@setluca/mcp 0.1.0

package/dist/http.js

@@ -0,0 +1,148 @@
+import { Context, Effect, Layer } from "effect";
+import { LucaConfig } from "./config.js";
+import { LucaDecodeError, LucaHttpError, LucaNetworkError, } from "./errors.js";
+export const LucaApi = Context.GenericTag("@luca/mcp/LucaApi");
+function isPresent(value) {
+    return value !== undefined && value !== null && value !== "";
+}
+function encodePath(path, params) {
+    return path.replace(/\{([^}]+)\}/g, (_, key) => {
+        const value = params?.[key];
+        if (!value) {
+            throw new Error(`Missing path parameter: ${key}`);
+        }
+        return encodeURIComponent(value);
+    });
+}
+function appendQuery(url, query) {
+    if (!query) {
+        return;
+    }
+    for (const [key, value] of Object.entries(query)) {
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (isPresent(item)) {
+                    url.searchParams.append(key, String(item));
+                }
+            }
+        }
+        else if (isPresent(value)) {
+            url.searchParams.set(key, String(value));
+        }
+    }
+}
+function parseJson(text) {
+    if (!text) {
+        return null;
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new LucaDecodeError({
+            message: "Luca API returned non-JSON content",
+            body: text,
+        });
+    }
+}
+function buildUrl(config, input) {
+    const path = encodePath(input.operation.path, input.pathParams);
+    const url = new URL(path, `${config.apiBaseUrl}/`);
+    appendQuery(url, input.query);
+    return url;
+}
+function buildHeaders(config, input) {
+    const headers = new Headers({
+        accept: "application/json",
+        "user-agent": "luca-mcp/0.1.0",
+    });
+    setAuthHeaders(headers, config);
+    setWorkspaceHeaders(headers, config, input);
+    setPayloadHeaders(headers, input);
+    return headers;
+}
+function setAuthHeaders(headers, config) {
+    if (config.authHeader === "authorization") {
+        headers.set("authorization", `Bearer ${config.apiKey}`);
+    }
+    else {
+        headers.set("x-api-key", config.apiKey);
+    }
+}
+function setWorkspaceHeaders(headers, config, input) {
+    const workspaceId = input.workspace?.workspaceId ?? config.workspaceId;
+    const workspaceSlug = input.workspace?.workspaceSlug ?? config.workspaceSlug;
+    if (workspaceId) {
+        headers.set("x-luca-workspace-id", workspaceId);
+    }
+    if (workspaceSlug) {
+        headers.set("x-luca-workspace-slug", workspaceSlug);
+    }
+}
+function setPayloadHeaders(headers, input) {
+    const hasBody = input.operation.method !== "GET" && input.body !== undefined;
+    if (hasBody) {
+        headers.set("content-type", "application/json");
+    }
+    if (input.operation.idempotencyRequired) {
+        headers.set("idempotency-key", input.idempotencyKey ?? crypto.randomUUID());
+    }
+}
+function buildRequestInit(input, headers) {
+    const hasBody = input.operation.method !== "GET" && input.body !== undefined;
+    return {
+        method: input.operation.method,
+        headers,
+        ...(hasBody ? { body: JSON.stringify(input.body) } : {}),
+    };
+}
+function readResponseBody(response) {
+    return Effect.gen(function* () {
+        const text = yield* Effect.tryPromise({
+            try: () => response.text(),
+            catch: (cause) => new LucaNetworkError({
+                message: "Could not read Luca API response body",
+                cause,
+            }),
+        });
+        return yield* Effect.try({
+            try: () => parseJson(text),
+            catch: (cause) => cause instanceof LucaDecodeError
+                ? cause
+                : new LucaDecodeError({ message: String(cause), body: text }),
+        });
+    });
+}
+export function makeLucaApi(config) {
+    return {
+        request: (input) => Effect.gen(function* () {
+            const url = buildUrl(config, input);
+            const init = buildRequestInit(input, buildHeaders(config, input));
+            const response = yield* Effect.tryPromise({
+                try: (signal) => fetch(url, {
+                    ...init,
+                    signal,
+                }),
+                catch: (cause) => new LucaNetworkError({
+                    message: `Could not reach Luca API at ${url.toString()}`,
+                    cause,
+                }),
+            });
+            const json = yield* readResponseBody(response);
+            if (!response.ok) {
+                const requestId = response.headers.get("x-request-id") ?? undefined;
+                return yield* Effect.fail(new LucaHttpError({
+                    status: response.status,
+                    statusText: response.statusText,
+                    body: json,
+                    ...(requestId ? { requestId } : {}),
+                }));
+            }
+            return json;
+        }),
+    };
+}
+export const LucaApiLive = Layer.effect(LucaApi, Effect.gen(function* () {
+    const config = yield* LucaConfig;
+    return makeLucaApi(config);
+}));

package/dist/index.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createLucaServer } from "./server.js";
+async function main() {
+    const server = createLucaServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((error) => {
+    console.error("Fatal error in Luca MCP server:", error);
+    process.exit(1);
+});

package/dist/oauth-resolver.js

@@ -0,0 +1,55 @@
+const TRAILING_SLASHES = /\/+$/;
+/**
+ * Developer API keys are handled by apiKeyResolver and never leave this
+ * process via the resolve endpoint. Refresh tokens (luca_ort_) are not
+ * developer keys — they fall through to the resolver, which rejects them
+ * server-side (fail closed, no client-side oracle).
+ */
+const API_KEY_SHAPE = /^luca_(?!ort_)[a-f0-9]/i;
+/**
+ * Resolver for OAuth access tokens (docs/specs/mcp-oauth-authorization-server.md
+ * §5.2): one authenticated call to the Luca API's POST /oauth/resolve, which
+ * verifies the JWT and returns the hidden vended key for the token's own
+ * grant. Fail closed: any error, non-200, or malformed body → null → 401.
+ */
+export function oauthResolver(env, fetchImpl = fetch) {
+    const apiBaseUrl = (env.LUCA_API_BASE_URL ?? "https://api.setluca.com").replace(TRAILING_SLASHES, "");
+    const authHeader = env.LUCA_AUTH_HEADER ?? "x-api-key";
+    return async (token) => {
+        if (API_KEY_SHAPE.test(token)) {
+            return null;
+        }
+        try {
+            const response = await fetchImpl(`${apiBaseUrl}/oauth/resolve`, {
+                method: "POST",
+                headers: { authorization: `Bearer ${token}` },
+            });
+            if (!response.ok) {
+                return null;
+            }
+            const payload = (await response.json());
+            if (!payload.apiKey) {
+                return null;
+            }
+            return {
+                config: { apiBaseUrl, apiKey: payload.apiKey, authHeader },
+                scopes: payload.scopes ?? [],
+            };
+        }
+        catch {
+            return null;
+        }
+    };
+}
+/** Try resolvers in order; the first non-null identity wins. */
+export function chainResolvers(...resolvers) {
+    return async (token) => {
+        for (const resolve of resolvers) {
+            const identity = await resolve(token);
+            if (identity) {
+                return identity;
+            }
+        }
+        return null;
+    };
+}

package/dist/observability.js

@@ -0,0 +1,19 @@
+/**
+ * One structured line per agent-surface event. PII-safe by contract: pass only
+ * names, booleans, counts, and already-coach-scoped ids — never message text,
+ * guidance text, or reasoning strings.
+ *
+ * A local mirror of `@luca/observability`'s `logAgentSurfaceEvent`: this package
+ * builds with plain `tsc` and ships to npm as a self-contained stdio tarball, so
+ * it cannot import the private workspace package. The two definitions share one
+ * contract (event names + payload shape).
+ */
+export function logAgentSurfaceEvent(event, fields) {
+    const clean = { msg: "mcp.agent_surface", event };
+    for (const [k, v] of Object.entries(fields)) {
+        if (v !== undefined) {
+            clean[k] = v;
+        }
+    }
+    console.log(JSON.stringify(clean));
+}

package/dist/openapi-zod.js

@@ -0,0 +1,269 @@
+import * as z from "zod/v4";
+function isNullable(schema) {
+    return (schema.nullable === true ||
+        (Array.isArray(schema.type) && schema.type.includes("null")));
+}
+function nonNullTypes(schema) {
+    if (Array.isArray(schema.type)) {
+        return schema.type.filter((type) => type !== "null");
+    }
+    if (schema.type) {
+        return [schema.type];
+    }
+    return [];
+}
+function withDescription(schema, description) {
+    return description ? schema.describe(description) : schema;
+}
+function enumSchema(values) {
+    if (values.length === 0) {
+        return z.never();
+    }
+    if (values.every((value) => typeof value === "string")) {
+        return z.enum(values);
+    }
+    if (values.length === 1) {
+        return z.literal(values[0]);
+    }
+    const literals = values.map((value) => z.literal(value));
+    return z.union(literals);
+}
+function stringSchema(schema) {
+    let result = z.string();
+    if (schema.format === "uuid") {
+        result = result.uuid();
+    }
+    else if (schema.format === "uri") {
+        result = result.url();
+    }
+    else if (schema.format === "date-time") {
+        result = result.datetime({ offset: true });
+    }
+    if (schema.minLength !== undefined) {
+        result = result.min(schema.minLength);
+    }
+    if (schema.maxLength !== undefined) {
+        result = result.max(schema.maxLength);
+    }
+    if (schema.pattern) {
+        result = result.regex(new RegExp(schema.pattern));
+    }
+    return result;
+}
+function numberSchema(schema, integer) {
+    let result = integer ? z.number().int() : z.number();
+    if (schema.minimum !== undefined) {
+        result =
+            schema.exclusiveMinimum === true
+                ? result.gt(schema.minimum)
+                : result.min(schema.minimum);
+    }
+    if (schema.maximum !== undefined) {
+        result =
+            schema.exclusiveMaximum === true
+                ? result.lt(schema.maximum)
+                : result.max(schema.maximum);
+    }
+    return result;
+}
+function arraySchema(schema) {
+    let result = z.array(schema.items ? schemaToZod(schema.items) : z.unknown());
+    if (schema.minItems !== undefined) {
+        result = result.min(schema.minItems);
+    }
+    if (schema.maxItems !== undefined) {
+        result = result.max(schema.maxItems);
+    }
+    return result;
+}
+function scalarSchema(schema, type) {
+    if (type === "string") {
+        return stringSchema(schema);
+    }
+    if (type === "integer" || type === "number") {
+        return numberSchema(schema, type === "integer");
+    }
+    return scalarSchemaWithoutConstraints(schema, type);
+}
+function scalarSchemaWithoutConstraints(schema, type) {
+    switch (type) {
+        case "boolean":
+            return z.boolean();
+        case "array":
+            return arraySchema(schema);
+        case "object":
+            return objectSchema(schema);
+        default:
+            return z.unknown();
+    }
+}
+function objectSchema(schema) {
+    const properties = schema.properties ?? {};
+    const required = new Set(schema.required ?? []);
+    const shape = {};
+    for (const [key, property] of Object.entries(properties)) {
+        const propertySchema = schemaToZod(property);
+        shape[key] = required.has(key) ? propertySchema : propertySchema.optional();
+    }
+    const result = z.object(shape);
+    if (schema.additionalProperties === true) {
+        return result.catchall(z.unknown());
+    }
+    if (schema.additionalProperties &&
+        typeof schema.additionalProperties === "object") {
+        return result.catchall(schemaToZod(schema.additionalProperties));
+    }
+    return result;
+}
+function schemaToZod(schema) {
+    const literal = literalOrEnumSchema(schema);
+    if (literal) {
+        return literal;
+    }
+    const composite = compositeSchema(schema);
+    if (composite) {
+        return composite;
+    }
+    return describedBaseSchema(schema);
+}
+function literalOrEnumSchema(schema) {
+    if (schema.const !== undefined) {
+        return z.literal(schema.const);
+    }
+    if (schema.enum) {
+        return withDescription(enumSchema(schema.enum), schema.description);
+    }
+    return;
+}
+function compositeSchema(schema) {
+    const variants = schema.anyOf ?? schema.oneOf;
+    if (variants?.length) {
+        return variantSchema(schema, variants);
+    }
+    const allOf = schema.allOf;
+    if (allOf?.length) {
+        return withDescription(schemaToZod(mergeAllOf(allOf)), schema.description);
+    }
+    return;
+}
+function variantSchema(schema, variants) {
+    const unionItems = variants.map(schemaToZod);
+    if (unionItems.length === 1) {
+        const single = unionItems[0] ?? z.never();
+        return withDescription(isNullable(schema) ? single.nullable() : single, schema.description);
+    }
+    const union = z.union(unionItems);
+    return withDescription(isNullable(schema) ? union.nullable() : union, schema.description);
+}
+function describedBaseSchema(schema) {
+    const base = baseSchema(schema);
+    return withDescription(isNullable(schema) ? base.nullable() : base, schema.description);
+}
+function mergeAllOf(allOf) {
+    const merged = {};
+    const properties = {};
+    const required = [];
+    for (const item of allOf) {
+        Object.assign(merged, item);
+        Object.assign(properties, item.properties);
+        required.push(...(item.required ?? []));
+    }
+    return {
+        ...merged,
+        ...(Object.keys(properties).length > 0 ? { properties } : {}),
+        ...(required.length > 0 ? { required } : {}),
+    };
+}
+function baseSchema(schema) {
+    const types = nonNullTypes(schema);
+    if (types.length === 0) {
+        return schema.properties ? objectSchema(schema) : z.unknown();
+    }
+    if (types.length === 1) {
+        return scalarSchema(schema, types[0] ?? "unknown");
+    }
+    return z.union(types.map((type) => scalarSchema(schema, type)));
+}
+/**
+ * Relax a response JSON schema to a **structural, type-only** shape for output
+ * validation. The goal is a check that fails loud on a genuinely malformed
+ * payload (a field typed as the wrong primitive, `result` that is not an object
+ * at all) while never rejecting a well-formed real result.
+ *
+ * So it keeps each field's base `type` (and `nullable`) but drops value-level
+ * constraints — `format` (uuid/date-time), `pattern`, length/range bounds,
+ * `enum`, and deep array-item schemas — and makes every object open with no
+ * required properties. Those constraints are the false-positive risk: they would
+ * 500 a real tool call on a non-v4 uuid, an enum that drifted, or an omitted
+ * optional field, and they also break the pagination merge (which drops
+ * `nextCursor` and adds a `pagination` block). The trade: array element shapes
+ * and formats are not deeply validated; the structural contract still is.
+ */
+function relaxJsonSchema(schema) {
+    const relaxed = {};
+    if (schema.type !== undefined) {
+        relaxed.type = schema.type;
+    }
+    if (isNullable(schema)) {
+        relaxed.nullable = true;
+    }
+    if (schema.properties) {
+        const properties = {};
+        for (const [key, value] of Object.entries(schema.properties)) {
+            properties[key] = relaxJsonSchema(value);
+        }
+        relaxed.properties = properties;
+        relaxed.required = [];
+        relaxed.additionalProperties = true;
+        if (relaxed.type === undefined) {
+            relaxed.type = "object";
+        }
+    }
+    for (const key of ["anyOf", "oneOf", "allOf"]) {
+        const variants = schema[key];
+        if (variants) {
+            relaxed[key] = variants.map(relaxJsonSchema);
+        }
+    }
+    // Array items and scalar formats/patterns/ranges/enums are intentionally
+    // dropped — see the doc comment.
+    return relaxed;
+}
+const untrustedProvenanceSchema = z
+    .object({ untrusted: z.literal(true), note: z.string() })
+    .loose();
+/**
+ * The `structuredContent` shape for a tool: `{ result }`, plus an optional
+ * `provenance` marker for operations that carry lead-authored text. `result` is
+ * the operation's success-response body, deep-relaxed (see
+ * {@link relaxJsonSchema}) so real results validate while malformed ones fail
+ * loud.
+ */
+export function openApiToolOutputShape(input) {
+    const resultSchema = input.body
+        ? schemaToZod(relaxJsonSchema(input.body))
+        : z.unknown();
+    const shape = { result: resultSchema };
+    if (input.untrustedContent) {
+        shape.provenance = untrustedProvenanceSchema.optional();
+    }
+    return shape;
+}
+export function openApiToolInputShape(input) {
+    const shape = {};
+    Object.assign(shape, input.workspaceInput);
+    if (input.idempotencyRequired) {
+        Object.assign(shape, input.idempotencyInput);
+    }
+    const pathShape = input.spec?.path ? schemaToZod(input.spec.path) : undefined;
+    if (pathShape instanceof z.ZodObject) {
+        Object.assign(shape, pathShape.shape);
+    }
+    if (input.spec?.query) {
+        shape.query = schemaToZod(input.spec.query).optional();
+    }
+    if (input.spec?.body) {
+        shape.body = schemaToZod(input.spec.body);
+    }
+    return shape;
+}