@headless-lms/server 0.4.0 → 0.6.0

package/dist/http/mcp/test-support.d.ts

@@ -1,6 +1,6 @@
 import { Container } from "../../app/container.js";
 import { Tool, ToolContext, ToolKind } from "./tool.js";
-import { AccessScope, StaffRole } from "@headless-lms/core/organizations";
+import { Actor } from "@headless-lms/core/shared/actor";
 //#region src/http/mcp/test-support.d.ts
 declare const ORG: {
   id: string;
@@ -19,10 +19,11 @@ declare const ORG_USER: {
   id: string;
   orgId: string;
   userId: string;
-  role: string;
+  status: string;
 };
+declare const OWNER: Actor;
 declare function fakeContainer(overrides?: Record<string, unknown>): Container;
-declare function toolContext(container: Container, role?: StaffRole): ToolContext;
+declare function toolContext(container: Container, actor?: Actor): ToolContext;
 declare function listTools(ctx: ToolContext, tools?: readonly Tool[]): Promise<{
   name: string;
   annotations?: Record<string, unknown>;
@@ -39,7 +40,7 @@ declare function callTool(name: string, args: unknown, ctx: ToolContext, tools?:
     text?: string;
   }>;
 }>;
-type ToolSpec = [name: string, scope: AccessScope, kind: ToolKind, idempotent: boolean, openWorld: boolean];
+type ToolSpec = [name: string, kind: ToolKind, idempotent: boolean, openWorld: boolean];
 declare function toolSpecs(tools: readonly Tool[]): ToolSpec[];
 type ToolCase = {
   tool: string;
@@ -51,5 +52,5 @@ type ToolCase = {
 };
 declare function runCase(tools: readonly Tool[], c: ToolCase): Promise<void>;
 //#endregion
-export { ORG, ORG_USER, ToolCase, ToolSpec, USER, callTool, fakeContainer, listTools, runCase, toolContext, toolSpecs };
+export { ORG, ORG_USER, OWNER, ToolCase, ToolSpec, USER, callTool, fakeContainer, listTools, runCase, toolContext, toolSpecs };
 //# sourceMappingURL=test-support.d.ts.map

package/dist/http/mcp/test-support.js

@@ -3,7 +3,7 @@ import { toToolResult } from "./tool.js";
 import { createToolServer } from "./server.js";
 import { TOOLS } from "./tools/index.js";
 import { a as globalExpect } from "../../node_modules/.pnpm/vitest@2.1.9_@types_node@22.20.0_jsdom@25.0.1_lightningcss@1.32.0/node_modules/vitest/dist/chunks/vi.DgezovHB.js";
-import { ACCESS_SCOPES } from "@headless-lms/core/organizations";
+import { ALL_PERMISSIONS, actorWith } from "@headless-lms/core/organizations";
 import { createMcpHandler } from "@modelcontextprotocol/server";
 //#region src/http/mcp/test-support.ts
 const ORG = {
@@ -23,8 +23,13 @@ const ORG_USER = {
 	id: "ou_1",
 	orgId: "org_1",
 	userId: "usr_1",
-	role: "owner"
+	status: "active"
 };
+const OWNER = actorWith({
+	id: ORG_USER.id,
+	orgId: ORG.id,
+	owner: true
+});
 function fakeContainer(overrides = {}) {
 	const logger = {
 		debug: () => {},
@@ -46,13 +51,29 @@ function fakeContainer(overrides = {}) {
 		auth: { verifyAccess: async () => ({
 			userId: USER.id,
 			orgId: ORG.id,
-			scopes: [...ACCESS_SCOPES],
-			clientId: "client_1"
+			clientId: "client_1",
+			limit: { scopes: [...ALL_PERMISSIONS] }
 		}) },
 		organizations: {
 			getById: async (id) => id === ORG.id ? ORG : null,
 			getByExternalId: async (id) => id === ORG.externalId ? ORG : null,
-			getOrgUser: async (orgId, userId) => orgId === ORG.id && userId === USER.id ? ORG_USER : null
+			getOrgUser: async (orgId, userId) => orgId === ORG.id && userId === USER.id ? ORG_USER : null,
+			actorFor: async (orgId, orgUserId) => orgId === ORG.id && orgUserId === ORG_USER.id ? OWNER : null,
+			resolveCaller: async (authOrgId, authUserId, limit) => {
+				const orgs = base.organizations;
+				const people = base.identity;
+				const org = await orgs.getByExternalId(authOrgId);
+				if (!org) return null;
+				const user = await people.getUserByExternalId(authUserId);
+				const orgUser = user ? await orgs.getOrgUser(org.id, user.id) : null;
+				const actor = orgUser ? await orgs.actorFor(org.id, orgUser.id, limit) : null;
+				return {
+					orgId: org.id,
+					userId: user?.id ?? null,
+					orgUserId: orgUser?.id ?? null,
+					actor
+				};
+			}
 		},
 		identity: {
 			getUserByExternalId: async (id) => id === USER.id ? USER : null,
@@ -68,15 +89,16 @@ function fakeContainer(overrides = {}) {
 	}
 	return base;
 }
-function toolContext(container, role = "owner") {
+function toolContext(container, actor = OWNER) {
 	return {
 		container,
-		scope: {
+		caller: {
+			actor,
 			orgId: ORG.id,
 			userId: USER.id,
 			orgUserId: ORG_USER.id,
-			role,
-			authOrgId: ORG.id
+			authOrgId: ORG.id,
+			authUserId: USER.id
 		},
 		requestId: "req_test"
 	};
@@ -121,7 +143,6 @@ async function callTool(name, args, ctx, tools = TOOLS) {
 function toolSpecs(tools) {
 	return tools.map((tool) => [
 		tool.name,
-		tool.scope,
 		tool.kind,
 		tool.idempotent,
 		tool.openWorld
@@ -146,6 +167,6 @@ async function runCase(tools, c) {
 	globalExpect(result.structuredContent).toEqual(toToolResult("shown" in c ? c.shown : returns).structuredContent);
 }
 //#endregion
-export { ORG, ORG_USER, USER, callTool, fakeContainer, listTools, runCase, toolContext, toolSpecs };
+export { ORG, ORG_USER, OWNER, USER, callTool, fakeContainer, listTools, runCase, toolContext, toolSpecs };
 
 //# sourceMappingURL=test-support.js.map

package/dist/http/mcp/test-support.js.map

@@ -1 +1 @@
-{"version":3,"file":"test-support.js","names":[],"sources":["../../../src/http/mcp/test-support.ts"],"sourcesContent":["import { expect } from 'vitest';\nimport { createMcpHandler } from '@modelcontextprotocol/server';\nimport { ACCESS_SCOPES, type AccessScope, type StaffRole } from '@headless-lms/core/organizations';\nimport type { Container } from '../../app/container.js';\nimport { mcpEndpoints } from '../../app/mcp-endpoints.js';\nimport { createToolServer } from './server.js';\nimport { toToolResult, type Tool, type ToolContext, type ToolKind } from './tool.js';\nimport { TOOLS } from './tools/index.js';\n\nexport const ORG = { id: 'org_1', name: 'Acme', slug: 'acme', externalId: 'org_1' };\nexport const USER = {\n  id: 'usr_1',\n  email: 'owner@acme.test',\n  firstName: 'Ada',\n  lastName: 'Lovelace',\n  externalId: 'usr_1',\n};\nexport const ORG_USER = { id: 'ou_1', orgId: 'org_1', userId: 'usr_1', role: 'owner' };\n\nexport function fakeContainer(overrides: Record<string, unknown> = {}): Container {\n  const logger = {\n    debug: () => {},\n    info: () => {},\n    warn: () => {},\n    error: () => {},\n    child: () => logger,\n  };\n  const base: Record<string, unknown> = {\n    mcp: mcpEndpoints({\n      authBaseURL: 'http://localhost:8100',\n      adminAppUrl: 'http://localhost:8101',\n    }),\n    logger,\n    requestContext: { set: () => {}, run: (_ctx: unknown, fn: () => void) => fn() },\n    auth: {\n      verifyAccess: async () => ({\n        userId: USER.id,\n        orgId: ORG.id,\n        scopes: [...ACCESS_SCOPES],\n        clientId: 'client_1',\n      }),\n    },\n    organizations: {\n      getById: async (id: string) => (id === ORG.id ? ORG : null),\n      getByExternalId: async (id: string) => (id === ORG.externalId ? ORG : null),\n      getOrgUser: async (orgId: string, userId: string) =>\n        orgId === ORG.id && userId === USER.id ? ORG_USER : null,\n    },\n    identity: {\n      getUserByExternalId: async (id: string) => (id === USER.id ? USER : null),\n      getUserById: async (id: string) => (id === USER.id ? USER : null),\n    },\n  };\n  for (const [key, value] of Object.entries(overrides)) {\n    const current = base[key];\n    base[key] =\n      current &&\n      typeof current === 'object' &&\n      value &&\n      typeof value === 'object' &&\n      !Array.isArray(value)\n        ? { ...(current as object), ...(value as object) }\n        : value;\n  }\n  return base as unknown as Container;\n}\n\nexport function toolContext(container: Container, role: StaffRole = 'owner'): ToolContext {\n  return {\n    container,\n    scope: { orgId: ORG.id, userId: USER.id, orgUserId: ORG_USER.id, role, authOrgId: ORG.id },\n    requestId: 'req_test',\n  };\n}\n\nconst MODERN_META = {\n  'io.modelcontextprotocol/protocolVersion': '2026-07-28',\n  'io.modelcontextprotocol/clientCapabilities': {},\n};\n\nasync function rpc(\n  ctx: ToolContext,\n  tools: readonly Tool[],\n  method: string,\n  params: Record<string, unknown>,\n  name?: string,\n) {\n  const handler = createMcpHandler(() => createToolServer(ctx, tools));\n  const headers: Record<string, string> = {\n    'content-type': 'application/json',\n    'mcp-protocol-version': '2026-07-28',\n    'mcp-method': method,\n  };\n  if (name) {\n    headers['mcp-name'] = name;\n  }\n  const response = await handler.fetch(\n    new Request('http://localhost:8100/mcp', {\n      method: 'POST',\n      headers,\n      body: JSON.stringify({\n        jsonrpc: '2.0',\n        id: 1,\n        method,\n        params: { ...params, _meta: MODERN_META },\n      }),\n    }),\n  );\n  const body = (await response.json()) as {\n    result?: Record<string, unknown>;\n    error?: { message: string };\n  };\n  if (body.error) {\n    throw new Error(body.error.message);\n  }\n  return body.result as Record<string, unknown>;\n}\n\nexport async function listTools(ctx: ToolContext, tools: readonly Tool[] = TOOLS) {\n  const result = await rpc(ctx, tools, 'tools/list', {});\n  return result.tools as Array<{\n    name: string;\n    annotations?: Record<string, unknown>;\n    inputSchema: { type?: string; properties?: Record<string, unknown> };\n  }>;\n}\n\nexport async function callTool(\n  name: string,\n  args: unknown,\n  ctx: ToolContext,\n  tools: readonly Tool[] = TOOLS,\n) {\n  return (await rpc(ctx, tools, 'tools/call', { name, arguments: args }, name)) as {\n    isError?: boolean;\n    structuredContent?: Record<string, unknown>;\n    content: Array<{ type: string; text?: string }>;\n  };\n}\n\nexport type ToolSpec = [\n  name: string,\n  scope: AccessScope,\n  kind: ToolKind,\n  idempotent: boolean,\n  openWorld: boolean,\n];\n\nexport function toolSpecs(tools: readonly Tool[]): ToolSpec[] {\n  return tools.map((tool) => [tool.name, tool.scope, tool.kind, tool.idempotent, tool.openWorld]);\n}\n\nexport type ToolCase = {\n  tool: string;\n  args: Record<string, unknown>;\n  service: string;\n  expected: unknown[];\n  returns?: unknown;\n  shown?: unknown;\n};\n\nfunction serviceFake(path: string, returns: unknown, calls: unknown[][]): Record<string, unknown> {\n  const keys = path.split('.');\n  const method = keys.pop() ?? '';\n  let node: Record<string, unknown> = {\n    [method]: async (...args: unknown[]) => {\n      calls.push(args);\n      return returns;\n    },\n  };\n  for (const key of keys.reverse()) {\n    node = { [key]: node };\n  }\n  return node;\n}\n\nexport async function runCase(tools: readonly Tool[], c: ToolCase): Promise<void> {\n  const calls: unknown[][] = [];\n  const returns = 'returns' in c ? c.returns : { id: 'result' };\n  const ctx = toolContext(fakeContainer(serviceFake(c.service, returns, calls)));\n  const result = await callTool(c.tool, c.args, ctx, tools);\n  expect(result.isError ?? false).toBe(false);\n  expect(calls).toEqual([c.expected]);\n  expect(result.structuredContent).toEqual(\n    toToolResult('shown' in c ? c.shown : returns).structuredContent,\n  );\n}\n"],"mappings":";;;;;;;;AASA,MAAa,MAAM;CAAE,IAAI;CAAS,MAAM;CAAQ,MAAM;CAAQ,YAAY;AAAQ;AAClF,MAAa,OAAO;CAClB,IAAI;CACJ,OAAO;CACP,WAAW;CACX,UAAU;CACV,YAAY;AACd;AACA,MAAa,WAAW;CAAE,IAAI;CAAQ,OAAO;CAAS,QAAQ;CAAS,MAAM;AAAQ;AAErF,SAAgB,cAAc,YAAqC,CAAC,GAAc;CAChF,MAAM,SAAS;EACb,aAAa,CAAC;EACd,YAAY,CAAC;EACb,YAAY,CAAC;EACb,aAAa,CAAC;EACd,aAAa;CACf;CACA,MAAM,OAAgC;EACpC,KAAK,aAAa;GAChB,aAAa;GACb,aAAa;EACf,CAAC;EACD;EACA,gBAAgB;GAAE,WAAW,CAAC;GAAG,MAAM,MAAe,OAAmB,GAAG;EAAE;EAC9E,MAAM,EACJ,cAAc,aAAa;GACzB,QAAQ,KAAK;GACb,OAAO,IAAI;GACX,QAAQ,CAAC,GAAG,aAAa;GACzB,UAAU;EACZ,GACF;EACA,eAAe;GACb,SAAS,OAAO,OAAgB,OAAO,IAAI,KAAK,MAAM;GACtD,iBAAiB,OAAO,OAAgB,OAAO,IAAI,aAAa,MAAM;GACtE,YAAY,OAAO,OAAe,WAChC,UAAU,IAAI,MAAM,WAAW,KAAK,KAAK,WAAW;EACxD;EACA,UAAU;GACR,qBAAqB,OAAO,OAAgB,OAAO,KAAK,KAAK,OAAO;GACpE,aAAa,OAAO,OAAgB,OAAO,KAAK,KAAK,OAAO;EAC9D;CACF;CACA,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,GAAG;EACpD,MAAM,UAAU,KAAK;EACrB,KAAK,OACH,WACA,OAAO,YAAY,YACnB,SACA,OAAO,UAAU,YACjB,CAAC,MAAM,QAAQ,KAAK,IAChB;GAAE,GAAI;GAAoB,GAAI;EAAiB,IAC/C;CACR;CACA,OAAO;AACT;AAEA,SAAgB,YAAY,WAAsB,OAAkB,SAAsB;CACxF,OAAO;EACL;EACA,OAAO;GAAE,OAAO,IAAI;GAAI,QAAQ,KAAK;GAAI,WAAW,SAAS;GAAI;GAAM,WAAW,IAAI;EAAG;EACzF,WAAW;CACb;AACF;AAEA,MAAM,cAAc;CAClB,2CAA2C;CAC3C,8CAA8C,CAAC;AACjD;AAEA,eAAe,IACb,KACA,OACA,QACA,QACA,MACA;CACA,MAAM,UAAU,uBAAuB,iBAAiB,KAAK,KAAK,CAAC;CACnE,MAAM,UAAkC;EACtC,gBAAgB;EAChB,wBAAwB;EACxB,cAAc;CAChB;CACA,IAAI,MACF,QAAQ,cAAc;CAcxB,MAAM,OAAQ,OAAM,MAZG,QAAQ,MAC7B,IAAI,QAAQ,6BAA6B;EACvC,QAAQ;EACR;EACA,MAAM,KAAK,UAAU;GACnB,SAAS;GACT,IAAI;GACJ;GACA,QAAQ;IAAE,GAAG;IAAQ,OAAO;GAAY;EAC1C,CAAC;CACH,CAAC,CACH,EAAA,CAC6B,KAAK;CAIlC,IAAI,KAAK,OACP,MAAM,IAAI,MAAM,KAAK,MAAM,OAAO;CAEpC,OAAO,KAAK;AACd;AAEA,eAAsB,UAAU,KAAkB,QAAyB,OAAO;CAEhF,QAAO,MADc,IAAI,KAAK,OAAO,cAAc,CAAC,CAAC,EAAA,CACvC;AAKhB;AAEA,eAAsB,SACpB,MACA,MACA,KACA,QAAyB,OACzB;CACA,OAAQ,MAAM,IAAI,KAAK,OAAO,cAAc;EAAE;EAAM,WAAW;CAAK,GAAG,IAAI;AAK7E;AAUA,SAAgB,UAAU,OAAoC;CAC5D,OAAO,MAAM,KAAK,SAAS;EAAC,KAAK;EAAM,KAAK;EAAO,KAAK;EAAM,KAAK;EAAY,KAAK;CAAS,CAAC;AAChG;AAWA,SAAS,YAAY,MAAc,SAAkB,OAA6C;CAChG,MAAM,OAAO,KAAK,MAAM,GAAG;CAE3B,IAAI,OAAgC,GADrB,KAAK,IAAI,KAAK,KAEjB,OAAO,GAAG,SAAoB;EACtC,MAAM,KAAK,IAAI;EACf,OAAO;CACT,EACF;CACA,KAAK,MAAM,OAAO,KAAK,QAAQ,GAC7B,OAAO,GAAG,MAAM,KAAK;CAEvB,OAAO;AACT;AAEA,eAAsB,QAAQ,OAAwB,GAA4B;CAChF,MAAM,QAAqB,CAAC;CAC5B,MAAM,UAAU,aAAa,IAAI,EAAE,UAAU,EAAE,IAAI,SAAS;CAC5D,MAAM,MAAM,YAAY,cAAc,YAAY,EAAE,SAAS,SAAS,KAAK,CAAC,CAAC;CAC7E,MAAM,SAAS,MAAM,SAAS,EAAE,MAAM,EAAE,MAAM,KAAK,KAAK;CACxD,aAAO,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,KAAK;CAC1C,aAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;CAClC,aAAO,OAAO,iBAAiB,CAAC,CAAC,QAC/B,aAAa,WAAW,IAAI,EAAE,QAAQ,OAAO,CAAC,CAAC,iBACjD;AACF"}
+{"version":3,"file":"test-support.js","names":[],"sources":["../../../src/http/mcp/test-support.ts"],"sourcesContent":["import { expect } from 'vitest';\nimport { createMcpHandler } from '@modelcontextprotocol/server';\nimport { ALL_PERMISSIONS, actorWith } from '@headless-lms/core/organizations';\nimport type { Actor } from '@headless-lms/core/shared/actor';\nimport type { CallerLimit } from '@headless-lms/core/organizations';\nimport type { Container } from '../../app/container.js';\nimport { mcpEndpoints } from '../../app/mcp-endpoints.js';\nimport { createToolServer } from './server.js';\nimport { toToolResult, type Tool, type ToolContext, type ToolKind } from './tool.js';\nimport { TOOLS } from './tools/index.js';\n\nexport const ORG = { id: 'org_1', name: 'Acme', slug: 'acme', externalId: 'org_1' };\nexport const USER = {\n  id: 'usr_1',\n  email: 'owner@acme.test',\n  firstName: 'Ada',\n  lastName: 'Lovelace',\n  externalId: 'usr_1',\n};\nexport const ORG_USER = { id: 'ou_1', orgId: 'org_1', userId: 'usr_1', status: 'active' };\nexport const OWNER: Actor = actorWith({ id: ORG_USER.id, orgId: ORG.id, owner: true });\n\ntype Lookups = {\n  getByExternalId: (id: string) => Promise<{ id: string } | null>;\n  getUserByExternalId: (id: string) => Promise<{ id: string } | null>;\n  getOrgUser: (orgId: string, userId: string) => Promise<{ id: string } | null>;\n  actorFor: (orgId: string, orgUserId: string, limit?: CallerLimit) => Promise<Actor | null>;\n};\n\nexport function fakeContainer(overrides: Record<string, unknown> = {}): Container {\n  const logger = {\n    debug: () => {},\n    info: () => {},\n    warn: () => {},\n    error: () => {},\n    child: () => logger,\n  };\n  const base: Record<string, unknown> = {\n    mcp: mcpEndpoints({\n      authBaseURL: 'http://localhost:8100',\n      adminAppUrl: 'http://localhost:8101',\n    }),\n    logger,\n    requestContext: { set: () => {}, run: (_ctx: unknown, fn: () => void) => fn() },\n    auth: {\n      verifyAccess: async () => ({\n        userId: USER.id,\n        orgId: ORG.id,\n        clientId: 'client_1',\n        limit: { scopes: [...ALL_PERMISSIONS] },\n      }),\n    },\n    organizations: {\n      getById: async (id: string) => (id === ORG.id ? ORG : null),\n      getByExternalId: async (id: string) => (id === ORG.externalId ? ORG : null),\n      getOrgUser: async (orgId: string, userId: string) =>\n        orgId === ORG.id && userId === USER.id ? ORG_USER : null,\n      actorFor: async (orgId: string, orgUserId: string) =>\n        orgId === ORG.id && orgUserId === ORG_USER.id ? OWNER : null,\n      resolveCaller: async (authOrgId: string, authUserId: string, limit?: CallerLimit) => {\n        const orgs = base.organizations as Lookups;\n        const people = base.identity as Pick<Lookups, 'getUserByExternalId'>;\n        const org = await orgs.getByExternalId(authOrgId);\n        if (!org) {\n          return null;\n        }\n        const user = await people.getUserByExternalId(authUserId);\n        const orgUser = user ? await orgs.getOrgUser(org.id, user.id) : null;\n        const actor = orgUser ? await orgs.actorFor(org.id, orgUser.id, limit) : null;\n        return { orgId: org.id, userId: user?.id ?? null, orgUserId: orgUser?.id ?? null, actor };\n      },\n    },\n    identity: {\n      getUserByExternalId: async (id: string) => (id === USER.id ? USER : null),\n      getUserById: async (id: string) => (id === USER.id ? USER : null),\n    },\n  };\n  for (const [key, value] of Object.entries(overrides)) {\n    const current = base[key];\n    base[key] =\n      current &&\n      typeof current === 'object' &&\n      value &&\n      typeof value === 'object' &&\n      !Array.isArray(value)\n        ? { ...(current as object), ...(value as object) }\n        : value;\n  }\n  return base as unknown as Container;\n}\n\nexport function toolContext(container: Container, actor: Actor = OWNER): ToolContext {\n  return {\n    container,\n    caller: {\n      actor,\n      orgId: ORG.id,\n      userId: USER.id,\n      orgUserId: ORG_USER.id,\n      authOrgId: ORG.id,\n      authUserId: USER.id,\n    },\n    requestId: 'req_test',\n  };\n}\n\nconst MODERN_META = {\n  'io.modelcontextprotocol/protocolVersion': '2026-07-28',\n  'io.modelcontextprotocol/clientCapabilities': {},\n};\n\nasync function rpc(\n  ctx: ToolContext,\n  tools: readonly Tool[],\n  method: string,\n  params: Record<string, unknown>,\n  name?: string,\n) {\n  const handler = createMcpHandler(() => createToolServer(ctx, tools));\n  const headers: Record<string, string> = {\n    'content-type': 'application/json',\n    'mcp-protocol-version': '2026-07-28',\n    'mcp-method': method,\n  };\n  if (name) {\n    headers['mcp-name'] = name;\n  }\n  const response = await handler.fetch(\n    new Request('http://localhost:8100/mcp', {\n      method: 'POST',\n      headers,\n      body: JSON.stringify({\n        jsonrpc: '2.0',\n        id: 1,\n        method,\n        params: { ...params, _meta: MODERN_META },\n      }),\n    }),\n  );\n  const body = (await response.json()) as {\n    result?: Record<string, unknown>;\n    error?: { message: string };\n  };\n  if (body.error) {\n    throw new Error(body.error.message);\n  }\n  return body.result as Record<string, unknown>;\n}\n\nexport async function listTools(ctx: ToolContext, tools: readonly Tool[] = TOOLS) {\n  const result = await rpc(ctx, tools, 'tools/list', {});\n  return result.tools as Array<{\n    name: string;\n    annotations?: Record<string, unknown>;\n    inputSchema: { type?: string; properties?: Record<string, unknown> };\n  }>;\n}\n\nexport async function callTool(\n  name: string,\n  args: unknown,\n  ctx: ToolContext,\n  tools: readonly Tool[] = TOOLS,\n) {\n  return (await rpc(ctx, tools, 'tools/call', { name, arguments: args }, name)) as {\n    isError?: boolean;\n    structuredContent?: Record<string, unknown>;\n    content: Array<{ type: string; text?: string }>;\n  };\n}\n\nexport type ToolSpec = [name: string, kind: ToolKind, idempotent: boolean, openWorld: boolean];\n\nexport function toolSpecs(tools: readonly Tool[]): ToolSpec[] {\n  return tools.map((tool) => [tool.name, tool.kind, tool.idempotent, tool.openWorld]);\n}\n\nexport type ToolCase = {\n  tool: string;\n  args: Record<string, unknown>;\n  service: string;\n  expected: unknown[];\n  returns?: unknown;\n  shown?: unknown;\n};\n\nfunction serviceFake(path: string, returns: unknown, calls: unknown[][]): Record<string, unknown> {\n  const keys = path.split('.');\n  const method = keys.pop() ?? '';\n  let node: Record<string, unknown> = {\n    [method]: async (...args: unknown[]) => {\n      calls.push(args);\n      return returns;\n    },\n  };\n  for (const key of keys.reverse()) {\n    node = { [key]: node };\n  }\n  return node;\n}\n\nexport async function runCase(tools: readonly Tool[], c: ToolCase): Promise<void> {\n  const calls: unknown[][] = [];\n  const returns = 'returns' in c ? c.returns : { id: 'result' };\n  const ctx = toolContext(fakeContainer(serviceFake(c.service, returns, calls)));\n  const result = await callTool(c.tool, c.args, ctx, tools);\n  expect(result.isError ?? false).toBe(false);\n  expect(calls).toEqual([c.expected]);\n  expect(result.structuredContent).toEqual(\n    toToolResult('shown' in c ? c.shown : returns).structuredContent,\n  );\n}\n"],"mappings":";;;;;;;;AAWA,MAAa,MAAM;CAAE,IAAI;CAAS,MAAM;CAAQ,MAAM;CAAQ,YAAY;AAAQ;AAClF,MAAa,OAAO;CAClB,IAAI;CACJ,OAAO;CACP,WAAW;CACX,UAAU;CACV,YAAY;AACd;AACA,MAAa,WAAW;CAAE,IAAI;CAAQ,OAAO;CAAS,QAAQ;CAAS,QAAQ;AAAS;AACxF,MAAa,QAAe,UAAU;CAAE,IAAI,SAAS;CAAI,OAAO,IAAI;CAAI,OAAO;AAAK,CAAC;AASrF,SAAgB,cAAc,YAAqC,CAAC,GAAc;CAChF,MAAM,SAAS;EACb,aAAa,CAAC;EACd,YAAY,CAAC;EACb,YAAY,CAAC;EACb,aAAa,CAAC;EACd,aAAa;CACf;CACA,MAAM,OAAgC;EACpC,KAAK,aAAa;GAChB,aAAa;GACb,aAAa;EACf,CAAC;EACD;EACA,gBAAgB;GAAE,WAAW,CAAC;GAAG,MAAM,MAAe,OAAmB,GAAG;EAAE;EAC9E,MAAM,EACJ,cAAc,aAAa;GACzB,QAAQ,KAAK;GACb,OAAO,IAAI;GACX,UAAU;GACV,OAAO,EAAE,QAAQ,CAAC,GAAG,eAAe,EAAE;EACxC,GACF;EACA,eAAe;GACb,SAAS,OAAO,OAAgB,OAAO,IAAI,KAAK,MAAM;GACtD,iBAAiB,OAAO,OAAgB,OAAO,IAAI,aAAa,MAAM;GACtE,YAAY,OAAO,OAAe,WAChC,UAAU,IAAI,MAAM,WAAW,KAAK,KAAK,WAAW;GACtD,UAAU,OAAO,OAAe,cAC9B,UAAU,IAAI,MAAM,cAAc,SAAS,KAAK,QAAQ;GAC1D,eAAe,OAAO,WAAmB,YAAoB,UAAwB;IACnF,MAAM,OAAO,KAAK;IAClB,MAAM,SAAS,KAAK;IACpB,MAAM,MAAM,MAAM,KAAK,gBAAgB,SAAS;IAChD,IAAI,CAAC,KACH,OAAO;IAET,MAAM,OAAO,MAAM,OAAO,oBAAoB,UAAU;IACxD,MAAM,UAAU,OAAO,MAAM,KAAK,WAAW,IAAI,IAAI,KAAK,EAAE,IAAI;IAChE,MAAM,QAAQ,UAAU,MAAM,KAAK,SAAS,IAAI,IAAI,QAAQ,IAAI,KAAK,IAAI;IACzE,OAAO;KAAE,OAAO,IAAI;KAAI,QAAQ,MAAM,MAAM;KAAM,WAAW,SAAS,MAAM;KAAM;IAAM;GAC1F;EACF;EACA,UAAU;GACR,qBAAqB,OAAO,OAAgB,OAAO,KAAK,KAAK,OAAO;GACpE,aAAa,OAAO,OAAgB,OAAO,KAAK,KAAK,OAAO;EAC9D;CACF;CACA,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,GAAG;EACpD,MAAM,UAAU,KAAK;EACrB,KAAK,OACH,WACA,OAAO,YAAY,YACnB,SACA,OAAO,UAAU,YACjB,CAAC,MAAM,QAAQ,KAAK,IAChB;GAAE,GAAI;GAAoB,GAAI;EAAiB,IAC/C;CACR;CACA,OAAO;AACT;AAEA,SAAgB,YAAY,WAAsB,QAAe,OAAoB;CACnF,OAAO;EACL;EACA,QAAQ;GACN;GACA,OAAO,IAAI;GACX,QAAQ,KAAK;GACb,WAAW,SAAS;GACpB,WAAW,IAAI;GACf,YAAY,KAAK;EACnB;EACA,WAAW;CACb;AACF;AAEA,MAAM,cAAc;CAClB,2CAA2C;CAC3C,8CAA8C,CAAC;AACjD;AAEA,eAAe,IACb,KACA,OACA,QACA,QACA,MACA;CACA,MAAM,UAAU,uBAAuB,iBAAiB,KAAK,KAAK,CAAC;CACnE,MAAM,UAAkC;EACtC,gBAAgB;EAChB,wBAAwB;EACxB,cAAc;CAChB;CACA,IAAI,MACF,QAAQ,cAAc;CAcxB,MAAM,OAAQ,OAAM,MAZG,QAAQ,MAC7B,IAAI,QAAQ,6BAA6B;EACvC,QAAQ;EACR;EACA,MAAM,KAAK,UAAU;GACnB,SAAS;GACT,IAAI;GACJ;GACA,QAAQ;IAAE,GAAG;IAAQ,OAAO;GAAY;EAC1C,CAAC;CACH,CAAC,CACH,EAAA,CAC6B,KAAK;CAIlC,IAAI,KAAK,OACP,MAAM,IAAI,MAAM,KAAK,MAAM,OAAO;CAEpC,OAAO,KAAK;AACd;AAEA,eAAsB,UAAU,KAAkB,QAAyB,OAAO;CAEhF,QAAO,MADc,IAAI,KAAK,OAAO,cAAc,CAAC,CAAC,EAAA,CACvC;AAKhB;AAEA,eAAsB,SACpB,MACA,MACA,KACA,QAAyB,OACzB;CACA,OAAQ,MAAM,IAAI,KAAK,OAAO,cAAc;EAAE;EAAM,WAAW;CAAK,GAAG,IAAI;AAK7E;AAIA,SAAgB,UAAU,OAAoC;CAC5D,OAAO,MAAM,KAAK,SAAS;EAAC,KAAK;EAAM,KAAK;EAAM,KAAK;EAAY,KAAK;CAAS,CAAC;AACpF;AAWA,SAAS,YAAY,MAAc,SAAkB,OAA6C;CAChG,MAAM,OAAO,KAAK,MAAM,GAAG;CAE3B,IAAI,OAAgC,GADrB,KAAK,IAAI,KAAK,KAEjB,OAAO,GAAG,SAAoB;EACtC,MAAM,KAAK,IAAI;EACf,OAAO;CACT,EACF;CACA,KAAK,MAAM,OAAO,KAAK,QAAQ,GAC7B,OAAO,GAAG,MAAM,KAAK;CAEvB,OAAO;AACT;AAEA,eAAsB,QAAQ,OAAwB,GAA4B;CAChF,MAAM,QAAqB,CAAC;CAC5B,MAAM,UAAU,aAAa,IAAI,EAAE,UAAU,EAAE,IAAI,SAAS;CAC5D,MAAM,MAAM,YAAY,cAAc,YAAY,EAAE,SAAS,SAAS,KAAK,CAAC,CAAC;CAC7E,MAAM,SAAS,MAAM,SAAS,EAAE,MAAM,EAAE,MAAM,KAAK,KAAK;CACxD,aAAO,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,KAAK;CAC1C,aAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;CAClC,aAAO,OAAO,iBAAiB,CAAC,CAAC,QAC/B,aAAa,WAAW,IAAI,EAAE,QAAQ,OAAO,CAAC,CAAC,iBACjD;AACF"}

package/dist/http/mcp/tool.d.ts

@@ -1,11 +1,10 @@
 import { Container } from "../../app/container.js";
-import { OrgScope } from "../scope.js";
-import { AccessScope } from "@headless-lms/core/organizations";
+import { Caller } from "../scope.js";
 import { z } from "zod";
 //#region src/http/mcp/tool.d.ts
 interface ToolContext {
   container: Container;
-  scope: OrgScope;
+  caller: Caller;
   requestId: string;
 }
 type ToolKind = 'read' | 'write' | 'destructive';
@@ -13,7 +12,6 @@ interface Tool {
   name: string;
   title: string;
   description: string;
-  scope: AccessScope;
   kind: ToolKind;
   idempotent: boolean;
   openWorld: boolean;
@@ -26,10 +24,6 @@ interface ToolDef<Input extends z.ZodObject> extends Omit<Tool, 'input' | 'call'
   call(input: z.output<Input>, ctx: ToolContext): unknown;
 }
 declare const noInput: z.ZodObject<{}, z.core.$strip>;
-declare const actor: (scope: OrgScope) => {
-  id: string;
-  role: import("@headless-lms/core/organizations").StaffRole;
-};
 declare function defineTool<Input extends z.ZodObject>(def: ToolDef<Input>): Tool;
 interface ToolResult {
   [key: string]: unknown;
@@ -44,5 +38,5 @@ declare function toolError(message: string): ToolResult;
 declare function toToolResult(data: unknown): ToolResult;
 declare function runTool(tool: Tool, args: unknown, ctx: ToolContext): Promise<ToolResult>;
 //#endregion
-export { Tool, ToolContext, ToolDef, ToolKind, ToolResult, actor, defineTool, noInput, runTool, toToolResult, toolError };
+export { Tool, ToolContext, ToolDef, ToolKind, ToolResult, defineTool, noInput, runTool, toToolResult, toolError };
 //# sourceMappingURL=tool.d.ts.map

package/dist/http/mcp/tool.js

@@ -1,11 +1,8 @@
 import { classifyError } from "../errors.js";
+import { refusalSubject } from "../plugins/error-handler.js";
 import { z } from "zod";
 //#region src/http/mcp/tool.ts
 const noInput = z.object({});
-const actor = (scope) => ({
-	id: scope.orgUserId,
-	role: scope.role
-});
 function defineTool(def) {
 	return {
 		...def,
@@ -34,7 +31,18 @@ function toToolResult(data) {
 }
 function describeFailure(error, tool, ctx) {
 	const known = classifyError(error);
-	if (known) return known.message;
+	if (known) {
+		ctx.container.logger.info("mcp tool refused", {
+			tool: tool.name,
+			status: known.status,
+			error: known.error,
+			message: known.message,
+			orgId: ctx.caller.orgId,
+			actorId: ctx.caller.orgUserId,
+			...refusalSubject(error)
+		});
+		return known.message;
+	}
 	ctx.container.logger.error("mcp tool failed", {
 		err: error instanceof Error ? error : new Error(String(error)),
 		tool: tool.name
@@ -53,6 +61,6 @@ async function runTool(tool, args, ctx) {
 	}
 }
 //#endregion
-export { actor, defineTool, noInput, runTool, toToolResult, toolError };
+export { defineTool, noInput, runTool, toToolResult, toolError };
 
 //# sourceMappingURL=tool.js.map

package/dist/http/mcp/tool.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool.js","names":[],"sources":["../../../src/http/mcp/tool.ts"],"sourcesContent":["import { z } from 'zod';\nimport type { AccessScope } from '@headless-lms/core/organizations';\nimport type { Container } from '../../app/container.js';\nimport { classifyError } from '../errors.js';\nimport type { OrgScope } from '../scope.js';\n\nexport interface ToolContext {\n  container: Container;\n  scope: OrgScope;\n  requestId: string;\n}\n\nexport type ToolKind = 'read' | 'write' | 'destructive';\n\nexport interface Tool {\n  name: string;\n  title: string;\n  description: string;\n  scope: AccessScope;\n  kind: ToolKind;\n  idempotent: boolean;\n  openWorld: boolean;\n  input: z.ZodObject;\n  output?: z.ZodType;\n  call(input: unknown, ctx: ToolContext): unknown;\n}\n\nexport interface ToolDef<Input extends z.ZodObject> extends Omit<Tool, 'input' | 'call'> {\n  input: Input;\n  call(input: z.output<Input>, ctx: ToolContext): unknown;\n}\n\nexport const noInput = z.object({});\n\nexport const actor = (scope: OrgScope) => ({ id: scope.orgUserId, role: scope.role });\n\nexport function defineTool<Input extends z.ZodObject>(def: ToolDef<Input>): Tool {\n  return { ...def, call: (input, ctx) => def.call(input as z.output<Input>, ctx) };\n}\n\nexport interface ToolResult {\n  [key: string]: unknown;\n  content: Array<{ type: 'text'; text: string }>;\n  structuredContent?: Record<string, unknown>;\n  isError?: boolean;\n}\n\nexport function toolError(message: string): ToolResult {\n  return { content: [{ type: 'text', text: message }], isError: true };\n}\n\nexport function toToolResult(data: unknown): ToolResult {\n  const plain: unknown = JSON.parse(JSON.stringify(data === undefined ? { ok: true } : data));\n  const structuredContent =\n    plain !== null && typeof plain === 'object' && !Array.isArray(plain)\n      ? (plain as Record<string, unknown>)\n      : { result: plain };\n  return {\n    content: [{ type: 'text', text: JSON.stringify(structuredContent) }],\n    structuredContent,\n  };\n}\n\nfunction describeFailure(error: unknown, tool: Tool, ctx: ToolContext): string {\n  const known = classifyError(error);\n  if (known) {\n    return known.message;\n  }\n  ctx.container.logger.error('mcp tool failed', {\n    err: error instanceof Error ? error : new Error(String(error)),\n    tool: tool.name,\n  });\n  return `Internal error (request ${ctx.requestId})`;\n}\n\nexport async function runTool(tool: Tool, args: unknown, ctx: ToolContext): Promise<ToolResult> {\n  const input = tool.input.safeParse(args);\n  if (!input.success) {\n    return toolError(`Invalid input: ${z.prettifyError(input.error)}`);\n  }\n  try {\n    const result = await tool.call(input.data, ctx);\n    if (result === null || result === false) {\n      return toolError('Not found.');\n    }\n    return toToolResult(tool.output && result !== undefined ? tool.output.parse(result) : result);\n  } catch (error) {\n    return toolError(describeFailure(error, tool, ctx));\n  }\n}\n"],"mappings":";;;AAgCA,MAAa,UAAU,EAAE,OAAO,CAAC,CAAC;AAElC,MAAa,SAAS,WAAqB;CAAE,IAAI,MAAM;CAAW,MAAM,MAAM;AAAK;AAEnF,SAAgB,WAAsC,KAA2B;CAC/E,OAAO;EAAE,GAAG;EAAK,OAAO,OAAO,QAAQ,IAAI,KAAK,OAA0B,GAAG;CAAE;AACjF;AASA,SAAgB,UAAU,SAA6B;CACrD,OAAO;EAAE,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM;EAAQ,CAAC;EAAG,SAAS;CAAK;AACrE;AAEA,SAAgB,aAAa,MAA2B;CACtD,MAAM,QAAiB,KAAK,MAAM,KAAK,UAAU,SAAS,KAAA,IAAY,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC;CAC1F,MAAM,oBACJ,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAC9D,QACD,EAAE,QAAQ,MAAM;CACtB,OAAO;EACL,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,iBAAiB;EAAE,CAAC;EACnE;CACF;AACF;AAEA,SAAS,gBAAgB,OAAgB,MAAY,KAA0B;CAC7E,MAAM,QAAQ,cAAc,KAAK;CACjC,IAAI,OACF,OAAO,MAAM;CAEf,IAAI,UAAU,OAAO,MAAM,mBAAmB;EAC5C,KAAK,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;EAC7D,MAAM,KAAK;CACb,CAAC;CACD,OAAO,2BAA2B,IAAI,UAAU;AAClD;AAEA,eAAsB,QAAQ,MAAY,MAAe,KAAuC;CAC9F,MAAM,QAAQ,KAAK,MAAM,UAAU,IAAI;CACvC,IAAI,CAAC,MAAM,SACT,OAAO,UAAU,kBAAkB,EAAE,cAAc,MAAM,KAAK,GAAG;CAEnE,IAAI;EACF,MAAM,SAAS,MAAM,KAAK,KAAK,MAAM,MAAM,GAAG;EAC9C,IAAI,WAAW,QAAQ,WAAW,OAChC,OAAO,UAAU,YAAY;EAE/B,OAAO,aAAa,KAAK,UAAU,WAAW,KAAA,IAAY,KAAK,OAAO,MAAM,MAAM,IAAI,MAAM;CAC9F,SAAS,OAAO;EACd,OAAO,UAAU,gBAAgB,OAAO,MAAM,GAAG,CAAC;CACpD;AACF"}
+{"version":3,"file":"tool.js","names":[],"sources":["../../../src/http/mcp/tool.ts"],"sourcesContent":["import { z } from 'zod';\nimport type { Container } from '../../app/container.js';\nimport { classifyError } from '../errors.js';\nimport { refusalSubject } from '../plugins/error-handler.js';\nimport type { Caller } from '../scope.js';\n\nexport interface ToolContext {\n  container: Container;\n  caller: Caller;\n  requestId: string;\n}\n\nexport type ToolKind = 'read' | 'write' | 'destructive';\n\nexport interface Tool {\n  name: string;\n  title: string;\n  description: string;\n  kind: ToolKind;\n  idempotent: boolean;\n  openWorld: boolean;\n  input: z.ZodObject;\n  output?: z.ZodType;\n  call(input: unknown, ctx: ToolContext): unknown;\n}\n\nexport interface ToolDef<Input extends z.ZodObject> extends Omit<Tool, 'input' | 'call'> {\n  input: Input;\n  call(input: z.output<Input>, ctx: ToolContext): unknown;\n}\n\nexport const noInput = z.object({});\n\nexport function defineTool<Input extends z.ZodObject>(def: ToolDef<Input>): Tool {\n  return { ...def, call: (input, ctx) => def.call(input as z.output<Input>, ctx) };\n}\n\nexport interface ToolResult {\n  [key: string]: unknown;\n  content: Array<{ type: 'text'; text: string }>;\n  structuredContent?: Record<string, unknown>;\n  isError?: boolean;\n}\n\nexport function toolError(message: string): ToolResult {\n  return { content: [{ type: 'text', text: message }], isError: true };\n}\n\nexport function toToolResult(data: unknown): ToolResult {\n  const plain: unknown = JSON.parse(JSON.stringify(data === undefined ? { ok: true } : data));\n  const structuredContent =\n    plain !== null && typeof plain === 'object' && !Array.isArray(plain)\n      ? (plain as Record<string, unknown>)\n      : { result: plain };\n  return {\n    content: [{ type: 'text', text: JSON.stringify(structuredContent) }],\n    structuredContent,\n  };\n}\n\nfunction describeFailure(error: unknown, tool: Tool, ctx: ToolContext): string {\n  const known = classifyError(error);\n  if (known) {\n    ctx.container.logger.info('mcp tool refused', {\n      tool: tool.name,\n      status: known.status,\n      error: known.error,\n      message: known.message,\n      orgId: ctx.caller.orgId,\n      actorId: ctx.caller.orgUserId,\n      ...refusalSubject(error),\n    });\n    return known.message;\n  }\n  ctx.container.logger.error('mcp tool failed', {\n    err: error instanceof Error ? error : new Error(String(error)),\n    tool: tool.name,\n  });\n  return `Internal error (request ${ctx.requestId})`;\n}\n\nexport async function runTool(tool: Tool, args: unknown, ctx: ToolContext): Promise<ToolResult> {\n  const input = tool.input.safeParse(args);\n  if (!input.success) {\n    return toolError(`Invalid input: ${z.prettifyError(input.error)}`);\n  }\n  try {\n    const result = await tool.call(input.data, ctx);\n    if (result === null || result === false) {\n      return toolError('Not found.');\n    }\n    return toToolResult(tool.output && result !== undefined ? tool.output.parse(result) : result);\n  } catch (error) {\n    return toolError(describeFailure(error, tool, ctx));\n  }\n}\n"],"mappings":";;;;AA+BA,MAAa,UAAU,EAAE,OAAO,CAAC,CAAC;AAElC,SAAgB,WAAsC,KAA2B;CAC/E,OAAO;EAAE,GAAG;EAAK,OAAO,OAAO,QAAQ,IAAI,KAAK,OAA0B,GAAG;CAAE;AACjF;AASA,SAAgB,UAAU,SAA6B;CACrD,OAAO;EAAE,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM;EAAQ,CAAC;EAAG,SAAS;CAAK;AACrE;AAEA,SAAgB,aAAa,MAA2B;CACtD,MAAM,QAAiB,KAAK,MAAM,KAAK,UAAU,SAAS,KAAA,IAAY,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC;CAC1F,MAAM,oBACJ,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAC9D,QACD,EAAE,QAAQ,MAAM;CACtB,OAAO;EACL,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,iBAAiB;EAAE,CAAC;EACnE;CACF;AACF;AAEA,SAAS,gBAAgB,OAAgB,MAAY,KAA0B;CAC7E,MAAM,QAAQ,cAAc,KAAK;CACjC,IAAI,OAAO;EACT,IAAI,UAAU,OAAO,KAAK,oBAAoB;GAC5C,MAAM,KAAK;GACX,QAAQ,MAAM;GACd,OAAO,MAAM;GACb,SAAS,MAAM;GACf,OAAO,IAAI,OAAO;GAClB,SAAS,IAAI,OAAO;GACpB,GAAG,eAAe,KAAK;EACzB,CAAC;EACD,OAAO,MAAM;CACf;CACA,IAAI,UAAU,OAAO,MAAM,mBAAmB;EAC5C,KAAK,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;EAC7D,MAAM,KAAK;CACb,CAAC;CACD,OAAO,2BAA2B,IAAI,UAAU;AAClD;AAEA,eAAsB,QAAQ,MAAY,MAAe,KAAuC;CAC9F,MAAM,QAAQ,KAAK,MAAM,UAAU,IAAI;CACvC,IAAI,CAAC,MAAM,SACT,OAAO,UAAU,kBAAkB,EAAE,cAAc,MAAM,KAAK,GAAG;CAEnE,IAAI;EACF,MAAM,SAAS,MAAM,KAAK,KAAK,MAAM,MAAM,GAAG;EAC9C,IAAI,WAAW,QAAQ,WAAW,OAChC,OAAO,UAAU,YAAY;EAE/B,OAAO,aAAa,KAAK,UAAU,WAAW,KAAA,IAAY,KAAK,OAAO,MAAM,MAAM,IAAI,MAAM;CAC9F,SAAS,OAAO;EACd,OAAO,UAAU,gBAAgB,OAAO,MAAM,GAAG,CAAC;CACpD;AACF"}

package/dist/http/mcp/tools/automations.js

@@ -7,111 +7,101 @@ const automationTools = [
 		name: "list_automation_triggers",
 		title: "List workflow triggers",
 		description: "The events that can start a workflow.",
-		scope: "automations:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: noInput,
-		call: (_input, { container }) => container.automations.availableTriggers()
+		call: (_input, { container, caller }) => container.automations.availableTriggers(caller.actor)
 	}),
 	defineTool({
 		name: "list_automation_actions",
 		title: "List workflow actions",
 		description: "The actions a workflow can run, with the settings each one takes.",
-		scope: "automations:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: noInput,
-		call: (_input, { container }) => container.automations.availableActions()
+		call: (_input, { container, caller }) => container.automations.availableActions(caller.actor)
 	}),
 	defineTool({
 		name: "list_automations",
 		title: "List workflows and webhooks",
 		description: "Workflows and webhooks with their triggers, ordered actions and enabled state. Filter by kind (workflow or webhook).",
-		scope: "automations:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: AutomationsQuery,
-		call: (input, { container, scope }) => container.automations.list(scope.orgId, input)
+		call: (input, { container, caller }) => container.automations.list(input, caller.actor)
 	}),
 	defineTool({
 		name: "list_automation_runs",
 		title: "List workflow and webhook runs",
 		description: "Runs of one workflow or webhook, newest first, with the trigger event as a webhook would receive it and each action result.",
-		scope: "automations:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: AutomationRunsQuery.extend(AutomationIdParam.shape),
-		call: ({ id, ...query }, { container, scope }) => container.automations.listRuns(scope.orgId, id, query)
+		call: ({ id, ...query }, { container, caller }) => container.automations.listRuns(id, query, caller.actor)
 	}),
 	defineTool({
 		name: "create_automation",
 		title: "Create workflow",
 		description: "Create a workflow from triggers and ordered actions. Use list_automation_triggers and list_automation_actions for valid values.",
-		scope: "automations:write",
 		kind: "write",
 		idempotent: false,
 		openWorld: false,
 		input: CreateAutomationBody,
-		call: (input, { container, scope }) => container.automations.create(scope.orgId, input)
+		call: (input, { container, caller }) => container.automations.create(input, caller.actor)
 	}),
 	defineTool({
 		name: "update_automation",
 		title: "Update workflow",
 		description: "Change a workflow name, description, triggers or actions, or turn it on and off with enabled. Fields left out stay as they are.",
-		scope: "automations:write",
 		kind: "write",
 		idempotent: true,
 		openWorld: false,
 		input: UpdateAutomationBody.extend(AutomationIdParam.shape),
-		call: ({ id, ...patch }, { container, scope }) => container.automations.update(scope.orgId, id, patch)
+		call: ({ id, ...patch }, { container, caller }) => container.automations.update(id, patch, caller.actor)
 	}),
 	defineTool({
 		name: "rerun_automation_run",
 		title: "Re-run workflow or webhook run",
 		description: "Run a finished workflow or webhook run again with its original trigger event, using the automation's current actions. Emails and webhook deliveries are sent again. The new outcome replaces the run's previous one. A run still in progress can't be re-run.",
-		scope: "automations:write",
 		kind: "write",
 		idempotent: false,
 		openWorld: true,
 		input: AutomationRunParams,
-		call: ({ id, runId }, { container, scope }) => container.automations.rerun(scope.orgId, id, runId)
+		call: ({ id, runId }, { container, caller }) => container.automations.rerun(id, runId, caller.actor)
 	}),
 	defineTool({
 		name: "delete_automation",
 		title: "Delete workflow",
 		description: "Permanently delete a workflow.",
-		scope: "automations:delete",
 		kind: "destructive",
 		idempotent: true,
 		openWorld: false,
 		input: AutomationIdParam,
-		call: ({ id }, { container, scope }) => container.automations.delete(scope.orgId, id)
+		call: ({ id }, { container, caller }) => container.automations.delete(id, caller.actor)
 	}),
 	defineTool({
 		name: "update_webhook",
 		title: "Update webhook",
 		description: "Change a webhook URL, events or description, or turn it on and off with enabled. Fields left out stay as they are.",
-		scope: "automations:write",
 		kind: "write",
 		idempotent: true,
 		openWorld: false,
 		input: UpdateWebhookBody.extend(AutomationIdParam.shape),
-		call: ({ id, ...patch }, { container, scope }) => container.automations.updateWebhook(scope.orgId, id, patch)
+		call: ({ id, ...patch }, { container, caller }) => container.automations.updateWebhook(id, patch, caller.actor)
 	}),
 	defineTool({
 		name: "delete_webhook",
 		title: "Delete webhook",
 		description: "Permanently delete a webhook and its signing secret. Its delivery history is kept.",
-		scope: "automations:delete",
 		kind: "destructive",
 		idempotent: true,
 		openWorld: false,
 		input: AutomationIdParam,
-		call: ({ id }, { container, scope }) => container.automations.deleteWebhook(scope.orgId, id)
+		call: ({ id }, { container, caller }) => container.automations.deleteWebhook(id, caller.actor)
 	})
 ];
 //#endregion

package/dist/http/mcp/tools/automations.js.map

@@ -1 +1 @@
-{"version":3,"file":"automations.js","names":[],"sources":["../../../../src/http/mcp/tools/automations.ts"],"sourcesContent":["import {\n  AutomationIdParam,\n  AutomationRunParams,\n  AutomationRunsQuery,\n  AutomationsQuery,\n  CreateAutomationBody,\n  UpdateAutomationBody,\n  UpdateWebhookBody,\n} from '../../schemas/index.js';\nimport { defineTool, noInput, type Tool } from '../tool.js';\n\nexport const automationTools: Tool[] = [\n  defineTool({\n    name: 'list_automation_triggers',\n    title: 'List workflow triggers',\n    description: 'The events that can start a workflow.',\n    scope: 'automations:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: noInput,\n    call: (_input, { container }) => container.automations.availableTriggers(),\n  }),\n  defineTool({\n    name: 'list_automation_actions',\n    title: 'List workflow actions',\n    description: 'The actions a workflow can run, with the settings each one takes.',\n    scope: 'automations:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: noInput,\n    call: (_input, { container }) => container.automations.availableActions(),\n  }),\n  defineTool({\n    name: 'list_automations',\n    title: 'List workflows and webhooks',\n    description:\n      'Workflows and webhooks with their triggers, ordered actions and enabled state. Filter by kind (workflow or webhook).',\n    scope: 'automations:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: AutomationsQuery,\n    call: (input, { container, scope }) => container.automations.list(scope.orgId, input),\n  }),\n  defineTool({\n    name: 'list_automation_runs',\n    title: 'List workflow and webhook runs',\n    description:\n      'Runs of one workflow or webhook, newest first, with the trigger event as a webhook would receive it and each action result.',\n    scope: 'automations:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: AutomationRunsQuery.extend(AutomationIdParam.shape),\n    call: ({ id, ...query }, { container, scope }) =>\n      container.automations.listRuns(scope.orgId, id, query),\n  }),\n  defineTool({\n    name: 'create_automation',\n    title: 'Create workflow',\n    description:\n      'Create a workflow from triggers and ordered actions. Use list_automation_triggers and list_automation_actions for valid values.',\n    scope: 'automations:write',\n    kind: 'write',\n    idempotent: false,\n    openWorld: false,\n    input: CreateAutomationBody,\n    call: (input, { container, scope }) => container.automations.create(scope.orgId, input),\n  }),\n  defineTool({\n    name: 'update_automation',\n    title: 'Update workflow',\n    description:\n      'Change a workflow name, description, triggers or actions, or turn it on and off with enabled. Fields left out stay as they are.',\n    scope: 'automations:write',\n    kind: 'write',\n    idempotent: true,\n    openWorld: false,\n    input: UpdateAutomationBody.extend(AutomationIdParam.shape),\n    call: ({ id, ...patch }, { container, scope }) =>\n      container.automations.update(scope.orgId, id, patch),\n  }),\n  defineTool({\n    name: 'rerun_automation_run',\n    title: 'Re-run workflow or webhook run',\n    description:\n      \"Run a finished workflow or webhook run again with its original trigger event, using the automation's current actions. Emails and webhook deliveries are sent again. The new outcome replaces the run's previous one. A run still in progress can't be re-run.\",\n    scope: 'automations:write',\n    kind: 'write',\n    idempotent: false,\n    openWorld: true,\n    input: AutomationRunParams,\n    call: ({ id, runId }, { container, scope }) =>\n      container.automations.rerun(scope.orgId, id, runId),\n  }),\n  defineTool({\n    name: 'delete_automation',\n    title: 'Delete workflow',\n    description: 'Permanently delete a workflow.',\n    scope: 'automations:delete',\n    kind: 'destructive',\n    idempotent: true,\n    openWorld: false,\n    input: AutomationIdParam,\n    call: ({ id }, { container, scope }) => container.automations.delete(scope.orgId, id),\n  }),\n  defineTool({\n    name: 'update_webhook',\n    title: 'Update webhook',\n    description:\n      'Change a webhook URL, events or description, or turn it on and off with enabled. Fields left out stay as they are.',\n    scope: 'automations:write',\n    kind: 'write',\n    idempotent: true,\n    openWorld: false,\n    input: UpdateWebhookBody.extend(AutomationIdParam.shape),\n    call: ({ id, ...patch }, { container, scope }) =>\n      container.automations.updateWebhook(scope.orgId, id, patch),\n  }),\n  defineTool({\n    name: 'delete_webhook',\n    title: 'Delete webhook',\n    description:\n      'Permanently delete a webhook and its signing secret. Its delivery history is kept.',\n    scope: 'automations:delete',\n    kind: 'destructive',\n    idempotent: true,\n    openWorld: false,\n    input: AutomationIdParam,\n    call: ({ id }, { container, scope }) => container.automations.deleteWebhook(scope.orgId, id),\n  }),\n];\n"],"mappings":";;;;AAWA,MAAa,kBAA0B;CACrC,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,QAAQ,EAAE,gBAAgB,UAAU,YAAY,kBAAkB;CAC3E,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,QAAQ,EAAE,gBAAgB,UAAU,YAAY,iBAAiB;CAC1E,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,YAAY,UAAU,YAAY,KAAK,MAAM,OAAO,KAAK;CACtF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,oBAAoB,OAAO,kBAAkB,KAAK;EACzD,OAAO,EAAE,IAAI,GAAG,SAAS,EAAE,WAAW,YACpC,UAAU,YAAY,SAAS,MAAM,OAAO,IAAI,KAAK;CACzD,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,YAAY,UAAU,YAAY,OAAO,MAAM,OAAO,KAAK;CACxF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,qBAAqB,OAAO,kBAAkB,KAAK;EAC1D,OAAO,EAAE,IAAI,GAAG,SAAS,EAAE,WAAW,YACpC,UAAU,YAAY,OAAO,MAAM,OAAO,IAAI,KAAK;CACvD,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,IAAI,SAAS,EAAE,WAAW,YACjC,UAAU,YAAY,MAAM,MAAM,OAAO,IAAI,KAAK;CACtD,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,MAAM,EAAE,WAAW,YAAY,UAAU,YAAY,OAAO,MAAM,OAAO,EAAE;CACtF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,kBAAkB,OAAO,kBAAkB,KAAK;EACvD,OAAO,EAAE,IAAI,GAAG,SAAS,EAAE,WAAW,YACpC,UAAU,YAAY,cAAc,MAAM,OAAO,IAAI,KAAK;CAC9D,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,MAAM,EAAE,WAAW,YAAY,UAAU,YAAY,cAAc,MAAM,OAAO,EAAE;CAC7F,CAAC;AACH"}
+{"version":3,"file":"automations.js","names":[],"sources":["../../../../src/http/mcp/tools/automations.ts"],"sourcesContent":["import {\n  AutomationIdParam,\n  AutomationRunParams,\n  AutomationRunsQuery,\n  AutomationsQuery,\n  CreateAutomationBody,\n  UpdateAutomationBody,\n  UpdateWebhookBody,\n} from '../../schemas/index.js';\nimport { defineTool, noInput, type Tool } from '../tool.js';\n\nexport const automationTools: Tool[] = [\n  defineTool({\n    name: 'list_automation_triggers',\n    title: 'List workflow triggers',\n    description: 'The events that can start a workflow.',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: noInput,\n    call: (_input, { container, caller }) => container.automations.availableTriggers(caller.actor),\n  }),\n  defineTool({\n    name: 'list_automation_actions',\n    title: 'List workflow actions',\n    description: 'The actions a workflow can run, with the settings each one takes.',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: noInput,\n    call: (_input, { container, caller }) => container.automations.availableActions(caller.actor),\n  }),\n  defineTool({\n    name: 'list_automations',\n    title: 'List workflows and webhooks',\n    description:\n      'Workflows and webhooks with their triggers, ordered actions and enabled state. Filter by kind (workflow or webhook).',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: AutomationsQuery,\n    call: (input, { container, caller }) => container.automations.list(input, caller.actor),\n  }),\n  defineTool({\n    name: 'list_automation_runs',\n    title: 'List workflow and webhook runs',\n    description:\n      'Runs of one workflow or webhook, newest first, with the trigger event as a webhook would receive it and each action result.',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: AutomationRunsQuery.extend(AutomationIdParam.shape),\n    call: ({ id, ...query }, { container, caller }) =>\n      container.automations.listRuns(id, query, caller.actor),\n  }),\n  defineTool({\n    name: 'create_automation',\n    title: 'Create workflow',\n    description:\n      'Create a workflow from triggers and ordered actions. Use list_automation_triggers and list_automation_actions for valid values.',\n    kind: 'write',\n    idempotent: false,\n    openWorld: false,\n    input: CreateAutomationBody,\n    call: (input, { container, caller }) => container.automations.create(input, caller.actor),\n  }),\n  defineTool({\n    name: 'update_automation',\n    title: 'Update workflow',\n    description:\n      'Change a workflow name, description, triggers or actions, or turn it on and off with enabled. Fields left out stay as they are.',\n    kind: 'write',\n    idempotent: true,\n    openWorld: false,\n    input: UpdateAutomationBody.extend(AutomationIdParam.shape),\n    call: ({ id, ...patch }, { container, caller }) =>\n      container.automations.update(id, patch, caller.actor),\n  }),\n  defineTool({\n    name: 'rerun_automation_run',\n    title: 'Re-run workflow or webhook run',\n    description:\n      \"Run a finished workflow or webhook run again with its original trigger event, using the automation's current actions. Emails and webhook deliveries are sent again. The new outcome replaces the run's previous one. A run still in progress can't be re-run.\",\n    kind: 'write',\n    idempotent: false,\n    openWorld: true,\n    input: AutomationRunParams,\n    call: ({ id, runId }, { container, caller }) =>\n      container.automations.rerun(id, runId, caller.actor),\n  }),\n  defineTool({\n    name: 'delete_automation',\n    title: 'Delete workflow',\n    description: 'Permanently delete a workflow.',\n    kind: 'destructive',\n    idempotent: true,\n    openWorld: false,\n    input: AutomationIdParam,\n    call: ({ id }, { container, caller }) => container.automations.delete(id, caller.actor),\n  }),\n  defineTool({\n    name: 'update_webhook',\n    title: 'Update webhook',\n    description:\n      'Change a webhook URL, events or description, or turn it on and off with enabled. Fields left out stay as they are.',\n    kind: 'write',\n    idempotent: true,\n    openWorld: false,\n    input: UpdateWebhookBody.extend(AutomationIdParam.shape),\n    call: ({ id, ...patch }, { container, caller }) =>\n      container.automations.updateWebhook(id, patch, caller.actor),\n  }),\n  defineTool({\n    name: 'delete_webhook',\n    title: 'Delete webhook',\n    description:\n      'Permanently delete a webhook and its signing secret. Its delivery history is kept.',\n    kind: 'destructive',\n    idempotent: true,\n    openWorld: false,\n    input: AutomationIdParam,\n    call: ({ id }, { container, caller }) => container.automations.deleteWebhook(id, caller.actor),\n  }),\n];\n"],"mappings":";;;;AAWA,MAAa,kBAA0B;CACrC,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,QAAQ,EAAE,WAAW,aAAa,UAAU,YAAY,kBAAkB,OAAO,KAAK;CAC/F,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,QAAQ,EAAE,WAAW,aAAa,UAAU,YAAY,iBAAiB,OAAO,KAAK;CAC9F,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,aAAa,UAAU,YAAY,KAAK,OAAO,OAAO,KAAK;CACxF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,oBAAoB,OAAO,kBAAkB,KAAK;EACzD,OAAO,EAAE,IAAI,GAAG,SAAS,EAAE,WAAW,aACpC,UAAU,YAAY,SAAS,IAAI,OAAO,OAAO,KAAK;CAC1D,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,aAAa,UAAU,YAAY,OAAO,OAAO,OAAO,KAAK;CAC1F,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,qBAAqB,OAAO,kBAAkB,KAAK;EAC1D,OAAO,EAAE,IAAI,GAAG,SAAS,EAAE,WAAW,aACpC,UAAU,YAAY,OAAO,IAAI,OAAO,OAAO,KAAK;CACxD,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,IAAI,SAAS,EAAE,WAAW,aACjC,UAAU,YAAY,MAAM,IAAI,OAAO,OAAO,KAAK;CACvD,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,MAAM,EAAE,WAAW,aAAa,UAAU,YAAY,OAAO,IAAI,OAAO,KAAK;CACxF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,kBAAkB,OAAO,kBAAkB,KAAK;EACvD,OAAO,EAAE,IAAI,GAAG,SAAS,EAAE,WAAW,aACpC,UAAU,YAAY,cAAc,IAAI,OAAO,OAAO,KAAK;CAC/D,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,MAAM,EAAE,WAAW,aAAa,UAAU,YAAY,cAAc,IAAI,OAAO,KAAK;CAC/F,CAAC;AACH"}