@nyuchi/mzizi-mcp 0.6.0 → 0.8.0

package/dist/identity.js

@@ -0,0 +1,44 @@
+// The WorkOS identity tenant this Worker trusts — resolved in ONE place.
+//
+// Mirrors `fundi/src/identity.ts`. The two Workers must agree: mzizi-mcp mints
+// the M2M token that fundi's gate binds, so a tenant mismatch between them means
+// every call mints a token that cannot pass.
+//
+// It is a SECRET, not a `[vars]` entry (see wrangler.toml). A hostname is not
+// confidential; it is environment-specific and vendor-dependent, and a var of
+// the same name wins on every deploy and silently discards the secret. THIS
+// Worker is the worked example — corrected through the settings API, verified,
+// and later found back on a host that no longer resolves.
+/**
+ * The tenant used when `WORKOS_AUTHKIT_DOMAIN` is unset.
+ *
+ * `accounts.mukoko.com`, NOT the `identity.nyuchi.com` that was configured until
+ * 10 Aug 2026. That host no longer resolves at all — attaching a new WorkOS
+ * custom domain detaches the old one with no overlap window, so it began
+ * returning Cloudflare 1014 the moment the new one landed.
+ *
+ * A default is what a Worker gets when configuration is missing, so it has to
+ * name something that works. Defaulting to the retired host would mean a Worker
+ * deployed before its secret is set fails every login while looking correctly
+ * configured.
+ *
+ * `accounts` is PLURAL. `account.mukoko.com` is the Mukoko Account app;
+ * `accounts.mukoko.com` is the issuer that mints its tokens.
+ */
+export const DEFAULT_AUTHKIT_DOMAIN = "https://accounts.mukoko.com";
+/**
+ * Resolve the identity tenant for this Worker.
+ *
+ * The trailing slash is trimmed: callers compose paths onto this, and while
+ * `new URL()` tolerates a slash, an `iss` claim comparison is an exact string
+ * match — `https://x/` never equals the `https://x` WorkOS issues. That would
+ * present as "every token is invalid", which is a long way from "someone left a
+ * trailing slash".
+ */
+export function authkitDomain(env) {
+    const raw = env.WORKOS_AUTHKIT_DOMAIN?.trim();
+    if (!raw)
+        return DEFAULT_AUTHKIT_DOMAIN;
+    return raw.replace(/\/+$/, "");
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,6CAA6C;AAC7C,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,0DAA0D;AAI1D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,6BAA6B,CAAA;AAEnE;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAuC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAA;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,sBAAsB,CAAA;IACvC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAChC,CAAC"}

package/dist/server.d.ts

@@ -1,36 +1,34 @@
 /**
- * Mzizi MCP — registry-driven server factory.
+ * The Mzizi MCP server.
  *
- * The tool surface is NOT hardcoded. It is read at startup from the public
- * `mcp_tool_registry` table (the same registry that powers the design system's
- * MCP), and each tool is dispatched dynamically to its backing implementation:
+ * Backed by `mzizi.dev/api/v1` over HTTP. There is no Supabase client here.
  *
- *   • `sql_function`  → `supabase.rpc(fn, args)`   (the common case)
- *   • `edge_function` → `supabase.functions.invoke(fn, { body: args })`
- *   • `source_table`  → `supabase.from(table).select()` (fallback)
+ * WHAT CHANGED AND WHY. This server used to build its tool catalog at startup from the
+ * `mcp_tool_registry` table and dispatch each call to a Supabase RPC, edge function or
+ * table read — 62 enabled tools, defined as data. Two things were wrong with that:
  *
- * This makes mzizi-mcp a drop-in replacement for the legacy design MCP: adding,
- * renaming, or retiring a tool is a registry edit, not a code change. Argument
- * names in the registry's `input_schema` (and in the curated fallback schemas
- * below) match the SQL function parameters exactly, so arguments pass straight
- * through to `rpc()` with no remapping.
+ *   1. Components are not rows. They are real files in `nyuchi/mzizi` that the Next.js
+ *      app compiles and typechecks, so an error in one fails the build. The app serves
+ *      them over `/api/v1/*`, which makes that API the source of truth and this server
+ *      one of its clients. Reading the database put a second, uncompiled representation
+ *      in the path — one that could disagree with the code while still looking correct.
  *
- * The factory takes a pre-built `SupabaseClient` so the same factory works
- * across transports (HTTP per-request anon client; stdio long-lived anon
- * client). RLS grants public read on `mcp_tool_registry`, `component_documents`,
- * and EXECUTE on the document/registry RPCs.
+ *   2. A tool surface defined in a table changes whenever someone edits a row: no diff,
+ *      no review, no test. The 10 tools live in `tools.ts` as code, so changing them is
+ *      a pull request.
+ *
+ * The 10 are specified in `docs/mcp-tool-consolidation.md` (mzizi repo). Each carries its
+ * `replaces` list in `TOOL_COVERAGE`, so coverage of the old 62 is checkable rather than
+ * asserted.
  */
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import type { SupabaseClient } from "@supabase/supabase-js";
 import type { FundiToolContext } from "./fundi-client.js";
-export declare const MZIZI_MCP_VERSION = "0.6.0";
-/**
- * Build the Mzizi MCP server bound to a Supabase client with public read on
- * `mcp_tool_registry` / `component_documents` and EXECUTE on the backing RPCs.
- * The tool catalog is loaded from the registry; write-kind tools are excluded
- * from this (anonymous, public) surface.
- */
-export declare function createMziziMcpServer(supabase: SupabaseClient, opts?: {
+export declare const MZIZI_MCP_VERSION = "0.8.0";
+export type CreateServerOptions = {
     fundi?: FundiToolContext;
-}): Promise<McpServer>;
+    /** Override the API base — used by tests and by a preview deployment. */
+    apiBaseUrl?: string;
+    fetchImpl?: typeof fetch;
+};
+export declare function createMziziMcpServer(opts?: CreateServerOptions): Promise<McpServer>;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAQ1D,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAwezC;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,cAAc,EACxB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,gBAAgB,CAAA;CAAO,GACtC,OAAO,CAAC,SAAS,CAAC,CAwTpB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAIzD,eAAO,MAAM,iBAAiB,UAAU,CAAA;AAExC,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB,CAAA;AAED,wBAAsB,oBAAoB,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,SAAS,CAAC,CA+D7F"}