@provos/ironcurtain 0.7.2 → 0.9.0

package/dist/pipeline/list-resolver.d.ts

@@ -7,41 +7,39 @@
  * structured response.
  *
  * For data-backed lists (requiresMcp: true): gives the LLM access to
- * MCP tools (via tool-use) so it can query live data sources, then
- * parses the final text response for the structured list values.
+ * MCP tools exposed through a proxy connection, then parses the final
+ * text response for the structured list values.
  *
  * Applies type-specific validation to filter malformed values.
  * Preserves manual overrides from any existing resolution.
  */
 import type { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import type { LanguageModel } from 'ai';
+import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { LanguageModel, ToolSet } from 'ai';
 import type { ListDefinition, ResolvedList, DynamicListsFile } from './types.js';
-/**
- * Shape of a pre-connected MCP server with its discovered tools.
- * Matches the ServerConnection pattern from annotate.ts.
- */
-export interface McpServerConnection {
-    readonly client: Client;
-    readonly tools: ReadonlyArray<{
-        name: string;
-        description?: string;
-        inputSchema: Record<string, unknown>;
-    }>;
-}
 export interface ListResolverConfig {
     readonly model: LanguageModel;
     /**
-     * Optional pre-connected MCP clients for data-backed list resolution.
-     * Keyed by server name. When undefined, lists with requiresMcp: true
-     * fail with a descriptive error.
+     * Optional proxy connection for data-backed list resolution.
+     * The proxy handles policy mediation, OAuth, and sandbox containment
+     * internally -- tools are already filtered.
      */
-    readonly mcpConnections?: ReadonlyMap<string, McpServerConnection>;
+    readonly proxyConnection?: {
+        readonly client: Client;
+        readonly tools: ReadonlyArray<Tool>;
+    };
 }
+/**
+ * Bridges proxy-exposed MCP tools as AI SDK tools. The proxy handles
+ * policy evaluation internally, so these wrappers simply forward
+ * calls to the MCP client.
+ */
+export declare function bridgeProxyTools(client: Client, tools: ReadonlyArray<Tool>): ToolSet;
 /**
  * Resolves a single list definition to concrete values.
  *
  * For knowledge-based lists: uses structured LLM output.
- * For data-backed lists: gives the LLM MCP tools, then parses the result.
+ * For data-backed lists: bridges proxy tools as AI SDK tools for LLM tool-use.
  *
  * Applies type-specific validation to filter malformed values.
  * Preserves manual overrides from any existing resolution.

package/dist/pipeline/list-resolver.js

@@ -7,8 +7,8 @@
  * structured response.
  *
  * For data-backed lists (requiresMcp: true): gives the LLM access to
- * MCP tools (via tool-use) so it can query live data sources, then
- * parses the final text response for the structured list values.
+ * MCP tools exposed through a proxy connection, then parses the final
+ * text response for the structured list values.
  *
  * Applies type-specific validation to filter malformed values.
  * Preserves manual overrides from any existing resolution.
@@ -87,20 +87,20 @@ async function resolveViaLlm(prompt, model, onProgress) {
 /** Maximum tool-use steps for MCP-backed resolution. */
 const MAX_MCP_TOOL_STEPS = 5;
 /**
- * Bridges MCP server tools as AI SDK tools with execute functions
- * that forward calls to the MCP client.
+ * Bridges proxy-exposed MCP tools as AI SDK tools. The proxy handles
+ * policy evaluation internally, so these wrappers simply forward
+ * calls to the MCP client.
  */
-function bridgeMcpTools(serverName, connection) {
-    const tools = {};
-    for (const mcpTool of connection.tools) {
-        const qualifiedName = `${serverName}__${mcpTool.name}`;
+export function bridgeProxyTools(client, tools) {
+    const bridged = {};
+    for (const mcpTool of tools) {
         // Ensure the input schema has "type": "object" (some MCP servers omit it)
         const schema = { type: 'object', ...mcpTool.inputSchema };
-        tools[qualifiedName] = tool({
+        bridged[mcpTool.name] = tool({
             description: mcpTool.description ?? `Tool: ${mcpTool.name}`,
             inputSchema: jsonSchema(schema),
             execute: async (args) => {
-                const result = await connection.client.callTool({
+                const result = await client.callTool({
                     name: mcpTool.name,
                     arguments: args,
                 });
@@ -115,25 +115,7 @@ function bridgeMcpTools(serverName, connection) {
             },
         });
     }
-    return tools;
-}
-/**
- * Selects which MCP connection to use for a definition.
- * Prefers mcpServerHint if it matches a connected server; otherwise
- * uses the first available connection.
- */
-function selectMcpConnection(definition, connections) {
-    if (definition.mcpServerHint) {
-        const connection = connections.get(definition.mcpServerHint);
-        if (connection)
-            return { serverName: definition.mcpServerHint, connection };
-    }
-    // Fall back to first available connection
-    const first = connections.entries().next();
-    if (!first.done) {
-        return { serverName: first.value[0], connection: first.value[1] };
-    }
-    return undefined;
+    return bridged;
 }
 /**
  * Resolves a data-backed list by giving the LLM access to MCP tools.
@@ -152,7 +134,14 @@ async function resolveViaMcpTools(prompt, model, mcpTools, onProgress) {
     const parsed = parseValuesFromText(result.text);
     if (parsed.length > 0)
         return parsed;
-    // If parsing failed, return empty with a warning
+    // Check if the LLM's response indicates all tool calls failed (e.g., missing OAuth, auth errors)
+    const errorPatterns = /\b(Error|Login Required|No refresh token|authentication failed|unauthorized)\b/i;
+    if (errorPatterns.test(result.text)) {
+        // Extract a short excerpt for the error message
+        const excerpt = result.text.slice(0, 300).replace(/\n/g, ' ').trim();
+        throw new Error(`MCP-backed list resolution failed — LLM reported errors: ${excerpt}`);
+    }
+    // If parsing failed but no errors detected, warn and return empty
     console.error(`  Warning: Could not parse list values from MCP-backed resolution text`);
     return [];
 }
@@ -195,7 +184,7 @@ function parseValuesFromText(text) {
  * Resolves a single list definition to concrete values.
  *
  * For knowledge-based lists: uses structured LLM output.
- * For data-backed lists: gives the LLM MCP tools, then parses the result.
+ * For data-backed lists: bridges proxy tools as AI SDK tools for LLM tool-use.
  *
  * Applies type-specific validation to filter malformed values.
  * Preserves manual overrides from any existing resolution.
@@ -205,13 +194,16 @@ export async function resolveList(definition, config, existing, onProgress) {
     const prompt = buildResolutionPrompt(definition);
     let rawValues;
     if (definition.requiresMcp) {
-        const selected = config.mcpConnections ? selectMcpConnection(definition, config.mcpConnections) : undefined;
-        if (!selected) {
+        if (!config.proxyConnection) {
+            throw new Error(`List "@${definition.name}" requires MCP access but no proxy connection ` +
+                `was provided. Ensure MCP servers are available (use --no-mcp to skip).`);
+        }
+        if (config.proxyConnection.tools.length === 0) {
             throw new Error(`List "@${definition.name}" requires MCP server access (requiresMcp: true) ` +
-                `but no MCP clients are available. Run with --with-mcp or ensure the ` +
-                `"${definition.mcpServerHint ?? 'required'}" MCP server is configured and reachable.`);
+                `but no MCP tools are available through the proxy. ` +
+                `Ensure the "${definition.mcpServerHint ?? 'required'}" MCP server is configured and reachable.`);
         }
-        const mcpTools = bridgeMcpTools(selected.serverName, selected.connection);
+        const mcpTools = bridgeProxyTools(config.proxyConnection.client, config.proxyConnection.tools);
         rawValues = await resolveViaMcpTools(prompt, config.model, mcpTools, onProgress);
     }
     else {

package/dist/pipeline/list-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-resolver.js","sourceRoot":"","sources":["../../src/pipeline/list-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AA2BnD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC;CACpE,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,qBAAqB,CAAC,UAA0B;IACvD,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,EAAE,CAAC;IACrD,OAAO,GAAG,UAAU,CAAC,gBAAgB,OAAO,cAAc,EAAE,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,UAA0B;IACjD,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACjD,OAAO,WAAW,CAChB,UAAU,CAAC,IAAI,EACf,UAAU,CAAC,IAAI,EACf,UAAU,CAAC,gBAAgB,EAC3B,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,EAC9B,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,SAAmB,EAAE,UAA0B,EAAE,QAAuB;IAC3F,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEnD,wCAAwC;IACxC,MAAM,WAAW,GAAG;QAClB,GAAG,IAAI,GAAG,CACR,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,IAAI,WAAW,CAAC,WAAW,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CACH;KACF,CAAC;IAEF,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED,kDAAkD;IAClD,MAAM,eAAe,GAAG,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAC1B,MAAc,EACd,KAAoB,EACpB,UAAsC;IAEtC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAChD,KAAK;QACL,MAAM,EAAE,kBAAkB;QAC1B,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,wDAAwD;AACxD,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B;;;GAGG;AACH,SAAS,cAAc,CAAC,UAAkB,EAAE,UAA+B;IACzE,MAAM,KAAK,GAAY,EAAE,CAAC;IAC1B,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG,GAAG,UAAU,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QACvD,0EAA0E;QAC1E,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAEnE,KAAK,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,SAAS,OAAO,CAAC,IAAI,EAAE;YAC3D,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,IAAa,EAAE,EAAE;gBAC/B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;oBAC9C,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,SAAS,EAAE,IAA+B;iBAC3C,CAAC,CAAC;gBACH,8CAA8C;gBAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClC,OAAO,MAAM,CAAC,OAAO;yBAClB,MAAM,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;yBAClD,GAAG,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;yBACpC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;gBACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxC,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,UAA0B,EAC1B,WAAqD;IAErD,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC7D,IAAI,UAAU;YAAE,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,aAAa,EAAE,UAAU,EAAE,CAAC;IAC9E,CAAC;IACD,0CAA0C;IAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,MAAc,EACd,KAAoB,EACpB,QAAiB,EACjB,UAAsC;IAEtC,UAAU,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,KAAK;QACL,KAAK,EAAE,QAAQ;QACf,QAAQ,EAAE,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,MAAM,gMAAgM;QACjN,eAAe,EAAE,IAAI;KACtB,CAAC,CAAC;IAEH,sDAAsD;IACtD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAErC,iDAAiD;IACjD,OAAO,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;IACxF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,kEAAkE;AAClE,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qEAAqE;AACrE,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,4DAA4D;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC/E,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,kBAAkB,CAAE,MAA2C,EAAE,MAAM,CAAC,CAAC;QACxF,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAED,8CAA8C;IAC9C,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAA0B,EAC1B,MAA0B,EAC1B,QAAuB,EACvB,UAAsC;IAEtC,UAAU,EAAE,CAAC,cAAc,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC;IAEjD,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,SAAmB,CAAC;IAExB,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE5G,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,UAAU,UAAU,CAAC,IAAI,mDAAmD;gBAC1E,sEAAsE;gBACtE,IAAI,UAAU,CAAC,aAAa,IAAI,UAAU,2CAA2C,CACxF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC1E,SAAS,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,eAAe,GAAG,WAAW,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAE9C,OAAO;QACL,MAAM,EAAE,eAAe;QACvB,eAAe,EAAE,QAAQ,EAAE,eAAe,IAAI,EAAE;QAChD,cAAc,EAAE,QAAQ,EAAE,cAAc,IAAI,EAAE;QAC9C,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAA6B,EAC7B,MAA0B,EAC1B,aAAgC,EAChC,UAAsC,EACtC,WAAqB;IAErB,MAAM,KAAK,GAAiC,EAAE,CAAC;IAE/C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAEjD,yEAAyE;QACzE,IAAI,CAAC,WAAW,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;YACpE,UAAU,EAAE,CAAC,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,CAAC;YAC7C,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;YAClC,SAAS;QACX,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACvF,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,KAAK;KACN,CAAC;AACJ,CAAC"}
+{"version":3,"file":"list-resolver.js","sourceRoot":"","sources":["../../src/pipeline/list-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAiBnD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC;CACpE,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,qBAAqB,CAAC,UAA0B;IACvD,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,EAAE,CAAC;IACrD,OAAO,GAAG,UAAU,CAAC,gBAAgB,OAAO,cAAc,EAAE,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,UAA0B;IACjD,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACjD,OAAO,WAAW,CAChB,UAAU,CAAC,IAAI,EACf,UAAU,CAAC,IAAI,EACf,UAAU,CAAC,gBAAgB,EAC3B,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,EAC9B,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,SAAmB,EAAE,UAA0B,EAAE,QAAuB;IAC3F,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEnD,wCAAwC;IACxC,MAAM,WAAW,GAAG;QAClB,GAAG,IAAI,GAAG,CACR,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,IAAI,WAAW,CAAC,WAAW,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CACH;KACF,CAAC;IAEF,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED,kDAAkD;IAClD,MAAM,eAAe,GAAG,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAC1B,MAAc,EACd,KAAoB,EACpB,UAAsC;IAEtC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAChD,KAAK;QACL,MAAM,EAAE,kBAAkB;QAC1B,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,wDAAwD;AACxD,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,KAA0B;IACzE,MAAM,OAAO,GAAY,EAAE,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,0EAA0E;QAC1E,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,GAAI,OAAO,CAAC,WAAuC,EAAE,CAAC;QAEhG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YAC3B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,SAAS,OAAO,CAAC,IAAI,EAAE;YAC3D,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,IAAa,EAAE,EAAE;gBAC/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;oBACnC,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,SAAS,EAAE,IAA+B;iBAC3C,CAAC,CAAC;gBACH,8CAA8C;gBAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClC,OAAO,MAAM,CAAC,OAAO;yBAClB,MAAM,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;yBAClD,GAAG,CAAC,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;yBACpC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;gBACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxC,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,MAAc,EACd,KAAoB,EACpB,QAAiB,EACjB,UAAsC;IAEtC,UAAU,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,KAAK;QACL,KAAK,EAAE,QAAQ;QACf,QAAQ,EAAE,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,MAAM,gMAAgM;QACjN,eAAe,EAAE,IAAI;KACtB,CAAC,CAAC;IAEH,sDAAsD;IACtD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAErC,iGAAiG;IACjG,MAAM,aAAa,GAAG,iFAAiF,CAAC;IACxG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,gDAAgD;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,4DAA4D,OAAO,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,kEAAkE;IAClE,OAAO,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;IACxF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,kEAAkE;AAClE,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qEAAqE;AACrE,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,4DAA4D;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC/E,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,kBAAkB,CAAE,MAA2C,EAAE,MAAM,CAAC,CAAC;QACxF,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAED,8CAA8C;IAC9C,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAA0B,EAC1B,MAA0B,EAC1B,QAAuB,EACvB,UAAsC;IAEtC,UAAU,EAAE,CAAC,cAAc,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC;IAEjD,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,SAAmB,CAAC;IAExB,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,UAAU,UAAU,CAAC,IAAI,gDAAgD;gBACvE,wEAAwE,CAC3E,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,UAAU,UAAU,CAAC,IAAI,mDAAmD;gBAC1E,oDAAoD;gBACpD,eAAe,UAAU,CAAC,aAAa,IAAI,UAAU,2CAA2C,CACnG,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC/F,SAAS,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,eAAe,GAAG,WAAW,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAE9C,OAAO;QACL,MAAM,EAAE,eAAe;QACvB,eAAe,EAAE,QAAQ,EAAE,eAAe,IAAI,EAAE;QAChD,cAAc,EAAE,QAAQ,EAAE,cAAc,IAAI,EAAE;QAC9C,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAA6B,EAC7B,MAA0B,EAC1B,aAAgC,EAChC,UAAsC,EACtC,WAAqB;IAErB,MAAM,KAAK,GAAiC,EAAE,CAAC;IAE/C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAEjD,yEAAyE;QACzE,IAAI,CAAC,WAAW,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;YACpE,UAAU,EAAE,CAAC,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,CAAC;YAC7C,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;YAClC,SAAS;QACX,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACvF,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/pipeline/pipeline-runner.d.ts

@@ -2,24 +2,26 @@
  * PipelineRunner -- Encapsulates the full policy compilation pipeline.
  *
  * Provides a reusable abstraction over the compile-verify-repair loop.
- * Used by both:
- * - compile.ts CLI (constitutionKind: 'constitution')
- * - compileTaskPolicy() (constitutionKind: 'task-policy')
+ * Used by:
+ * - compile.ts CLI (constitutionKind: 'constitution') -- per-server compilation
+ * - compileTaskPolicy() (constitutionKind: 'task-policy') -- per-server whitelist
  *
- * The two constitutionKind variants differ only in the LLM prompt:
- * - 'constitution': broad-principle compilation from a constitution doc
- * - 'task-policy': whitelist-generation from an English task description
+ * Each MCP server is compiled independently with its own compile-verify-repair
+ * cycle, then results are merged. This enables incremental recompilation and
+ * better per-server rule quality.
  */
 import type { LanguageModel } from 'ai';
 import type { MCPServerConfig } from '../config/types.js';
 import type { LlmLogContext } from './llm-logger.js';
 import type { PromptCacheStrategy } from '../session/prompt-cache.js';
-import type { CompiledPolicyFile, ToolAnnotationsFile } from './types.js';
+import type { CompiledPolicyFile, CompiledRule, DynamicListsFile, ListDefinition, StoredToolAnnotationsFile, TestScenario, ToolAnnotation } from './types.js';
 /**
- * Selects the LLM prompt variant for policy compilation.
+ * Selects the LLM prompt variant for per-server policy compilation.
  *
  * - 'constitution': broad-principle compilation from a constitution document.
- * - 'task-policy': whitelist-generation from an English task description.
+ * - 'task-policy': strict whitelist-generation from an English task description.
+ *
+ * Both modes compile each server independently via the per-server path.
  */
 export type ConstitutionKind = 'constitution' | 'task-policy';
 /**
@@ -46,13 +48,15 @@ export interface PipelineRunConfig {
     readonly llmLogPath?: string;
     /**
      * Whether to include handwritten scenarios in verification.
-     * Default true for 'constitution', false for 'task-policy'.
+     * Defaults to true for 'constitution', false for 'task-policy'.
      */
     readonly includeHandwrittenScenarios?: boolean;
     /** Progress callback for CLI output. */
     readonly onProgress?: (message: string) => void;
-    /** Pre-loaded tool annotations (avoids re-reading from disk). */
-    readonly preloadedToolAnnotations?: ToolAnnotationsFile;
+    /** Pre-loaded stored tool annotations (avoids re-reading from disk). */
+    readonly preloadedStoredAnnotations?: StoredToolAnnotationsFile;
+    /** Compile only these servers (default: all servers in annotations). */
+    readonly serverFilter?: string[];
 }
 /**
  * LLM model references shared across pipeline runs.
@@ -66,9 +70,52 @@ export interface PipelineModels {
 }
 /** Creates PipelineModels from user config. Delegates to shared createPipelineLlm. */
 export declare function createPipelineModels(logDir?: string): Promise<PipelineModels>;
+/** Output from a single server's compilation cycle. */
+interface ServerCompilationResult {
+    readonly serverName: string;
+    readonly rules: CompiledRule[];
+    readonly listDefinitions: ListDefinition[];
+    readonly scenarios: TestScenario[];
+    readonly inputHash: string;
+    readonly constitutionHash: string;
+    readonly resolvedLists?: DynamicListsFile;
+}
+/**
+ * Computes a content hash for a single server's policy compilation inputs.
+ * The hash includes the server name, constitution, annotations, and prompt
+ * template so that any change invalidates the cache for this server.
+ */
+export declare function computeServerPolicyHash(serverName: string, constitutionText: string, annotations: ToolAnnotation[], compilerPromptTemplate: string): string;
+/**
+ * Filters handwritten scenarios to only those belonging to a specific server.
+ * Safe because handwritten scenarios are tagged with serverName in their request.
+ */
+export declare function getHandwrittenScenariosForServer(serverName: string, sandboxDir: string): TestScenario[];
+/**
+ * Debug assertion: validates that all rules from a server's compilation
+ * are properly scoped to exactly that server. This should never fail if
+ * the Zod schema with requireServer is correct.
+ */
+export declare function validateServerScoping(serverName: string, rules: CompiledRule[]): void;
+/**
+ * Deduplicates list definitions by name. When two servers produce different
+ * generationPrompt values for the same named list, uses first-wins
+ * (alphabetical server order) and logs a warning.
+ */
+export declare function deduplicateListDefinitions(defs: ListDefinition[]): ListDefinition[];
+/**
+ * Merges per-server compilation results into a single CompiledPolicyFile.
+ * Rules are concatenated in alphabetical server order for determinism.
+ * List definitions are deduplicated by name.
+ */
+export declare function mergeServerResults(results: ServerCompilationResult[], constitutionHash: string): CompiledPolicyFile;
 /**
  * Encapsulates the full policy compilation pipeline:
  * compile rules -> generate scenarios -> verify -> repair loop.
+ *
+ * Uses per-server compilation with independent compile-verify-repair
+ * cycles per server, then merges results. Works for both 'constitution'
+ * (broad principles) and 'task-policy' (strict whitelist) modes.
  */
 export declare class PipelineRunner {
     private readonly model;
@@ -77,10 +124,52 @@ export declare class PipelineRunner {
     constructor(models: PipelineModels);
     /**
      * Runs the full pipeline. Returns the compiled policy on success.
+     * All compilation modes use per-server compilation with independent
+     * compile-verify-repair cycles per server, then merge results.
      */
     run(config: PipelineRunConfig): Promise<CompiledPolicyFile>;
-    private compilePolicyRules;
+    /**
+     * Orchestrates per-server compilation + merge.
+     *
+     * Phase 1: Compile each server independently (compile-verify-repair per server)
+     * Phase 2: Merge all per-server results into final compiled-policy.json
+     * Phase 3: Resolve dynamic lists (global, post-merge)
+     *
+     * Works for both 'constitution' and 'task-policy' modes -- the
+     * constitutionKind is forwarded to each server's compilation unit
+     * to select the appropriate compiler prompt.
+     */
+    private runPerServer;
+    /**
+     * Compiles rules for all servers sequentially.
+     * Respects serverFilter if provided (for debugging single servers).
+     */
+    private compileAllServers;
+    /**
+     * Compiles a single server: compile -> generate scenarios -> verify -> repair.
+     * Self-contained compile-verify-repair loop per server.
+     */
+    private compileServer;
+    /**
+     * Compiles policy rules for a single server (initial compilation).
+     * Uses per-server schema with requireServer: true.
+     */
+    private compileServerPolicyRules;
     private compilePolicyRulesWithRepair;
+    /**
+     * Attempts point-fix repair via the session, falling back to full recompile.
+     * When a compiler session exists, uses repairPointFix() to emit a minimal
+     * patch instead of regenerating the entire rule set. This avoids oscillation
+     * where fixing one failure breaks previously-passing rules.
+     */
+    private compilePolicyRulesWithPointFix;
+    /**
+     * Resolves dynamic lists for a single server's list definitions.
+     * Loads existing per-server dynamic-lists.json for cache comparison,
+     * connects MCP servers if needed, and writes results to serverOutputDir.
+     */
+    private resolveServerLists;
     private generateTestScenarios;
     private logVerboseFailures;
 }
+export {};