@happyvertical/smrt-app-mcp 0.57.43 → 0.57.45

package/dist/chunks/errors-XG_zn1pP.js

@@ -0,0 +1,73 @@
+//#region src/errors.ts
+var MCP_TOOL_ACCESS_DENIED_CODE = "mcp_tool_access_denied";
+var MCP_ORIGIN_DENIED_CODE = "mcp_origin_denied";
+var McpAccessError = class extends Error {
+	constructor(status, message, metadata = {}) {
+		super(message);
+		this.status = status;
+		this.metadata = metadata;
+		this.name = "McpAccessError";
+	}
+	status;
+	metadata;
+};
+var MCP_TOOL_NOT_FOUND_CODE = "mcp_tool_not_found";
+var MCP_AUTHENTICATION_REQUIRED_CODE = "mcp_authentication_required";
+var MCP_TOOL_EXECUTION_FAILED_CODE = "mcp_tool_execution_failed";
+var MCP_TOOL_EXECUTION_FAILED_MESSAGE = "Workflow execution failed.";
+var McpToolError = class extends Error {
+	code;
+	details;
+	constructor(code, message, details) {
+		super(message);
+		this.name = "McpToolError";
+		this.code = code;
+		if (details !== void 0) this.details = details;
+	}
+};
+var SAFE_CODE = /^[A-Za-z][A-Za-z0-9_.:-]{0,63}$/;
+var MAX_SAFE_MESSAGE_LENGTH = 500;
+var MAX_SAFE_DETAILS_BYTES = 4096;
+var GENERIC_TOOL_ERROR = Object.freeze({
+	code: MCP_TOOL_EXECUTION_FAILED_CODE,
+	message: MCP_TOOL_EXECUTION_FAILED_MESSAGE
+});
+function validInfo(value) {
+	if (!value || typeof value !== "object") return void 0;
+	const { code, message, details } = value;
+	if (typeof code !== "string" || !SAFE_CODE.test(code)) return void 0;
+	if (typeof message !== "string" || !message.trim() || message.length > MAX_SAFE_MESSAGE_LENGTH) return;
+	const info = {
+		code,
+		message
+	};
+	if (details !== void 0) try {
+		if (!details || typeof details !== "object" || Array.isArray(details) || typeof JSON.stringify(details) !== "string" || JSON.stringify(details).length > MAX_SAFE_DETAILS_BYTES) return;
+		info.details = JSON.parse(JSON.stringify(details));
+	} catch {
+		return;
+	}
+	return info;
+}
+function safeMcpToolError(error, mapError) {
+	return authoredMcpToolError(error, mapError) ?? { ...GENERIC_TOOL_ERROR };
+}
+function authoredMcpToolError(error, mapError) {
+	try {
+		if (error instanceof McpToolError) {
+			const info = validInfo({
+				code: error.code,
+				message: error.message,
+				details: error.details
+			});
+			if (info) return info;
+		} else if (mapError) {
+			const info = validInfo(mapError(error));
+			if (info) return info;
+		}
+	} catch {}
+}
+//#endregion
+export { MCP_TOOL_NOT_FOUND_CODE as a, authoredMcpToolError as c, MCP_TOOL_EXECUTION_FAILED_CODE as i, safeMcpToolError as l, MCP_ORIGIN_DENIED_CODE as n, McpAccessError as o, MCP_TOOL_ACCESS_DENIED_CODE as r, McpToolError as s, MCP_AUTHENTICATION_REQUIRED_CODE as t };
+
+//# sourceMappingURL=errors-XG_zn1pP.js.map

package/dist/chunks/errors-XG_zn1pP.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-XG_zn1pP.js","names":[],"sources":["../../src/errors.ts"],"sourcesContent":["/** Machine-readable code for a principal policy denial. */\nexport const MCP_TOOL_ACCESS_DENIED_CODE = 'mcp_tool_access_denied';\n\n/** Machine-readable code for a request refused by the endpoint's origin check. */\nexport const MCP_ORIGIN_DENIED_CODE = 'mcp_origin_denied';\n\n/**\n * Metadata that is safe to expose for an app-MCP access failure. Policy\n * implementations must not place principal, scope, tool, or internal-error\n * details here.\n */\nexport interface McpAccessErrorMetadata {\n  code?: string;\n  retryable?: boolean;\n}\n\n/**\n * Error returned by the MCP app server when a caller tries to use a tool\n * they are not allowed to access. The HTTP layer should map `status` onto\n * the response status code.\n */\nexport class McpAccessError extends Error {\n  constructor(\n    readonly status: number,\n    message: string,\n    readonly metadata: McpAccessErrorMetadata = {},\n  ) {\n    super(message);\n    this.name = 'McpAccessError';\n  }\n}\n\n/** Stable code for a request naming a tool this server does not publish. */\nexport const MCP_TOOL_NOT_FOUND_CODE = 'mcp_tool_not_found';\n\n/** Stable code for a tool call that needs an authenticated principal. */\nexport const MCP_AUTHENTICATION_REQUIRED_CODE = 'mcp_authentication_required';\n\n/** Stable code for an unmapped handler failure; carries no internals. */\nexport const MCP_TOOL_EXECUTION_FAILED_CODE = 'mcp_tool_execution_failed';\n\n/** The generic message an unmapped handler failure returns. */\nexport const MCP_TOOL_EXECUTION_FAILED_MESSAGE = 'Workflow execution failed.';\n\n/** The agent-safe projection of a tool failure: a stable code and a message. */\nexport interface McpToolErrorInfo {\n  code: string;\n  message: string;\n  /** Optional JSON-safe, non-sensitive structured detail. */\n  details?: Record<string, unknown>;\n}\n\n/**\n * Throw from a workflow tool handler to hand the calling agent a typed,\n * authored failure. The `code` and `message` (and optional `details`) reach\n * the agent verbatim, so they must be safe to disclose: never put records,\n * credentials, stack traces, or other tenants' data in them. Any other\n * thrown value stays behind the generic failure message.\n */\nexport class McpToolError extends Error {\n  readonly code: string;\n  readonly details?: Record<string, unknown>;\n  constructor(\n    code: string,\n    message: string,\n    details?: Record<string, unknown>,\n  ) {\n    super(message);\n    this.name = 'McpToolError';\n    this.code = code;\n    if (details !== undefined) this.details = details;\n  }\n}\n\n/** Per-tool mapping of a handler failure to a safe code and message. */\nexport type McpToolErrorMapper = (\n  error: unknown,\n) => McpToolErrorInfo | null | undefined;\n\nconst SAFE_CODE = /^[A-Za-z][A-Za-z0-9_.:-]{0,63}$/;\nconst MAX_SAFE_MESSAGE_LENGTH = 500;\nconst MAX_SAFE_DETAILS_BYTES = 4096;\n\nconst GENERIC_TOOL_ERROR: Readonly<McpToolErrorInfo> = Object.freeze({\n  code: MCP_TOOL_EXECUTION_FAILED_CODE,\n  message: MCP_TOOL_EXECUTION_FAILED_MESSAGE,\n});\n\nfunction validInfo(value: unknown): McpToolErrorInfo | undefined {\n  if (!value || typeof value !== 'object') return undefined;\n  const { code, message, details } = value as Record<string, unknown>;\n  if (typeof code !== 'string' || !SAFE_CODE.test(code)) return undefined;\n  if (\n    typeof message !== 'string' ||\n    !message.trim() ||\n    message.length > MAX_SAFE_MESSAGE_LENGTH\n  ) {\n    return undefined;\n  }\n  const info: McpToolErrorInfo = { code, message };\n  if (details !== undefined) {\n    try {\n      if (\n        !details ||\n        typeof details !== 'object' ||\n        Array.isArray(details) ||\n        typeof JSON.stringify(details) !== 'string' ||\n        JSON.stringify(details).length > MAX_SAFE_DETAILS_BYTES\n      ) {\n        return undefined;\n      }\n      info.details = JSON.parse(JSON.stringify(details));\n    } catch {\n      return undefined;\n    }\n  }\n  return info;\n}\n\n/**\n * Resolve a thrown value to the information that may reach an agent. Never\n * throws: a thrown {@link McpToolError} or a valid `mapError` result yields its\n * safe code and message; anything else (including a throwing or malformed\n * mapper) yields the generic failure.\n */\nexport function safeMcpToolError(\n  error: unknown,\n  mapError?: McpToolErrorMapper,\n): McpToolErrorInfo {\n  return authoredMcpToolError(error, mapError) ?? { ...GENERIC_TOOL_ERROR };\n}\n\n/**\n * The authored (opt-in) safe error for a thrown value: a valid\n * {@link McpToolError} or `mapError` result, else `undefined`. Only this form\n * is typed on the MCP wire; an unmapped failure keeps the generic result.\n */\nexport function authoredMcpToolError(\n  error: unknown,\n  mapError?: McpToolErrorMapper,\n): McpToolErrorInfo | undefined {\n  try {\n    if (error instanceof McpToolError) {\n      const info = validInfo({\n        code: error.code,\n        message: error.message,\n        details: error.details,\n      });\n      if (info) return info;\n    } else if (mapError) {\n      const info = validInfo(mapError(error));\n      if (info) return info;\n    }\n  } catch {\n    // A mapper failure falls back to the generic message.\n  }\n  return undefined;\n}\n"],"mappings":";AACO,IAAM,8BAA8B;AAGpC,IAAM,yBAAyB;AAiB/B,IAAM,iBAAN,cAA6B,MAAM;CACxC,YACW,QACT,SACS,WAAmC,CAAC,GAC7C;EACA,MAAM,OAAO;EAJJ,KAAA,SAAA;EAEA,KAAA,WAAA;EAGT,KAAK,OAAO;CACd;CANW;CAEA;AAKb;AAGO,IAAM,0BAA0B;AAGhC,IAAM,mCAAmC;AAGzC,IAAM,iCAAiC;AAGvC,IAAM,oCAAoC;AAiB1C,IAAM,eAAN,cAA2B,MAAM;CAC7B;CACA;CACT,YACE,MACA,SACA,SACA;EACA,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,IAAI,YAAY,KAAA,GAAW,KAAK,UAAU;CAC5C;AACF;AAOA,IAAM,YAAY;AAClB,IAAM,0BAA0B;AAChC,IAAM,yBAAyB;AAE/B,IAAM,qBAAiD,OAAO,OAAO;CACnE,MAAM;CACN,SAAS;AACX,CAAC;AAED,SAAS,UAAU,OAA8C;CAC/D,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO,KAAA;CAChD,MAAM,EAAE,MAAM,SAAS,YAAY;CACnC,IAAI,OAAO,SAAS,YAAY,CAAC,UAAU,KAAK,IAAI,GAAG,OAAO,KAAA;CAC9D,IACE,OAAO,YAAY,YACnB,CAAC,QAAQ,KAAK,KACd,QAAQ,SAAS,yBAEjB;CAEF,MAAM,OAAyB;EAAE;EAAM;CAAQ;CAC/C,IAAI,YAAY,KAAA,GACd,IAAI;EACF,IACE,CAAC,WACD,OAAO,YAAY,YACnB,MAAM,QAAQ,OAAO,KACrB,OAAO,KAAK,UAAU,OAAO,MAAM,YACnC,KAAK,UAAU,OAAO,CAAA,CAAE,SAAS,wBAEjC;EAEF,KAAK,UAAU,KAAK,MAAM,KAAK,UAAU,OAAO,CAAC;CACnD,QAAQ;EACN;CACF;CAEF,OAAO;AACT;AAQO,SAAS,iBACd,OACA,UACkB;CAClB,OAAO,qBAAqB,OAAO,QAAQ,KAAK,EAAE,GAAG,mBAAmB;AAC1E;AAOO,SAAS,qBACd,OACA,UAC8B;CAC9B,IAAI;EACF,IAAI,iBAAiB,cAAc;GACjC,MAAM,OAAO,UAAU;IACrB,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;GACjB,CAAC;GACD,IAAI,MAAM,OAAO;EACnB,OAAA,IAAW,UAAU;GACnB,MAAM,OAAO,UAAU,SAAS,KAAK,CAAC;GACtC,IAAI,MAAM,OAAO;EACnB;CACF,QAAQ,CAER;AAEF"}

package/dist/chunks/identity-BNzyRsWf.js

@@ -0,0 +1,14 @@
+//#region src/identity.ts
+function stampVerifiedIdentity(principal, identity) {
+	if (identity) Object.defineProperty(principal, "identity", {
+		value: Object.freeze({ ...identity }),
+		enumerable: false,
+		configurable: false,
+		writable: false
+	});
+	return principal;
+}
+//#endregion
+export { stampVerifiedIdentity as t };
+
+//# sourceMappingURL=identity-BNzyRsWf.js.map

package/dist/chunks/identity-BNzyRsWf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-BNzyRsWf.js","names":[],"sources":["../../src/identity.ts"],"sourcesContent":["import type { McpPrincipalIdentity } from './server.js';\n\n/**\n * Attach the adapter-verified credential identity to a principal as a\n * non-enumerable property: it never changes the principal's enumerable\n * (deep-equal, serialized) shape, and an object spread drops it, so any\n * code that rebuilds a principal must re-stamp it from the authenticated one.\n *\n * @internal\n */\nexport function stampVerifiedIdentity<T extends object>(\n  principal: T,\n  identity: McpPrincipalIdentity | undefined,\n): T {\n  if (identity) {\n    Object.defineProperty(principal, 'identity', {\n      value: Object.freeze({ ...identity }),\n      enumerable: false,\n      configurable: false,\n      writable: false,\n    });\n  }\n  return principal;\n}\n"],"mappings":";AAUO,SAAS,sBACd,WACA,UACG;CACH,IAAI,UACF,OAAO,eAAe,WAAW,YAAY;EAC3C,OAAO,OAAO,OAAO,EAAE,GAAG,SAAS,CAAC;EACpC,YAAY;EACZ,cAAc;EACd,UAAU;CACZ,CAAC;CAEH,OAAO;AACT"}

package/dist/chunks/{protocol-CoCuR_w7.js → protocol-BRQji5k_.js}

@@ -1,22 +1,9 @@
+import { c as authoredMcpToolError, l as safeMcpToolError, o as McpAccessError, r as MCP_TOOL_ACCESS_DENIED_CODE } from "./errors-XG_zn1pP.js";
 import { McpTaskNotFoundError, McpTaskStore, SmrtJobCollection } from "@happyvertical/smrt-jobs";
 import { MCPGenerator, MCP_STABLE_CATALOG_TTL_MS, assertMcpJsonSchemaSafety, mcpToolAnnotationsFor } from "@happyvertical/smrt-core/generators/mcp";
 import { ObjectRegistry, isTenantScopedClassResolved } from "@happyvertical/smrt-core";
 import { createHash } from "node:crypto";
 import { ProtocolError, ProtocolErrorCode, Server } from "@modelcontextprotocol/server";
-//#region src/errors.ts
-var MCP_TOOL_ACCESS_DENIED_CODE = "mcp_tool_access_denied";
-var MCP_ORIGIN_DENIED_CODE = "mcp_origin_denied";
-var McpAccessError = class extends Error {
-	constructor(status, message, metadata = {}) {
-		super(message);
-		this.status = status;
-		this.metadata = metadata;
-		this.name = "McpAccessError";
-	}
-	status;
-	metadata;
-};
-//#endregion
 //#region src/workflow-tools.ts
 var TOOL_NAME = /^[a-z][a-z0-9_]{0,63}$/;
 function assertRecord(value, label) {
@@ -94,6 +81,7 @@ function createMcpWorkflowTool(definition) {
 	if (typeof definition.name !== "string" || !TOOL_NAME.test(definition.name)) throw new TypeError("Workflow tool name must be lowercase snake_case with at most 64 characters.");
 	if (typeof definition.description !== "string" || !definition.description.trim()) throw new TypeError("Workflow tool description must be non-empty.");
 	if (typeof definition.execute !== "function") throw new TypeError("Workflow tool execute must be a function.");
+	if (definition.mapError !== void 0 && typeof definition.mapError !== "function") throw new TypeError("Workflow tool mapError must be a function.");
 	if (![
 		"read",
 		"write",
@@ -134,7 +122,8 @@ function createMcpWorkflowTool(definition) {
 			...icons ? { icons } : {},
 			...Object.keys(meta).length > 0 ? { _meta: meta } : {}
 		},
-		execute: definition.execute
+		execute: definition.execute,
+		...definition.mapError ? { mapError: definition.mapError } : {}
 	};
 }
 //#endregion
@@ -7345,32 +7334,104 @@ function createMcpAppServer(options) {
 			tool
 		};
 	}
-	async function callTool(input) {
-		const { args, principal } = await authorizeCall(input);
-		const workflowTool = workflowToolsByName.get(input.name);
-		if (workflowTool) try {
-			return await workflowTool.execute({
-				arguments: args,
-				principal
-			});
+	function snapshotPrincipal(principal) {
+		if (!principal) return null;
+		const copy = { ...principal };
+		if (principal.roles) copy.roles = Object.freeze([...principal.roles]);
+		if (principal.scopes) copy.scopes = Object.freeze([...principal.scopes]);
+		return Object.freeze(copy);
+	}
+	function identityOf(principal) {
+		const identity = principal?.identity;
+		if (!identity || typeof identity.issuer !== "string" || typeof identity.subject !== "string") return null;
+		return Object.freeze({
+			issuer: identity.issuer,
+			subject: identity.subject,
+			...typeof identity.clientId === "string" ? { clientId: identity.clientId } : {}
+		});
+	}
+	async function audit(input, principal, outcome, error) {
+		if (!options.onToolCall) return;
+		try {
+			await options.onToolCall(Object.freeze({
+				tool: String(input.name).slice(0, 256),
+				principal: snapshotPrincipal(principal),
+				identity: identityOf(principal),
+				outcome,
+				...error ? { error: Object.freeze({ ...error }) } : {}
+			}));
+		} catch (hookError) {
+			try {
+				options.onToolCallHookError?.(hookError);
+			} catch {}
+		}
+	}
+	function deniedInfo(error) {
+		return {
+			code: error.metadata.code ?? (error.status === 404 ? "mcp_tool_not_found" : error.status === 401 ? "mcp_authentication_required" : "mcp_access_denied"),
+			message: error.message
+		};
+	}
+	async function audited(input, run) {
+		const principal = principalForCall(input);
+		let authorized;
+		try {
+			authorized = await authorizeCall(input);
 		} catch (error) {
-			if (error instanceof McpAccessError) throw error;
-			const message = "Workflow execution failed.";
-			return {
-				isError: true,
-				content: [{
-					type: "text",
-					text: message
-				}],
-				structuredContent: { error: { message } }
-			};
+			if (error instanceof McpAccessError) await audit(input, principal, "denied", deniedInfo(error));
+			else await audit(input, principal, "error", safeMcpToolError(error));
+			throw error;
+		}
+		let result;
+		try {
+			result = await run(authorized);
+		} catch (error) {
+			if (error instanceof McpAccessError) await audit(input, principal, "denied", deniedInfo(error));
+			else await audit(input, principal, "error", safeMcpToolError(error));
+			throw error;
 		}
-		return makeGenerator(principal).handleToolCall({
-			method: "tools/call",
-			params: {
-				arguments: args,
-				name: input.name
+		if (result.response.isError) await audit(input, principal, "error", result.failure ?? failureOf(result.response));
+		else await audit(input, principal, "ok");
+		return result.response;
+	}
+	function failureOf(response) {
+		const error = response.structuredContent?.error;
+		return safeMcpToolError(void 0, () => typeof error?.code === "string" && typeof error?.message === "string" ? {
+			code: error.code,
+			message: error.message
+		} : void 0);
+	}
+	async function callTool(input) {
+		return audited(input, async ({ args, principal }) => {
+			const workflowTool = workflowToolsByName.get(input.name);
+			if (workflowTool) try {
+				return { response: await workflowTool.execute({
+					arguments: args,
+					principal
+				}) };
+			} catch (error) {
+				if (error instanceof McpAccessError) throw error;
+				const typed = authoredMcpToolError(error, workflowTool.mapError);
+				const message = typed?.message ?? "Workflow execution failed.";
+				return {
+					failure: typed ?? safeMcpToolError(error),
+					response: {
+						isError: true,
+						content: [{
+							type: "text",
+							text: message
+						}],
+						structuredContent: { error: typed ?? { message } }
+					}
+				};
 			}
+			return { response: await makeGenerator(principal).handleToolCall({
+				method: "tools/call",
+				params: {
+					arguments: args,
+					name: input.name
+				}
+			}) };
 		});
 	}
 	async function hasTaskSupport() {
@@ -7388,14 +7449,15 @@ function createMcpAppServer(options) {
 		return makeGenerator().supportsTaskTool(name);
 	}
 	async function callTask(input) {
-		const { args, principal } = await authorizeCall(input);
-		if (workflowToolsByName.has(input.name)) throw new McpAccessError(400, "Workflow MCP tools do not support tasks.");
-		return makeGenerator(principal, await taskStoreFor(principal)).createTask({
-			method: "tools/call",
-			params: {
-				arguments: args,
-				name: input.name
-			}
+		return audited(input, async ({ args, principal }) => {
+			if (workflowToolsByName.has(input.name)) throw new McpAccessError(400, "Workflow MCP tools do not support tasks.");
+			return { response: await makeGenerator(principal, await taskStoreFor(principal)).createTask({
+				method: "tools/call",
+				params: {
+					arguments: args,
+					name: input.name
+				}
+			}) };
 		});
 	}
 	async function taskOrigin(taskId, principal) {
@@ -7676,6 +7738,6 @@ function assertExtensionMetadata(value) {
 	for (const [name, entry] of Object.entries(value)) if (!name.trim() || !entry || typeof entry !== "object" || Array.isArray(entry)) throw new TypeError("Expected named extension object.");
 }
 //#endregion
-export { McpAccessError as C, MCP_TOOL_ACCESS_DENIED_CODE as S, MCP_APP_RESOURCE_MAX_BYTES as _, createDefaultMcpAppServer as a, createMcpWorkflowTool as b, createMcpAppServer as c, isAllowedCoreTool as d, isPublicMcpTool as f, mcpToolEffect as g, matchesToolPattern as h, DEFAULT_MCP_APP_SERVER_INFO as i, MCP_TOOL_EFFECTS as l, isReadOnlyToolName as m, createMcpProtocolServer as n, mcpAllowedClassNames as o, isPublicToolName as p, createMcpProtocolServerForRequest as r, mcpPrincipalScopePolicy as s, MCP_TASKS_EXTENSION as t, classNamePrefixes as u, MCP_APP_RESOURCE_MIME as v, MCP_ORIGIN_DENIED_CODE as x, prepareMcpAppResource as y };
+export { MCP_APP_RESOURCE_MAX_BYTES as _, createDefaultMcpAppServer as a, createMcpWorkflowTool as b, createMcpAppServer as c, isAllowedCoreTool as d, isPublicMcpTool as f, mcpToolEffect as g, matchesToolPattern as h, DEFAULT_MCP_APP_SERVER_INFO as i, MCP_TOOL_EFFECTS as l, isReadOnlyToolName as m, createMcpProtocolServer as n, mcpAllowedClassNames as o, isPublicToolName as p, createMcpProtocolServerForRequest as r, mcpPrincipalScopePolicy as s, MCP_TASKS_EXTENSION as t, classNamePrefixes as u, MCP_APP_RESOURCE_MIME as v, prepareMcpAppResource as y };
 
-//# sourceMappingURL=protocol-CoCuR_w7.js.map
+//# sourceMappingURL=protocol-BRQji5k_.js.map