@ogygie/mcp 0.10.0 → 0.10.2

package/dist/mcp.js

@@ -823,7 +823,8 @@ function declaredEntries(manifest) {
       name: feature.name,
       status: feature.status,
       folder: owningApp === void 0 ? null : `${owningApp.path}/${feature.folder}`,
-      specId: feature.name
+      specId: feature.name,
+      appType: owningApp?.type ?? null
     });
   }
   for (const productPackage of manifest.packages ?? []) {
@@ -832,7 +833,8 @@ function declaredEntries(manifest) {
       name: productPackage.name,
       status: productPackage.status,
       folder: productPackage.path,
-      specId: productPackage.name
+      specId: productPackage.name,
+      appType: null
     });
   }
   for (const frameworkPackage of manifest.framework?.packages ?? []) {
@@ -842,7 +844,8 @@ function declaredEntries(manifest) {
       status: frameworkPackage.status,
       folder: frameworkPackage.path,
       // A published npm name is not a spec id: the link is DECLARED.
-      specId: frameworkPackage.spec === null ? null : specIdOf(frameworkPackage.spec)
+      specId: frameworkPackage.spec === null ? null : specIdOf(frameworkPackage.spec),
+      appType: null
     });
   }
   return entries;
@@ -1055,6 +1058,7 @@ async function buildReport(deps, entries, target) {
         dependents.set(entry.name, accumulator);
       }
       if (isTest(file.path)) continue;
+      if (entry.appType === "front" || entry.appType === "gateway") continue;
       for (const table of ownedTables) {
         if (!content.includes(`"${table}"`)) continue;
         tableReadersOutsideOwner.push({ table, feature: entry.name, file: filePath });
@@ -1092,7 +1096,7 @@ async function buildReport(deps, entries, target) {
     scope: {
       scannedFolders: scannedFolders.sort(),
       coveredKinds: [...new Set(entries.map((entry) => entry.kind))],
-      outOfReach: [...outOfReach, ...outOfReachOf(target)]
+      outOfReach: [...outOfReach, ...outOfReachOf(target, entries)]
     }
   };
   return ImpactReportSchema.parse(report);
@@ -1105,11 +1109,19 @@ function tablesOf(manifest, featureName) {
   const feature = manifest.features.find((candidate) => candidate.name === featureName);
   return feature === void 0 ? [] : dbTableNamesOf(feature);
 }
-function outOfReachOf(target) {
+function outOfReachOf(target, entries) {
   const limits = [
     "code that no manifest entry declares \u2014 the map is the only chart",
     "anything outside this repo: no network, no npm registry"
   ];
+  const spared = entries.filter(
+    (entry) => entry.appType === "front" || entry.appType === "gateway"
+  );
+  if (spared.length > 0 && target.kind === "feature") {
+    limits.push(
+      `table ownership was NOT checked in ${spared.length} front/gateway entr${spared.length === 1 ? "y" : "ies"} \u2014 that code holds no database client, so a table name there is a query key or a route`
+    );
+  }
   if (target.kind === "framework-package" || target.kind === "package") {
     limits.unshift(
       `consumers of "${target.name}" OUTSIDE this repo \u2014 it is a package, and a published package is imported by projects this analysis cannot see`
@@ -1488,11 +1500,18 @@ function refuse(response, status, error) {
   response.writeHead(status, { "content-type": "application/json" });
   response.end(JSON.stringify(error));
 }
-function isAuthorized(authorization, expected) {
-  if (authorization === void 0) return false;
-  const [scheme, value] = authorization.split(" ");
-  if (scheme?.toLowerCase() !== "bearer" || value === void 0) return false;
-  return tokenMatches(expected, value);
+var SECRET_PATH_PREFIX = "/mcp-";
+function isAuthorized(authorization, expected, requestPath) {
+  if (authorization !== void 0) {
+    const [scheme, value] = authorization.split(" ");
+    if (scheme?.toLowerCase() === "bearer" && value !== void 0) {
+      if (tokenMatches(expected, value)) return true;
+    }
+  }
+  if (requestPath === void 0) return false;
+  const [pathOnly] = requestPath.split("?");
+  if (pathOnly === void 0 || !pathOnly.startsWith(SECRET_PATH_PREFIX)) return false;
+  return tokenMatches(expected, pathOnly.slice(SECRET_PATH_PREFIX.length));
 }
 async function startHttpTransport(createServerInstance, options) {
   const token = assertUsableToken(options.token);
@@ -1507,18 +1526,24 @@ async function startHttpTransport(createServerInstance, options) {
     await transport.handleRequest(request, response, body);
   };
   const httpServer = createServer((request, response) => {
-    if (!isAuthorized(request.headers.authorization, token)) {
-      refuse(
-        response,
-        401,
-        ogygieError({
-          code: "UNAUTHORIZED",
-          message: "This Ogygie MCP server requires a bearer token.",
-          file: null,
-          cause: "missing or wrong Authorization header",
-          suggestedFix: "Send `Authorization: Bearer <OGYGIE_MCP_TOKEN>`."
-        })
-      );
+    if (!isAuthorized(request.headers.authorization, token, request.url)) {
+      const announcedCredential = request.headers.authorization !== void 0;
+      if (announcedCredential) {
+        refuse(
+          response,
+          401,
+          ogygieError({
+            code: "UNAUTHORIZED",
+            message: "This Ogygie MCP server refused the credential it was given.",
+            file: null,
+            cause: "the Authorization header does not carry the expected bearer token",
+            suggestedFix: "Send `Authorization: Bearer <OGYGIE_MCP_TOKEN>`, or address the secret path `/mcp-<OGYGIE_MCP_TOKEN>`."
+          })
+        );
+        return;
+      }
+      response.writeHead(404, { "content-type": "application/json" });
+      response.end(JSON.stringify({ error: "not found" }));
       return;
     }
     const chunks = [];

package/dist/server.js

@@ -818,7 +818,8 @@ function declaredEntries(manifest) {
       name: feature.name,
       status: feature.status,
       folder: owningApp === void 0 ? null : `${owningApp.path}/${feature.folder}`,
-      specId: feature.name
+      specId: feature.name,
+      appType: owningApp?.type ?? null
     });
   }
   for (const productPackage of manifest.packages ?? []) {
@@ -827,7 +828,8 @@ function declaredEntries(manifest) {
       name: productPackage.name,
       status: productPackage.status,
       folder: productPackage.path,
-      specId: productPackage.name
+      specId: productPackage.name,
+      appType: null
     });
   }
   for (const frameworkPackage of manifest.framework?.packages ?? []) {
@@ -837,7 +839,8 @@ function declaredEntries(manifest) {
       status: frameworkPackage.status,
       folder: frameworkPackage.path,
       // A published npm name is not a spec id: the link is DECLARED.
-      specId: frameworkPackage.spec === null ? null : specIdOf(frameworkPackage.spec)
+      specId: frameworkPackage.spec === null ? null : specIdOf(frameworkPackage.spec),
+      appType: null
     });
   }
   return entries;
@@ -1050,6 +1053,7 @@ async function buildReport(deps, entries, target) {
         dependents.set(entry.name, accumulator);
       }
       if (isTest(file.path)) continue;
+      if (entry.appType === "front" || entry.appType === "gateway") continue;
       for (const table of ownedTables) {
         if (!content.includes(`"${table}"`)) continue;
         tableReadersOutsideOwner.push({ table, feature: entry.name, file: filePath });
@@ -1087,7 +1091,7 @@ async function buildReport(deps, entries, target) {
     scope: {
       scannedFolders: scannedFolders.sort(),
       coveredKinds: [...new Set(entries.map((entry) => entry.kind))],
-      outOfReach: [...outOfReach, ...outOfReachOf(target)]
+      outOfReach: [...outOfReach, ...outOfReachOf(target, entries)]
     }
   };
   return ImpactReportSchema.parse(report);
@@ -1100,11 +1104,19 @@ function tablesOf(manifest, featureName) {
   const feature = manifest.features.find((candidate) => candidate.name === featureName);
   return feature === void 0 ? [] : dbTableNamesOf(feature);
 }
-function outOfReachOf(target) {
+function outOfReachOf(target, entries) {
   const limits = [
     "code that no manifest entry declares \u2014 the map is the only chart",
     "anything outside this repo: no network, no npm registry"
   ];
+  const spared = entries.filter(
+    (entry) => entry.appType === "front" || entry.appType === "gateway"
+  );
+  if (spared.length > 0 && target.kind === "feature") {
+    limits.push(
+      `table ownership was NOT checked in ${spared.length} front/gateway entr${spared.length === 1 ? "y" : "ies"} \u2014 that code holds no database client, so a table name there is a query key or a route`
+    );
+  }
   if (target.kind === "framework-package" || target.kind === "package") {
     limits.unshift(
       `consumers of "${target.name}" OUTSIDE this repo \u2014 it is a package, and a published package is imported by projects this analysis cannot see`
@@ -1483,11 +1495,18 @@ function refuse(response, status, error) {
   response.writeHead(status, { "content-type": "application/json" });
   response.end(JSON.stringify(error));
 }
-function isAuthorized(authorization, expected) {
-  if (authorization === void 0) return false;
-  const [scheme, value] = authorization.split(" ");
-  if (scheme?.toLowerCase() !== "bearer" || value === void 0) return false;
-  return tokenMatches(expected, value);
+var SECRET_PATH_PREFIX = "/mcp-";
+function isAuthorized(authorization, expected, requestPath) {
+  if (authorization !== void 0) {
+    const [scheme, value] = authorization.split(" ");
+    if (scheme?.toLowerCase() === "bearer" && value !== void 0) {
+      if (tokenMatches(expected, value)) return true;
+    }
+  }
+  if (requestPath === void 0) return false;
+  const [pathOnly] = requestPath.split("?");
+  if (pathOnly === void 0 || !pathOnly.startsWith(SECRET_PATH_PREFIX)) return false;
+  return tokenMatches(expected, pathOnly.slice(SECRET_PATH_PREFIX.length));
 }
 async function startHttpTransport(createServerInstance, options) {
   const token = assertUsableToken(options.token);
@@ -1502,18 +1521,24 @@ async function startHttpTransport(createServerInstance, options) {
     await transport.handleRequest(request, response, body);
   };
   const httpServer = createServer((request, response) => {
-    if (!isAuthorized(request.headers.authorization, token)) {
-      refuse(
-        response,
-        401,
-        ogygieError({
-          code: "UNAUTHORIZED",
-          message: "This Ogygie MCP server requires a bearer token.",
-          file: null,
-          cause: "missing or wrong Authorization header",
-          suggestedFix: "Send `Authorization: Bearer <OGYGIE_MCP_TOKEN>`."
-        })
-      );
+    if (!isAuthorized(request.headers.authorization, token, request.url)) {
+      const announcedCredential = request.headers.authorization !== void 0;
+      if (announcedCredential) {
+        refuse(
+          response,
+          401,
+          ogygieError({
+            code: "UNAUTHORIZED",
+            message: "This Ogygie MCP server refused the credential it was given.",
+            file: null,
+            cause: "the Authorization header does not carry the expected bearer token",
+            suggestedFix: "Send `Authorization: Bearer <OGYGIE_MCP_TOKEN>`, or address the secret path `/mcp-<OGYGIE_MCP_TOKEN>`."
+          })
+        );
+        return;
+      }
+      response.writeHead(404, { "content-type": "application/json" });
+      response.end(JSON.stringify({ error: "not found" }));
       return;
     }
     const chunks = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ogygie/mcp",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "Ogygie MCP server: read-only access to the governance files and features of any Ogygie repo, the manifest as index. Ships built; runnable standalone or through `ogygie mcp`.",
   "license": "MIT",
   "type": "module",
@@ -28,7 +28,7 @@
     "tsx": "^4.20.0",
     "typescript": "^5.8.0",
     "vitest": "^3.2.0",
-    "@ogygie/core": "0.10.0"
+    "@ogygie/core": "0.10.2"
   },
   "scripts": {
     "typecheck": "tsc -p tsconfig.json",