@oneentry/mcp-platform-server 0.1.0

package/dist/tools/api-discovery.js

@@ -0,0 +1,80 @@
+import { z } from 'zod';
+import { errorResult, jsonResult } from './result.js';
+/** Регистрирует `cms_api_search` и `cms_api_describe`. */
+export const registerApiDiscovery = (server, deps) => {
+    const { catalog } = deps;
+    server.registerTool('cms_api_search', {
+        title: 'Search Admin API operations',
+        description: 'Find Admin API operations by keyword, tag, HTTP method or mutating/non-mutating. Returns operation ids to pass to cms_api_describe. This is the only authority on which endpoints exist.',
+        inputSchema: {
+            query: z.string().describe('Keywords: entity, path fragment, or action ("menu position", "orders refund").'),
+            tag: z.string().optional().describe('Restrict to one tag, e.g. "Orders".'),
+            method: z.enum(['get', 'post', 'put', 'patch', 'delete']).optional(),
+            mutating: z.boolean().optional().describe('true = only writes/deletes, false = only reads.'),
+            limit: z.number().int().min(1).max(50).optional().describe('Maximum hits, default 15.'),
+        },
+        annotations: { readOnlyHint: true, openWorldHint: false },
+    }, ({ query, tag, method, mutating, limit }) => {
+        const hits = catalog.search({
+            query,
+            ...(tag ? { tag } : {}),
+            ...(method ? { method } : {}),
+            ...(mutating !== undefined ? { mutating } : {}),
+            ...(limit ? { limit } : {}),
+        });
+        if (hits.length === 0) {
+            return jsonResult({
+                hits: [],
+                tags: [...new Set(catalog.operations().map((o) => o.tag))].sort(),
+                hint: 'Nothing matched. Try a bare entity name, or filter by one of the tags listed here.',
+            });
+        }
+        return jsonResult({
+            hits,
+            next: 'Get the payload shape with cms_api_describe { opId }.',
+        });
+    });
+    server.registerTool('cms_api_describe', {
+        title: 'Describe an Admin API operation',
+        description: 'Full detail for one operation: path and query parameters, request-body schema, required permission, risk level, and the knowledge sections that explain the payload. Fields marked "x-loose": true have a TypeScript-shaped type in the source swagger — trust their example, not their type.',
+        inputSchema: {
+            opId: z.string().min(1).describe('Operation id from cms_api_search, e.g. "AdminPagesController_findAllRoot".'),
+        },
+        annotations: { readOnlyHint: true, openWorldHint: false },
+    }, ({ opId }) => {
+        const operation = catalog.get(opId);
+        if (!operation) {
+            return errorResult(`Unknown opId "${opId}".`, {
+                didYouMean: catalog.suggest(opId),
+                hint: 'Operation ids come from cms_api_search — do not construct them by hand.',
+            });
+        }
+        const loose = [
+            ...(operation.body?.schema.properties
+                ? Object.entries(operation.body.schema.properties)
+                    .filter(([, schema]) => schema['x-loose'] === true)
+                    .map(([name, schema]) => ({ field: name, sourceType: schema['x-source-type'] }))
+                : []),
+        ];
+        return jsonResult({
+            opId: operation.opId,
+            method: operation.method.toUpperCase(),
+            path: operation.path,
+            fullPath: operation.fullPath,
+            tag: operation.tag,
+            summary: operation.summary,
+            permission: operation.permission ?? null,
+            risk: operation.risk,
+            alwaysConfirm: operation.alwaysConfirm,
+            params: operation.params,
+            body: operation.body ?? null,
+            looseFields: loose,
+            responseSummary: operation.responseSummary ?? null,
+            docs: operation.docLinks,
+            next: operation.risk === 'read'
+                ? 'Call it with cms_api_call { opId, path, query }.'
+                : 'Read the linked docs, then call cms_api_call with dryRun: true first.',
+        });
+    });
+};
+//# sourceMappingURL=api-discovery.js.map

package/dist/tools/api-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-discovery.js","sourceRoot":"","sources":["../../src/tools/api-discovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAiB,EAAE,IAAgB,EAAQ,EAAE;IAChF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAEzB,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,0LAA0L;QAC5L,WAAW,EAAE;YACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;YAC5G,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YAC1E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;YACpE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;YAC5F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;SACxF;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KAC1D,EACD,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;YAC1B,KAAK;YACL,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,UAAU,CAAC;gBAChB,IAAI,EAAE,EAAE;gBACR,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBACjE,IAAI,EAAE,oFAAoF;aAC3F,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC;YAChB,IAAI;YACJ,IAAI,EAAE,uDAAuD;SAC9D,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,+RAA+R;QACjS,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4EAA4E,CAAC;SAC/G;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KAC1D,EACD,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QACX,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,iBAAiB,IAAI,IAAI,EAAE;gBAC5C,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;gBACjC,IAAI,EAAE,yEAAyE;aAChF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG;YACZ,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU;gBACnC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;qBAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;qBAClD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;gBACpF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QAEF,OAAO,UAAU,CAAC;YAChB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE;YACtC,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,IAAI;YACxC,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,IAAI;YAC5B,WAAW,EAAE,KAAK;YAClB,eAAe,EAAE,SAAS,CAAC,eAAe,IAAI,IAAI;YAClD,IAAI,EAAE,SAAS,CAAC,QAAQ;YACxB,IAAI,EACF,SAAS,CAAC,IAAI,KAAK,MAAM;gBACvB,CAAC,CAAC,kDAAkD;gBACpD,CAAC,CAAC,uEAAuE;SAC9E,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/tools/docs.d.ts

@@ -0,0 +1,5 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { SharedDeps } from '../session.js';
+/** Регистрирует `cms_docs_search` и `cms_docs_read`. */
+export declare const registerDocs: (server: McpServer, deps: SharedDeps) => void;
+//# sourceMappingURL=docs.d.ts.map

package/dist/tools/docs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/tools/docs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAMhD,wDAAwD;AACxD,eAAO,MAAM,YAAY,GAAI,QAAQ,SAAS,EAAE,MAAM,UAAU,KAAG,IA0IlE,CAAC"}

package/dist/tools/docs.js

@@ -0,0 +1,113 @@
+import { z } from 'zod';
+import { errorResult, jsonResult } from './result.js';
+/** Предел размера одного раздела, отдаваемого модели. */
+const MAX_SECTION_BYTES = 12_288;
+/** Регистрирует `cms_docs_search` и `cms_docs_read`. */
+export const registerDocs = (server, deps) => {
+    const { knowledge } = deps;
+    server.registerTool('cms_docs_search', {
+        title: 'Search CMS knowledge',
+        description: 'Search the project knowledge base (module reference docs, e2e conventions, code style, shipped-fix write-ups, and this server\'s operating rules) and return matching sections with snippets. Use before writing any payload.',
+        inputSchema: {
+            query: z.string().min(2).describe('Natural-language query; Russian and English both work.'),
+            limit: z.number().int().min(1).max(20).optional().describe('Maximum hits, default 8.'),
+        },
+        annotations: { readOnlyHint: true, openWorldHint: false },
+    }, ({ query, limit }) => {
+        const hits = knowledge.search(query, limit ?? 8);
+        if (hits.length === 0) {
+            return jsonResult({
+                hits: [],
+                hint: 'Nothing matched. Try a module name (menus, orders, blocks, attributes) or an entity field name.',
+            });
+        }
+        return jsonResult({
+            hits: hits.map((hit) => ({
+                docId: hit.docId,
+                anchor: hit.anchor,
+                title: hit.title,
+                doc: hit.docTitle,
+                score: hit.score,
+                snippet: hit.snippet,
+            })),
+            next: 'Read a hit with cms_docs_read { docId, anchor }.',
+        });
+    });
+    server.registerTool('cms_docs_read', {
+        title: 'Read a CMS knowledge section',
+        description: 'Read one section of a knowledge document. Omit the anchor to get the document preamble plus its section list, then page through the sections you need.',
+        inputSchema: {
+            docId: z.string().min(1).describe('Document id, e.g. "back/docs/menus-module" or "mcp/operating-rules".'),
+            anchor: z.string().optional().describe('Section anchor from cms_docs_search; omit for the preamble.'),
+        },
+        annotations: { readOnlyHint: true, openWorldHint: false },
+    }, ({ docId, anchor }) => {
+        const doc = knowledge.doc(docId);
+        if (!doc) {
+            const candidates = knowledge
+                .docs()
+                .filter((d) => d.docId.includes(docId) || docId.includes(d.docId.split('/').pop() ?? ''))
+                .slice(0, 8)
+                .map((d) => d.docId);
+            return errorResult(`Unknown docId "${docId}".`, {
+                candidates,
+                hint: 'Use cms_docs_search to get a valid docId.',
+            });
+        }
+        const chunk = knowledge.chunk(`${docId}#${anchor ?? ''}`);
+        if (!chunk) {
+            return errorResult(`Document "${docId}" has no section "${anchor ?? ''}".`, {
+                anchors: doc.anchors.map((a) => a.anchor),
+            });
+        }
+        const text = Buffer.byteLength(chunk.text, 'utf8') > MAX_SECTION_BYTES
+            ? `${chunk.text.slice(0, MAX_SECTION_BYTES)}\n\n…[section truncated]`
+            : chunk.text;
+        return jsonResult({
+            docId,
+            anchor: chunk.anchor,
+            title: chunk.title,
+            doc: doc.title,
+            sourcePath: `${chunk.repo}:${chunk.path}`,
+            text,
+            sections: doc.anchors.map((a) => ({ anchor: a.anchor, title: a.title, bytes: a.bytes })),
+        });
+    });
+    /** Ресурсы дублируют два самых нужных документа, чтобы клиент мог их закрепить. */
+    server.registerResource('operating-rules', 'oneentry://knowledge/mcp/operating-rules', {
+        title: 'OneEntry CMS operating rules',
+        description: 'The payload and safety rules an agent must follow before writing to this CMS.',
+        mimeType: 'text/markdown',
+    }, () => {
+        const sections = knowledge
+            .pack.chunks.filter((chunk) => chunk.docId === 'mcp/operating-rules')
+            .map((chunk) => (chunk.title && chunk.anchor ? `## ${chunk.title}\n\n${chunk.text}` : chunk.text));
+        return {
+            contents: [
+                {
+                    uri: 'oneentry://knowledge/mcp/operating-rules',
+                    mimeType: 'text/markdown',
+                    text: sections.join('\n\n'),
+                },
+            ],
+        };
+    });
+    server.registerResource('knowledge-index', 'oneentry://knowledge/index', {
+        title: 'OneEntry CMS knowledge index',
+        description: 'Every available knowledge document with its sections.',
+        mimeType: 'application/json',
+    }, () => ({
+        contents: [
+            {
+                uri: 'oneentry://knowledge/index',
+                mimeType: 'application/json',
+                text: JSON.stringify(knowledge.docs().map((doc) => ({
+                    docId: doc.docId,
+                    title: doc.title,
+                    sections: doc.anchors.length,
+                })), null, 2),
+            },
+        ],
+    }));
+};
+//# sourceMappingURL=docs.js.map

package/dist/tools/docs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs.js","sourceRoot":"","sources":["../../src/tools/docs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,yDAAyD;AACzD,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,wDAAwD;AACxD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAiB,EAAE,IAAgB,EAAQ,EAAE;IACxE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAE3B,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,+NAA+N;QACjO,WAAW,EAAE;YACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wDAAwD,CAAC;YAC3F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;SACvF;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KAC1D,EACD,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;QACnB,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,UAAU,CAAC;gBAChB,IAAI,EAAE,EAAE;gBACR,IAAI,EAAE,iGAAiG;aACxG,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC;YAChB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACvB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,GAAG,EAAE,GAAG,CAAC,QAAQ;gBACjB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC,CAAC;YACH,IAAI,EAAE,kDAAkD;SACzD,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,wJAAwJ;QAC1J,WAAW,EAAE;YACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sEAAsE,CAAC;YACzG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;SACtG;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KAC1D,EACD,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;QACpB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,UAAU,GAAG,SAAS;iBACzB,IAAI,EAAE;iBACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;iBACxF,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACvB,OAAO,WAAW,CAAC,kBAAkB,KAAK,IAAI,EAAE;gBAC9C,UAAU;gBACV,IAAI,EAAE,2CAA2C;aAClD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,WAAW,CAAC,aAAa,KAAK,qBAAqB,MAAM,IAAI,EAAE,IAAI,EAAE;gBAC1E,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GACR,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,iBAAiB;YACvD,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,0BAA0B;YACrE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAEjB,OAAO,UAAU,CAAC;YAChB,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,GAAG,CAAC,KAAK;YACd,UAAU,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;YACzC,IAAI;YACJ,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;SACzF,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,mFAAmF;IACnF,MAAM,CAAC,gBAAgB,CACrB,iBAAiB,EACjB,0CAA0C,EAC1C;QACE,KAAK,EAAE,8BAA8B;QACrC,WAAW,EAAE,+EAA+E;QAC5F,QAAQ,EAAE,eAAe;KAC1B,EACD,GAAG,EAAE;QACH,MAAM,QAAQ,GAAG,SAAS;aACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,qBAAqB,CAAC;aACpE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrG,OAAO;YACL,QAAQ,EAAE;gBACR;oBACE,GAAG,EAAE,0CAA0C;oBAC/C,QAAQ,EAAE,eAAe;oBACzB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;iBAC5B;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,gBAAgB,CACrB,iBAAiB,EACjB,4BAA4B,EAC5B;QACE,KAAK,EAAE,8BAA8B;QACrC,WAAW,EAAE,uDAAuD;QACpE,QAAQ,EAAE,kBAAkB;KAC7B,EACD,GAAG,EAAE,CAAC,CAAC;QACL,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,4BAA4B;gBACjC,QAAQ,EAAE,kBAAkB;gBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;iBAC7B,CAAC,CAAC,EACH,IAAI,EACJ,CAAC,CACF;aACF;SACF;KACF,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/tools/guide.d.ts

@@ -0,0 +1,11 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { SharedDeps } from '../session.js';
+/**
+ * Собирает краткое руководство: режим, политика, карта тегов и порядок работы.
+ * Генерируется, а не хранится текстом, потому что половина содержимого —
+ * фактическое состояние сервера, и расхождение здесь дороже дублирования.
+ */
+export declare const renderGuide: (deps: SharedDeps) => string;
+/** Регистрирует `cms_guide`. */
+export declare const registerGuide: (server: McpServer, deps: SharedDeps) => void;
+//# sourceMappingURL=guide.d.ts.map

package/dist/tools/guide.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guide.d.ts","sourceRoot":"","sources":["../../src/tools/guide.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAMhD;;;;GAIG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,UAAU,KAAG,MAoD9C,CAAC;AAEF,gCAAgC;AAChC,eAAO,MAAM,aAAa,GAAI,QAAQ,SAAS,EAAE,MAAM,UAAU,KAAG,IAWnE,CAAC"}

package/dist/tools/guide.js

@@ -0,0 +1,67 @@
+import { textResult } from './result.js';
+/** Сколько тегов показывать в карте API. */
+const TAG_LIMIT = 24;
+/**
+ * Собирает краткое руководство: режим, политика, карта тегов и порядок работы.
+ * Генерируется, а не хранится текстом, потому что половина содержимого —
+ * фактическое состояние сервера, и расхождение здесь дороже дублирования.
+ */
+export const renderGuide = (deps) => {
+    const { config, catalog, knowledge } = deps;
+    const counts = new Map();
+    for (const operation of catalog.operations()) {
+        counts.set(operation.tag, (counts.get(operation.tag) ?? 0) + 1);
+    }
+    const tags = [...counts.entries()]
+        .sort((a, b) => b[1] - a[1])
+        .slice(0, TAG_LIMIT)
+        .map(([tag, count]) => `${tag} (${String(count)})`)
+        .join(', ');
+    const allowLine = config.allow === 'read'
+        ? 'read-only — every POST/PUT/PATCH/DELETE is refused locally, without a request being sent'
+        : config.allow === 'write'
+            ? 'writes allowed; DELETE and the permanently gated paths still need a confirm token'
+            : 'writes and deletes allowed; deletes and the permanently gated paths still need a confirm token';
+    return [
+        '# OneEntry CMS Admin API — agent guide',
+        '',
+        `Mode: **${config.mode}** · Base URL: \`${config.baseUrl}\` · Policy: ${allowLine}.`,
+        `Catalog: ${String(catalog.operations().length)} operations (swagger ${catalog.catalog.swaggerHash}).`,
+        `Knowledge: ${String(knowledge.docs().length)} docs / ${String(knowledge.pack.chunks.length)} sections, source ${knowledge.pack.source}.`,
+        '',
+        '## How to work here',
+        '',
+        '1. `cms_docs_read` → `mcp/operating-rules` — **read it before your first write.** It carries the',
+        '   payload rules (locale-keyed `localizeInfos`, attribute-set-driven `attributesSets`,',
+        '   lexorank vs numeric `position`, eventual consistency) that make the difference between',
+        '   a 400 and a correct call.',
+        '2. `cms_docs_search` — find the reference doc for the entity you are touching.',
+        '3. `cms_api_search` → `cms_api_describe` — get the real operation and its payload shape.',
+        '4. `cms_api_call` — `dryRun: true` first for anything that mutates.',
+        '',
+        'Never invent a path: `cms_api_search` is the only authority on what exists.',
+        '',
+        '## API map (tag → operations)',
+        '',
+        tags,
+        '',
+        '## Hard limits',
+        '',
+        '- Admin API only. The Content and Developer APIs are deliberately not exposed.',
+        '- `immutable-settings`, `admins`, `backups`, `modules`, `payments/webhook`, `settings-general`,',
+        '  `system/captcha-keys` and `auth/logout/all-users` are permanently confirm-gated.',
+        '- Responses are capped; overflow is reported as `_truncated`. Narrow the query instead.',
+        ...(catalog.catalog.warnings.length > 0
+            ? ['', '## Warnings', '', ...catalog.catalog.warnings.map((w) => `- ${w}`)]
+            : []),
+    ].join('\n');
+};
+/** Регистрирует `cms_guide`. */
+export const registerGuide = (server, deps) => {
+    server.registerTool('cms_guide', {
+        title: 'CMS guide',
+        description: 'Read this first. What this server exposes, the current mode and write policy, the API map, and the order in which to use the other tools.',
+        annotations: { readOnlyHint: true, openWorldHint: false },
+    }, () => textResult(renderGuide(deps)));
+};
+//# sourceMappingURL=guide.js.map

package/dist/tools/guide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guide.js","sourceRoot":"","sources":["../../src/tools/guide.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,4CAA4C;AAC5C,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAgB,EAAU,EAAE;IACtD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3B,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;SACnB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;SAClD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,SAAS,GACb,MAAM,CAAC,KAAK,KAAK,MAAM;QACrB,CAAC,CAAC,0FAA0F;QAC5F,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO;YACxB,CAAC,CAAC,mFAAmF;YACrF,CAAC,CAAC,gGAAgG,CAAC;IAEzG,OAAO;QACL,wCAAwC;QACxC,EAAE;QACF,WAAW,MAAM,CAAC,IAAI,oBAAoB,MAAM,CAAC,OAAO,gBAAgB,SAAS,GAAG;QACpF,YAAY,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,wBAAwB,OAAO,CAAC,OAAO,CAAC,WAAW,IAAI;QACtG,cAAc,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG;QACzI,EAAE;QACF,qBAAqB;QACrB,EAAE;QACF,kGAAkG;QAClG,wFAAwF;QACxF,2FAA2F;QAC3F,8BAA8B;QAC9B,gFAAgF;QAChF,0FAA0F;QAC1F,qEAAqE;QACrE,EAAE;QACF,6EAA6E;QAC7E,EAAE;QACF,+BAA+B;QAC/B,EAAE;QACF,IAAI;QACJ,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,gFAAgF;QAChF,iGAAiG;QACjG,oFAAoF;QACpF,yFAAyF;QACzF,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACrC,CAAC,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC,CAAC;AAEF,gCAAgC;AAChC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAiB,EAAE,IAAgB,EAAQ,EAAE;IACzE,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,KAAK,EAAE,WAAW;QAClB,WAAW,EACT,2IAA2I;QAC7I,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KAC1D,EACD,GAAG,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CACpC,CAAC;AACJ,CAAC,CAAC"}

package/dist/tools/result.d.ts

@@ -0,0 +1,19 @@
+/** Форма результата вызова инструмента MCP. */
+export interface ToolResult {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+    [key: string]: unknown;
+}
+/** Успешный результат-JSON. */
+export declare const jsonResult: (payload: unknown) => ToolResult;
+/** Успешный результат-текст (для человекочитаемых руководств). */
+export declare const textResult: (text: string) => ToolResult;
+/**
+ * Ошибка инструмента. Возвращаем её как isError, а не бросаем исключение:
+ * модель должна увидеть текст и исправиться, а не получить обрыв сессии.
+ */
+export declare const errorResult: (message: string, extra?: Record<string, unknown>) => ToolResult;
+//# sourceMappingURL=result.d.ts.map

package/dist/tools/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../src/tools/result.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,+BAA+B;AAC/B,eAAO,MAAM,UAAU,GAAI,SAAS,OAAO,KAAG,UAE5C,CAAC;AAEH,kEAAkE;AAClE,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,UAExC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,MAAM,EAAE,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,UAK7E,CAAC"}

package/dist/tools/result.js

@@ -0,0 +1,19 @@
+/** Успешный результат-JSON. */
+export const jsonResult = (payload) => ({
+    content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }],
+});
+/** Успешный результат-текст (для человекочитаемых руководств). */
+export const textResult = (text) => ({
+    content: [{ type: 'text', text }],
+});
+/**
+ * Ошибка инструмента. Возвращаем её как isError, а не бросаем исключение:
+ * модель должна увидеть текст и исправиться, а не получить обрыв сессии.
+ */
+export const errorResult = (message, extra) => ({
+    content: [
+        { type: 'text', text: JSON.stringify({ error: message, ...(extra ?? {}) }, null, 2) },
+    ],
+    isError: true,
+});
+//# sourceMappingURL=result.js.map

package/dist/tools/result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.js","sourceRoot":"","sources":["../../src/tools/result.ts"],"names":[],"mappings":"AAOA,+BAA+B;AAC/B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAc,EAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;CACpE,CAAC,CAAC;AAEH,kEAAkE;AAClE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC;IACvD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;CAClC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,KAA+B,EAAc,EAAE,CAAC,CAAC;IAC5F,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;KACtF;IACD,OAAO,EAAE,IAAI;CACd,CAAC,CAAC"}

package/dist/tools/whoami.d.ts

@@ -0,0 +1,5 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Session } from '../session.js';
+/** Регистрирует `cms_whoami` — состояние сервера и подключённого админа. */
+export declare const registerWhoami: (server: McpServer, getSession: () => Session) => void;
+//# sourceMappingURL=whoami.d.ts.map

package/dist/tools/whoami.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../src/tools/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAG7C,4EAA4E;AAC5E,eAAO,MAAM,cAAc,GAAI,QAAQ,SAAS,EAAE,YAAY,MAAM,OAAO,KAAG,IA4C7E,CAAC"}

package/dist/tools/whoami.js

@@ -0,0 +1,42 @@
+import { jsonResult } from './result.js';
+/** Регистрирует `cms_whoami` — состояние сервера и подключённого админа. */
+export const registerWhoami = (server, getSession) => {
+    server.registerTool('cms_whoami', {
+        title: 'Who am I',
+        description: 'Current mode, Admin API base URL, write policy, the authenticated admin and its permissions, and the versions of the bundled catalog and knowledge pack.',
+        annotations: { readOnlyHint: true, openWorldHint: true },
+    }, async () => {
+        const session = getSession();
+        const { config, catalog, knowledge } = session.shared;
+        const identity = await session.identity();
+        return jsonResult({
+            mode: config.mode,
+            baseUrl: config.baseUrl,
+            allow: config.allow,
+            authenticated: identity !== undefined,
+            ...(identity
+                ? { admin: { id: identity.id, permissionCount: identity.permissions.length, permissions: identity.permissions } }
+                : {
+                    admin: null,
+                    hint: session.isConfigured
+                        ? 'Credentials are configured but authentication failed — check ONEENTRY_CMS_LOGIN / ONEENTRY_CMS_PASSWORD and that the stand is reachable.'
+                        : 'No credentials configured. Set ONEENTRY_CMS_LOGIN + ONEENTRY_CMS_PASSWORD (or ONEENTRY_CMS_TOKEN).',
+                }),
+            catalog: {
+                operations: catalog.operations().length,
+                swaggerHash: catalog.catalog.swaggerHash,
+                builtAt: catalog.catalog.builtAt,
+                knownPermissions: catalog.catalog.permissions.length,
+                warnings: catalog.catalog.warnings,
+            },
+            knowledge: {
+                source: knowledge.pack.source,
+                builtAt: knowledge.pack.builtAt,
+                docs: knowledge.docs().length,
+                sections: knowledge.pack.chunks.length,
+            },
+            audit: config.auditPath ?? null,
+        });
+    });
+};
+//# sourceMappingURL=whoami.js.map

package/dist/tools/whoami.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/tools/whoami.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAiB,EAAE,UAAyB,EAAQ,EAAE;IACnF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,UAAU;QACjB,WAAW,EACT,0JAA0J;QAC5J,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;KACzD,EACD,KAAK,IAAI,EAAE;QACT,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAE1C,OAAO,UAAU,CAAC;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,aAAa,EAAE,QAAQ,KAAK,SAAS;YACrC,GAAG,CAAC,QAAQ;gBACV,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE;gBACjH,CAAC,CAAC;oBACE,KAAK,EAAE,IAAI;oBACX,IAAI,EAAE,OAAO,CAAC,YAAY;wBACxB,CAAC,CAAC,0IAA0I;wBAC5I,CAAC,CAAC,oGAAoG;iBACzG,CAAC;YACN,OAAO,EAAE;gBACP,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM;gBACvC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;gBACxC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;gBAChC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM;gBACpD,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;aACnC;YACD,SAAS,EAAE;gBACT,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM;gBAC7B,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO;gBAC/B,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM;gBAC7B,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;aACvC;YACD,KAAK,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;SAChC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/transports/http.d.ts

@@ -0,0 +1,10 @@
+import type { Config } from '../config/config.js';
+/**
+ * Запускает сервер поверх Streamable HTTP — remote-режим.
+ * На каждое MCP-подключение создаётся своя `Session` со своими токенами
+ * и своими подтверждениями; общий каталог и знания строятся один раз.
+ */
+export declare const runHttp: (config: Config) => Promise<{
+    close: () => Promise<void>;
+}>;
+//# sourceMappingURL=http.d.ts.map

package/dist/transports/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transports/http.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AA6DlD;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAAU,QAAQ,MAAM,KAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAiFpF,CAAC"}

package/dist/transports/http.js

@@ -0,0 +1,126 @@
+import { randomUUID } from 'node:crypto';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import express from 'express';
+import { createServer, createSharedDeps } from '../server.js';
+import { Session } from '../session.js';
+/** Заголовки, которыми клиент передаёт свои учётные данные CMS. */
+const HEADER_TOKEN = 'x-cms-token';
+const HEADER_LOGIN = 'x-cms-login';
+const HEADER_PASSWORD = 'x-cms-password';
+const headerValue = (request, name) => {
+    const raw = request.headers[name];
+    const value = Array.isArray(raw) ? raw[0] : raw;
+    return typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined;
+};
+/**
+ * Читает учётные данные сессии из заголовков подключения.
+ * Только отсюда и из конфигурации сервера — никогда из аргументов инструмента:
+ * иначе внедрённая в текст инструкция могла бы подменить личность.
+ */
+const credentialsFromRequest = (request) => {
+    const token = headerValue(request, HEADER_TOKEN);
+    if (token) {
+        return { token };
+    }
+    const login = headerValue(request, HEADER_LOGIN);
+    const password = headerValue(request, HEADER_PASSWORD);
+    if (login && password) {
+        return { login, password };
+    }
+    return undefined;
+};
+/**
+ * Проверка Origin. Транспорт SDK умеет это сам, но помечает как deprecated
+ * в пользу внешней middleware — делаем внешнюю.
+ */
+const originGuard = (allowedOrigins) => (request, response, next) => {
+    const origin = headerValue(request, 'origin');
+    if (!origin) {
+        next();
+        return;
+    }
+    if (allowedOrigins.includes(origin)) {
+        next();
+        return;
+    }
+    response.status(403).json({
+        error: `Origin "${origin}" is not allowed. Start the server with --allowed-origins to permit it.`,
+    });
+};
+/**
+ * Запускает сервер поверх Streamable HTTP — remote-режим.
+ * На каждое MCP-подключение создаётся своя `Session` со своими токенами
+ * и своими подтверждениями; общий каталог и знания строятся один раз.
+ */
+export const runHttp = async (config) => {
+    const deps = createSharedDeps(config);
+    const sessions = new Map();
+    const app = express();
+    app.use(express.json({ limit: '4mb' }));
+    app.use(originGuard(config.http.allowedOrigins));
+    app.get('/health', (_request, response) => {
+        response.json({ ok: true, mode: config.mode, sessions: sessions.size });
+    });
+    app.post('/mcp', async (request, response) => {
+        const sessionId = headerValue(request, 'mcp-session-id');
+        const existing = sessionId ? sessions.get(sessionId) : undefined;
+        if (existing) {
+            await existing.transport.handleRequest(request, response, request.body);
+            return;
+        }
+        if (sessionId || !isInitializeRequest(request.body)) {
+            response.status(400).json({
+                error: 'Unknown or missing MCP session. Send an initialize request first.',
+            });
+            return;
+        }
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: () => randomUUID(),
+            onsessioninitialized: (id) => {
+                sessions.set(id, { transport, session });
+            },
+            onsessionclosed: (id) => {
+                sessions.delete(id);
+            },
+        });
+        const session = new Session(deps, credentialsFromRequest(request));
+        const server = createServer(deps, () => session);
+        transport.onclose = () => {
+            if (transport.sessionId) {
+                sessions.delete(transport.sessionId);
+            }
+        };
+        await server.connect(transport);
+        await transport.handleRequest(request, response, request.body);
+    });
+    /** GET открывает SSE-поток, DELETE закрывает сессию — обе требуют существующей сессии. */
+    const requireSession = async (request, response) => {
+        const sessionId = headerValue(request, 'mcp-session-id');
+        const managed = sessionId ? sessions.get(sessionId) : undefined;
+        if (!managed) {
+            response.status(404).json({ error: 'Unknown MCP session.' });
+            return;
+        }
+        await managed.transport.handleRequest(request, response);
+    };
+    app.get('/mcp', requireSession);
+    app.delete('/mcp', requireSession);
+    const httpServer = await new Promise((resolveListen) => {
+        const listener = app.listen(config.http.port, config.http.host, () => {
+            resolveListen(listener);
+        });
+    });
+    process.stderr.write(`oneentry-mcp-platform listening on http://${config.http.host}:${String(config.http.port)}/mcp ` +
+        `(allow=${config.allow}, baseUrl=${config.baseUrl})\n`);
+    return {
+        close: async () => {
+            for (const managed of sessions.values()) {
+                await managed.transport.close();
+            }
+            sessions.clear();
+            await new Promise((resolveClose) => httpServer.close(() => resolveClose()));
+        },
+    };
+};
+//# sourceMappingURL=http.js.map

package/dist/transports/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/transports/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,OAA2D,MAAM,SAAS,CAAC;AAGlF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,mEAAmE;AACnE,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEzC,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAE,IAAY,EAAsB,EAAE;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACrF,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,CAAC,OAAgB,EAA2B,EAAE;IAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACjD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACvD,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,GACf,CAAC,cAAiC,EAAE,EAAE,CACtC,CAAC,OAAgB,EAAE,QAAkB,EAAE,IAAkB,EAAQ,EAAE;IACjE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,WAAW,MAAM,yEAAyE;KAClG,CAAC,CAAC;AACL,CAAC,CAAC;AAQJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EAAE,MAAc,EAA2C,EAAE;IACvF,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEnD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAEjD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;QACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,IAAI,SAAS,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxB,KAAK,EAAE,mEAAmE;aAC3E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;YACtC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE;gBACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;QACjD,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;YACvB,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;gBACxB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,0FAA0F;IAC1F,MAAM,cAAc,GAAG,KAAK,EAAE,OAAgB,EAAE,QAAkB,EAAiB,EAAE;QACnF,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAChC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAEnC,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,CAAgC,CAAC,aAAa,EAAE,EAAE;QACpF,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;YACnE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6CAA6C,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;QAC9F,UAAU,MAAM,CAAC,KAAK,aAAa,MAAM,CAAC,OAAO,KAAK,CACzD,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBACxC,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAClC,CAAC;YACD,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/transports/stdio.d.ts

@@ -0,0 +1,8 @@
+import type { Config } from '../config/config.js';
+/**
+ * Запускает сервер поверх stdio — local-режим.
+ * Сессия одна на процесс: клиент сам порождает процесс на подключение,
+ * поэтому изоляция обеспечивается операционной системой, а не нашим кодом.
+ */
+export declare const runStdio: (config: Config) => Promise<void>;
+//# sourceMappingURL=stdio.d.ts.map

package/dist/transports/stdio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../src/transports/stdio.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAGlD;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GAAU,QAAQ,MAAM,KAAG,OAAO,CAAC,IAAI,CAK3D,CAAC"}

package/dist/transports/stdio.js

@@ -0,0 +1,15 @@
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { createServer, createSharedDeps } from '../server.js';
+import { Session } from '../session.js';
+/**
+ * Запускает сервер поверх stdio — local-режим.
+ * Сессия одна на процесс: клиент сам порождает процесс на подключение,
+ * поэтому изоляция обеспечивается операционной системой, а не нашим кодом.
+ */
+export const runStdio = async (config) => {
+    const deps = createSharedDeps(config);
+    const session = new Session(deps);
+    const server = createServer(deps, () => session);
+    await server.connect(new StdioServerTransport());
+};
+//# sourceMappingURL=stdio.js.map

package/dist/transports/stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../src/transports/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;IAC9D,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACnD,CAAC,CAAC"}