@intentface/latch-mcp 0.9.1

package/dist/host-output.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-output.test.js","sourceRoot":"","sources":["../src/host-output.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AAE1D,MAAM,IAAI,GAAG,CAAC,MAAe,EAAE,QAAmC,EAAE,EAAE,CACpE,6BAA6B,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAEnF,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,EAAE;YACX,iBAAiB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE;YAC3D,OAAO,EAAE,KAAK;SACf,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3B,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACvC,iBAAiB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SAChC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;YAClD,iBAAiB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;SACjC,CAAC;QACF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YACrC,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;SACjD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;YAC9D,iBAAiB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;SACpC,CAAC;QACF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAClF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,gBAAgB,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/host.d.ts

@@ -0,0 +1,203 @@
+import { type MCPTransport, type OAuthClientProvider } from "@ai-sdk/mcp";
+import type { SingleToolApprovalFunction, ToolApprovalStatus } from "ai";
+import type { SecretResolver } from "@intentface/latch-core";
+import { isHostAllowed } from "@intentface/latch-net";
+import type { FetchFunction } from "./oauth-fetch.js";
+/**
+ * The MCP host — connect to MCP servers and expose their tools to an agent,
+ * with two Latch-specific guards on top of the SDK client:
+ *
+ *  1. A per-tenant SSRF allowlist: a connection's host must be explicitly
+ *     permitted before we open a socket to it (and the transport rejects
+ *     redirects, so a server can't bounce us somewhere else).
+ *  2. Vault-brokered auth: bearer tokens are resolved per-tenant from the Vault
+ *     and injected as request headers — they never appear in agent config.
+ */
+export type McpAuth = {
+    type: "bearer";
+    vaultKey: string;
+} | {
+    type: "headers";
+    headers: Record<string, string>;
+};
+/**
+ * What the model sees of an MCP tool result, fixed for structured-only servers.
+ *
+ * The SDK's default `toModelOutput` maps `result.content` to model blocks and
+ * only falls back to raw JSON when `content` is missing entirely. Newer MCP
+ * servers (Airtable among them) return their payload in `structuredContent`
+ * with `content: []` — the spec says they SHOULD mirror it into a text block,
+ * but nothing enforces that — and the default then hands the model an empty
+ * result while the stored message (what the UI renders) keeps the full object.
+ * The agent reports "empty content" for a call that visibly succeeded.
+ *
+ * When `structuredContent` is present and `content` carries no text, the model
+ * gets the structured payload as JSON instead. Everything else keeps the SDK's
+ * behavior via `original`.
+ */
+export declare function withStructuredContentFallback(original: ((args: never) => unknown) | undefined): (args: {
+    toolCallId: string;
+    input: unknown;
+    output: unknown;
+}) => unknown;
+/** MCP tool annotations (sensitivity hints) the server may advertise. */
+export interface McpToolInfo {
+    name: string;
+    annotations?: {
+        readOnlyHint?: boolean;
+        destructiveHint?: boolean;
+        idempotentHint?: boolean;
+        openWorldHint?: boolean;
+        [k: string]: unknown;
+    };
+}
+/**
+ * Per-CALL approval decision for one tool: evaluated with the model's input
+ * each time it calls the tool (synchronously or async — return `boolean` or
+ * `Promise<boolean>`), so policy can key on ARGUMENTS. This is the escape
+ * hatch for meta-tool servers — one `execute_tool` multiplexing every
+ * operation through its arguments carries a single annotation set, so a
+ * per-tool boolean can only gate everything or nothing.
+ */
+export type McpCallApproval = (input: unknown) => boolean | Promise<boolean>;
+/**
+ * Which of a connection's tools require human approval before running.
+ * - `"destructive"` (default): respect MCP's built-in hints — gate any tool the
+ *   server marks `destructiveHint: true` or explicitly `readOnlyHint: false`.
+ * - `"all"` / `"none"`: gate every tool / no tool.
+ * - a predicate: decide per tool from its annotations. Return a boolean for a
+ *   whole-tool decision, or an {@link McpCallApproval} —
+ *   `(input) => boolean | Promise<boolean>` — to decide per call (e.g. gate
+ *   `execute_tool` only when `input.toolName` starts with `create_`).
+ *   Annotations stay the first-class signal; the call function is for tools
+ *   whose annotations structurally can't say enough.
+ */
+export type McpApprovalPolicy = "destructive" | "all" | "none" | ((tool: McpToolInfo) => boolean | McpCallApproval);
+/**
+ * Apply an approval policy to one tool (defaults to `"destructive"`).
+ * A function result means "decide per call with the input" — truthy for
+ * gating purposes wherever a whole-tool answer is needed (a policy that must
+ * be decided without input is treated conservatively as gated).
+ */
+export declare function needsMcpApproval(policy: McpApprovalPolicy | undefined, tool: McpToolInfo): boolean | McpCallApproval;
+/**
+ * One tool's value in the AI SDK's `toolApproval` map: an approval status
+ * (`"user-approval"` = always gate; `undefined` = not applicable, never gate)
+ * or a per-call function the SDK evaluates with the call input.
+ */
+export type McpToolApprovalValue = ToolApprovalStatus | SingleToolApprovalFunction<unknown, unknown, unknown>;
+/**
+ * Resolve a policy to the value the AI SDK's `toolApproval` map takes for one
+ * tool: `"user-approval"` (always gate), `undefined` (never gate), or a
+ * per-call function the SDK evaluates with the call input.
+ */
+export declare function mcpApprovalValue(policy: McpApprovalPolicy | undefined, tool: McpToolInfo): McpToolApprovalValue;
+/** Tuning for {@link nameHeuristicApproval} — extra verbs merged into the defaults. */
+export interface NameHeuristicOptions {
+    /** Verbs that mark a write (added to the built-in write list). */
+    writeVerbs?: string[];
+    /** Verbs that mark a destructive op (added to the built-in destructive list). */
+    destructiveVerbs?: string[];
+}
+/**
+ * A generic approval predicate that gates a tool when either its MCP
+ * annotations say it's destructive/non-read-only (the same rule
+ * {@link needsMcpApproval} applies for `"destructive"`), OR — when the server
+ * ships no annotations — the tool's name (normalized to snake_case) starts with
+ * a write/destructive verb. Pure function; the returned predicate is stateless.
+ *
+ * Use it as an `approval` policy (or as a building block) for MCP servers whose
+ * tools lack sensitivity hints.
+ */
+export declare function nameHeuristicApproval(opts?: NameHeuristicOptions): (tool: McpToolInfo) => boolean;
+/**
+ * A connection is either a URL (untrusted/config-driven → SSRF allowlist + auth
+ * applies) or a developer-provided transport instance (trusted in-process; e.g.
+ * stdio or an in-memory transport — no allowlist, it carries its own auth).
+ */
+export type McpConnection = {
+    /** Namespacing prefix for this server's tools (e.g. `linear` → `linear_*`). */
+    name: string;
+    /** MCP server URL (HTTP transport). */
+    url: string;
+    /** Static/bearer auth. Bearer tokens come from the Vault, per tenant. */
+    auth?: McpAuth;
+    /** OAuth provider (auto-refreshing). Build per scope via `McpOAuth.provider(scope)`. */
+    authProvider?: OAuthClientProvider;
+    /**
+     * Custom fetch for this connection's requests AND the transport's on-401
+     * re-auth/refresh. Pass the same fetch used by the OAuth flow (e.g.
+     * `createOAuthDiscoveryFetch`) so discovery normalization is consistent.
+     */
+    fetch?: FetchFunction;
+    /**
+     * Permit this connection to reach a private/internal address. By default
+     * the host rejects private/loopback/link-local IPs and DNS-rebinding
+     * (a name that resolves private) even when the host is on the allowlist.
+     * Set `true` only for a trusted local/in-cluster MCP server.
+     */
+    allowPrivateHost?: boolean;
+    /** Which tools require approval (default: respect MCP destructive hints). */
+    approval?: McpApprovalPolicy;
+    /**
+     * Tool visibility filter. When set, a tool for which this returns `false`
+     * is dropped entirely — no agent tool, no approval entry. Use it to hide
+     * tools an approval predicate can't express (e.g. a hard block). Absent →
+     * all of the server's tools are exposed.
+     */
+    visible?: (tool: McpToolInfo) => boolean;
+} | {
+    name: string;
+    /** A prebuilt transport (stdio/in-memory/custom). Used as-is. */
+    transport: MCPTransport;
+    /** Which tools require approval (default: respect MCP destructive hints). */
+    approval?: McpApprovalPolicy;
+    /**
+     * Tool visibility filter. When set, a tool for which this returns `false`
+     * is dropped entirely — no agent tool, no approval entry. Use it to hide
+     * tools an approval predicate can't express (e.g. a hard block). Absent →
+     * all of the server's tools are exposed.
+     */
+    visible?: (tool: McpToolInfo) => boolean;
+};
+export interface McpHostConfig<P> {
+    /** Connections, static or resolved per caller (e.g. to inject OAuth providers). */
+    connections: McpConnection[] | ((principal: P) => McpConnection[] | Promise<McpConnection[]>);
+    /**
+     * SSRF allowlist of permitted hostnames. An entry beginning with `.` matches
+     * that domain and its subdomains (`.example.com` → `example.com`,
+     * `api.example.com`). Static, or resolved per caller.
+     */
+    allowedHosts: string[] | ((principal: P) => string[] | Promise<string[]>);
+    /** Vault read-side, used for bearer auth. */
+    secrets?: SecretResolver<P>;
+    /** Observe a connection that failed to open (it's skipped, not fatal). */
+    onConnectionError?: (name: string, error: unknown) => void;
+}
+export interface OpenMcp {
+    /** Merged, name-prefixed tools, ready to spread into an agent's `tools`. */
+    tools: Record<string, unknown>;
+    /**
+     * Per-tool approval policy derived from each connection's `approval` setting
+     * and the MCP servers' tool annotations (`<name>_<tool>: "user-approval"`).
+     * Merged into the agent's `toolApproval` by the runtime.
+     */
+    toolApproval: Record<string, McpToolApprovalValue>;
+    /** Close every underlying client. Call when the turn finishes. */
+    close(): Promise<void>;
+}
+export interface McpHost<P> {
+    open(principal: P): Promise<OpenMcp>;
+}
+export { isHostAllowed };
+/**
+ * Resolve the request headers for a connection. Bearer tokens are read from the
+ * Vault per tenant; the token is returned for immediate egress use and is never
+ * logged or persisted by the host.
+ */
+export declare function buildAuthHeaders<P>(conn: {
+    name: string;
+    auth?: McpAuth;
+}, principal: P, secrets?: SecretResolver<P>): Promise<Record<string, string>>;
+export declare function createMcpHost<P>(config: McpHostConfig<P>): McpHost<P>;
+//# sourceMappingURL=host.d.ts.map

package/dist/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAGL,aAAa,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;;;;;;;GASG;AAEH,MAAM,MAAM,OAAO,GACf;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAEzD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,GAAG,SAAS,GAC/C,CAAC,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,KAAK,OAAO,CA2B5E;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE;QACZ,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,CAAC;CACH;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,KAAK,GACL,MAAM,GACN,CAAC,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,GAAG,eAAe,CAAC,CAAC;AAQvD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,IAAI,EAAE,WAAW,GAChB,OAAO,GAAG,eAAe,CAM3B;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC5B,kBAAkB,GAClB,0BAA0B,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAE1D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,IAAI,EAAE,WAAW,GAChB,oBAAoB,CAQtB;AAED,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAsDD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,CAAC,EAAE,oBAAoB,GAC1B,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAsBhC;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB;IACE,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,wFAAwF;IACxF,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC;CAC1C,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,SAAS,EAAE,YAAY,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC;CAC1C,CAAC;AAEN,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,mFAAmF;IACnF,WAAW,EACP,aAAa,EAAE,GACf,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,aAAa,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IACnE;;;;OAIG;IACH,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1E,6CAA6C;IAC7C,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IAC5B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,OAAO;IACtB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnD,kEAAkE;IAClE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,OAAO,CAAC,CAAC;IACxB,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAID,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,EACtC,SAAS,EAAE,CAAC,EACZ,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgBjC;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAoGrE"}

package/dist/host.js

@@ -0,0 +1,259 @@
+import { createMCPClient, } from "@ai-sdk/mcp";
+import { isBlockedHost, isBlockedResolved, isHostAllowed, } from "@intentface/latch-net";
+/**
+ * What the model sees of an MCP tool result, fixed for structured-only servers.
+ *
+ * The SDK's default `toModelOutput` maps `result.content` to model blocks and
+ * only falls back to raw JSON when `content` is missing entirely. Newer MCP
+ * servers (Airtable among them) return their payload in `structuredContent`
+ * with `content: []` — the spec says they SHOULD mirror it into a text block,
+ * but nothing enforces that — and the default then hands the model an empty
+ * result while the stored message (what the UI renders) keeps the full object.
+ * The agent reports "empty content" for a call that visibly succeeded.
+ *
+ * When `structuredContent` is present and `content` carries no text, the model
+ * gets the structured payload as JSON instead. Everything else keeps the SDK's
+ * behavior via `original`.
+ */
+export function withStructuredContentFallback(original) {
+    return (args) => {
+        const result = args.output;
+        if (result &&
+            typeof result === "object" &&
+            !result.isError &&
+            result.structuredContent != null &&
+            Array.isArray(result.content) &&
+            // "No text": empty, or only parts with empty/absent text (some servers
+            // pad with a blank text block instead of omitting content).
+            result.content.every((part) => !part.text?.trim?.() &&
+                part.type === "text")) {
+            return { type: "json", value: result.structuredContent };
+        }
+        return original
+            ? original(args)
+            : { type: "json", value: args.output };
+    };
+}
+/** The `"destructive"` rule: annotations say destructive / not read-only. */
+function destructiveByAnnotations(tool) {
+    const a = tool.annotations ?? {};
+    return a.destructiveHint === true || a.readOnlyHint === false;
+}
+/**
+ * Apply an approval policy to one tool (defaults to `"destructive"`).
+ * A function result means "decide per call with the input" — truthy for
+ * gating purposes wherever a whole-tool answer is needed (a policy that must
+ * be decided without input is treated conservatively as gated).
+ */
+export function needsMcpApproval(policy, tool) {
+    const p = policy ?? "destructive";
+    if (typeof p === "function")
+        return p(tool);
+    if (p === "all")
+        return true;
+    if (p === "none")
+        return false;
+    return destructiveByAnnotations(tool);
+}
+/**
+ * Resolve a policy to the value the AI SDK's `toolApproval` map takes for one
+ * tool: `"user-approval"` (always gate), `undefined` (never gate), or a
+ * per-call function the SDK evaluates with the call input.
+ */
+export function mcpApprovalValue(policy, tool) {
+    const gate = needsMcpApproval(policy, tool);
+    if (typeof gate === "function") {
+        // `undefined` is the SDK's "not-applicable" — the call runs ungated.
+        return async (input) => (await gate(input)) ? "user-approval" : undefined;
+    }
+    return gate ? "user-approval" : undefined;
+}
+/** Default verbs a tool name may start with to count as a write. */
+const DEFAULT_WRITE_VERBS = [
+    "create",
+    "update",
+    "delete",
+    "write",
+    "remove",
+    "set",
+    "put",
+    "post",
+    "patch",
+    "add",
+    "insert",
+    "edit",
+    "move",
+    "assign",
+    "send",
+    "cancel",
+    "complete",
+    "upsert",
+    "publish",
+    "share",
+    "invite",
+    "revoke",
+    "merge",
+    "duplicate",
+    "copy",
+    "archive",
+    "destroy",
+    "drop",
+    "purge",
+];
+/** Default verbs a tool name may start with to count as destructive. */
+const DEFAULT_DESTRUCTIVE_VERBS = [
+    "delete",
+    "remove",
+    "drop",
+    "destroy",
+    "archive",
+    "purge",
+];
+/** Normalize CamelCase/PascalCase (`CreateDeal`) → snake_case (`create_deal`). */
+function normalizeToolName(s) {
+    return s.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * A generic approval predicate that gates a tool when either its MCP
+ * annotations say it's destructive/non-read-only (the same rule
+ * {@link needsMcpApproval} applies for `"destructive"`), OR — when the server
+ * ships no annotations — the tool's name (normalized to snake_case) starts with
+ * a write/destructive verb. Pure function; the returned predicate is stateless.
+ *
+ * Use it as an `approval` policy (or as a building block) for MCP servers whose
+ * tools lack sensitivity hints.
+ */
+export function nameHeuristicApproval(opts) {
+    const verbs = Array.from(new Set([
+        ...DEFAULT_WRITE_VERBS,
+        ...DEFAULT_DESTRUCTIVE_VERBS,
+        ...(opts?.writeVerbs ?? []),
+        ...(opts?.destructiveVerbs ?? []),
+    ]));
+    const pattern = new RegExp(`^(${verbs.map(escapeRegExp).join("|")})([_\\W]|$)`, "i");
+    return (tool) => {
+        const a = tool.annotations ?? {};
+        // Annotations are authoritative when present — reuse the destructive rule.
+        if (a.readOnlyHint !== undefined || a.destructiveHint !== undefined) {
+            return destructiveByAnnotations(tool);
+        }
+        // No hints — fall back to the tool-name verb heuristic.
+        return pattern.test(normalizeToolName(tool.name));
+    };
+}
+// Canonical implementation lives in @intentface/latch-net; re-exported here
+// for callers that historically imported it from this package.
+export { isHostAllowed };
+/**
+ * Resolve the request headers for a connection. Bearer tokens are read from the
+ * Vault per tenant; the token is returned for immediate egress use and is never
+ * logged or persisted by the host.
+ */
+export async function buildAuthHeaders(conn, principal, secrets) {
+    if (!conn.auth)
+        return {};
+    if (conn.auth.type === "headers")
+        return { ...conn.auth.headers };
+    // bearer
+    if (!secrets) {
+        throw new Error(`MCP connection "${conn.name}" needs bearer auth but no secrets resolver is configured`);
+    }
+    const token = await secrets(principal, conn.auth.vaultKey);
+    if (!token) {
+        throw new Error(`MCP connection "${conn.name}": secret "${conn.auth.vaultKey}" not found for this tenant`);
+    }
+    return { Authorization: `Bearer ${token}` };
+}
+export function createMcpHost(config) {
+    return {
+        async open(principal) {
+            const allowed = typeof config.allowedHosts === "function"
+                ? await config.allowedHosts(principal)
+                : config.allowedHosts;
+            const connections = typeof config.connections === "function"
+                ? await config.connections(principal)
+                : config.connections;
+            const clients = [];
+            const tools = {};
+            const toolApproval = {};
+            const closeAll = () => Promise.all(clients.map((c) => c.close().catch(() => { }))).then(() => undefined);
+            for (const conn of connections) {
+                // SSRF guard is a HARD failure (security): an unlisted host throws,
+                // before any socket opens.
+                if (!("transport" in conn)) {
+                    const host = new URL(conn.url).hostname;
+                    if (!isHostAllowed(host, allowed)) {
+                        await closeAll();
+                        throw new Error(`MCP host not allowed for this tenant: ${host} (connection "${conn.name}")`);
+                    }
+                    // Defense-in-depth beyond the allowlist: reject private/internal
+                    // addresses and DNS rebinding (an allowlisted name that resolves to a
+                    // private/link-local IP — e.g. cloud metadata at 169.254.169.254).
+                    // Opt out per connection for a trusted local server.
+                    if (!conn.allowPrivateHost &&
+                        (isBlockedHost(host) || (await isBlockedResolved(host)))) {
+                        await closeAll();
+                        throw new Error(`MCP host resolves to a private/internal address: ${host} (connection "${conn.name}"). Set allowPrivateHost to permit a trusted local server.`);
+                    }
+                }
+                // A connection that can't be opened (down / bad token / no tools) is
+                // SKIPPED, not fatal — the agent degrades gracefully without it.
+                try {
+                    let client;
+                    if ("transport" in conn) {
+                        client = await createMCPClient({
+                            transport: conn.transport,
+                        });
+                    }
+                    else {
+                        const headers = await buildAuthHeaders(conn, principal, config.secrets);
+                        client = await createMCPClient({
+                            transport: {
+                                type: "http",
+                                url: conn.url,
+                                headers,
+                                authProvider: conn.authProvider, // OAuth (auto-refresh) if present
+                                redirect: "error", // no redirect-based SSRF
+                                fetch: conn.fetch, // normalizing fetch for on-401 re-auth, if set
+                            },
+                        });
+                    }
+                    clients.push(client);
+                    // listTools (not tools()) so we keep the annotations the AI SDK's
+                    // tools() drops — they drive the approval policy. tools() is exactly
+                    // toolsFromDefinitions(listTools()), so this builds identical tools.
+                    const defs = await client.listTools();
+                    const serverTools = client.toolsFromDefinitions(defs);
+                    const annotations = new Map((defs.tools ?? []).map((t) => [t.name, t.annotations]));
+                    for (const [name, tool] of Object.entries(serverTools)) {
+                        const info = { name, annotations: annotations.get(name) };
+                        // A hidden tool is dropped entirely (no tool, no approval entry) —
+                        // the primitive for a hard block, which approval can't express.
+                        if (conn.visible && !conn.visible(info))
+                            continue;
+                        const key = `${conn.name}_${name}`; // namespace to avoid collisions
+                        // Patch the SDK's model-output mapping so structured-only results
+                        // (structuredContent + empty content) reach the model as JSON
+                        // instead of an empty block.
+                        const sdkTool = tool;
+                        tools[key] = {
+                            ...sdkTool,
+                            toModelOutput: withStructuredContentFallback(sdkTool.toModelOutput),
+                        };
+                        const approvalValue = mcpApprovalValue(conn.approval, info);
+                        if (approvalValue !== undefined)
+                            toolApproval[key] = approvalValue;
+                    }
+                }
+                catch (error) {
+                    config.onConnectionError?.(conn.name, error);
+                }
+            }
+            return { tools, toolApproval, close: closeAll };
+        },
+    };
+}
+//# sourceMappingURL=host.js.map

package/dist/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,GAIhB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAkB/B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAAgD;IAEhD,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,MAIZ,CAAC;QACT,IACE,MAAM;YACN,OAAO,MAAM,KAAK,QAAQ;YAC1B,CAAC,MAAM,CAAC,OAAO;YACf,MAAM,CAAC,iBAAiB,IAAI,IAAI;YAChC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAC7B,uEAAuE;YACvE,4DAA4D;YAC5D,MAAM,CAAC,OAAO,CAAC,KAAK,CAClB,CAAC,IAAI,EAAE,EAAE,CACP,CAAE,IAAyC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;gBACzD,IAA0B,CAAC,IAAI,KAAK,MAAM,CAC9C,EACD,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,QAAQ;YACb,CAAC,CAAE,QAAwC,CAAC,IAAI,CAAC;YACjD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC,CAAC;AACJ,CAAC;AA0CD,6EAA6E;AAC7E,SAAS,wBAAwB,CAAC,IAAiB;IACjD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IACjC,OAAO,CAAC,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAqC,EACrC,IAAiB;IAEjB,MAAM,CAAC,GAAG,MAAM,IAAI,aAAa,CAAC;IAClC,IAAI,OAAO,CAAC,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAqC,EACrC,IAAiB;IAEjB,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,qEAAqE;QACrE,OAAO,KAAK,EAAE,KAAc,EAAE,EAAE,CAC9B,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAUD,oEAAoE;AACpE,MAAM,mBAAmB,GAAG;IAC1B,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,KAAK;IACL,QAAQ;IACR,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,WAAW;IACX,MAAM;IACN,SAAS;IACT,SAAS;IACT,MAAM;IACN,OAAO;CACR,CAAC;AAEF,wEAAwE;AACxE,MAAM,yBAAyB,GAAG;IAChC,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,SAAS;IACT,SAAS;IACT,OAAO;CACR,CAAC;AAEF,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,CAAS;IAClC,OAAO,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA2B;IAE3B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CACtB,IAAI,GAAG,CAAC;QACN,GAAG,mBAAmB;QACtB,GAAG,yBAAyB;QAC5B,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC;KAClC,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,MAAM,CACxB,KAAK,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EACnD,GAAG,CACJ,CAAC;IACF,OAAO,CAAC,IAAiB,EAAW,EAAE;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QACjC,2EAA2E;QAC3E,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACpE,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,wDAAwD;QACxD,OAAO,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC;AAyFD,4EAA4E;AAC5E,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAsC,EACtC,SAAY,EACZ,OAA2B;IAE3B,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAClE,SAAS;IACT,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,IAAI,2DAA2D,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,6BAA6B,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,aAAa,CAAI,MAAwB;IACvD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,SAAS;YAClB,MAAM,OAAO,GACX,OAAO,MAAM,CAAC,YAAY,KAAK,UAAU;gBACvC,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;gBACtC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;YAC1B,MAAM,WAAW,GACf,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU;gBACtC,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC;gBACrC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;YAEzB,MAAM,OAAO,GAAgB,EAAE,CAAC;YAChC,MAAM,KAAK,GAA4B,EAAE,CAAC;YAC1C,MAAM,YAAY,GAAyC,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7D,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;YAEJ,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,oEAAoE;gBACpE,2BAA2B;gBAC3B,IAAI,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;oBACxC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;wBAClC,MAAM,QAAQ,EAAE,CAAC;wBACjB,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,iBAAiB,IAAI,CAAC,IAAI,IAAI,CAC5E,CAAC;oBACJ,CAAC;oBACD,iEAAiE;oBACjE,sEAAsE;oBACtE,mEAAmE;oBACnE,qDAAqD;oBACrD,IACE,CAAC,IAAI,CAAC,gBAAgB;wBACtB,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EACxD,CAAC;wBACD,MAAM,QAAQ,EAAE,CAAC;wBACjB,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,iBAAiB,IAAI,CAAC,IAAI,4DAA4D,CAC/I,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,qEAAqE;gBACrE,iEAAiE;gBACjE,IAAI,CAAC;oBACH,IAAI,MAAiB,CAAC;oBACtB,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;wBACxB,MAAM,GAAG,MAAM,eAAe,CAAC;4BAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;yBACe,CAAC,CAAC;oBAC9C,CAAC;yBAAM,CAAC;wBACN,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;wBACxE,MAAM,GAAG,MAAM,eAAe,CAAC;4BAC7B,SAAS,EAAE;gCACT,IAAI,EAAE,MAAM;gCACZ,GAAG,EAAE,IAAI,CAAC,GAAG;gCACb,OAAO;gCACP,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,kCAAkC;gCACnE,QAAQ,EAAE,OAAO,EAAE,yBAAyB;gCAC5C,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,+CAA+C;6BACnE;yBACuC,CAAC,CAAC;oBAC9C,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,kEAAkE;oBAClE,qEAAqE;oBACrE,qEAAqE;oBACrE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;oBACtC,MAAM,WAAW,GAAG,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;oBACtD,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CACvD,CAAC;oBACF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;wBACvD,MAAM,IAAI,GAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvE,mEAAmE;wBACnE,gEAAgE;wBAChE,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;4BAAE,SAAS;wBAClD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,gCAAgC;wBACpE,kEAAkE;wBAClE,8DAA8D;wBAC9D,6BAA6B;wBAC7B,MAAM,OAAO,GAAG,IAAoD,CAAC;wBACrE,KAAK,CAAC,GAAG,CAAC,GAAG;4BACX,GAAG,OAAO;4BACV,aAAa,EAAE,6BAA6B,CAAC,OAAO,CAAC,aAAa,CAAC;yBACpE,CAAC;wBACF,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;wBAC5D,IAAI,aAAa,KAAK,SAAS;4BAAE,YAAY,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC;oBACrE,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @intentface/latch-mcp
+ *
+ * MCP host for Latch: connect to MCP servers and surface their tools to an
+ * agent, behind a per-tenant SSRF allowlist and vault-brokered auth. Built on
+ * `@ai-sdk/mcp`; the resulting tools spread straight into an agent's `tools`.
+ */
+export { createMcpHost, isHostAllowed, buildAuthHeaders, needsMcpApproval, mcpApprovalValue, nameHeuristicApproval, } from "./host.js";
+export type { McpHost, McpHostConfig, McpConnection, McpAuth, McpApprovalPolicy, McpCallApproval, McpToolApprovalValue, McpToolInfo, NameHeuristicOptions, OpenMcp, } from "./host.js";
+export { createMcpOAuth, createVaultOAuthProvider, decodeOAuthState, } from "./oauth.js";
+export type { McpOAuth, McpOAuthConfig, StartResult } from "./oauth.js";
+export { createOAuthDiscoveryFetch } from "./oauth-fetch.js";
+export type { OAuthDiscoveryFetchOptions, FetchFunction, } from "./oauth-fetch.js";
+export { createMcpConnections, defineMcpConnection, none, bearer, headers, oauth, } from "./connections.js";
+export type { McpConnections, McpConnectionsConfig, McpConnectionDef, McpConnectionAuth, OAuthAuthOptions, ConnectionStatus, } from "./connections.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,OAAO,EACP,aAAa,EACb,aAAa,EACb,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,WAAW,EACX,oBAAoB,EACpB,OAAO,GACR,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EACV,0BAA0B,EAC1B,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,IAAI,EACJ,MAAM,EACN,OAAO,EACP,KAAK,GACN,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,12 @@
+/**
+ * @intentface/latch-mcp
+ *
+ * MCP host for Latch: connect to MCP servers and surface their tools to an
+ * agent, behind a per-tenant SSRF allowlist and vault-brokered auth. Built on
+ * `@ai-sdk/mcp`; the resulting tools spread straight into an agent's `tools`.
+ */
+export { createMcpHost, isHostAllowed, buildAuthHeaders, needsMcpApproval, mcpApprovalValue, nameHeuristicApproval, } from "./host.js";
+export { createMcpOAuth, createVaultOAuthProvider, decodeOAuthState, } from "./oauth.js";
+export { createOAuthDiscoveryFetch } from "./oauth-fetch.js";
+export { createMcpConnections, defineMcpConnection, none, bearer, headers, oauth, } from "./connections.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAanB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAK7D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,IAAI,EACJ,MAAM,EACN,OAAO,EACP,KAAK,GACN,MAAM,kBAAkB,CAAC"}

package/dist/oauth-fetch.d.ts

@@ -0,0 +1,45 @@
+/**
+ * A custom fetch implementation, structurally compatible with the SDK's
+ * `FetchFunction` (and `globalThis.fetch`). Declared locally so this package
+ * doesn't take a direct dependency on `@ai-sdk/provider-utils`.
+ */
+export type FetchFunction = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+/**
+ * A fetch wrapper that canonicalizes a misbehaving MCP provider's OAuth
+ * discovery documents so the SDK's strict RFC 8414 checks accept them.
+ *
+ * `@ai-sdk/mcp` enforces RFC 8414 exactly: the authorization-server metadata's
+ * `issuer` must equal the issuer derived from the well-known URL it was fetched
+ * from (origin, or origin+path, never with a trailing slash), and there is no
+ * provider hook to relax it. Some providers — typically those behind a
+ * TLS-terminating proxy — publish discovery documents that violate this:
+ *
+ *   • the protected-resource doc advertises its `authorization_servers` (and
+ *     `resource`) over `http://` even though the live endpoints are `https://`;
+ *   • the authorization-server doc's `issuer` carries a trailing slash
+ *     (`https://host/`) while the SDK expects the bare origin (`https://host`).
+ *
+ * Either makes `auth()` throw `... issuer ... does not match expected issuer ...`.
+ * This wrapper rewrites only the discovery documents (by well-known path), only
+ * for the configured hosts, leaving every other request untouched. Wire it into
+ * BOTH the OAuth flow (`McpOAuthConfig.fetch`) and the host transport
+ * (`McpConnection.fetch`) so the on-401 re-auth/refresh uses it too.
+ */
+export interface OAuthDiscoveryFetchOptions {
+    /** Underlying fetch. Default: `globalThis.fetch`. */
+    baseFetch?: FetchFunction;
+    /**
+     * Force this scheme on the URLs inside discovery documents (issuer,
+     * authorization/token/registration endpoints, advertised resource and
+     * authorization servers). Use `"https"` for the common proxied-http case.
+     * Omit to leave schemes as published.
+     */
+    forceScheme?: "https" | "http";
+    /**
+     * Restrict normalization to these hostnames — a safety boundary so a third
+     * party's metadata is never rewritten. Omit to apply to any host.
+     */
+    hosts?: string[];
+}
+export declare function createOAuthDiscoveryFetch(options?: OAuthDiscoveryFetchOptions): FetchFunction;
+//# sourceMappingURL=oauth-fetch.d.ts.map

package/dist/oauth-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-fetch.d.ts","sourceRoot":"","sources":["../src/oauth-fetch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,KACf,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,0BAA0B;IACzC,qDAAqD;IACrD,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAqED,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CAkDf"}