@engenty/wizards-runtime 0.0.0-stage → 0.7.5

package/apps/runtime/dist/manage.js

@@ -0,0 +1,249 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { env } from "./env.js";
+/**
+ * The Manage-App as this runtime sees it (docs/manage-contract.md): it issues the tokens,
+ * knows the tenants and their credits. Nothing here runs when `MANAGE_URL` is empty.
+ */
+export const managed = Boolean(env.manage.url);
+const discoveries = new Map();
+/** OIDC discovery of a Manage-App, cached for an hour. */
+export async function discovery(base = env.manage.url) {
+    const hit = discoveries.get(base);
+    if (hit && Date.now() - hit.at < 3600_000) {
+        return hit.value;
+    }
+    const res = await fetch(`${base}/.well-known/openid-configuration`, {
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (!res.ok) {
+        throw new Error(`Manage-App discovery failed: ${res.status}`);
+    }
+    const value = (await res.json());
+    discoveries.set(base, { at: Date.now(), value });
+    return value;
+}
+const keySets = new Map();
+function toClaims(payload) {
+    const p = payload;
+    if (typeof p.sub !== "string" || typeof p.tenant !== "string") {
+        return null;
+    }
+    const role = p.role === "owner" || p.role === "admin" ? p.role : "member";
+    return {
+        userId: p.sub,
+        tenantId: p.tenant,
+        role,
+        name: typeof p.name === "string" ? p.name : "",
+        email: typeof p.email === "string" ? p.email : "",
+        clientId: typeof p.azp === "string" ? p.azp : String(p.client_id ?? ""),
+        scopes: String(p.scope ?? "")
+            .split(" ")
+            .filter(Boolean),
+        expiresAt: (p.exp ?? 0) * 1000,
+    };
+}
+/**
+ * Verifies an access token of the Manage-App against its JWKS — no round trip per request.
+ * `audiences` are the resources this caller accepts; null skips the audience check.
+ */
+export async function verifyToken(token, audiences, base = env.manage.url) {
+    const payload = await verifySigned(token, audiences, base);
+    return payload ? toClaims(payload) : null;
+}
+/** Any token the Manage-App at `base` signed (its JWKS, its issuer); null when it is not one. */
+export async function verifySigned(token, audiences, base = env.manage.url) {
+    try {
+        const d = await discovery(base);
+        let keys = keySets.get(d.jwks_uri);
+        if (!keys) {
+            keys = createRemoteJWKSet(new URL(d.jwks_uri));
+            keySets.set(d.jwks_uri, keys);
+        }
+        const { payload } = await jwtVerify(token, keys, {
+            issuer: d.issuer,
+            ...(audiences ? { audience: audiences } : {}),
+        });
+        return payload;
+    }
+    catch {
+        return null;
+    }
+}
+/** Reads a token's claims without verifying it — only for tokens the token endpoint just handed us. */
+export function unverifiedClaims(token) {
+    try {
+        const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8"));
+        return toClaims(payload);
+    }
+    catch {
+        return null;
+    }
+}
+// --- service calls -----------------------------------------------------------
+export class ManageError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+async function call(method, path, body) {
+    const res = await fetch(`${env.manage.url}${path}`, {
+        method,
+        headers: {
+            authorization: `Bearer ${env.manage.serviceKey}`,
+            ...(body === undefined ? {} : { "content-type": "application/json" }),
+        },
+        body: body === undefined ? undefined : JSON.stringify(body),
+        signal: AbortSignal.timeout(15_000),
+    });
+    const data = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        throw new ManageError(res.status, data.code ?? "error", data.error ?? `Manage-App ${res.status}`);
+    }
+    return data;
+}
+/** The people of a tenant, as the Manage-App keeps them; they are managed there. */
+export function tenantMembers(id) {
+    return call("GET", `/v1/tenants/${encodeURIComponent(id)}/members`);
+}
+const users = new Map();
+/** What the Manage-App says of a person beyond their token; cached a minute. */
+export async function userInfo(userId) {
+    const hit = users.get(userId);
+    if (hit && Date.now() - hit.at < 60_000) {
+        return hit.value;
+    }
+    const value = await call("GET", `/v1/users/${encodeURIComponent(userId)}`)
+        .then((u) => ({ features: u.features ?? {}, admin: u.admin === true }))
+        .catch(() => hit?.value ?? { features: {}, admin: false });
+    users.set(userId, { at: Date.now(), value });
+    return value;
+}
+const tenants = new Map();
+/** Plan, limits and balance of a tenant, cached for a minute. */
+export async function tenantInfo(id, fresh = false) {
+    const hit = tenants.get(id);
+    if (!fresh && hit && Date.now() - hit.at < 60_000) {
+        return hit.value;
+    }
+    try {
+        const value = await call("GET", `/v1/tenants/${encodeURIComponent(id)}`);
+        tenants.set(id, { at: Date.now(), value });
+        return value;
+    }
+    catch (err) {
+        // The Manage-App is out of reach for a moment: what it said within the hour still counts.
+        if (hit && !(err instanceof ManageError) && Date.now() - hit.at < 3600_000) {
+            return hit.value;
+        }
+        throw err;
+    }
+}
+export function forgetTenant(id) {
+    tenants.delete(id);
+}
+/** Renames the team at the Manage-App; what it answers is the tenant as it stands now. */
+export async function renameTenant(id, name) {
+    const value = await call("PATCH", `/v1/tenants/${encodeURIComponent(id)}`, {
+        name,
+    });
+    tenants.set(id, { at: Date.now(), value });
+    return value;
+}
+export function saveTeamProfile(tenantId, userId, lang, profile) {
+    return call("PUT", `/v1/tenants/${encodeURIComponent(tenantId)}/profile`, {
+        ...profile,
+        userId,
+        lang,
+    });
+}
+/** The Manage-App mails the install command and the first steps to one of the team's people. */
+export function installMail(email, lang) {
+    return call("POST", "/v1/install-mail", { email, lang });
+}
+export function verifyKey(key) {
+    return call("POST", "/v1/keys/verify", { key });
+}
+/** Whether the grant behind an access token still stands: not disconnected, still a member. */
+export function grantActive(userId, clientId, tenantId) {
+    return call("POST", "/v1/grants/check", { userId, clientId, tenantId });
+}
+export function reserve(tenantId, runId, credits) {
+    return call("POST", "/v1/reservations", { tenantId, runId, credits });
+}
+export function release(runId) {
+    return call("POST", "/v1/reservations/release", { runId });
+}
+export function runUsage(tenantId, runId) {
+    return call("GET", `/v1/runs/${encodeURIComponent(runId)}/usage?tenantId=${encodeURIComponent(tenantId)}`);
+}
+export function tenantUsage(tenantId, months = 3) {
+    return call("GET", `/v1/tenants/${encodeURIComponent(tenantId)}/usage?months=${months}`);
+}
+/** The plans of a Manage-App: public, no key needed. */
+export async function publicPlans(base) {
+    const res = await fetch(`${base}/v1/plans`, { signal: AbortSignal.timeout(10_000) });
+    if (!res.ok) {
+        throw new ManageError(res.status, "error", `Manage-App ${res.status}`);
+    }
+    return (await res.json());
+}
+const channels = new Map();
+/** The tenant's numbers, cached for a minute. */
+export async function tenantChannels(id) {
+    const hit = channels.get(id);
+    if (hit && Date.now() - hit.at < 60_000) {
+        return hit.value;
+    }
+    const value = await call("GET", `/v1/tenants/${encodeURIComponent(id)}/channels`);
+    channels.set(id, { at: Date.now(), value });
+    return value;
+}
+/**
+ * Forgets what the Manage-App said of the tenant's numbers: the next `tenantChannels` asks.
+ * The runtime tests of the Manage-App's channel plugins (sms, calls, whatsapp) call it.
+ */
+export function forgetChannels(id) {
+    channels.delete(id);
+}
+/** A person of the tenant asks for its number; what the Manage-App answers with is the request. */
+export async function requestChannelNumber(id, input) {
+    channels.delete(id);
+    return call("POST", `/v1/tenants/${encodeURIComponent(id)}/channels/requests`, input);
+}
+/** The tenant takes its open request back. */
+export async function withdrawChannelRequest(id) {
+    channels.delete(id);
+    return call("DELETE", `/v1/tenants/${encodeURIComponent(id)}/channels/requests`);
+}
+/** What a tenant's channel used, priced by the Manage-App: texts by segment, calls by minute. */
+export function bookChannelUsage(id, input) {
+    return call("POST", `/v1/tenants/${encodeURIComponent(id)}/channels/usage`, input);
+}
+/** A push to the mobile app on one device; the Manage-App holds the APNs and FCM keys. */
+export function pushToDevice(input) {
+    return call("POST", "/v1/push", input);
+}
+/** Code or refresh token → tokens. A confidential client sends its secret, a public one only its id. */
+export async function tokenRequest(params, client, base = env.manage.url) {
+    const d = await discovery(base);
+    const body = new URLSearchParams({ ...params, client_id: client.id });
+    const headers = { "content-type": "application/x-www-form-urlencoded" };
+    if (client.secret) {
+        headers.authorization = `Basic ${Buffer.from(`${encodeURIComponent(client.id)}:${encodeURIComponent(client.secret)}`).toString("base64")}`;
+    }
+    const res = await fetch(d.token_endpoint, {
+        method: "POST",
+        headers,
+        body,
+        signal: AbortSignal.timeout(15_000),
+    });
+    const data = (await res.json().catch(() => ({})));
+    if (!res.ok || !data.access_token) {
+        throw new ManageError(res.status, data.error ?? "token_error", "Token request failed");
+    }
+    return data;
+}

package/apps/runtime/dist/mcp/auth.js

@@ -0,0 +1,161 @@
+import { API_KEY_PREFIX, verifyLocalKey } from "../auth/keys.js";
+import { LOCAL_CLIENT_HEADER, LOCAL_MCP_HEADER, localTicketExpiry } from "../auth/local-ticket.js";
+import { env } from "../env.js";
+import { grantActive, managed, verifyKey, verifyToken } from "../manage.js";
+import { LOCAL_TENANT } from "../tenants/tenant.js";
+import { MCP_RESOURCE, SCOPES } from "./scopes.js";
+export function principalOf(info) {
+    return info.extra;
+}
+function authInfoFor(who, token, clientId) {
+    return { token, clientId, scopes: who.scopes, extra: { ...who } };
+}
+function bearer(request) {
+    return (request.headers
+        .get("authorization")
+        ?.match(/^Bearer\s+(.+)$/i)?.[1]
+        ?.trim() || null);
+}
+const resourceMetadataUrl = (() => {
+    const url = new URL(MCP_RESOURCE);
+    return `${url.origin}/.well-known/oauth-protected-resource${url.pathname}`;
+})();
+/** RFC 6750 / RFC 9728 challenge: tells an MCP client where to start OAuth. */
+function challenge(status, error, description) {
+    return new Response(JSON.stringify({ error, error_description: description }), {
+        status,
+        headers: {
+            "content-type": "application/json",
+            ...(status === 401
+                ? {
+                    "www-authenticate": managed
+                        ? `Bearer error="${error}", error_description="${description}", resource_metadata="${resourceMetadataUrl}", scope="${SCOPES.join(" ")}"`
+                        : `Bearer error="${error}", error_description="${description}"`,
+                }
+                : {}),
+        },
+    });
+}
+const keyCache = new Map();
+/** An API key acts as its owner, in the key's tenant, with every scope. */
+async function apiKeyAuth(key) {
+    if (!managed) {
+        const found = await verifyLocalKey(key);
+        if (!found) {
+            return challenge(401, "invalid_token", "This API key is unknown or revoked.");
+        }
+        const who = {
+            userId: "local",
+            tenantId: LOCAL_TENANT,
+            role: "owner",
+            client: found.name || "MCP",
+            scopes: [...SCOPES],
+        };
+        return authInfoFor(who, key, found.id);
+    }
+    const hit = keyCache.get(key);
+    if (hit && Date.now() - hit.at < 60_000) {
+        return authInfoFor(hit.who, key, hit.keyId);
+    }
+    const result = await verifyKey(key).catch(() => null);
+    if (!result?.valid || !result.userId || !result.tenantId) {
+        keyCache.delete(key);
+        return challenge(401, "invalid_token", "This API key is unknown or revoked.");
+    }
+    const who = {
+        userId: result.userId,
+        tenantId: result.tenantId,
+        role: result.role ?? "member",
+        client: result.name || "MCP",
+        scopes: [...SCOPES],
+        name: result.userName ?? "",
+    };
+    keyCache.set(key, { at: Date.now(), who, keyId: result.keyId ?? "" });
+    return authInfoFor(who, key, result.keyId ?? "");
+}
+const grantCache = new Map();
+/** How long an answer of the Manage-App holds: "Trennen" takes effect within this time. */
+const GRANT_TTL = 30_000;
+/**
+ * A signed token lives its hour whatever happens; whether the person still allows the app —
+ * and is still in the team — the Manage-App knows. Asked at most every 30 seconds per grant;
+ * when it cannot be asked, the token is refused.
+ */
+async function grantStands(userId, clientId, tenantId) {
+    const key = `${userId}\n${clientId}\n${tenantId}`;
+    const hit = grantCache.get(key);
+    if (hit && Date.now() - hit.at < GRANT_TTL) {
+        return hit.active;
+    }
+    const active = await grantActive(userId, clientId, tenantId)
+        .then((r) => r.active)
+        .catch(() => null);
+    if (active === null) {
+        return false;
+    }
+    grantCache.set(key, { at: Date.now(), active });
+    return active;
+}
+/** An access token of the Manage-App, issued for this MCP endpoint, acts within its scopes. */
+async function tokenAuth(token) {
+    if (!managed) {
+        return challenge(401, "invalid_token", "Sign in with an API key from the settings.");
+    }
+    const claims = await verifyToken(token, [MCP_RESOURCE, env.appUrl]);
+    if (!claims) {
+        return challenge(401, "invalid_token", "The access token is invalid or expired.");
+    }
+    if (!(await grantStands(claims.userId, claims.clientId, claims.tenantId))) {
+        return challenge(401, "invalid_token", "This connection was ended. Connect again.");
+    }
+    const granted = new Set(claims.scopes);
+    const who = {
+        userId: claims.userId,
+        tenantId: claims.tenantId,
+        role: claims.role,
+        client: claims.clientId || "MCP",
+        scopes: SCOPES.filter((s) => granted.has(s)),
+        name: claims.name,
+        email: claims.email,
+    };
+    return authInfoFor(who, token, claims.clientId);
+}
+/**
+ * A request from `wizards mcp` on this machine: signed with the data folder's secret,
+ * which only a runtime alone has. It acts as the admin, like a key from the settings.
+ */
+function localAuth(request, ticket) {
+    if (managed || !localTicketExpiry(env.authSecret, ticket, Date.now(), "local-mcp")) {
+        return challenge(401, "invalid_token", "This local signature is invalid or expired.");
+    }
+    const client = request.headers
+        .get(LOCAL_CLIENT_HEADER)
+        ?.replace(/[^\p{L}\p{N} ._-]/gu, "")
+        .trim()
+        .slice(0, 60) || "MCP";
+    const who = {
+        userId: "local",
+        tenantId: LOCAL_TENANT,
+        role: "owner",
+        client,
+        scopes: [...SCOPES],
+    };
+    return authInfoFor(who, ticket, "local");
+}
+/** Who an MCP or API request acts for: an API key (`x-api-key` or a `wz_…` bearer) or an OAuth access token. */
+export async function authenticate(request) {
+    const local = request.headers.get(LOCAL_MCP_HEADER)?.trim();
+    if (local) {
+        return localAuth(request, local);
+    }
+    const header = request.headers.get("x-api-key")?.trim();
+    const token = bearer(request);
+    const key = header || (token?.startsWith(API_KEY_PREFIX) ? token : null);
+    if (key) {
+        return apiKeyAuth(key);
+    }
+    if (!token) {
+        return challenge(401, "invalid_token", "Sign in to use this endpoint.");
+    }
+    return tokenAuth(token);
+}

package/apps/runtime/dist/mcp/bridge.js

@@ -0,0 +1,59 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { randomBytes } from "node:crypto";
+import { createMcpHandler, fromJsonSchema, McpServer, } from "@modelcontextprotocol/server";
+import { env } from "../env.js";
+const bridges = new Map();
+const textOf = (value) => typeof value === "string" ? value : JSON.stringify(value ?? null);
+/** A tool's result as MCP content: text, or the blocks its `toModelOutput` shapes (text and images). */
+function contentOf(tool, output) {
+    const shaped = tool.toModelOutput?.(output);
+    if (shaped?.type === "content") {
+        return {
+            content: shaped.value.map((part) => part.type === "image-data"
+                ? { type: "image", data: part.data ?? "", mimeType: part.mediaType ?? "image/png" }
+                : { type: "text", text: part.text ?? textOf(part) }),
+        };
+    }
+    return { content: [{ type: "text", text: textOf(shaped ? shaped.value : output) }] };
+}
+export function openBridge(tools) {
+    const token = randomBytes(24).toString("base64url");
+    // The client's requests arrive on their own; the tools run as the call that opened the bridge —
+    // in its tenant, as its person.
+    const inCall = AsyncLocalStorage.snapshot();
+    const handler = createMcpHandler(() => {
+        const server = new McpServer({ name: "step", version: "0.1.0" }, { capabilities: { tools: {} } });
+        for (const tool of tools) {
+            server.registerTool(tool.name, {
+                description: tool.description,
+                inputSchema: fromJsonSchema(tool.inputSchema),
+            }, (async (args) => {
+                try {
+                    return contentOf(tool, await inCall(() => tool.execute(args)));
+                }
+                catch (err) {
+                    return {
+                        isError: true,
+                        content: [{ type: "text", text: err?.message ?? String(err) }],
+                    };
+                }
+            }));
+        }
+        return server;
+    }, { legacy: "stateless" });
+    bridges.set(token, handler);
+    return {
+        url: `http://127.0.0.1:${env.port}/api/mcp/bridge/${token}`,
+        close: () => {
+            bridges.delete(token);
+        },
+    };
+}
+/** Answers an MCP request of an open bridge; a closed or unknown one is not found. */
+export function bridgeRequest(token, request) {
+    const handler = bridges.get(token);
+    if (!handler) {
+        return Promise.resolve(new Response("not found", { status: 404 }));
+    }
+    return handler.fetch(request);
+}

package/apps/runtime/dist/mcp/flow-app.js

@@ -0,0 +1,97 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { RESOURCE_MIME_TYPE, registerAppResource } from "@modelcontextprotocol/ext-apps/server";
+import { env } from "../env.js";
+import { runTicket } from "../secrets/signing.js";
+import { draftIssues, ownedWizard, publishedVersion } from "../services/wizards.js";
+/**
+ * The flow widget (MCP Apps): a wizard as its diagram, and a run on it — where it stands, what
+ * it made, the page it waits for. Hosts that render MCP Apps (Claude Desktop, Cursor, VS Code,
+ * Goose, ChatGPT) show it in the chat; the others get the same tools as text.
+ */
+/** Built by the web app (`vite.mcp-app.config.ts`) into one HTML file with everything inline. */
+const FLOW_APP_FILE = resolve(dirname(fileURLToPath(import.meta.url)), "../../../web/dist/mcp/flow.html");
+const MISSING = `<!doctype html><meta charset="utf-8"><body style="font:14px system-ui;padding:16px">
+The flow widget is not built: run <code>pnpm --filter @engenty-wizards/web build</code>.</body>`;
+function readWidget() {
+    try {
+        return readFileSync(FLOW_APP_FILE, "utf8");
+    }
+    catch {
+        return MISSING;
+    }
+}
+const FLOW_APP_HTML = readWidget();
+/**
+ * Hosts keep a widget by its URI, so the URI names the build: a new widget gets a new address
+ * instead of the cached old one.
+ */
+export const FLOW_APP_URI = `ui://engenty-wizards/flow-${createHash("sha256").update(FLOW_APP_HTML).digest("hex").slice(0, 10)}.html`;
+export function registerFlowApp(server) {
+    // The widget reaches the run on the doors: their origin.
+    const origin = new URL(env.publicUrl).origin;
+    registerAppResource(server, "Wizard flow", FLOW_APP_URI, {
+        description: "A wizard as a diagram, and a run on it.",
+        mimeType: RESOURCE_MIME_TYPE,
+    }, async () => ({
+        contents: [
+            {
+                uri: FLOW_APP_URI,
+                mimeType: RESOURCE_MIME_TYPE,
+                text: FLOW_APP_HTML,
+                _meta: {
+                    ui: {
+                        // The run and its files are served by this runtime; the fonts by Google.
+                        csp: {
+                            connectDomains: [origin],
+                            resourceDomains: [
+                                origin,
+                                "https://fonts.googleapis.com",
+                                "https://fonts.gstatic.com",
+                            ],
+                        },
+                        prefersBorder: true,
+                    },
+                },
+            },
+        ],
+    }));
+}
+/**
+ * The widget's data for a wizard: the published version when there is one (that is what runs),
+ * else the draft. A run brings the definition it started on.
+ */
+export async function flowView(userId, wizardId, options = {}) {
+    const w = await ownedWizard(userId, wizardId);
+    const published = options.shows === "draft" ? null : await publishedVersion(w);
+    const shows = published ? "published" : "draft";
+    const definition = options.definition ?? published?.definition ?? w.draft;
+    return {
+        wizard: {
+            id: w.id,
+            title: definition.title,
+            description: definition.description,
+            avatar: definition.avatar,
+            shows,
+            published: w.publishedVersion !== null,
+            issues: shows === "draft" ? (await draftIssues(w)).length : undefined,
+        },
+        definition,
+        run: options.run,
+        runtime: options.run
+            ? { base: env.publicUrl, ticket: runTicket(options.run.runId) }
+            : undefined,
+    };
+}
+/** A tool's `_meta` that opens the widget with the tool's result. */
+export const flowAppMeta = {
+    ui: { resourceUri: FLOW_APP_URI },
+    "openai/outputTemplate": FLOW_APP_URI,
+};
+/**
+ * Where a result carries the widget's data. The definition stays out of `structuredContent`,
+ * which hosts hand to the model as well; `_meta` only reaches the widget.
+ */
+export const FLOW_VIEW_KEY = "engenty/flow";

package/apps/runtime/dist/mcp/handler.js

@@ -0,0 +1,54 @@
+import { createMcpHandler, McpServer, originValidationResponse, } from "@modelcontextprotocol/server";
+import { withTenant } from "../db/client.js";
+import { env } from "../env.js";
+import { asRole } from "../services/access.js";
+import { tenantStatus } from "../tenants/control.js";
+import { authenticate, principalOf } from "./auth.js";
+import { registerFlowApp } from "./flow-app.js";
+import { noteRequest } from "./seen.js";
+import { registerPrompts, registerTools } from "./tools.js";
+const INSTRUCTIONS = `engenty wizards: page-by-page AI wizards — the person answers pages, AI steps write, research and make images or videos, the person reviews, the result is files.
+Use one: list_wizards, then run_wizard straight away — its widget shows the wizard itself (show_wizard only when the person wants to see a wizard before running it), then follow waitingFor (answer_page, review_step, answer_ask, get_run with waitSeconds). Runs spend credits.
+Build one: get_authoring_guide (schema + design rules), a close starter with get_starter, create_wizard, edit_wizard until "issues" is empty, check with start_test_run + get_test_run. Publish only when the person asks.
+When a run needs the browser, hand over its browserUrl, the wizard's own run page. The studioUrl is for building only: never send someone who uses a wizard to the studio.
+Projects are called spaces in the studio. Ids are for the tools only: name wizards and spaces by their titles and names, and where two spaces share a name, by where each comes from.`;
+/** A wizard definition is a few KB; this leaves room and refuses anything far beyond it. */
+const MAX_BODY_BYTES = 300_000;
+/**
+ * Streamable HTTP MCP endpoint, stateless: every request authenticates — with an access token of
+ * the Manage-App or an API key — and gets a fresh server whose tools act as that admin, in the
+ * tenant the token or key names.
+ */
+export function mcpHandler() {
+    const allowedHosts = [new URL(env.appUrl).hostname, "localhost", "127.0.0.1"];
+    const handler = createMcpHandler((ctx) => {
+        const server = new McpServer({ name: "engenty-wizards", version: "0.1.0" }, { instructions: INSTRUCTIONS, capabilities: { tools: {}, prompts: {}, resources: {} } });
+        const who = principalOf(ctx.authInfo);
+        registerTools(server, who);
+        registerPrompts(server);
+        registerFlowApp(server);
+        return server;
+    }, { legacy: "stateless", maxRequestBodySize: MAX_BODY_BYTES });
+    return async (request) => {
+        const rejected = originValidationResponse(request, allowedHosts);
+        if (rejected) {
+            return rejected;
+        }
+        const authInfo = await authenticate(request);
+        if (authInfo instanceof Response) {
+            return authInfo;
+        }
+        const who = principalOf(authInfo);
+        if ((await tenantStatus(who.tenantId)) === "suspended") {
+            return new Response(JSON.stringify({ error: "This account is suspended.", code: "tenant_suspended" }), { status: 403 });
+        }
+        if (request.method === "POST") {
+            const body = await request
+                .clone()
+                .json()
+                .catch(() => null);
+            noteRequest(who.tenantId, authInfo.clientId, who.client, body);
+        }
+        return withTenant(who.tenantId, () => asRole(who.role, () => handler.fetch(request, { authInfo })));
+    };
+}

package/apps/runtime/dist/mcp/scopes.js

@@ -0,0 +1,14 @@
+import { env } from "../env.js";
+/**
+ * What an MCP or API client may do; the Manage-App's consent page lists them, tools register only
+ * when granted. `runs:read`: the results of the live runs, as the WordPress plugin lists them.
+ */
+export const SCOPES = [
+    "wizards:read",
+    "wizards:write",
+    "wizards:publish",
+    "runs:test",
+    "runs:read",
+];
+/** The protected resource OAuth tokens are bound to (RFC 8707 / RFC 9728). */
+export const MCP_RESOURCE = `${env.appUrl}/api/mcp`;