@nyuchi/mzizi-mcp 0.7.0 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +22 -13
- package/dist/api-client.d.ts.map +1 -1
- package/dist/api-client.js +14 -1
- package/dist/api-client.js.map +1 -1
- package/dist/auth/authkit-handler.d.ts +1 -1
- package/dist/auth/authkit-handler.d.ts.map +1 -1
- package/dist/auth/authkit-handler.js +8 -3
- package/dist/auth/authkit-handler.js.map +1 -1
- package/dist/env.d.ts +1 -1
- package/dist/env.d.ts.map +1 -1
- package/dist/fundi-client.d.ts +13 -1
- package/dist/fundi-client.d.ts.map +1 -1
- package/dist/fundi-client.js +16 -6
- package/dist/fundi-client.js.map +1 -1
- package/dist/identity.d.ts +29 -0
- package/dist/identity.d.ts.map +1 -0
- package/dist/identity.js +44 -0
- package/dist/identity.js.map +1 -0
- package/dist/server.d.ts +1 -1
- package/dist/server.js +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -9,7 +9,9 @@ retiring a tool is a registry edit, not a code change. The server is read-only o
|
|
|
9
9
|
the anonymous surface — write-kind tools are excluded.
|
|
10
10
|
|
|
11
11
|
**Live at** `https://mcp.mzizi.dev/mcp` (Cloudflare Worker `mzizi-mcp`, version
|
|
12
|
-
0.
|
|
12
|
+
0.7.0 — `MZIZI_MCP_VERSION` in `src/server.ts` is what `serverInfo.version`
|
|
13
|
+
reports, and it moves in lockstep with `package.json` and `server.json`). A
|
|
14
|
+
**free WorkOS signup gate** fronts the endpoint — a WorkOS
|
|
13
15
|
**Connect OAuth application** (public client, PKCE; no client secret) — so sign up
|
|
14
16
|
once and read the whole registry at no cost. The worker advertises
|
|
15
17
|
`/.well-known/oauth-protected-resource` so MCP clients can run the OAuth discovery
|
|
@@ -138,21 +140,28 @@ catalog.
|
|
|
138
140
|
|
|
139
141
|
Secrets (`wrangler secret put`):
|
|
140
142
|
|
|
141
|
-
| Secret | Required | Notes
|
|
142
|
-
| -------------------------- | -------- |
|
|
143
|
-
| `SUPABASE_URL` | yes | Public Supabase project URL
|
|
144
|
-
| `SUPABASE_PUBLISHABLE_KEY` | yes | Anon (RLS public-read) key
|
|
145
|
-
| `SUPABASE_SECRET_KEY` | no | Service-role key; placeholder is used if unset
|
|
146
|
-
| `COOKIE_ENCRYPTION_KEY` | yes | HMAC key for the consent cookie (random bytes)
|
|
143
|
+
| Secret | Required | Notes |
|
|
144
|
+
| -------------------------- | -------- | -------------------------------------------------------------- |
|
|
145
|
+
| `SUPABASE_URL` | yes | Public Supabase project URL |
|
|
146
|
+
| `SUPABASE_PUBLISHABLE_KEY` | yes | Anon (RLS public-read) key |
|
|
147
|
+
| `SUPABASE_SECRET_KEY` | no | Service-role key; placeholder is used if unset |
|
|
148
|
+
| `COOKIE_ENCRYPTION_KEY` | yes | HMAC key for the consent cookie (random bytes) |
|
|
149
|
+
| `WORKOS_AUTHKIT_DOMAIN` | no | AuthKit domain for `/oauth2/*` (`https://accounts.mukoko.com`) |
|
|
150
|
+
|
|
151
|
+
`WORKOS_AUTHKIT_DOMAIN` is a **secret and not a `[vars]` entry**, even though a hostname is not
|
|
152
|
+
confidential: a var wins on every deploy and silently discards a same-named remote value, so a
|
|
153
|
+
value that differs per environment cannot live in committed config. It is "not required" only
|
|
154
|
+
because `src/identity.ts` carries a working default — and it must move in lockstep with
|
|
155
|
+
`fundi-tester`, which binds the same issuer that this Worker's agent-card consumers are pointed
|
|
156
|
+
at. See `AUTH.md`.
|
|
147
157
|
|
|
148
158
|
Plain vars (`[vars]` in `wrangler.toml`, not secrets):
|
|
149
159
|
|
|
150
|
-
| Var
|
|
151
|
-
|
|
|
152
|
-
| `WORKOS_CLIENT_ID`
|
|
153
|
-
| `
|
|
154
|
-
| `
|
|
155
|
-
| `FUNDI_URL` | Base URL of the fundi worker; enables the `fundi_status` tool |
|
|
160
|
+
| Var | Notes |
|
|
161
|
+
| ---------------------- | -------------------------------------------------------------- |
|
|
162
|
+
| `WORKOS_CLIENT_ID` | Connect OAuth app client id (public client; PKCE) |
|
|
163
|
+
| `WORKOS_M2M_CLIENT_ID` | Fundi M2M app client id; required only when `FUNDI_URL` is set |
|
|
164
|
+
| `FUNDI_URL` | Base URL of the fundi worker; enables the `fundi_status` tool |
|
|
156
165
|
|
|
157
166
|
> The Connect OAuth app is a **public client (PKCE)** — there is no `WORKOS_CLIENT_SECRET`
|
|
158
167
|
> or WorkOS API key on the worker.
|
package/dist/api-client.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,eAAO,MAAM,gBAAgB,6BAA6B,CAAA;AAK1D,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,CAAA;AAC5C,MAAM,MAAM,MAAM,GAAG;IACnB,EAAE,EAAE,KAAK,CAAA;IACT,wDAAwD;IACxD,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,CAAA;IACvE,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AACD,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;AAE5C,MAAM,MAAM,eAAe,GAAG;IAC5B,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB,CAAA;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;gBAE5B,IAAI,GAAE,eAAoB;
|
|
1
|
+
{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,eAAO,MAAM,gBAAgB,6BAA6B,CAAA;AAK1D,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,CAAA;AAC5C,MAAM,MAAM,MAAM,GAAG;IACnB,EAAE,EAAE,KAAK,CAAA;IACT,wDAAwD;IACxD,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,CAAA;IACvE,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AACD,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;AAE5C,MAAM,MAAM,eAAe,GAAG;IAC5B,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB,CAAA;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;gBAE5B,IAAI,GAAE,eAAoB;IAmBtC;;;;;;OAMG;IACG,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAyEtG,sBAAsB;IACtB,cAAc;IAId,6DAA6D;IAC7D,YAAY,CAAC,IAAI,EAAE,MAAM;IAIzB,qDAAqD;IACrD,gBAAgB,CAAC,IAAI,EAAE,MAAM;IAI7B,qCAAqC;IACrC,oBAAoB,CAAC,IAAI,EAAE,MAAM;IAIjC,2DAA2D;IAC3D,MAAM,CAAC,KAAK,EAAE,MAAM;IAIpB,gEAAgE;IAChE,eAAe;IAIf,8EAA8E;IAC9E,OAAO,CAAC,CAAC,EAAE,MAAM;IAIjB,wEAAwE;IACxE,QAAQ;IAIR,gBAAgB;IAIhB,mBAAmB;IAInB,kBAAkB;IAIlB,iBAAiB,CAAC,IAAI,EAAE,MAAM;IAI9B,UAAU;IAIV,QAAQ,CAAC,IAAI,EAAE,MAAM;IAIrB,aAAa;IAIb,UAAU,CAAC,OAAO,EAAE,MAAM;IAI1B,4EAA4E;IAC5E,QAAQ;IAIR,sBAAsB;IACtB,SAAS;CAGV"}
|
package/dist/api-client.js
CHANGED
|
@@ -30,7 +30,20 @@ export class MziziApiClient {
|
|
|
30
30
|
constructor(opts = {}) {
|
|
31
31
|
this.baseUrl = (opts.baseUrl ?? DEFAULT_API_BASE).replace(/\/+$/, "");
|
|
32
32
|
this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
|
|
33
|
-
|
|
33
|
+
// `.bind(globalThis)` is load-bearing, not defensive style.
|
|
34
|
+
//
|
|
35
|
+
// Storing the global on an instance and calling it as `this.fetchImpl(...)`
|
|
36
|
+
// invokes it as a METHOD, so its receiver is the MziziApiClient rather than
|
|
37
|
+
// the global scope. Workers' `fetch` is a native binding that validates its
|
|
38
|
+
// receiver and throws:
|
|
39
|
+
//
|
|
40
|
+
// Illegal invocation: function called with incorrect `this` reference
|
|
41
|
+
//
|
|
42
|
+
// Node's global fetch tolerates the same call, which is exactly why this
|
|
43
|
+
// shipped: the offline suite passed on Node while every network-backed tool
|
|
44
|
+
// on the deployed Worker was dead. An injected `fetchImpl` is a plain
|
|
45
|
+
// closure and needs no binding, so the tests never touched the broken path.
|
|
46
|
+
this.fetchImpl = opts.fetchImpl ?? fetch.bind(globalThis);
|
|
34
47
|
}
|
|
35
48
|
/**
|
|
36
49
|
* GET a JSON path under the API base.
|
package/dist/api-client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,0BAA0B,CAAA;AAE1D,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAqBjC,MAAM,OAAO,cAAc;IACR,OAAO,CAAQ;IACf,SAAS,CAAQ;IACjB,SAAS,CAAc;IAExC,YAAY,OAAwB,EAAE;QACpC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAA;QACrD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;
|
|
1
|
+
{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,0BAA0B,CAAA;AAE1D,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAqBjC,MAAM,OAAO,cAAc;IACR,OAAO,CAAQ;IACf,SAAS,CAAQ;IACjB,SAAS,CAAc;IAExC,YAAY,OAAwB,EAAE;QACpC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAA;QACrD,4DAA4D;QAC5D,EAAE;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,uBAAuB;QACvB,EAAE;QACF,wEAAwE;QACxE,EAAE;QACF,yEAAyE;QACzE,4EAA4E;QAC5E,sEAAsE;QACtE,4EAA4E;QAC5E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC3D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,KAAmD;QAC5E,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAA;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;YAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;oBAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;YACvD,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAA;YACvB,IAAI,CAAC;gBAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAA;QACvB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBACpC,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAA;YAEF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,kCAAkC,IAAI,2DAA2D;iBAC3G,CAAA;YACH,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,4EAA4E;gBAC5E,4EAA4E;gBAC5E,yDAAyD;gBACzD,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG;oBAChB,CAAC,CAAC,+FAA+F;oBACjG,CAAC,CAAC,EAAE,CAAA;gBACR,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,0BAA0B,GAAG,CAAC,MAAM,QAAQ,IAAI,IAAI,IAAI,EAAE;iBACpE,CAAA;YACH,CAAC;YAED,IAAI,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,EAAE,CAAA;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,UAAU;oBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,8CAA8C,IAAI,0DAA0D;iBACtH,CAAA;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAAa,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1C,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,wCAAwC,IAAI,CAAC,SAAS,UAAU,IAAI,GAAG;iBACjF,CAAA;YACH,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,oCAAoC,IAAI,CAAC,OAAO,KAAM,GAAa,EAAE,OAAO,IAAI,eAAe,GAAG;aAC5G,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED,sEAAsE;IAEtE,sBAAsB;IACtB,cAAc;QACZ,OAAO,IAAI,CAAC,GAAG,CAAU,KAAK,CAAC,CAAA;IACjC,CAAC;IAED,6DAA6D;IAC7D,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,GAAG,CAAU,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,qDAAqD;IACrD,gBAAgB,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAU,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAClE,CAAC;IAED,qCAAqC;IACrC,oBAAoB,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAU,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACtE,CAAC;IAED,2DAA2D;IAC3D,MAAM,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,GAAG,CAAU,SAAS,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACnD,CAAC;IAED,gEAAgE;IAChE,eAAe;QACb,OAAO,IAAI,CAAC,GAAG,CAAU,eAAe,CAAC,CAAA;IAC3C,CAAC;IAED,8EAA8E;IAC9E,OAAO,CAAC,CAAS;QACf,OAAO,IAAI,CAAC,GAAG,CAAU,uBAAuB,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,wEAAwE;IACxE,QAAQ;QACN,OAAO,IAAI,CAAC,GAAG,CAAU,QAAQ,CAAC,CAAA;IACpC,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,GAAG,CAAU,iBAAiB,CAAC,CAAA;IAC7C,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,GAAG,CAAU,oBAAoB,CAAC,CAAA;IAChD,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,GAAG,CAAU,kBAAkB,CAAC,CAAA;IAC9C,CAAC;IAED,iBAAiB,CAAC,IAAY;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAU,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,GAAG,CAAU,SAAS,CAAC,CAAA;IACrC,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,GAAG,CAAU,WAAW,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,GAAG,CAAU,YAAY,CAAC,CAAA;IACxC,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,OAAO,IAAI,CAAC,GAAG,CAAU,cAAc,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,4EAA4E;IAC5E,QAAQ;QACN,OAAO,IAAI,CAAC,GAAG,CAAU,QAAQ,CAAC,CAAA;IACpC,CAAC;IAED,sBAAsB;IACtB,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,CAAU,SAAS,CAAC,CAAA;IACrC,CAAC;CACF"}
|
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
* configured as a PUBLIC client: it has a client id only and NO secret, so the
|
|
6
6
|
* worker holds no WorkOS API key. The flow is standard OAuth 2.0
|
|
7
7
|
* authorization-code with **PKCE** against the AuthKit domain
|
|
8
|
-
* (`WORKOS_AUTHKIT_DOMAIN`, e.g. https://
|
|
8
|
+
* (`WORKOS_AUTHKIT_DOMAIN`, e.g. https://accounts.mukoko.com):
|
|
9
9
|
*
|
|
10
10
|
* /authorize → MCP-client consent, then 302 to <authkit>/oauth2/authorize
|
|
11
11
|
* with a PKCE code_challenge
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authkit-handler.d.ts","sourceRoot":"","sources":["../../src/auth/authkit-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAEV,YAAY,EACb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"authkit-handler.d.ts","sourceRoot":"","sources":["../../src/auth/authkit-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAEV,YAAY,EACb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAerC,KAAK,OAAO,GAAG;IAAE,QAAQ,EAAE,GAAG,GAAG;QAAE,cAAc,EAAE,YAAY,CAAA;KAAE,CAAA;CAAE,CAAC;AAmSpE,eAAO,MAAM,cAAc,sDAAM,CAAC"}
|
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
* configured as a PUBLIC client: it has a client id only and NO secret, so the
|
|
6
6
|
* worker holds no WorkOS API key. The flow is standard OAuth 2.0
|
|
7
7
|
* authorization-code with **PKCE** against the AuthKit domain
|
|
8
|
-
* (`WORKOS_AUTHKIT_DOMAIN`, e.g. https://
|
|
8
|
+
* (`WORKOS_AUTHKIT_DOMAIN`, e.g. https://accounts.mukoko.com):
|
|
9
9
|
*
|
|
10
10
|
* /authorize → MCP-client consent, then 302 to <authkit>/oauth2/authorize
|
|
11
11
|
* with a PKCE code_challenge
|
|
@@ -23,6 +23,7 @@
|
|
|
23
23
|
*/
|
|
24
24
|
import { Hono } from "hono";
|
|
25
25
|
import * as jose from "jose";
|
|
26
|
+
import { authkitDomain } from "../identity.js";
|
|
26
27
|
import { addApprovedClient, bindStateToSession, createOAuthState, generateCSRFProtection, isClientApproved, OAuthError, renderApprovalDialog, validateCSRFToken, validateOAuthState, } from "./oauth-utils.js";
|
|
27
28
|
const SERVER_NAME = "Mzizi Design System Registry";
|
|
28
29
|
const SERVER_DESCRIPTION = "Free, public MCP over the Mzizi design-system registry — components, design tokens, brand, and the ecosystem architecture nodes. Sign in or create a free account to connect.";
|
|
@@ -51,8 +52,12 @@ async function deriveCodeChallenge(verifier) {
|
|
|
51
52
|
return base64url(digest);
|
|
52
53
|
}
|
|
53
54
|
function authkitOrigin(c) {
|
|
54
|
-
// Accept a bare host or a full origin
|
|
55
|
-
|
|
55
|
+
// Accept a bare host or a full origin, and tolerate the secret being unset —
|
|
56
|
+
// `authkitDomain` falls back to a live issuer rather than throwing on
|
|
57
|
+
// `undefined.trim()`. The bare-host case is real: at least one Worker on this
|
|
58
|
+
// account stores the hostname with no scheme, so a find-and-replace that
|
|
59
|
+
// assumes one produces `https://https://…`.
|
|
60
|
+
const raw = authkitDomain(c.env);
|
|
56
61
|
return /^https?:\/\//.test(raw) ? raw : `https://${raw}`;
|
|
57
62
|
}
|
|
58
63
|
function callbackUrl(c) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authkit-handler.js","sourceRoot":"","sources":["../../src/auth/authkit-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"authkit-handler.js","sourceRoot":"","sources":["../../src/auth/authkit-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,WAAW,GAAG,8BAA8B,CAAC;AACnD,MAAM,kBAAkB,GACtB,+KAA+K,CAAC;AAClL,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAC9D,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAC3C,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAW,CAAC;AAEhC,gFAAgF;AAChF,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CACnC,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,CAAmB;IACxC,6EAA6E;IAC7E,sEAAsE;IACtE,8EAA8E;IAC9E,yEAAyE;IACzE,4CAA4C;IAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,CAAmB;IACtC,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,QAAQ,EAAE,aAAa;YACvB,eAAe,EAAE,uBAAuB;SACzC;KACF,CAAC,CAAC;AACL,CAAC;AAED,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACjB,CAAC,CAAC,IAAI,CACJ,2IAA2I,WAAW,0UAA0U,WAAW,WAAW,kBAAkB,sTAAsT,EAC9zB,GAAG,EACH,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAC3C,CACF,CAAC;AACF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;AAChD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;AAE7C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAErD,IACE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,EACxE,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,GACvC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,sBAAsB,EAAE,CAAC;IAEjE,OAAO,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE;QACrC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,QAAQ,CAAC;QACzD,SAAS;QACT,MAAM,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE;QAC9D,SAAS;QACT,KAAK,EAAE,EAAE,YAAY,EAAE;KACxB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5C,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvC,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,KAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,iBAAiB,CAClD,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,KAAK,CAAC,YAAY,CAAC,QAAQ,EAC3B,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAC5B,CAAC;QAEF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,gBAAgB,CAC3C,KAAK,CAAC,YAAY,EAClB,CAAC,CAAC,GAAG,CAAC,QAAQ,CACf,CAAC;QACF,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,GACvC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEvC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAEnD,OAAO,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,KAAK,YAAY,UAAU;YAAE,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,gFAAgF;AAChF,KAAK,UAAU,UAAU,CACvB,CAAmB,EACnB,UAAkB,EAClB,UAAkC,EAAE;IAEpC,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC9D,6EAA6E;IAC7E,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,UAAU,EAAE,EAAE,YAAY,EAAE;QACjE,aAAa,EAAE,gBAAgB;KAChC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACvD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACpD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACnD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC/D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAE/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,IAAI,EAAE;KACrD,CAAC,CAAC;AACL,CAAC;AAUD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/B,IAAI,YAAyB,CAAC;IAC9B,IAAI,kBAA0B,CAAC;IAE/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnE,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACnC,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,UAAU;YAAE,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,MAAM,YAAY,GAAG,WAAW;QAC9B,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,YAAY;QACf,OAAO,CAAC,CAAC,IAAI,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;IACpE,IAAI,WAAW;QAAE,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAE1D,iEAAiE;IACjE,MAAM,aAAa,GAAG,MAAM,KAAK,CAC/B,IAAI,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAC1C;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB;YACjC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5B,aAAa,EAAE,YAAY;SAC5B,CAAC;KACH,CACF,CAAC;IAEF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CACX,wBAAwB,EACxB,aAAa,CAAC,MAAM,EACpB,MAAM,aAAa,CAAC,IAAI,EAAE,CAC3B,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAkB,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,MAMH,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAClC,IAAI,GAAG,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAC1C,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAEzD,MAAM,IAAI,GACR,MAAM,CAAC,IAAI;QACX,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACjE,SAAS,CAAC;IACZ,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC,WAAW;QACpB,CAAC,CAAC,EAAE,CAAC;IAEP,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,KAAK,GAAU;QACnB,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,IAAI,IAAI,SAAS;QACvB,WAAW,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACtC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,WAAW;KACZ,CAAC;IAEF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;QACtE,OAAO,EAAE,YAAY;QACrB,MAAM;QACN,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,WAAW;QAClB,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,IAAI,kBAAkB;QAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IAEtE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC"}
|
package/dist/env.d.ts
CHANGED
|
@@ -15,7 +15,7 @@ export interface Env {
|
|
|
15
15
|
SUPABASE_PUBLISHABLE_KEY: string;
|
|
16
16
|
SUPABASE_SECRET_KEY?: string;
|
|
17
17
|
WORKOS_CLIENT_ID: string;
|
|
18
|
-
WORKOS_AUTHKIT_DOMAIN
|
|
18
|
+
WORKOS_AUTHKIT_DOMAIN?: string;
|
|
19
19
|
WORKOS_M2M_CLIENT_ID?: string;
|
|
20
20
|
WORKOS_M2M_CLIENT_SECRET?: string;
|
|
21
21
|
FUNDI_URL?: string;
|
package/dist/env.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAEtE,MAAM,WAAW,GAAG;IAElB,YAAY,EAAE,MAAM,CAAA;IACpB,wBAAwB,EAAE,MAAM,CAAA;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;
|
|
1
|
+
{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAEtE,MAAM,WAAW,GAAG;IAElB,YAAY,EAAE,MAAM,CAAA;IACpB,wBAAwB,EAAE,MAAM,CAAA;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAK5B,gBAAgB,EAAE,MAAM,CAAA;IAWxB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAO9B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAUlB,aAAa,CAAC,EAAE,OAAO,CAAA;IAGvB,qBAAqB,EAAE,MAAM,CAAA;IAG7B,QAAQ,EAAE,WAAW,CAAA;IACrB,cAAc,EAAE,YAAY,CAAA;CAC7B"}
|
package/dist/fundi-client.d.ts
CHANGED
|
@@ -18,7 +18,19 @@ export interface FundiToolContext {
|
|
|
18
18
|
/** The signed-in user's WorkOS access token (from ctx.props). */
|
|
19
19
|
userAccessToken: string;
|
|
20
20
|
}
|
|
21
|
-
/**
|
|
21
|
+
/**
|
|
22
|
+
* True when either path to fundi is wired: the Service Binding or HTTP + M2M.
|
|
23
|
+
*
|
|
24
|
+
* `WORKOS_AUTHKIT_DOMAIN` is deliberately NOT in this condition. It is now a
|
|
25
|
+
* secret with a live default, so it always resolves — and gating on it would
|
|
26
|
+
* reintroduce the exact failure this Worker already shipped once: a capability
|
|
27
|
+
* conditioned on a credential that turned out not to be set does not error, it
|
|
28
|
+
* DISAPPEARS. All four fundi tools were absent from the deployed public surface
|
|
29
|
+
* for weeks because `fundiConfigured` answered false and nothing said so.
|
|
30
|
+
*
|
|
31
|
+
* The values that remain are the ones with no usable default: without the M2M
|
|
32
|
+
* client id, secret and fundi URL there is genuinely no HTTP path to fundi.
|
|
33
|
+
*/
|
|
22
34
|
export declare function fundiConfigured(env: Env): boolean;
|
|
23
35
|
/**
|
|
24
36
|
* Build the transport to fundi.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fundi-client.d.ts","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;
|
|
1
|
+
{"version":3,"file":"fundi-client.d.ts","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAgCnC,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACnF;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,WAAW,CAAA;IACnB,iEAAiE;IACjE,eAAe,EAAE,MAAM,CAAA;CACxB;AASD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAGjD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,WAAW,CAuBvD"}
|
package/dist/fundi-client.js
CHANGED
|
@@ -9,12 +9,13 @@
|
|
|
9
9
|
* CLI never holds the secret — it reaches fundi *through* this Worker.
|
|
10
10
|
*/
|
|
11
11
|
import { decodeJwt } from "jose";
|
|
12
|
+
import { authkitDomain } from "./identity.js";
|
|
12
13
|
let cached = null;
|
|
13
14
|
async function mintM2MToken(env) {
|
|
14
15
|
const now = Math.floor(Date.now() / 1000);
|
|
15
16
|
if (cached && cached.exp > now + 60)
|
|
16
17
|
return cached.jwt;
|
|
17
|
-
const res = await fetch(new URL("/oauth2/token", env
|
|
18
|
+
const res = await fetch(new URL("/oauth2/token", authkitDomain(env)), {
|
|
18
19
|
method: "POST",
|
|
19
20
|
headers: { "Content-Type": "application/x-www-form-urlencoded" },
|
|
20
21
|
body: new URLSearchParams({
|
|
@@ -45,14 +46,23 @@ async function mintM2MToken(env) {
|
|
|
45
46
|
* resolved, because the binding routes by service, not by DNS.
|
|
46
47
|
*/
|
|
47
48
|
const BINDING_ORIGIN = "https://fundi.internal";
|
|
48
|
-
/**
|
|
49
|
+
/**
|
|
50
|
+
* True when either path to fundi is wired: the Service Binding or HTTP + M2M.
|
|
51
|
+
*
|
|
52
|
+
* `WORKOS_AUTHKIT_DOMAIN` is deliberately NOT in this condition. It is now a
|
|
53
|
+
* secret with a live default, so it always resolves — and gating on it would
|
|
54
|
+
* reintroduce the exact failure this Worker already shipped once: a capability
|
|
55
|
+
* conditioned on a credential that turned out not to be set does not error, it
|
|
56
|
+
* DISAPPEARS. All four fundi tools were absent from the deployed public surface
|
|
57
|
+
* for weeks because `fundiConfigured` answered false and nothing said so.
|
|
58
|
+
*
|
|
59
|
+
* The values that remain are the ones with no usable default: without the M2M
|
|
60
|
+
* client id, secret and fundi URL there is genuinely no HTTP path to fundi.
|
|
61
|
+
*/
|
|
49
62
|
export function fundiConfigured(env) {
|
|
50
63
|
if (env.FUNDI_SERVICE)
|
|
51
64
|
return true;
|
|
52
|
-
return Boolean(env.WORKOS_M2M_CLIENT_ID &&
|
|
53
|
-
env.WORKOS_M2M_CLIENT_SECRET &&
|
|
54
|
-
env.FUNDI_URL &&
|
|
55
|
-
env.WORKOS_AUTHKIT_DOMAIN);
|
|
65
|
+
return Boolean(env.WORKOS_M2M_CLIENT_ID && env.WORKOS_M2M_CLIENT_SECRET && env.FUNDI_URL);
|
|
56
66
|
}
|
|
57
67
|
/**
|
|
58
68
|
* Build the transport to fundi.
|
package/dist/fundi-client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fundi-client.js","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;
|
|
1
|
+
{"version":3,"file":"fundi-client.js","sourceRoot":"","sources":["../src/fundi-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE7C,IAAI,MAAM,GAAwC,IAAI,CAAA;AAEtD,KAAK,UAAU,YAAY,CAAC,GAAQ;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,GAAG,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE;QACpE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE;YACzC,aAAa,EAAE,GAAG,CAAC,wBAAwB,IAAI,EAAE;SAClD,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IACrG,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAA;IAChF,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC3C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAA;IACxC,OAAO,IAAI,CAAC,YAAY,CAAA;AAC1B,CAAC;AAaD;;;;GAIG;AACH,MAAM,cAAc,GAAG,wBAAwB,CAAA;AAE/C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,wBAAwB,IAAI,GAAG,CAAC,SAAS,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAQ;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAA;IACjC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAG,EAAE;gBACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACzC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAA;gBAClD,kEAAkE;gBAClE,uEAAuE;gBACvE,8CAA8C;gBAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;YACxF,CAAC;SACF,CAAA;IACH,CAAC;IACD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAG,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACzC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;YAC7C,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAA;YAClD,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAClE,CAAC;KACF,CAAA;AACH,CAAC"}
|
|
@@ -0,0 +1,29 @@
|
|
|
1
|
+
import type { Env } from "./env.js";
|
|
2
|
+
/**
|
|
3
|
+
* The tenant used when `WORKOS_AUTHKIT_DOMAIN` is unset.
|
|
4
|
+
*
|
|
5
|
+
* `accounts.mukoko.com`, NOT the `identity.nyuchi.com` that was configured until
|
|
6
|
+
* 10 Aug 2026. That host no longer resolves at all — attaching a new WorkOS
|
|
7
|
+
* custom domain detaches the old one with no overlap window, so it began
|
|
8
|
+
* returning Cloudflare 1014 the moment the new one landed.
|
|
9
|
+
*
|
|
10
|
+
* A default is what a Worker gets when configuration is missing, so it has to
|
|
11
|
+
* name something that works. Defaulting to the retired host would mean a Worker
|
|
12
|
+
* deployed before its secret is set fails every login while looking correctly
|
|
13
|
+
* configured.
|
|
14
|
+
*
|
|
15
|
+
* `accounts` is PLURAL. `account.mukoko.com` is the Mukoko Account app;
|
|
16
|
+
* `accounts.mukoko.com` is the issuer that mints its tokens.
|
|
17
|
+
*/
|
|
18
|
+
export declare const DEFAULT_AUTHKIT_DOMAIN = "https://accounts.mukoko.com";
|
|
19
|
+
/**
|
|
20
|
+
* Resolve the identity tenant for this Worker.
|
|
21
|
+
*
|
|
22
|
+
* The trailing slash is trimmed: callers compose paths onto this, and while
|
|
23
|
+
* `new URL()` tolerates a slash, an `iss` claim comparison is an exact string
|
|
24
|
+
* match — `https://x/` never equals the `https://x` WorkOS issues. That would
|
|
25
|
+
* present as "every token is invalid", which is a long way from "someone left a
|
|
26
|
+
* trailing slash".
|
|
27
|
+
*/
|
|
28
|
+
export declare function authkitDomain(env: Pick<Env, "WORKOS_AUTHKIT_DOMAIN">): string;
|
|
29
|
+
//# sourceMappingURL=identity.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAEnC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,gCAAgC,CAAA;AAEnE;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,GAAG,MAAM,CAI7E"}
|
package/dist/identity.js
ADDED
|
@@ -0,0 +1,44 @@
|
|
|
1
|
+
// The WorkOS identity tenant this Worker trusts — resolved in ONE place.
|
|
2
|
+
//
|
|
3
|
+
// Mirrors `fundi/src/identity.ts`. The two Workers must agree: mzizi-mcp mints
|
|
4
|
+
// the M2M token that fundi's gate binds, so a tenant mismatch between them means
|
|
5
|
+
// every call mints a token that cannot pass.
|
|
6
|
+
//
|
|
7
|
+
// It is a SECRET, not a `[vars]` entry (see wrangler.toml). A hostname is not
|
|
8
|
+
// confidential; it is environment-specific and vendor-dependent, and a var of
|
|
9
|
+
// the same name wins on every deploy and silently discards the secret. THIS
|
|
10
|
+
// Worker is the worked example — corrected through the settings API, verified,
|
|
11
|
+
// and later found back on a host that no longer resolves.
|
|
12
|
+
/**
|
|
13
|
+
* The tenant used when `WORKOS_AUTHKIT_DOMAIN` is unset.
|
|
14
|
+
*
|
|
15
|
+
* `accounts.mukoko.com`, NOT the `identity.nyuchi.com` that was configured until
|
|
16
|
+
* 10 Aug 2026. That host no longer resolves at all — attaching a new WorkOS
|
|
17
|
+
* custom domain detaches the old one with no overlap window, so it began
|
|
18
|
+
* returning Cloudflare 1014 the moment the new one landed.
|
|
19
|
+
*
|
|
20
|
+
* A default is what a Worker gets when configuration is missing, so it has to
|
|
21
|
+
* name something that works. Defaulting to the retired host would mean a Worker
|
|
22
|
+
* deployed before its secret is set fails every login while looking correctly
|
|
23
|
+
* configured.
|
|
24
|
+
*
|
|
25
|
+
* `accounts` is PLURAL. `account.mukoko.com` is the Mukoko Account app;
|
|
26
|
+
* `accounts.mukoko.com` is the issuer that mints its tokens.
|
|
27
|
+
*/
|
|
28
|
+
export const DEFAULT_AUTHKIT_DOMAIN = "https://accounts.mukoko.com";
|
|
29
|
+
/**
|
|
30
|
+
* Resolve the identity tenant for this Worker.
|
|
31
|
+
*
|
|
32
|
+
* The trailing slash is trimmed: callers compose paths onto this, and while
|
|
33
|
+
* `new URL()` tolerates a slash, an `iss` claim comparison is an exact string
|
|
34
|
+
* match — `https://x/` never equals the `https://x` WorkOS issues. That would
|
|
35
|
+
* present as "every token is invalid", which is a long way from "someone left a
|
|
36
|
+
* trailing slash".
|
|
37
|
+
*/
|
|
38
|
+
export function authkitDomain(env) {
|
|
39
|
+
const raw = env.WORKOS_AUTHKIT_DOMAIN?.trim();
|
|
40
|
+
if (!raw)
|
|
41
|
+
return DEFAULT_AUTHKIT_DOMAIN;
|
|
42
|
+
return raw.replace(/\/+$/, "");
|
|
43
|
+
}
|
|
44
|
+
//# sourceMappingURL=identity.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,6CAA6C;AAC7C,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,0DAA0D;AAI1D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,6BAA6B,CAAA;AAEnE;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAuC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAA;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,sBAAsB,CAAA;IACvC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAChC,CAAC"}
|
package/dist/server.d.ts
CHANGED
|
@@ -23,7 +23,7 @@
|
|
|
23
23
|
*/
|
|
24
24
|
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
|
|
25
25
|
import type { FundiToolContext } from "./fundi-client.js";
|
|
26
|
-
export declare const MZIZI_MCP_VERSION = "0.
|
|
26
|
+
export declare const MZIZI_MCP_VERSION = "0.8.0";
|
|
27
27
|
export type CreateServerOptions = {
|
|
28
28
|
fundi?: FundiToolContext;
|
|
29
29
|
/** Override the API base — used by tests and by a preview deployment. */
|
package/dist/server.js
CHANGED
|
@@ -25,7 +25,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
|
|
|
25
25
|
import { MziziApiClient } from "./api-client.js";
|
|
26
26
|
import { registerMziziTools, TOOL_COVERAGE, TOOL_PREFIX } from "./tools.js";
|
|
27
27
|
import { jsonContent } from "./tool-result.js";
|
|
28
|
-
export const MZIZI_MCP_VERSION = "0.
|
|
28
|
+
export const MZIZI_MCP_VERSION = "0.8.0";
|
|
29
29
|
export async function createMziziMcpServer(opts = {}) {
|
|
30
30
|
const server = new McpServer({
|
|
31
31
|
name: "mzizi-mcp",
|