@headless-lms/server 0.3.0 → 0.5.0

package/dist/http/errors.d.ts

@@ -7,6 +7,7 @@ type Refusal = {
     path: string;
     message: string;
   }[];
+  details?: Record<string, string>;
 };
 declare function classifyError(error: unknown): Refusal | undefined;
 //#endregion

package/dist/http/errors.js

@@ -3,8 +3,8 @@ import { NoActiveOrgError } from "./scope.js";
 import { InviteError, OrganizationRuleError } from "@headless-lms/core/organizations";
 import { ActionInvocationError, AlreadyConnectedError, InvalidConfigError, UnknownIntegrationError } from "@headless-lms/core/integrations";
 import { AutomationKindMismatchError, InvalidTriggerError, ReservedActionError } from "@headless-lms/core/automations";
+import { ConflictError, ForbiddenError, InvalidInputError, NotFoundError, UnavailableError, ValidationError } from "@headless-lms/core/shared/errors";
 import { hasZodFastifySchemaValidationErrors } from "fastify-type-provider-zod";
-import { ConflictError, ForbiddenError, InvalidInputError, NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/errors.ts
 const BODY_ERRORS = {
 	FST_ERR_CTP_INVALID_JSON_BODY: {
@@ -39,13 +39,13 @@ function issuePath(context, instancePath) {
 function describeIssue(keyword, params, fallback) {
 	switch (keyword) {
 		case "invalid_type":
-			if (params.received === "undefined" || params.received === "null") return "is required";
+			if (params.received === "undefined" || params.received === "null" || /received (undefined|null)$/.test(fallback)) return "is required";
 			return params.expected ? `must be ${withArticle(params.expected)}` : fallback;
 		case "too_small": return params.origin === "string" ? Number(params.minimum) === 1 ? "must not be empty" : `must be at least ${params.minimum} characters` : params.origin === "array" ? `must have at least ${params.minimum} ${Number(params.minimum) === 1 ? "item" : "items"}` : `must be ${params.inclusive === false ? "greater than" : "at least"} ${params.minimum}`;
 		case "too_big": return params.origin === "string" ? `must be at most ${params.maximum} characters` : params.origin === "array" ? `must have at most ${params.maximum} items` : `must be ${params.inclusive === false ? "less than" : "at most"} ${params.maximum}`;
 		case "unrecognized_keys": return `has ${params.keys && params.keys.length > 1 ? "unknown fields" : "an unknown field"} ${(params.keys ?? []).map((key) => `"${key}"`).join(", ")}`;
 		case "invalid_value": return `must be one of ${(params.values ?? []).map((value) => JSON.stringify(value)).join(", ")}`;
-		case "invalid_format": return params.format ? `must be a valid ${params.format.replace(/_/g, " ")}` : fallback;
+		case "invalid_format": return params.format && params.format !== "regex" ? `must be a valid ${params.format.replace(/_/g, " ")}` : fallback;
 		case "invalid_union": return "is not in an accepted shape";
 		default: return fallback;
 	}
@@ -64,7 +64,21 @@ function classifyError(error) {
 		error: "invalid_input",
 		message: error.message
 	};
-	if (error instanceof ConflictError || error instanceof OrganizationRuleError) return {
+	if (error instanceof ValidationError) return {
+		status: 422,
+		error: "unprocessable",
+		message: error.message,
+		issues: error.problems.map((problem) => ({
+			path: problem.path ? `body.${problem.path}` : "body",
+			message: problem.message
+		}))
+	};
+	if (error instanceof ConflictError) return {
+		status: 409,
+		error: error.code ?? "conflict",
+		message: error.message
+	};
+	if (error instanceof OrganizationRuleError) return {
 		status: 409,
 		error: "conflict",
 		message: error.message
@@ -74,6 +88,12 @@ function classifyError(error) {
 		error: "forbidden",
 		message: error.message
 	};
+	if (error instanceof UnavailableError) return {
+		status: 503,
+		error: "unavailable",
+		message: error.message,
+		...error.details && { details: error.details }
+	};
 	if (error instanceof UnauthorizedError) return {
 		status: 401,
 		error: "unauthorized",

package/dist/http/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","names":[],"sources":["../../src/http/errors.ts"],"sourcesContent":["import {\n  ConflictError,\n  ForbiddenError,\n  InvalidInputError,\n  NotFoundError,\n} from '@headless-lms/core/shared/errors';\nimport { InviteError, OrganizationRuleError } from '@headless-lms/core/organizations';\nimport {\n  ActionInvocationError,\n  AlreadyConnectedError,\n  InvalidConfigError,\n  UnknownIntegrationError,\n} from '@headless-lms/core/integrations';\nimport {\n  AutomationKindMismatchError,\n  InvalidTriggerError,\n  ReservedActionError,\n} from '@headless-lms/core/automations';\nimport { hasZodFastifySchemaValidationErrors } from 'fastify-type-provider-zod';\nimport { NoActiveOrgError } from './scope.js';\nimport { UnauthorizedError } from './plugins/auth.js';\n\nexport type Refusal = {\n  status: number;\n  error: string;\n  message: string;\n  issues?: { path: string; message: string }[];\n};\n\nconst BODY_ERRORS: Record<string, Refusal> = {\n  FST_ERR_CTP_INVALID_JSON_BODY: {\n    status: 400,\n    error: 'invalid_body',\n    message: 'The request body must be valid JSON',\n  },\n  FST_ERR_CTP_EMPTY_JSON_BODY: {\n    status: 400,\n    error: 'invalid_body',\n    message: 'The request body must be valid JSON',\n  },\n  FST_ERR_CTP_INVALID_MEDIA_TYPE: {\n    status: 415,\n    error: 'unsupported_media_type',\n    message: 'Send the request body as application/json',\n  },\n  FST_ERR_CTP_BODY_TOO_LARGE: {\n    status: 413,\n    error: 'payload_too_large',\n    message: 'The request body is too large',\n  },\n  FST_ERR_NOT_FOUND: { status: 404, error: 'not_found', message: 'No such route' },\n};\n\nfunction issuePath(context: string, instancePath: string): string {\n  const inner = instancePath\n    .split('/')\n    .filter((part) => part.length > 0)\n    .map((part) => (/^\\d+$/.test(part) ? `[${part}]` : `.${part}`))\n    .join('');\n  return `${context}${inner}`;\n}\n\ntype IssueParams = {\n  expected?: string;\n  received?: string;\n  minimum?: number | bigint;\n  maximum?: number | bigint;\n  inclusive?: boolean;\n  origin?: string;\n  keys?: string[];\n  values?: unknown[];\n  format?: string;\n};\n\nfunction describeIssue(keyword: string | undefined, params: IssueParams, fallback: string): string {\n  switch (keyword) {\n    case 'invalid_type':\n      if (params.received === 'undefined' || params.received === 'null') {\n        return 'is required';\n      }\n      return params.expected ? `must be ${withArticle(params.expected)}` : fallback;\n    case 'too_small':\n      return params.origin === 'string'\n        ? Number(params.minimum) === 1\n          ? 'must not be empty'\n          : `must be at least ${params.minimum} characters`\n        : params.origin === 'array'\n          ? `must have at least ${params.minimum} ${Number(params.minimum) === 1 ? 'item' : 'items'}`\n          : `must be ${params.inclusive === false ? 'greater than' : 'at least'} ${params.minimum}`;\n    case 'too_big':\n      return params.origin === 'string'\n        ? `must be at most ${params.maximum} characters`\n        : params.origin === 'array'\n          ? `must have at most ${params.maximum} items`\n          : `must be ${params.inclusive === false ? 'less than' : 'at most'} ${params.maximum}`;\n    case 'unrecognized_keys':\n      return `has ${params.keys && params.keys.length > 1 ? 'unknown fields' : 'an unknown field'} ${(params.keys ?? []).map((key) => `\"${key}\"`).join(', ')}`;\n    case 'invalid_value':\n      return `must be one of ${(params.values ?? []).map((value) => JSON.stringify(value)).join(', ')}`;\n    case 'invalid_format':\n      return params.format ? `must be a valid ${params.format.replace(/_/g, ' ')}` : fallback;\n    case 'invalid_union':\n      return 'is not in an accepted shape';\n    default:\n      return fallback;\n  }\n}\n\nfunction withArticle(noun: string): string {\n  return /^[aeiou]/i.test(noun) ? `an ${noun}` : `a ${noun}`;\n}\n\nexport function classifyError(error: unknown): Refusal | undefined {\n  if (error instanceof NotFoundError) {\n    return { status: 404, error: 'not_found', message: error.message };\n  }\n  if (error instanceof InvalidInputError) {\n    return { status: 400, error: 'invalid_input', message: error.message };\n  }\n  if (error instanceof ConflictError || error instanceof OrganizationRuleError) {\n    return { status: 409, error: 'conflict', message: error.message };\n  }\n  if (error instanceof ForbiddenError || error instanceof NoActiveOrgError) {\n    return { status: 403, error: 'forbidden', message: error.message };\n  }\n  if (error instanceof UnauthorizedError) {\n    return { status: 401, error: 'unauthorized', message: error.message };\n  }\n  if (error instanceof InviteError) {\n    return { status: 400, error: 'invalid_invite', message: error.message };\n  }\n  if (error instanceof AlreadyConnectedError) {\n    return { status: 409, error: 'already_connected', message: error.message };\n  }\n  if (error instanceof UnknownIntegrationError) {\n    return { status: 400, error: 'unknown_integration', message: error.message };\n  }\n  if (error instanceof InvalidConfigError) {\n    return { status: 400, error: 'invalid_config', message: error.message };\n  }\n  if (error instanceof InvalidTriggerError) {\n    return { status: 400, error: 'invalid_trigger', message: error.message };\n  }\n  if (error instanceof ReservedActionError) {\n    return { status: 400, error: 'reserved_action', message: error.message };\n  }\n  if (error instanceof ActionInvocationError) {\n    return {\n      status: 502,\n      error: 'action_failed',\n      message: 'The integration did not respond as expected',\n    };\n  }\n  if (error instanceof AutomationKindMismatchError) {\n    return { status: 409, error: 'kind_mismatch', message: error.message };\n  }\n  if (hasZodFastifySchemaValidationErrors(error)) {\n    const context = (error as { validationContext?: string }).validationContext ?? 'request';\n    const issues = error.validation.map((issue) => ({\n      path: issuePath(context, issue.instancePath),\n      message: describeIssue(\n        issue.keyword,\n        (issue.params ?? {}) as IssueParams,\n        issue.message ?? 'is invalid',\n      ),\n    }));\n    const first = issues[0];\n    return {\n      status: 400,\n      error: 'validation',\n      message: first ? `${first.path}: ${first.message}` : 'The request is invalid',\n      issues,\n    };\n  }\n  const err = error as { statusCode?: number; code?: string };\n  if (err.code && BODY_ERRORS[err.code]) {\n    return BODY_ERRORS[err.code];\n  }\n  if (typeof err.statusCode === 'number' && err.statusCode >= 400 && err.statusCode < 500) {\n    return {\n      status: err.statusCode,\n      error: 'bad_request',\n      message: 'The request could not be processed',\n    };\n  }\n  return undefined;\n}\n"],"mappings":";;;;;;;;AA6BA,MAAM,cAAuC;CAC3C,+BAA+B;EAC7B,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CACA,6BAA6B;EAC3B,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CACA,gCAAgC;EAC9B,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CACA,4BAA4B;EAC1B,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CACA,mBAAmB;EAAE,QAAQ;EAAK,OAAO;EAAa,SAAS;CAAgB;AACjF;AAEA,SAAS,UAAU,SAAiB,cAA8B;CAMhE,OAAO,GAAG,UALI,aACX,MAAM,GAAG,CAAC,CACV,QAAQ,SAAS,KAAK,SAAS,CAAC,CAAC,CACjC,KAAK,SAAU,QAAQ,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,MAAO,CAAC,CAC9D,KAAK,EACgB;AAC1B;AAcA,SAAS,cAAc,SAA6B,QAAqB,UAA0B;CACjG,QAAQ,SAAR;EACE,KAAK;GACH,IAAI,OAAO,aAAa,eAAe,OAAO,aAAa,QACzD,OAAO;GAET,OAAO,OAAO,WAAW,WAAW,YAAY,OAAO,QAAQ,MAAM;EACvE,KAAK,aACH,OAAO,OAAO,WAAW,WACrB,OAAO,OAAO,OAAO,MAAM,IACzB,sBACA,oBAAoB,OAAO,QAAQ,eACrC,OAAO,WAAW,UAChB,sBAAsB,OAAO,QAAQ,GAAG,OAAO,OAAO,OAAO,MAAM,IAAI,SAAS,YAChF,WAAW,OAAO,cAAc,QAAQ,iBAAiB,WAAW,GAAG,OAAO;EACtF,KAAK,WACH,OAAO,OAAO,WAAW,WACrB,mBAAmB,OAAO,QAAQ,eAClC,OAAO,WAAW,UAChB,qBAAqB,OAAO,QAAQ,UACpC,WAAW,OAAO,cAAc,QAAQ,cAAc,UAAU,GAAG,OAAO;EAClF,KAAK,qBACH,OAAO,OAAO,OAAO,QAAQ,OAAO,KAAK,SAAS,IAAI,mBAAmB,mBAAmB,IAAI,OAAO,QAAQ,CAAC,EAAA,CAAG,KAAK,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI;EACvJ,KAAK,iBACH,OAAO,mBAAmB,OAAO,UAAU,CAAC,EAAA,CAAG,KAAK,UAAU,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;EAChG,KAAK,kBACH,OAAO,OAAO,SAAS,mBAAmB,OAAO,OAAO,QAAQ,MAAM,GAAG,MAAM;EACjF,KAAK,iBACH,OAAO;EACT,SACE,OAAO;CACX;AACF;AAEA,SAAS,YAAY,MAAsB;CACzC,OAAO,YAAY,KAAK,IAAI,IAAI,MAAM,SAAS,KAAK;AACtD;AAEA,SAAgB,cAAc,OAAqC;CACjE,IAAI,iBAAiB,eACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAa,SAAS,MAAM;CAAQ;CAEnE,IAAI,iBAAiB,mBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAiB,SAAS,MAAM;CAAQ;CAEvE,IAAI,iBAAiB,iBAAiB,iBAAiB,uBACrD,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAY,SAAS,MAAM;CAAQ;CAElE,IAAI,iBAAiB,kBAAkB,iBAAiB,kBACtD,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAa,SAAS,MAAM;CAAQ;CAEnE,IAAI,iBAAiB,mBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAgB,SAAS,MAAM;CAAQ;CAEtE,IAAI,iBAAiB,aACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAkB,SAAS,MAAM;CAAQ;CAExE,IAAI,iBAAiB,uBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAqB,SAAS,MAAM;CAAQ;CAE3E,IAAI,iBAAiB,yBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAuB,SAAS,MAAM;CAAQ;CAE7E,IAAI,iBAAiB,oBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAkB,SAAS,MAAM;CAAQ;CAExE,IAAI,iBAAiB,qBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAmB,SAAS,MAAM;CAAQ;CAEzE,IAAI,iBAAiB,qBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAmB,SAAS,MAAM;CAAQ;CAEzE,IAAI,iBAAiB,uBACnB,OAAO;EACL,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CAEF,IAAI,iBAAiB,6BACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAiB,SAAS,MAAM;CAAQ;CAEvE,IAAI,oCAAoC,KAAK,GAAG;EAC9C,MAAM,UAAW,MAAyC,qBAAqB;EAC/E,MAAM,SAAS,MAAM,WAAW,KAAK,WAAW;GAC9C,MAAM,UAAU,SAAS,MAAM,YAAY;GAC3C,SAAS,cACP,MAAM,SACL,MAAM,UAAU,CAAC,GAClB,MAAM,WAAW,YACnB;EACF,EAAE;EACF,MAAM,QAAQ,OAAO;EACrB,OAAO;GACL,QAAQ;GACR,OAAO;GACP,SAAS,QAAQ,GAAG,MAAM,KAAK,IAAI,MAAM,YAAY;GACrD;EACF;CACF;CACA,MAAM,MAAM;CACZ,IAAI,IAAI,QAAQ,YAAY,IAAI,OAC9B,OAAO,YAAY,IAAI;CAEzB,IAAI,OAAO,IAAI,eAAe,YAAY,IAAI,cAAc,OAAO,IAAI,aAAa,KAClF,OAAO;EACL,QAAQ,IAAI;EACZ,OAAO;EACP,SAAS;CACX;AAGJ"}
+{"version":3,"file":"errors.js","names":[],"sources":["../../src/http/errors.ts"],"sourcesContent":["import {\n  ConflictError,\n  ForbiddenError,\n  InvalidInputError,\n  NotFoundError,\n  UnavailableError,\n  ValidationError,\n} from '@headless-lms/core/shared/errors';\nimport { InviteError, OrganizationRuleError } from '@headless-lms/core/organizations';\nimport {\n  ActionInvocationError,\n  AlreadyConnectedError,\n  InvalidConfigError,\n  UnknownIntegrationError,\n} from '@headless-lms/core/integrations';\nimport {\n  AutomationKindMismatchError,\n  InvalidTriggerError,\n  ReservedActionError,\n} from '@headless-lms/core/automations';\nimport { hasZodFastifySchemaValidationErrors } from 'fastify-type-provider-zod';\nimport { NoActiveOrgError } from './scope.js';\nimport { UnauthorizedError } from './plugins/auth.js';\n\nexport type Refusal = {\n  status: number;\n  error: string;\n  message: string;\n  issues?: { path: string; message: string }[];\n  details?: Record<string, string>;\n};\n\nconst BODY_ERRORS: Record<string, Refusal> = {\n  FST_ERR_CTP_INVALID_JSON_BODY: {\n    status: 400,\n    error: 'invalid_body',\n    message: 'The request body must be valid JSON',\n  },\n  FST_ERR_CTP_EMPTY_JSON_BODY: {\n    status: 400,\n    error: 'invalid_body',\n    message: 'The request body must be valid JSON',\n  },\n  FST_ERR_CTP_INVALID_MEDIA_TYPE: {\n    status: 415,\n    error: 'unsupported_media_type',\n    message: 'Send the request body as application/json',\n  },\n  FST_ERR_CTP_BODY_TOO_LARGE: {\n    status: 413,\n    error: 'payload_too_large',\n    message: 'The request body is too large',\n  },\n  FST_ERR_NOT_FOUND: { status: 404, error: 'not_found', message: 'No such route' },\n};\n\nfunction issuePath(context: string, instancePath: string): string {\n  const inner = instancePath\n    .split('/')\n    .filter((part) => part.length > 0)\n    .map((part) => (/^\\d+$/.test(part) ? `[${part}]` : `.${part}`))\n    .join('');\n  return `${context}${inner}`;\n}\n\ntype IssueParams = {\n  expected?: string;\n  received?: string;\n  minimum?: number | bigint;\n  maximum?: number | bigint;\n  inclusive?: boolean;\n  origin?: string;\n  keys?: string[];\n  values?: unknown[];\n  format?: string;\n};\n\nfunction describeIssue(keyword: string | undefined, params: IssueParams, fallback: string): string {\n  switch (keyword) {\n    case 'invalid_type':\n      if (\n        params.received === 'undefined' ||\n        params.received === 'null' ||\n        /received (undefined|null)$/.test(fallback)\n      ) {\n        return 'is required';\n      }\n      return params.expected ? `must be ${withArticle(params.expected)}` : fallback;\n    case 'too_small':\n      return params.origin === 'string'\n        ? Number(params.minimum) === 1\n          ? 'must not be empty'\n          : `must be at least ${params.minimum} characters`\n        : params.origin === 'array'\n          ? `must have at least ${params.minimum} ${Number(params.minimum) === 1 ? 'item' : 'items'}`\n          : `must be ${params.inclusive === false ? 'greater than' : 'at least'} ${params.minimum}`;\n    case 'too_big':\n      return params.origin === 'string'\n        ? `must be at most ${params.maximum} characters`\n        : params.origin === 'array'\n          ? `must have at most ${params.maximum} items`\n          : `must be ${params.inclusive === false ? 'less than' : 'at most'} ${params.maximum}`;\n    case 'unrecognized_keys':\n      return `has ${params.keys && params.keys.length > 1 ? 'unknown fields' : 'an unknown field'} ${(params.keys ?? []).map((key) => `\"${key}\"`).join(', ')}`;\n    case 'invalid_value':\n      return `must be one of ${(params.values ?? []).map((value) => JSON.stringify(value)).join(', ')}`;\n    case 'invalid_format':\n      return params.format && params.format !== 'regex'\n        ? `must be a valid ${params.format.replace(/_/g, ' ')}`\n        : fallback;\n    case 'invalid_union':\n      return 'is not in an accepted shape';\n    default:\n      return fallback;\n  }\n}\n\nfunction withArticle(noun: string): string {\n  return /^[aeiou]/i.test(noun) ? `an ${noun}` : `a ${noun}`;\n}\n\nexport function classifyError(error: unknown): Refusal | undefined {\n  if (error instanceof NotFoundError) {\n    return { status: 404, error: 'not_found', message: error.message };\n  }\n  if (error instanceof InvalidInputError) {\n    return { status: 400, error: 'invalid_input', message: error.message };\n  }\n  if (error instanceof ValidationError) {\n    return {\n      status: 422,\n      error: 'unprocessable',\n      message: error.message,\n      issues: error.problems.map((problem) => ({\n        path: problem.path ? `body.${problem.path}` : 'body',\n        message: problem.message,\n      })),\n    };\n  }\n  if (error instanceof ConflictError) {\n    return { status: 409, error: error.code ?? 'conflict', message: error.message };\n  }\n  if (error instanceof OrganizationRuleError) {\n    return { status: 409, error: 'conflict', message: error.message };\n  }\n  if (error instanceof ForbiddenError || error instanceof NoActiveOrgError) {\n    return { status: 403, error: 'forbidden', message: error.message };\n  }\n  if (error instanceof UnavailableError) {\n    return {\n      status: 503,\n      error: 'unavailable',\n      message: error.message,\n      ...(error.details && { details: error.details }),\n    };\n  }\n  if (error instanceof UnauthorizedError) {\n    return { status: 401, error: 'unauthorized', message: error.message };\n  }\n  if (error instanceof InviteError) {\n    return { status: 400, error: 'invalid_invite', message: error.message };\n  }\n  if (error instanceof AlreadyConnectedError) {\n    return { status: 409, error: 'already_connected', message: error.message };\n  }\n  if (error instanceof UnknownIntegrationError) {\n    return { status: 400, error: 'unknown_integration', message: error.message };\n  }\n  if (error instanceof InvalidConfigError) {\n    return { status: 400, error: 'invalid_config', message: error.message };\n  }\n  if (error instanceof InvalidTriggerError) {\n    return { status: 400, error: 'invalid_trigger', message: error.message };\n  }\n  if (error instanceof ReservedActionError) {\n    return { status: 400, error: 'reserved_action', message: error.message };\n  }\n  if (error instanceof ActionInvocationError) {\n    return {\n      status: 502,\n      error: 'action_failed',\n      message: 'The integration did not respond as expected',\n    };\n  }\n  if (error instanceof AutomationKindMismatchError) {\n    return { status: 409, error: 'kind_mismatch', message: error.message };\n  }\n  if (hasZodFastifySchemaValidationErrors(error)) {\n    const context = (error as { validationContext?: string }).validationContext ?? 'request';\n    const issues = error.validation.map((issue) => ({\n      path: issuePath(context, issue.instancePath),\n      message: describeIssue(\n        issue.keyword,\n        (issue.params ?? {}) as IssueParams,\n        issue.message ?? 'is invalid',\n      ),\n    }));\n    const first = issues[0];\n    return {\n      status: 400,\n      error: 'validation',\n      message: first ? `${first.path}: ${first.message}` : 'The request is invalid',\n      issues,\n    };\n  }\n  const err = error as { statusCode?: number; code?: string };\n  if (err.code && BODY_ERRORS[err.code]) {\n    return BODY_ERRORS[err.code];\n  }\n  if (typeof err.statusCode === 'number' && err.statusCode >= 400 && err.statusCode < 500) {\n    return {\n      status: err.statusCode,\n      error: 'bad_request',\n      message: 'The request could not be processed',\n    };\n  }\n  return undefined;\n}\n"],"mappings":";;;;;;;;AAgCA,MAAM,cAAuC;CAC3C,+BAA+B;EAC7B,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CACA,6BAA6B;EAC3B,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CACA,gCAAgC;EAC9B,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CACA,4BAA4B;EAC1B,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CACA,mBAAmB;EAAE,QAAQ;EAAK,OAAO;EAAa,SAAS;CAAgB;AACjF;AAEA,SAAS,UAAU,SAAiB,cAA8B;CAMhE,OAAO,GAAG,UALI,aACX,MAAM,GAAG,CAAC,CACV,QAAQ,SAAS,KAAK,SAAS,CAAC,CAAC,CACjC,KAAK,SAAU,QAAQ,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,MAAO,CAAC,CAC9D,KAAK,EACgB;AAC1B;AAcA,SAAS,cAAc,SAA6B,QAAqB,UAA0B;CACjG,QAAQ,SAAR;EACE,KAAK;GACH,IACE,OAAO,aAAa,eACpB,OAAO,aAAa,UACpB,6BAA6B,KAAK,QAAQ,GAE1C,OAAO;GAET,OAAO,OAAO,WAAW,WAAW,YAAY,OAAO,QAAQ,MAAM;EACvE,KAAK,aACH,OAAO,OAAO,WAAW,WACrB,OAAO,OAAO,OAAO,MAAM,IACzB,sBACA,oBAAoB,OAAO,QAAQ,eACrC,OAAO,WAAW,UAChB,sBAAsB,OAAO,QAAQ,GAAG,OAAO,OAAO,OAAO,MAAM,IAAI,SAAS,YAChF,WAAW,OAAO,cAAc,QAAQ,iBAAiB,WAAW,GAAG,OAAO;EACtF,KAAK,WACH,OAAO,OAAO,WAAW,WACrB,mBAAmB,OAAO,QAAQ,eAClC,OAAO,WAAW,UAChB,qBAAqB,OAAO,QAAQ,UACpC,WAAW,OAAO,cAAc,QAAQ,cAAc,UAAU,GAAG,OAAO;EAClF,KAAK,qBACH,OAAO,OAAO,OAAO,QAAQ,OAAO,KAAK,SAAS,IAAI,mBAAmB,mBAAmB,IAAI,OAAO,QAAQ,CAAC,EAAA,CAAG,KAAK,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI;EACvJ,KAAK,iBACH,OAAO,mBAAmB,OAAO,UAAU,CAAC,EAAA,CAAG,KAAK,UAAU,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;EAChG,KAAK,kBACH,OAAO,OAAO,UAAU,OAAO,WAAW,UACtC,mBAAmB,OAAO,OAAO,QAAQ,MAAM,GAAG,MAClD;EACN,KAAK,iBACH,OAAO;EACT,SACE,OAAO;CACX;AACF;AAEA,SAAS,YAAY,MAAsB;CACzC,OAAO,YAAY,KAAK,IAAI,IAAI,MAAM,SAAS,KAAK;AACtD;AAEA,SAAgB,cAAc,OAAqC;CACjE,IAAI,iBAAiB,eACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAa,SAAS,MAAM;CAAQ;CAEnE,IAAI,iBAAiB,mBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAiB,SAAS,MAAM;CAAQ;CAEvE,IAAI,iBAAiB,iBACnB,OAAO;EACL,QAAQ;EACR,OAAO;EACP,SAAS,MAAM;EACf,QAAQ,MAAM,SAAS,KAAK,aAAa;GACvC,MAAM,QAAQ,OAAO,QAAQ,QAAQ,SAAS;GAC9C,SAAS,QAAQ;EACnB,EAAE;CACJ;CAEF,IAAI,iBAAiB,eACnB,OAAO;EAAE,QAAQ;EAAK,OAAO,MAAM,QAAQ;EAAY,SAAS,MAAM;CAAQ;CAEhF,IAAI,iBAAiB,uBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAY,SAAS,MAAM;CAAQ;CAElE,IAAI,iBAAiB,kBAAkB,iBAAiB,kBACtD,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAa,SAAS,MAAM;CAAQ;CAEnE,IAAI,iBAAiB,kBACnB,OAAO;EACL,QAAQ;EACR,OAAO;EACP,SAAS,MAAM;EACf,GAAI,MAAM,WAAW,EAAE,SAAS,MAAM,QAAQ;CAChD;CAEF,IAAI,iBAAiB,mBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAgB,SAAS,MAAM;CAAQ;CAEtE,IAAI,iBAAiB,aACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAkB,SAAS,MAAM;CAAQ;CAExE,IAAI,iBAAiB,uBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAqB,SAAS,MAAM;CAAQ;CAE3E,IAAI,iBAAiB,yBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAuB,SAAS,MAAM;CAAQ;CAE7E,IAAI,iBAAiB,oBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAkB,SAAS,MAAM;CAAQ;CAExE,IAAI,iBAAiB,qBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAmB,SAAS,MAAM;CAAQ;CAEzE,IAAI,iBAAiB,qBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAmB,SAAS,MAAM;CAAQ;CAEzE,IAAI,iBAAiB,uBACnB,OAAO;EACL,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CAEF,IAAI,iBAAiB,6BACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAiB,SAAS,MAAM;CAAQ;CAEvE,IAAI,oCAAoC,KAAK,GAAG;EAC9C,MAAM,UAAW,MAAyC,qBAAqB;EAC/E,MAAM,SAAS,MAAM,WAAW,KAAK,WAAW;GAC9C,MAAM,UAAU,SAAS,MAAM,YAAY;GAC3C,SAAS,cACP,MAAM,SACL,MAAM,UAAU,CAAC,GAClB,MAAM,WAAW,YACnB;EACF,EAAE;EACF,MAAM,QAAQ,OAAO;EACrB,OAAO;GACL,QAAQ;GACR,OAAO;GACP,SAAS,QAAQ,GAAG,MAAM,KAAK,IAAI,MAAM,YAAY;GACrD;EACF;CACF;CACA,MAAM,MAAM;CACZ,IAAI,IAAI,QAAQ,YAAY,IAAI,OAC9B,OAAO,YAAY,IAAI;CAEzB,IAAI,OAAO,IAAI,eAAe,YAAY,IAAI,cAAc,OAAO,IAAI,aAAa,KAClF,OAAO;EACL,QAAQ,IAAI;EACZ,OAAO;EACP,SAAS;CACX;AAGJ"}

package/dist/http/fastify.d.ts

@@ -1,3 +1,4 @@
+import { ResolvedCaller } from "@headless-lms/core/organizations";
 import "fastify";
 import { User } from "@headless-lms/core/types";
 //#region src/http/fastify.d.ts
@@ -5,6 +6,10 @@ import { User } from "@headless-lms/core/types";
  *  package entry point so this module — and its augmentation — gets loaded. */
 type AuthUser = User;
 declare module 'fastify' {
+  interface FastifyContextConfig {
+    /** A server-sent event stream; shutdown waits for it to finish. */
+    eventStream?: boolean;
+  }
   interface FastifyInstance {
     /** Session guard. Populates `authUser` (and `orgId` when the session has an
      *  active org), or throws `UnauthorizedError`. Use for the routes reached
@@ -12,9 +17,11 @@ declare module 'fastify' {
     requireSession(request: FastifyRequest): Promise<void>;
     /** As `requireSession`, but also requires an active org on the session. */
     requireOrgSession(request: FastifyRequest): Promise<void>;
+    requirePlatform(request: FastifyRequest): Promise<void>;
   }
   interface FastifyRequest {
     authUser: User;
+    authUserId: string;
     /** Domain `organizations.id` for the session's active org — what every
      *  domain read keys off. Guaranteed set by `requireOrgSession`; absent under
      *  `requireSession` when the session has no active org. */
@@ -28,6 +35,7 @@ declare module 'fastify' {
      *  and every other domain row references. Not `authUser.id`: the two match
      *  only for a self-signup, never for a person an admin provisioned first. */
     userId: string;
+    resolvedCaller?: ResolvedCaller;
   }
 }
 //#endregion

package/dist/http/mcp/catalogue.d.ts

@@ -1,5 +1,5 @@
 import { ToolKind } from "./tool.js";
-import { AccessScope, StaffRole } from "@headless-lms/core/organizations";
+import { Level, Permission } from "@headless-lms/core/types";
 //#region src/http/mcp/catalogue.d.ts
 interface CatalogueField {
   name: string;
@@ -11,27 +11,29 @@ interface CatalogueTool {
   name: string;
   title: string;
   description: string;
-  resource: string;
-  scope: AccessScope;
+  group: string;
   kind: ToolKind;
   idempotent: boolean;
   openWorld: boolean;
   fields: CatalogueField[];
 }
-interface CatalogueScope {
-  scope: AccessScope;
+interface CataloguePermission {
+  permission: Permission;
   resource: string;
   action: string;
-  permission: string | null;
-  roles: StaffRole[];
+  label: string;
+  description: string;
+  about: Level;
+  implies: Permission[];
+  roles: string[];
   removes: boolean;
 }
 interface McpCatalogue {
   instructions: string;
-  scopes: CatalogueScope[];
+  permissions: CataloguePermission[];
   tools: CatalogueTool[];
 }
 declare function mcpCatalogue(): McpCatalogue;
 //#endregion
-export { CatalogueField, CatalogueScope, CatalogueTool, McpCatalogue, mcpCatalogue };
+export { CatalogueField, CataloguePermission, CatalogueTool, McpCatalogue, mcpCatalogue };
 //# sourceMappingURL=catalogue.d.ts.map

package/dist/http/mcp/catalogue.js

@@ -1,7 +1,7 @@
 import { toolInputSchema } from "./input-schema.js";
 import { MCP_INSTRUCTIONS } from "./server.js";
-import { TOOLS } from "./tools/index.js";
-import { ACCESS_SCOPES, SCOPE_PERMISSION, STAFF_ROLES, isDeleteScope, roleHoldsScope } from "@headless-lms/core/organizations";
+import { TOOL_GROUPS } from "./tools/index.js";
+import { ALL_PERMISSIONS, PERMISSIONS, defaultHolders, withImplied } from "@headless-lms/core/organizations";
 //#region src/http/mcp/catalogue.ts
 function typeOf(schema) {
 	const variants = schema.anyOf ?? schema.oneOf;
@@ -27,40 +27,34 @@ function fieldsOf(tool) {
 	}));
 	return [...fields.filter((field) => field.required), ...fields.filter((field) => !field.required)];
 }
-const REMOVING_WRITE_SCOPES = [
-	"downloads:write",
-	"bundles:write",
-	"access:write",
-	"comments:moderate",
-	"communities:write",
-	"community_members:write",
-	"community_moderation:write"
-];
 function mcpCatalogue() {
 	return {
 		instructions: MCP_INSTRUCTIONS,
-		scopes: ACCESS_SCOPES.map((scope) => {
-			const [resource = scope, action = ""] = scope.split(":");
+		permissions: ALL_PERMISSIONS.map((permission) => {
+			const [resource = permission, action = ""] = permission.split(":");
+			const definition = PERMISSIONS[permission];
 			return {
-				scope,
+				permission,
 				resource,
 				action,
-				permission: SCOPE_PERMISSION[scope],
-				roles: STAFF_ROLES.filter((role) => roleHoldsScope(role, scope)),
-				removes: isDeleteScope(scope) || REMOVING_WRITE_SCOPES.includes(scope)
+				label: definition.label,
+				description: definition.description,
+				about: definition.about,
+				implies: [...withImplied([permission])].filter((p) => p !== permission),
+				roles: defaultHolders(permission),
+				removes: action === "delete"
 			};
 		}),
-		tools: TOOLS.map((tool) => ({
+		tools: TOOL_GROUPS.flatMap(({ title: group, tools }) => tools.map((tool) => ({
 			name: tool.name,
 			title: tool.title,
 			description: tool.description,
-			resource: tool.scope.split(":")[0] ?? tool.scope,
-			scope: tool.scope,
+			group,
 			kind: tool.kind,
 			idempotent: tool.idempotent,
 			openWorld: tool.openWorld,
 			fields: fieldsOf(tool)
-		}))
+		})))
 	};
 }
 //#endregion

package/dist/http/mcp/catalogue.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalogue.js","names":[],"sources":["../../../src/http/mcp/catalogue.ts"],"sourcesContent":["import {\n  ACCESS_SCOPES,\n  SCOPE_PERMISSION,\n  STAFF_ROLES,\n  isDeleteScope,\n  roleHoldsScope,\n  type AccessScope,\n  type StaffRole,\n} from '@headless-lms/core/organizations';\nimport { toolInputSchema } from './input-schema.js';\nimport { MCP_INSTRUCTIONS } from './server.js';\nimport type { ToolKind } from './tool.js';\nimport { TOOLS } from './tools/index.js';\n\nexport interface CatalogueField {\n  name: string;\n  type: string;\n  required: boolean;\n  description: string | null;\n}\n\nexport interface CatalogueTool {\n  name: string;\n  title: string;\n  description: string;\n  resource: string;\n  scope: AccessScope;\n  kind: ToolKind;\n  idempotent: boolean;\n  openWorld: boolean;\n  fields: CatalogueField[];\n}\n\nexport interface CatalogueScope {\n  scope: AccessScope;\n  resource: string;\n  action: string;\n  permission: string | null;\n  roles: StaffRole[];\n  removes: boolean;\n}\n\nexport interface McpCatalogue {\n  instructions: string;\n  scopes: CatalogueScope[];\n  tools: CatalogueTool[];\n}\n\ntype JsonSchema = {\n  type?: string | string[];\n  format?: string;\n  enum?: unknown[];\n  const?: unknown;\n  items?: JsonSchema;\n  anyOf?: JsonSchema[];\n  oneOf?: JsonSchema[];\n  description?: string;\n  properties?: Record<string, JsonSchema>;\n  required?: string[];\n};\n\nfunction typeOf(schema: JsonSchema): string {\n  const variants = schema.anyOf ?? schema.oneOf;\n  if (variants) {\n    return [...new Set(variants.map(typeOf))].join(' | ');\n  }\n  if (schema.enum) {\n    return schema.enum.map((value) => JSON.stringify(value)).join(' | ');\n  }\n  if (schema.const !== undefined) {\n    return JSON.stringify(schema.const);\n  }\n  if (schema.type === 'array') {\n    return `${schema.items ? typeOf(schema.items) : 'unknown'}[]`;\n  }\n  if (schema.format === 'date-time') {\n    return 'date-time';\n  }\n  if (Array.isArray(schema.type)) {\n    return schema.type.join(' | ');\n  }\n  return schema.type ?? 'unknown';\n}\n\nfunction descriptionOf(schema: JsonSchema): string | null {\n  return (\n    schema.description ??\n    (schema.anyOf ?? schema.oneOf)?.find((variant) => variant.description)?.description ??\n    null\n  );\n}\n\nfunction fieldsOf(tool: (typeof TOOLS)[number]): CatalogueField[] {\n  const json = toolInputSchema(tool.input)['~standard'].jsonSchema.input({\n    target: 'draft-2020-12',\n  }) as JsonSchema;\n  const required = new Set(json.required ?? []);\n  const fields = Object.entries(json.properties ?? {}).map(([name, schema]) => ({\n    name,\n    type: typeOf(schema),\n    required: required.has(name),\n    description: descriptionOf(schema),\n  }));\n  return [\n    ...fields.filter((field) => field.required),\n    ...fields.filter((field) => !field.required),\n  ];\n}\n\nconst REMOVING_WRITE_SCOPES: readonly AccessScope[] = [\n  'downloads:write',\n  'bundles:write',\n  'access:write',\n  'comments:moderate',\n  'communities:write',\n  'community_members:write',\n  'community_moderation:write',\n];\n\nexport function mcpCatalogue(): McpCatalogue {\n  return {\n    instructions: MCP_INSTRUCTIONS,\n    scopes: ACCESS_SCOPES.map((scope) => {\n      const [resource = scope, action = ''] = scope.split(':');\n      return {\n        scope,\n        resource,\n        action,\n        permission: SCOPE_PERMISSION[scope],\n        roles: STAFF_ROLES.filter((role) => roleHoldsScope(role, scope)),\n        removes: isDeleteScope(scope) || REMOVING_WRITE_SCOPES.includes(scope),\n      };\n    }),\n    tools: TOOLS.map((tool) => ({\n      name: tool.name,\n      title: tool.title,\n      description: tool.description,\n      resource: tool.scope.split(':')[0] ?? tool.scope,\n      scope: tool.scope,\n      kind: tool.kind,\n      idempotent: tool.idempotent,\n      openWorld: tool.openWorld,\n      fields: fieldsOf(tool),\n    })),\n  };\n}\n"],"mappings":";;;;;AA6DA,SAAS,OAAO,QAA4B;CAC1C,MAAM,WAAW,OAAO,SAAS,OAAO;CACxC,IAAI,UACF,OAAO,CAAC,GAAG,IAAI,IAAI,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK;CAEtD,IAAI,OAAO,MACT,OAAO,OAAO,KAAK,KAAK,UAAU,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;CAErE,IAAI,OAAO,UAAU,KAAA,GACnB,OAAO,KAAK,UAAU,OAAO,KAAK;CAEpC,IAAI,OAAO,SAAS,SAClB,OAAO,GAAG,OAAO,QAAQ,OAAO,OAAO,KAAK,IAAI,UAAU;CAE5D,IAAI,OAAO,WAAW,aACpB,OAAO;CAET,IAAI,MAAM,QAAQ,OAAO,IAAI,GAC3B,OAAO,OAAO,KAAK,KAAK,KAAK;CAE/B,OAAO,OAAO,QAAQ;AACxB;AAEA,SAAS,cAAc,QAAmC;CACxD,OACE,OAAO,gBACN,OAAO,SAAS,OAAO,MAAA,EAAQ,MAAM,YAAY,QAAQ,WAAW,CAAC,EAAE,eACxE;AAEJ;AAEA,SAAS,SAAS,MAAgD;CAChE,MAAM,OAAO,gBAAgB,KAAK,KAAK,CAAC,CAAC,YAAY,CAAC,WAAW,MAAM,EACrE,QAAQ,gBACV,CAAC;CACD,MAAM,WAAW,IAAI,IAAI,KAAK,YAAY,CAAC,CAAC;CAC5C,MAAM,SAAS,OAAO,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,aAAa;EAC5E;EACA,MAAM,OAAO,MAAM;EACnB,UAAU,SAAS,IAAI,IAAI;EAC3B,aAAa,cAAc,MAAM;CACnC,EAAE;CACF,OAAO,CACL,GAAG,OAAO,QAAQ,UAAU,MAAM,QAAQ,GAC1C,GAAG,OAAO,QAAQ,UAAU,CAAC,MAAM,QAAQ,CAC7C;AACF;AAEA,MAAM,wBAAgD;CACpD;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAgB,eAA6B;CAC3C,OAAO;EACL,cAAc;EACd,QAAQ,cAAc,KAAK,UAAU;GACnC,MAAM,CAAC,WAAW,OAAO,SAAS,MAAM,MAAM,MAAM,GAAG;GACvD,OAAO;IACL;IACA;IACA;IACA,YAAY,iBAAiB;IAC7B,OAAO,YAAY,QAAQ,SAAS,eAAe,MAAM,KAAK,CAAC;IAC/D,SAAS,cAAc,KAAK,KAAK,sBAAsB,SAAS,KAAK;GACvE;EACF,CAAC;EACD,OAAO,MAAM,KAAK,UAAU;GAC1B,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,aAAa,KAAK;GAClB,UAAU,KAAK,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK;GAC3C,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,WAAW,KAAK;GAChB,QAAQ,SAAS,IAAI;EACvB,EAAE;CACJ;AACF"}
+{"version":3,"file":"catalogue.js","names":[],"sources":["../../../src/http/mcp/catalogue.ts"],"sourcesContent":["import {\n  ALL_PERMISSIONS,\n  defaultHolders,\n  PERMISSIONS,\n  withImplied,\n} from '@headless-lms/core/organizations';\nimport type { Level, Permission } from '@headless-lms/core/types';\nimport { toolInputSchema } from './input-schema.js';\nimport { MCP_INSTRUCTIONS } from './server.js';\nimport type { Tool, ToolKind } from './tool.js';\nimport { TOOL_GROUPS } from './tools/index.js';\n\nexport interface CatalogueField {\n  name: string;\n  type: string;\n  required: boolean;\n  description: string | null;\n}\n\nexport interface CatalogueTool {\n  name: string;\n  title: string;\n  description: string;\n  group: string;\n  kind: ToolKind;\n  idempotent: boolean;\n  openWorld: boolean;\n  fields: CatalogueField[];\n}\n\nexport interface CataloguePermission {\n  permission: Permission;\n  resource: string;\n  action: string;\n  label: string;\n  description: string;\n  about: Level;\n  implies: Permission[];\n  roles: string[];\n  removes: boolean;\n}\n\nexport interface McpCatalogue {\n  instructions: string;\n  permissions: CataloguePermission[];\n  tools: CatalogueTool[];\n}\n\ntype JsonSchema = {\n  type?: string | string[];\n  format?: string;\n  enum?: unknown[];\n  const?: unknown;\n  items?: JsonSchema;\n  anyOf?: JsonSchema[];\n  oneOf?: JsonSchema[];\n  description?: string;\n  properties?: Record<string, JsonSchema>;\n  required?: string[];\n};\n\nfunction typeOf(schema: JsonSchema): string {\n  const variants = schema.anyOf ?? schema.oneOf;\n  if (variants) {\n    return [...new Set(variants.map(typeOf))].join(' | ');\n  }\n  if (schema.enum) {\n    return schema.enum.map((value) => JSON.stringify(value)).join(' | ');\n  }\n  if (schema.const !== undefined) {\n    return JSON.stringify(schema.const);\n  }\n  if (schema.type === 'array') {\n    return `${schema.items ? typeOf(schema.items) : 'unknown'}[]`;\n  }\n  if (schema.format === 'date-time') {\n    return 'date-time';\n  }\n  if (Array.isArray(schema.type)) {\n    return schema.type.join(' | ');\n  }\n  return schema.type ?? 'unknown';\n}\n\nfunction descriptionOf(schema: JsonSchema): string | null {\n  return (\n    schema.description ??\n    (schema.anyOf ?? schema.oneOf)?.find((variant) => variant.description)?.description ??\n    null\n  );\n}\n\nfunction fieldsOf(tool: Tool): CatalogueField[] {\n  const json = toolInputSchema(tool.input)['~standard'].jsonSchema.input({\n    target: 'draft-2020-12',\n  }) as JsonSchema;\n  const required = new Set(json.required ?? []);\n  const fields = Object.entries(json.properties ?? {}).map(([name, schema]) => ({\n    name,\n    type: typeOf(schema),\n    required: required.has(name),\n    description: descriptionOf(schema),\n  }));\n  return [\n    ...fields.filter((field) => field.required),\n    ...fields.filter((field) => !field.required),\n  ];\n}\n\nexport function mcpCatalogue(): McpCatalogue {\n  return {\n    instructions: MCP_INSTRUCTIONS,\n    permissions: ALL_PERMISSIONS.map((permission) => {\n      const [resource = permission, action = ''] = permission.split(':');\n      const definition = PERMISSIONS[permission];\n      return {\n        permission,\n        resource,\n        action,\n        label: definition.label,\n        description: definition.description,\n        about: definition.about,\n        implies: [...withImplied([permission])].filter((p) => p !== permission),\n        roles: defaultHolders(permission),\n        removes: action === 'delete',\n      };\n    }),\n    tools: TOOL_GROUPS.flatMap(({ title: group, tools }) =>\n      tools.map((tool) => ({\n        name: tool.name,\n        title: tool.title,\n        description: tool.description,\n        group,\n        kind: tool.kind,\n        idempotent: tool.idempotent,\n        openWorld: tool.openWorld,\n        fields: fieldsOf(tool),\n      })),\n    ),\n  };\n}\n"],"mappings":";;;;;AA6DA,SAAS,OAAO,QAA4B;CAC1C,MAAM,WAAW,OAAO,SAAS,OAAO;CACxC,IAAI,UACF,OAAO,CAAC,GAAG,IAAI,IAAI,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK;CAEtD,IAAI,OAAO,MACT,OAAO,OAAO,KAAK,KAAK,UAAU,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;CAErE,IAAI,OAAO,UAAU,KAAA,GACnB,OAAO,KAAK,UAAU,OAAO,KAAK;CAEpC,IAAI,OAAO,SAAS,SAClB,OAAO,GAAG,OAAO,QAAQ,OAAO,OAAO,KAAK,IAAI,UAAU;CAE5D,IAAI,OAAO,WAAW,aACpB,OAAO;CAET,IAAI,MAAM,QAAQ,OAAO,IAAI,GAC3B,OAAO,OAAO,KAAK,KAAK,KAAK;CAE/B,OAAO,OAAO,QAAQ;AACxB;AAEA,SAAS,cAAc,QAAmC;CACxD,OACE,OAAO,gBACN,OAAO,SAAS,OAAO,MAAA,EAAQ,MAAM,YAAY,QAAQ,WAAW,CAAC,EAAE,eACxE;AAEJ;AAEA,SAAS,SAAS,MAA8B;CAC9C,MAAM,OAAO,gBAAgB,KAAK,KAAK,CAAC,CAAC,YAAY,CAAC,WAAW,MAAM,EACrE,QAAQ,gBACV,CAAC;CACD,MAAM,WAAW,IAAI,IAAI,KAAK,YAAY,CAAC,CAAC;CAC5C,MAAM,SAAS,OAAO,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,aAAa;EAC5E;EACA,MAAM,OAAO,MAAM;EACnB,UAAU,SAAS,IAAI,IAAI;EAC3B,aAAa,cAAc,MAAM;CACnC,EAAE;CACF,OAAO,CACL,GAAG,OAAO,QAAQ,UAAU,MAAM,QAAQ,GAC1C,GAAG,OAAO,QAAQ,UAAU,CAAC,MAAM,QAAQ,CAC7C;AACF;AAEA,SAAgB,eAA6B;CAC3C,OAAO;EACL,cAAc;EACd,aAAa,gBAAgB,KAAK,eAAe;GAC/C,MAAM,CAAC,WAAW,YAAY,SAAS,MAAM,WAAW,MAAM,GAAG;GACjE,MAAM,aAAa,YAAY;GAC/B,OAAO;IACL;IACA;IACA;IACA,OAAO,WAAW;IAClB,aAAa,WAAW;IACxB,OAAO,WAAW;IAClB,SAAS,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,MAAM,MAAM,UAAU;IACtE,OAAO,eAAe,UAAU;IAChC,SAAS,WAAW;GACtB;EACF,CAAC;EACD,OAAO,YAAY,SAAS,EAAE,OAAO,OAAO,YAC1C,MAAM,KAAK,UAAU;GACnB,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,aAAa,KAAK;GAClB;GACA,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,WAAW,KAAK;GAChB,QAAQ,SAAS,IAAI;EACvB,EAAE,CACJ;CACF;AACF"}

package/dist/http/mcp/challenge.js

@@ -1,4 +1,4 @@
-import { ACCESS_SCOPES } from "@headless-lms/core/organizations";
+import { ALL_PERMISSIONS } from "@headless-lms/core/organizations";
 //#region src/http/mcp/challenge.ts
 function unauthorized(mcp) {
 	return new Response(JSON.stringify({
@@ -12,7 +12,7 @@ function unauthorized(mcp) {
 		status: 401,
 		headers: {
 			"content-type": "application/json",
-			"www-authenticate": `Bearer resource_metadata="${mcp.resourceMetadataUrl}", scope="${ACCESS_SCOPES.join(" ")}"`
+			"www-authenticate": `Bearer resource_metadata="${mcp.resourceMetadataUrl}", scope="${ALL_PERMISSIONS.join(" ")}"`
 		}
 	});
 }
@@ -21,7 +21,7 @@ function forbidden() {
 		jsonrpc: "2.0",
 		error: {
 			code: -32e3,
-			message: "Only staff of this organization can use this server"
+			message: "Only active members of this organization can use this server"
 		},
 		id: null
 	}), {

package/dist/http/mcp/challenge.js.map

@@ -1 +1 @@
-{"version":3,"file":"challenge.js","names":[],"sources":["../../../src/http/mcp/challenge.ts"],"sourcesContent":["import { ACCESS_SCOPES } from '@headless-lms/core/organizations';\nimport type { McpEndpoints } from '../../app/mcp-endpoints.js';\n\nexport function unauthorized(mcp: McpEndpoints): Response {\n  const body = { jsonrpc: '2.0', error: { code: -32000, message: 'Unauthorized' }, id: null };\n  return new Response(JSON.stringify(body), {\n    status: 401,\n    headers: {\n      'content-type': 'application/json',\n      'www-authenticate': `Bearer resource_metadata=\"${mcp.resourceMetadataUrl}\", scope=\"${ACCESS_SCOPES.join(' ')}\"`,\n    },\n  });\n}\n\nexport function forbidden(): Response {\n  const body = {\n    jsonrpc: '2.0',\n    error: { code: -32000, message: 'Only staff of this organization can use this server' },\n    id: null,\n  };\n  return new Response(JSON.stringify(body), {\n    status: 403,\n    headers: { 'content-type': 'application/json' },\n  });\n}\n"],"mappings":";;AAGA,SAAgB,aAAa,KAA6B;CAExD,OAAO,IAAI,SAAS,KAAK,UAAU;EADpB,SAAS;EAAO,OAAO;GAAE,MAAM;GAAQ,SAAS;EAAe;EAAG,IAAI;CAC/C,CAAC,GAAG;EACxC,QAAQ;EACR,SAAS;GACP,gBAAgB;GAChB,oBAAoB,6BAA6B,IAAI,oBAAoB,YAAY,cAAc,KAAK,GAAG,EAAE;EAC/G;CACF,CAAC;AACH;AAEA,SAAgB,YAAsB;CAMpC,OAAO,IAAI,SAAS,KAAK,UAAU;EAJjC,SAAS;EACT,OAAO;GAAE,MAAM;GAAQ,SAAS;EAAsD;EACtF,IAAI;CAEgC,CAAC,GAAG;EACxC,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;AACH"}
+{"version":3,"file":"challenge.js","names":[],"sources":["../../../src/http/mcp/challenge.ts"],"sourcesContent":["import { ALL_PERMISSIONS } from '@headless-lms/core/organizations';\nimport type { McpEndpoints } from '../../app/mcp-endpoints.js';\n\nexport function unauthorized(mcp: McpEndpoints): Response {\n  const body = { jsonrpc: '2.0', error: { code: -32000, message: 'Unauthorized' }, id: null };\n  return new Response(JSON.stringify(body), {\n    status: 401,\n    headers: {\n      'content-type': 'application/json',\n      'www-authenticate': `Bearer resource_metadata=\"${mcp.resourceMetadataUrl}\", scope=\"${ALL_PERMISSIONS.join(' ')}\"`,\n    },\n  });\n}\n\nexport function forbidden(): Response {\n  const body = {\n    jsonrpc: '2.0',\n    error: {\n      code: -32000,\n      message: 'Only active members of this organization can use this server',\n    },\n    id: null,\n  };\n  return new Response(JSON.stringify(body), {\n    status: 403,\n    headers: { 'content-type': 'application/json' },\n  });\n}\n"],"mappings":";;AAGA,SAAgB,aAAa,KAA6B;CAExD,OAAO,IAAI,SAAS,KAAK,UAAU;EADpB,SAAS;EAAO,OAAO;GAAE,MAAM;GAAQ,SAAS;EAAe;EAAG,IAAI;CAC/C,CAAC,GAAG;EACxC,QAAQ;EACR,SAAS;GACP,gBAAgB;GAChB,oBAAoB,6BAA6B,IAAI,oBAAoB,YAAY,gBAAgB,KAAK,GAAG,EAAE;EACjH;CACF,CAAC;AACH;AAEA,SAAgB,YAAsB;CASpC,OAAO,IAAI,SAAS,KAAK,UAAU;EAPjC,SAAS;EACT,OAAO;GACL,MAAM;GACN,SAAS;EACX;EACA,IAAI;CAEgC,CAAC,GAAG;EACxC,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;AACH"}

package/dist/http/mcp/route.js

@@ -1,8 +1,8 @@
-import { NoActiveOrgError, resolveScopeFor } from "../scope.js";
+import { NoActiveOrgError, resolveCallerFor } from "../scope.js";
 import { forbidden, unauthorized } from "./challenge.js";
 import { createToolServer } from "./server.js";
 import { TOOLS } from "./tools/index.js";
-import { roleHoldsScope } from "@headless-lms/core/organizations";
+import { isPermission } from "@headless-lms/core/organizations";
 import { createMcpHandler } from "@modelcontextprotocol/server";
 import { toWebRequest } from "@modelcontextprotocol/node";
 //#region src/http/mcp/route.ts
@@ -29,9 +29,9 @@ function registerMcp(app, container, tools = TOOLS) {
 			headers: request.headers
 		});
 		if (!grant) return reply.send(unauthorized(container.mcp));
-		let scope;
+		let caller;
 		try {
-			scope = await resolveScopeFor(container, grant.userId, grant.orgId);
+			caller = await resolveCallerFor(container, grant.userId, grant.orgId, "roleKey" in grant.limit ? grant.limit : { scopes: grant.limit.scopes.filter(isPermission) });
 		} catch (error) {
 			if (error instanceof NoActiveOrgError) return reply.send(forbidden());
 			throw error;
@@ -39,16 +39,16 @@ function registerMcp(app, container, tools = TOOLS) {
 		const connection = {
 			context: {
 				container,
-				scope,
+				caller,
 				requestId: request.id
 			},
-			tools: tools.filter((tool) => grant.scopes.includes(tool.scope) && roleHoldsScope(scope.role, tool.scope))
+			tools
 		};
 		const response = await handler.fetch(await webRequest(request, reply), {
 			authInfo: {
 				token: "",
 				clientId: grant.clientId,
-				scopes: grant.scopes,
+				scopes: "scopes" in grant.limit ? grant.limit.scopes : [],
 				extra: { connection }
 			},
 			parsedBody: request.body

package/dist/http/mcp/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","names":[],"sources":["../../../src/http/mcp/route.ts"],"sourcesContent":["import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';\nimport { createMcpHandler } from '@modelcontextprotocol/server';\nimport { toWebRequest } from '@modelcontextprotocol/node';\nimport { roleHoldsScope } from '@headless-lms/core/organizations';\nimport type { Container } from '../../app/container.js';\nimport { NoActiveOrgError, resolveScopeFor, type OrgScope } from '../scope.js';\nimport { forbidden, unauthorized } from './challenge.js';\nimport { createToolServer } from './server.js';\nimport type { Tool, ToolContext } from './tool.js';\nimport { TOOLS } from './tools/index.js';\n\ntype Connection = { context: ToolContext; tools: Tool[] };\n\nexport function registerMcp(\n  app: FastifyInstance,\n  container: Container,\n  tools: readonly Tool[] = TOOLS,\n): void {\n  const handler = createMcpHandler(\n    (ctx) => {\n      const connection = ctx.authInfo?.extra?.connection as Connection | undefined;\n      if (!connection) {\n        throw new Error('mcp connection missing');\n      }\n      return createToolServer(connection.context, connection.tools);\n    },\n    {\n      legacy: 'stateless',\n      onerror: (err) => container.logger.error('mcp handler error', { err }),\n    },\n  );\n\n  const webRequest = async (request: FastifyRequest, reply: FastifyReply) => {\n    const abort = new AbortController();\n    reply.raw.on('close', () => {\n      if (!reply.raw.writableFinished) {\n        abort.abort();\n      }\n    });\n    return toWebRequest(request.raw, request.body, { signal: abort.signal });\n  };\n\n  app.post('/mcp', { schema: { hide: true } }, async (request, reply) => {\n    const grant = await container.auth.verifyAccess({\n      method: request.method,\n      url: container.mcp.resource,\n      headers: request.headers,\n    });\n    if (!grant) {\n      return reply.send(unauthorized(container.mcp));\n    }\n    let scope: OrgScope;\n    try {\n      scope = await resolveScopeFor(container, grant.userId, grant.orgId);\n    } catch (error) {\n      if (error instanceof NoActiveOrgError) {\n        return reply.send(forbidden());\n      }\n      throw error;\n    }\n    const connection: Connection = {\n      context: { container, scope, requestId: request.id },\n      tools: tools.filter(\n        (tool) => grant.scopes.includes(tool.scope) && roleHoldsScope(scope.role, tool.scope),\n      ),\n    };\n    const response = await handler.fetch(await webRequest(request, reply), {\n      authInfo: {\n        token: '',\n        clientId: grant.clientId,\n        scopes: grant.scopes,\n        extra: { connection },\n      },\n      parsedBody: request.body,\n    });\n    return reply.send(response);\n  });\n\n  app.route({\n    method: ['GET', 'DELETE'],\n    url: '/mcp',\n    schema: { hide: true },\n    handler: async (_request, reply) =>\n      reply\n        .code(405)\n        .header('allow', 'POST')\n        .header('content-type', 'application/json')\n        .send({\n          jsonrpc: '2.0',\n          error: { code: -32000, message: 'Method not allowed.' },\n          id: null,\n        }),\n  });\n}\n"],"mappings":";;;;;;;;AAaA,SAAgB,YACd,KACA,WACA,QAAyB,OACnB;CACN,MAAM,UAAU,kBACb,QAAQ;EACP,MAAM,aAAa,IAAI,UAAU,OAAO;EACxC,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,wBAAwB;EAE1C,OAAO,iBAAiB,WAAW,SAAS,WAAW,KAAK;CAC9D,GACA;EACE,QAAQ;EACR,UAAU,QAAQ,UAAU,OAAO,MAAM,qBAAqB,EAAE,IAAI,CAAC;CACvE,CACF;CAEA,MAAM,aAAa,OAAO,SAAyB,UAAwB;EACzE,MAAM,QAAQ,IAAI,gBAAgB;EAClC,MAAM,IAAI,GAAG,eAAe;GAC1B,IAAI,CAAC,MAAM,IAAI,kBACb,MAAM,MAAM;EAEhB,CAAC;EACD,OAAO,aAAa,QAAQ,KAAK,QAAQ,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;CACzE;CAEA,IAAI,KAAK,QAAQ,EAAE,QAAQ,EAAE,MAAM,KAAK,EAAE,GAAG,OAAO,SAAS,UAAU;EACrE,MAAM,QAAQ,MAAM,UAAU,KAAK,aAAa;GAC9C,QAAQ,QAAQ;GAChB,KAAK,UAAU,IAAI;GACnB,SAAS,QAAQ;EACnB,CAAC;EACD,IAAI,CAAC,OACH,OAAO,MAAM,KAAK,aAAa,UAAU,GAAG,CAAC;EAE/C,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,gBAAgB,WAAW,MAAM,QAAQ,MAAM,KAAK;EACpE,SAAS,OAAO;GACd,IAAI,iBAAiB,kBACnB,OAAO,MAAM,KAAK,UAAU,CAAC;GAE/B,MAAM;EACR;EACA,MAAM,aAAyB;GAC7B,SAAS;IAAE;IAAW;IAAO,WAAW,QAAQ;GAAG;GACnD,OAAO,MAAM,QACV,SAAS,MAAM,OAAO,SAAS,KAAK,KAAK,KAAK,eAAe,MAAM,MAAM,KAAK,KAAK,CACtF;EACF;EACA,MAAM,WAAW,MAAM,QAAQ,MAAM,MAAM,WAAW,SAAS,KAAK,GAAG;GACrE,UAAU;IACR,OAAO;IACP,UAAU,MAAM;IAChB,QAAQ,MAAM;IACd,OAAO,EAAE,WAAW;GACtB;GACA,YAAY,QAAQ;EACtB,CAAC;EACD,OAAO,MAAM,KAAK,QAAQ;CAC5B,CAAC;CAED,IAAI,MAAM;EACR,QAAQ,CAAC,OAAO,QAAQ;EACxB,KAAK;EACL,QAAQ,EAAE,MAAM,KAAK;EACrB,SAAS,OAAO,UAAU,UACxB,MACG,KAAK,GAAG,CAAC,CACT,OAAO,SAAS,MAAM,CAAC,CACvB,OAAO,gBAAgB,kBAAkB,CAAC,CAC1C,KAAK;GACJ,SAAS;GACT,OAAO;IAAE,MAAM;IAAQ,SAAS;GAAsB;GACtD,IAAI;EACN,CAAC;CACP,CAAC;AACH"}
+{"version":3,"file":"route.js","names":[],"sources":["../../../src/http/mcp/route.ts"],"sourcesContent":["import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';\nimport { createMcpHandler } from '@modelcontextprotocol/server';\nimport { toWebRequest } from '@modelcontextprotocol/node';\nimport { isPermission } from '@headless-lms/core/organizations';\nimport type { Container } from '../../app/container.js';\nimport { NoActiveOrgError, resolveCallerFor, type Caller } from '../scope.js';\nimport { forbidden, unauthorized } from './challenge.js';\nimport { createToolServer } from './server.js';\nimport type { Tool, ToolContext } from './tool.js';\nimport { TOOLS } from './tools/index.js';\n\ntype Connection = { context: ToolContext; tools: readonly Tool[] };\n\nexport function registerMcp(\n  app: FastifyInstance,\n  container: Container,\n  tools: readonly Tool[] = TOOLS,\n): void {\n  const handler = createMcpHandler(\n    (ctx) => {\n      const connection = ctx.authInfo?.extra?.connection as Connection | undefined;\n      if (!connection) {\n        throw new Error('mcp connection missing');\n      }\n      return createToolServer(connection.context, connection.tools);\n    },\n    {\n      legacy: 'stateless',\n      onerror: (err) => container.logger.error('mcp handler error', { err }),\n    },\n  );\n\n  const webRequest = async (request: FastifyRequest, reply: FastifyReply) => {\n    const abort = new AbortController();\n    reply.raw.on('close', () => {\n      if (!reply.raw.writableFinished) {\n        abort.abort();\n      }\n    });\n    return toWebRequest(request.raw, request.body, { signal: abort.signal });\n  };\n\n  app.post('/mcp', { schema: { hide: true } }, async (request, reply) => {\n    const grant = await container.auth.verifyAccess({\n      method: request.method,\n      url: container.mcp.resource,\n      headers: request.headers,\n    });\n    if (!grant) {\n      return reply.send(unauthorized(container.mcp));\n    }\n    let caller: Caller;\n    try {\n      caller = await resolveCallerFor(\n        container,\n        grant.userId,\n        grant.orgId,\n        'roleKey' in grant.limit\n          ? grant.limit\n          : { scopes: grant.limit.scopes.filter(isPermission) },\n      );\n    } catch (error) {\n      if (error instanceof NoActiveOrgError) {\n        return reply.send(forbidden());\n      }\n      throw error;\n    }\n    const connection: Connection = {\n      context: { container, caller, requestId: request.id },\n      tools,\n    };\n    const response = await handler.fetch(await webRequest(request, reply), {\n      authInfo: {\n        token: '',\n        clientId: grant.clientId,\n        scopes: 'scopes' in grant.limit ? grant.limit.scopes : [],\n        extra: { connection },\n      },\n      parsedBody: request.body,\n    });\n    return reply.send(response);\n  });\n\n  app.route({\n    method: ['GET', 'DELETE'],\n    url: '/mcp',\n    schema: { hide: true },\n    handler: async (_request, reply) =>\n      reply\n        .code(405)\n        .header('allow', 'POST')\n        .header('content-type', 'application/json')\n        .send({\n          jsonrpc: '2.0',\n          error: { code: -32000, message: 'Method not allowed.' },\n          id: null,\n        }),\n  });\n}\n"],"mappings":";;;;;;;;AAaA,SAAgB,YACd,KACA,WACA,QAAyB,OACnB;CACN,MAAM,UAAU,kBACb,QAAQ;EACP,MAAM,aAAa,IAAI,UAAU,OAAO;EACxC,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,wBAAwB;EAE1C,OAAO,iBAAiB,WAAW,SAAS,WAAW,KAAK;CAC9D,GACA;EACE,QAAQ;EACR,UAAU,QAAQ,UAAU,OAAO,MAAM,qBAAqB,EAAE,IAAI,CAAC;CACvE,CACF;CAEA,MAAM,aAAa,OAAO,SAAyB,UAAwB;EACzE,MAAM,QAAQ,IAAI,gBAAgB;EAClC,MAAM,IAAI,GAAG,eAAe;GAC1B,IAAI,CAAC,MAAM,IAAI,kBACb,MAAM,MAAM;EAEhB,CAAC;EACD,OAAO,aAAa,QAAQ,KAAK,QAAQ,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;CACzE;CAEA,IAAI,KAAK,QAAQ,EAAE,QAAQ,EAAE,MAAM,KAAK,EAAE,GAAG,OAAO,SAAS,UAAU;EACrE,MAAM,QAAQ,MAAM,UAAU,KAAK,aAAa;GAC9C,QAAQ,QAAQ;GAChB,KAAK,UAAU,IAAI;GACnB,SAAS,QAAQ;EACnB,CAAC;EACD,IAAI,CAAC,OACH,OAAO,MAAM,KAAK,aAAa,UAAU,GAAG,CAAC;EAE/C,IAAI;EACJ,IAAI;GACF,SAAS,MAAM,iBACb,WACA,MAAM,QACN,MAAM,OACN,aAAa,MAAM,QACf,MAAM,QACN,EAAE,QAAQ,MAAM,MAAM,OAAO,OAAO,YAAY,EAAE,CACxD;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,kBACnB,OAAO,MAAM,KAAK,UAAU,CAAC;GAE/B,MAAM;EACR;EACA,MAAM,aAAyB;GAC7B,SAAS;IAAE;IAAW;IAAQ,WAAW,QAAQ;GAAG;GACpD;EACF;EACA,MAAM,WAAW,MAAM,QAAQ,MAAM,MAAM,WAAW,SAAS,KAAK,GAAG;GACrE,UAAU;IACR,OAAO;IACP,UAAU,MAAM;IAChB,QAAQ,YAAY,MAAM,QAAQ,MAAM,MAAM,SAAS,CAAC;IACxD,OAAO,EAAE,WAAW;GACtB;GACA,YAAY,QAAQ;EACtB,CAAC;EACD,OAAO,MAAM,KAAK,QAAQ;CAC5B,CAAC;CAED,IAAI,MAAM;EACR,QAAQ,CAAC,OAAO,QAAQ;EACxB,KAAK;EACL,QAAQ,EAAE,MAAM,KAAK;EACrB,SAAS,OAAO,UAAU,UACxB,MACG,KAAK,GAAG,CAAC,CACT,OAAO,SAAS,MAAM,CAAC,CACvB,OAAO,gBAAgB,kBAAkB,CAAC,CAC1C,KAAK;GACJ,SAAS;GACT,OAAO;IAAE,MAAM;IAAQ,SAAS;GAAsB;GACtD,IAAI;EACN,CAAC;CACP,CAAC;AACH"}

package/dist/http/mcp/test-support.d.ts

@@ -1,6 +1,6 @@
 import { Container } from "../../app/container.js";
 import { Tool, ToolContext, ToolKind } from "./tool.js";
-import { AccessScope, StaffRole } from "@headless-lms/core/organizations";
+import { Actor } from "@headless-lms/core/shared/actor";
 //#region src/http/mcp/test-support.d.ts
 declare const ORG: {
   id: string;
@@ -19,10 +19,11 @@ declare const ORG_USER: {
   id: string;
   orgId: string;
   userId: string;
-  role: string;
+  status: string;
 };
+declare const OWNER: Actor;
 declare function fakeContainer(overrides?: Record<string, unknown>): Container;
-declare function toolContext(container: Container, role?: StaffRole): ToolContext;
+declare function toolContext(container: Container, actor?: Actor): ToolContext;
 declare function listTools(ctx: ToolContext, tools?: readonly Tool[]): Promise<{
   name: string;
   annotations?: Record<string, unknown>;
@@ -39,7 +40,7 @@ declare function callTool(name: string, args: unknown, ctx: ToolContext, tools?:
     text?: string;
   }>;
 }>;
-type ToolSpec = [name: string, scope: AccessScope, kind: ToolKind, idempotent: boolean, openWorld: boolean];
+type ToolSpec = [name: string, kind: ToolKind, idempotent: boolean, openWorld: boolean];
 declare function toolSpecs(tools: readonly Tool[]): ToolSpec[];
 type ToolCase = {
   tool: string;
@@ -51,5 +52,5 @@ type ToolCase = {
 };
 declare function runCase(tools: readonly Tool[], c: ToolCase): Promise<void>;
 //#endregion
-export { ORG, ORG_USER, ToolCase, ToolSpec, USER, callTool, fakeContainer, listTools, runCase, toolContext, toolSpecs };
+export { ORG, ORG_USER, OWNER, ToolCase, ToolSpec, USER, callTool, fakeContainer, listTools, runCase, toolContext, toolSpecs };
 //# sourceMappingURL=test-support.d.ts.map

package/dist/http/mcp/test-support.js

@@ -3,7 +3,7 @@ import { toToolResult } from "./tool.js";
 import { createToolServer } from "./server.js";
 import { TOOLS } from "./tools/index.js";
 import { a as globalExpect } from "../../node_modules/.pnpm/vitest@2.1.9_@types_node@22.20.0_jsdom@25.0.1_lightningcss@1.32.0/node_modules/vitest/dist/chunks/vi.DgezovHB.js";
-import { ACCESS_SCOPES } from "@headless-lms/core/organizations";
+import { ALL_PERMISSIONS, actorWith } from "@headless-lms/core/organizations";
 import { createMcpHandler } from "@modelcontextprotocol/server";
 //#region src/http/mcp/test-support.ts
 const ORG = {
@@ -23,8 +23,13 @@ const ORG_USER = {
 	id: "ou_1",
 	orgId: "org_1",
 	userId: "usr_1",
-	role: "owner"
+	status: "active"
 };
+const OWNER = actorWith({
+	id: ORG_USER.id,
+	orgId: ORG.id,
+	owner: true
+});
 function fakeContainer(overrides = {}) {
 	const logger = {
 		debug: () => {},
@@ -46,13 +51,29 @@ function fakeContainer(overrides = {}) {
 		auth: { verifyAccess: async () => ({
 			userId: USER.id,
 			orgId: ORG.id,
-			scopes: [...ACCESS_SCOPES],
-			clientId: "client_1"
+			clientId: "client_1",
+			limit: { scopes: [...ALL_PERMISSIONS] }
 		}) },
 		organizations: {
 			getById: async (id) => id === ORG.id ? ORG : null,
 			getByExternalId: async (id) => id === ORG.externalId ? ORG : null,
-			getOrgUser: async (orgId, userId) => orgId === ORG.id && userId === USER.id ? ORG_USER : null
+			getOrgUser: async (orgId, userId) => orgId === ORG.id && userId === USER.id ? ORG_USER : null,
+			actorFor: async (orgId, orgUserId) => orgId === ORG.id && orgUserId === ORG_USER.id ? OWNER : null,
+			resolveCaller: async (authOrgId, authUserId, limit) => {
+				const orgs = base.organizations;
+				const people = base.identity;
+				const org = await orgs.getByExternalId(authOrgId);
+				if (!org) return null;
+				const user = await people.getUserByExternalId(authUserId);
+				const orgUser = user ? await orgs.getOrgUser(org.id, user.id) : null;
+				const actor = orgUser ? await orgs.actorFor(org.id, orgUser.id, limit) : null;
+				return {
+					orgId: org.id,
+					userId: user?.id ?? null,
+					orgUserId: orgUser?.id ?? null,
+					actor
+				};
+			}
 		},
 		identity: {
 			getUserByExternalId: async (id) => id === USER.id ? USER : null,
@@ -68,15 +89,16 @@ function fakeContainer(overrides = {}) {
 	}
 	return base;
 }
-function toolContext(container, role = "owner") {
+function toolContext(container, actor = OWNER) {
 	return {
 		container,
-		scope: {
+		caller: {
+			actor,
 			orgId: ORG.id,
 			userId: USER.id,
 			orgUserId: ORG_USER.id,
-			role,
-			authOrgId: ORG.id
+			authOrgId: ORG.id,
+			authUserId: USER.id
 		},
 		requestId: "req_test"
 	};
@@ -121,7 +143,6 @@ async function callTool(name, args, ctx, tools = TOOLS) {
 function toolSpecs(tools) {
 	return tools.map((tool) => [
 		tool.name,
-		tool.scope,
 		tool.kind,
 		tool.idempotent,
 		tool.openWorld
@@ -146,6 +167,6 @@ async function runCase(tools, c) {
 	globalExpect(result.structuredContent).toEqual(toToolResult("shown" in c ? c.shown : returns).structuredContent);
 }
 //#endregion
-export { ORG, ORG_USER, USER, callTool, fakeContainer, listTools, runCase, toolContext, toolSpecs };
+export { ORG, ORG_USER, OWNER, USER, callTool, fakeContainer, listTools, runCase, toolContext, toolSpecs };
 
 //# sourceMappingURL=test-support.js.map

package/dist/http/mcp/test-support.js.map

@@ -1 +1 @@
-{"version":3,"file":"test-support.js","names":[],"sources":["../../../src/http/mcp/test-support.ts"],"sourcesContent":["import { expect } from 'vitest';\nimport { createMcpHandler } from '@modelcontextprotocol/server';\nimport { ACCESS_SCOPES, type AccessScope, type StaffRole } from '@headless-lms/core/organizations';\nimport type { Container } from '../../app/container.js';\nimport { mcpEndpoints } from '../../app/mcp-endpoints.js';\nimport { createToolServer } from './server.js';\nimport { toToolResult, type Tool, type ToolContext, type ToolKind } from './tool.js';\nimport { TOOLS } from './tools/index.js';\n\nexport const ORG = { id: 'org_1', name: 'Acme', slug: 'acme', externalId: 'org_1' };\nexport const USER = {\n  id: 'usr_1',\n  email: 'owner@acme.test',\n  firstName: 'Ada',\n  lastName: 'Lovelace',\n  externalId: 'usr_1',\n};\nexport const ORG_USER = { id: 'ou_1', orgId: 'org_1', userId: 'usr_1', role: 'owner' };\n\nexport function fakeContainer(overrides: Record<string, unknown> = {}): Container {\n  const logger = {\n    debug: () => {},\n    info: () => {},\n    warn: () => {},\n    error: () => {},\n    child: () => logger,\n  };\n  const base: Record<string, unknown> = {\n    mcp: mcpEndpoints({\n      authBaseURL: 'http://localhost:8100',\n      adminAppUrl: 'http://localhost:8101',\n    }),\n    logger,\n    requestContext: { set: () => {}, run: (_ctx: unknown, fn: () => void) => fn() },\n    auth: {\n      verifyAccess: async () => ({\n        userId: USER.id,\n        orgId: ORG.id,\n        scopes: [...ACCESS_SCOPES],\n        clientId: 'client_1',\n      }),\n    },\n    organizations: {\n      getById: async (id: string) => (id === ORG.id ? ORG : null),\n      getByExternalId: async (id: string) => (id === ORG.externalId ? ORG : null),\n      getOrgUser: async (orgId: string, userId: string) =>\n        orgId === ORG.id && userId === USER.id ? ORG_USER : null,\n    },\n    identity: {\n      getUserByExternalId: async (id: string) => (id === USER.id ? USER : null),\n      getUserById: async (id: string) => (id === USER.id ? USER : null),\n    },\n  };\n  for (const [key, value] of Object.entries(overrides)) {\n    const current = base[key];\n    base[key] =\n      current &&\n      typeof current === 'object' &&\n      value &&\n      typeof value === 'object' &&\n      !Array.isArray(value)\n        ? { ...(current as object), ...(value as object) }\n        : value;\n  }\n  return base as unknown as Container;\n}\n\nexport function toolContext(container: Container, role: StaffRole = 'owner'): ToolContext {\n  return {\n    container,\n    scope: { orgId: ORG.id, userId: USER.id, orgUserId: ORG_USER.id, role, authOrgId: ORG.id },\n    requestId: 'req_test',\n  };\n}\n\nconst MODERN_META = {\n  'io.modelcontextprotocol/protocolVersion': '2026-07-28',\n  'io.modelcontextprotocol/clientCapabilities': {},\n};\n\nasync function rpc(\n  ctx: ToolContext,\n  tools: readonly Tool[],\n  method: string,\n  params: Record<string, unknown>,\n  name?: string,\n) {\n  const handler = createMcpHandler(() => createToolServer(ctx, tools));\n  const headers: Record<string, string> = {\n    'content-type': 'application/json',\n    'mcp-protocol-version': '2026-07-28',\n    'mcp-method': method,\n  };\n  if (name) {\n    headers['mcp-name'] = name;\n  }\n  const response = await handler.fetch(\n    new Request('http://localhost:8100/mcp', {\n      method: 'POST',\n      headers,\n      body: JSON.stringify({\n        jsonrpc: '2.0',\n        id: 1,\n        method,\n        params: { ...params, _meta: MODERN_META },\n      }),\n    }),\n  );\n  const body = (await response.json()) as {\n    result?: Record<string, unknown>;\n    error?: { message: string };\n  };\n  if (body.error) {\n    throw new Error(body.error.message);\n  }\n  return body.result as Record<string, unknown>;\n}\n\nexport async function listTools(ctx: ToolContext, tools: readonly Tool[] = TOOLS) {\n  const result = await rpc(ctx, tools, 'tools/list', {});\n  return result.tools as Array<{\n    name: string;\n    annotations?: Record<string, unknown>;\n    inputSchema: { type?: string; properties?: Record<string, unknown> };\n  }>;\n}\n\nexport async function callTool(\n  name: string,\n  args: unknown,\n  ctx: ToolContext,\n  tools: readonly Tool[] = TOOLS,\n) {\n  return (await rpc(ctx, tools, 'tools/call', { name, arguments: args }, name)) as {\n    isError?: boolean;\n    structuredContent?: Record<string, unknown>;\n    content: Array<{ type: string; text?: string }>;\n  };\n}\n\nexport type ToolSpec = [\n  name: string,\n  scope: AccessScope,\n  kind: ToolKind,\n  idempotent: boolean,\n  openWorld: boolean,\n];\n\nexport function toolSpecs(tools: readonly Tool[]): ToolSpec[] {\n  return tools.map((tool) => [tool.name, tool.scope, tool.kind, tool.idempotent, tool.openWorld]);\n}\n\nexport type ToolCase = {\n  tool: string;\n  args: Record<string, unknown>;\n  service: string;\n  expected: unknown[];\n  returns?: unknown;\n  shown?: unknown;\n};\n\nfunction serviceFake(path: string, returns: unknown, calls: unknown[][]): Record<string, unknown> {\n  const keys = path.split('.');\n  const method = keys.pop() ?? '';\n  let node: Record<string, unknown> = {\n    [method]: async (...args: unknown[]) => {\n      calls.push(args);\n      return returns;\n    },\n  };\n  for (const key of keys.reverse()) {\n    node = { [key]: node };\n  }\n  return node;\n}\n\nexport async function runCase(tools: readonly Tool[], c: ToolCase): Promise<void> {\n  const calls: unknown[][] = [];\n  const returns = 'returns' in c ? c.returns : { id: 'result' };\n  const ctx = toolContext(fakeContainer(serviceFake(c.service, returns, calls)));\n  const result = await callTool(c.tool, c.args, ctx, tools);\n  expect(result.isError ?? false).toBe(false);\n  expect(calls).toEqual([c.expected]);\n  expect(result.structuredContent).toEqual(\n    toToolResult('shown' in c ? c.shown : returns).structuredContent,\n  );\n}\n"],"mappings":";;;;;;;;AASA,MAAa,MAAM;CAAE,IAAI;CAAS,MAAM;CAAQ,MAAM;CAAQ,YAAY;AAAQ;AAClF,MAAa,OAAO;CAClB,IAAI;CACJ,OAAO;CACP,WAAW;CACX,UAAU;CACV,YAAY;AACd;AACA,MAAa,WAAW;CAAE,IAAI;CAAQ,OAAO;CAAS,QAAQ;CAAS,MAAM;AAAQ;AAErF,SAAgB,cAAc,YAAqC,CAAC,GAAc;CAChF,MAAM,SAAS;EACb,aAAa,CAAC;EACd,YAAY,CAAC;EACb,YAAY,CAAC;EACb,aAAa,CAAC;EACd,aAAa;CACf;CACA,MAAM,OAAgC;EACpC,KAAK,aAAa;GAChB,aAAa;GACb,aAAa;EACf,CAAC;EACD;EACA,gBAAgB;GAAE,WAAW,CAAC;GAAG,MAAM,MAAe,OAAmB,GAAG;EAAE;EAC9E,MAAM,EACJ,cAAc,aAAa;GACzB,QAAQ,KAAK;GACb,OAAO,IAAI;GACX,QAAQ,CAAC,GAAG,aAAa;GACzB,UAAU;EACZ,GACF;EACA,eAAe;GACb,SAAS,OAAO,OAAgB,OAAO,IAAI,KAAK,MAAM;GACtD,iBAAiB,OAAO,OAAgB,OAAO,IAAI,aAAa,MAAM;GACtE,YAAY,OAAO,OAAe,WAChC,UAAU,IAAI,MAAM,WAAW,KAAK,KAAK,WAAW;EACxD;EACA,UAAU;GACR,qBAAqB,OAAO,OAAgB,OAAO,KAAK,KAAK,OAAO;GACpE,aAAa,OAAO,OAAgB,OAAO,KAAK,KAAK,OAAO;EAC9D;CACF;CACA,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,GAAG;EACpD,MAAM,UAAU,KAAK;EACrB,KAAK,OACH,WACA,OAAO,YAAY,YACnB,SACA,OAAO,UAAU,YACjB,CAAC,MAAM,QAAQ,KAAK,IAChB;GAAE,GAAI;GAAoB,GAAI;EAAiB,IAC/C;CACR;CACA,OAAO;AACT;AAEA,SAAgB,YAAY,WAAsB,OAAkB,SAAsB;CACxF,OAAO;EACL;EACA,OAAO;GAAE,OAAO,IAAI;GAAI,QAAQ,KAAK;GAAI,WAAW,SAAS;GAAI;GAAM,WAAW,IAAI;EAAG;EACzF,WAAW;CACb;AACF;AAEA,MAAM,cAAc;CAClB,2CAA2C;CAC3C,8CAA8C,CAAC;AACjD;AAEA,eAAe,IACb,KACA,OACA,QACA,QACA,MACA;CACA,MAAM,UAAU,uBAAuB,iBAAiB,KAAK,KAAK,CAAC;CACnE,MAAM,UAAkC;EACtC,gBAAgB;EAChB,wBAAwB;EACxB,cAAc;CAChB;CACA,IAAI,MACF,QAAQ,cAAc;CAcxB,MAAM,OAAQ,OAAM,MAZG,QAAQ,MAC7B,IAAI,QAAQ,6BAA6B;EACvC,QAAQ;EACR;EACA,MAAM,KAAK,UAAU;GACnB,SAAS;GACT,IAAI;GACJ;GACA,QAAQ;IAAE,GAAG;IAAQ,OAAO;GAAY;EAC1C,CAAC;CACH,CAAC,CACH,EAAA,CAC6B,KAAK;CAIlC,IAAI,KAAK,OACP,MAAM,IAAI,MAAM,KAAK,MAAM,OAAO;CAEpC,OAAO,KAAK;AACd;AAEA,eAAsB,UAAU,KAAkB,QAAyB,OAAO;CAEhF,QAAO,MADc,IAAI,KAAK,OAAO,cAAc,CAAC,CAAC,EAAA,CACvC;AAKhB;AAEA,eAAsB,SACpB,MACA,MACA,KACA,QAAyB,OACzB;CACA,OAAQ,MAAM,IAAI,KAAK,OAAO,cAAc;EAAE;EAAM,WAAW;CAAK,GAAG,IAAI;AAK7E;AAUA,SAAgB,UAAU,OAAoC;CAC5D,OAAO,MAAM,KAAK,SAAS;EAAC,KAAK;EAAM,KAAK;EAAO,KAAK;EAAM,KAAK;EAAY,KAAK;CAAS,CAAC;AAChG;AAWA,SAAS,YAAY,MAAc,SAAkB,OAA6C;CAChG,MAAM,OAAO,KAAK,MAAM,GAAG;CAE3B,IAAI,OAAgC,GADrB,KAAK,IAAI,KAAK,KAEjB,OAAO,GAAG,SAAoB;EACtC,MAAM,KAAK,IAAI;EACf,OAAO;CACT,EACF;CACA,KAAK,MAAM,OAAO,KAAK,QAAQ,GAC7B,OAAO,GAAG,MAAM,KAAK;CAEvB,OAAO;AACT;AAEA,eAAsB,QAAQ,OAAwB,GAA4B;CAChF,MAAM,QAAqB,CAAC;CAC5B,MAAM,UAAU,aAAa,IAAI,EAAE,UAAU,EAAE,IAAI,SAAS;CAC5D,MAAM,MAAM,YAAY,cAAc,YAAY,EAAE,SAAS,SAAS,KAAK,CAAC,CAAC;CAC7E,MAAM,SAAS,MAAM,SAAS,EAAE,MAAM,EAAE,MAAM,KAAK,KAAK;CACxD,aAAO,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,KAAK;CAC1C,aAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;CAClC,aAAO,OAAO,iBAAiB,CAAC,CAAC,QAC/B,aAAa,WAAW,IAAI,EAAE,QAAQ,OAAO,CAAC,CAAC,iBACjD;AACF"}
+{"version":3,"file":"test-support.js","names":[],"sources":["../../../src/http/mcp/test-support.ts"],"sourcesContent":["import { expect } from 'vitest';\nimport { createMcpHandler } from '@modelcontextprotocol/server';\nimport { ALL_PERMISSIONS, actorWith } from '@headless-lms/core/organizations';\nimport type { Actor } from '@headless-lms/core/shared/actor';\nimport type { CallerLimit } from '@headless-lms/core/organizations';\nimport type { Container } from '../../app/container.js';\nimport { mcpEndpoints } from '../../app/mcp-endpoints.js';\nimport { createToolServer } from './server.js';\nimport { toToolResult, type Tool, type ToolContext, type ToolKind } from './tool.js';\nimport { TOOLS } from './tools/index.js';\n\nexport const ORG = { id: 'org_1', name: 'Acme', slug: 'acme', externalId: 'org_1' };\nexport const USER = {\n  id: 'usr_1',\n  email: 'owner@acme.test',\n  firstName: 'Ada',\n  lastName: 'Lovelace',\n  externalId: 'usr_1',\n};\nexport const ORG_USER = { id: 'ou_1', orgId: 'org_1', userId: 'usr_1', status: 'active' };\nexport const OWNER: Actor = actorWith({ id: ORG_USER.id, orgId: ORG.id, owner: true });\n\ntype Lookups = {\n  getByExternalId: (id: string) => Promise<{ id: string } | null>;\n  getUserByExternalId: (id: string) => Promise<{ id: string } | null>;\n  getOrgUser: (orgId: string, userId: string) => Promise<{ id: string } | null>;\n  actorFor: (orgId: string, orgUserId: string, limit?: CallerLimit) => Promise<Actor | null>;\n};\n\nexport function fakeContainer(overrides: Record<string, unknown> = {}): Container {\n  const logger = {\n    debug: () => {},\n    info: () => {},\n    warn: () => {},\n    error: () => {},\n    child: () => logger,\n  };\n  const base: Record<string, unknown> = {\n    mcp: mcpEndpoints({\n      authBaseURL: 'http://localhost:8100',\n      adminAppUrl: 'http://localhost:8101',\n    }),\n    logger,\n    requestContext: { set: () => {}, run: (_ctx: unknown, fn: () => void) => fn() },\n    auth: {\n      verifyAccess: async () => ({\n        userId: USER.id,\n        orgId: ORG.id,\n        clientId: 'client_1',\n        limit: { scopes: [...ALL_PERMISSIONS] },\n      }),\n    },\n    organizations: {\n      getById: async (id: string) => (id === ORG.id ? ORG : null),\n      getByExternalId: async (id: string) => (id === ORG.externalId ? ORG : null),\n      getOrgUser: async (orgId: string, userId: string) =>\n        orgId === ORG.id && userId === USER.id ? ORG_USER : null,\n      actorFor: async (orgId: string, orgUserId: string) =>\n        orgId === ORG.id && orgUserId === ORG_USER.id ? OWNER : null,\n      resolveCaller: async (authOrgId: string, authUserId: string, limit?: CallerLimit) => {\n        const orgs = base.organizations as Lookups;\n        const people = base.identity as Pick<Lookups, 'getUserByExternalId'>;\n        const org = await orgs.getByExternalId(authOrgId);\n        if (!org) {\n          return null;\n        }\n        const user = await people.getUserByExternalId(authUserId);\n        const orgUser = user ? await orgs.getOrgUser(org.id, user.id) : null;\n        const actor = orgUser ? await orgs.actorFor(org.id, orgUser.id, limit) : null;\n        return { orgId: org.id, userId: user?.id ?? null, orgUserId: orgUser?.id ?? null, actor };\n      },\n    },\n    identity: {\n      getUserByExternalId: async (id: string) => (id === USER.id ? USER : null),\n      getUserById: async (id: string) => (id === USER.id ? USER : null),\n    },\n  };\n  for (const [key, value] of Object.entries(overrides)) {\n    const current = base[key];\n    base[key] =\n      current &&\n      typeof current === 'object' &&\n      value &&\n      typeof value === 'object' &&\n      !Array.isArray(value)\n        ? { ...(current as object), ...(value as object) }\n        : value;\n  }\n  return base as unknown as Container;\n}\n\nexport function toolContext(container: Container, actor: Actor = OWNER): ToolContext {\n  return {\n    container,\n    caller: {\n      actor,\n      orgId: ORG.id,\n      userId: USER.id,\n      orgUserId: ORG_USER.id,\n      authOrgId: ORG.id,\n      authUserId: USER.id,\n    },\n    requestId: 'req_test',\n  };\n}\n\nconst MODERN_META = {\n  'io.modelcontextprotocol/protocolVersion': '2026-07-28',\n  'io.modelcontextprotocol/clientCapabilities': {},\n};\n\nasync function rpc(\n  ctx: ToolContext,\n  tools: readonly Tool[],\n  method: string,\n  params: Record<string, unknown>,\n  name?: string,\n) {\n  const handler = createMcpHandler(() => createToolServer(ctx, tools));\n  const headers: Record<string, string> = {\n    'content-type': 'application/json',\n    'mcp-protocol-version': '2026-07-28',\n    'mcp-method': method,\n  };\n  if (name) {\n    headers['mcp-name'] = name;\n  }\n  const response = await handler.fetch(\n    new Request('http://localhost:8100/mcp', {\n      method: 'POST',\n      headers,\n      body: JSON.stringify({\n        jsonrpc: '2.0',\n        id: 1,\n        method,\n        params: { ...params, _meta: MODERN_META },\n      }),\n    }),\n  );\n  const body = (await response.json()) as {\n    result?: Record<string, unknown>;\n    error?: { message: string };\n  };\n  if (body.error) {\n    throw new Error(body.error.message);\n  }\n  return body.result as Record<string, unknown>;\n}\n\nexport async function listTools(ctx: ToolContext, tools: readonly Tool[] = TOOLS) {\n  const result = await rpc(ctx, tools, 'tools/list', {});\n  return result.tools as Array<{\n    name: string;\n    annotations?: Record<string, unknown>;\n    inputSchema: { type?: string; properties?: Record<string, unknown> };\n  }>;\n}\n\nexport async function callTool(\n  name: string,\n  args: unknown,\n  ctx: ToolContext,\n  tools: readonly Tool[] = TOOLS,\n) {\n  return (await rpc(ctx, tools, 'tools/call', { name, arguments: args }, name)) as {\n    isError?: boolean;\n    structuredContent?: Record<string, unknown>;\n    content: Array<{ type: string; text?: string }>;\n  };\n}\n\nexport type ToolSpec = [name: string, kind: ToolKind, idempotent: boolean, openWorld: boolean];\n\nexport function toolSpecs(tools: readonly Tool[]): ToolSpec[] {\n  return tools.map((tool) => [tool.name, tool.kind, tool.idempotent, tool.openWorld]);\n}\n\nexport type ToolCase = {\n  tool: string;\n  args: Record<string, unknown>;\n  service: string;\n  expected: unknown[];\n  returns?: unknown;\n  shown?: unknown;\n};\n\nfunction serviceFake(path: string, returns: unknown, calls: unknown[][]): Record<string, unknown> {\n  const keys = path.split('.');\n  const method = keys.pop() ?? '';\n  let node: Record<string, unknown> = {\n    [method]: async (...args: unknown[]) => {\n      calls.push(args);\n      return returns;\n    },\n  };\n  for (const key of keys.reverse()) {\n    node = { [key]: node };\n  }\n  return node;\n}\n\nexport async function runCase(tools: readonly Tool[], c: ToolCase): Promise<void> {\n  const calls: unknown[][] = [];\n  const returns = 'returns' in c ? c.returns : { id: 'result' };\n  const ctx = toolContext(fakeContainer(serviceFake(c.service, returns, calls)));\n  const result = await callTool(c.tool, c.args, ctx, tools);\n  expect(result.isError ?? false).toBe(false);\n  expect(calls).toEqual([c.expected]);\n  expect(result.structuredContent).toEqual(\n    toToolResult('shown' in c ? c.shown : returns).structuredContent,\n  );\n}\n"],"mappings":";;;;;;;;AAWA,MAAa,MAAM;CAAE,IAAI;CAAS,MAAM;CAAQ,MAAM;CAAQ,YAAY;AAAQ;AAClF,MAAa,OAAO;CAClB,IAAI;CACJ,OAAO;CACP,WAAW;CACX,UAAU;CACV,YAAY;AACd;AACA,MAAa,WAAW;CAAE,IAAI;CAAQ,OAAO;CAAS,QAAQ;CAAS,QAAQ;AAAS;AACxF,MAAa,QAAe,UAAU;CAAE,IAAI,SAAS;CAAI,OAAO,IAAI;CAAI,OAAO;AAAK,CAAC;AASrF,SAAgB,cAAc,YAAqC,CAAC,GAAc;CAChF,MAAM,SAAS;EACb,aAAa,CAAC;EACd,YAAY,CAAC;EACb,YAAY,CAAC;EACb,aAAa,CAAC;EACd,aAAa;CACf;CACA,MAAM,OAAgC;EACpC,KAAK,aAAa;GAChB,aAAa;GACb,aAAa;EACf,CAAC;EACD;EACA,gBAAgB;GAAE,WAAW,CAAC;GAAG,MAAM,MAAe,OAAmB,GAAG;EAAE;EAC9E,MAAM,EACJ,cAAc,aAAa;GACzB,QAAQ,KAAK;GACb,OAAO,IAAI;GACX,UAAU;GACV,OAAO,EAAE,QAAQ,CAAC,GAAG,eAAe,EAAE;EACxC,GACF;EACA,eAAe;GACb,SAAS,OAAO,OAAgB,OAAO,IAAI,KAAK,MAAM;GACtD,iBAAiB,OAAO,OAAgB,OAAO,IAAI,aAAa,MAAM;GACtE,YAAY,OAAO,OAAe,WAChC,UAAU,IAAI,MAAM,WAAW,KAAK,KAAK,WAAW;GACtD,UAAU,OAAO,OAAe,cAC9B,UAAU,IAAI,MAAM,cAAc,SAAS,KAAK,QAAQ;GAC1D,eAAe,OAAO,WAAmB,YAAoB,UAAwB;IACnF,MAAM,OAAO,KAAK;IAClB,MAAM,SAAS,KAAK;IACpB,MAAM,MAAM,MAAM,KAAK,gBAAgB,SAAS;IAChD,IAAI,CAAC,KACH,OAAO;IAET,MAAM,OAAO,MAAM,OAAO,oBAAoB,UAAU;IACxD,MAAM,UAAU,OAAO,MAAM,KAAK,WAAW,IAAI,IAAI,KAAK,EAAE,IAAI;IAChE,MAAM,QAAQ,UAAU,MAAM,KAAK,SAAS,IAAI,IAAI,QAAQ,IAAI,KAAK,IAAI;IACzE,OAAO;KAAE,OAAO,IAAI;KAAI,QAAQ,MAAM,MAAM;KAAM,WAAW,SAAS,MAAM;KAAM;IAAM;GAC1F;EACF;EACA,UAAU;GACR,qBAAqB,OAAO,OAAgB,OAAO,KAAK,KAAK,OAAO;GACpE,aAAa,OAAO,OAAgB,OAAO,KAAK,KAAK,OAAO;EAC9D;CACF;CACA,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,GAAG;EACpD,MAAM,UAAU,KAAK;EACrB,KAAK,OACH,WACA,OAAO,YAAY,YACnB,SACA,OAAO,UAAU,YACjB,CAAC,MAAM,QAAQ,KAAK,IAChB;GAAE,GAAI;GAAoB,GAAI;EAAiB,IAC/C;CACR;CACA,OAAO;AACT;AAEA,SAAgB,YAAY,WAAsB,QAAe,OAAoB;CACnF,OAAO;EACL;EACA,QAAQ;GACN;GACA,OAAO,IAAI;GACX,QAAQ,KAAK;GACb,WAAW,SAAS;GACpB,WAAW,IAAI;GACf,YAAY,KAAK;EACnB;EACA,WAAW;CACb;AACF;AAEA,MAAM,cAAc;CAClB,2CAA2C;CAC3C,8CAA8C,CAAC;AACjD;AAEA,eAAe,IACb,KACA,OACA,QACA,QACA,MACA;CACA,MAAM,UAAU,uBAAuB,iBAAiB,KAAK,KAAK,CAAC;CACnE,MAAM,UAAkC;EACtC,gBAAgB;EAChB,wBAAwB;EACxB,cAAc;CAChB;CACA,IAAI,MACF,QAAQ,cAAc;CAcxB,MAAM,OAAQ,OAAM,MAZG,QAAQ,MAC7B,IAAI,QAAQ,6BAA6B;EACvC,QAAQ;EACR;EACA,MAAM,KAAK,UAAU;GACnB,SAAS;GACT,IAAI;GACJ;GACA,QAAQ;IAAE,GAAG;IAAQ,OAAO;GAAY;EAC1C,CAAC;CACH,CAAC,CACH,EAAA,CAC6B,KAAK;CAIlC,IAAI,KAAK,OACP,MAAM,IAAI,MAAM,KAAK,MAAM,OAAO;CAEpC,OAAO,KAAK;AACd;AAEA,eAAsB,UAAU,KAAkB,QAAyB,OAAO;CAEhF,QAAO,MADc,IAAI,KAAK,OAAO,cAAc,CAAC,CAAC,EAAA,CACvC;AAKhB;AAEA,eAAsB,SACpB,MACA,MACA,KACA,QAAyB,OACzB;CACA,OAAQ,MAAM,IAAI,KAAK,OAAO,cAAc;EAAE;EAAM,WAAW;CAAK,GAAG,IAAI;AAK7E;AAIA,SAAgB,UAAU,OAAoC;CAC5D,OAAO,MAAM,KAAK,SAAS;EAAC,KAAK;EAAM,KAAK;EAAM,KAAK;EAAY,KAAK;CAAS,CAAC;AACpF;AAWA,SAAS,YAAY,MAAc,SAAkB,OAA6C;CAChG,MAAM,OAAO,KAAK,MAAM,GAAG;CAE3B,IAAI,OAAgC,GADrB,KAAK,IAAI,KAAK,KAEjB,OAAO,GAAG,SAAoB;EACtC,MAAM,KAAK,IAAI;EACf,OAAO;CACT,EACF;CACA,KAAK,MAAM,OAAO,KAAK,QAAQ,GAC7B,OAAO,GAAG,MAAM,KAAK;CAEvB,OAAO;AACT;AAEA,eAAsB,QAAQ,OAAwB,GAA4B;CAChF,MAAM,QAAqB,CAAC;CAC5B,MAAM,UAAU,aAAa,IAAI,EAAE,UAAU,EAAE,IAAI,SAAS;CAC5D,MAAM,MAAM,YAAY,cAAc,YAAY,EAAE,SAAS,SAAS,KAAK,CAAC,CAAC;CAC7E,MAAM,SAAS,MAAM,SAAS,EAAE,MAAM,EAAE,MAAM,KAAK,KAAK;CACxD,aAAO,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,KAAK;CAC1C,aAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;CAClC,aAAO,OAAO,iBAAiB,CAAC,CAAC,QAC/B,aAAa,WAAW,IAAI,EAAE,QAAQ,OAAO,CAAC,CAAC,iBACjD;AACF"}

package/dist/http/mcp/tool.d.ts

@@ -1,11 +1,10 @@
 import { Container } from "../../app/container.js";
-import { OrgScope } from "../scope.js";
-import { AccessScope } from "@headless-lms/core/organizations";
+import { Caller } from "../scope.js";
 import { z } from "zod";
 //#region src/http/mcp/tool.d.ts
 interface ToolContext {
   container: Container;
-  scope: OrgScope;
+  caller: Caller;
   requestId: string;
 }
 type ToolKind = 'read' | 'write' | 'destructive';
@@ -13,7 +12,6 @@ interface Tool {
   name: string;
   title: string;
   description: string;
-  scope: AccessScope;
   kind: ToolKind;
   idempotent: boolean;
   openWorld: boolean;
@@ -26,10 +24,6 @@ interface ToolDef<Input extends z.ZodObject> extends Omit<Tool, 'input' | 'call'
   call(input: z.output<Input>, ctx: ToolContext): unknown;
 }
 declare const noInput: z.ZodObject<{}, z.core.$strip>;
-declare const actor: (scope: OrgScope) => {
-  id: string;
-  role: import("@headless-lms/core/organizations").StaffRole;
-};
 declare function defineTool<Input extends z.ZodObject>(def: ToolDef<Input>): Tool;
 interface ToolResult {
   [key: string]: unknown;
@@ -44,5 +38,5 @@ declare function toolError(message: string): ToolResult;
 declare function toToolResult(data: unknown): ToolResult;
 declare function runTool(tool: Tool, args: unknown, ctx: ToolContext): Promise<ToolResult>;
 //#endregion
-export { Tool, ToolContext, ToolDef, ToolKind, ToolResult, actor, defineTool, noInput, runTool, toToolResult, toolError };
+export { Tool, ToolContext, ToolDef, ToolKind, ToolResult, defineTool, noInput, runTool, toToolResult, toolError };
 //# sourceMappingURL=tool.d.ts.map