@fragno-dev/mcp-fragment 0.0.0-stage → 0.0.3

package/dist/cli/routes.js

@@ -0,0 +1,743 @@
+import { assertAllowedEndpoint, callMcpTool, listMcpTools, stringifySecretPayload } from "./mcp-api.js";
+import { mcpSchema } from "./schema.js";
+import { createMcpOperationAuth, isMcpAuthReady, pendingOAuthLink, projectMcpAuthStatus, withoutOAuthConsent, writeOAuthSecretChanges } from "./services.js";
+import { mcpFragmentDefinition, scheduleMcpAuthExpiry } from "./definition.js";
+import { MCP_OAUTH_REDIRECT_URI_QUERY_PARAMETER, createServerInputSchema, mcpAuthStatusSchema, mcpOAuthPendingSchema, mcpOAuthRedirectUriSchema, mcpToolCallResultSchema, mcpToolSchema, oauthStartInputSchema, replaceServerConfigurationInputSchema, tokenAuthInputSchema, toolCallInputSchema } from "./mcp-types.js";
+import { buildAuthDiagnostics, errorMessage, refreshOutputSchema } from "./diagnostics.js";
+import { defineRoutes } from "@fragno-dev/core";
+import { z } from "zod";
+//#region src/routes.ts
+const serverConnectionCacheOutputSchema = z.object({
+	protocolVersion: z.string().nullable().optional(),
+	serverInfo: z.unknown().nullable().optional(),
+	capabilities: z.unknown().nullable().optional(),
+	tools: z.array(mcpToolSchema).nullable().optional(),
+	updatedAt: z.union([z.string(), z.date()]).optional()
+});
+const serverOutputSchema = z.object({
+	slug: z.string(),
+	name: z.string().nullable().optional(),
+	endpointUrl: z.string(),
+	authMode: z.string(),
+	cache: serverConnectionCacheOutputSchema.nullable().optional()
+});
+function publicServer(server, cache) {
+	return {
+		slug: server.id.toString(),
+		name: server.name,
+		endpointUrl: server.endpointUrl,
+		authMode: server.authMode,
+		...cache ? { cache: {
+			protocolVersion: cache.protocolVersion ?? null,
+			serverInfo: cache.serverInfo ?? null,
+			capabilities: cache.capabilities ?? null,
+			tools: Array.isArray(cache.tools) ? cache.tools : null,
+			updatedAt: cache.updatedAt
+		} } : {}
+	};
+}
+function authMode(auth) {
+	return auth.type;
+}
+const mcpRoutesFactory = defineRoutes(mcpFragmentDefinition).create(({ services, defineRoute, config }) => {
+	return [
+		defineRoute({
+			method: "POST",
+			path: "/servers",
+			inputSchema: createServerInputSchema,
+			outputSchema: serverOutputSchema,
+			errorCodes: ["SERVER_EXISTS", "ENDPOINT_NOT_ALLOWED"],
+			handler: async function({ input }, { json, error }) {
+				const body = await input.valid();
+				try {
+					assertAllowedEndpoint(body.endpointUrl, config);
+				} catch (err) {
+					return error({
+						code: "ENDPOINT_NOT_ALLOWED",
+						message: err.message
+					}, 400);
+				}
+				const payload = body.auth.type === "none" ? void 0 : stringifySecretPayload(body.auth);
+				if ((await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", body.slug)))).mutate(({ forSchema, retrieveResult: [existing] }) => {
+					if (existing) return { exists: true };
+					const uow = forSchema(mcpSchema);
+					uow.create("server_configuration", {
+						id: body.slug,
+						name: body.name ?? null,
+						endpointUrl: body.endpointUrl,
+						authMode: authMode(body.auth)
+					});
+					if (payload) uow.create("secret", {
+						id: `${body.slug}:auth`,
+						serverId: body.slug,
+						kind: "auth",
+						payload,
+						expiresAt: null
+					});
+					if (body.auth.type !== "oauth") uow.triggerHook("internalRefreshServerConfiguration", { serverId: body.slug });
+					uow.triggerHook("onServerReadinessChanged", {
+						serverId: body.slug,
+						ready: isMcpAuthReady(authMode(body.auth), payload === void 0 ? void 0 : {
+							payload,
+							expiresAt: null
+						})
+					});
+					return { exists: false };
+				}).execute()).exists) return error({
+					code: "SERVER_EXISTS",
+					message: "MCP server already exists"
+				}, 409);
+				return json(publicServer({
+					...body,
+					id: body.slug,
+					authMode: authMode(body.auth)
+				}), 201);
+			}
+		}),
+		defineRoute({
+			method: "GET",
+			path: "/servers",
+			outputSchema: z.object({ servers: z.array(serverOutputSchema) }),
+			handler: async function(_, { json }) {
+				const [servers, caches] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).find("server_configuration", (b) => b.whereIndex("primary")).find("server_connection_cache", (b) => b.whereIndex("primary"))).execute();
+				const cacheByServerId = new Map(caches.map((cache) => [cache.id.toString(), cache]));
+				return json({ servers: servers.map((server) => publicServer(server, cacheByServerId.get(server.id.toString()))) });
+			}
+		}),
+		defineRoute({
+			method: "GET",
+			path: "/servers/:slug",
+			outputSchema: serverOutputSchema,
+			errorCodes: ["SERVER_NOT_FOUND"],
+			handler: async function({ pathParams }, { json, error }) {
+				const [server, cache] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).findFirst("server_connection_cache", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug)))).execute();
+				if (!server) return error({
+					code: "SERVER_NOT_FOUND",
+					message: "MCP server not found"
+				}, 404);
+				return json(publicServer(server, cache));
+			}
+		}),
+		defineRoute({
+			method: "PUT",
+			path: "/servers/:slug/configuration",
+			inputSchema: replaceServerConfigurationInputSchema,
+			outputSchema: serverOutputSchema,
+			errorCodes: ["SERVER_NOT_FOUND", "ENDPOINT_NOT_ALLOWED"],
+			handler: async function({ input, pathParams }, { json, error }) {
+				const body = await input.valid();
+				try {
+					assertAllowedEndpoint(body.endpointUrl, config);
+				} catch (err) {
+					return error({
+						code: "ENDPOINT_NOT_ALLOWED",
+						message: err.message
+					}, 400);
+				}
+				const payload = body.auth.type === "none" ? null : stringifySecretPayload(body.auth);
+				const result = await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).find("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb("serverId", "=", pathParams.slug))).find("oauthState", (b) => b.whereIndex("idx_oauth_state_server", (eb) => eb("serverId", "=", pathParams.slug))).findFirst("server_connection_cache", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug)))).mutate(({ forSchema, retrieveResult: [server, secrets, oauthStates, cache] }) => {
+					if (!server) return { server: null };
+					const uow = forSchema(mcpSchema);
+					const replaced = {
+						...server,
+						name: body.name ?? null,
+						endpointUrl: body.endpointUrl,
+						authMode: authMode(body.auth)
+					};
+					uow.update("server_configuration", server.id, (b) => b.set({
+						name: replaced.name,
+						endpointUrl: replaced.endpointUrl,
+						authMode: replaced.authMode,
+						updatedAt: b.now()
+					}).check());
+					const authSecret = secrets.find((secret) => secret.kind === "auth");
+					for (const secret of secrets) if (secret !== authSecret || payload === null) uow.delete("secret", secret.id);
+					if (payload !== null) {
+						if (authSecret) uow.update("secret", authSecret.id, (b) => b.set({
+							payload,
+							expiresAt: null,
+							updatedAt: b.now()
+						}).check());
+						else uow.create("secret", {
+							id: `${pathParams.slug}:auth`,
+							serverId: pathParams.slug,
+							kind: "auth",
+							payload,
+							expiresAt: null
+						});
+					}
+					for (const oauthState of oauthStates) uow.delete("oauthState", oauthState.id);
+					if (cache) uow.delete("server_connection_cache", cache.id);
+					if (body.auth.type !== "oauth") uow.triggerHook("internalRefreshServerConfiguration", { serverId: pathParams.slug });
+					const ready = isMcpAuthReady(replaced.authMode, payload === null ? void 0 : {
+						payload,
+						expiresAt: null
+					});
+					if (ready !== isMcpAuthReady(server.authMode, authSecret)) uow.triggerHook("onServerReadinessChanged", {
+						serverId: pathParams.slug,
+						ready
+					});
+					return { server: replaced };
+				}).execute();
+				if (!result.server) return error({
+					code: "SERVER_NOT_FOUND",
+					message: "MCP server not found"
+				}, 404);
+				return json(publicServer(result.server));
+			}
+		}),
+		defineRoute({
+			method: "DELETE",
+			path: "/servers/:slug",
+			errorCodes: ["SERVER_NOT_FOUND"],
+			handler: async function({ pathParams }, { empty, error }) {
+				if (!(await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).find("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb("serverId", "=", pathParams.slug))).find("oauthState", (b) => b.whereIndex("idx_oauth_state_server", (eb) => eb("serverId", "=", pathParams.slug))).findFirst("server_connection_cache", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug)))).mutate(({ forSchema, retrieveResult: [server, secrets, oauthStates, cache] }) => {
+					if (!server) return { deleted: false };
+					const uow = forSchema(mcpSchema);
+					for (const secret of secrets) uow.delete("secret", secret.id);
+					for (const oauthState of oauthStates) uow.delete("oauthState", oauthState.id);
+					if (cache) uow.delete("server_connection_cache", cache.id);
+					uow.delete("server_configuration", server.id);
+					uow.triggerHook("onServerConfigurationDeleted", { serverId: pathParams.slug });
+					return { deleted: true };
+				}).execute()).deleted) return error({
+					code: "SERVER_NOT_FOUND",
+					message: "MCP server not found"
+				}, 404);
+				return empty(204);
+			}
+		}),
+		defineRoute({
+			method: "GET",
+			path: "/servers/:slug/auth/status",
+			outputSchema: mcpAuthStatusSchema,
+			errorCodes: ["SERVER_NOT_FOUND"],
+			handler: async function({ pathParams }, { json, error }) {
+				const [server, secret, pendingState] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).findFirst("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb.and(eb("serverId", "=", pathParams.slug), eb("kind", "=", "auth")))).findFirst("oauthState", (b) => b.whereIndex("idx_oauth_state_pending", (eb) => eb.and(eb("serverId", "=", pathParams.slug), eb.isNull("consumedAt"), eb("expiresAt", ">", eb.now()))).orderByIndex("idx_oauth_state_pending", "desc"))).execute();
+				if (!server) return error({
+					code: "SERVER_NOT_FOUND",
+					message: "MCP server not found"
+				}, 404);
+				return json(projectMcpAuthStatus({
+					authMode: server.authMode,
+					authSecret: secret ?? void 0,
+					hasPendingOAuth: pendingOAuthLink(pendingState) !== null
+				}));
+			}
+		}),
+		defineRoute({
+			method: "GET",
+			path: "/servers/:slug/auth/pending",
+			outputSchema: mcpOAuthPendingSchema,
+			errorCodes: ["SERVER_NOT_FOUND"],
+			handler: async function({ pathParams }, { json, error }) {
+				const [server, pendingState] = await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).findFirst("oauthState", (b) => b.whereIndex("idx_oauth_state_pending", (eb) => eb.and(eb("serverId", "=", pathParams.slug), eb.isNull("consumedAt"), eb("expiresAt", ">", eb.now()))).orderByIndex("idx_oauth_state_pending", "desc"))).execute();
+				if (!server) return error({
+					code: "SERVER_NOT_FOUND",
+					message: "MCP server not found"
+				}, 404);
+				return json({ pending: pendingOAuthLink(pendingState) });
+			}
+		}),
+		defineRoute({
+			method: "POST",
+			path: "/servers/:slug/auth/token",
+			inputSchema: tokenAuthInputSchema,
+			outputSchema: mcpAuthStatusSchema,
+			errorCodes: ["SERVER_NOT_FOUND"],
+			handler: async function({ input, pathParams }, { json, error }) {
+				const { token } = await input.valid();
+				const payload = stringifySecretPayload({
+					type: "bearer",
+					token
+				});
+				if (!(await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).findFirst("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb.and(eb("serverId", "=", pathParams.slug), eb("kind", "=", "auth")))).findFirst("server_connection_cache", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug)))).mutate(({ forSchema, retrieveResult: [server, secret, cache] }) => {
+					if (!server) return { found: false };
+					const uow = forSchema(mcpSchema);
+					uow.update("server_configuration", server.id, (b) => b.set({
+						authMode: "bearer",
+						updatedAt: b.now()
+					}).check());
+					if (cache) uow.delete("server_connection_cache", cache.id);
+					if (secret) uow.update("secret", secret.id, (b) => b.set({
+						payload,
+						expiresAt: null,
+						updatedAt: b.now()
+					}).check());
+					else uow.create("secret", {
+						id: `${pathParams.slug}:auth`,
+						serverId: pathParams.slug,
+						kind: "auth",
+						payload,
+						expiresAt: null
+					});
+					uow.triggerHook("internalRefreshServerConfiguration", { serverId: pathParams.slug });
+					if (!isMcpAuthReady(server.authMode, secret ?? void 0)) uow.triggerHook("onServerReadinessChanged", {
+						serverId: pathParams.slug,
+						ready: true
+					});
+					return { found: true };
+				}).execute()).found) return error({
+					code: "SERVER_NOT_FOUND",
+					message: "MCP server not found"
+				}, 404);
+				return json({
+					mode: "bearer",
+					credentials: "present"
+				});
+			}
+		}),
+		defineRoute({
+			method: "POST",
+			path: "/servers/:slug/auth/start",
+			inputSchema: oauthStartInputSchema,
+			outputSchema: z.object({
+				authorizationUrl: z.string(),
+				state: z.string()
+			}),
+			queryParameters: [MCP_OAUTH_REDIRECT_URI_QUERY_PARAMETER],
+			errorCodes: [
+				"INVALID_OAUTH_REDIRECT_URI",
+				"OAUTH_REDIRECT_URI_NOT_ALLOWED",
+				"SERVER_NOT_FOUND",
+				"OAUTH_ERROR"
+			],
+			handler: async function({ input, pathParams, query }, { json, error }) {
+				const body = await input.valid();
+				const redirectUri = mcpOAuthRedirectUriSchema.safeParse(query.get(MCP_OAUTH_REDIRECT_URI_QUERY_PARAMETER));
+				if (!redirectUri.success) return error({
+					code: "INVALID_OAUTH_REDIRECT_URI",
+					message: "MCP OAuth redirect URI must be an HTTP or HTTPS URL"
+				}, 400);
+				const oauthRedirectUri = new URL(redirectUri.data);
+				if (!config.allowedOAuthRedirectUris?.(oauthRedirectUri)) return error({
+					code: "OAUTH_REDIRECT_URI_NOT_ALLOWED",
+					message: "MCP OAuth redirect URI is not allowed by the fragment configuration"
+				}, 400);
+				const state = `${pathParams.slug}:${crypto.randomUUID()}`;
+				try {
+					const [result] = await this.handlerTx().withServiceCalls(() => [services.startOAuth({
+						serverId: pathParams.slug,
+						stateId: state,
+						redirectUri: oauthRedirectUri.toString(),
+						scope: body.scope,
+						clientId: body.clientId,
+						clientSecret: body.clientSecret,
+						discardTokens: body.discardTokens
+					})]).execute();
+					if (!result.found) return error({
+						code: "SERVER_NOT_FOUND",
+						message: "MCP server not found"
+					}, 404);
+					return json({
+						authorizationUrl: result.authorizationUrl,
+						state
+					});
+				} catch (err) {
+					return error({
+						code: "OAUTH_ERROR",
+						message: err.message
+					}, 502);
+				}
+			}
+		}),
+		defineRoute({
+			method: "GET",
+			path: "/oauth/callback",
+			outputSchema: z.object({
+				authenticated: z.boolean(),
+				mode: z.string()
+			}),
+			errorCodes: [
+				"SERVER_NOT_FOUND",
+				"OAUTH_ERROR",
+				"INVALID_OAUTH_STATE"
+			],
+			handler: async function({ query }, { json, error }) {
+				const code = query.get("code");
+				const stateId = query.get("state");
+				if (!code || !stateId) return error({
+					code: "INVALID_OAUTH_STATE",
+					message: "Missing OAuth code or state"
+				}, 400);
+				try {
+					const [result] = await this.handlerTx().withServiceCalls(() => [services.completeOAuthCallback({
+						stateId,
+						code,
+						iss: query.get("iss") ?? void 0
+					})]).execute();
+					if (!result.found) {
+						if (result.reason === "server_not_found") return error({
+							code: "SERVER_NOT_FOUND",
+							message: "MCP server not found"
+						}, 404);
+						return error({
+							code: "INVALID_OAUTH_STATE",
+							message: "Invalid OAuth state"
+						}, 400);
+					}
+					return json({
+						authenticated: true,
+						mode: "oauth"
+					});
+				} catch (err) {
+					return error({
+						code: "OAUTH_ERROR",
+						message: err.message
+					}, 502);
+				}
+			}
+		}),
+		defineRoute({
+			method: "DELETE",
+			path: "/servers/:slug/auth",
+			outputSchema: mcpAuthStatusSchema,
+			errorCodes: ["SERVER_NOT_FOUND"],
+			handler: async function({ pathParams }, { json, error }) {
+				const result = await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).find("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb("serverId", "=", pathParams.slug))).find("oauthState", (b) => b.whereIndex("idx_oauth_state_server", (eb) => eb("serverId", "=", pathParams.slug))).findFirst("server_connection_cache", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug)))).mutate(({ forSchema, retrieveResult: [server, secrets, oauthStates, cache] }) => {
+					if (!server) return { found: false };
+					const uow = forSchema(mcpSchema);
+					const authSecret = secrets.find((secret) => secret.kind === "auth");
+					const remainingAuth = server.authMode === "oauth" && authSecret ? {
+						payload: withoutOAuthConsent(authSecret.payload),
+						expiresAt: null
+					} : void 0;
+					if (server.authMode === "oauth") {
+						if (authSecret && remainingAuth) uow.update("secret", authSecret.id, (b) => b.set({
+							payload: remainingAuth.payload,
+							expiresAt: null,
+							updatedAt: b.now()
+						}).check());
+					} else for (const secret of secrets) uow.delete("secret", secret.id);
+					const ready = isMcpAuthReady(server.authMode, remainingAuth);
+					if (ready !== isMcpAuthReady(server.authMode, authSecret)) uow.triggerHook("onServerReadinessChanged", {
+						serverId: pathParams.slug,
+						ready
+					});
+					for (const oauthState of oauthStates) uow.delete("oauthState", oauthState.id);
+					if (cache) uow.delete("server_connection_cache", cache.id);
+					uow.update("server_configuration", server.id, (b) => b.set({ updatedAt: b.now() }).check());
+					return {
+						found: true,
+						status: projectMcpAuthStatus({
+							authMode: server.authMode,
+							authSecret: void 0,
+							hasPendingOAuth: false
+						})
+					};
+				}).execute();
+				if (!result.found) return error({
+					code: "SERVER_NOT_FOUND",
+					message: "MCP server not found"
+				}, 404);
+				return json(result.status);
+			}
+		}),
+		defineRoute({
+			method: "POST",
+			path: "/servers/:slug/refresh",
+			outputSchema: refreshOutputSchema,
+			errorCodes: ["SERVER_NOT_FOUND"],
+			handler: async function({ pathParams }, { json, error }) {
+				const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+				let prepared;
+				let authError;
+				const result = await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).find("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb("serverId", "=", pathParams.slug))).findFirst("server_connection_cache", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).find("oauthState", (b) => b.whereIndex("idx_oauth_state_server", (eb) => eb("serverId", "=", pathParams.slug)))).afterRetrieve(async (_uow, [server, secrets]) => {
+					if (!server) return;
+					try {
+						const auth = await createMcpOperationAuth({
+							config,
+							server,
+							secrets
+						});
+						const toolsOperation = await listMcpTools({
+							endpointUrl: server.endpointUrl,
+							auth,
+							fetchImplementation: config.fetch
+						});
+						prepared = {
+							authChanges: toolsOperation.authChanges,
+							toolsOperation
+						};
+					} catch (err) {
+						authError = err;
+					}
+				}).mutate(({ forSchema, retrieveResult: [server, secrets, cache, oauthStates] }) => {
+					if (!server) return { found: false };
+					const serverId = server.id.toString();
+					const previousTools = Array.isArray(cache?.tools) ? cache.tools : null;
+					const baseDiagnostics = {
+						checkedAt,
+						server: publicServer(server),
+						cache: {
+							presentBeforeCheck: Boolean(cache),
+							previousToolCount: previousTools?.length ?? null,
+							updatedToolCount: null
+						}
+					};
+					if (authError) return {
+						found: true,
+						refresh: {
+							...baseDiagnostics,
+							ok: false,
+							tools: [],
+							stage: "auth",
+							auth: buildAuthDiagnostics({
+								mode: server.authMode,
+								secrets,
+								oauthStates
+							}),
+							live: {
+								reachable: false,
+								listToolsOk: false,
+								toolCount: null,
+								protocolVersion: null,
+								serverInfo: null,
+								capabilities: null
+							},
+							error: {
+								code: "AUTH_ERROR",
+								message: errorMessage(authError)
+							}
+						}
+					};
+					if (!prepared) throw new Error("MCP refresh operation was not prepared");
+					const preparedOperation = prepared;
+					const uow = forSchema(mcpSchema);
+					const upsertSecret = (kind, payload, expiresAt) => {
+						const existing = secrets.find((secret) => secret.kind === kind);
+						if (existing) {
+							uow.update("secret", existing.id, (b) => b.set({
+								payload,
+								expiresAt,
+								updatedAt: b.now()
+							}).check());
+							return;
+						}
+						uow.create("secret", {
+							id: `${serverId}:${kind}`,
+							serverId,
+							kind,
+							payload,
+							expiresAt
+						});
+					};
+					if (preparedOperation.authChanges) writeOAuthSecretChanges(preparedOperation.authChanges, {
+						upsert: (kind, payload) => {
+							upsertSecret(kind, payload, null);
+						},
+						remove: (kind) => {
+							const existing = secrets.find((secret) => secret.kind === kind);
+							if (existing) uow.delete("secret", existing.id);
+						}
+					});
+					if (preparedOperation.authChanges?.authPayload) {
+						const after = {
+							payload: preparedOperation.authChanges.authPayload,
+							expiresAt: preparedOperation.authChanges.authExpiresAt ?? null
+						};
+						upsertSecret("auth", after.payload, after.expiresAt);
+						const before = secrets.find((secret) => secret.kind === "auth");
+						const ready = isMcpAuthReady(server.authMode, after);
+						if (ready !== isMcpAuthReady(server.authMode, before)) uow.triggerHook("onServerReadinessChanged", {
+							serverId,
+							ready
+						});
+						scheduleMcpAuthExpiry(uow, serverId, server.authMode, after);
+					}
+					const auth = buildAuthDiagnostics({
+						mode: server.authMode,
+						secrets,
+						oauthStates,
+						authChanges: preparedOperation.authChanges
+					});
+					if (!preparedOperation.toolsOperation.ok) return {
+						found: true,
+						refresh: {
+							...baseDiagnostics,
+							ok: false,
+							tools: [],
+							stage: "list_tools",
+							auth,
+							live: {
+								reachable: false,
+								listToolsOk: false,
+								toolCount: null,
+								protocolVersion: null,
+								serverInfo: null,
+								capabilities: null
+							},
+							error: {
+								code: "MCP_ERROR",
+								message: errorMessage(preparedOperation.toolsOperation.error)
+							}
+						}
+					};
+					const tools = Array.isArray(preparedOperation.toolsOperation.result.tools) ? preparedOperation.toolsOperation.result.tools : [];
+					if (!previousTools || JSON.stringify(previousTools) !== JSON.stringify(tools)) uow.triggerHook("onServerConfigurationChanged", {
+						serverId,
+						current: { tools }
+					});
+					uow.delete("server_connection_cache", serverId);
+					uow.create("server_connection_cache", {
+						id: serverId,
+						serverId,
+						protocolVersion: preparedOperation.toolsOperation.metadata.protocolVersion ?? null,
+						serverInfo: preparedOperation.toolsOperation.metadata.serverInfo ?? null,
+						capabilities: preparedOperation.toolsOperation.metadata.capabilities ?? null,
+						tools
+					});
+					return {
+						found: true,
+						refresh: {
+							...baseDiagnostics,
+							ok: true,
+							tools,
+							stage: null,
+							auth,
+							live: {
+								reachable: true,
+								listToolsOk: true,
+								toolCount: tools.length,
+								protocolVersion: preparedOperation.toolsOperation.metadata.protocolVersion ?? null,
+								serverInfo: preparedOperation.toolsOperation.metadata.serverInfo ?? null,
+								capabilities: preparedOperation.toolsOperation.metadata.capabilities ?? null
+							},
+							cache: {
+								...baseDiagnostics.cache,
+								updatedToolCount: tools.length
+							},
+							error: null
+						}
+					};
+				}).execute();
+				if (!result.found) return error({
+					code: "SERVER_NOT_FOUND",
+					message: "MCP server not found"
+				}, 404);
+				return json(result.refresh);
+			}
+		}),
+		defineRoute({
+			method: "POST",
+			path: "/servers/:slug/tools/execute",
+			inputSchema: toolCallInputSchema,
+			outputSchema: mcpToolCallResultSchema,
+			errorCodes: ["SERVER_NOT_FOUND", "MCP_ERROR"],
+			handler: async function({ input, pathParams }, { json, error }) {
+				const body = await input.valid();
+				try {
+					let prepared;
+					const result = await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug))).find("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb("serverId", "=", pathParams.slug))).findFirst("server_connection_cache", (b) => b.whereIndex("primary", (eb) => eb("id", "=", pathParams.slug)))).afterRetrieve(async (_uow, [server, secrets]) => {
+						if (!server) return;
+						const auth = await createMcpOperationAuth({
+							config,
+							server,
+							secrets
+						});
+						const toolOperation = await callMcpTool({
+							endpointUrl: server.endpointUrl,
+							auth,
+							name: body.name,
+							toolArguments: body.arguments,
+							timeoutMs: body.timeoutMs,
+							fetchImplementation: config.fetch
+						});
+						prepared = {
+							serverId: server.id.toString(),
+							authChanges: toolOperation.authChanges,
+							toolOperation
+						};
+					}).mutate(({ forSchema, retrieveResult: [server, secrets, cache] }) => {
+						if (!server) return { found: false };
+						if (!prepared) throw new Error("MCP operation was not prepared");
+						const preparedOperation = prepared;
+						const uow = forSchema(mcpSchema);
+						const upsertSecret = (kind, payload, expiresAt) => {
+							const existing = secrets.find((secret) => secret.kind === kind);
+							if (existing) {
+								uow.update("secret", existing.id, (b) => b.set({
+									payload,
+									expiresAt,
+									updatedAt: b.now()
+								}).check());
+								return;
+							}
+							uow.create("secret", {
+								id: `${preparedOperation.serverId}:${kind}`,
+								serverId: preparedOperation.serverId,
+								kind,
+								payload,
+								expiresAt
+							});
+						};
+						if (preparedOperation.authChanges) writeOAuthSecretChanges(preparedOperation.authChanges, {
+							upsert: (kind, payload) => {
+								upsertSecret(kind, payload, null);
+							},
+							remove: (kind) => {
+								const existing = secrets.find((secret) => secret.kind === kind);
+								if (existing) uow.delete("secret", existing.id);
+							}
+						});
+						if (preparedOperation.authChanges?.authPayload) {
+							const after = {
+								payload: preparedOperation.authChanges.authPayload,
+								expiresAt: preparedOperation.authChanges.authExpiresAt ?? null
+							};
+							upsertSecret("auth", after.payload, after.expiresAt);
+							const before = secrets.find((secret) => secret.kind === "auth");
+							const ready = isMcpAuthReady(server.authMode, after);
+							if (ready !== isMcpAuthReady(server.authMode, before)) uow.triggerHook("onServerReadinessChanged", {
+								serverId: preparedOperation.serverId,
+								ready
+							});
+							scheduleMcpAuthExpiry(uow, preparedOperation.serverId, server.authMode, after);
+						}
+						const toolOperation = preparedOperation.toolOperation;
+						if (!toolOperation.ok) return {
+							found: true,
+							error: toolOperation.error instanceof Error ? toolOperation.error.message : String(toolOperation.error)
+						};
+						if (cache) uow.update("server_connection_cache", cache.id, (b) => b.set({
+							protocolVersion: toolOperation.metadata.protocolVersion ?? null,
+							serverInfo: toolOperation.metadata.serverInfo ?? null,
+							capabilities: toolOperation.metadata.capabilities ?? null,
+							updatedAt: b.now()
+						}).check());
+						else uow.create("server_connection_cache", {
+							id: pathParams.slug,
+							serverId: pathParams.slug,
+							protocolVersion: toolOperation.metadata.protocolVersion ?? null,
+							serverInfo: toolOperation.metadata.serverInfo ?? null,
+							capabilities: toolOperation.metadata.capabilities ?? null,
+							tools: null
+						});
+						return {
+							found: true,
+							result: toolOperation.result
+						};
+					}).execute();
+					if (!result.found) return error({
+						code: "SERVER_NOT_FOUND",
+						message: "MCP server not found"
+					}, 404);
+					if ("error" in result) return error({
+						code: "MCP_ERROR",
+						message: result.error ?? "MCP operation failed"
+					}, 502);
+					return json(result.result);
+				} catch (err) {
+					return error({
+						code: "MCP_ERROR",
+						message: err.message
+					}, 502);
+				}
+			}
+		})
+	];
+});
+//#endregion
+export { mcpRoutesFactory };
+
+//# sourceMappingURL=routes.js.map