@oomol-lab/open-connector 1.9.0 → 1.9.2

package/src/server/api/console-catalog-routes.js

@@ -0,0 +1,88 @@
+import { Hono } from "hono";
+import { ConnectionError } from "../../connection-service.js";
+import { searchActions } from "../../core/action-search.js";
+import { renderActionMarkdown } from "./action-markdown.js";
+import { jsonError, notFound, readConnectionName as defaultReadConnectionName } from "./http-utils.js";
+import { mapConnectionErrorStatus } from "./runtime-api.js";
+import { readSearchQuery, serializeActionSearchResult } from "./runtime-catalog-routes.js";
+function stripWeakPrefix(etag) {
+    return etag.startsWith("W/") ? etag.slice(2) : etag;
+}
+function requestMatchesEtag(ifNoneMatch, etag) {
+    if (!ifNoneMatch)
+        return false;
+    if (ifNoneMatch.trim() === "*")
+        return true;
+    const target = stripWeakPrefix(etag);
+    return ifNoneMatch.split(",").some((candidate) => stripWeakPrefix(candidate.trim()) === target);
+}
+/** Console catalog, providers, actions and documentation routes. */
+export function createConsoleCatalogRoutes({ catalog, connections, actionSearch, publicOrigin, getPolicySnapshot, readConnectionName = defaultReadConnectionName, serializeSearchResults: injectedSerializeSearchResults, }) {
+    const app = new Hono();
+    const serializeSearchResults = injectedSerializeSearchResults ??
+        (async (results) => {
+            const authenticated = new Set(await connections.listAuthenticatedServices([...new Set(results.map((result) => result.service))]));
+            return results.flatMap((result) => {
+                const action = catalog.actionsById.get(result.id);
+                if (!action)
+                    return [];
+                return [serializeActionSearchResult(result, action, authenticated.has(action.service))];
+            });
+        });
+    app.get("/providers", (context) => {
+        const { providerSummariesJson, providerSummariesEtag } = catalog;
+        context.header("ETag", providerSummariesEtag);
+        if (requestMatchesEtag(context.req.header("If-None-Match"), providerSummariesEtag)) {
+            return context.body(null, 304);
+        }
+        return context.body(providerSummariesJson, 200, { "Content-Type": "application/json" });
+    });
+    app.get("/providers/:service", (context) => {
+        const provider = catalog.providers.find((p) => p.service === context.req.param("service"));
+        if (!provider)
+            return notFound(context);
+        return context.json(provider);
+    });
+    app.get("/actions", (context) => context.json(catalog.actions));
+    app.get("/actions/search", async (context) => {
+        const query = readSearchQuery(context);
+        if (!query.ok) {
+            return jsonError(context, 400, "invalid_input", query.message);
+        }
+        const index = await actionSearch.get();
+        return context.json(await serializeSearchResults(searchActions(index, query.q, {
+            service: query.service,
+            limit: query.limit,
+        })));
+    });
+    app.get("/actions/:actionId/agent.md", async (context) => {
+        const actionId = context.req.param("actionId");
+        const action = catalog.actionsById.get(actionId);
+        if (!action)
+            return notFound(context);
+        try {
+            const policy = (await getPolicySnapshot(context)).evaluate(action);
+            return context.text(renderActionMarkdown(action, {
+                transport: { kind: "http", origin: publicOrigin },
+                connection: await connections.getConnectionSummary(action.service, readConnectionName(context)),
+                policy,
+            }), 200, {
+                "content-type": "text/markdown; charset=utf-8",
+            });
+        }
+        catch (error) {
+            if (error instanceof ConnectionError) {
+                const status = mapConnectionErrorStatus(error);
+                return jsonError(context, status, error.code, error.message);
+            }
+            throw error;
+        }
+    });
+    app.get("/actions/:actionId", (context) => {
+        const action = catalog.actionsById.get(context.req.param("actionId"));
+        if (!action)
+            return notFound(context);
+        return context.json(action);
+    });
+    return app;
+}

package/src/server/api/console-oauth-routes.d.ts

@@ -0,0 +1,18 @@
+import type { ConnectionService } from "../../connection-service.ts";
+import type { RuntimeLogger } from "../../core/types.ts";
+import type { OAuthClientConfigService } from "../../oauth/oauth-client-config-service.ts";
+import type { OAuthFlowService } from "../../oauth/oauth-flow-service.ts";
+import type { SaasProjectService } from "../../saas/saas-project-service.ts";
+import type { Context } from "hono";
+import { Hono } from "hono";
+export interface ConsoleOAuthRoutesOptions {
+    connections: ConnectionService;
+    oauthFlow: OAuthFlowService;
+    oauthClientConfigs: OAuthClientConfigService;
+    saasProject?: SaasProjectService;
+    logger?: RuntimeLogger;
+    oauthCloseDelaySeconds?: number;
+    readConnectionName?: (context: Context, body?: Record<string, unknown>) => string | undefined;
+}
+/** Console connection management and OAuth client configuration / authorization routes. */
+export declare function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientConfigs, saasProject, logger, oauthCloseDelaySeconds, readConnectionName, }: ConsoleOAuthRoutesOptions): Hono;

package/src/server/api/console-oauth-routes.js

@@ -0,0 +1,298 @@
+import { Hono } from "hono";
+import { ConnectionError } from "../../connection-service.js";
+import { optionalBoolean, optionalRecord, optionalString, requiredRawString, requiredString, requiredStringArray, } from "../../core/cast.js";
+import { OAuthClientConfigError } from "../../oauth/oauth-client-config-service.js";
+import { OAuthCallbackError, OAuthFlowError } from "../../oauth/oauth-flow-service.js";
+import { HttpRequestError, jsonError, readConnectionName as defaultReadConnectionName, readJsonBody, } from "./http-utils.js";
+import { renderOAuthCompletionPage } from "./oauth-completion-page.js";
+function readOAuthClientConfigInput(body) {
+    const keys = ["clientId", "clientSecret", "requestedScopes", "redirectUri", "extra", "secretExtra"];
+    if (!keys.some((key) => key in body)) {
+        return undefined;
+    }
+    return {
+        clientId: optionalString(body.clientId) ?? "",
+        clientSecret: optionalString(body.clientSecret) ?? "",
+        requestedScopes: readOptionalStringArray(body, "requestedScopes"),
+        redirectUri: readOptionalRawString(body, "redirectUri"),
+        extra: optionalRecord(body.extra),
+        secretExtra: optionalRecord(body.secretExtra),
+    };
+}
+/** An absent field is undefined; a present one, null included, must be a string (blank is kept for the caller to read as unset). */
+function readOptionalRawString(body, fieldName) {
+    if (!(fieldName in body))
+        return undefined;
+    return requiredRawString(body[fieldName], fieldName, (message) => new HttpRequestError("invalid_input", `${message}.`));
+}
+function readOptionalStringArray(body, fieldName) {
+    if (!(fieldName in body))
+        return undefined;
+    return requiredStringArray(body[fieldName], fieldName, (message) => new HttpRequestError("invalid_input", `${message}.`));
+}
+/** Console connection management and OAuth client configuration / authorization routes. */
+export function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientConfigs, saasProject, logger, oauthCloseDelaySeconds, readConnectionName = defaultReadConnectionName, }) {
+    const app = new Hono();
+    const writeConnectionResult = async (context, operation, logContext) => {
+        try {
+            const result = await operation;
+            if (logContext) {
+                logger?.info(logContext, logContext.operation === "disconnect" ? "connection disconnect completed" : "connection completed");
+            }
+            return context.json(result);
+        }
+        catch (error) {
+            if (error instanceof ConnectionError) {
+                if (logContext) {
+                    const cancelled = error.code === "connection_cancelled";
+                    logger?.[cancelled ? "info" : "warn"]({
+                        ...logContext,
+                        errorCode: error.code,
+                    }, cancelled
+                        ? "connection cancelled"
+                        : logContext.operation === "disconnect"
+                            ? "connection disconnect failed"
+                            : "connection failed");
+                }
+                return jsonError(context, error.code === "unknown_service" ? 404 : 400, error.code, error.message);
+            }
+            throw error;
+        }
+    };
+    const writeOAuthResult = async (context, operation) => {
+        try {
+            return context.json(await operation);
+        }
+        catch (error) {
+            if (error instanceof OAuthClientConfigError || error instanceof OAuthFlowError) {
+                return jsonError(context, error.code === "unknown_service" ? 404 : 400, error.code, error.message);
+            }
+            if (error instanceof HttpRequestError) {
+                return jsonError(context, 400, error.code, error.message);
+            }
+            throw error;
+        }
+    };
+    app.get("/api/connections", async (context) => context.json(await connections.listConnections()));
+    app.put("/api/connections/:service", async (context) => {
+        const service = context.req.param("service");
+        const body = await readJsonBody(context);
+        const authType = optionalString(body.authType);
+        if (!authType) {
+            logger?.warn({
+                errorCode: "invalid_input",
+                path: context.req.path,
+                service,
+            }, "connection rejected");
+            return jsonError(context, 400, "invalid_input", "authType is required.");
+        }
+        const values = body.values ?? body;
+        const connectionName = readConnectionName(context, body);
+        const logContext = {
+            operation: "connect",
+            path: context.req.path,
+            service,
+            authType,
+            connectionName,
+        };
+        if (authType === "no_auth") {
+            logger?.info(logContext, "connection started");
+            return writeConnectionResult(context, connections.connectWithoutAuth(service, { connectionName }), logContext);
+        }
+        if (authType === "api_key") {
+            logger?.info(logContext, "connection started");
+            return writeConnectionResult(context, connections.connectWithApiKey(service, {
+                values,
+                connectionName,
+                signal: context.req.raw.signal,
+            }), logContext);
+        }
+        if (authType === "custom_credential") {
+            logger?.info(logContext, "connection started");
+            return writeConnectionResult(context, connections.connectWithCustomCredential(service, {
+                values,
+                connectionName,
+                signal: context.req.raw.signal,
+            }), logContext);
+        }
+        logger?.warn({
+            ...logContext,
+            errorCode: "unsupported_auth_type",
+        }, "connection rejected");
+        return jsonError(context, 400, "unsupported_auth_type", `${service} does not support ${authType}.`);
+    });
+    app.delete("/api/connections/:service", async (context) => {
+        const service = context.req.param("service");
+        const body = await readJsonBody(context);
+        const connectionName = readConnectionName(context, body);
+        const logContext = {
+            operation: "disconnect",
+            path: context.req.path,
+            service,
+            connectionName,
+        };
+        logger?.info(logContext, "connection disconnect started");
+        return writeConnectionResult(context, connections.disconnect(service, connectionName, { revoke: optionalBoolean(body.revoke) }), logContext);
+    });
+    app.get("/api/oauth/configs", async (context) => {
+        const configs = await oauthClientConfigs.listConfigs();
+        const sources = await saasProject?.listSources();
+        return context.json(configs.map((config) => ({
+            ...config,
+            oauthSource: sources?.get(config.service) ?? { mode: "local" },
+            customClientAvailable: sources?.has(config.service) ? false : config.customClientAvailable,
+        })));
+    });
+    app.put("/api/oauth/configs/:service", async (context) => {
+        const service = context.req.param("service");
+        const body = await readJsonBody(context);
+        return writeOAuthResult(context, oauthClientConfigs.upsertConfig({
+            service,
+            clientId: optionalString(body.clientId) ?? "",
+            clientSecret: optionalString(body.clientSecret) ?? "",
+            requestedScopes: readOptionalStringArray(body, "requestedScopes"),
+            redirectUri: readOptionalRawString(body, "redirectUri"),
+            extra: optionalRecord(body.extra),
+            secretExtra: optionalRecord(body.secretExtra),
+        }));
+    });
+    app.delete("/api/oauth/configs/:service", async (context) => {
+        const service = context.req.param("service");
+        return writeOAuthResult(context, oauthClientConfigs.deleteConfig(service));
+    });
+    app.post("/api/oauth/connection-requests", async (context) => {
+        try {
+            const { consoleOAuthConnectionInput } = await import("./connection-input.js");
+            const parsed = consoleOAuthConnectionInput.safeParse(await readJsonBody(context));
+            if (!parsed.success)
+                return jsonError(context, 400, "invalid_input", "Invalid OAuth connection request.");
+            const { appId, ...input } = parsed.data;
+            const target = appId ? await connections.getStoredConnection(appId) : undefined;
+            if (target && (target.service !== input.service || target.connectionName !== input.connectionName))
+                return jsonError(context, 400, "invalid_input", "The selected connection no longer matches.");
+            return context.json(await oauthFlow.startConnectionRequest({
+                ...input,
+                target,
+                owner: "local-admin",
+                signal: context.req.raw.signal,
+            }));
+        }
+        catch (error) {
+            if (error instanceof OAuthClientConfigError ||
+                error instanceof OAuthFlowError ||
+                error instanceof ConnectionError)
+                return jsonError(context, error.code === "unknown_service" || error.code === "app_not_found" ? 404 : 400, error.code, error.message);
+            throw error;
+        }
+    });
+    app.post("/api/oauth/authorizations", async (context) => {
+        const body = await readJsonBody(context);
+        const requestedService = optionalString(body.service);
+        const connectionName = readConnectionName(context, body);
+        try {
+            const service = requiredString(body.service, "service", (message) => new OAuthFlowError("invalid_input", message));
+            const logContext = {
+                path: context.req.path,
+                service,
+                connectionName,
+            };
+            logger?.info(logContext, "oauth authorization started");
+            const authorization = await oauthFlow.startAuthorization({
+                service,
+                connectionName,
+                clientConfig: readOAuthClientConfigInput(body),
+                authorizationOptionIds: readOptionalStringArray(body, "authorizationOptionIds"),
+            });
+            const authorizationUrl = new URL(authorization.authorizationUrl);
+            logger?.info({
+                ...logContext,
+                authorizationHost: authorizationUrl.host,
+                redirectUri: authorizationUrl.searchParams.get("redirect_uri") ?? undefined,
+            }, "oauth authorization created");
+            return context.json(authorization);
+        }
+        catch (error) {
+            if (error instanceof OAuthClientConfigError ||
+                error instanceof OAuthFlowError ||
+                error instanceof ConnectionError) {
+                logger?.warn({
+                    errorCode: error.code,
+                    path: context.req.path,
+                    service: requestedService,
+                    connectionName,
+                }, "oauth authorization failed");
+                const status = error.code === "unknown_service" ? 404 : 400;
+                return jsonError(context, status, error.code, error.message);
+            }
+            throw error;
+        }
+    });
+    app.get("/oauth/callback", async (context) => {
+        const state = context.req.query("state");
+        const code = context.req.query("code");
+        const logContext = {
+            path: context.req.path,
+            hasState: Boolean(state),
+            hasCode: Boolean(code),
+        };
+        logger?.info(logContext, "oauth callback received");
+        const providerError = context.req.query("error");
+        if (providerError) {
+            const returnUri = state
+                ? await oauthFlow.rejectAuthorization(state, providerError === "access_denied")
+                : undefined;
+            if (returnUri)
+                return context.redirect(returnUri);
+            const providerErrorDescription = context.req.query("error_description");
+            logger?.warn({
+                ...logContext,
+                errorCode: "oauth_provider_error",
+                providerError,
+                providerErrorDescription,
+            }, "oauth callback failed");
+            return jsonError(context, 400, "oauth_provider_error", `OAuth provider returned error "${providerError}"${providerErrorDescription ? `: ${providerErrorDescription}` : "."}`);
+        }
+        if (!state || !code) {
+            if (state)
+                await oauthFlow.rejectAuthorization(state, false);
+            logger?.warn({
+                ...logContext,
+                errorCode: "invalid_oauth_callback",
+            }, "oauth callback failed");
+            return jsonError(context, 400, "invalid_oauth_callback", "OAuth callback requires state and code.");
+        }
+        let service;
+        try {
+            const callbackUrl = new URL(context.req.url);
+            const completed = await oauthFlow.completeAuthorization({
+                state,
+                code,
+                callbackParameters: Object.fromEntries(callbackUrl.searchParams),
+                callbackQuery: callbackUrl.search,
+                signal: context.req.raw.signal,
+            });
+            service = completed.service;
+            if (completed.returnUri)
+                return context.redirect(completed.returnUri);
+            logger?.info({
+                ...logContext,
+                service,
+            }, "oauth callback completed");
+        }
+        catch (error) {
+            if (error instanceof OAuthCallbackError && error.returnUri)
+                return context.redirect(error.returnUri);
+            if (error instanceof OAuthFlowError || error instanceof ConnectionError) {
+                const cancelled = error instanceof ConnectionError && error.code === "connection_cancelled";
+                logger?.[cancelled ? "info" : "warn"]({
+                    ...logContext,
+                    errorCode: error.code,
+                }, cancelled ? "oauth callback cancelled" : "oauth callback failed");
+                return jsonError(context, error.code === "unknown_service" ? 404 : 400, error.code, error.message);
+            }
+            throw error;
+        }
+        return context.html(renderOAuthCompletionPage(service, oauthCloseDelaySeconds));
+    });
+    return app;
+}

package/src/server/api/docs-routes.d.ts

@@ -0,0 +1,12 @@
+import type { ProviderDefinition } from "../../core/types.ts";
+import type { MiddlewareHandler } from "hono";
+import { Hono } from "hono";
+/** The Scalar API reference is only rendered for /docs, so its package is loaded on demand. */
+export declare function loadDocsHandler(openapiUrl?: string): Promise<MiddlewareHandler>;
+export interface DocsRoutesOptions {
+    providers: ProviderDefinition[];
+    publicOrigin: string;
+    serveDocumentation?: boolean;
+}
+/** OpenAPI 3.1 schema and interactive documentation routes. */
+export declare function createDocsRoutes({ providers, publicOrigin, serveDocumentation }: DocsRoutesOptions): Hono;

package/src/server/api/docs-routes.js

@@ -0,0 +1,38 @@
+import { Hono } from "hono";
+import { optionalString } from "../../core/cast.js";
+import { PromiseCache } from "../../core/promise-cache.js";
+const docsHandler = new PromiseCache();
+/** The Scalar API reference is only rendered for /docs, so its package is loaded on demand. */
+export function loadDocsHandler(openapiUrl = "/openapi.json") {
+    return docsHandler.get(openapiUrl, async () => {
+        const { Scalar } = await import("@scalar/hono-api-reference");
+        return Scalar({
+            pageTitle: "OOMOL Connect API Reference",
+            url: openapiUrl,
+            theme: "default",
+            darkMode: false,
+            forceDarkModeState: "light",
+            customCss: `
+          :root {
+            --scalar-color-accent: rgb(59, 99, 251);
+            --scalar-background-accent: rgba(59, 99, 251, 0.12);
+          }
+        `,
+        });
+    });
+}
+/** OpenAPI 3.1 schema and interactive documentation routes. */
+export function createDocsRoutes({ providers, publicOrigin, serveDocumentation }) {
+    const app = new Hono();
+    app.get("/openapi.json", async (context) => {
+        const { createOpenApiDocument } = await import("./openapi.js");
+        return context.json(createOpenApiDocument(providers, {
+            actionId: optionalString(context.req.query("actionId")),
+        }));
+    });
+    if (serveDocumentation !== false) {
+        const openapiUrl = `${new URL(publicOrigin).pathname.replace(/\/+$/, "")}/openapi.json`;
+        app.get("/docs", async (context, next) => (await loadDocsHandler(openapiUrl))(context, next));
+    }
+    return app;
+}

package/src/server/api/http-utils.d.ts

@@ -37,3 +37,4 @@ export declare class HttpRequestError extends Error {
     readonly status: RuntimeStatus;
     constructor(code: string, message: string, status?: RuntimeStatus);
 }
+export declare function readConnectionName(context: Context, body?: Record<string, unknown>): string | undefined;

package/src/server/api/http-utils.js

@@ -1,3 +1,4 @@
+import { optionalString } from "../../core/cast.js";
 /**
  * Read an optional JSON object request body.
  *
@@ -91,3 +92,10 @@ export class HttpRequestError extends Error {
         this.status = status;
     }
 }
+export function readConnectionName(context, body) {
+    return (optionalString(body?.connectionName) ??
+        optionalString(body?.alias) ??
+        optionalString(context.req.header("x-oo-connector-alias")) ??
+        optionalString(context.req.query("connectionName")) ??
+        optionalString(context.req.query("alias")));
+}

package/src/server/api/marketplace-routes.d.ts

@@ -0,0 +1,7 @@
+import type { MarketplaceService } from "../../marketplace/marketplace-service.ts";
+import { Hono } from "hono";
+export interface MarketplaceRoutesOptions {
+    marketplace: MarketplaceService;
+}
+/** Marketplace configuration and provider preference routes. */
+export declare function createMarketplaceRoutes({ marketplace }: MarketplaceRoutesOptions): Hono;

package/src/server/api/marketplace-routes.js

@@ -0,0 +1,62 @@
+import { Hono } from "hono";
+import { optionalString } from "../../core/cast.js";
+import { MarketplaceError } from "../../marketplace/marketplace-service.js";
+import { jsonError, readJsonBody } from "./http-utils.js";
+function writeMarketplaceError(context, error) {
+    const status = error.status;
+    return jsonError(context, status === 401 || status === 403 || status === 404 || status === 502 || status === 504 ? status : 400, error.code, error.message);
+}
+/** Marketplace configuration and provider preference routes. */
+export function createMarketplaceRoutes({ marketplace }) {
+    const app = new Hono();
+    app.get("/marketplace", (context) => context.json(marketplace.getState()));
+    app.get("/marketplace/discovery", async (context) => {
+        try {
+            return context.json(await marketplace.getDefaultDiscovery(context.req.raw.signal));
+        }
+        catch (error) {
+            if (error instanceof MarketplaceError)
+                return writeMarketplaceError(context, error);
+            throw error;
+        }
+    });
+    const configureMarketplace = async (context) => {
+        const body = await readJsonBody(context);
+        const input = {
+            discoveryUrl: optionalString(body.discoveryUrl),
+            apiKey: optionalString(body.apiKey),
+            enabled: typeof body.enabled === "boolean" ? body.enabled : undefined,
+        };
+        try {
+            return context.json(await marketplace.configure(input));
+        }
+        catch (error) {
+            if (error instanceof MarketplaceError)
+                return writeMarketplaceError(context, error);
+            throw error;
+        }
+    };
+    app.put("/marketplace", configureMarketplace);
+    app.patch("/marketplace", configureMarketplace);
+    app.delete("/marketplace", async (context) => {
+        await marketplace.remove();
+        return context.json(marketplace.getState());
+    });
+    app.get("/provider-preferences", async (context) => context.json(await marketplace.listProviderPreferences()));
+    app.patch("/provider-preferences/:service", async (context) => {
+        const service = context.req.param("service");
+        const body = await readJsonBody(context);
+        if (typeof body.enabled !== "boolean") {
+            return jsonError(context, 400, "invalid_input", "enabled must be a boolean.");
+        }
+        try {
+            return context.json(await marketplace.setProviderEnabled(service, body.enabled));
+        }
+        catch (error) {
+            if (error instanceof MarketplaceError)
+                return jsonError(context, 404, error.code, error.message);
+            throw error;
+        }
+    });
+    return app;
+}

package/src/server/api/mcp-routes.d.ts

@@ -0,0 +1,18 @@
+import type { CatalogStore } from "../../catalog-store.ts";
+import type { ConnectionService } from "../../connection-service.ts";
+import type { ActionPolicySnapshot } from "../../core/action-policy.ts";
+import type { ActionSearchIndexProvider } from "../../core/action-search.ts";
+import type { ActionRunner } from "../actions/action-runner.ts";
+import type { Context } from "hono";
+import { Hono } from "hono";
+export type McpModule = typeof import("../../mcp.ts");
+export declare function loadMcpModule(): Promise<McpModule>;
+export interface McpRoutesOptions {
+    catalog: CatalogStore;
+    connections: ConnectionService;
+    actions: ActionRunner;
+    actionSearch: ActionSearchIndexProvider;
+    getPolicySnapshot: (context: Context) => Promise<ActionPolicySnapshot>;
+}
+/** MCP transport and tool discovery routes. */
+export declare function createMcpRoutes({ catalog, connections, actions, actionSearch, getPolicySnapshot, }: McpRoutesOptions): Hono;

package/src/server/api/mcp-routes.js

@@ -0,0 +1,37 @@
+import { Hono } from "hono";
+import { PromiseCache } from "../../core/promise-cache.js";
+import { readRuntimeGrant } from "./auth.js";
+const mcpModule = new PromiseCache();
+export function loadMcpModule() {
+    return mcpModule.get("", () => import("../../mcp.js"));
+}
+function rejectMcpMethod(context) {
+    return context.json({
+        jsonrpc: "2.0",
+        error: {
+            code: -32000,
+            message: "Method not allowed.",
+        },
+        id: null,
+    }, 405);
+}
+/** MCP transport and tool discovery routes. */
+export function createMcpRoutes({ catalog, connections, actions, actionSearch, getPolicySnapshot, }) {
+    const app = new Hono();
+    app.post("/mcp", async (context) => {
+        const { handleMcpRequest } = await loadMcpModule();
+        return await handleMcpRequest(context.req.raw, {
+            catalog,
+            connections,
+            actions,
+            actionSearch,
+            getPolicySnapshot: () => getPolicySnapshot(context),
+            runtimeGrant: readRuntimeGrant(context),
+            signal: context.req.raw.signal,
+        });
+    });
+    app.get("/mcp", (context) => rejectMcpMethod(context));
+    app.delete("/mcp", (context) => rejectMcpMethod(context));
+    app.get("/mcp/tools", async (context) => context.json({ tools: (await loadMcpModule()).listMcpToolSummaries() }));
+    return app;
+}

package/src/server/api/pattern-example.js

@@ -51,12 +51,46 @@ export function samplePattern(pattern, options = {}) {
         if (sample.length > maximumSampleLength) {
             return undefined;
         }
-        return matchesPattern(pattern, sample) ? sample : undefined;
+        if (matchesPattern(pattern, sample)) {
+            return sample;
+        }
+        // Try explicit alternatives when an assertion rejects the shortest branch.
+        // Bound the work; this is a sampler, not a general regex constraint solver.
+        for (const candidate of alternativeRoots(root)) {
+            const value = generateSample(candidate, minLength, growth, { remaining: maximumSampleLength });
+            if (value.length >= minLength && matchesPattern(pattern, value)) {
+                return value;
+            }
+        }
+        return undefined;
     }
     catch {
         return undefined;
     }
 }
+function alternativeRoots(root) {
+    switch (root.kind) {
+        case "literal":
+            return [];
+        case "alternation":
+            return root.branches.slice(0, 32);
+        case "repeat":
+            return alternativeRoots(root.node).map((node) => ({ ...root, node }));
+        case "sequence": {
+            const variants = [];
+            for (let index = 0; index < root.nodes.length && variants.length < 32; index += 1) {
+                for (const node of alternativeRoots(root.nodes[index])) {
+                    const nodes = root.nodes.slice();
+                    nodes[index] = node;
+                    variants.push({ kind: "sequence", nodes });
+                    if (variants.length === 32)
+                        break;
+                }
+            }
+            return variants;
+        }
+    }
+}
 function matchesPattern(pattern, sample) {
     try {
         // The runtime validator compiles patterns with the `u` flag (@cfworker/json-schema).