherwise: uses the
- * pre-injected accountId from the MCP route, falling back to the user's
- * personal account. See context/N8N_INTEGRATION_PLAN.md "Machine-principal design".
- */
-export function getAccountId(ctx) {
-    if (ctx.principal === 'machine') {
-        // A machine principal MUST carry a grant. Falling back to ctx.user.id here
-        // would silently retarget the call at the token creator's PERSONAL account
-        // — fail closed instead: a machine context without a grant is a bug.
-        if (!ctx.machineGrant) {
-            throw new Error('Machine principal context is missing its account grant');
-        }
-        return ctx.machineGrant.accountId;
-    }
-    return ctx.accountId || ctx.user.id;
-}
-/**
- * Verify the caller has access to the specified account.
- *
- * Machine principal (Workflow Gateway): access is granted iff the requested
- * account matches the token's bound account — the token is the authorization,
- * so no DB membership lookup is performed (and none would be correct, since a
- * machine call has no signed-in user).
- *
- * User principal (default): unchanged — true for personal accounts
- * (accountId === user.id) or a valid team membership row.
- */
-export async function ensureAccountMembership(ctx, accountId) {
-    var _a;
-    // Machine principal: the gateway token binds exactly one account. Access is
-    // allowed only for that account; there is no membership table to consult.
-    if (ctx.principal === 'machine') {
-        return ((_a = ctx.machineGrant) === null || _a === void 0 ? void 0 : _a.accountId) === accountId;
-    }
-    // Personal account - user always has access
-    if (accountId === ctx.user.id) {
-        return true;
-    }
-    // Team account - check membership
-    const { data: membershipRows } = await ctx.supabase
-        .from('accounts_memberships')
-        .select('account_id')
-        .eq('account_id', accountId)
-        .eq('user_id', ctx.user.id)
-        .limit(1);
-    return !!(membershipRows && membershipRows.length > 0);
-}
-/**
- * Verify user is a member of a named group within the account.
- * Returns true only if the named group exists AND the user is a member.
- * Returns false if the group doesn't exist (deny by default — the group
- * must be created and the user added before they gain access).
- */
-export async function ensureGroupMembership(ctx, accountId, groupName) {
-    // Machine principal (Workflow Gateway): group membership is a per-user
-    // concept and is not meaningful for a token-authenticated machine caller —
-    // checking it against ctx.user.id (the token creator) would be both wrong
-    // and a membership-probing leak. Deny; machine access is governed solely by
-    // the token grant (ensureAccountMembership).
-    if (ctx.principal === 'machine') {
-        return false;
-    }
-    // Check if the named group exists for this account
-    const { data: groups } = await ctx.supabase
-        .from('account_groups')
-        .select('id')
-        .eq('account_id', accountId)
-        .eq('name', groupName)
-        .limit(1);
-    // Group doesn't exist → deny (must be configured first)
-    if (!groups || groups.length === 0) {
-        return false;
-    }
-    const groupId = groups[0].id;
-    // Group exists → check if user is a member
-    const { data: membership } = await ctx.supabase
-        .from('account_group_members')
-        .select('id')
-        .eq('group_id', groupId)
-        .eq('user_id', ctx.user.id)
-        .limit(1);
-    return !!(membership && membership.length > 0);
-}
-//# sourceMappingURL=guards.js.map

package/dist/mcp/guards.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/mcp/guards.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAgB;IAC3C,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChC,2EAA2E;QAC3E,2EAA2E;QAC3E,qEAAqE;QACrE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;IACpC,CAAC;IAED,OAAO,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAgB,EAChB,SAAiB;;IAEjB,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAA,MAAA,GAAG,CAAC,YAAY,0CAAE,SAAS,MAAK,SAAS,CAAC;IACnD,CAAC;IAED,4CAA4C;IAC5C,IAAI,SAAS,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kCAAkC;IAClC,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ;SAChD,IAAI,CAAC,sBAAsB,CAAC;SAC5B,MAAM,CAAC,YAAY,CAAC;SACpB,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC;SAC3B,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,OAAO,CAAC,CAAC,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAgB,EAChB,SAAiB,EACjB,SAAiB;IAEjB,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,6CAA6C;IAC7C,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mDAAmD;IACnD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ;SACxC,IAAI,CAAC,gBAAgB,CAAC;SACtB,MAAM,CAAC,IAAI,CAAC;SACZ,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC;SAC3B,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;SACrB,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,wDAAwD;IACxD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,EAAY,CAAC;IAExC,2CAA2C;IAC3C,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ;SAC5C,IAAI,CAAC,uBAAuB,CAAC;SAC7B,MAAM,CAAC,IAAI,CAAC;SACZ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;SACvB,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC","sourcesContent":["import type { ToolContext } from './types';\n\n/**\n * Account-resolution and membership guards for MCP tool modules.\n *\n * Every tool module MUST resolve the acting account via `getAccountId` and\n * verify access with `ensureAccountMembership` (or the group variant) before\n * touching data. Moved here from `@kit/integrations-core/mcp` by the SDK\n * inversion; the HOST-only tool machinery (partner/first-party branding,\n * account_slug schema injection) deliberately stays in integrations-core —\n * branding is the host's provenance pen and must not ship in the\n * partner-facing SDK.\n */\n\n/**\n * Resolve the account ID from context.\n *\n * Machine principal (Workflow Gateway): the account is fixed by the gateway\n * token grant — never derived from args or the user. Otherwise: uses the\n * pre-injected accountId from the MCP route, falling back to the user's\n * personal account. See context/N8N_INTEGRATION_PLAN.md \"Machine-principal design\".\n */\nexport function getAccountId(ctx: ToolContext): string {\n  if (ctx.principal === 'machine') {\n    // A machine principal MUST carry a grant. Falling back to ctx.user.id here\n    // would silently retarget the call at the token creator's PERSONAL account\n    // — fail closed instead: a machine context without a grant is a bug.\n    if (!ctx.machineGrant) {\n      throw new Error('Machine principal context is missing its account grant');\n    }\n\n    return ctx.machineGrant.accountId;\n  }\n\n  return ctx.accountId || ctx.user.id;\n}\n\n/**\n * Verify the caller has access to the specified account.\n *\n * Machine principal (Workflow Gateway): access is granted iff the requested\n * account matches the token's bound account — the token is the authorization,\n * so no DB membership lookup is performed (and none would be correct, since a\n * machine call has no signed-in user).\n *\n * User principal (default): unchanged — true for personal accounts\n * (accountId === user.id) or a valid team membership row.\n */\nexport async function ensureAccountMembership(\n  ctx: ToolContext,\n  accountId: string,\n): Promise<boolean> {\n  // Machine principal: the gateway token binds exactly one account. Access is\n  // allowed only for that account; there is no membership table to consult.\n  if (ctx.principal === 'machine') {\n    return ctx.machineGrant?.accountId === accountId;\n  }\n\n  // Personal account - user always has access\n  if (accountId === ctx.user.id) {\n    return true;\n  }\n\n  // Team account - check membership\n  const { data: membershipRows } = await ctx.supabase\n    .from('accounts_memberships')\n    .select('account_id')\n    .eq('account_id', accountId)\n    .eq('user_id', ctx.user.id)\n    .limit(1);\n\n  return !!(membershipRows && membershipRows.length > 0);\n}\n\n/**\n * Verify user is a member of a named group within the account.\n * Returns true only if the named group exists AND the user is a member.\n * Returns false if the group doesn't exist (deny by default — the group\n * must be created and the user added before they gain access).\n */\nexport async function ensureGroupMembership(\n  ctx: ToolContext,\n  accountId: string,\n  groupName: string,\n): Promise<boolean> {\n  // Machine principal (Workflow Gateway): group membership is a per-user\n  // concept and is not meaningful for a token-authenticated machine caller —\n  // checking it against ctx.user.id (the token creator) would be both wrong\n  // and a membership-probing leak. Deny; machine access is governed solely by\n  // the token grant (ensureAccountMembership).\n  if (ctx.principal === 'machine') {\n    return false;\n  }\n\n  // Check if the named group exists for this account\n  const { data: groups } = await ctx.supabase\n    .from('account_groups')\n    .select('id')\n    .eq('account_id', accountId)\n    .eq('name', groupName)\n    .limit(1);\n\n  // Group doesn't exist → deny (must be configured first)\n  if (!groups || groups.length === 0) {\n    return false;\n  }\n\n  const groupId = groups[0]!.id as string;\n\n  // Group exists → check if user is a member\n  const { data: membership } = await ctx.supabase\n    .from('account_group_members')\n    .select('id')\n    .eq('group_id', groupId)\n    .eq('user_id', ctx.user.id)\n    .limit(1);\n\n  return !!(membership && membership.length > 0);\n}\n"]}

package/dist/mcp/index.d.ts

@@ -1,22 +0,0 @@
-/**
- * @ekanos/sdk/mcp — MCP tool contract and security guards.
- *
- * Every tool module MUST resolve the acting account via `getAccountId` and
- * verify access with `ensureAccountMembership` (or the group/resource
- * variants) before touching data. `assertResourceOwnership` is exported so
- * tools never hand-roll ownership checks.
- *
- * The SDK OWNS these implementations (the inversion);
- * `@kit/integrations-core/mcp` re-exports them for first-party code. The
- * HOST-only machinery stays in integrations-core on purpose:
- * `brandPartnerTool` / `brandFirstPartyTool` (the provenance pen — exporting
- * it here would hand partners the classification authority) and
- * `injectAccountSlugParam(s)` (host route plumbing).
- *
- * Surface discipline: additions require an entry in
- * docs/devex/sdk-export-map.md ("`@ekanos/sdk/mcp`").
- */
-import 'server-only';
-export type * from './types.js';
-export { ensureAccountMembership, ensureGroupMembership, getAccountId, } from './guards.js';
-export { ToolOwnershipError, assertResourceOwnership, resolveSelfOnly, } from './ownership.js';

package/dist/mcp/index.js

@@ -1,22 +0,0 @@
-/**
- * @ekanos/sdk/mcp — MCP tool contract and security guards.
- *
- * Every tool module MUST resolve the acting account via `getAccountId` and
- * verify access with `ensureAccountMembership` (or the group/resource
- * variants) before touching data. `assertResourceOwnership` is exported so
- * tools never hand-roll ownership checks.
- *
- * The SDK OWNS these implementations (the inversion);
- * `@kit/integrations-core/mcp` re-exports them for first-party code. The
- * HOST-only machinery stays in integrations-core on purpose:
- * `brandPartnerTool` / `brandFirstPartyTool` (the provenance pen — exporting
- * it here would hand partners the classification authority) and
- * `injectAccountSlugParam(s)` (host route plumbing).
- *
- * Surface discipline: additions require an entry in
- * docs/devex/sdk-export-map.md ("`@ekanos/sdk/mcp`").
- */
-import 'server-only';
-export { ensureAccountMembership, ensureGroupMembership, getAccountId, } from './guards.js';
-export { ToolOwnershipError, assertResourceOwnership, resolveSelfOnly, } from './ownership.js';
-//# sourceMappingURL=index.js.map

package/dist/mcp/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,aAAa,CAAC;AAIrB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,GACb,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,GAChB,MAAM,aAAa,CAAC","sourcesContent":["/**\n * @ekanos/sdk/mcp — MCP tool contract and security guards.\n *\n * Every tool module MUST resolve the acting account via `getAccountId` and\n * verify access with `ensureAccountMembership` (or the group/resource\n * variants) before touching data. `assertResourceOwnership` is exported so\n * tools never hand-roll ownership checks.\n *\n * The SDK OWNS these implementations (the inversion);\n * `@kit/integrations-core/mcp` re-exports them for first-party code. The\n * HOST-only machinery stays in integrations-core on purpose:\n * `brandPartnerTool` / `brandFirstPartyTool` (the provenance pen — exporting\n * it here would hand partners the classification authority) and\n * `injectAccountSlugParam(s)` (host route plumbing).\n *\n * Surface discipline: additions require an entry in\n * docs/devex/sdk-export-map.md (\"`@ekanos/sdk/mcp`\").\n */\nimport 'server-only';\n\nexport type * from './types';\n\nexport {\n  ensureAccountMembership,\n  ensureGroupMembership,\n  getAccountId,\n} from './guards';\n\nexport {\n  ToolOwnershipError,\n  assertResourceOwnership,\n  resolveSelfOnly,\n} from './ownership';\n"]}