@nyuchi/mzizi-mcp 0.9.0 → 0.10.0

package/dist/worker.d.ts

@@ -1,23 +1,35 @@
 /**
  * Cloudflare Worker entry — mcp.mzizi.dev
  *
- * mzizi-mcp is a free, public tool gated by a WorkOS AuthKit signup. The
- * `@cloudflare/workers-oauth-provider` front makes it a spec-compliant OAuth
- * resource server — it serves `/.well-known/*` metadata + Dynamic Client
- * Registration (`/register`) + `/authorize` + `/token`, which is what lets
- * remote MCP clients (including the claude.ai web "custom connector" flow)
- * complete the handshake and connect.
+ * mzizi-mcp is free, with no gate except Fundi (owner decision, 2026-09-29).
+ * Two fronts share one MCP handler:
  *
- *   apiRoute     "/mcp"  → the MCP itself, behind the access token (mcpApiHandler)
- *   defaultHandler        → WorkOS AuthKit login/consent (AuthkitHandler)
+ *   POST/GET/DELETE /mcp, no Authorization header
+ *       → the free tier. Rate-limited per IP, then the MCP handler with no
+ *         user: every tool except the Fundi ones (`access.ts`).
+ *   everything else, including /mcp WITH a bearer token and /mcp/signin
+ *       → the `@cloudflare/workers-oauth-provider` front, unchanged. It serves
+ *         `/.well-known/*` metadata, Dynamic Client Registration (`/register`),
+ *         `/authorize` and `/token`, validates the token on the API route and
+ *         puts the WorkOS identity on `ctx.props`; the defaultHandler is the
+ *         WorkOS AuthKit login/consent (AuthkitHandler).
  *
- * This is the reusable auth foundation the rest of the Mzizi tooling (the fundi
- * agent, gated collections) sits behind later. Auth here is a FREE signup; any
- * paid/subscription gate (e.g. fundi) is an entitlement check layered on top at
- * the tool level, not a second login.
+ * Why an optional-auth front rather than a second Worker or a flag inside the
+ * provider: the provider is what makes `ctx.props` trustworthy, and it answers
+ * 401 to every tokenless request on its API route. Routing ONLY the tokenless
+ * `/mcp` request around it keeps that guarantee intact: a request that presents
+ * a token is always validated (a bad or expired one still gets the 401 that
+ * makes a client refresh), `ctx.props` is only ever set by the provider, and
+ * the handler learns "is there a user" from whether `ctx.props` is present.
+ *
+ * `/mcp/signin` is the same handler with the provider's 401 left in place, so a
+ * client that wants to sign in has a URL that asks for it (see access.ts).
  */
-import OAuthProvider from "@cloudflare/workers-oauth-provider";
+import type { Env } from "./env.js";
 export type { Env } from "./env.js";
-declare const _default: OAuthProvider<Cloudflare.Env>;
+export { IssueDesk } from "./issue-desk.js";
+declare const _default: {
+    fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response>;
+};
 export default _default;
 //# sourceMappingURL=worker.d.ts.map

package/dist/worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,aAAa,MAAM,oCAAoC,CAAA;AAI9D,YAAY,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;;AAEnC,wBAOE"}
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAInC,YAAY,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAMnC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;;mBAapB,OAAO,OAAO,GAAG,OAAO,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;;AADnF,wBASgC"}

package/dist/worker.js

@@ -1,25 +1,42 @@
 /**
  * Cloudflare Worker entry — mcp.mzizi.dev
  *
- * mzizi-mcp is a free, public tool gated by a WorkOS AuthKit signup. The
- * `@cloudflare/workers-oauth-provider` front makes it a spec-compliant OAuth
- * resource server — it serves `/.well-known/*` metadata + Dynamic Client
- * Registration (`/register`) + `/authorize` + `/token`, which is what lets
- * remote MCP clients (including the claude.ai web "custom connector" flow)
- * complete the handshake and connect.
+ * mzizi-mcp is free, with no gate except Fundi (owner decision, 2026-09-29).
+ * Two fronts share one MCP handler:
  *
- *   apiRoute     "/mcp"  → the MCP itself, behind the access token (mcpApiHandler)
- *   defaultHandler        → WorkOS AuthKit login/consent (AuthkitHandler)
+ *   POST/GET/DELETE /mcp, no Authorization header
+ *       → the free tier. Rate-limited per IP, then the MCP handler with no
+ *         user: every tool except the Fundi ones (`access.ts`).
+ *   everything else, including /mcp WITH a bearer token and /mcp/signin
+ *       → the `@cloudflare/workers-oauth-provider` front, unchanged. It serves
+ *         `/.well-known/*` metadata, Dynamic Client Registration (`/register`),
+ *         `/authorize` and `/token`, validates the token on the API route and
+ *         puts the WorkOS identity on `ctx.props`; the defaultHandler is the
+ *         WorkOS AuthKit login/consent (AuthkitHandler).
  *
- * This is the reusable auth foundation the rest of the Mzizi tooling (the fundi
- * agent, gated collections) sits behind later. Auth here is a FREE signup; any
- * paid/subscription gate (e.g. fundi) is an entitlement check layered on top at
- * the tool level, not a second login.
+ * Why an optional-auth front rather than a second Worker or a flag inside the
+ * provider: the provider is what makes `ctx.props` trustworthy, and it answers
+ * 401 to every tokenless request on its API route. Routing ONLY the tokenless
+ * `/mcp` request around it keeps that guarantee intact: a request that presents
+ * a token is always validated (a bad or expired one still gets the 401 that
+ * makes a client refresh), `ctx.props` is only ever set by the provider, and
+ * the handler learns "is there a user" from whether `ctx.props` is present.
+ *
+ * `/mcp/signin` is the same handler with the provider's 401 left in place, so a
+ * client that wants to sign in has a URL that asks for it (see access.ts).
  */
 import OAuthProvider from "@cloudflare/workers-oauth-provider";
 import { AuthkitHandler } from "./auth/authkit-handler.js";
-import { mcpApiHandler } from "./auth/mcp-api-handler.js";
-export default new OAuthProvider({
+import { mcpApiHandler, serveAnonymous } from "./auth/mcp-api-handler.js";
+import { limitAnonymous } from "./rate-limit.js";
+import { isAnonymousMcpRequest } from "./auth/front.js";
+// The per-user issue desk. Exported here because Cloudflare resolves a Durable
+// Object class off the Worker's entry module, and `wrangler.toml` names this
+// file — an unexported class fails the deploy with "class not found", which
+// reads like a config error and is a missing export.
+export { IssueDesk } from "./issue-desk.js";
+const oauth = new OAuthProvider({
+    // A prefix: it covers `/mcp` and `/mcp/signin`.
     apiRoute: "/mcp",
     apiHandler: mcpApiHandler,
     defaultHandler: AuthkitHandler,
@@ -27,4 +44,15 @@ export default new OAuthProvider({
     tokenEndpoint: "/token",
     clientRegistrationEndpoint: "/register",
 });
+export default {
+    async fetch(request, env, ctx) {
+        if (isAnonymousMcpRequest(request)) {
+            const limited = await limitAnonymous(env.ANON_RATE_LIMIT, request);
+            if (limited)
+                return limited;
+            return serveAnonymous(request, env);
+        }
+        return oauth.fetch(request, env, ctx);
+    },
+};
 //# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,aAAa,MAAM,oCAAoC,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAIzD,eAAe,IAAI,aAAa,CAAC;IAC/B,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,aAAsB;IAClC,cAAc,EAAE,cAAuB;IACvC,iBAAiB,EAAE,YAAY;IAC/B,aAAa,EAAE,QAAQ;IACvB,0BAA0B,EAAE,WAAW;CACxC,CAAC,CAAA"}
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,aAAa,MAAM,oCAAoC,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAIvD,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,qDAAqD;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC;IAC9B,gDAAgD;IAChD,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,aAAsB;IAClC,cAAc,EAAE,cAAuB;IACvC,iBAAiB,EAAE,YAAY;IAC/B,aAAa,EAAE,QAAQ;IACvB,0BAA0B,EAAE,WAAW;CACxC,CAAC,CAAA;AAEF,eAAe;IACb,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAQ,EAAE,GAAqB;QAC3D,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;YAClE,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAC3B,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;CAC6B,CAAA"}

package/package.json

@@ -1,24 +1,22 @@
 {
   "name": "@nyuchi/mzizi-mcp",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "publishConfig": {
     "access": "public"
   },
   "mcpName": "io.github.nyuchi/mzizi-mcp",
-  "description": "Mzizi MCP — Model Context Protocol server for the Mzizi component registry. Reads the document-route store, one component per JSON document.",
+  "description": "Mzizi MCP — Model Context Protocol server for the Mzizi design system: registry, design tokens, doctrine, agent skills and the docs.mzizi.dev docs. Free with no account; sign-in only for the Fundi tools. Registry data and skills are bundled at build time from a pinned registry commit; holds no database credential.",
   "license": "Apache-2.0",
   "homepage": "https://mzizi.dev",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/nyuchi/mzizi-tools.git",
+    "url": "git+https://github.com/mzizi-dev/agent-tools.git",
     "directory": "mzizi-mcp"
   },
   "keywords": [
     "mcp",
     "model-context-protocol",
     "mzizi",
-    "bundu",
-    "supabase",
     "registry"
   ],
   "type": "module",
@@ -43,38 +41,45 @@
   "dependencies": {
     "@cloudflare/workers-oauth-provider": "^0.8.2",
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@supabase/server": "^1.4.1",
-    "@supabase/supabase-js": "^2.110.9",
     "@workos-inc/node": "^9.3.1",
     "hono": "^4.12.32",
     "jose": "^6.2.4",
     "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@cloudflare/vite-plugin": "^1.54.0",
     "@cloudflare/workers-types": "^4.20260702.1",
     "@modelcontextprotocol/inspector": "^2.0.0",
     "@types/node": "^25.9.5",
+    "esbuild": "^0.28.1",
     "typescript": "^6.0.3",
+    "vite": "^7.3.6",
+    "vite-plus": "^0.3.0",
     "vitest": "^3.2.7",
-    "wrangler": "^4.114.0"
+    "wrangler": "^4.126.0"
   },
   "engines": {
     "node": ">=20"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "registry:manifest": "node scripts/inspect-tools.mjs",
-    "registry:check": "node scripts/inspect-tools.mjs --check",
-    "registry:smoke": "node scripts/inspect-tools.mjs --smoke",
+    "build": "pnpm generate && tsc -p tsconfig.json",
+    "build:worker": "pnpm generate && vp build",
+    "cf:deploy": "pnpm generate && vp build && wrangler deploy -c dist-worker/mzizi_mcp/wrangler.json",
+    "cf:dev": "pnpm generate && vp dev",
+    "check": "pnpm generate && vp check --no-fmt",
+    "fmt": "vp fmt",
+    "generate": "node scripts/generate-skills.mjs && node scripts/generate-registry.mjs",
     "inspect": "mcp-inspector --web node dist/stdio.js",
-    "inspect:tui": "mcp-inspector --tui node dist/stdio.js",
     "inspect:cli": "mcp-inspector --cli node dist/stdio.js --method tools/list --format json",
     "inspect:dev": "mcp-inspector --web --server-url http://localhost:8787/mcp --transport http",
-    "wrangler": "wrangler",
-    "cf:dev": "wrangler dev",
-    "cf:deploy": "wrangler deploy"
+    "inspect:tui": "mcp-inspector --tui node dist/stdio.js",
+    "integration": "pnpm generate && node scripts/integration.mjs",
+    "lint": "vp lint",
+    "registry:generate": "node scripts/generate-registry.mjs --force",
+    "skills:generate": "node scripts/generate-skills.mjs",
+    "test": "pnpm generate && vp test",
+    "test:watch": "vp test --watch",
+    "typecheck": "pnpm generate && tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json",
+    "wrangler": "wrangler"
   }
 }

package/dist/api-client.d.ts

@@ -1,101 +0,0 @@
-/**
- * HTTP client for the Mzizi API — the MCP's only data source.
- *
- * The architecture: the Next.js app at mzizi.dev builds the registry from files at
- * build time and serves it over `/api/v1/*`. This MCP is a client of that API. It does
- * NOT talk to Supabase, and it does not hold a database credential, because component
- * documents and doctrine are files in `nyuchi/mzizi` — not rows.
- *
- * What that buys, beyond matching the architecture:
- *
- *   - One source of truth. The API and the MCP answer from the same build, so an agent
- *     over MCP and a consumer over HTTP cannot get different answers.
- *   - No credential. The previous design read `mcp_tool_registry` and dispatched to
- *     Supabase RPCs with an anon key; there is nothing to leak or rotate here.
- *   - The tool surface stops being data. It was built at startup from a table, which
- *     meant a row edit silently changed what the server exposed with no review. The
- *     tools are now code (see `tools.ts`), so a change to them is a diff.
- *
- * Failure policy: every method returns a discriminated result rather than throwing, so
- * a tool can turn an upstream outage into a sentence the caller can act on. An MCP tool
- * that throws an opaque fetch error teaches the agent nothing.
- */
-export declare const DEFAULT_API_BASE = "https://mzizi.dev/api/v1";
-export type ApiOk<T> = {
-    ok: true;
-    data: T;
-};
-export type ApiErr = {
-    ok: false;
-    /** Machine-readable reason, for a tool to branch on. */
-    reason: "not_found" | "timeout" | "network" | "bad_status" | "bad_body";
-    /** A sentence for the caller. Not a status code. */
-    message: string;
-    status?: number;
-};
-export type ApiResult<T> = ApiOk<T> | ApiErr;
-export type MziziApiOptions = {
-    /** Base URL, no trailing slash. Defaults to the public API. */
-    baseUrl?: string;
-    timeoutMs?: number;
-    /** Injectable for tests and for a Worker's bound fetch. */
-    fetchImpl?: typeof fetch;
-};
-export declare class MziziApiClient {
-    private readonly baseUrl;
-    private readonly timeoutMs;
-    private readonly fetchImpl;
-    constructor(opts?: MziziApiOptions);
-    /**
-     * GET a JSON path under the API base.
-     *
-     * `path` is appended verbatim, so every caller must encode its own segments —
-     * a component name arriving from an agent is untrusted input, and an unencoded
-     * `../` would climb out of /api/v1.
-     */
-    get<T>(path: string, query?: Record<string, string | number | undefined>): Promise<ApiResult<T>>;
-    /**
-     * Registry index, filtered and paged SERVER-SIDE.
-     *
-     * The filters used to be applied here, on the response — which could not work, because
-     * the index served only `name`, `description` and `dependencies`. Every `node` / `owner`
-     * filter matched `undefined !== value` on all 573 items and returned zero, for every
-     * value, silently. Filtering upstream also means the 135 KB full index is never
-     * transferred just to select nine rows from it.
-     */
-    listComponents(query?: {
-        node?: number;
-        owner?: string;
-        collection?: string;
-        type?: string;
-        limit?: number;
-        offset?: number;
-    }): Promise<ApiResult<unknown>>;
-    /** One component, shadcn-shaped, with metadata and files. */
-    getComponent(name: string): Promise<ApiResult<unknown>>;
-    /** Per-component docs: use cases, variants, a11y. */
-    getComponentDocs(name: string): Promise<ApiResult<unknown>>;
-    /** Per-component version history. */
-    getComponentVersions(name: string): Promise<ApiResult<unknown>>;
-    /** Cross-resource search — components, docs, changelog. */
-    search(query: string): Promise<ApiResult<unknown>>;
-    /** The DNA double helix: nodes, rungs, strands, live counts. */
-    getArchitecture(): Promise<ApiResult<unknown>>;
-    /** One node. `n` is uncapped — the node set grows, so never bound it here. */
-    getNode(n: number): Promise<ApiResult<unknown>>;
-    /** Brand system: minerals, heritage, typography, spacing, ecosystem. */
-    getBrand(): Promise<ApiResult<unknown>>;
-    getUbuntuPillars(): Promise<ApiResult<unknown>>;
-    getUbuntuPrinciples(): Promise<ApiResult<unknown>>;
-    listAiInstructions(): Promise<ApiResult<unknown>>;
-    getAiInstructions(name: string): Promise<ApiResult<unknown>>;
-    listSkills(): Promise<ApiResult<unknown>>;
-    getSkill(name: string): Promise<ApiResult<unknown>>;
-    listChangelog(): Promise<ApiResult<unknown>>;
-    getRelease(version: string): Promise<ApiResult<unknown>>;
-    /** Live counts + usage metrics. Derived upstream, never a stored number. */
-    getStats(): Promise<ApiResult<unknown>>;
-    /** Service health. */
-    getHealth(): Promise<ApiResult<unknown>>;
-}
-//# sourceMappingURL=api-client.d.ts.map

package/dist/api-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,eAAO,MAAM,gBAAgB,6BAA6B,CAAA;AAK1D,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,CAAA;AAC5C,MAAM,MAAM,MAAM,GAAG;IACnB,EAAE,EAAE,KAAK,CAAA;IACT,wDAAwD;IACxD,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,CAAA;IACvE,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AACD,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;AAE5C,MAAM,MAAM,eAAe,GAAG;IAC5B,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB,CAAA;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;gBAE5B,IAAI,GAAE,eAAoB;IAmBtC;;;;;;OAMG;IACG,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAyEtG;;;;;;;;OAQG;IACH,cAAc,CACZ,KAAK,GAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;KACX;IAKR,6DAA6D;IAC7D,YAAY,CAAC,IAAI,EAAE,MAAM;IAIzB,qDAAqD;IACrD,gBAAgB,CAAC,IAAI,EAAE,MAAM;IAI7B,qCAAqC;IACrC,oBAAoB,CAAC,IAAI,EAAE,MAAM;IAIjC,2DAA2D;IAC3D,MAAM,CAAC,KAAK,EAAE,MAAM;IAIpB,gEAAgE;IAChE,eAAe;IAIf,8EAA8E;IAC9E,OAAO,CAAC,CAAC,EAAE,MAAM;IAIjB,wEAAwE;IACxE,QAAQ;IAIR,gBAAgB;IAIhB,mBAAmB;IAInB,kBAAkB;IAIlB,iBAAiB,CAAC,IAAI,EAAE,MAAM;IAI9B,UAAU;IAIV,QAAQ,CAAC,IAAI,EAAE,MAAM;IAIrB,aAAa;IAIb,UAAU,CAAC,OAAO,EAAE,MAAM;IAI1B,4EAA4E;IAC5E,QAAQ;IAIR,sBAAsB;IACtB,SAAS;CAGV"}

package/dist/api-client.js

@@ -1,200 +0,0 @@
-/**
- * HTTP client for the Mzizi API — the MCP's only data source.
- *
- * The architecture: the Next.js app at mzizi.dev builds the registry from files at
- * build time and serves it over `/api/v1/*`. This MCP is a client of that API. It does
- * NOT talk to Supabase, and it does not hold a database credential, because component
- * documents and doctrine are files in `nyuchi/mzizi` — not rows.
- *
- * What that buys, beyond matching the architecture:
- *
- *   - One source of truth. The API and the MCP answer from the same build, so an agent
- *     over MCP and a consumer over HTTP cannot get different answers.
- *   - No credential. The previous design read `mcp_tool_registry` and dispatched to
- *     Supabase RPCs with an anon key; there is nothing to leak or rotate here.
- *   - The tool surface stops being data. It was built at startup from a table, which
- *     meant a row edit silently changed what the server exposed with no review. The
- *     tools are now code (see `tools.ts`), so a change to them is a diff.
- *
- * Failure policy: every method returns a discriminated result rather than throwing, so
- * a tool can turn an upstream outage into a sentence the caller can act on. An MCP tool
- * that throws an opaque fetch error teaches the agent nothing.
- */
-export const DEFAULT_API_BASE = "https://mzizi.dev/api/v1";
-/** How long any single upstream call may take before it is abandoned. */
-const DEFAULT_TIMEOUT_MS = 10_000;
-export class MziziApiClient {
-    baseUrl;
-    timeoutMs;
-    fetchImpl;
-    constructor(opts = {}) {
-        this.baseUrl = (opts.baseUrl ?? DEFAULT_API_BASE).replace(/\/+$/, "");
-        this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-        // `.bind(globalThis)` is load-bearing, not defensive style.
-        //
-        // Storing the global on an instance and calling it as `this.fetchImpl(...)`
-        // invokes it as a METHOD, so its receiver is the MziziApiClient rather than
-        // the global scope. Workers' `fetch` is a native binding that validates its
-        // receiver and throws:
-        //
-        //   Illegal invocation: function called with incorrect `this` reference
-        //
-        // Node's global fetch tolerates the same call, which is exactly why this
-        // shipped: the offline suite passed on Node while every network-backed tool
-        // on the deployed Worker was dead. An injected `fetchImpl` is a plain
-        // closure and needs no binding, so the tests never touched the broken path.
-        this.fetchImpl = opts.fetchImpl ?? fetch.bind(globalThis);
-    }
-    /**
-     * GET a JSON path under the API base.
-     *
-     * `path` is appended verbatim, so every caller must encode its own segments —
-     * a component name arriving from an agent is untrusted input, and an unencoded
-     * `../` would climb out of /api/v1.
-     */
-    async get(path, query) {
-        let url = `${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
-        if (query) {
-            const qs = new URLSearchParams();
-            for (const [k, v] of Object.entries(query)) {
-                if (v !== undefined && v !== "")
-                    qs.set(k, String(v));
-            }
-            const s = qs.toString();
-            if (s)
-                url += `?${s}`;
-        }
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-        try {
-            const res = await this.fetchImpl(url, {
-                signal: controller.signal,
-                headers: { accept: "application/json" },
-            });
-            if (res.status === 404) {
-                return {
-                    ok: false,
-                    reason: "not_found",
-                    status: 404,
-                    message: `The Mzizi API has no record at ${path}. Check the name — list_components returns the valid set.`,
-                };
-            }
-            if (!res.ok) {
-                // 503 is the API's documented "database not configured" signal. It is worth
-                // distinguishing in words, because it means the deployment is misconfigured
-                // rather than that the caller asked for something wrong.
-                const hint = res.status === 503
-                    ? " The API reports it is not fully configured; this is a deployment problem, not a bad request."
-                    : "";
-                return {
-                    ok: false,
-                    reason: "bad_status",
-                    status: res.status,
-                    message: `The Mzizi API answered ${res.status} for ${path}.${hint}`,
-                };
-            }
-            try {
-                return { ok: true, data: (await res.json()) };
-            }
-            catch {
-                return {
-                    ok: false,
-                    reason: "bad_body",
-                    status: res.status,
-                    message: `The Mzizi API returned a non-JSON body for ${path}. The endpoint may be behind a redirect or an auth gate.`,
-                };
-            }
-        }
-        catch (err) {
-            if (err?.name === "AbortError") {
-                return {
-                    ok: false,
-                    reason: "timeout",
-                    message: `The Mzizi API did not respond within ${this.timeoutMs}ms for ${path}.`,
-                };
-            }
-            return {
-                ok: false,
-                reason: "network",
-                message: `Could not reach the Mzizi API at ${this.baseUrl}: ${err?.message ?? "unknown error"}.`,
-            };
-        }
-        finally {
-            clearTimeout(timer);
-        }
-    }
-    // ── The endpoints the 10 tools are built from ──────────────────────
-    /**
-     * Registry index, filtered and paged SERVER-SIDE.
-     *
-     * The filters used to be applied here, on the response — which could not work, because
-     * the index served only `name`, `description` and `dependencies`. Every `node` / `owner`
-     * filter matched `undefined !== value` on all 573 items and returned zero, for every
-     * value, silently. Filtering upstream also means the 135 KB full index is never
-     * transferred just to select nine rows from it.
-     */
-    listComponents(query = {}) {
-        return this.get("/ui", query);
-    }
-    /** One component, shadcn-shaped, with metadata and files. */
-    getComponent(name) {
-        return this.get(`/ui/${encodeURIComponent(name)}`);
-    }
-    /** Per-component docs: use cases, variants, a11y. */
-    getComponentDocs(name) {
-        return this.get(`/ui/${encodeURIComponent(name)}/docs`);
-    }
-    /** Per-component version history. */
-    getComponentVersions(name) {
-        return this.get(`/ui/${encodeURIComponent(name)}/versions`);
-    }
-    /** Cross-resource search — components, docs, changelog. */
-    search(query) {
-        return this.get("/search", { q: query });
-    }
-    /** The DNA double helix: nodes, rungs, strands, live counts. */
-    getArchitecture() {
-        return this.get("/architecture");
-    }
-    /** One node. `n` is uncapped — the node set grows, so never bound it here. */
-    getNode(n) {
-        return this.get(`/architecture/nodes/${encodeURIComponent(String(n))}`);
-    }
-    /** Brand system: minerals, heritage, typography, spacing, ecosystem. */
-    getBrand() {
-        return this.get("/brand");
-    }
-    getUbuntuPillars() {
-        return this.get("/ubuntu/pillars");
-    }
-    getUbuntuPrinciples() {
-        return this.get("/ubuntu/principles");
-    }
-    listAiInstructions() {
-        return this.get("/ai/instructions");
-    }
-    getAiInstructions(name) {
-        return this.get(`/ai/instructions/${encodeURIComponent(name)}`);
-    }
-    listSkills() {
-        return this.get("/skills");
-    }
-    getSkill(name) {
-        return this.get(`/skills/${encodeURIComponent(name)}`);
-    }
-    listChangelog() {
-        return this.get("/changelog");
-    }
-    getRelease(version) {
-        return this.get(`/changelog/${encodeURIComponent(version)}`);
-    }
-    /** Live counts + usage metrics. Derived upstream, never a stored number. */
-    getStats() {
-        return this.get("/stats");
-    }
-    /** Service health. */
-    getHealth() {
-        return this.get("/health");
-    }
-}
-//# sourceMappingURL=api-client.js.map

package/dist/api-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,0BAA0B,CAAA;AAE1D,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAqBjC,MAAM,OAAO,cAAc;IACR,OAAO,CAAQ;IACf,SAAS,CAAQ;IACjB,SAAS,CAAc;IAExC,YAAY,OAAwB,EAAE;QACpC,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAA;QACrD,4DAA4D;QAC5D,EAAE;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,uBAAuB;QACvB,EAAE;QACF,wEAAwE;QACxE,EAAE;QACF,yEAAyE;QACzE,4EAA4E;QAC5E,sEAAsE;QACtE,4EAA4E;QAC5E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC3D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,KAAmD;QAC5E,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAA;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;YAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;oBAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;YACvD,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAA;YACvB,IAAI,CAAC;gBAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAA;QACvB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBACpC,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAA;YAEF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,kCAAkC,IAAI,2DAA2D;iBAC3G,CAAA;YACH,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,4EAA4E;gBAC5E,4EAA4E;gBAC5E,yDAAyD;gBACzD,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG;oBAChB,CAAC,CAAC,+FAA+F;oBACjG,CAAC,CAAC,EAAE,CAAA;gBACR,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,0BAA0B,GAAG,CAAC,MAAM,QAAQ,IAAI,IAAI,IAAI,EAAE;iBACpE,CAAA;YACH,CAAC;YAED,IAAI,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,EAAE,CAAA;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,UAAU;oBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,8CAA8C,IAAI,0DAA0D;iBACtH,CAAA;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAAa,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1C,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,wCAAwC,IAAI,CAAC,SAAS,UAAU,IAAI,GAAG;iBACjF,CAAA;YACH,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,oCAAoC,IAAI,CAAC,OAAO,KAAM,GAAa,EAAE,OAAO,IAAI,eAAe,GAAG;aAC5G,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED,sEAAsE;IAEtE;;;;;;;;OAQG;IACH,cAAc,CACZ,QAOI,EAAE;QAEN,OAAO,IAAI,CAAC,GAAG,CAAU,KAAK,EAAE,KAAK,CAAC,CAAA;IACxC,CAAC;IAED,6DAA6D;IAC7D,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,GAAG,CAAU,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,qDAAqD;IACrD,gBAAgB,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAU,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAClE,CAAC;IAED,qCAAqC;IACrC,oBAAoB,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAU,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACtE,CAAC;IAED,2DAA2D;IAC3D,MAAM,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,GAAG,CAAU,SAAS,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACnD,CAAC;IAED,gEAAgE;IAChE,eAAe;QACb,OAAO,IAAI,CAAC,GAAG,CAAU,eAAe,CAAC,CAAA;IAC3C,CAAC;IAED,8EAA8E;IAC9E,OAAO,CAAC,CAAS;QACf,OAAO,IAAI,CAAC,GAAG,CAAU,uBAAuB,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,wEAAwE;IACxE,QAAQ;QACN,OAAO,IAAI,CAAC,GAAG,CAAU,QAAQ,CAAC,CAAA;IACpC,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,GAAG,CAAU,iBAAiB,CAAC,CAAA;IAC7C,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,GAAG,CAAU,oBAAoB,CAAC,CAAA;IAChD,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,GAAG,CAAU,kBAAkB,CAAC,CAAA;IAC9C,CAAC;IAED,iBAAiB,CAAC,IAAY;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAU,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,GAAG,CAAU,SAAS,CAAC,CAAA;IACrC,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,GAAG,CAAU,WAAW,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,GAAG,CAAU,YAAY,CAAC,CAAA;IACxC,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,OAAO,IAAI,CAAC,GAAG,CAAU,cAAc,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,4EAA4E;IAC5E,QAAQ;QACN,OAAO,IAAI,CAAC,GAAG,CAAU,QAAQ,CAAC,CAAA;IACpC,CAAC;IAED,sBAAsB;IACtB,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,CAAU,SAAS,CAAC,CAAA;IACrC,CAAC;CACF"}

package/dist/defaults.d.ts

@@ -1,29 +0,0 @@
-/**
- * Public connection defaults for the stdio bin.
- *
- * mzizi-mcp is a FREE, PUBLIC tool. The registry it serves
- * (`component_documents` on the Mzizi Supabase project) is public,
- * read-only, RLS-enforced anon access — exactly the audience Supabase's
- * publishable/anon keys are designed for ("safe to ship in client apps").
- *
- * Baking the project URL + publishable key in as DEFAULTS makes
- * `npx mzizi-mcp` work with zero configuration — which is what a headless
- * agent (Claude Code, a CI job, a local MCP client) needs, since the hosted
- * `mcp.mzizi.dev` endpoint sits behind an interactive, browser-only WorkOS
- * signup gate that a headless session cannot complete.
- *
- * These are NOT secrets:
- *   - the URL is a public project endpoint;
- *   - the publishable key only grants the anon role, which RLS restricts to
- *     read-only SELECT on the public registry tables.
- * There is no service-role key here and no write path.
- *
- * Both are overridable via env (`SUPABASE_URL` / `SUPABASE_PUBLISHABLE_KEY`,
- * or their `NEXT_PUBLIC_` equivalents) for anyone pointing the bin at a
- * fork or a self-hosted mirror. If the publishable key is ever rotated,
- * ship a new release (or set the env var) — the env override always wins.
- */
-export declare const DEFAULT_SUPABASE_URL = "https://grjsboqkaywpwatvrzmy.supabase.co";
-/** Modern publishable key (sb_publishable_…) — anon role, RLS read-only. */
-export declare const DEFAULT_SUPABASE_PUBLISHABLE_KEY = "sb_publishable_90MsojNH3bKYBWIJFb3VpA_O_hbz-wQ";
-//# sourceMappingURL=defaults.d.ts.map

package/dist/defaults.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,eAAO,MAAM,oBAAoB,6CAA6C,CAAA;AAE9E,4EAA4E;AAC5E,eAAO,MAAM,gCAAgC,mDAAmD,CAAA"}

package/dist/defaults.js

@@ -1,29 +0,0 @@
-/**
- * Public connection defaults for the stdio bin.
- *
- * mzizi-mcp is a FREE, PUBLIC tool. The registry it serves
- * (`component_documents` on the Mzizi Supabase project) is public,
- * read-only, RLS-enforced anon access — exactly the audience Supabase's
- * publishable/anon keys are designed for ("safe to ship in client apps").
- *
- * Baking the project URL + publishable key in as DEFAULTS makes
- * `npx mzizi-mcp` work with zero configuration — which is what a headless
- * agent (Claude Code, a CI job, a local MCP client) needs, since the hosted
- * `mcp.mzizi.dev` endpoint sits behind an interactive, browser-only WorkOS
- * signup gate that a headless session cannot complete.
- *
- * These are NOT secrets:
- *   - the URL is a public project endpoint;
- *   - the publishable key only grants the anon role, which RLS restricts to
- *     read-only SELECT on the public registry tables.
- * There is no service-role key here and no write path.
- *
- * Both are overridable via env (`SUPABASE_URL` / `SUPABASE_PUBLISHABLE_KEY`,
- * or their `NEXT_PUBLIC_` equivalents) for anyone pointing the bin at a
- * fork or a self-hosted mirror. If the publishable key is ever rotated,
- * ship a new release (or set the env var) — the env override always wins.
- */
-export const DEFAULT_SUPABASE_URL = "https://grjsboqkaywpwatvrzmy.supabase.co";
-/** Modern publishable key (sb_publishable_…) — anon role, RLS read-only. */
-export const DEFAULT_SUPABASE_PUBLISHABLE_KEY = "sb_publishable_90MsojNH3bKYBWIJFb3VpA_O_hbz-wQ";
-//# sourceMappingURL=defaults.js.map

package/dist/defaults.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,0CAA0C,CAAA;AAE9E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gCAAgC,GAAG,gDAAgD,CAAA"}