@open-mercato/ai-assistant 0.4.2-canary-c02407ff85

package/dist/modules/ai_assistant/lib/http-server.js

@@ -0,0 +1,367 @@
+import { createServer } from "node:http";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { z } from "zod";
+import { getToolRegistry } from "./tool-registry.js";
+import { executeTool } from "./tool-executor.js";
+import { loadAllModuleTools, indexToolsForSearch } from "./tool-loader.js";
+import { extractApiKeyFromHeaders, hasRequiredFeatures } from "./auth.js";
+import { jsonSchemaToZod } from "./schema-utils.js";
+import { findApiKeyBySessionToken } from "@open-mercato/core/modules/api_keys/services/apiKeyService";
+async function resolveSessionContext(sessionToken, baseContext, debug) {
+  try {
+    const em = baseContext.container.resolve("em");
+    const rbacService = baseContext.container.resolve("rbacService");
+    const sessionKey = await findApiKeyBySessionToken(em, sessionToken);
+    if (!sessionKey) {
+      if (debug) {
+        console.error(`[MCP HTTP] Session token not found or expired: ${sessionToken}`);
+      }
+      return null;
+    }
+    const userId = sessionKey.sessionUserId || sessionKey.createdBy;
+    if (!userId) {
+      if (debug) {
+        console.error(`[MCP HTTP] Session key has no associated user`);
+      }
+      return null;
+    }
+    const acl = await rbacService.loadAcl(`api_key:${sessionKey.id}`, {
+      tenantId: sessionKey.tenantId ?? null,
+      organizationId: sessionKey.organizationId ?? null
+    });
+    if (debug) {
+      console.error(`[MCP HTTP] Session context resolved for user ${userId}:`, {
+        tenantId: sessionKey.tenantId,
+        organizationId: sessionKey.organizationId,
+        features: acl.features.length,
+        isSuperAdmin: acl.isSuperAdmin
+      });
+    }
+    return {
+      tenantId: sessionKey.tenantId ?? null,
+      organizationId: sessionKey.organizationId ?? null,
+      userId,
+      container: baseContext.container,
+      userFeatures: acl.features,
+      isSuperAdmin: acl.isSuperAdmin,
+      apiKeySecret: baseContext.apiKeySecret
+    };
+  } catch (error) {
+    if (debug) {
+      console.error(`[MCP HTTP] Error resolving session context:`, error);
+    }
+    return null;
+  }
+}
+function createMcpServerForRequest(config, toolContext) {
+  const server = new McpServer(
+    { name: config.name, version: config.version },
+    { capabilities: { tools: {} } }
+  );
+  const registry = getToolRegistry();
+  const tools = Array.from(registry.getTools().values());
+  if (config.debug) {
+    console.error(`[MCP HTTP] Registering ${tools.length} tools (ACL checked per-call via session token)`);
+  }
+  for (const tool of tools) {
+    if (config.debug) {
+      console.error(`[MCP HTTP] Registering tool: ${tool.name}`);
+    }
+    let safeSchema;
+    if (tool.inputSchema) {
+      try {
+        const jsonSchema = z.toJSONSchema(tool.inputSchema, { unrepresentable: "any" });
+        const properties = jsonSchema.properties ?? {};
+        properties._sessionToken = {
+          type: "string",
+          description: "Session authorization token (REQUIRED for all tool calls)"
+        };
+        jsonSchema.properties = properties;
+        const converted = jsonSchemaToZod(jsonSchema);
+        safeSchema = converted.passthrough();
+      } catch (error) {
+        if (config.debug) {
+          console.error(
+            `[MCP HTTP] Skipping tool ${tool.name} - schema conversion failed:`,
+            error instanceof Error ? error.message : error
+          );
+        }
+        continue;
+      }
+    } else {
+      safeSchema = z.object({
+        _sessionToken: z.string().optional().describe("Session authorization token (REQUIRED for all tool calls)")
+      });
+    }
+    try {
+      server.registerTool(
+        tool.name,
+        {
+          description: tool.description,
+          inputSchema: safeSchema
+        },
+        async (args) => {
+          const toolArgs = args ?? {};
+          const sessionToken = toolArgs._sessionToken;
+          delete toolArgs._sessionToken;
+          if (config.debug) {
+            console.error(`[MCP HTTP] Calling tool: ${tool.name}`, {
+              hasSessionToken: !!sessionToken,
+              args: JSON.stringify(toolArgs)
+            });
+          }
+          let effectiveContext = toolContext;
+          if (sessionToken) {
+            const sessionContext = await resolveSessionContext(sessionToken, toolContext, config.debug);
+            if (sessionContext) {
+              effectiveContext = sessionContext;
+            } else {
+              return {
+                content: [
+                  {
+                    type: "text",
+                    text: JSON.stringify({
+                      error: "Your chat session has expired. Please close and reopen the chat window to continue.",
+                      code: "SESSION_EXPIRED"
+                    })
+                  }
+                ],
+                isError: true
+              };
+            }
+          } else {
+            if (!effectiveContext.userId && effectiveContext.userFeatures.length === 0) {
+              return {
+                content: [
+                  {
+                    type: "text",
+                    text: JSON.stringify({
+                      error: "Session token required (_sessionToken parameter)",
+                      code: "UNAUTHORIZED"
+                    })
+                  }
+                ],
+                isError: true
+              };
+            }
+          }
+          if (tool.requiredFeatures?.length) {
+            const hasAccess = hasRequiredFeatures(
+              tool.requiredFeatures,
+              effectiveContext.userFeatures,
+              effectiveContext.isSuperAdmin
+            );
+            if (!hasAccess) {
+              return {
+                content: [
+                  {
+                    type: "text",
+                    text: JSON.stringify({
+                      error: `Insufficient permissions for tool "${tool.name}". Required: ${tool.requiredFeatures.join(", ")}`,
+                      code: "UNAUTHORIZED"
+                    })
+                  }
+                ],
+                isError: true
+              };
+            }
+          }
+          const result = await executeTool(tool.name, toolArgs, effectiveContext);
+          if (!result.success) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: JSON.stringify({ error: result.error, code: result.errorCode })
+                }
+              ],
+              isError: true
+            };
+          }
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(result.result, null, 2)
+              }
+            ]
+          };
+        }
+      );
+    } catch (error) {
+      if (config.debug) {
+        console.error(
+          `[MCP HTTP] Skipping tool ${tool.name} - registration failed:`,
+          error instanceof Error ? error.message : error
+        );
+      }
+      continue;
+    }
+  }
+  return server;
+}
+const MAX_BODY_SIZE = 1 * 1024 * 1024;
+async function parseJsonBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let totalSize = 0;
+    req.on("data", (chunk) => {
+      totalSize += chunk.length;
+      if (totalSize > MAX_BODY_SIZE) {
+        req.destroy();
+        reject(new Error("Request payload too large"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      try {
+        const body = Buffer.concat(chunks).toString("utf-8");
+        resolve(body ? JSON.parse(body) : void 0);
+      } catch (error) {
+        reject(error);
+      }
+    });
+    req.on("error", reject);
+  });
+}
+async function runMcpHttpServer(options) {
+  const { config, container, port } = options;
+  await loadAllModuleTools();
+  try {
+    const searchService = container.resolve("searchService");
+    await indexToolsForSearch(searchService);
+    const { indexApiEndpoints } = await import("./api-endpoint-index.js");
+    const endpointCount = await indexApiEndpoints(searchService);
+    if (endpointCount > 0) {
+      console.error(`[MCP HTTP] Indexed ${endpointCount} API endpoints for hybrid search`);
+    }
+  } catch (error) {
+    console.error("[MCP HTTP] Search indexing skipped (search service not available):", error);
+  }
+  const httpServer = createServer(async (req, res) => {
+    const url = new URL(req.url || "/", `http://localhost:${port}`);
+    if (url.pathname === "/health") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({
+        status: "ok",
+        tools: getToolRegistry().listToolNames().length,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      }));
+      return;
+    }
+    if (url.pathname !== "/mcp") {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Not found" }));
+      return;
+    }
+    const headers = {};
+    for (const [key, value] of Object.entries(req.headers)) {
+      headers[key] = Array.isArray(value) ? value[0] : value;
+    }
+    const providedApiKey = extractApiKeyFromHeaders(headers);
+    if (!providedApiKey) {
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "API key required (x-api-key header)" }));
+      return;
+    }
+    const serverApiKey = options.serverApiKey || process.env.MCP_SERVER_API_KEY;
+    if (!serverApiKey) {
+      console.error("[MCP HTTP] Warning: MCP_SERVER_API_KEY not configured, rejecting all requests");
+      res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "MCP server not properly configured" }));
+      return;
+    }
+    if (providedApiKey !== serverApiKey) {
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Invalid API key" }));
+      return;
+    }
+    if (config.debug) {
+      console.error(`[MCP HTTP] Server-level auth passed (${req.method})`);
+    }
+    const toolContext = {
+      tenantId: null,
+      organizationId: null,
+      userId: null,
+      container,
+      userFeatures: [],
+      isSuperAdmin: false,
+      apiKeySecret: providedApiKey
+    };
+    try {
+      const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: void 0,
+        enableJsonResponse: req.method === "POST"
+      });
+      const mcpServer = createMcpServerForRequest(config, toolContext);
+      if (config.debug) {
+        const registeredTools = mcpServer._registeredTools || {};
+        console.error(`[MCP HTTP] Registered tools in McpServer:`, Object.keys(registeredTools));
+        console.error(`[MCP HTTP] Tool handlers initialized:`, mcpServer._toolHandlersInitialized);
+      }
+      await mcpServer.connect(transport);
+      if (req.method === "POST") {
+        const body = await parseJsonBody(req);
+        await transport.handleRequest(req, res, body);
+      } else {
+        await transport.handleRequest(req, res);
+      }
+      res.on("finish", () => {
+        transport.close();
+        mcpServer.close();
+        if (config.debug) {
+          console.error(`[MCP HTTP] Request completed, cleaned up`);
+        }
+      });
+    } catch (error) {
+      console.error("[MCP HTTP] Error handling request:", error);
+      if (!res.headersSent) {
+        if (error instanceof Error && error.message === "Request payload too large") {
+          res.writeHead(413, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Request payload too large (max 1MB)" }));
+          return;
+        }
+        res.writeHead(500, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            jsonrpc: "2.0",
+            error: {
+              code: -32603,
+              message: `Internal server error: ${error instanceof Error ? error.message : String(error)}`
+            },
+            id: null
+          })
+        );
+      }
+    }
+  });
+  const toolCount = getToolRegistry().listToolNames().length;
+  const serverKeyConfigured = !!(options.serverApiKey || process.env.MCP_SERVER_API_KEY);
+  console.error(`[MCP HTTP] Starting ${config.name} v${config.version}`);
+  console.error(`[MCP HTTP] Endpoint: http://localhost:${port}/mcp`);
+  console.error(`[MCP HTTP] Health: http://localhost:${port}/health`);
+  console.error(`[MCP HTTP] Tools registered: ${toolCount}`);
+  console.error(`[MCP HTTP] Mode: Stateless (new server per request)`);
+  console.error(`[MCP HTTP] Server Auth: ${serverKeyConfigured ? "MCP_SERVER_API_KEY configured" : "WARNING: MCP_SERVER_API_KEY not set!"}`);
+  console.error(`[MCP HTTP] User Auth: Session token in _sessionToken parameter`);
+  return new Promise((resolve) => {
+    httpServer.listen(port, () => {
+      console.error(`[MCP HTTP] Server listening on port ${port}`);
+    });
+    const shutdown = async () => {
+      console.error("[MCP HTTP] Shutting down...");
+      httpServer.close(() => {
+        console.error("[MCP HTTP] Server closed");
+        resolve();
+      });
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+  });
+}
+export {
+  runMcpHttpServer
+};
+//# sourceMappingURL=http-server.js.map

package/dist/modules/ai_assistant/lib/http-server.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/ai_assistant/lib/http-server.ts"],
+  "sourcesContent": ["import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'\nimport type { AwilixContainer } from 'awilix'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { z, type ZodType } from 'zod'\nimport { getToolRegistry } from './tool-registry'\nimport { executeTool } from './tool-executor'\nimport { loadAllModuleTools, indexToolsForSearch } from './tool-loader'\nimport { authenticateMcpRequest, extractApiKeyFromHeaders, hasRequiredFeatures } from './auth'\nimport { jsonSchemaToZod, toSafeZodSchema } from './schema-utils'\nimport type { McpServerConfig, McpToolContext } from './types'\nimport type { SearchService } from '@open-mercato/search/service'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { findApiKeyBySessionToken } from '@open-mercato/core/modules/api_keys/services/apiKeyService'\n\n/**\n * Options for the HTTP MCP server.\n */\nexport type McpHttpServerOptions = {\n  config: McpServerConfig\n  container: AwilixContainer\n  port: number\n  /** Static API key for server-level authentication (from env MCP_SERVER_API_KEY) */\n  serverApiKey?: string\n}\n\n/**\n * Resolve user context from session token.\n * Returns null if session token is invalid or expired.\n */\nasync function resolveSessionContext(\n  sessionToken: string,\n  baseContext: McpToolContext,\n  debug?: boolean\n): Promise<McpToolContext | null> {\n  try {\n    const em = baseContext.container.resolve<EntityManager>('em')\n    const rbacService = baseContext.container.resolve<RbacService>('rbacService')\n\n    // Look up ephemeral key by session token\n    const sessionKey = await findApiKeyBySessionToken(em, sessionToken)\n    if (!sessionKey) {\n      if (debug) {\n        console.error(`[MCP HTTP] Session token not found or expired: ${sessionToken}`)\n      }\n      return null\n    }\n\n    // Load ACL for the session user\n    const userId = sessionKey.sessionUserId || sessionKey.createdBy\n    if (!userId) {\n      if (debug) {\n        console.error(`[MCP HTTP] Session key has no associated user`)\n      }\n      return null\n    }\n\n    const acl = await rbacService.loadAcl(`api_key:${sessionKey.id}`, {\n      tenantId: sessionKey.tenantId ?? null,\n      organizationId: sessionKey.organizationId ?? null,\n    })\n\n    if (debug) {\n      console.error(`[MCP HTTP] Session context resolved for user ${userId}:`, {\n        tenantId: sessionKey.tenantId,\n        organizationId: sessionKey.organizationId,\n        features: acl.features.length,\n        isSuperAdmin: acl.isSuperAdmin,\n      })\n    }\n\n    return {\n      tenantId: sessionKey.tenantId ?? null,\n      organizationId: sessionKey.organizationId ?? null,\n      userId,\n      container: baseContext.container,\n      userFeatures: acl.features,\n      isSuperAdmin: acl.isSuperAdmin,\n      apiKeySecret: baseContext.apiKeySecret,\n    }\n  } catch (error) {\n    if (debug) {\n      console.error(`[MCP HTTP] Error resolving session context:`, error)\n    }\n    return null\n  }\n}\n\n/**\n * Create a stateless MCP server instance for a single request.\n * Tools are registered without pre-filtering - permission checks happen at execution time\n * based on the session token provided in each tool call.\n */\nfunction createMcpServerForRequest(\n  config: McpServerConfig,\n  toolContext: McpToolContext\n): McpServer {\n  const server = new McpServer(\n    { name: config.name, version: config.version },\n    { capabilities: { tools: {} } }\n  )\n\n  const registry = getToolRegistry()\n  const tools = Array.from(registry.getTools().values())\n\n  if (config.debug) {\n    console.error(`[MCP HTTP] Registering ${tools.length} tools (ACL checked per-call via session token)`)\n  }\n\n  // Register ALL tools - permission checks happen at execution time via session token\n  for (const tool of tools) {\n    if (config.debug) {\n      console.error(`[MCP HTTP] Registering tool: ${tool.name}`)\n    }\n\n    // Convert Zod schema to a \"safe\" schema without Date types\n    // This uses JSON Schema round-trip to avoid issues with MCP SDK's internal conversion\n    // Also inject _sessionToken as an optional parameter so the AI knows to pass it\n    let safeSchema: ZodType | undefined\n    if (tool.inputSchema) {\n      try {\n        // Convert to JSON Schema first\n        const jsonSchema = z.toJSONSchema(tool.inputSchema, { unrepresentable: 'any' }) as Record<string, unknown>\n\n        // Inject _sessionToken into the JSON schema properties\n        const properties = (jsonSchema.properties ?? {}) as Record<string, unknown>\n        properties._sessionToken = {\n          type: 'string',\n          description: 'Session authorization token (REQUIRED for all tool calls)',\n        }\n        jsonSchema.properties = properties\n\n        // Convert back to Zod with passthrough to allow extra properties\n        const converted = jsonSchemaToZod(jsonSchema)\n        // Use type assertion since we know it's an object schema (we added properties above)\n        safeSchema = (converted as z.ZodObject<any>).passthrough()\n      } catch (error) {\n        if (config.debug) {\n          console.error(\n            `[MCP HTTP] Skipping tool ${tool.name} - schema conversion failed:`,\n            error instanceof Error ? error.message : error\n          )\n        }\n        continue\n      }\n    } else {\n      // If no schema, create one with just _sessionToken\n      safeSchema = z.object({\n        _sessionToken: z\n          .string()\n          .optional()\n          .describe('Session authorization token (REQUIRED for all tool calls)'),\n      })\n    }\n\n    // Wrap in try/catch to handle any remaining edge cases\n    try {\n      server.registerTool(\n        tool.name,\n        {\n          description: tool.description,\n          inputSchema: safeSchema,\n        },\n        async (args: unknown) => {\n          const toolArgs = (args ?? {}) as Record<string, unknown>\n\n          // Extract session token from args\n          const sessionToken = toolArgs._sessionToken as string | undefined\n          delete toolArgs._sessionToken // Remove before passing to tool handler\n\n          if (config.debug) {\n            console.error(`[MCP HTTP] Calling tool: ${tool.name}`, {\n              hasSessionToken: !!sessionToken,\n              args: JSON.stringify(toolArgs),\n            })\n          }\n\n          // Resolve user context from session token\n          let effectiveContext = toolContext\n          if (sessionToken) {\n            const sessionContext = await resolveSessionContext(sessionToken, toolContext, config.debug)\n            if (sessionContext) {\n              effectiveContext = sessionContext\n            } else {\n              // Session token expired - return user-friendly error for AI to relay\n              return {\n                content: [\n                  {\n                    type: 'text' as const,\n                    text: JSON.stringify({\n                      error: 'Your chat session has expired. Please close and reopen the chat window to continue.',\n                      code: 'SESSION_EXPIRED',\n                    }),\n                  },\n                ],\n                isError: true,\n              }\n            }\n          } else {\n            // No session token provided - reject if base context has no permissions\n            if (!effectiveContext.userId && effectiveContext.userFeatures.length === 0) {\n              return {\n                content: [\n                  {\n                    type: 'text' as const,\n                    text: JSON.stringify({\n                      error: 'Session token required (_sessionToken parameter)',\n                      code: 'UNAUTHORIZED',\n                    }),\n                  },\n                ],\n                isError: true,\n              }\n            }\n          }\n\n          // Check if user has required permissions for this tool\n          if (tool.requiredFeatures?.length) {\n            const hasAccess = hasRequiredFeatures(\n              tool.requiredFeatures,\n              effectiveContext.userFeatures,\n              effectiveContext.isSuperAdmin\n            )\n            if (!hasAccess) {\n              return {\n                content: [\n                  {\n                    type: 'text' as const,\n                    text: JSON.stringify({\n                      error: `Insufficient permissions for tool \"${tool.name}\". Required: ${tool.requiredFeatures.join(', ')}`,\n                      code: 'UNAUTHORIZED',\n                    }),\n                  },\n                ],\n                isError: true,\n              }\n            }\n          }\n\n          const result = await executeTool(tool.name, toolArgs, effectiveContext)\n\n          if (!result.success) {\n            return {\n              content: [\n                {\n                  type: 'text' as const,\n                  text: JSON.stringify({ error: result.error, code: result.errorCode }),\n                },\n              ],\n              isError: true,\n            }\n          }\n\n          return {\n            content: [\n              {\n                type: 'text' as const,\n                text: JSON.stringify(result.result, null, 2),\n              },\n            ],\n          }\n        }\n      )\n    } catch (error) {\n      // Skip tools with schemas that can't be registered\n      if (config.debug) {\n        console.error(\n          `[MCP HTTP] Skipping tool ${tool.name} - registration failed:`,\n          error instanceof Error ? error.message : error\n        )\n      }\n      continue\n    }\n  }\n\n  return server\n}\n\n/**\n * Maximum request body size (1MB).\n * Prevents memory exhaustion from oversized payloads.\n */\nconst MAX_BODY_SIZE = 1 * 1024 * 1024\n\n/**\n * Parse JSON body from request with size limit.\n */\nasync function parseJsonBody(req: IncomingMessage): Promise<unknown> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = []\n    let totalSize = 0\n\n    req.on('data', (chunk: Buffer) => {\n      totalSize += chunk.length\n      if (totalSize > MAX_BODY_SIZE) {\n        req.destroy()\n        reject(new Error('Request payload too large'))\n        return\n      }\n      chunks.push(chunk)\n    })\n    req.on('end', () => {\n      try {\n        const body = Buffer.concat(chunks).toString('utf-8')\n        resolve(body ? JSON.parse(body) : undefined)\n      } catch (error) {\n        reject(error)\n      }\n    })\n    req.on('error', reject)\n  })\n}\n\n/**\n * Run MCP server with HTTP transport (stateless mode).\n *\n * Each request creates a new MCP server instance and transport.\n * The server authenticates requests using API keys from the x-api-key header.\n */\nexport async function runMcpHttpServer(options: McpHttpServerOptions): Promise<void> {\n  const { config, container, port } = options\n\n  await loadAllModuleTools()\n\n  // Index tools and API endpoints for hybrid search discovery (if search service available)\n  try {\n    const searchService = container.resolve('searchService') as SearchService\n\n    // Index MCP tools\n    await indexToolsForSearch(searchService)\n\n    // Index API endpoints for api_discover\n    const { indexApiEndpoints } = await import('./api-endpoint-index')\n    const endpointCount = await indexApiEndpoints(searchService)\n    if (endpointCount > 0) {\n      console.error(`[MCP HTTP] Indexed ${endpointCount} API endpoints for hybrid search`)\n    }\n  } catch (error) {\n    // Search service might not be configured - discovery will use fallback\n    console.error('[MCP HTTP] Search indexing skipped (search service not available):', error)\n  }\n\n  const httpServer = createServer(async (req: IncomingMessage, res: ServerResponse) => {\n    const url = new URL(req.url || '/', `http://localhost:${port}`)\n\n    // Health check endpoint\n    if (url.pathname === '/health') {\n      res.writeHead(200, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({\n        status: 'ok',\n        tools: getToolRegistry().listToolNames().length,\n        timestamp: new Date().toISOString(),\n      }))\n      return\n    }\n\n    if (url.pathname !== '/mcp') {\n      res.writeHead(404, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'Not found' }))\n      return\n    }\n\n    // Extract headers\n    const headers: Record<string, string | undefined> = {}\n    for (const [key, value] of Object.entries(req.headers)) {\n      headers[key] = Array.isArray(value) ? value[0] : value\n    }\n\n    // Server-level authentication with static API key\n    const providedApiKey = extractApiKeyFromHeaders(headers)\n    if (!providedApiKey) {\n      res.writeHead(401, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'API key required (x-api-key header)' }))\n      return\n    }\n\n    // Check against static server API key (from env MCP_SERVER_API_KEY)\n    const serverApiKey = options.serverApiKey || process.env.MCP_SERVER_API_KEY\n    if (!serverApiKey) {\n      console.error('[MCP HTTP] Warning: MCP_SERVER_API_KEY not configured, rejecting all requests')\n      res.writeHead(500, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'MCP server not properly configured' }))\n      return\n    }\n\n    if (providedApiKey !== serverApiKey) {\n      res.writeHead(401, { 'Content-Type': 'application/json' })\n      res.end(JSON.stringify({ error: 'Invalid API key' }))\n      return\n    }\n\n    if (config.debug) {\n      console.error(`[MCP HTTP] Server-level auth passed (${req.method})`)\n    }\n\n    // Create base tool context (will be overridden by session token per-tool)\n    // Start with minimal permissions - session tokens provide user-level auth\n    const toolContext: McpToolContext = {\n      tenantId: null,\n      organizationId: null,\n      userId: null,\n      container,\n      userFeatures: [],\n      isSuperAdmin: false,\n      apiKeySecret: providedApiKey,\n    }\n\n    try {\n      // Create stateless transport (no session ID generator = stateless)\n      const transport = new StreamableHTTPServerTransport({\n        sessionIdGenerator: undefined,\n        enableJsonResponse: req.method === 'POST',\n      })\n\n      // Create new server for this request\n      const mcpServer = createMcpServerForRequest(config, toolContext)\n\n      if (config.debug) {\n        // Check registered tools on the server\n        const registeredTools = (mcpServer as any)._registeredTools || {}\n        console.error(`[MCP HTTP] Registered tools in McpServer:`, Object.keys(registeredTools))\n        console.error(`[MCP HTTP] Tool handlers initialized:`, (mcpServer as any)._toolHandlersInitialized)\n      }\n\n      // Connect server to transport\n      await mcpServer.connect(transport)\n\n      // Handle the request\n      if (req.method === 'POST') {\n        const body = await parseJsonBody(req)\n        await transport.handleRequest(req, res, body)\n      } else {\n        await transport.handleRequest(req, res)\n      }\n\n      // Cleanup after response finishes\n      res.on('finish', () => {\n        transport.close()\n        mcpServer.close()\n        if (config.debug) {\n          console.error(`[MCP HTTP] Request completed, cleaned up`)\n        }\n      })\n    } catch (error) {\n      console.error('[MCP HTTP] Error handling request:', error)\n      if (!res.headersSent) {\n        // Handle payload too large error\n        if (error instanceof Error && error.message === 'Request payload too large') {\n          res.writeHead(413, { 'Content-Type': 'application/json' })\n          res.end(JSON.stringify({ error: 'Request payload too large (max 1MB)' }))\n          return\n        }\n\n        res.writeHead(500, { 'Content-Type': 'application/json' })\n        res.end(\n          JSON.stringify({\n            jsonrpc: '2.0',\n            error: {\n              code: -32603,\n              message: `Internal server error: ${error instanceof Error ? error.message : String(error)}`,\n            },\n            id: null,\n          })\n        )\n      }\n    }\n  })\n\n  const toolCount = getToolRegistry().listToolNames().length\n  const serverKeyConfigured = !!(options.serverApiKey || process.env.MCP_SERVER_API_KEY)\n\n  console.error(`[MCP HTTP] Starting ${config.name} v${config.version}`)\n  console.error(`[MCP HTTP] Endpoint: http://localhost:${port}/mcp`)\n  console.error(`[MCP HTTP] Health: http://localhost:${port}/health`)\n  console.error(`[MCP HTTP] Tools registered: ${toolCount}`)\n  console.error(`[MCP HTTP] Mode: Stateless (new server per request)`)\n  console.error(`[MCP HTTP] Server Auth: ${serverKeyConfigured ? 'MCP_SERVER_API_KEY configured' : 'WARNING: MCP_SERVER_API_KEY not set!'}`)\n  console.error(`[MCP HTTP] User Auth: Session token in _sessionToken parameter`)\n\n  // Return a Promise that keeps the process alive until shutdown\n  return new Promise<void>((resolve) => {\n    httpServer.listen(port, () => {\n      console.error(`[MCP HTTP] Server listening on port ${port}`)\n    })\n\n    const shutdown = async () => {\n      console.error('[MCP HTTP] Shutting down...')\n      httpServer.close(() => {\n        console.error('[MCP HTTP] Server closed')\n        resolve()\n      })\n    }\n\n    process.on('SIGINT', shutdown)\n    process.on('SIGTERM', shutdown)\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAA+D;AACxE,SAAS,iBAAiB;AAC1B,SAAS,qCAAqC;AAG9C,SAAS,SAAuB;AAChC,SAAS,uBAAuB;AAChC,SAAS,mBAAmB;AAC5B,SAAS,oBAAoB,2BAA2B;AACxD,SAAiC,0BAA0B,2BAA2B;AACtF,SAAS,uBAAwC;AAIjD,SAAS,gCAAgC;AAiBzC,eAAe,sBACb,cACA,aACA,OACgC;AAChC,MAAI;AACF,UAAM,KAAK,YAAY,UAAU,QAAuB,IAAI;AAC5D,UAAM,cAAc,YAAY,UAAU,QAAqB,aAAa;AAG5E,UAAM,aAAa,MAAM,yBAAyB,IAAI,YAAY;AAClE,QAAI,CAAC,YAAY;AACf,UAAI,OAAO;AACT,gBAAQ,MAAM,kDAAkD,YAAY,EAAE;AAAA,MAChF;AACA,aAAO;AAAA,IACT;AAGA,UAAM,SAAS,WAAW,iBAAiB,WAAW;AACtD,QAAI,CAAC,QAAQ;AACX,UAAI,OAAO;AACT,gBAAQ,MAAM,+CAA+C;AAAA,MAC/D;AACA,aAAO;AAAA,IACT;AAEA,UAAM,MAAM,MAAM,YAAY,QAAQ,WAAW,WAAW,EAAE,IAAI;AAAA,MAChE,UAAU,WAAW,YAAY;AAAA,MACjC,gBAAgB,WAAW,kBAAkB;AAAA,IAC/C,CAAC;AAED,QAAI,OAAO;AACT,cAAQ,MAAM,gDAAgD,MAAM,KAAK;AAAA,QACvE,UAAU,WAAW;AAAA,QACrB,gBAAgB,WAAW;AAAA,QAC3B,UAAU,IAAI,SAAS;AAAA,QACvB,cAAc,IAAI;AAAA,MACpB,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,MACL,UAAU,WAAW,YAAY;AAAA,MACjC,gBAAgB,WAAW,kBAAkB;AAAA,MAC7C;AAAA,MACA,WAAW,YAAY;AAAA,MACvB,cAAc,IAAI;AAAA,MAClB,cAAc,IAAI;AAAA,MAClB,cAAc,YAAY;AAAA,IAC5B;AAAA,EACF,SAAS,OAAO;AACd,QAAI,OAAO;AACT,cAAQ,MAAM,+CAA+C,KAAK;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AACF;AAOA,SAAS,0BACP,QACA,aACW;AACX,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,OAAO,MAAM,SAAS,OAAO,QAAQ;AAAA,IAC7C,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EAChC;AAEA,QAAM,WAAW,gBAAgB;AACjC,QAAM,QAAQ,MAAM,KAAK,SAAS,SAAS,EAAE,OAAO,CAAC;AAErD,MAAI,OAAO,OAAO;AAChB,YAAQ,MAAM,0BAA0B,MAAM,MAAM,iDAAiD;AAAA,EACvG;AAGA,aAAW,QAAQ,OAAO;AACxB,QAAI,OAAO,OAAO;AAChB,cAAQ,MAAM,gCAAgC,KAAK,IAAI,EAAE;AAAA,IAC3D;AAKA,QAAI;AACJ,QAAI,KAAK,aAAa;AACpB,UAAI;AAEF,cAAM,aAAa,EAAE,aAAa,KAAK,aAAa,EAAE,iBAAiB,MAAM,CAAC;AAG9E,cAAM,aAAc,WAAW,cAAc,CAAC;AAC9C,mBAAW,gBAAgB;AAAA,UACzB,MAAM;AAAA,UACN,aAAa;AAAA,QACf;AACA,mBAAW,aAAa;AAGxB,cAAM,YAAY,gBAAgB,UAAU;AAE5C,qBAAc,UAA+B,YAAY;AAAA,MAC3D,SAAS,OAAO;AACd,YAAI,OAAO,OAAO;AAChB,kBAAQ;AAAA,YACN,4BAA4B,KAAK,IAAI;AAAA,YACrC,iBAAiB,QAAQ,MAAM,UAAU;AAAA,UAC3C;AAAA,QACF;AACA;AAAA,MACF;AAAA,IACF,OAAO;AAEL,mBAAa,EAAE,OAAO;AAAA,QACpB,eAAe,EACZ,OAAO,EACP,SAAS,EACT,SAAS,2DAA2D;AAAA,MACzE,CAAC;AAAA,IACH;AAGA,QAAI;AACF,aAAO;AAAA,QACL,KAAK;AAAA,QACL;AAAA,UACE,aAAa,KAAK;AAAA,UAClB,aAAa;AAAA,QACf;AAAA,QACA,OAAO,SAAkB;AACvB,gBAAM,WAAY,QAAQ,CAAC;AAG3B,gBAAM,eAAe,SAAS;AAC9B,iBAAO,SAAS;AAEhB,cAAI,OAAO,OAAO;AAChB,oBAAQ,MAAM,4BAA4B,KAAK,IAAI,IAAI;AAAA,cACrD,iBAAiB,CAAC,CAAC;AAAA,cACnB,MAAM,KAAK,UAAU,QAAQ;AAAA,YAC/B,CAAC;AAAA,UACH;AAGA,cAAI,mBAAmB;AACvB,cAAI,cAAc;AAChB,kBAAM,iBAAiB,MAAM,sBAAsB,cAAc,aAAa,OAAO,KAAK;AAC1F,gBAAI,gBAAgB;AAClB,iCAAmB;AAAA,YACrB,OAAO;AAEL,qBAAO;AAAA,gBACL,SAAS;AAAA,kBACP;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM,KAAK,UAAU;AAAA,sBACnB,OAAO;AAAA,sBACP,MAAM;AAAA,oBACR,CAAC;AAAA,kBACH;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF,OAAO;AAEL,gBAAI,CAAC,iBAAiB,UAAU,iBAAiB,aAAa,WAAW,GAAG;AAC1E,qBAAO;AAAA,gBACL,SAAS;AAAA,kBACP;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM,KAAK,UAAU;AAAA,sBACnB,OAAO;AAAA,sBACP,MAAM;AAAA,oBACR,CAAC;AAAA,kBACH;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF;AAGA,cAAI,KAAK,kBAAkB,QAAQ;AACjC,kBAAM,YAAY;AAAA,cAChB,KAAK;AAAA,cACL,iBAAiB;AAAA,cACjB,iBAAiB;AAAA,YACnB;AACA,gBAAI,CAAC,WAAW;AACd,qBAAO;AAAA,gBACL,SAAS;AAAA,kBACP;AAAA,oBACE,MAAM;AAAA,oBACN,MAAM,KAAK,UAAU;AAAA,sBACnB,OAAO,sCAAsC,KAAK,IAAI,gBAAgB,KAAK,iBAAiB,KAAK,IAAI,CAAC;AAAA,sBACtG,MAAM;AAAA,oBACR,CAAC;AAAA,kBACH;AAAA,gBACF;AAAA,gBACA,SAAS;AAAA,cACX;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,SAAS,MAAM,YAAY,KAAK,MAAM,UAAU,gBAAgB;AAEtE,cAAI,CAAC,OAAO,SAAS;AACnB,mBAAO;AAAA,cACL,SAAS;AAAA,gBACP;AAAA,kBACE,MAAM;AAAA,kBACN,MAAM,KAAK,UAAU,EAAE,OAAO,OAAO,OAAO,MAAM,OAAO,UAAU,CAAC;AAAA,gBACtE;AAAA,cACF;AAAA,cACA,SAAS;AAAA,YACX;AAAA,UACF;AAEA,iBAAO;AAAA,YACL,SAAS;AAAA,cACP;AAAA,gBACE,MAAM;AAAA,gBACN,MAAM,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC;AAAA,cAC7C;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AAEd,UAAI,OAAO,OAAO;AAChB,gBAAQ;AAAA,UACN,4BAA4B,KAAK,IAAI;AAAA,UACrC,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QAC3C;AAAA,MACF;AACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAMA,MAAM,gBAAgB,IAAI,OAAO;AAKjC,eAAe,cAAc,KAAwC;AACnE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,YAAY;AAEhB,QAAI,GAAG,QAAQ,CAAC,UAAkB;AAChC,mBAAa,MAAM;AACnB,UAAI,YAAY,eAAe;AAC7B,YAAI,QAAQ;AACZ,eAAO,IAAI,MAAM,2BAA2B,CAAC;AAC7C;AAAA,MACF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB,CAAC;AACD,QAAI,GAAG,OAAO,MAAM;AAClB,UAAI;AACF,cAAM,OAAO,OAAO,OAAO,MAAM,EAAE,SAAS,OAAO;AACnD,gBAAQ,OAAO,KAAK,MAAM,IAAI,IAAI,MAAS;AAAA,MAC7C,SAAS,OAAO;AACd,eAAO,KAAK;AAAA,MACd;AAAA,IACF,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAQA,eAAsB,iBAAiB,SAA8C;AACnF,QAAM,EAAE,QAAQ,WAAW,KAAK,IAAI;AAEpC,QAAM,mBAAmB;AAGzB,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,eAAe;AAGvD,UAAM,oBAAoB,aAAa;AAGvC,UAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,sBAAsB;AACjE,UAAM,gBAAgB,MAAM,kBAAkB,aAAa;AAC3D,QAAI,gBAAgB,GAAG;AACrB,cAAQ,MAAM,sBAAsB,aAAa,kCAAkC;AAAA,IACrF;AAAA,EACF,SAAS,OAAO;AAEd,YAAQ,MAAM,sEAAsE,KAAK;AAAA,EAC3F;AAEA,QAAM,aAAa,aAAa,OAAO,KAAsB,QAAwB;AACnF,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,oBAAoB,IAAI,EAAE;AAG9D,QAAI,IAAI,aAAa,WAAW;AAC9B,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO,gBAAgB,EAAE,cAAc,EAAE;AAAA,QACzC,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC,CAAC;AACF;AAAA,IACF;AAEA,QAAI,IAAI,aAAa,QAAQ;AAC3B,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,YAAY,CAAC,CAAC;AAC9C;AAAA,IACF;AAGA,UAAM,UAA8C,CAAC;AACrD,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AACtD,cAAQ,GAAG,IAAI,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AAAA,IACnD;AAGA,UAAM,iBAAiB,yBAAyB,OAAO;AACvD,QAAI,CAAC,gBAAgB;AACnB,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sCAAsC,CAAC,CAAC;AACxE;AAAA,IACF;AAGA,UAAM,eAAe,QAAQ,gBAAgB,QAAQ,IAAI;AACzD,QAAI,CAAC,cAAc;AACjB,cAAQ,MAAM,+EAA+E;AAC7F,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,qCAAqC,CAAC,CAAC;AACvE;AAAA,IACF;AAEA,QAAI,mBAAmB,cAAc;AACnC,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AACpD;AAAA,IACF;AAEA,QAAI,OAAO,OAAO;AAChB,cAAQ,MAAM,wCAAwC,IAAI,MAAM,GAAG;AAAA,IACrE;AAIA,UAAM,cAA8B;AAAA,MAClC,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,QAAQ;AAAA,MACR;AAAA,MACA,cAAc,CAAC;AAAA,MACf,cAAc;AAAA,MACd,cAAc;AAAA,IAChB;AAEA,QAAI;AAEF,YAAM,YAAY,IAAI,8BAA8B;AAAA,QAClD,oBAAoB;AAAA,QACpB,oBAAoB,IAAI,WAAW;AAAA,MACrC,CAAC;AAGD,YAAM,YAAY,0BAA0B,QAAQ,WAAW;AAE/D,UAAI,OAAO,OAAO;AAEhB,cAAM,kBAAmB,UAAkB,oBAAoB,CAAC;AAChE,gBAAQ,MAAM,6CAA6C,OAAO,KAAK,eAAe,CAAC;AACvF,gBAAQ,MAAM,yCAA0C,UAAkB,wBAAwB;AAAA,MACpG;AAGA,YAAM,UAAU,QAAQ,SAAS;AAGjC,UAAI,IAAI,WAAW,QAAQ;AACzB,cAAM,OAAO,MAAM,cAAc,GAAG;AACpC,cAAM,UAAU,cAAc,KAAK,KAAK,IAAI;AAAA,MAC9C,OAAO;AACL,cAAM,UAAU,cAAc,KAAK,GAAG;AAAA,MACxC;AAGA,UAAI,GAAG,UAAU,MAAM;AACrB,kBAAU,MAAM;AAChB,kBAAU,MAAM;AAChB,YAAI,OAAO,OAAO;AAChB,kBAAQ,MAAM,0CAA0C;AAAA,QAC1D;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,sCAAsC,KAAK;AACzD,UAAI,CAAC,IAAI,aAAa;AAEpB,YAAI,iBAAiB,SAAS,MAAM,YAAY,6BAA6B;AAC3E,cAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,cAAI,IAAI,KAAK,UAAU,EAAE,OAAO,sCAAsC,CAAC,CAAC;AACxE;AAAA,QACF;AAEA,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI;AAAA,UACF,KAAK,UAAU;AAAA,YACb,SAAS;AAAA,YACT,OAAO;AAAA,cACL,MAAM;AAAA,cACN,SAAS,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,YAC3F;AAAA,YACA,IAAI;AAAA,UACN,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,YAAY,gBAAgB,EAAE,cAAc,EAAE;AACpD,QAAM,sBAAsB,CAAC,EAAE,QAAQ,gBAAgB,QAAQ,IAAI;AAEnE,UAAQ,MAAM,uBAAuB,OAAO,IAAI,KAAK,OAAO,OAAO,EAAE;AACrE,UAAQ,MAAM,yCAAyC,IAAI,MAAM;AACjE,UAAQ,MAAM,uCAAuC,IAAI,SAAS;AAClE,UAAQ,MAAM,gCAAgC,SAAS,EAAE;AACzD,UAAQ,MAAM,qDAAqD;AACnE,UAAQ,MAAM,2BAA2B,sBAAsB,kCAAkC,sCAAsC,EAAE;AACzI,UAAQ,MAAM,gEAAgE;AAG9E,SAAO,IAAI,QAAc,CAAC,YAAY;AACpC,eAAW,OAAO,MAAM,MAAM;AAC5B,cAAQ,MAAM,uCAAuC,IAAI,EAAE;AAAA,IAC7D,CAAC;AAED,UAAM,WAAW,YAAY;AAC3B,cAAQ,MAAM,6BAA6B;AAC3C,iBAAW,MAAM,MAAM;AACrB,gBAAQ,MAAM,0BAA0B;AACxC,gBAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,YAAQ,GAAG,UAAU,QAAQ;AAC7B,YAAQ,GAAG,WAAW,QAAQ;AAAA,EAChC,CAAC;AACH;",
+  "names": []
+}

package/dist/modules/ai_assistant/lib/in-process-client.js

@@ -0,0 +1,126 @@
+import { zodToJsonSchema } from "zod-to-json-schema";
+import { getToolRegistry } from "./tool-registry.js";
+import { executeTool } from "./tool-executor.js";
+import { loadAllModuleTools } from "./tool-loader.js";
+import { authenticateMcpRequest, hasRequiredFeatures } from "./auth.js";
+class InProcessMcpClient {
+  constructor(auth, container) {
+    this.toolsLoaded = false;
+    this.auth = auth;
+    this.container = container;
+    this.toolContext = {
+      tenantId: auth.tenantId,
+      organizationId: auth.organizationId,
+      userId: auth.userId,
+      container,
+      userFeatures: auth.features,
+      isSuperAdmin: auth.isSuperAdmin
+    };
+  }
+  /**
+   * Create and authenticate an in-process client using API key.
+   */
+  static async create(options) {
+    const { apiKeySecret, container } = options;
+    const authResult = await authenticateMcpRequest(apiKeySecret, container);
+    if (!authResult.success) {
+      throw new Error(`Authentication failed: ${authResult.error}`);
+    }
+    return new InProcessMcpClient(authResult, container);
+  }
+  /**
+   * Create an in-process client with pre-authenticated context.
+   * Use this when you already have user auth context (e.g., from session auth).
+   */
+  static async createWithAuthContext(options) {
+    const { container, authContext } = options;
+    const syntheticAuth = {
+      success: true,
+      keyId: "session-auth",
+      keyName: "Session Authentication",
+      tenantId: authContext.tenantId,
+      organizationId: authContext.organizationId,
+      userId: authContext.userId,
+      features: authContext.userFeatures,
+      isSuperAdmin: authContext.isSuperAdmin
+    };
+    return new InProcessMcpClient(syntheticAuth, container);
+  }
+  /**
+   * Ensure tools are loaded from all modules.
+   */
+  async ensureToolsLoaded() {
+    if (!this.toolsLoaded) {
+      await loadAllModuleTools();
+      this.toolsLoaded = true;
+    }
+  }
+  /**
+   * List available tools filtered by API key's permissions.
+   * Returns JSON Schema format (for MCP protocol compatibility).
+   */
+  async listTools() {
+    await this.ensureToolsLoaded();
+    const registry = getToolRegistry();
+    const tools = Array.from(registry.getTools().values());
+    const accessibleTools = tools.filter(
+      (tool) => hasRequiredFeatures(tool.requiredFeatures, this.auth.features, this.auth.isSuperAdmin)
+    );
+    return accessibleTools.map((tool) => ({
+      name: tool.name,
+      description: tool.description,
+      inputSchema: zodToJsonSchema(tool.inputSchema)
+    }));
+  }
+  /**
+   * List available tools with raw Zod schemas.
+   * Use this for AI SDK integration which requires Zod schemas.
+   */
+  async listToolsWithSchemas() {
+    await this.ensureToolsLoaded();
+    const registry = getToolRegistry();
+    const tools = Array.from(registry.getTools().values());
+    const accessibleTools = tools.filter(
+      (tool) => hasRequiredFeatures(tool.requiredFeatures, this.auth.features, this.auth.isSuperAdmin)
+    );
+    return accessibleTools.map((tool) => ({
+      name: tool.name,
+      description: tool.description,
+      inputSchema: tool.inputSchema
+    }));
+  }
+  /**
+   * Execute a tool directly.
+   */
+  async callTool(name, args) {
+    await this.ensureToolsLoaded();
+    const result = await executeTool(name, args ?? {}, this.toolContext);
+    return {
+      success: result.success,
+      result: result.result,
+      error: result.error
+    };
+  }
+  /**
+   * Close the client (no-op for in-process).
+   */
+  async close() {
+  }
+  /**
+   * Get the authenticated context info.
+   */
+  getAuthInfo() {
+    return {
+      keyId: this.auth.keyId,
+      keyName: this.auth.keyName,
+      tenantId: this.auth.tenantId,
+      organizationId: this.auth.organizationId,
+      userId: this.auth.userId,
+      isSuperAdmin: this.auth.isSuperAdmin
+    };
+  }
+}
+export {
+  InProcessMcpClient
+};
+//# sourceMappingURL=in-process-client.js.map

package/dist/modules/ai_assistant/lib/in-process-client.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/ai_assistant/lib/in-process-client.ts"],
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport type { z } from 'zod'\nimport { zodToJsonSchema } from 'zod-to-json-schema'\nimport { getToolRegistry } from './tool-registry'\nimport { executeTool } from './tool-executor'\nimport { loadAllModuleTools } from './tool-loader'\nimport { authenticateMcpRequest, hasRequiredFeatures, type McpAuthSuccess } from './auth'\nimport type { McpToolContext, McpClientInterface, ToolInfo, ToolResult, McpToolDefinition } from './types'\n\n/**\n * Options for creating an in-process MCP client.\n */\nexport type InProcessClientOptions = {\n  /** API key secret for authentication */\n  apiKeySecret: string\n  /** DI container */\n  container: AwilixContainer\n}\n\n/**\n * Options for creating an in-process MCP client with direct auth context.\n * Used when the caller already has authenticated user context (e.g., from session).\n */\nexport type AuthContextOptions = {\n  /** DI container */\n  container: AwilixContainer\n  /** Pre-authenticated user context */\n  authContext: {\n    tenantId: string | null\n    organizationId: string | null\n    userId: string\n    userFeatures: string[]\n    isSuperAdmin: boolean\n  }\n}\n\n/**\n * Tool info with raw Zod schema for AI SDK integration.\n */\nexport type ToolInfoWithSchema = {\n  name: string\n  description: string\n  inputSchema: z.ZodType<unknown>\n}\n\n/**\n * In-process MCP client for direct tool execution.\n *\n * This client executes tools directly without MCP protocol overhead,\n * making it the fastest option when running in the same process as\n * the LLM service.\n *\n * Authentication is still performed via API key to ensure proper\n * ACL filtering of available tools.\n */\nexport class InProcessMcpClient implements McpClientInterface {\n  private auth: McpAuthSuccess\n  private container: AwilixContainer\n  private toolContext: McpToolContext\n  private toolsLoaded = false\n\n  private constructor(auth: McpAuthSuccess, container: AwilixContainer) {\n    this.auth = auth\n    this.container = container\n    this.toolContext = {\n      tenantId: auth.tenantId,\n      organizationId: auth.organizationId,\n      userId: auth.userId,\n      container,\n      userFeatures: auth.features,\n      isSuperAdmin: auth.isSuperAdmin,\n    }\n  }\n\n  /**\n   * Create and authenticate an in-process client using API key.\n   */\n  static async create(options: InProcessClientOptions): Promise<InProcessMcpClient> {\n    const { apiKeySecret, container } = options\n\n    const authResult = await authenticateMcpRequest(apiKeySecret, container)\n    if (!authResult.success) {\n      throw new Error(`Authentication failed: ${authResult.error}`)\n    }\n\n    return new InProcessMcpClient(authResult, container)\n  }\n\n  /**\n   * Create an in-process client with pre-authenticated context.\n   * Use this when you already have user auth context (e.g., from session auth).\n   */\n  static async createWithAuthContext(options: AuthContextOptions): Promise<InProcessMcpClient> {\n    const { container, authContext } = options\n\n    // Create a synthetic auth result (no API key lookup needed)\n    const syntheticAuth: McpAuthSuccess = {\n      success: true,\n      keyId: 'session-auth',\n      keyName: 'Session Authentication',\n      tenantId: authContext.tenantId,\n      organizationId: authContext.organizationId,\n      userId: authContext.userId,\n      features: authContext.userFeatures,\n      isSuperAdmin: authContext.isSuperAdmin,\n    }\n\n    return new InProcessMcpClient(syntheticAuth, container)\n  }\n\n  /**\n   * Ensure tools are loaded from all modules.\n   */\n  private async ensureToolsLoaded(): Promise<void> {\n    if (!this.toolsLoaded) {\n      await loadAllModuleTools()\n      this.toolsLoaded = true\n    }\n  }\n\n  /**\n   * List available tools filtered by API key's permissions.\n   * Returns JSON Schema format (for MCP protocol compatibility).\n   */\n  async listTools(): Promise<ToolInfo[]> {\n    await this.ensureToolsLoaded()\n\n    const registry = getToolRegistry()\n    const tools = Array.from(registry.getTools().values())\n\n    const accessibleTools = tools.filter((tool) =>\n      hasRequiredFeatures(tool.requiredFeatures, this.auth.features, this.auth.isSuperAdmin)\n    )\n\n    return accessibleTools.map((tool) => ({\n      name: tool.name,\n      description: tool.description,\n      inputSchema: zodToJsonSchema(tool.inputSchema as any) as Record<string, unknown>,\n    }))\n  }\n\n  /**\n   * List available tools with raw Zod schemas.\n   * Use this for AI SDK integration which requires Zod schemas.\n   */\n  async listToolsWithSchemas(): Promise<ToolInfoWithSchema[]> {\n    await this.ensureToolsLoaded()\n\n    const registry = getToolRegistry()\n    const tools = Array.from(registry.getTools().values())\n\n    const accessibleTools = tools.filter((tool) =>\n      hasRequiredFeatures(tool.requiredFeatures, this.auth.features, this.auth.isSuperAdmin)\n    )\n\n    return accessibleTools.map((tool) => ({\n      name: tool.name,\n      description: tool.description,\n      inputSchema: tool.inputSchema,\n    }))\n  }\n\n  /**\n   * Execute a tool directly.\n   */\n  async callTool(name: string, args: unknown): Promise<ToolResult> {\n    await this.ensureToolsLoaded()\n\n    const result = await executeTool(name, args ?? {}, this.toolContext)\n\n    return {\n      success: result.success,\n      result: result.result,\n      error: result.error,\n    }\n  }\n\n  /**\n   * Close the client (no-op for in-process).\n   */\n  async close(): Promise<void> {\n    // No resources to clean up for in-process client\n  }\n\n  /**\n   * Get the authenticated context info.\n   */\n  getAuthInfo(): {\n    keyId: string\n    keyName: string\n    tenantId: string | null\n    organizationId: string | null\n    userId: string\n    isSuperAdmin: boolean\n  } {\n    return {\n      keyId: this.auth.keyId,\n      keyName: this.auth.keyName,\n      tenantId: this.auth.tenantId,\n      organizationId: this.auth.organizationId,\n      userId: this.auth.userId,\n      isSuperAdmin: this.auth.isSuperAdmin,\n    }\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,uBAAuB;AAChC,SAAS,uBAAuB;AAChC,SAAS,mBAAmB;AAC5B,SAAS,0BAA0B;AACnC,SAAS,wBAAwB,2BAAgD;AAiD1E,MAAM,mBAAiD;AAAA,EAMpD,YAAY,MAAsB,WAA4B;AAFtE,SAAQ,cAAc;AAGpB,SAAK,OAAO;AACZ,SAAK,YAAY;AACjB,SAAK,cAAc;AAAA,MACjB,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK;AAAA,MACb;AAAA,MACA,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,OAAO,SAA8D;AAChF,UAAM,EAAE,cAAc,UAAU,IAAI;AAEpC,UAAM,aAAa,MAAM,uBAAuB,cAAc,SAAS;AACvE,QAAI,CAAC,WAAW,SAAS;AACvB,YAAM,IAAI,MAAM,0BAA0B,WAAW,KAAK,EAAE;AAAA,IAC9D;AAEA,WAAO,IAAI,mBAAmB,YAAY,SAAS;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa,sBAAsB,SAA0D;AAC3F,UAAM,EAAE,WAAW,YAAY,IAAI;AAGnC,UAAM,gBAAgC;AAAA,MACpC,SAAS;AAAA,MACT,OAAO;AAAA,MACP,SAAS;AAAA,MACT,UAAU,YAAY;AAAA,MACtB,gBAAgB,YAAY;AAAA,MAC5B,QAAQ,YAAY;AAAA,MACpB,UAAU,YAAY;AAAA,MACtB,cAAc,YAAY;AAAA,IAC5B;AAEA,WAAO,IAAI,mBAAmB,eAAe,SAAS;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,oBAAmC;AAC/C,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,mBAAmB;AACzB,WAAK,cAAc;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAiC;AACrC,UAAM,KAAK,kBAAkB;AAE7B,UAAM,WAAW,gBAAgB;AACjC,UAAM,QAAQ,MAAM,KAAK,SAAS,SAAS,EAAE,OAAO,CAAC;AAErD,UAAM,kBAAkB,MAAM;AAAA,MAAO,CAAC,SACpC,oBAAoB,KAAK,kBAAkB,KAAK,KAAK,UAAU,KAAK,KAAK,YAAY;AAAA,IACvF;AAEA,WAAO,gBAAgB,IAAI,CAAC,UAAU;AAAA,MACpC,MAAM,KAAK;AAAA,MACX,aAAa,KAAK;AAAA,MAClB,aAAa,gBAAgB,KAAK,WAAkB;AAAA,IACtD,EAAE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,uBAAsD;AAC1D,UAAM,KAAK,kBAAkB;AAE7B,UAAM,WAAW,gBAAgB;AACjC,UAAM,QAAQ,MAAM,KAAK,SAAS,SAAS,EAAE,OAAO,CAAC;AAErD,UAAM,kBAAkB,MAAM;AAAA,MAAO,CAAC,SACpC,oBAAoB,KAAK,kBAAkB,KAAK,KAAK,UAAU,KAAK,KAAK,YAAY;AAAA,IACvF;AAEA,WAAO,gBAAgB,IAAI,CAAC,UAAU;AAAA,MACpC,MAAM,KAAK;AAAA,MACX,aAAa,KAAK;AAAA,MAClB,aAAa,KAAK;AAAA,IACpB,EAAE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAS,MAAc,MAAoC;AAC/D,UAAM,KAAK,kBAAkB;AAE7B,UAAM,SAAS,MAAM,YAAY,MAAM,QAAQ,CAAC,GAAG,KAAK,WAAW;AAEnE,WAAO;AAAA,MACL,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,MACf,OAAO,OAAO;AAAA,IAChB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAuB;AAAA,EAE7B;AAAA;AAAA;AAAA;AAAA,EAKA,cAOE;AACA,WAAO;AAAA,MACL,OAAO,KAAK,KAAK;AAAA,MACjB,SAAS,KAAK,KAAK;AAAA,MACnB,UAAU,KAAK,KAAK;AAAA,MACpB,gBAAgB,KAAK,KAAK;AAAA,MAC1B,QAAQ,KAAK,KAAK;AAAA,MAClB,cAAc,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AACF;",
+  "names": []
+}