@nyuchi/mzizi-mcp 0.5.0 → 0.7.0

package/dist/api-client.d.ts

@@ -0,0 +1,86 @@
+/**
+ * HTTP client for the Mzizi API — the MCP's only data source.
+ *
+ * The architecture: the Next.js app at mzizi.dev builds the registry from files at
+ * build time and serves it over `/api/v1/*`. This MCP is a client of that API. It does
+ * NOT talk to Supabase, and it does not hold a database credential, because component
+ * documents and doctrine are files in `nyuchi/mzizi` — not rows.
+ *
+ * What that buys, beyond matching the architecture:
+ *
+ *   - One source of truth. The API and the MCP answer from the same build, so an agent
+ *     over MCP and a consumer over HTTP cannot get different answers.
+ *   - No credential. The previous design read `mcp_tool_registry` and dispatched to
+ *     Supabase RPCs with an anon key; there is nothing to leak or rotate here.
+ *   - The tool surface stops being data. It was built at startup from a table, which
+ *     meant a row edit silently changed what the server exposed with no review. The
+ *     tools are now code (see `tools.ts`), so a change to them is a diff.
+ *
+ * Failure policy: every method returns a discriminated result rather than throwing, so
+ * a tool can turn an upstream outage into a sentence the caller can act on. An MCP tool
+ * that throws an opaque fetch error teaches the agent nothing.
+ */
+export declare const DEFAULT_API_BASE = "https://mzizi.dev/api/v1";
+export type ApiOk<T> = {
+    ok: true;
+    data: T;
+};
+export type ApiErr = {
+    ok: false;
+    /** Machine-readable reason, for a tool to branch on. */
+    reason: "not_found" | "timeout" | "network" | "bad_status" | "bad_body";
+    /** A sentence for the caller. Not a status code. */
+    message: string;
+    status?: number;
+};
+export type ApiResult<T> = ApiOk<T> | ApiErr;
+export type MziziApiOptions = {
+    /** Base URL, no trailing slash. Defaults to the public API. */
+    baseUrl?: string;
+    timeoutMs?: number;
+    /** Injectable for tests and for a Worker's bound fetch. */
+    fetchImpl?: typeof fetch;
+};
+export declare class MziziApiClient {
+    private readonly baseUrl;
+    private readonly timeoutMs;
+    private readonly fetchImpl;
+    constructor(opts?: MziziApiOptions);
+    /**
+     * GET a JSON path under the API base.
+     *
+     * `path` is appended verbatim, so every caller must encode its own segments —
+     * a component name arriving from an agent is untrusted input, and an unencoded
+     * `../` would climb out of /api/v1.
+     */
+    get<T>(path: string, query?: Record<string, string | number | undefined>): Promise<ApiResult<T>>;
+    /** Registry index. */
+    listComponents(): Promise<ApiResult<unknown>>;
+    /** One component, shadcn-shaped, with metadata and files. */
+    getComponent(name: string): Promise<ApiResult<unknown>>;
+    /** Per-component docs: use cases, variants, a11y. */
+    getComponentDocs(name: string): Promise<ApiResult<unknown>>;
+    /** Per-component version history. */
+    getComponentVersions(name: string): Promise<ApiResult<unknown>>;
+    /** Cross-resource search — components, docs, changelog. */
+    search(query: string): Promise<ApiResult<unknown>>;
+    /** The DNA double helix: nodes, rungs, strands, live counts. */
+    getArchitecture(): Promise<ApiResult<unknown>>;
+    /** One node. `n` is uncapped — the node set grows, so never bound it here. */
+    getNode(n: number): Promise<ApiResult<unknown>>;
+    /** Brand system: minerals, heritage, typography, spacing, ecosystem. */
+    getBrand(): Promise<ApiResult<unknown>>;
+    getUbuntuPillars(): Promise<ApiResult<unknown>>;
+    getUbuntuPrinciples(): Promise<ApiResult<unknown>>;
+    listAiInstructions(): Promise<ApiResult<unknown>>;
+    getAiInstructions(name: string): Promise<ApiResult<unknown>>;
+    listSkills(): Promise<ApiResult<unknown>>;
+    getSkill(name: string): Promise<ApiResult<unknown>>;
+    listChangelog(): Promise<ApiResult<unknown>>;
+    getRelease(version: string): Promise<ApiResult<unknown>>;
+    /** Live counts + usage metrics. Derived upstream, never a stored number. */
+    getStats(): Promise<ApiResult<unknown>>;
+    /** Service health. */
+    getHealth(): Promise<ApiResult<unknown>>;
+}
+//# sourceMappingURL=api-client.d.ts.map

package/dist/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,eAAO,MAAM,gBAAgB,6BAA6B,CAAA;AAK1D,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,CAAA;AAC5C,MAAM,MAAM,MAAM,GAAG;IACnB,EAAE,EAAE,KAAK,CAAA;IACT,wDAAwD;IACxD,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,CAAA;IACvE,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AACD,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;AAE5C,MAAM,MAAM,eAAe,GAAG;IAC5B,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB,CAAA;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;gBAE5B,IAAI,GAAE,eAAoB;IAMtC;;;;;;OAMG;IACG,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAyEtG,sBAAsB;IACtB,cAAc;IAId,6DAA6D;IAC7D,YAAY,CAAC,IAAI,EAAE,MAAM;IAIzB,qDAAqD;IACrD,gBAAgB,CAAC,IAAI,EAAE,MAAM;IAI7B,qCAAqC;IACrC,oBAAoB,CAAC,IAAI,EAAE,MAAM;IAIjC,2DAA2D;IAC3D,MAAM,CAAC,KAAK,EAAE,MAAM;IAIpB,gEAAgE;IAChE,eAAe;IAIf,8EAA8E;IAC9E,OAAO,CAAC,CAAC,EAAE,MAAM;IAIjB,wEAAwE;IACxE,QAAQ;IAIR,gBAAgB;IAIhB,mBAAmB;IAInB,kBAAkB;IAIlB,iBAAiB,CAAC,IAAI,EAAE,MAAM;IAI9B,UAAU;IAIV,QAAQ,CAAC,IAAI,EAAE,MAAM;IAIrB,aAAa;IAIb,UAAU,CAAC,OAAO,EAAE,MAAM;IAI1B,4EAA4E;IAC5E,QAAQ;IAIR,sBAAsB;IACtB,SAAS;CAGV"}

package/dist/api-client.js

@@ -0,0 +1,179 @@
+/**
+ * HTTP client for the Mzizi API — the MCP's only data source.
+ *
+ * The architecture: the Next.js app at mzizi.dev builds the registry from files at
+ * build time and serves it over `/api/v1/*`. This MCP is a client of that API. It does
+ * NOT talk to Supabase, and it does not hold a database credential, because component
+ * documents and doctrine are files in `nyuchi/mzizi` — not rows.
+ *
+ * What that buys, beyond matching the architecture:
+ *
+ *   - One source of truth. The API and the MCP answer from the same build, so an agent
+ *     over MCP and a consumer over HTTP cannot get different answers.
+ *   - No credential. The previous design read `mcp_tool_registry` and dispatched to
+ *     Supabase RPCs with an anon key; there is nothing to leak or rotate here.
+ *   - The tool surface stops being data. It was built at startup from a table, which
+ *     meant a row edit silently changed what the server exposed with no review. The
+ *     tools are now code (see `tools.ts`), so a change to them is a diff.
+ *
+ * Failure policy: every method returns a discriminated result rather than throwing, so
+ * a tool can turn an upstream outage into a sentence the caller can act on. An MCP tool
+ * that throws an opaque fetch error teaches the agent nothing.
+ */
+export const DEFAULT_API_BASE = "https://mzizi.dev/api/v1";
+/** How long any single upstream call may take before it is abandoned. */
+const DEFAULT_TIMEOUT_MS = 10_000;
+export class MziziApiClient {
+    baseUrl;
+    timeoutMs;
+    fetchImpl;
+    constructor(opts = {}) {
+        this.baseUrl = (opts.baseUrl ?? DEFAULT_API_BASE).replace(/\/+$/, "");
+        this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+    }
+    /**
+     * GET a JSON path under the API base.
+     *
+     * `path` is appended verbatim, so every caller must encode its own segments —
+     * a component name arriving from an agent is untrusted input, and an unencoded
+     * `../` would climb out of /api/v1.
+     */
+    async get(path, query) {
+        let url = `${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
+        if (query) {
+            const qs = new URLSearchParams();
+            for (const [k, v] of Object.entries(query)) {
+                if (v !== undefined && v !== "")
+                    qs.set(k, String(v));
+            }
+            const s = qs.toString();
+            if (s)
+                url += `?${s}`;
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const res = await this.fetchImpl(url, {
+                signal: controller.signal,
+                headers: { accept: "application/json" },
+            });
+            if (res.status === 404) {
+                return {
+                    ok: false,
+                    reason: "not_found",
+                    status: 404,
+                    message: `The Mzizi API has no record at ${path}. Check the name — list_components returns the valid set.`,
+                };
+            }
+            if (!res.ok) {
+                // 503 is the API's documented "database not configured" signal. It is worth
+                // distinguishing in words, because it means the deployment is misconfigured
+                // rather than that the caller asked for something wrong.
+                const hint = res.status === 503
+                    ? " The API reports it is not fully configured; this is a deployment problem, not a bad request."
+                    : "";
+                return {
+                    ok: false,
+                    reason: "bad_status",
+                    status: res.status,
+                    message: `The Mzizi API answered ${res.status} for ${path}.${hint}`,
+                };
+            }
+            try {
+                return { ok: true, data: (await res.json()) };
+            }
+            catch {
+                return {
+                    ok: false,
+                    reason: "bad_body",
+                    status: res.status,
+                    message: `The Mzizi API returned a non-JSON body for ${path}. The endpoint may be behind a redirect or an auth gate.`,
+                };
+            }
+        }
+        catch (err) {
+            if (err?.name === "AbortError") {
+                return {
+                    ok: false,
+                    reason: "timeout",
+                    message: `The Mzizi API did not respond within ${this.timeoutMs}ms for ${path}.`,
+                };
+            }
+            return {
+                ok: false,
+                reason: "network",
+                message: `Could not reach the Mzizi API at ${this.baseUrl}: ${err?.message ?? "unknown error"}.`,
+            };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    // ── The endpoints the 10 tools are built from ──────────────────────
+    /** Registry index. */
+    listComponents() {
+        return this.get("/ui");
+    }
+    /** One component, shadcn-shaped, with metadata and files. */
+    getComponent(name) {
+        return this.get(`/ui/${encodeURIComponent(name)}`);
+    }
+    /** Per-component docs: use cases, variants, a11y. */
+    getComponentDocs(name) {
+        return this.get(`/ui/${encodeURIComponent(name)}/docs`);
+    }
+    /** Per-component version history. */
+    getComponentVersions(name) {
+        return this.get(`/ui/${encodeURIComponent(name)}/versions`);
+    }
+    /** Cross-resource search — components, docs, changelog. */
+    search(query) {
+        return this.get("/search", { q: query });
+    }
+    /** The DNA double helix: nodes, rungs, strands, live counts. */
+    getArchitecture() {
+        return this.get("/architecture");
+    }
+    /** One node. `n` is uncapped — the node set grows, so never bound it here. */
+    getNode(n) {
+        return this.get(`/architecture/nodes/${encodeURIComponent(String(n))}`);
+    }
+    /** Brand system: minerals, heritage, typography, spacing, ecosystem. */
+    getBrand() {
+        return this.get("/brand");
+    }
+    getUbuntuPillars() {
+        return this.get("/ubuntu/pillars");
+    }
+    getUbuntuPrinciples() {
+        return this.get("/ubuntu/principles");
+    }
+    listAiInstructions() {
+        return this.get("/ai/instructions");
+    }
+    getAiInstructions(name) {
+        return this.get(`/ai/instructions/${encodeURIComponent(name)}`);
+    }
+    listSkills() {
+        return this.get("/skills");
+    }
+    getSkill(name) {
+        return this.get(`/skills/${encodeURIComponent(name)}`);
+    }
+    listChangelog() {
+        return this.get("/changelog");
+    }
+    getRelease(version) {
+        return this.get(`/changelog/${encodeURIComponent(version)}`);
+    }
+    /** Live counts + usage metrics. Derived upstream, never a stored number. */
+    getStats() {
+        return this.get("/stats");
+    }
+    /** Service health. */
+    getHealth() {
+        return this.get("/health");
+    }
+}
+//# sourceMappingURL=api-client.js.map

package/dist/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,0BAA0B,CAAA;AAE1D,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAqBjC,MAAM,OAAO,cAAc;IACR,OAAO,CAAQ;IACf,SAAS,CAAQ;IACjB,SAAS,CAAc;IAExC,YAAY,OAAwB,EAAE;QACpC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAA;QACrD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,KAAmD;QAC5E,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAA;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;YAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;oBAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;YACvD,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAA;YACvB,IAAI,CAAC;gBAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAA;QACvB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBACpC,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAA;YAEF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,kCAAkC,IAAI,2DAA2D;iBAC3G,CAAA;YACH,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,4EAA4E;gBAC5E,4EAA4E;gBAC5E,yDAAyD;gBACzD,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG;oBAChB,CAAC,CAAC,+FAA+F;oBACjG,CAAC,CAAC,EAAE,CAAA;gBACR,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,0BAA0B,GAAG,CAAC,MAAM,QAAQ,IAAI,IAAI,IAAI,EAAE;iBACpE,CAAA;YACH,CAAC;YAED,IAAI,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,EAAE,CAAA;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,UAAU;oBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,8CAA8C,IAAI,0DAA0D;iBACtH,CAAA;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAAa,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1C,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,wCAAwC,IAAI,CAAC,SAAS,UAAU,IAAI,GAAG;iBACjF,CAAA;YACH,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,oCAAoC,IAAI,CAAC,OAAO,KAAM,GAAa,EAAE,OAAO,IAAI,eAAe,GAAG;aAC5G,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED,sEAAsE;IAEtE,sBAAsB;IACtB,cAAc;QACZ,OAAO,IAAI,CAAC,GAAG,CAAU,KAAK,CAAC,CAAA;IACjC,CAAC;IAED,6DAA6D;IAC7D,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,GAAG,CAAU,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,qDAAqD;IACrD,gBAAgB,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAU,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAClE,CAAC;IAED,qCAAqC;IACrC,oBAAoB,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAU,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACtE,CAAC;IAED,2DAA2D;IAC3D,MAAM,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,GAAG,CAAU,SAAS,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACnD,CAAC;IAED,gEAAgE;IAChE,eAAe;QACb,OAAO,IAAI,CAAC,GAAG,CAAU,eAAe,CAAC,CAAA;IAC3C,CAAC;IAED,8EAA8E;IAC9E,OAAO,CAAC,CAAS;QACf,OAAO,IAAI,CAAC,GAAG,CAAU,uBAAuB,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,wEAAwE;IACxE,QAAQ;QACN,OAAO,IAAI,CAAC,GAAG,CAAU,QAAQ,CAAC,CAAA;IACpC,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,GAAG,CAAU,iBAAiB,CAAC,CAAA;IAC7C,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,GAAG,CAAU,oBAAoB,CAAC,CAAA;IAChD,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,GAAG,CAAU,kBAAkB,CAAC,CAAA;IAC9C,CAAC;IAED,iBAAiB,CAAC,IAAY;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAU,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,GAAG,CAAU,SAAS,CAAC,CAAA;IACrC,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,GAAG,CAAU,WAAW,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,GAAG,CAAU,YAAY,CAAC,CAAA;IACxC,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,OAAO,IAAI,CAAC,GAAG,CAAU,cAAc,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,4EAA4E;IAC5E,QAAQ;QACN,OAAO,IAAI,CAAC,GAAG,CAAU,QAAQ,CAAC,CAAA;IACpC,CAAC;IAED,sBAAsB;IACtB,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,CAAU,SAAS,CAAC,CAAA;IACrC,CAAC;CACF"}

package/dist/env.d.ts

@@ -19,6 +19,7 @@ export interface Env {
     WORKOS_M2M_CLIENT_ID?: string;
     WORKOS_M2M_CLIENT_SECRET?: string;
     FUNDI_URL?: string;
+    FUNDI_SERVICE?: Fetcher;
     COOKIE_ENCRYPTION_KEY: string;
     OAUTH_KV: KVNamespace;
     OAUTH_PROVIDER: OAuthHelpers;

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAEtE,MAAM,WAAW,GAAG;IAElB,YAAY,EAAE,MAAM,CAAA;IACpB,wBAAwB,EAAE,MAAM,CAAA;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAM5B,gBAAgB,EAAE,MAAM,CAAA;IACxB,qBAAqB,EAAE,MAAM,CAAA;IAO7B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAGlB,qBAAqB,EAAE,MAAM,CAAA;IAG7B,QAAQ,EAAE,WAAW,CAAA;IACrB,cAAc,EAAE,YAAY,CAAA;CAC7B"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAEtE,MAAM,WAAW,GAAG;IAElB,YAAY,EAAE,MAAM,CAAA;IACpB,wBAAwB,EAAE,MAAM,CAAA;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAM5B,gBAAgB,EAAE,MAAM,CAAA;IACxB,qBAAqB,EAAE,MAAM,CAAA;IAO7B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAUlB,aAAa,CAAC,EAAE,OAAO,CAAA;IAGvB,qBAAqB,EAAE,MAAM,CAAA;IAG7B,QAAQ,EAAE,WAAW,CAAA;IACrB,cAAc,EAAE,YAAY,CAAA;CAC7B"}

package/dist/fundi-client.d.ts

@@ -18,7 +18,21 @@ export interface FundiToolContext {
     /** The signed-in user's WorkOS access token (from ctx.props). */
     userAccessToken: string;
 }
-/** True when every binding needed to call fundi is present. */
+/** True when either path to fundi is wired: the Service Binding or HTTP + M2M. */
 export declare function fundiConfigured(env: Env): boolean;
+/**
+ * Build the transport to fundi.
+ *
+ * The branch is here, at construction, and nowhere else — every call site keeps
+ * calling `FundiCaller.call(path, userToken, init)` and never learns which path
+ * it got. Preferring the binding is what lets `WORKOS_M2M_CLIENT_SECRET` be
+ * deleted from this Worker once the binding is proven (docs/service-bindings.md);
+ * the HTTP fallback stays because `wrangler dev` and the stdio bin have no
+ * binding to use.
+ *
+ * The user token is forwarded on BOTH paths. A binding removes the machine
+ * credential, not the human one: fundi's entitlement is per-user and it still
+ * refuses a call that acts for nobody.
+ */
 export declare function createFundiCaller(env: Env): FundiCaller;
 //# sourceMappingURL=fundi-client.d.ts.map

package/dist/fundi-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fundi-client.d.ts","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AA+BnC,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACnF;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,WAAW,CAAA;IACnB,iEAAiE;IACjE,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAOjD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,WAAW,CAUvD"}
+{"version":3,"file":"fundi-client.d.ts","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AA+BnC,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACnF;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,WAAW,CAAA;IACnB,iEAAiE;IACjE,eAAe,EAAE,MAAM,CAAA;CACxB;AASD,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAQjD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,WAAW,CAuBvD"}

package/dist/fundi-client.js

@@ -39,14 +39,49 @@ async function mintM2MToken(env) {
     cached = { jwt: data.access_token, exp };
     return data.access_token;
 }
-/** True when every binding needed to call fundi is present. */
+/**
+ * Origin the bound request is addressed to. A `Fetcher` still needs a
+ * well-formed absolute URL to build a `Request` from; the host is never
+ * resolved, because the binding routes by service, not by DNS.
+ */
+const BINDING_ORIGIN = "https://fundi.internal";
+/** True when either path to fundi is wired: the Service Binding or HTTP + M2M. */
 export function fundiConfigured(env) {
+    if (env.FUNDI_SERVICE)
+        return true;
     return Boolean(env.WORKOS_M2M_CLIENT_ID &&
         env.WORKOS_M2M_CLIENT_SECRET &&
         env.FUNDI_URL &&
         env.WORKOS_AUTHKIT_DOMAIN);
 }
+/**
+ * Build the transport to fundi.
+ *
+ * The branch is here, at construction, and nowhere else — every call site keeps
+ * calling `FundiCaller.call(path, userToken, init)` and never learns which path
+ * it got. Preferring the binding is what lets `WORKOS_M2M_CLIENT_SECRET` be
+ * deleted from this Worker once the binding is proven (docs/service-bindings.md);
+ * the HTTP fallback stays because `wrangler dev` and the stdio bin have no
+ * binding to use.
+ *
+ * The user token is forwarded on BOTH paths. A binding removes the machine
+ * credential, not the human one: fundi's entitlement is per-user and it still
+ * refuses a call that acts for nobody.
+ */
 export function createFundiCaller(env) {
+    const service = env.FUNDI_SERVICE;
+    if (service) {
+        return {
+            async call(path, userAccessToken, init = {}) {
+                const headers = new Headers(init.headers);
+                headers.set("X-Fundi-User-Token", userAccessToken);
+                // No Authorization header: the binding IS the machine credential.
+                // Cloudflare will not route a public request to a named entrypoint, so
+                // there is no token to mint, replay, or leak.
+                return service.fetch(new Request(new URL(path, BINDING_ORIGIN), { ...init, headers }));
+            },
+        };
+    }
     return {
         async call(path, userAccessToken, init = {}) {
             const m2m = await mintM2MToken(env);

package/dist/fundi-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"fundi-client.js","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAGhC,IAAI,MAAM,GAAwC,IAAI,CAAA;AAEtD,KAAK,UAAU,YAAY,CAAC,GAAQ;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,GAAG,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,qBAAqB,CAAC,EAAE;QAC3E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE;YACzC,aAAa,EAAE,GAAG,CAAC,wBAAwB,IAAI,EAAE;SAClD,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IACrG,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAA;IAChF,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC3C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAA;IACxC,OAAO,IAAI,CAAC,YAAY,CAAA;AAC1B,CAAC;AAaD,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,OAAO,OAAO,CACZ,GAAG,CAAC,oBAAoB;QACtB,GAAG,CAAC,wBAAwB;QAC5B,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,qBAAqB,CAC5B,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAQ;IACxC,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAG,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACzC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;YAC7C,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAA;YAClD,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAClE,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"fundi-client.js","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAGhC,IAAI,MAAM,GAAwC,IAAI,CAAA;AAEtD,KAAK,UAAU,YAAY,CAAC,GAAQ;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,GAAG,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,qBAAqB,CAAC,EAAE;QAC3E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE;YACzC,aAAa,EAAE,GAAG,CAAC,wBAAwB,IAAI,EAAE;SAClD,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IACrG,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAA;IAChF,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC3C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAA;IACxC,OAAO,IAAI,CAAC,YAAY,CAAA;AAC1B,CAAC;AAaD;;;;GAIG;AACH,MAAM,cAAc,GAAG,wBAAwB,CAAA;AAE/C,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IAClC,OAAO,OAAO,CACZ,GAAG,CAAC,oBAAoB;QACtB,GAAG,CAAC,wBAAwB;QAC5B,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,qBAAqB,CAC5B,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAQ;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAA;IACjC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAG,EAAE;gBACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACzC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAA;gBAClD,kEAAkE;gBAClE,uEAAuE;gBACvE,8CAA8C;gBAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;YACxF,CAAC;SACF,CAAA;IACH,CAAC;IACD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAG,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACzC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;YAC7C,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAA;YAClD,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAClE,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/http.js

@@ -63,7 +63,7 @@ export function createMziziHttpHandler(options = {}) {
             sessionIdGenerator: undefined,
             enableJsonResponse: true,
         });
-        const server = await createMziziMcpServer(ctx.supabase, { fundi: options.fundi });
+        const server = await createMziziMcpServer({ fundi: options.fundi });
         await server.connect(transport);
         const response = await transport.handleRequest(request);
         return withCors(response);

package/dist/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAA;AACxH,OAAO,EAAE,qBAAqB,EAA2B,MAAM,kBAAkB,CAAA;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAGlD,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,4BAA4B;IAC5D,8BAA8B,EAAE,4DAA4D;CAC7F,CAAA;AAED,SAAS,QAAQ,CAAC,QAAkB;IAClC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAChF,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,uEAAuE;AACvE,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAM,wBAAwB,GAAG;IAC/B,uCAAuC;IACvC,yCAAyC;IACzC,mCAAmC;CACpC,CAAA;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO,wBAAwB,CAAC,IAAI,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAA;AACH,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA8B,EAAE;IACrE,MAAM,MAAM,GAAuB,OAAO,CAAC,cAAc,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAE1F,OAAO,KAAK,UAAU,MAAM,CAAC,OAAgB;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,oBAAoB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,OAAO,QAAQ,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzE,IAAI,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAClB,OAAO,QAAQ,CACb,QAAQ,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,mCAAmC,EAAE,EAChE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,GAAG,EAAE,CACjC,CACF,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;YAC7D,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QACjF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACvD,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3B,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAA;AACxH,OAAO,EAAE,qBAAqB,EAA2B,MAAM,kBAAkB,CAAA;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAGlD,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,4BAA4B;IAC5D,8BAA8B,EAAE,4DAA4D;CAC7F,CAAA;AAED,SAAS,QAAQ,CAAC,QAAkB;IAClC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAChF,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,uEAAuE;AACvE,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAM,wBAAwB,GAAG;IAC/B,uCAAuC;IACvC,yCAAyC;IACzC,mCAAmC;CACpC,CAAA;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO,wBAAwB,CAAC,IAAI,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CAAA;AACH,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAA8B,EAAE;IACrE,MAAM,MAAM,GAAuB,OAAO,CAAC,cAAc,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAE1F,OAAO,KAAK,UAAU,MAAM,CAAC,OAAgB;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,oBAAoB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,OAAO,QAAQ,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzE,IAAI,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAClB,OAAO,QAAQ,CACb,QAAQ,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,mCAAmC,EAAE,EAChE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,GAAG,EAAE,CACjC,CACF,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;YAC7D,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACvD,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3B,CAAC,CAAA;AACH,CAAC"}

package/dist/server.d.ts

@@ -1,36 +1,34 @@
 /**
- * Mzizi MCP — registry-driven server factory.
+ * The Mzizi MCP server.
  *
- * The tool surface is NOT hardcoded. It is read at startup from the public
- * `mcp_tool_registry` table (the same registry that powers the design system's
- * MCP), and each tool is dispatched dynamically to its backing implementation:
+ * Backed by `mzizi.dev/api/v1` over HTTP. There is no Supabase client here.
  *
- *   • `sql_function`  → `supabase.rpc(fn, args)`   (the common case)
- *   • `edge_function` → `supabase.functions.invoke(fn, { body: args })`
- *   • `source_table`  → `supabase.from(table).select()` (fallback)
+ * WHAT CHANGED AND WHY. This server used to build its tool catalog at startup from the
+ * `mcp_tool_registry` table and dispatch each call to a Supabase RPC, edge function or
+ * table read — 62 enabled tools, defined as data. Two things were wrong with that:
  *
- * This makes mzizi-mcp a drop-in replacement for the legacy design MCP: adding,
- * renaming, or retiring a tool is a registry edit, not a code change. Argument
- * names in the registry's `input_schema` (and in the curated fallback schemas
- * below) match the SQL function parameters exactly, so arguments pass straight
- * through to `rpc()` with no remapping.
+ *   1. Components are not rows. They are real files in `nyuchi/mzizi` that the Next.js
+ *      app compiles and typechecks, so an error in one fails the build. The app serves
+ *      them over `/api/v1/*`, which makes that API the source of truth and this server
+ *      one of its clients. Reading the database put a second, uncompiled representation
+ *      in the path — one that could disagree with the code while still looking correct.
  *
- * The factory takes a pre-built `SupabaseClient` so the same factory works
- * across transports (HTTP per-request anon client; stdio long-lived anon
- * client). RLS grants public read on `mcp_tool_registry`, `component_documents`,
- * and EXECUTE on the document/registry RPCs.
+ *   2. A tool surface defined in a table changes whenever someone edits a row: no diff,
+ *      no review, no test. The 10 tools live in `tools.ts` as code, so changing them is
+ *      a pull request.
+ *
+ * The 10 are specified in `docs/mcp-tool-consolidation.md` (mzizi repo). Each carries its
+ * `replaces` list in `TOOL_COVERAGE`, so coverage of the old 62 is checkable rather than
+ * asserted.
  */
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import type { SupabaseClient } from "@supabase/supabase-js";
 import type { FundiToolContext } from "./fundi-client.js";
-export declare const MZIZI_MCP_VERSION = "0.5.0";
-/**
- * Build the Mzizi MCP server bound to a Supabase client with public read on
- * `mcp_tool_registry` / `component_documents` and EXECUTE on the backing RPCs.
- * The tool catalog is loaded from the registry; write-kind tools are excluded
- * from this (anonymous, public) surface.
- */
-export declare function createMziziMcpServer(supabase: SupabaseClient, opts?: {
+export declare const MZIZI_MCP_VERSION = "0.7.0";
+export type CreateServerOptions = {
     fundi?: FundiToolContext;
-}): Promise<McpServer>;
+    /** Override the API base — used by tests and by a preview deployment. */
+    apiBaseUrl?: string;
+    fetchImpl?: typeof fetch;
+};
+export declare function createMziziMcpServer(opts?: CreateServerOptions): Promise<McpServer>;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAQ1D,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAwezC;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,cAAc,EACxB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,gBAAgB,CAAA;CAAO,GACtC,OAAO,CAAC,SAAS,CAAC,CAwTpB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAIzD,eAAO,MAAM,iBAAiB,UAAU,CAAA;AAExC,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB,CAAA;AAED,wBAAsB,oBAAoB,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,SAAS,CAAC,CA+D7F"}