@segmentstream/ontology 0.0.0-stage → 0.92.0

package/dist/service/mcp/runtime-policy.d.ts

@@ -0,0 +1,27 @@
+import { Effect } from "effect";
+import { PermissionDenied } from "../../errors.js";
+import type { OntologyManifest } from "../../manifest.js";
+import { type CallerContext } from "../caller-context.js";
+interface OperationIdentity {
+    readonly name?: string;
+    readonly target?: {
+        readonly kind: string;
+        readonly planned?: {
+            readonly name: string;
+        };
+        readonly action?: {
+            readonly name: string;
+        };
+    };
+    readonly entity?: string;
+    readonly action?: string;
+}
+/** Classify operation identity, including aliases, rather than trusting a public tool name alone. */
+export declare function invokesAgent(operation: OperationIdentity): boolean;
+export declare function runtimeAllows(caller: CallerContext, operation: OperationIdentity): boolean;
+/** Shared execution defense, before decoding, preparation, transactions or external I/O. */
+export declare function requireRuntimeOperation(operation: OperationIdentity): Effect.Effect<void, PermissionDenied, never>;
+export declare function checkRuntimeOperation(caller: CallerContext, operation: OperationIdentity): Effect.Effect<void, never, never> | Effect.Effect<never, PermissionDenied, never>;
+/** Runtime catalog exports keep ordinary definitions while excluding invocation actions. */
+export declare function runtimeManifest(manifest: OntologyManifest, caller: CallerContext): OntologyManifest;
+export {};

package/dist/service/mcp/runtime-policy.js

@@ -0,0 +1,62 @@
+import { Effect, Option } from "effect";
+import { RuntimeDeployment } from "../../runtime/deployment.js";
+import { requireDeploymentCapability } from "../../deployment.js";
+import { PermissionDenied } from "../../errors.js";
+import { currentCaller } from "../caller-context.js";
+function normalized(name) {
+    return name
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "_");
+}
+/** Classify operation identity, including aliases, rather than trusting a public tool name alone. */
+export function invokesAgent(operation) {
+    const { target } = operation;
+    const entity = operation.entity ?? target?.planned?.name;
+    const action = operation.action ?? target?.action?.name;
+    const names = [
+        operation.name,
+        entity !== undefined && action !== undefined ? `${entity}_${action}` : undefined,
+    ];
+    return (target?.kind === "agent-invocation" ||
+        target?.kind === "agent" ||
+        names.some((name) => {
+            if (name === undefined) {
+                return false;
+            }
+            const wire = normalized(name);
+            return (/^agent_(start|get|update|cancel|run|invoke|execute)(?:_|$)/.test(wire) ||
+                /^agent_chat_send_message(?:_|$)/.test(wire));
+        }));
+}
+export function runtimeAllows(caller, operation) {
+    return caller.kind !== "runtime" || !invokesAgent(operation);
+}
+/** Shared execution defense, before decoding, preparation, transactions or external I/O. */
+export function requireRuntimeOperation(operation) {
+    return Effect.gen(function* () {
+        const deployment = Option.getOrUndefined(yield* Effect.serviceOption(RuntimeDeployment));
+        if (deployment) {
+            yield* Effect.sync(() => requireDeploymentCapability(deployment, invokesAgent(operation) || operation.entity === "agent_chat" ? "agents" : undefined));
+        }
+        return yield* currentCaller.pipe(Effect.flatMap((caller) => checkRuntimeOperation(caller, operation)));
+    });
+}
+export function checkRuntimeOperation(caller, operation) {
+    return runtimeAllows(caller, operation)
+        ? Effect.void
+        : Effect.fail(new PermissionDenied({ message: "The agent runtime cannot invoke an agent." }));
+}
+/** Runtime catalog exports keep ordinary definitions while excluding invocation actions. */
+export function runtimeManifest(manifest, caller) {
+    if (caller.kind !== "runtime") {
+        return manifest;
+    }
+    return {
+        ...manifest,
+        entities: manifest.entities.map((entity) => ({
+            ...entity,
+            actions: entity.actions.filter((action) => runtimeAllows(caller, { entity: entity.name, action: action.name })),
+        })),
+    };
+}

package/dist/service/mcp/server.d.ts

@@ -0,0 +1,52 @@
+import { Layer } from "effect";
+import { HttpRouter } from "effect/unstable/http";
+import type { ChatDeliveryFactory } from "../chat/delivery.js";
+import type { MetricQueries } from "../metric-query.js";
+import { type Decide } from "../decisions.js";
+import type { BuiltApi } from "../api.js";
+import { type TokenVerifier } from "../authentication.js";
+import type { PageCatalogV1 } from "../../navigation-catalog.js";
+import type { AfterCommitHook } from "../config.js";
+import { type ConversationTransport } from "../agent/conversations.js";
+import type { ConnectionTransportFactory } from "../connections.js";
+import { RequestId } from "../errors.js";
+import type { ReplicationKick } from "../replication.js";
+import { OntologyBackend } from "../runtime-contract.js";
+import { type RuntimeTokenVerifier } from "../runtime-identity.js";
+/** The URL path of the ontology's MCP server, outside `/api/ontology`: one per app. */
+export declare const MCP_PATH = "/mcp";
+/** The MCP revisions the server speaks, newest first. */
+export declare const MCP_PROTOCOL_VERSIONS: readonly ["2025-11-25", "2025-06-18"];
+export declare const MCP_STREAM_MAX_DURATION_MS = 45000;
+/**
+ * When to offer feedback, for a caller who may send it. Platform guidance for the agent; the agent
+ * words the offer itself, in the conversation's language.
+ */
+export declare const FEEDBACK_INSTRUCTIONS: string;
+export declare const AUTOMATIC_FAILURE_REPORT_INSTRUCTIONS: string;
+export interface McpServerOptions {
+    readonly navigation?: PageCatalogV1;
+    readonly appOrigins?: readonly string[] | undefined;
+    readonly streamMaxDurationMs?: number | undefined;
+    readonly built: BuiltApi;
+    readonly hooks: ReadonlyMap<string, AfterCommitHook>;
+    readonly connections: ConnectionTransportFactory;
+    readonly replicate: ReplicationKick;
+    readonly verifyToken: TokenVerifier;
+    /** The deployment's runtime tokens, acting as a member; `undefined` while that is disabled. */
+    readonly verifyRuntime?: RuntimeTokenVerifier | undefined;
+    /** The facade the metric query routes run; query_metrics runs its model-level query. */
+    readonly metricQueries: MetricQueries;
+    /** Authenticated exact-text delivery for the built-in chat action. */
+    readonly chatDelivery?: ChatDeliveryFactory | undefined;
+    readonly conversations?: ConversationTransport | undefined;
+    /** The workspace whose workflows' tasks authenticate here; without it the task header is refused. */
+    readonly workspaceId?: string | undefined;
+    /** How `discover` asks the ontology's decision model: AI Gateway by default. Tests replace it. */
+    readonly decide?: Decide | undefined;
+}
+/**
+ * Streamable HTTP without sessions: POST answers JSON-RPC, GET keeps an idle SSE stream alive,
+ * and DELETE answers 405. Every instance can answer any authenticated request independently.
+ */
+export declare function mcpLayer(options: McpServerOptions): Layer.Layer<never, never, OntologyBackend | HttpRouter.HttpRouter | HttpRouter.Request<"Requires", RequestId> | HttpRouter.Request<"Error", unknown>>;