@intentface/latch-mcp 0.9.1

package/dist/oauth.test.js

@@ -0,0 +1,211 @@
+import { describe, expect, it, vi, beforeEach } from "vitest";
+/**
+ * `scope` may be a function, resolved per caller at flow time.
+ *
+ * This is a correctness requirement rather than API sugar: a single `McpOAuth`
+ * is shared across callers (UI-added connections are cached by connection
+ * NAME, while the connection record — and therefore its requested scopes —
+ * lives in each caller's own Vault). A static scope string would send one
+ * caller's scopes on another caller's authorize request, which for a
+ * *restriction* scope like Loredex's `private_only` means silently handing
+ * someone a broader grant than their connection asked for.
+ */
+const authMock = vi.hoisted(() => vi.fn());
+vi.mock("@ai-sdk/mcp", () => ({
+    auth: authMock,
+}));
+const { createMcpOAuth, decodeOAuthState } = await import("./oauth.js");
+/** Minimal in-memory Vault, keyed by principal so callers stay separate. */
+function fakeVault() {
+    const store = new Map();
+    const k = (p, key) => `${p.userId}::${key}`;
+    return {
+        async set(p, key, value) {
+            store.set(k(p, key), value);
+        },
+        async get(p, key) {
+            return store.get(k(p, key));
+        },
+        async has(p, key) {
+            return store.has(k(p, key));
+        },
+        async delete(p, key) {
+            store.delete(k(p, key));
+        },
+        async list(p) {
+            return [...store.keys()].filter((x) => x.startsWith(`${p.userId}::`));
+        },
+        resolver: {},
+        _store: store,
+    };
+}
+function build(scope, vault = fakeVault()) {
+    return {
+        vault,
+        oauth: createMcpOAuth({
+            vault: vault,
+            config: {
+                name: "loredex",
+                serverUrl: "https://loredex.example/ws/mcp",
+                redirectUrl: "https://latch.example/cb",
+                clientMetadata: {
+                    client_name: "Latch (loredex)",
+                    redirect_uris: ["https://latch.example/cb"],
+                },
+                scope: scope,
+            },
+        }),
+    };
+}
+/** The `scope` value handed to the SDK on the most recent `start()`. */
+const lastScope = () => authMock.mock.calls.at(-1)?.[1]?.scope;
+beforeEach(() => {
+    authMock.mockReset();
+    authMock.mockResolvedValue("AUTHORIZED");
+});
+describe("createMcpOAuth scope resolution", () => {
+    it("passes a static scope through unchanged", async () => {
+        const { oauth } = build("private_only");
+        await oauth.start({ userId: "u1" });
+        expect(lastScope()).toBe("private_only");
+    });
+    it("omits the scope entirely when unset", async () => {
+        // Connections that request nothing must keep their previous, scope-less
+        // authorize request — adding an empty `scope=` would change the ask.
+        const { oauth } = build(undefined);
+        await oauth.start({ userId: "u1" });
+        expect(lastScope()).toBeUndefined();
+    });
+    it("resolves a function scope per caller", async () => {
+        // The core requirement: two callers of the SAME connection get their own
+        // scopes, because the record is per-caller while the client is shared.
+        const scopes = {
+            u1: "private_only",
+            u2: undefined,
+        };
+        const { oauth } = build((p) => scopes[p.userId]);
+        await oauth.start({ userId: "u1" });
+        expect(lastScope()).toBe("private_only");
+        await oauth.start({ userId: "u2" });
+        expect(lastScope()).toBeUndefined();
+        // ...and back again, so nothing was cached from the first resolution.
+        await oauth.start({ userId: "u1" });
+        expect(lastScope()).toBe("private_only");
+    });
+    it("awaits an async scope resolver", async () => {
+        // The real resolver reads the connection out of the Vault, so it is async.
+        const { oauth } = build(async (p) => p.userId === "u1" ? "mcp:read private_only" : undefined);
+        await oauth.start({ userId: "u1" });
+        expect(lastScope()).toBe("mcp:read private_only");
+    });
+});
+describe("authorizationParams", () => {
+    // Providers like Google need extra authorize params the SDK doesn't model
+    // (`access_type=offline&prompt=consent` for a refresh token). They are
+    // appended to the SDK-built redirect URL in start().
+    it("appends the configured params to the authorization URL", async () => {
+        const vault = fakeVault();
+        const oauth = createMcpOAuth({
+            vault: vault,
+            config: {
+                name: "gcal",
+                serverUrl: "https://calendarmcp.example/mcp/v1",
+                redirectUrl: "https://latch.example/cb",
+                clientMetadata: {
+                    client_name: "Latch (gcal)",
+                    redirect_uris: ["https://latch.example/cb"],
+                },
+                authorizationParams: { access_type: "offline", prompt: "consent" },
+            },
+        });
+        // Simulate the SDK asking for a browser redirect.
+        authMock.mockImplementationOnce(async (provider) => {
+            provider.redirectToAuthorization(new URL("https://idp.example/authorize?client_id=abc"));
+            return "REDIRECT";
+        });
+        const res = await oauth.start({ userId: "u1" });
+        if (res.status !== "redirect")
+            throw new Error("expected redirect");
+        const url = new URL(res.authorizationUrl);
+        expect(url.searchParams.get("client_id")).toBe("abc"); // SDK params kept
+        expect(url.searchParams.get("access_type")).toBe("offline");
+        expect(url.searchParams.get("prompt")).toBe("consent");
+    });
+});
+describe("state encoding", () => {
+    it("round-trips app context (incl. a pinned principal) through decodeOAuthState", async () => {
+        // The handler pins the resolved principal into the flow state at
+        // authorize time; the callback must recover it byte-for-byte.
+        const { oauth } = build(undefined);
+        const stateData = {
+            returnTo: "/chat/c1",
+            __latch: { p: { orgId: "org_a", userId: "u1" }, iat: 1_700_000_000_000 },
+        };
+        let sent;
+        authMock.mockImplementationOnce(async (provider) => {
+            sent = provider.state();
+            await provider.saveState(sent);
+            provider.redirectToAuthorization(new URL("https://idp.example/authorize"));
+            return "REDIRECT";
+        });
+        await oauth.start({ userId: "u1" }, { state: stateData });
+        expect(decodeOAuthState(sent)).toEqual(stateData);
+    });
+    it("returns undefined for a bare csrf or garbage", () => {
+        expect(decodeOAuthState("deadbeef")).toBeUndefined();
+        expect(decodeOAuthState("deadbeef.%%%not-b64%%%")).toBeUndefined();
+        expect(decodeOAuthState(null)).toBeUndefined();
+    });
+});
+describe("finish", () => {
+    it("deletes the spent state + verifier but keeps tokens/client/as_info", async () => {
+        // Single-use flow state: a replayed callback URL must find no stored flow
+        // material — while the durable credential parts survive.
+        const { vault, oauth } = build(undefined);
+        const p = { userId: "u1" };
+        for (const part of ["tokens", "verifier", "state", "client", "as_info"]) {
+            await vault.set(p, `mcp_oauth:loredex:${part}`, "x");
+        }
+        authMock.mockResolvedValueOnce("AUTHORIZED");
+        await oauth.finish(p, { code: "abc", state: "deadbeef" });
+        expect(await vault.has(p, "mcp_oauth:loredex:state")).toBe(false);
+        expect(await vault.has(p, "mcp_oauth:loredex:verifier")).toBe(false);
+        expect(await vault.has(p, "mcp_oauth:loredex:tokens")).toBe(true);
+        expect(await vault.has(p, "mcp_oauth:loredex:client")).toBe(true);
+        expect(await vault.has(p, "mcp_oauth:loredex:as_info")).toBe(true);
+    });
+    it("does not delete flow state when the exchange throws", async () => {
+        // A transient exchange failure must leave the flow re-tryable.
+        const { vault, oauth } = build(undefined);
+        const p = { userId: "u1" };
+        await vault.set(p, "mcp_oauth:loredex:state", "s");
+        await vault.set(p, "mcp_oauth:loredex:verifier", "v");
+        authMock.mockRejectedValueOnce(new Error("exchange failed"));
+        await expect(oauth.finish(p, { code: "abc", state: "s" })).rejects.toThrow();
+        expect(await vault.has(p, "mcp_oauth:loredex:state")).toBe(true);
+        expect(await vault.has(p, "mcp_oauth:loredex:verifier")).toBe(true);
+    });
+});
+describe("invalidateCredentials", () => {
+    it("clears the DCR client as well as the tokens", async () => {
+        // A scope change re-runs registration: the stored client was registered
+        // under the old scope, so keeping it would re-request the old grant.
+        const { vault, oauth } = build("private_only");
+        const p = { userId: "u1" };
+        for (const part of ["tokens", "verifier", "state", "client", "as_info"]) {
+            await vault.set(p, `mcp_oauth:loredex:${part}`, "x");
+        }
+        await oauth.provider(p).invalidateCredentials?.("all");
+        expect(await vault.list(p)).toEqual([]);
+    });
+    it("leaves another caller's tokens alone", async () => {
+        const { vault, oauth } = build("private_only");
+        const mine = { userId: "u1" };
+        const theirs = { userId: "u2" };
+        await vault.set(mine, "mcp_oauth:loredex:tokens", "mine");
+        await vault.set(theirs, "mcp_oauth:loredex:tokens", "theirs");
+        await oauth.provider(mine).invalidateCredentials?.("all");
+        expect(await vault.get(theirs, "mcp_oauth:loredex:tokens")).toBe("theirs");
+    });
+});
+//# sourceMappingURL=oauth.test.js.map

package/dist/oauth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.test.js","sourceRoot":"","sources":["../src/oauth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D;;;;;;;;;;GAUG;AAEH,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAE3C,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5B,IAAI,EAAE,QAAQ;CACf,CAAC,CAAC,CAAC;AAEJ,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;AAMxE,4EAA4E;AAC5E,SAAS,SAAS;IAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;IACvD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW,EAAE,KAAa;YACxC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,CAAI,EAAE,GAAW;YAC5B,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAI;YACb,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,QAAQ,EAAE,EAAW;QACrB,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,KAAK,GAAG,SAAS,EAAE;IAChD,OAAO;QACL,KAAK;QACL,KAAK,EAAE,cAAc,CAAI;YACvB,KAAK,EAAE,KAAc;YACrB,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,gCAAgC;gBAC3C,WAAW,EAAE,0BAA0B;gBACvC,cAAc,EAAE;oBACd,WAAW,EAAE,iBAAiB;oBAC9B,aAAa,EAAE,CAAC,0BAA0B,CAAC;iBACnC;gBACV,KAAK,EAAE,KAAc;aACtB;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;AAE/D,UAAU,CAAC,GAAG,EAAE;IACd,QAAQ,CAAC,SAAS,EAAE,CAAC;IACrB,QAAQ,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,MAAM,GAAuC;YACjD,EAAE,EAAE,cAAc;YAClB,EAAE,EAAE,SAAS;SACd,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,CAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpD,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAEzC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;QAEpC,sEAAsE;QACtE,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,2EAA2E;QAC3E,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAI,EAAE,EAAE,CACrC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CACxD,CAAC;QACF,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,qDAAqD;IACrD,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,cAAc,CAAI;YAC9B,KAAK,EAAE,KAAc;YACrB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,SAAS,EAAE,oCAAoC;gBAC/C,WAAW,EAAE,0BAA0B;gBACvC,cAAc,EAAE;oBACd,WAAW,EAAE,cAAc;oBAC3B,aAAa,EAAE,CAAC,0BAA0B,CAAC;iBACnC;gBACV,mBAAmB,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;aACnE;SACF,CAAC,CAAC;QACH,kDAAkD;QAClD,QAAQ,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAEtC,EAAE,EAAE;YACH,QAAQ,CAAC,uBAAuB,CAC9B,IAAI,GAAG,CAAC,6CAA6C,CAAC,CACvD,CAAC;YACF,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB;QACzE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,iEAAiE;QACjE,8DAA8D;QAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG;YAChB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE;SACzE,CAAC;QACF,IAAI,IAAwB,CAAC;QAC7B,QAAQ,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAItC,EAAE,EAAE;YACH,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/B,QAAQ,CAAC,uBAAuB,CAAC,IAAI,GAAG,CAAC,+BAA+B,CAAC,CAAC,CAAC;YAC3E,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACrD,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACnE,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,qBAAqB,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,QAAQ,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,+DAA+D;QAC/D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACtD,QAAQ,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7E,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,qBAAqB,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,0BAA0B,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,0BAA0B,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@intentface/latch-mcp",
+  "version": "0.9.1",
+  "description": "Latch MCP host — connect to MCP servers as tools, with a per-tenant SSRF allowlist and vault-brokered auth.",
+  "keywords": [
+    "ai",
+    "ai-sdk",
+    "agents",
+    "llm",
+    "mcp",
+    "model-context-protocol",
+    "tools"
+  ],
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "dependencies": {
+    "@intentface/latch-core": "^0.9.1",
+    "@intentface/latch-net": "^0.9.1"
+  },
+  "peerDependencies": {
+    "@ai-sdk/mcp": ">=2.0.0",
+    "ai": ">=7.0.0"
+  },
+  "devDependencies": {
+    "@ai-sdk/mcp": "^2.0.0",
+    "ai": "^7.0.2",
+    "typescript": "^5.7.0",
+    "vitest": "^4"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Intentface/intentface-latch.git",
+    "directory": "packages/mcp"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}