@nimbus-dev/connectors 0.2.1 → 0.2.2

package/connectors/figma/src/tools.ts

@@ -0,0 +1,99 @@
+import { z } from "zod";
+import { createJsonGetter, envAuthHeaders, requiredEnv } from "../../../shared/env-json-api.ts";
+import { searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterFigmaFiles } from "./search-filter.ts";
+
+const BASE = "https://api.figma.com";
+
+const figmaGet = createJsonGetter({
+  base: BASE,
+  label: "Figma",
+  headers: envAuthHeaders({ env: "FIGMA_TOKEN" }),
+});
+
+function projectsFrom(root: unknown): Array<{ id: string; name: string }> {
+  const projects = (root as { projects?: unknown } | null)?.projects;
+  if (!Array.isArray(projects)) {
+    return [];
+  }
+  const out: Array<{ id: string; name: string }> = [];
+  for (const p of projects) {
+    const rec = p as { id?: unknown; name?: unknown } | null;
+    const id = rec?.id;
+    if (typeof id === "string" || typeof id === "number") {
+      out.push({
+        id: String(id),
+        name: typeof rec?.name === "string" ? rec.name : "",
+      });
+    }
+  }
+  return out;
+}
+
+function filesFrom(root: unknown): unknown[] {
+  const files = (root as { files?: unknown } | null)?.files;
+  return Array.isArray(files) ? files : [];
+}
+
+/**
+ * Flatten the configured team's projects into a single list of files, tagging
+ * each file with its `project_name` for searchability. This is the two-level
+ * fetch: GET /v1/teams/<team_id>/projects, then GET /v1/projects/<id>/files for
+ * each project.
+ */
+async function listTeamFiles(): Promise<unknown[]> {
+  const teamId = encodeURIComponent(requiredEnv("FIGMA_TEAM_ID"));
+  const projectsRoot = await figmaGet(`/v1/teams/${teamId}/projects`);
+  const projects = projectsFrom(projectsRoot);
+  const out: unknown[] = [];
+  for (const project of projects) {
+    const filesRoot = await figmaGet(`/v1/projects/${encodeURIComponent(project.id)}/files`); // NOSONAR S9382: one request per team project, one at a time on purpose — the project count is unbounded and Figma's REST API is rate-limited, so a fan-out would turn a large team into 429s.
+    for (const f of filesFrom(filesRoot)) {
+      const rec = f as Record<string, unknown> | null;
+      out.push({
+        ...rec,
+        project_id: project.id,
+        project_name: project.name,
+      });
+    }
+  }
+  return out;
+}
+
+/** Tool names exposed by this connector — for contract/introspection tests. */
+export const FIGMA_TOOL_NAMES = ["figma_get", "figma_list", "figma_search"] as const;
+
+export function registerFigmaTools(reg: ZodToolRegistrar): void {
+  reg(
+    "figma_list",
+    "List the configured team's Figma files. Two-level fetch: GET /v1/teams/<team_id>/projects (the team id is injected at spawn from the figma.team_id vault key) returns { name, projects: [{ id, name }] }; then for each project GET /v1/projects/<project_id>/files returns { name, files: [{ key, name, thumbnail_url, last_modified }] }. Returns a flattened { files: [...] } envelope where each file is shaped { key, name, thumbnail_url, last_modified, project_id, project_name }. Neither endpoint paginates — each returns the full list.",
+    z.object({}),
+    async () => {
+      return jsonResult({ files: await listTeamFiles() });
+    },
+  );
+
+  reg(
+    "figma_get",
+    "List the files in one Figma project by its id (GET /v1/projects/{projectId}/files). Returns the { name, files: [{ key, name, thumbnail_url, last_modified }] } envelope directly. Throws when no project with that id is accessible.",
+    z.object({
+      projectId: z.string().min(1),
+    }),
+    async (p) => {
+      return jsonResult(await figmaGet(`/v1/projects/${encodeURIComponent(p.projectId)}/files`));
+    },
+  );
+
+  reg(
+    "figma_search",
+    "Substring search across the configured team's Figma files. Runs the same two-level fetch as figma_list (team projects, then files per project), flattens the result, and matches the query locally (case-insensitive) against each file name and its project name. Returns a { matches: [...] } envelope.",
+    searchToolInputSchema(200),
+    async (p) => {
+      const files = await listTeamFiles();
+      const matches = filterFigmaFiles(files, { query: p.query, limit: p.limit });
+      return jsonResult({ matches });
+    },
+  );
+}

package/connectors/firebase/src/server.ts

@@ -1,94 +1,6 @@
-import { mintGoogleAccessToken } from "@nimbus-dev/sdk";
-import { z } from "zod";
-import { matchesResult } from "../../../shared/mcp-search-tool.ts";
-import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
 import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
-import { filterFirebaseReleases } from "./search-filter.ts";
-import { configuredAppIds, projectNumberFromAppId, serviceAccountFromEnv } from "./token.ts";
-
-const APP_DISTRIBUTION_API = "https://firebaseappdistribution.googleapis.com";
-
-// App Distribution OAuth2 tokens last ~1h; cache and refresh conservatively.
-let cachedToken: { token: string; expiresAt: number } | null = null;
-
-async function accessToken(): Promise<string> {
-  const now = Date.now();
-  if (cachedToken !== null && cachedToken.expiresAt > now + 60_000) {
-    return cachedToken.token;
-  }
-  const token = await mintGoogleAccessToken(serviceAccountFromEnv());
-  if (token === null) {
-    throw new Error("failed to mint a Firebase access token");
-  }
-  cachedToken = { token, expiresAt: now + 30 * 60 * 1000 };
-  return token;
-}
-
-async function appDistGet(path: string): Promise<unknown> {
-  const res = await fetch(`${APP_DISTRIBUTION_API}${path}`, {
-    headers: { Authorization: `Bearer ${await accessToken()}`, Accept: "application/json" },
-  });
-  const text = await res.text();
-  if (!res.ok) {
-    throw new Error(`Firebase App Distribution ${String(res.status)}: ${text.slice(0, 400)}`);
-  }
-  return JSON.parse(text) as unknown;
-}
-
-function appBasePath(appId: string): string {
-  const projectNumber = projectNumberFromAppId(appId);
-  if (projectNumber === null) {
-    throw new Error(`cannot derive a project number from app id: ${appId}`);
-  }
-  return `/v1/projects/${encodeURIComponent(projectNumber)}/apps/${encodeURIComponent(appId)}`;
-}
-
-function releasesPath(appId: string, pageSize: number): string {
-  return `${appBasePath(appId)}/releases?pageSize=${String(pageSize)}`;
-}
-
-function releasePath(appId: string, releaseId: string): string {
-  return `${appBasePath(appId)}/releases/${encodeURIComponent(releaseId)}`;
-}
+import { registerFirebaseTools } from "./tools.ts";
 
 await runReadOnlyMcpConnector("nimbus-firebase", (reg) => {
-  reg(
-    "firebase_list",
-    "List Firebase App Distribution resources. When `appId` is omitted, returns the connector's configured app ids. When `appId` is provided, returns that app's most-recent releases via GET /v1/projects/<n>/apps/<appId>/releases (pageSize optional, default 50).",
-    z.object({
-      appId: z.string().min(1).optional(),
-      pageSize: z.number().int().min(1).max(100).optional(),
-    }),
-    async (p) => {
-      if (p.appId === undefined) {
-        return jsonResult({ appIds: configuredAppIds() });
-      }
-      return jsonResult(await appDistGet(releasesPath(p.appId, p.pageSize ?? 50)));
-    },
-  );
-
-  reg(
-    "firebase_get",
-    "Fetch a single Firebase App Distribution release via GET /v1/projects/<n>/apps/<appId>/releases/<releaseId>.",
-    z.object({
-      appId: z.string().min(1),
-      releaseId: z.string().min(1),
-    }),
-    async (p) => jsonResult(await appDistGet(releasePath(p.appId, p.releaseId))),
-  );
-
-  reg(
-    "firebase_search",
-    "Substring search across an app's recent releases. Matches the query against each release's display version, build version, release notes, and resource name (case-insensitive). Returns a `{ matches: [...] }` envelope.",
-    z.object({
-      appId: z.string().min(1),
-      query: z.string().min(1),
-      limit: z.number().int().min(1).max(100).optional(),
-    }),
-    async (p) => {
-      const root = await appDistGet(releasesPath(p.appId, 100));
-      const releases = (root as { releases?: unknown[] } | null)?.releases;
-      return matchesResult(releases, filterFirebaseReleases, p);
-    },
-  );
+  registerFirebaseTools(reg);
 });

package/connectors/firebase/src/token.ts

@@ -1,4 +1,5 @@
 import { type GoogleServiceAccount, parseServiceAccountJson } from "@nimbus-dev/sdk";
+import { requiredEnv } from "../../../shared/env-json-api.ts";
 
 /**
  * Firebase App Distribution credential plumbing.
@@ -21,11 +22,7 @@ export function projectNumberFromAppId(appId: string): string | null {
  * throws if unset or malformed. The Gateway sets this at spawn time.
  */
 export function serviceAccountFromEnv(): GoogleServiceAccount {
-  const json = process.env["FIREBASE_SERVICE_ACCOUNT_JSON"]?.trim();
-  if (json === undefined || json === "") {
-    throw new Error("FIREBASE_SERVICE_ACCOUNT_JSON is not set");
-  }
-  const sa = parseServiceAccountJson(json);
+  const sa = parseServiceAccountJson(requiredEnv("FIREBASE_SERVICE_ACCOUNT_JSON"));
   if (sa === null) {
     throw new Error("FIREBASE_SERVICE_ACCOUNT_JSON is not a valid service-account key");
   }

package/connectors/firebase/src/tools.ts

@@ -0,0 +1,106 @@
+import { mintGoogleAccessToken } from "@nimbus-dev/sdk";
+import { z } from "zod";
+import { matchesResult } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterFirebaseReleases } from "./search-filter.ts";
+import { configuredAppIds, projectNumberFromAppId, serviceAccountFromEnv } from "./token.ts";
+
+const APP_DISTRIBUTION_API = "https://firebaseappdistribution.googleapis.com";
+
+// App Distribution OAuth2 tokens last ~1h; cache and refresh conservatively.
+let cachedToken: { token: string; expiresAt: number } | null = null;
+
+/**
+ * Forget the cached access token. Tests only: the cache is module state shared by every test in
+ * the process, and a token one test left behind lets a later tool call skip reading its
+ * credential entirely.
+ */
+export function __resetFirebaseTokenCacheForTests(): void {
+  cachedToken = null;
+}
+
+async function accessToken(): Promise<string> {
+  const now = Date.now();
+  if (cachedToken !== null && cachedToken.expiresAt > now + 60_000) {
+    return cachedToken.token;
+  }
+  const token = await mintGoogleAccessToken(serviceAccountFromEnv());
+  if (token === null) {
+    throw new Error("failed to mint a Firebase access token");
+  }
+  cachedToken = { token, expiresAt: now + 30 * 60 * 1000 };
+  return token;
+}
+
+async function appDistGet(path: string): Promise<unknown> {
+  const res = await fetch(`${APP_DISTRIBUTION_API}${path}`, {
+    headers: { Authorization: `Bearer ${await accessToken()}`, Accept: "application/json" },
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Firebase App Distribution ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+function appBasePath(appId: string): string {
+  const projectNumber = projectNumberFromAppId(appId);
+  if (projectNumber === null) {
+    throw new Error(`cannot derive a project number from app id: ${appId}`);
+  }
+  return `/v1/projects/${encodeURIComponent(projectNumber)}/apps/${encodeURIComponent(appId)}`;
+}
+
+function releasesPath(appId: string, pageSize: number): string {
+  return `${appBasePath(appId)}/releases?pageSize=${String(pageSize)}`;
+}
+
+function releasePath(appId: string, releaseId: string): string {
+  return `${appBasePath(appId)}/releases/${encodeURIComponent(releaseId)}`;
+}
+
+/** Tool names exposed by this connector — for contract/introspection tests. */
+export const FIREBASE_TOOL_NAMES = ["firebase_get", "firebase_list", "firebase_search"] as const;
+
+export function registerFirebaseTools(reg: ZodToolRegistrar): void {
+  reg(
+    "firebase_list",
+    "List Firebase App Distribution resources. When `appId` is omitted, returns the connector's configured app ids. When `appId` is provided, returns that app's most-recent releases via GET /v1/projects/<n>/apps/<appId>/releases (pageSize optional, default 50).",
+    z.object({
+      appId: z.string().min(1).optional(),
+      pageSize: z.number().int().min(1).max(100).optional(),
+    }),
+    async (p) => {
+      if (p.appId === undefined) {
+        return jsonResult({ appIds: configuredAppIds() });
+      }
+      return jsonResult(await appDistGet(releasesPath(p.appId, p.pageSize ?? 50)));
+    },
+  );
+
+  reg(
+    "firebase_get",
+    "Fetch a single Firebase App Distribution release via GET /v1/projects/<n>/apps/<appId>/releases/<releaseId>.",
+    z.object({
+      appId: z.string().min(1),
+      releaseId: z.string().min(1),
+    }),
+    async (p) => jsonResult(await appDistGet(releasePath(p.appId, p.releaseId))),
+  );
+
+  reg(
+    "firebase_search",
+    "Substring search across an app's recent releases. Matches the query against each release's display version, build version, release notes, and resource name (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    z.object({
+      appId: z.string().min(1),
+      query: z.string().min(1),
+      limit: z.number().int().min(1).max(100).optional(),
+    }),
+    async (p) => {
+      const root = await appDistGet(releasesPath(p.appId, 100));
+      const releases = (root as { releases?: unknown[] } | null)?.releases;
+      return matchesResult(releases, filterFirebaseReleases, p);
+    },
+  );
+}

package/connectors/flagsmith/src/server.ts

@@ -1,102 +1,6 @@
-import { z } from "zod";
-import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
 import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
-import { filterFlagsmithFeatures } from "./search-filter.ts";
-
-const DEFAULT_API_BASE = "https://api.flagsmith.com";
-
-function apiBase(): string {
-  const v = process.env["FLAGSMITH_API_BASE"]?.trim();
-  return v === undefined || v === "" ? DEFAULT_API_BASE : v;
-}
-
-function authHeader(): Record<string, string> {
-  const t = process.env["FLAGSMITH_TOKEN"]?.trim();
-  if (t === undefined || t === "") {
-    throw new Error("FLAGSMITH_TOKEN is not set");
-  }
-  return { Authorization: `Token ${t}`, Accept: "application/json" };
-}
-
-async function fsGet(path: string): Promise<unknown> {
-  const res = await fetch(`${apiBase()}/api/v1${path}`, { headers: authHeader() });
-  const text = await res.text();
-  if (!res.ok) {
-    throw new Error(`Flagsmith ${String(res.status)}: ${text.slice(0, 400)}`);
-  }
-  return JSON.parse(text) as unknown;
-}
-
-function featuresFromPage(root: unknown): unknown[] {
-  if (Array.isArray(root)) {
-    return root;
-  }
-  const results = (root as { results?: unknown } | null)?.results;
-  return Array.isArray(results) ? results : [];
-}
+import { registerFlagsmithTools } from "./tools.ts";
 
 await runReadOnlyMcpConnector("nimbus-flagsmith", (reg) => {
-  reg(
-    "flagsmith_list",
-    "List Flagsmith projects, or feature flags for a project. Without `projectId`, returns the account's projects (`/projects/`). With `projectId`, returns that project's feature flags (`/projects/{projectId}/features/`), capped at `limit` (default 100).",
-    z.object({
-      projectId: z.number().int().optional(),
-      limit: z.number().int().min(1).max(500).optional(),
-    }),
-    async (p) => {
-      if (p.projectId === undefined) {
-        return jsonResult(await fsGet("/projects/"));
-      }
-      const search = new URLSearchParams({ page_size: String(p.limit ?? 100) });
-      return jsonResult(
-        await fsGet(
-          `/projects/${encodeURIComponent(String(p.projectId))}/features/?${search.toString()}`,
-        ),
-      );
-    },
-  );
-
-  reg(
-    "flagsmith_get",
-    "Fetch one Flagsmith feature flag by project id + feature name. Flagsmith has no GET-by-name endpoint, so this searches the project's features and narrows to the exact-name match. Throws when no match is found.",
-    z.object({
-      projectId: z.number().int(),
-      featureName: z.string().min(1),
-    }),
-    async (p) => {
-      const search = new URLSearchParams({ page_size: "100", search: p.featureName });
-      const root = await fsGet(
-        `/projects/${encodeURIComponent(String(p.projectId))}/features/?${search.toString()}`,
-      );
-      const match = featuresFromPage(root).find(
-        (f) =>
-          f !== null && typeof f === "object" && (f as { name?: unknown }).name === p.featureName,
-      );
-      if (match === undefined) {
-        throw new Error(`Flagsmith feature not found: ${p.featureName}`);
-      }
-      return jsonResult(match);
-    },
-  );
-
-  reg(
-    "flagsmith_search",
-    "Substring search across a project's feature flags. Matches the query against flag name, description, and tags (case-insensitive). Returns a `{ matches: [...] }` envelope.",
-    z.object({
-      projectId: z.number().int(),
-      query: z.string().min(1),
-      limit: z.number().int().min(1).max(200).optional(),
-    }),
-    async (p) => {
-      const search = new URLSearchParams({ page_size: "500" });
-      const root = await fsGet(
-        `/projects/${encodeURIComponent(String(p.projectId))}/features/?${search.toString()}`,
-      );
-      const matches = filterFlagsmithFeatures(featuresFromPage(root), {
-        query: p.query,
-        limit: p.limit,
-      });
-      return jsonResult({ matches });
-    },
-  );
+  registerFlagsmithTools(reg);
 });

package/connectors/flagsmith/src/tools.ts

@@ -0,0 +1,95 @@
+import { z } from "zod";
+import { createJsonGetter, envAuthHeaders, optionalEnv } from "../../../shared/env-json-api.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterFlagsmithFeatures } from "./search-filter.ts";
+
+const DEFAULT_API_BASE = "https://api.flagsmith.com";
+
+const fsGet = createJsonGetter({
+  // `optionalEnv`, not `optionalBaseUrl`: a trailing slash on the override is left as given.
+  base: () => `${optionalEnv("FLAGSMITH_API_BASE", DEFAULT_API_BASE)}/api/v1`,
+  label: "Flagsmith",
+  headers: envAuthHeaders({ env: "FLAGSMITH_TOKEN", scheme: "Token" }),
+});
+
+function featuresFromPage(root: unknown): unknown[] {
+  if (Array.isArray(root)) {
+    return root;
+  }
+  const results = (root as { results?: unknown } | null)?.results;
+  return Array.isArray(results) ? results : [];
+}
+
+/** Tool names exposed by this connector — for contract/introspection tests. */
+export const FLAGSMITH_TOOL_NAMES = [
+  "flagsmith_list",
+  "flagsmith_get",
+  "flagsmith_search",
+] as const;
+
+export function registerFlagsmithTools(reg: ZodToolRegistrar): void {
+  reg(
+    "flagsmith_list",
+    "List Flagsmith projects, or feature flags for a project. Without `projectId`, returns the account's projects (`/projects/`). With `projectId`, returns that project's feature flags (`/projects/{projectId}/features/`), capped at `limit` (default 100).",
+    z.object({
+      projectId: z.number().int().optional(),
+      limit: z.number().int().min(1).max(500).optional(),
+    }),
+    async (p) => {
+      if (p.projectId === undefined) {
+        return jsonResult(await fsGet("/projects/"));
+      }
+      const search = new URLSearchParams({ page_size: String(p.limit ?? 100) });
+      return jsonResult(
+        await fsGet(
+          `/projects/${encodeURIComponent(String(p.projectId))}/features/?${search.toString()}`,
+        ),
+      );
+    },
+  );
+
+  reg(
+    "flagsmith_get",
+    "Fetch one Flagsmith feature flag by project id + feature name. Flagsmith has no GET-by-name endpoint, so this searches the project's features and narrows to the exact-name match. Throws when no match is found.",
+    z.object({
+      projectId: z.number().int(),
+      featureName: z.string().min(1),
+    }),
+    async (p) => {
+      const search = new URLSearchParams({ page_size: "100", search: p.featureName });
+      const root = await fsGet(
+        `/projects/${encodeURIComponent(String(p.projectId))}/features/?${search.toString()}`,
+      );
+      const match = featuresFromPage(root).find(
+        (f) =>
+          f !== null && typeof f === "object" && (f as { name?: unknown }).name === p.featureName,
+      );
+      if (match === undefined) {
+        throw new Error(`Flagsmith feature not found: ${p.featureName}`);
+      }
+      return jsonResult(match);
+    },
+  );
+
+  reg(
+    "flagsmith_search",
+    "Substring search across a project's feature flags. Matches the query against flag name, description, and tags (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    z.object({
+      projectId: z.number().int(),
+      query: z.string().min(1),
+      limit: z.number().int().min(1).max(200).optional(),
+    }),
+    async (p) => {
+      const search = new URLSearchParams({ page_size: "500" });
+      const root = await fsGet(
+        `/projects/${encodeURIComponent(String(p.projectId))}/features/?${search.toString()}`,
+      );
+      const matches = filterFlagsmithFeatures(featuresFromPage(root), {
+        query: p.query,
+        limit: p.limit,
+      });
+      return jsonResult({ matches });
+    },
+  );
+}

package/connectors/flux/src/server.ts

@@ -1,6 +1,7 @@
 import { FLUX_KINDS, type FluxKindEntry, trimTrailingSlash } from "@nimbus-dev/sdk";
 import { z } from "zod";
 import { type ConsentServer, createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
+import { createJsonGetter, envAuthHeaders, requiredEnv } from "../../../shared/env-json-api.ts";
 import { fetchWithTimeout, mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
 import {
   runReadOnlyMcpConnector,
@@ -18,30 +19,24 @@ function kindEntry(kind: string): FluxKindEntry {
   return found;
 }
 
+/** Only ONE trailing slash is dropped here — not `requiredBaseUrl`'s strip-them-all. */
 function apiBase(): string {
-  const v = process.env["FLUX_API_URL"]?.trim();
-  if (v === undefined || v === "") {
-    throw new Error("FLUX_API_URL is not set");
-  }
-  return trimTrailingSlash(v);
+  return trimTrailingSlash(requiredEnv("FLUX_API_URL"));
 }
 
-function authHeader(): Record<string, string> {
-  const t = process.env["FLUX_TOKEN"]?.trim();
-  if (t === undefined || t === "") {
-    throw new Error("FLUX_TOKEN is not set");
-  }
-  return { Authorization: `Bearer ${t}`, Accept: "application/json" };
-}
+/**
+ * `fetchWithTimeout`, not the global fetch: this is a self-hosted control plane,
+ * and one that stops answering must fail the tool call rather than hang it.
+ */
+/** Shared with the mutating request below, which adds its own Content-Type. */
+const authHeader = envAuthHeaders({ env: "FLUX_TOKEN" });
 
-async function agGet(path: string): Promise<unknown> {
-  const res = await fetchWithTimeout(`${apiBase()}${path}`, { headers: authHeader() });
-  const text = await res.text();
-  if (!res.ok) {
-    throw new Error(`Flux ${String(res.status)}: ${text.slice(0, 400)}`);
-  }
-  return JSON.parse(text) as unknown;
-}
+const agGet = createJsonGetter({
+  base: apiBase,
+  label: "Flux",
+  headers: authHeader,
+  fetch: fetchWithTimeout,
+});
 
 function itemsFrom(root: unknown): unknown[] {
   if (Array.isArray(root)) {
@@ -80,6 +75,24 @@ async function fluxReconcile(kind: string, namespace: string, name: string): Pro
   return requestedAt;
 }
 
+/** The Flux CRs a reconcile can be requested on. */
+const RECONCILABLE = [
+  {
+    tool: "flux_kustomization_reconcile",
+    kind: "kustomization",
+    mutates: "flux.kustomization.reconcile",
+    description:
+      "Request a reconcile of a Flux Kustomization by annotating reconcile.fluxcd.io/requestedAt (PATCH the CR; requires HITL flux.kustomization.reconcile, and the SA's `patch` RBAC verb on kustomizations). Async — verify via the next metadata sync.",
+  },
+  {
+    tool: "flux_helmrelease_reconcile",
+    kind: "helm_release",
+    mutates: "flux.helmrelease.reconcile",
+    description:
+      "Request a reconcile of a Flux HelmRelease by annotating reconcile.fluxcd.io/requestedAt (PATCH the CR; requires HITL flux.helmrelease.reconcile, and the SA's `patch` RBAC verb on helmreleases). Async — verify via the next metadata sync.",
+  },
+] as const;
+
 export function registerFluxTools(reg: ZodToolRegistrar, server: unknown): void {
   // Despite the read-only helper's name, this connector exposes write tools. The consent
   // kit needs the real server, which the helper now passes through as its second argument.
@@ -140,39 +153,25 @@ export function registerFluxTools(reg: ZodToolRegistrar, server: unknown): void
     },
   );
 
-  registerWriteTool(
-    "flux_kustomization_reconcile",
-    {
-      mutates: "flux.kustomization.reconcile",
-      recoverable: true,
-      scopeTargetOf: (p) => ({ kind: "namespace", value: p.namespace }),
-    },
-    "Request a reconcile of a Flux Kustomization by annotating reconcile.fluxcd.io/requestedAt (PATCH the CR; requires HITL flux.kustomization.reconcile, and the SA's `patch` RBAC verb on kustomizations). Async — verify via the next metadata sync.",
-    z.object({ namespace: z.string().min(1), name: z.string().min(1) }),
-    async (p) =>
-      jsonResult({
-        status: "requested",
-        name: p.name,
-        requestedAt: await fluxReconcile("kustomization", p.namespace, p.name),
-      }),
-  );
-
-  registerWriteTool(
-    "flux_helmrelease_reconcile",
-    {
-      mutates: "flux.helmrelease.reconcile",
-      recoverable: true,
-      scopeTargetOf: (p) => ({ kind: "namespace", value: p.namespace }),
-    },
-    "Request a reconcile of a Flux HelmRelease by annotating reconcile.fluxcd.io/requestedAt (PATCH the CR; requires HITL flux.helmrelease.reconcile, and the SA's `patch` RBAC verb on helmreleases). Async — verify via the next metadata sync.",
-    z.object({ namespace: z.string().min(1), name: z.string().min(1) }),
-    async (p) =>
-      jsonResult({
-        status: "requested",
-        name: p.name,
-        requestedAt: await fluxReconcile("helm_release", p.namespace, p.name),
-      }),
-  );
+  // Both reconcile tools are the same annotation PATCH against a different CR.
+  for (const { tool, kind, mutates, description } of RECONCILABLE) {
+    registerWriteTool(
+      tool,
+      {
+        mutates,
+        recoverable: true,
+        scopeTargetOf: (p) => ({ kind: "namespace", value: p.namespace }),
+      },
+      description,
+      z.object({ namespace: z.string().min(1), name: z.string().min(1) }),
+      async (p) =>
+        jsonResult({
+          status: "requested",
+          name: p.name,
+          requestedAt: await fluxReconcile(kind, p.namespace, p.name),
+        }),
+    );
+  }
 }
 
 export async function startConnector(): Promise<void> {