@raytio/mcp-server 10.4.1 → 10.6.0

package/dist/tools/wrm/wrm-credential-request-create.js

@@ -1,14 +1,16 @@
+import { idempotencyKeySchema } from '../_shared/side-effect.js';
+import { rpcCap } from '../../capabilities/tool-capability.js';
 import { z } from 'zod';
-import { successResponse, errorResponse, WRM_NOT_FOUND, WRM_VALIDATION, API_ERROR } from '../types.js';
-import { WRM_WORKER_SELECT } from '../../wrm/projection.js';
-import { cap } from '../../capabilities/tool-capability.js';
+import { successResponse, errorResponse, API_ERROR } from '../types.js';
 export const credentialRequestCreateTool = {
     name: 'wrm_credential_request_create',
     description: 'Creates a credential request for an agent worker. Builds an Access Application (AA), ' +
         'adds the worker to the AA guest list, creates credential and request records, ' +
         'and notifies the specified human user to share the credential via the AA flow. ' +
         'Returns { request_id, aa_id, credential_id }.',
+    idempotency: 'explicit_key',
     inputSchema: z.object({
+        idempotency_key: idempotencyKeySchema,
         worker_id: z.string().describe('UUID of the requesting worker'),
         credential_name: z.string().describe('Name identifying this credential (e.g. "github_api_token")'),
         credential_type: z
@@ -19,85 +21,35 @@ export const credentialRequestCreateTool = {
         ttl_seconds: z.number().optional().describe('Credential TTL in seconds (default 3600)'),
         work_item_id: z.string().optional().describe('UUID of the related PPM work item (optional)'),
     }),
-    capabilities: [
-        cap('wrm_workers', 'SELECT'),
-        cap('dsm_access_application_users', 'INSERT'),
-        cap('dsm_access_applications', 'INSERT'),
-        cap('wrm_credential_requests', 'INSERT'),
-        cap('wrm_worker_credentials', 'INSERT'),
-        // NOTE: Step 6 also POSTs /db/v1/fnd_notifications, but that call is
-        // fire-and-forget and explicitly non-fatal. Declaring it as a hard
-        // requirement hides this whole tool from callers who hold every
-        // permission it actually needs, so it is registered as an optional
-        // endpoint in capability-completeness.test.ts instead of declared
-        // here. See OPTIONAL_ENDPOINTS there for the rationale.
-    ],
+    capabilities: [...rpcCap('wrm_create_credential_request')],
     handler: async (args, ctx) => {
         const input = args;
         try {
-            // Step 1: Validate worker exists and has a service account user_id
-            const workers = await ctx.apiClient.get(`/db/v1/wrm_workers?id=eq.${input.worker_id}&select=${WRM_WORKER_SELECT}`);
-            if (!workers || workers.length === 0) {
-                return errorResponse(WRM_NOT_FOUND, `Worker ${input.worker_id} not found`);
-            }
-            const worker = workers[0];
-            if (!worker.user_id) {
-                return errorResponse(WRM_VALIDATION, `Worker ${input.worker_id} has no service account user_id. ` +
-                    'Credential sharing requires a Cognito service account linked to the worker.');
-            }
-            const ttl = input.ttl_seconds ?? 3600;
-            const expiresAt = new Date(Date.now() + ttl * 1000).toISOString();
-            // Step 2: Create Access Application for the credential sharing context
-            const aaRecords = await ctx.apiClient.post('/db/v1/dsm_access_applications?select=id', {
-                name: `Credential Request: ${input.credential_name}`,
-                description: input.purpose,
-            }, { headers: { Prefer: 'return=representation' } });
-            const aaId = aaRecords[0].id;
-            // Step 3: Add worker's user_id to AA guest list
-            await ctx.apiClient.post('/db/v1/dsm_access_application_users', { aa_id: aaId, user_id: worker.user_id }, { headers: { Prefer: 'return=representation' } });
-            // Step 4: Create credential record (status=PENDING, encrypted_value empty until fulfilled)
-            const credBody = {
-                worker_id: input.worker_id,
-                credential_name: input.credential_name,
-                credential_type: input.credential_type,
-                encrypted_value: {},
-                source_aa_id: aaId,
-                expires_at: expiresAt,
-                status: 'PENDING',
-                request_context: {
-                    purpose: input.purpose,
-                    work_item_id: input.work_item_id ?? null,
-                },
-            };
-            const credRecords = await ctx.apiClient.post('/db/v1/wrm_worker_credentials?select=id', credBody, { headers: { Prefer: 'return=representation' } });
-            const credentialId = credRecords[0].id;
-            // Step 5: Create credential request record (tracks lifecycle)
-            const reqBody = {
-                worker_id: input.worker_id,
-                requested_from_user_id: input.request_from_user_id,
-                aa_id: aaId,
-                credential_id: credentialId,
-                credential_name: input.credential_name,
-                credential_type: input.credential_type,
-                purpose: input.purpose,
-                ttl_seconds: ttl,
-                status: 'PENDING',
-            };
-            if (input.work_item_id)
-                reqBody.work_item_id = input.work_item_id;
-            const reqRecords = await ctx.apiClient.post('/db/v1/wrm_credential_requests?select=id', reqBody, { headers: { Prefer: 'return=representation' } });
-            const requestId = reqRecords[0].id;
+            const result = z.object({
+                request_id: z.string(), aa_id: z.string(), credential_id: z.string(), replayed: z.boolean(),
+            }).parse(await ctx.apiClient.post(`${ctx.apiClient.dbBasePath}/rpc/wrm_create_credential_request`, {
+                p_worker_id: input.worker_id,
+                p_request_from_user_id: input.request_from_user_id,
+                p_credential_name: input.credential_name,
+                p_credential_type: input.credential_type,
+                p_purpose: input.purpose,
+                p_ttl_seconds: input.ttl_seconds ?? 3600,
+                p_work_item_id: input.work_item_id ?? null,
+                p_idempotency_key: input.idempotency_key ?? null,
+            }));
+            const { request_id: requestId, aa_id: aaId, credential_id: credentialId } = result;
             // Step 6: Fire-and-forget notification to the human (non-fatal if it fails)
-            ctx.apiClient
-                .post('/db/v1/fnd_notifications', {
-                user_id: input.request_from_user_id,
-                notification_type: 'CREDENTIAL_REQUEST',
-                title: `Credential request: ${input.credential_name}`,
-                message: `An AI agent is requesting the credential "${input.credential_name}". Purpose: ${input.purpose}`,
-                metadata: { request_id: requestId, aa_id: aaId, credential_id: credentialId },
-            })
-                .catch(() => undefined);
-            return successResponse({ request_id: requestId, aa_id: aaId, credential_id: credentialId });
+            if (!result.replayed)
+                ctx.apiClient
+                    .post(`${ctx.apiClient.dbBasePath}/fnd_notifications`, {
+                    user_id: input.request_from_user_id,
+                    notification_type: 'CREDENTIAL_REQUEST',
+                    title: `Credential request: ${input.credential_name}`,
+                    message: `An AI agent is requesting the credential "${input.credential_name}". Purpose: ${input.purpose}`,
+                    metadata: { request_id: requestId, aa_id: aaId, credential_id: credentialId },
+                })
+                    .catch(() => undefined);
+            return successResponse(result);
         }
         catch (error) {
             return errorResponse(API_ERROR, `Failed to create credential request: ${error.message}`);

package/dist/tools/wrm/wrm-credential-request-create.js.map

@@ -1 +1 @@
-{"version":3,"file":"wrm-credential-request-create.js","sourceRoot":"","sources":["../../../src/tools/wrm/wrm-credential-request-create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,GAAG,EAAE,MAAM,uCAAuC,CAAC;AAE5D,MAAM,CAAC,MAAM,2BAA2B,GAAS;IAC/C,IAAI,EAAE,+BAA+B;IACrC,WAAW,EACT,uFAAuF;QACvF,gFAAgF;QAChF,iFAAiF;QACjF,+CAA+C;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC/D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;QAClG,eAAe,EAAE,CAAC;aACf,IAAI,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;aACrE,QAAQ,CAAC,oCAAoC,CAAC;QACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;QACxF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;QAC9F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QACvF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KAC7F,CAAC;IACF,YAAY,EAAE;QACZ,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC;QAC5B,GAAG,CAAC,8BAA8B,EAAE,QAAQ,CAAC;QAC7C,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC;QACxC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC;QACxC,GAAG,CAAC,wBAAwB,EAAE,QAAQ,CAAC;QACvC,qEAAqE;QACrE,mEAAmE;QACnE,gEAAgE;QAChE,mEAAmE;QACnE,kEAAkE;QAClE,wDAAwD;KACzD;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAA2B,CAAC;QAC1C,IAAI,CAAC;YACH,mEAAmE;YACnE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,CACrC,4BAA4B,KAAK,CAAC,SAAS,WAAW,iBAAiB,EAAE,CAC1E,CAAC;YACF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrC,OAAO,aAAa,CAAC,aAAa,EAAE,UAAU,KAAK,CAAC,SAAS,YAAY,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,aAAa,CAClB,cAAc,EACd,UAAU,KAAK,CAAC,SAAS,mCAAmC;oBAC1D,6EAA6E,CAChF,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAElE,uEAAuE;YACvE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CACxC,0CAA0C,EAC1C;gBACE,IAAI,EAAE,uBAAuB,KAAK,CAAC,eAAe,EAAE;gBACpD,WAAW,EAAE,KAAK,CAAC,OAAO;aAC3B,EACD,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,CACjD,CAAC;YACF,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,EAAY,CAAC;YAEvC,gDAAgD;YAChD,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CACtB,qCAAqC,EACrC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EACxC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,CACjD,CAAC;YAEF,2FAA2F;YAC3F,MAAM,QAAQ,GAAwB;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,eAAe,EAAE,EAAE;gBACnB,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,SAAS;gBACrB,MAAM,EAAE,SAAS;gBACjB,eAAe,EAAE;oBACf,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;iBACzC;aACF,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAC1C,yCAAyC,EACzC,QAAQ,EACR,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,CACjD,CAAC;YACF,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,EAAY,CAAC;YAEjD,8DAA8D;YAC9D,MAAM,OAAO,GAAwB;gBACnC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,sBAAsB,EAAE,KAAK,CAAC,oBAAoB;gBAClD,KAAK,EAAE,IAAI;gBACX,aAAa,EAAE,YAAY;gBAC3B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,WAAW,EAAE,GAAG;gBAChB,MAAM,EAAE,SAAS;aAClB,CAAC;YACF,IAAI,KAAK,CAAC,YAAY;gBAAE,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;YAElE,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CACzC,0CAA0C,EAC1C,OAAO,EACP,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,CACjD,CAAC;YACF,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,EAAY,CAAC;YAE7C,4EAA4E;YAC5E,GAAG,CAAC,SAAS;iBACV,IAAI,CAAC,0BAA0B,EAAE;gBAChC,OAAO,EAAE,KAAK,CAAC,oBAAoB;gBACnC,iBAAiB,EAAE,oBAAoB;gBACvC,KAAK,EAAE,uBAAuB,KAAK,CAAC,eAAe,EAAE;gBACrD,OAAO,EAAE,6CAA6C,KAAK,CAAC,eAAe,eAAe,KAAK,CAAC,OAAO,EAAE;gBACzG,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE;aAC9E,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAE1B,OAAO,eAAe,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,aAAa,CAAC,SAAS,EAAE,wCAAwC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CACF,CAAC"}
+{"version":3,"file":"wrm-credential-request-create.js","sourceRoot":"","sources":["../../../src/tools/wrm/wrm-credential-request-create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,uCAAuC,CAAC;AAC/D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExE,MAAM,CAAC,MAAM,2BAA2B,GAAS;IAC/C,IAAI,EAAE,+BAA+B;IACrC,WAAW,EACT,uFAAuF;QACvF,gFAAgF;QAChF,iFAAiF;QACjF,+CAA+C;IACjD,WAAW,EAAE,cAAc;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,eAAe,EAAE,oBAAoB;QACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC/D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;QAClG,eAAe,EAAE,CAAC;aACf,IAAI,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;aACrE,QAAQ,CAAC,oCAAoC,CAAC;QACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;QACxF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;QAC9F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;QACvF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KAC7F,CAAC;IACF,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAA2B,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;gBACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;aAC5F,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAC/B,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,oCAAoC,EAC/D;gBACE,WAAW,EAAE,KAAK,CAAC,SAAS;gBAC5B,sBAAsB,EAAE,KAAK,CAAC,oBAAoB;gBAClD,iBAAiB,EAAE,KAAK,CAAC,eAAe;gBACxC,iBAAiB,EAAE,KAAK,CAAC,eAAe;gBACxC,SAAS,EAAE,KAAK,CAAC,OAAO;gBACxB,aAAa,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;gBACxC,cAAc,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;gBAC1C,iBAAiB,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;aACjD,CACF,CAAC,CAAC;YACH,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;YAEnF,4EAA4E;YAC5E,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,GAAG,CAAC,SAAS;qBAChC,IAAI,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,oBAAoB,EAAE;oBACrD,OAAO,EAAE,KAAK,CAAC,oBAAoB;oBACnC,iBAAiB,EAAE,oBAAoB;oBACvC,KAAK,EAAE,uBAAuB,KAAK,CAAC,eAAe,EAAE;oBACrD,OAAO,EAAE,6CAA6C,KAAK,CAAC,eAAe,eAAe,KAAK,CAAC,OAAO,EAAE;oBACzG,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE;iBAC9E,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAE1B,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,aAAa,CAAC,SAAS,EAAE,wCAAwC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raytio/mcp-server",
-  "version": "10.4.1",
+  "version": "10.6.0",
   "description": "MCP server for secure AI agent access to Raytio user data",
   "type": "module",
   "main": "dist/index.js",