@nyuchi/mzizi-mcp 0.5.0 → 0.6.0

package/dist/env.d.ts

@@ -19,6 +19,7 @@ export interface Env {
     WORKOS_M2M_CLIENT_ID?: string;
     WORKOS_M2M_CLIENT_SECRET?: string;
     FUNDI_URL?: string;
+    FUNDI_SERVICE?: Fetcher;
     COOKIE_ENCRYPTION_KEY: string;
     OAUTH_KV: KVNamespace;
     OAUTH_PROVIDER: OAuthHelpers;

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAEtE,MAAM,WAAW,GAAG;IAElB,YAAY,EAAE,MAAM,CAAA;IACpB,wBAAwB,EAAE,MAAM,CAAA;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAM5B,gBAAgB,EAAE,MAAM,CAAA;IACxB,qBAAqB,EAAE,MAAM,CAAA;IAO7B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAGlB,qBAAqB,EAAE,MAAM,CAAA;IAG7B,QAAQ,EAAE,WAAW,CAAA;IACrB,cAAc,EAAE,YAAY,CAAA;CAC7B"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAEtE,MAAM,WAAW,GAAG;IAElB,YAAY,EAAE,MAAM,CAAA;IACpB,wBAAwB,EAAE,MAAM,CAAA;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAM5B,gBAAgB,EAAE,MAAM,CAAA;IACxB,qBAAqB,EAAE,MAAM,CAAA;IAO7B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAUlB,aAAa,CAAC,EAAE,OAAO,CAAA;IAGvB,qBAAqB,EAAE,MAAM,CAAA;IAG7B,QAAQ,EAAE,WAAW,CAAA;IACrB,cAAc,EAAE,YAAY,CAAA;CAC7B"}

package/dist/fundi-client.d.ts

@@ -18,7 +18,21 @@ export interface FundiToolContext {
     /** The signed-in user's WorkOS access token (from ctx.props). */
     userAccessToken: string;
 }
-/** True when every binding needed to call fundi is present. */
+/** True when either path to fundi is wired: the Service Binding or HTTP + M2M. */
 export declare function fundiConfigured(env: Env): boolean;
+/**
+ * Build the transport to fundi.
+ *
+ * The branch is here, at construction, and nowhere else — every call site keeps
+ * calling `FundiCaller.call(path, userToken, init)` and never learns which path
+ * it got. Preferring the binding is what lets `WORKOS_M2M_CLIENT_SECRET` be
+ * deleted from this Worker once the binding is proven (docs/service-bindings.md);
+ * the HTTP fallback stays because `wrangler dev` and the stdio bin have no
+ * binding to use.
+ *
+ * The user token is forwarded on BOTH paths. A binding removes the machine
+ * credential, not the human one: fundi's entitlement is per-user and it still
+ * refuses a call that acts for nobody.
+ */
 export declare function createFundiCaller(env: Env): FundiCaller;
 //# sourceMappingURL=fundi-client.d.ts.map

package/dist/fundi-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fundi-client.d.ts","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AA+BnC,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACnF;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,WAAW,CAAA;IACnB,iEAAiE;IACjE,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAOjD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,WAAW,CAUvD"}
+{"version":3,"file":"fundi-client.d.ts","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AA+BnC,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACnF;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,WAAW,CAAA;IACnB,iEAAiE;IACjE,eAAe,EAAE,MAAM,CAAA;CACxB;AASD,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAQjD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,WAAW,CAuBvD"}

package/dist/fundi-client.js

@@ -39,14 +39,49 @@ async function mintM2MToken(env) {
     cached = { jwt: data.access_token, exp };
     return data.access_token;
 }
-/** True when every binding needed to call fundi is present. */
+/**
+ * Origin the bound request is addressed to. A `Fetcher` still needs a
+ * well-formed absolute URL to build a `Request` from; the host is never
+ * resolved, because the binding routes by service, not by DNS.
+ */
+const BINDING_ORIGIN = "https://fundi.internal";
+/** True when either path to fundi is wired: the Service Binding or HTTP + M2M. */
 export function fundiConfigured(env) {
+    if (env.FUNDI_SERVICE)
+        return true;
     return Boolean(env.WORKOS_M2M_CLIENT_ID &&
         env.WORKOS_M2M_CLIENT_SECRET &&
         env.FUNDI_URL &&
         env.WORKOS_AUTHKIT_DOMAIN);
 }
+/**
+ * Build the transport to fundi.
+ *
+ * The branch is here, at construction, and nowhere else — every call site keeps
+ * calling `FundiCaller.call(path, userToken, init)` and never learns which path
+ * it got. Preferring the binding is what lets `WORKOS_M2M_CLIENT_SECRET` be
+ * deleted from this Worker once the binding is proven (docs/service-bindings.md);
+ * the HTTP fallback stays because `wrangler dev` and the stdio bin have no
+ * binding to use.
+ *
+ * The user token is forwarded on BOTH paths. A binding removes the machine
+ * credential, not the human one: fundi's entitlement is per-user and it still
+ * refuses a call that acts for nobody.
+ */
 export function createFundiCaller(env) {
+    const service = env.FUNDI_SERVICE;
+    if (service) {
+        return {
+            async call(path, userAccessToken, init = {}) {
+                const headers = new Headers(init.headers);
+                headers.set("X-Fundi-User-Token", userAccessToken);
+                // No Authorization header: the binding IS the machine credential.
+                // Cloudflare will not route a public request to a named entrypoint, so
+                // there is no token to mint, replay, or leak.
+                return service.fetch(new Request(new URL(path, BINDING_ORIGIN), { ...init, headers }));
+            },
+        };
+    }
     return {
         async call(path, userAccessToken, init = {}) {
             const m2m = await mintM2MToken(env);

package/dist/fundi-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"fundi-client.js","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAGhC,IAAI,MAAM,GAAwC,IAAI,CAAA;AAEtD,KAAK,UAAU,YAAY,CAAC,GAAQ;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,GAAG,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,qBAAqB,CAAC,EAAE;QAC3E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE;YACzC,aAAa,EAAE,GAAG,CAAC,wBAAwB,IAAI,EAAE;SAClD,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IACrG,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAA;IAChF,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC3C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAA;IACxC,OAAO,IAAI,CAAC,YAAY,CAAA;AAC1B,CAAC;AAaD,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,OAAO,OAAO,CACZ,GAAG,CAAC,oBAAoB;QACtB,GAAG,CAAC,wBAAwB;QAC5B,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,qBAAqB,CAC5B,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAQ;IACxC,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAG,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACzC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;YAC7C,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAA;YAClD,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAClE,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"fundi-client.js","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAGhC,IAAI,MAAM,GAAwC,IAAI,CAAA;AAEtD,KAAK,UAAU,YAAY,CAAC,GAAQ;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,GAAG,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,qBAAqB,CAAC,EAAE;QAC3E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE;YACzC,aAAa,EAAE,GAAG,CAAC,wBAAwB,IAAI,EAAE;SAClD,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IACrG,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAA;IAChF,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC3C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAA;IACxC,OAAO,IAAI,CAAC,YAAY,CAAA;AAC1B,CAAC;AAaD;;;;GAIG;AACH,MAAM,cAAc,GAAG,wBAAwB,CAAA;AAE/C,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IAClC,OAAO,OAAO,CACZ,GAAG,CAAC,oBAAoB;QACtB,GAAG,CAAC,wBAAwB;QAC5B,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,qBAAqB,CAC5B,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAQ;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAA;IACjC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAG,EAAE;gBACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACzC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAA;gBAClD,kEAAkE;gBAClE,uEAAuE;gBACvE,8CAA8C;gBAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;YACxF,CAAC;SACF,CAAA;IACH,CAAC;IACD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAG,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACzC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;YAC7C,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAA;YAClD,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAClE,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/server.d.ts

@@ -23,7 +23,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { SupabaseClient } from "@supabase/supabase-js";
 import type { FundiToolContext } from "./fundi-client.js";
-export declare const MZIZI_MCP_VERSION = "0.5.0";
+export declare const MZIZI_MCP_VERSION = "0.6.0";
 /**
  * Build the Mzizi MCP server bound to a Supabase client with public read on
  * `mcp_tool_registry` / `component_documents` and EXECUTE on the backing RPCs.

package/dist/server.js

@@ -24,7 +24,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { FUNDI_A2A_TOOLS, dispatchFundiA2A, isFundiA2AToolName, } from "./fundi-a2a.js";
 import { jsonContent, toolError } from "./tool-result.js";
-export const MZIZI_MCP_VERSION = "0.5.0";
+export const MZIZI_MCP_VERSION = "0.6.0";
 /**
  * Every tool this server exposes is prefixed with `mzizi_` so the surface is
  * unambiguous when mounted alongside other MCP servers (see the mcp-builder

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nyuchi/mzizi-mcp",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "publishConfig": {
     "access": "public"
   },