@kvman/kvcoder 0.1.0

package/dist/mcp/connect.js

@@ -0,0 +1,54 @@
+import { ProblemError } from '@kvman/sdk';
+import { UnauthorizedError } from '@modelcontextprotocol/sdk/client/auth.js';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport, StreamableHTTPError } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { OAuthError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import { commandTransport } from "./command-transport.js";
+import { oauthProvider, registeredRedirect } from "./oauth-provider.js";
+import { serverSecrets, withoutSecrets } from "./secrets.js";
+async function open(ctx, server, secrets) {
+    if ('command' in server) {
+        const command = commandTransport({ command: server.command, args: server.args, cwd: ctx.job.workspace.path, env: secrets });
+        return { transport: command, command };
+    }
+    // The client's class declares `sessionId` as `string | undefined`, which its own `Transport` doesn't take under
+    // `exactOptionalPropertyTypes`; it is the transport the client is written for.
+    // A server the person signed in to is called with its tokens, which are refreshed when they have expired.
+    const redirectUrl = await registeredRedirect(ctx, server.name);
+    const signedIn = redirectUrl === undefined ? {} : { authProvider: oauthProvider(ctx, server.name, { redirectUrl, step: 'call' }) };
+    const transport = new StreamableHTTPClientTransport(new URL(server.url), { requestInit: { headers: secrets }, ...signedIn });
+    return { transport };
+}
+// The server refused the call for lack of a sign-in it takes: no tokens, or tokens it no longer refreshes.
+const isUnauthorized = (error) => error instanceof UnauthorizedError || error instanceof OAuthError || (error instanceof StreamableHTTPError && error.code === 401);
+// Why a connection failed, for the person and the model: the error's message, then the last of what a command wrote
+// to its error output, with every secret value taken out.
+function failure(server, error, opened, secrets, timedOutAfterMs) {
+    if (isUnauthorized(error))
+        return new ProblemError({ code: 'kvcoder/MCP_SIGN_IN_NEEDED', message: `The MCP server ${server.name} needs the person to sign in, on Coder's page under Extensions.`, params: { server: server.name } });
+    const said = timedOutAfterMs === undefined ? (error instanceof Error ? error.message : String(error)) : `it didn't answer within ${Math.ceil(timedOutAfterMs / 1000)} s`;
+    const reason = withoutSecrets([said, opened.command?.errorOutput() ?? ''].filter((part) => part !== '').join('\n'), secrets);
+    return new ProblemError({ code: 'kvcoder/MCP_CONNECT_FAILED', message: `The MCP server ${server.name} failed: ${reason}`, params: { server: server.name, reason } });
+}
+/** Connects to a server, runs `work`, and closes the connection; a failure is a Problem with the reason. */
+export async function withServer(ctx, server, timeoutMs, work) {
+    const secrets = await serverSecrets(ctx, server);
+    const { version } = await ctx.exec('kernel.health.get', {});
+    const opened = await open(ctx, server, secrets);
+    const deadline = AbortSignal.timeout(timeoutMs);
+    const request = { signal: AbortSignal.any([ctx.job.signal, deadline]), timeout: timeoutMs, maxTotalTimeout: timeoutMs };
+    const client = new Client({ name: 'kvman', version });
+    try {
+        await client.connect(opened.transport, request);
+        return await work({ client, request });
+    }
+    catch (error) {
+        if (error instanceof ProblemError || ctx.job.signal.aborted)
+            throw error;
+        throw failure(server, error, opened, secrets, deadline.aborted ? timeoutMs : undefined);
+    }
+    finally {
+        await client.close();
+    }
+}
+//# sourceMappingURL=connect.js.map

package/dist/mcp/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../src/mcp/connect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAY,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AACxH,OAAO,EAAE,UAAU,EAAE,MAAM,iDAAiD,CAAC;AAG7E,OAAO,EAAE,gBAAgB,EAAyB,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAW7D,KAAK,UAAU,IAAI,CAAC,GAAQ,EAAE,MAAiB,EAAE,OAA+B;IAC9E,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5H,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACzC,CAAC;IACD,gHAAgH;IAChH,+EAA+E;IAC/E,0GAA0G;IAC1G,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACnI,MAAM,SAAS,GAAc,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,CAAc,CAAC;IACrJ,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC;AAED,2GAA2G;AAC3G,MAAM,cAAc,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,KAAK,YAAY,iBAAiB,IAAI,KAAK,YAAY,UAAU,IAAI,CAAC,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAEtL,oHAAoH;AACpH,0DAA0D;AAC1D,SAAS,OAAO,CAAC,MAAiB,EAAE,KAAc,EAAE,MAAc,EAAE,OAA+B,EAAE,eAAmC;IACtI,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,kBAAkB,MAAM,CAAC,IAAI,iEAAiE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrO,MAAM,IAAI,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC;IACzK,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7H,OAAO,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,kBAAkB,MAAM,CAAC,IAAI,YAAY,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AACvK,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,UAAU,CAAS,GAAQ,EAAE,MAAiB,EAAE,SAAiB,EAAE,IAAiD;IACxI,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,OAAO,GAAmB,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;IACxI,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC;QACzE,MAAM,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1F,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/mcp/oauth-provider.d.ts

@@ -0,0 +1,25 @@
+import { type Ctx } from '@kvman/sdk';
+import { type OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
+/** A server's sign-in secrets. */
+export declare const oauthSecrets: (server: string) => {
+    client: string;
+    verifier: string;
+    tokens: string;
+};
+/** The redirect address the server's client registration was made for, when there is one. */
+export declare function registeredRedirect(ctx: Ctx, server: string): Promise<string | undefined>;
+/** What the client is used for: starting a sign-in, exchanging its code, or a call that may only refresh tokens. */
+export type SignIn = {
+    redirectUrl: string;
+    step: 'start';
+    state: string;
+    open(authorizationUrl: URL): void;
+} | {
+    redirectUrl: string;
+    step: 'finish';
+} | {
+    redirectUrl: string;
+    step: 'call';
+};
+export declare function oauthProvider(ctx: Ctx, server: string, signIn: SignIn): OAuthClientProvider;
+//# sourceMappingURL=oauth-provider.d.ts.map

package/dist/mcp/oauth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../../src/mcp/oauth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAK,KAAK,GAAG,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAOvG,kCAAkC;AAClC,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM;;;;CAA+H,CAAC;AAU3K,6FAA6F;AAC7F,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE9F;AAED,oHAAoH;AACpH,MAAM,MAAM,MAAM,GACd;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,GAAG,IAAI,CAAA;CAAE,GACxF;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GACvC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAkC3F"}

package/dist/mcp/oauth-provider.js

@@ -0,0 +1,59 @@
+import { z } from '@kvman/sdk';
+import { UnauthorizedError } from '@modelcontextprotocol/sdk/client/auth.js';
+// kvman as an OAuth client of one MCP server (plan 08 §8.5, ADR 0020, 8 and 16), over kvcoder's secrets: the client
+// registration with the address it was made for, the code verifier of a sign-in under way, and the tokens. A tool
+// call refreshes tokens but never sends the person to a browser: that is what a sign-in from the server's row does.
+/** A server's sign-in secrets. */
+export const oauthSecrets = (server) => ({ client: `mcp.${server}.oauth.client`, verifier: `mcp.${server}.oauth.verifier`, tokens: `mcp.${server}.oauth.tokens` });
+const clientSchema = z.object({ redirectUrl: z.string(), information: z.looseObject({ client_id: z.string() }) });
+const tokensSchema = z.looseObject({ access_token: z.string(), token_type: z.string() });
+async function stored(ctx, name, schema) {
+    const value = await ctx.secrets.get(name);
+    return value === undefined ? undefined : schema.parse(JSON.parse(value));
+}
+/** The redirect address the server's client registration was made for, when there is one. */
+export async function registeredRedirect(ctx, server) {
+    return (await stored(ctx, oauthSecrets(server).client, clientSchema))?.redirectUrl;
+}
+export function oauthProvider(ctx, server, signIn) {
+    const names = oauthSecrets(server);
+    return {
+        redirectUrl: signIn.redirectUrl,
+        clientMetadata: { client_name: 'kvman', redirect_uris: [signIn.redirectUrl], grant_types: ['authorization_code', 'refresh_token'], response_types: ['code'], token_endpoint_auth_method: 'none' },
+        ...(signIn.step === 'start' ? { state: () => signIn.state } : {}),
+        // A registration made for another address (kvman on another port) can't be used with this one.
+        clientInformation: async () => {
+            const client = await stored(ctx, names.client, clientSchema);
+            return client?.redirectUrl === signIn.redirectUrl ? client.information : undefined;
+        },
+        // A call never registers kvman with a server: only a sign-in the person started does.
+        ...(signIn.step === 'call' ? {} : { saveClientInformation: (information) => ctx.secrets.set(names.client, JSON.stringify({ redirectUrl: signIn.redirectUrl, information })) }),
+        tokens: async () => (await stored(ctx, names.tokens, tokensSchema)),
+        saveTokens: (tokens) => ctx.secrets.set(names.tokens, JSON.stringify(tokens)),
+        saveCodeVerifier: async (verifier) => {
+            if (signIn.step === 'start')
+                await ctx.secrets.set(names.verifier, verifier);
+        },
+        codeVerifier: async () => {
+            const verifier = await ctx.secrets.get(names.verifier);
+            if (verifier === undefined)
+                throw new UnauthorizedError('No sign-in is under way.');
+            return verifier;
+        },
+        redirectToAuthorization: (authorizationUrl) => {
+            if (signIn.step !== 'start')
+                throw new UnauthorizedError('The person must sign in.');
+            signIn.open(authorizationUrl);
+        },
+        // What the server no longer takes is forgotten, so the next attempt doesn't offer it again.
+        invalidateCredentials: async (scope) => {
+            if (scope === 'all' || scope === 'tokens')
+                await ctx.secrets.delete(names.tokens);
+            if (scope === 'all' || scope === 'client')
+                await ctx.secrets.delete(names.client);
+            if (scope === 'all' || scope === 'verifier')
+                await ctx.secrets.delete(names.verifier);
+        },
+    };
+}
+//# sourceMappingURL=oauth-provider.js.map

package/dist/mcp/oauth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../../src/mcp/oauth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAY,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAA4B,MAAM,0CAA0C,CAAC;AAGvG,oHAAoH;AACpH,kHAAkH;AAClH,oHAAoH;AAEpH,kCAAkC;AAClC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,MAAM,eAAe,EAAE,QAAQ,EAAE,OAAO,MAAM,iBAAiB,EAAE,MAAM,EAAE,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC;AAE3K,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AAClH,MAAM,YAAY,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEzF,KAAK,UAAU,MAAM,CAA2B,GAAQ,EAAE,IAAY,EAAE,MAAc;IACpF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAQ,EAAE,MAAc;IAC/D,OAAO,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,EAAE,WAAW,CAAC;AACrF,CAAC;AAQD,MAAM,UAAU,aAAa,CAAC,GAAQ,EAAE,MAAc,EAAE,MAAc;IACpE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE,MAAM,EAAE;QACjM,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,+FAA+F;QAC/F,iBAAiB,EAAE,KAAK,IAAI,EAAE;YAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC7D,OAAO,MAAM,EAAE,WAAW,KAAK,MAAM,CAAC,WAAW,CAAC,CAAC,CAAE,MAAM,CAAC,WAA2C,CAAC,CAAC,CAAC,SAAS,CAAC;QACtH,CAAC;QACD,sFAAsF;QACtF,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,WAAwC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QAC3M,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAA4B;QAC9F,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7E,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACnC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC;QACD,YAAY,EAAE,KAAK,IAAI,EAAE;YACvB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YACpF,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,uBAAuB,EAAE,CAAC,gBAAgB,EAAE,EAAE;YAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YACrF,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;QACD,4FAA4F;QAC5F,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACrC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClF,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClF,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,UAAU;gBAAE,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/mcp/register-mcp.d.ts

@@ -0,0 +1,3 @@
+import { type Ctx } from '@kvman/sdk';
+export declare function registerMcp(ctx: Ctx): void;
+//# sourceMappingURL=register-mcp.d.ts.map

package/dist/mcp/register-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-mcp.d.ts","sourceRoot":"","sources":["../../src/mcp/register-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,GAAG,EAAE,MAAM,YAAY,CAAC;AAcvD,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CA6C1C"}

package/dist/mcp/register-mcp.js

@@ -0,0 +1,61 @@
+import { ProblemError, z } from '@kvman/sdk';
+import { userOnly } from "../sessions/session-lookup.js";
+import { mcpServer } from "./servers.js";
+import { listTools } from "./tools.js";
+// What kvcoder's configuration asks about an MCP server (plan 08 §8.6, ADR 0020, 11 and 14): its state is checked when
+// the dialog shows it, and never stored; and the person signs in to it from its row.
+/** How long a check gives a server to start and list its tools. */
+const checkTimeoutMs = 30_000;
+const problemSchema = z.object({ code: z.string(), message: z.string(), params: z.record(z.string(), z.json()).exactOptional() });
+const checkOutput = z.union([z.object({ status: z.literal('ready'), tools: z.number().int() }), z.object({ status: z.literal('signInNeeded') }), z.object({ status: z.literal('failed'), problem: problemSchema })]);
+export function registerMcp(ctx) {
+    ctx.registerCommand('kvcoder.mcp.server.check', {
+        description: 'Connects to one MCP server of kvcoder.mcp.servers and says whether it is ready, with how many tools, needs a sign-in, or failed.',
+        input: z.strictObject({ name: z.string().min(1) }),
+        output: checkOutput,
+        public: true,
+        retries: 0,
+        handle: async ({ name }) => {
+            const server = await mcpServer(ctx, name);
+            const { withServer } = await import("./connect.js");
+            try {
+                return { status: 'ready', tools: (await withServer(ctx, server, checkTimeoutMs, listTools)).length };
+            }
+            catch (error) {
+                if (!(error instanceof ProblemError) || ctx.job.signal.aborted)
+                    throw error;
+                if (error.problem.code === 'kvcoder/MCP_SIGN_IN_NEEDED')
+                    return { status: 'signInNeeded' };
+                if (error.problem.code === 'kvcoder/MCP_CONNECT_FAILED')
+                    return { status: 'failed', problem: problemSchema.parse(error.problem) };
+                throw error;
+            }
+        },
+    });
+    ctx.registerCommand('kvcoder.mcp.sign-in.start', {
+        description: "Starts the person's sign-in to an MCP server reached at a URL, and gives the address to open in the browser.",
+        input: z.strictObject({ name: z.string().min(1), redirectUrl: z.string().min(1) }),
+        output: z.object({ url: z.string() }),
+        public: true,
+        retries: 0,
+        handle: async ({ name, redirectUrl }) => {
+            userOnly(ctx, 'kvcoder.mcp.sign-in.start');
+            const { startSignIn } = await import("./sign-in.js");
+            return startSignIn(ctx, name, redirectUrl);
+        },
+    });
+    ctx.registerCommand('kvcoder.mcp.sign-in.finish', {
+        description: 'Finishes a started sign-in with the code the server sent back, and stores the tokens as secrets.',
+        input: z.strictObject({ state: z.string().min(1), code: z.string().min(1) }),
+        output: z.object({ name: z.string() }),
+        public: true,
+        retries: 0,
+        syncOnly: true,
+        handle: async ({ state, code }) => {
+            userOnly(ctx, 'kvcoder.mcp.sign-in.finish');
+            const { finishSignIn } = await import("./sign-in.js");
+            return finishSignIn(ctx, state, code);
+        },
+    });
+}
+//# sourceMappingURL=register-mcp.js.map

package/dist/mcp/register-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-mcp.js","sourceRoot":"","sources":["../../src/mcp/register-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,CAAC,EAAY,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,uHAAuH;AACvH,qFAAqF;AAErF,mEAAmE;AACnE,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AAClI,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;AAErN,MAAM,UAAU,WAAW,CAAC,GAAQ;IAClC,GAAG,CAAC,eAAe,CAAC,0BAA0B,EAAE;QAC9C,WAAW,EAAE,kIAAkI;QAC/I,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YACzB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC1C,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,KAAK,EAAE,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAChH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,KAAK,CAAC;gBAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,4BAA4B;oBAAE,OAAO,EAAE,MAAM,EAAE,cAAuB,EAAE,CAAC;gBACpG,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,4BAA4B;oBAAE,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3I,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IACH,GAAG,CAAC,eAAe,CAAC,2BAA2B,EAAE;QAC/C,WAAW,EAAE,8GAA8G;QAC3H,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;YACtC,QAAQ,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;YAC3C,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YACrD,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;KACF,CAAC,CAAC;IACH,GAAG,CAAC,eAAe,CAAC,4BAA4B,EAAE;QAChD,WAAW,EAAE,kGAAkG;QAC/G,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;YAChC,QAAQ,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YAC5C,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YACtD,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/mcp/secrets.d.ts

@@ -0,0 +1,7 @@
+import type { Ctx } from '@kvman/sdk';
+import type { McpServer } from './servers.ts';
+/** The values a server is given, by variable or header name; a name without a secret is left out. */
+export declare function serverSecrets(ctx: Ctx, server: McpServer): Promise<Record<string, string>>;
+/** A text with every one of the values replaced by `***`, so a server's failure can't carry a secret out. */
+export declare function withoutSecrets(text: string, values: Readonly<Record<string, string>>): string;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/mcp/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/mcp/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAK9C,qGAAqG;AACrG,wBAAsB,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAQhG;AAED,6GAA6G;AAC7G,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAI7F"}

package/dist/mcp/secrets.js

@@ -0,0 +1,20 @@
+// A server's secret values (plan 08 §8.5, ADR 0020, 6): kvcoder's secrets `mcp.<server>.env.<VARIABLE>` and
+// `mcp.<server>.header.<Header>`. They go to the server and nowhere else.
+/** The values a server is given, by variable or header name; a name without a secret is left out. */
+export async function serverSecrets(ctx, server) {
+    const [kind, names] = 'command' in server ? ['env', server.env] : ['header', server.headers];
+    const values = {};
+    for (const name of names) {
+        const value = await ctx.secrets.get(`mcp.${server.name}.${kind}.${name}`);
+        if (value !== undefined)
+            values[name] = value;
+    }
+    return values;
+}
+/** A text with every one of the values replaced by `***`, so a server's failure can't carry a secret out. */
+export function withoutSecrets(text, values) {
+    return Object.values(values)
+        .filter((value) => value !== '')
+        .reduce((cleaned, value) => cleaned.replaceAll(value, '***'), text);
+}
+//# sourceMappingURL=secrets.js.map

package/dist/mcp/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/mcp/secrets.ts"],"names":[],"mappings":"AAGA,4GAA4G;AAC5G,0EAA0E;AAE1E,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAQ,EAAE,MAAiB;IAC7D,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,SAAS,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAW,CAAC,CAAC,CAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAW,CAAC;IACnH,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAwC;IACnF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;SACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;SAC/B,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AACxE,CAAC"}

package/dist/mcp/servers.d.ts

@@ -0,0 +1,33 @@
+import { z, type Ctx } from '@kvman/sdk';
+/** One MCP server: a command, or an address. */
+export declare const mcpServerSchema: z.ZodUnion<readonly [z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+    command: z.ZodString;
+    args: z.ZodArray<z.ZodString>;
+    env: z.ZodArray<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+    url: z.ZodString;
+    headers: z.ZodArray<z.ZodString>;
+}, z.core.$strict>]>;
+/** The `kvcoder.mcp.servers` setting: each server has its own name. */
+export declare const mcpServersSchema: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+    command: z.ZodString;
+    args: z.ZodArray<z.ZodString>;
+    env: z.ZodArray<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+    url: z.ZodString;
+    headers: z.ZodArray<z.ZodString>;
+}, z.core.$strict>]>>;
+export type McpServer = z.output<typeof mcpServerSchema>;
+/** The servers of the job's workspace, in the setting's order. */
+export declare function mcpServers(ctx: Ctx): Promise<McpServer[]>;
+/** One server by name, or `kvcoder/MCP_SERVER_NOT_FOUND` naming the ones there are. */
+export declare function mcpServer(ctx: Ctx, name: string): Promise<McpServer>;
+//# sourceMappingURL=servers.d.ts.map

package/dist/mcp/servers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"servers.d.ts","sourceRoot":"","sources":["../../src/mcp/servers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,CAAC,EAAE,KAAK,GAAG,EAAE,MAAM,YAAY,CAAC;AAkBvD,gDAAgD;AAChD,eAAO,MAAM,eAAe;;;;;;;;;;;oBAAkD,CAAC;AAE/E,uEAAuE;AACvE,eAAO,MAAM,gBAAgB;;;;;;;;;;;qBAAyJ,CAAC;AAEvL,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;AAEzD,kEAAkE;AAClE,wBAAsB,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAE/D;AAED,uFAAuF;AACvF,wBAAsB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAM1E"}

package/dist/mcp/servers.js

@@ -0,0 +1,31 @@
+import { ProblemError, z } from '@kvman/sdk';
+import { wordSchema } from "../schemas/registry.js";
+// The MCP servers the person added (plan 08 §8.5, ADR 0020, 4, 6, and 9): the setting `kvcoder.mcp.servers`. A server
+// is a command that speaks MCP on its standard input and output, or an address reached over Streamable HTTP. `env` and
+// `headers` hold names only: each value is one of kvcoder's secrets.
+const text = z.string().min(1);
+const variableName = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/, 'Use letters, digits, and _, not starting with a digit.');
+const headerName = z.string().regex(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/, 'Use the characters of an HTTP header name.');
+function isHttpAddress(value) {
+    return URL.canParse(value) && ['http:', 'https:'].includes(new URL(value).protocol);
+}
+const commandServerSchema = z.strictObject({ name: wordSchema, description: text, command: text, args: z.array(z.string()), env: z.array(variableName) });
+const urlServerSchema = z.strictObject({ name: wordSchema, description: text, url: z.string().refine(isHttpAddress, 'Give an http or https address.'), headers: z.array(headerName) });
+/** One MCP server: a command, or an address. */
+export const mcpServerSchema = z.union([commandServerSchema, urlServerSchema]);
+/** The `kvcoder.mcp.servers` setting: each server has its own name. */
+export const mcpServersSchema = z.array(mcpServerSchema).refine((servers) => new Set(servers.map((server) => server.name)).size === servers.length, 'Each server needs its own name.');
+/** The servers of the job's workspace, in the setting's order. */
+export async function mcpServers(ctx) {
+    return mcpServersSchema.parse(await ctx.settings.get('kvcoder.mcp.servers'));
+}
+/** One server by name, or `kvcoder/MCP_SERVER_NOT_FOUND` naming the ones there are. */
+export async function mcpServer(ctx, name) {
+    const servers = await mcpServers(ctx);
+    const found = servers.find((server) => server.name === name);
+    if (found !== undefined)
+        return found;
+    const names = servers.map((server) => server.name).join(', ');
+    throw new ProblemError({ code: 'kvcoder/MCP_SERVER_NOT_FOUND', message: `There is no MCP server ${name}. ${names === '' ? 'No server is set up.' : `The servers are: ${names}.`}`, params: { server: name } });
+}
+//# sourceMappingURL=servers.js.map

package/dist/mcp/servers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"servers.js","sourceRoot":"","sources":["../../src/mcp/servers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,CAAC,EAAY,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,sHAAsH;AACtH,uHAAuH;AACvH,qEAAqE;AAErE,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,EAAE,wDAAwD,CAAC,CAAC;AAC5H,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE,4CAA4C,CAAC,CAAC;AAEnH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAC1J,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,gCAAgC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AAEvL,gDAAgD;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC,CAAC;AAE/E,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;AAIvL,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAQ;IACvC,OAAO,gBAAgB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,IAAY;IACpD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,0BAA0B,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,KAAK,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACjN,CAAC"}

package/dist/mcp/sign-in-record.d.ts

@@ -0,0 +1,10 @@
+import { z } from '@kvman/sdk';
+/** A sign-in to an MCP server that was started and not yet finished (plan 08 §8.5): kept in the global store, by its state. */
+export declare const signInDocSchema: z.ZodObject<{
+    state: z.ZodString;
+    server: z.ZodString;
+    url: z.ZodString;
+    redirectUrl: z.ZodString;
+    at: z.ZodNumber;
+}, z.core.$strip>;
+//# sourceMappingURL=sign-in-record.d.ts.map

package/dist/mcp/sign-in-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-record.d.ts","sourceRoot":"","sources":["../../src/mcp/sign-in-record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,YAAY,CAAC;AAE/B,+HAA+H;AAC/H,eAAO,MAAM,eAAe;;;;;;iBAAgH,CAAC"}

package/dist/mcp/sign-in-record.js

@@ -0,0 +1,4 @@
+import { z } from '@kvman/sdk';
+/** A sign-in to an MCP server that was started and not yet finished (plan 08 §8.5): kept in the global store, by its state. */
+export const signInDocSchema = z.object({ state: z.string(), server: z.string(), url: z.string(), redirectUrl: z.string(), at: z.number() });
+//# sourceMappingURL=sign-in-record.js.map

package/dist/mcp/sign-in-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-record.js","sourceRoot":"","sources":["../../src/mcp/sign-in-record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,YAAY,CAAC;AAE/B,+HAA+H;AAC/H,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC"}

package/dist/mcp/sign-in.d.ts

@@ -0,0 +1,12 @@
+import { type Ctx } from '@kvman/sdk';
+/** Whether an address is kvcoder's sign-in page on this computer: nothing else may receive a code. */
+export declare function isSignInPage(address: string): boolean;
+/** Starts a sign-in and gives the address the person opens. */
+export declare function startSignIn(ctx: Ctx, name: string, redirectUrl: string): Promise<{
+    url: string;
+}>;
+/** Finishes a started sign-in with the code the server sent back, and stores the tokens. */
+export declare function finishSignIn(ctx: Ctx, state: string, code: string): Promise<{
+    name: string;
+}>;
+//# sourceMappingURL=sign-in.d.ts.map

package/dist/mcp/sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in.d.ts","sourceRoot":"","sources":["../../src/mcp/sign-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,GAAG,EAAE,MAAM,YAAY,CAAC;AAiBpD,sGAAsG;AACtG,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAIrD;AAOD,+DAA+D;AAC/D,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBvG;AAED,4FAA4F;AAC5F,wBAAsB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBnG"}

package/dist/mcp/sign-in.js

@@ -0,0 +1,75 @@
+import { randomUUID } from 'node:crypto';
+import { ProblemError } from '@kvman/sdk';
+import { auth } from '@modelcontextprotocol/sdk/client/auth.js';
+import { invalid } from "../problems.js";
+import { records } from "../store/collections.js";
+import { oauthProvider, oauthSecrets } from "./oauth-provider.js";
+import { mcpServer } from "./servers.js";
+// Signing in to an MCP server (plan 08 §8.5, ADR 0020, 8, 11, and 16). `start` registers kvman with the server when it
+// hasn't yet and gives the address to open; the server sends the browser back to kvcoder's sign-in page, which calls
+// `finish` with the code. A started sign-in is kept in the global store for 10 minutes, so finishing needs no workspace.
+const signInLifeMs = 10 * 60_000;
+// A job id is a UUIDv7: its first 48 bits are the kernel's clock in milliseconds, so a sign-in's age follows that clock.
+const jobTime = (ctx) => Number.parseInt(ctx.job.id.replaceAll('-', '').slice(0, 12), 16);
+const redirectPath = '/kvcoder/mcp-sign-in';
+/** Whether an address is kvcoder's sign-in page on this computer: nothing else may receive a code. */
+export function isSignInPage(address) {
+    if (!URL.canParse(address))
+        return false;
+    const url = new URL(address);
+    return url.protocol === 'http:' && ['127.0.0.1', 'localhost'].includes(url.hostname) && url.pathname === redirectPath && url.search === '' && url.hash === '' && url.username === '' && url.password === '';
+}
+const failed = (error) => {
+    const reason = error instanceof Error ? error.message : String(error);
+    return new ProblemError({ code: 'kvcoder/MCP_SIGN_IN_FAILED', message: `The sign-in failed: ${reason}`, params: { reason } });
+};
+/** Starts a sign-in and gives the address the person opens. */
+export async function startSignIn(ctx, name, redirectUrl) {
+    if (!isSignInPage(redirectUrl))
+        throw invalid(`The redirect address must be http://127.0.0.1:<port>${redirectPath}, or the same on localhost.`);
+    const server = await mcpServer(ctx, name);
+    if (!('url' in server))
+        throw invalid(`${name} runs as a command; only a server reached at a URL is signed in to.`, { server: name });
+    // Whatever was left of an earlier sign-in would be used in place of a new one.
+    await ctx.secrets.delete(oauthSecrets(name).tokens);
+    const state = randomUUID();
+    let opened;
+    try {
+        await auth(oauthProvider(ctx, name, { redirectUrl, step: 'start', state, open: (authorizationUrl) => void (opened = authorizationUrl) }), { serverUrl: server.url });
+    }
+    catch (error) {
+        if (error instanceof ProblemError || ctx.job.signal.aborted)
+            throw error;
+        throw failed(error);
+    }
+    if (opened === undefined)
+        throw failed(new Error('the server gave no address to sign in at'));
+    await records(ctx.store).signIns.insert({ state, server: name, url: server.url, redirectUrl, at: jobTime(ctx) });
+    return { url: opened.href };
+}
+/** Finishes a started sign-in with the code the server sent back, and stores the tokens. */
+export async function finishSignIn(ctx, state, code) {
+    const { signIns } = records(ctx.store);
+    for (const old of await signIns.find({}, { limit: 1000 }))
+        if (old.at < jobTime(ctx) - signInLifeMs)
+            await signIns.delete(old.id);
+    const [started] = await signIns.find({ state }, { limit: 1 });
+    if (started === undefined)
+        throw failed(new Error('it was not started here, was already finished, or took more than 10 minutes'));
+    await signIns.delete(started.id);
+    try {
+        const result = await auth(oauthProvider(ctx, started.server, { redirectUrl: started.redirectUrl, step: 'finish' }), { serverUrl: started.url, authorizationCode: code });
+        if (result !== 'AUTHORIZED')
+            throw new Error('the server did not accept the code');
+    }
+    catch (error) {
+        if (error instanceof ProblemError || ctx.job.signal.aborted)
+            throw error;
+        throw failed(error);
+    }
+    finally {
+        await ctx.secrets.delete(oauthSecrets(started.server).verifier);
+    }
+    return { name: started.server };
+}
+//# sourceMappingURL=sign-in.js.map

package/dist/mcp/sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in.js","sourceRoot":"","sources":["../../src/mcp/sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAY,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,0CAA0C,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,uHAAuH;AACvH,qHAAqH;AACrH,yHAAyH;AAEzH,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AAEjC,yHAAyH;AACzH,MAAM,OAAO,GAAG,CAAC,GAAQ,EAAU,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACvG,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C,sGAAsG;AACtG,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;AAC9M,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAgB,EAAE;IAC9C,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,uBAAuB,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAChI,CAAC,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ,EAAE,IAAY,EAAE,WAAmB;IAC3E,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;QAAE,MAAM,OAAO,CAAC,uDAAuD,YAAY,6BAA6B,CAAC,CAAC;IAChJ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC;QAAE,MAAM,OAAO,CAAC,GAAG,IAAI,qEAAqE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACtI,+EAA+E;IAC/E,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACvK,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC;QACzE,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;IAC9F,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjH,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAQ,EAAE,KAAa,EAAE,IAAY;IACtE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAAE,IAAI,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY;YAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClI,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9D,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,MAAM,CAAC,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC,CAAC;IAClI,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzK,IAAI,MAAM,KAAK,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC;QACzE,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/mcp/tools.d.ts

@@ -0,0 +1,19 @@
+import { z } from '@kvman/sdk';
+import type { Connection } from './connect.ts';
+declare const toolSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    inputSchema: z.ZodJSONSchema;
+}, z.core.$strip>;
+export type McpTool = z.output<typeof toolSchema>;
+/** Every tool of the server, through all of its pages. */
+export declare function listTools({ client, request }: Connection): Promise<McpTool[]>;
+/** The server's tool by name, or `NOT_FOUND` naming the tools it has. */
+export declare function toolNamed(server: string, tools: readonly McpTool[], name: string): McpTool;
+/** A tool's result: its text blocks joined by a blank line, a block of another kind as `[<kind> omitted]`, and whether the tool says it failed. */
+export declare function resultText(result: unknown): {
+    text: string;
+    isError: boolean;
+};
+export {};
+//# sourceMappingURL=tools.d.ts.map

package/dist/mcp/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,YAAY,CAAC;AAE/B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C,QAAA,MAAM,UAAU;;;;iBAA4F,CAAC;AAE7G,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC;AAElD,0DAA0D;AAC1D,wBAAsB,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CASnF;AAED,yEAAyE;AACzE,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAI1F;AAKD,mJAAmJ;AACnJ,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAI9E"}

package/dist/mcp/tools.js

@@ -0,0 +1,31 @@
+import { z } from '@kvman/sdk';
+import { notFound } from "../problems.js";
+// A server's tools and a call's result as the model reads them (plan 08 §8.5, ADR 0020, 10 and 16).
+const toolSchema = z.object({ name: z.string(), description: z.string().optional(), inputSchema: z.json() });
+/** Every tool of the server, through all of its pages. */
+export async function listTools({ client, request }) {
+    const tools = [];
+    let cursor;
+    do {
+        const page = await client.listTools(cursor === undefined ? {} : { cursor }, request);
+        tools.push(...z.array(toolSchema).parse(page.tools));
+        cursor = page.nextCursor;
+    } while (cursor !== undefined);
+    return tools;
+}
+/** The server's tool by name, or `NOT_FOUND` naming the tools it has. */
+export function toolNamed(server, tools, name) {
+    const found = tools.find((tool) => tool.name === name);
+    if (found !== undefined)
+        return found;
+    throw notFound(`${server} has no tool ${name}. Its tools are: ${tools.map((tool) => tool.name).join(', ')}.`, { server, tool: name });
+}
+const blockSchema = z.looseObject({ type: z.string(), text: z.string().optional() });
+const resultSchema = z.looseObject({ content: z.array(blockSchema).default([]), isError: z.boolean().optional() });
+/** A tool's result: its text blocks joined by a blank line, a block of another kind as `[<kind> omitted]`, and whether the tool says it failed. */
+export function resultText(result) {
+    const { content, isError } = resultSchema.parse(result);
+    const text = content.map((block) => (block.type === 'text' && block.text !== undefined ? block.text : `[${block.type} omitted]`)).join('\n\n');
+    return { text, isError: isError === true };
+}
+//# sourceMappingURL=tools.js.map

package/dist/mcp/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,oGAAoG;AAEpG,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAI7G,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAc;IAC7D,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,IAAI,MAA0B,CAAC;IAC/B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;QACrF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC,QAAQ,MAAM,KAAK,SAAS,EAAE;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,KAAyB,EAAE,IAAY;IAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,QAAQ,CAAC,GAAG,MAAM,gBAAgB,IAAI,oBAAoB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACxI,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACrF,MAAM,YAAY,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEnH,mJAAmJ;AACnJ,MAAM,UAAU,UAAU,CAAC,MAAe;IACxC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/I,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;AAC7C,CAAC"}

package/dist/messages/attachments.d.ts

@@ -0,0 +1,8 @@
+import type { Ctx, File } from '@kvman/sdk';
+/** A file's name as it is saved: its base name, with only letters, digits, space, and `._-()` kept. */
+export declare function safeName(name: string): string;
+/** Saves the files into the workspace folder and gives their paths in it; a user upload leaves the kernel's files. */
+export declare function saveAttachments(ctx: Ctx, files: readonly File[]): Promise<string[]>;
+/** The message's text with its saved files named at its end. */
+export declare function withAttachments(text: string, saved: readonly string[]): string;
+//# sourceMappingURL=attachments.d.ts.map

package/dist/messages/attachments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../../src/messages/attachments.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAW5C,uGAAuG;AACvG,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI7C;AAeD,sHAAsH;AACtH,wBAAsB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAUzF;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAE9E"}