@shipfox/api-integration-core 2.0.0

package/dist/presentation/routes/agent-tools-gateway/dispatch.js

@@ -0,0 +1,108 @@
+import { IntegrationProviderError } from '#core/errors.js';
+const timeoutErrorPattern = /timed?\s*out|timeout/i;
+const credentialErrorNamePattern = /Token|Credential|Secret|AccessToken/;
+export function createIntegrationToolDispatcher(params) {
+    return (input)=>dispatchIntegrationToolCall({
+            ...input,
+            registry: params.registry
+        });
+}
+async function dispatchIntegrationToolCall(input) {
+    let session;
+    try {
+        const adapter = input.registry.getAdapter(input.authorizedTool.integration.provider, 'agent_tools');
+        session = await adapter.openSession({
+            connection: input.authorizedTool.connection,
+            tools: [
+                agentToolCatalogEntry(input)
+            ],
+            scope: input.authorizedTool.integration
+        });
+        return await session.call({
+            toolId: input.authorizedTool.tool.id,
+            arguments: input.arguments
+        });
+    } catch (error) {
+        return toolError(errorResult(error));
+    } finally{
+        await closeSession(session);
+    }
+}
+function agentToolCatalogEntry(input) {
+    const { tool, description, inputSchema, outputSchema } = input.authorizedTool;
+    return {
+        id: tool.id,
+        description,
+        sensitivity: tool.sensitivity,
+        sensitive: tool.sensitive,
+        requiredScope: tool.requiredScope,
+        inputSchema,
+        ...outputSchema === undefined ? {} : {
+            outputSchema
+        },
+        ...tool.methods === undefined ? {} : {
+            methods: tool.methods.map((method)=>({
+                    id: method.id,
+                    description: method.description ?? method.token,
+                    sensitivity: method.sensitivity,
+                    sensitive: method.sensitive,
+                    requiredScope: method.requiredScope
+                }))
+        }
+    };
+}
+async function closeSession(session) {
+    try {
+        await session?.close?.();
+    } catch  {
+    // Cleanup must not mask the tool result returned to the runner.
+    }
+}
+function errorResult(error) {
+    if (error instanceof IntegrationProviderError) {
+        return {
+            code: error.reason,
+            message: `Integration provider error: ${error.reason}`
+        };
+    }
+    if (isTimeoutError(error)) {
+        return {
+            code: 'provider-timeout',
+            message: 'Integration provider timed out'
+        };
+    }
+    if (isCredentialError(error)) {
+        return {
+            code: 'credentials-unavailable',
+            message: 'Integration provider credentials are unavailable'
+        };
+    }
+    return {
+        code: 'provider-unavailable',
+        message: 'Integration provider call failed'
+    };
+}
+function isTimeoutError(error) {
+    if (!(error instanceof Error)) return false;
+    return error.name === 'AbortError' || timeoutErrorPattern.test(error.name) || timeoutErrorPattern.test(error.message);
+}
+function isCredentialError(error) {
+    if (!(error instanceof Error)) return false;
+    return credentialErrorNamePattern.test(error.name);
+}
+function toolError(params) {
+    return {
+        isError: true,
+        content: [
+            {
+                type: 'text',
+                text: params.message
+            }
+        ],
+        structuredContent: {
+            code: params.code
+        }
+    };
+}
+
+//# sourceMappingURL=dispatch.js.map

package/dist/presentation/routes/agent-tools-gateway/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/presentation/routes/agent-tools-gateway/dispatch.ts"],"sourcesContent":["import type {CallToolResult} from '@modelcontextprotocol/sdk/types.js';\nimport {IntegrationProviderError} from '#core/errors.js';\nimport type {\n  AgentToolCatalogEntry,\n  AgentToolCatalogMethod,\n  AgentToolSession,\n  AgentToolsProvider,\n} from '#core/providers/agent-tools.js';\nimport type {IntegrationProviderRegistry} from '#core/providers/registry.js';\nimport type {IntegrationToolDispatcher, IntegrationToolDispatchInput} from './mcp-server.js';\n\nexport interface CreateIntegrationToolDispatcherParams {\n  registry: IntegrationProviderRegistry;\n}\n\nconst timeoutErrorPattern = /timed?\\s*out|timeout/i;\nconst credentialErrorNamePattern = /Token|Credential|Secret|AccessToken/;\n\nexport function createIntegrationToolDispatcher(\n  params: CreateIntegrationToolDispatcherParams,\n): IntegrationToolDispatcher {\n  return (input) => dispatchIntegrationToolCall({...input, registry: params.registry});\n}\n\nasync function dispatchIntegrationToolCall(\n  input: IntegrationToolDispatchInput & {registry: IntegrationProviderRegistry},\n): Promise<CallToolResult> {\n  let session: AgentToolSession<CallToolResult> | undefined;\n\n  try {\n    const adapter = input.registry.getAdapter(\n      input.authorizedTool.integration.provider,\n      'agent_tools',\n    ) as AgentToolsProvider<\n      typeof input.authorizedTool.connection,\n      unknown,\n      typeof input.authorizedTool.integration,\n      CallToolResult\n    >;\n    session = await adapter.openSession({\n      connection: input.authorizedTool.connection,\n      tools: [agentToolCatalogEntry(input)],\n      scope: input.authorizedTool.integration,\n    });\n\n    return await session.call({\n      toolId: input.authorizedTool.tool.id,\n      arguments: input.arguments,\n    });\n  } catch (error) {\n    return toolError(errorResult(error));\n  } finally {\n    await closeSession(session);\n  }\n}\n\nfunction agentToolCatalogEntry(input: IntegrationToolDispatchInput): AgentToolCatalogEntry {\n  const {tool, description, inputSchema, outputSchema} = input.authorizedTool;\n  return {\n    id: tool.id,\n    description,\n    sensitivity: tool.sensitivity,\n    sensitive: tool.sensitive,\n    requiredScope: tool.requiredScope,\n    inputSchema,\n    ...(outputSchema === undefined ? {} : {outputSchema}),\n    ...(tool.methods === undefined\n      ? {}\n      : {\n          methods: tool.methods.map(\n            (method): AgentToolCatalogMethod => ({\n              id: method.id,\n              description: method.description ?? method.token,\n              sensitivity: method.sensitivity,\n              sensitive: method.sensitive,\n              requiredScope: method.requiredScope,\n            }),\n          ),\n        }),\n  };\n}\n\nasync function closeSession(session: {close?(): Promise<void>} | undefined): Promise<void> {\n  try {\n    await session?.close?.();\n  } catch {\n    // Cleanup must not mask the tool result returned to the runner.\n  }\n}\n\nfunction errorResult(error: unknown): {code: string; message: string} {\n  if (error instanceof IntegrationProviderError) {\n    return {\n      code: error.reason,\n      message: `Integration provider error: ${error.reason}`,\n    };\n  }\n\n  if (isTimeoutError(error)) {\n    return {\n      code: 'provider-timeout',\n      message: 'Integration provider timed out',\n    };\n  }\n\n  if (isCredentialError(error)) {\n    return {\n      code: 'credentials-unavailable',\n      message: 'Integration provider credentials are unavailable',\n    };\n  }\n\n  return {\n    code: 'provider-unavailable',\n    message: 'Integration provider call failed',\n  };\n}\n\nfunction isTimeoutError(error: unknown): boolean {\n  if (!(error instanceof Error)) return false;\n  return (\n    error.name === 'AbortError' ||\n    timeoutErrorPattern.test(error.name) ||\n    timeoutErrorPattern.test(error.message)\n  );\n}\n\nfunction isCredentialError(error: unknown): boolean {\n  if (!(error instanceof Error)) return false;\n  return credentialErrorNamePattern.test(error.name);\n}\n\nfunction toolError(params: {code: string; message: string}): CallToolResult {\n  return {\n    isError: true,\n    content: [{type: 'text', text: params.message}],\n    structuredContent: {code: params.code},\n  };\n}\n"],"names":["IntegrationProviderError","timeoutErrorPattern","credentialErrorNamePattern","createIntegrationToolDispatcher","params","input","dispatchIntegrationToolCall","registry","session","adapter","getAdapter","authorizedTool","integration","provider","openSession","connection","tools","agentToolCatalogEntry","scope","call","toolId","tool","id","arguments","error","toolError","errorResult","closeSession","description","inputSchema","outputSchema","sensitivity","sensitive","requiredScope","undefined","methods","map","method","token","close","code","reason","message","isTimeoutError","isCredentialError","Error","name","test","isError","content","type","text","structuredContent"],"mappings":"AACA,SAAQA,wBAAwB,QAAO,kBAAkB;AAczD,MAAMC,sBAAsB;AAC5B,MAAMC,6BAA6B;AAEnC,OAAO,SAASC,gCACdC,MAA6C;IAE7C,OAAO,CAACC,QAAUC,4BAA4B;YAAC,GAAGD,KAAK;YAAEE,UAAUH,OAAOG,QAAQ;QAAA;AACpF;AAEA,eAAeD,4BACbD,KAA6E;IAE7E,IAAIG;IAEJ,IAAI;QACF,MAAMC,UAAUJ,MAAME,QAAQ,CAACG,UAAU,CACvCL,MAAMM,cAAc,CAACC,WAAW,CAACC,QAAQ,EACzC;QAOFL,UAAU,MAAMC,QAAQK,WAAW,CAAC;YAClCC,YAAYV,MAAMM,cAAc,CAACI,UAAU;YAC3CC,OAAO;gBAACC,sBAAsBZ;aAAO;YACrCa,OAAOb,MAAMM,cAAc,CAACC,WAAW;QACzC;QAEA,OAAO,MAAMJ,QAAQW,IAAI,CAAC;YACxBC,QAAQf,MAAMM,cAAc,CAACU,IAAI,CAACC,EAAE;YACpCC,WAAWlB,MAAMkB,SAAS;QAC5B;IACF,EAAE,OAAOC,OAAO;QACd,OAAOC,UAAUC,YAAYF;IAC/B,SAAU;QACR,MAAMG,aAAanB;IACrB;AACF;AAEA,SAASS,sBAAsBZ,KAAmC;IAChE,MAAM,EAACgB,IAAI,EAAEO,WAAW,EAAEC,WAAW,EAAEC,YAAY,EAAC,GAAGzB,MAAMM,cAAc;IAC3E,OAAO;QACLW,IAAID,KAAKC,EAAE;QACXM;QACAG,aAAaV,KAAKU,WAAW;QAC7BC,WAAWX,KAAKW,SAAS;QACzBC,eAAeZ,KAAKY,aAAa;QACjCJ;QACA,GAAIC,iBAAiBI,YAAY,CAAC,IAAI;YAACJ;QAAY,CAAC;QACpD,GAAIT,KAAKc,OAAO,KAAKD,YACjB,CAAC,IACD;YACEC,SAASd,KAAKc,OAAO,CAACC,GAAG,CACvB,CAACC,SAAoC,CAAA;oBACnCf,IAAIe,OAAOf,EAAE;oBACbM,aAAaS,OAAOT,WAAW,IAAIS,OAAOC,KAAK;oBAC/CP,aAAaM,OAAON,WAAW;oBAC/BC,WAAWK,OAAOL,SAAS;oBAC3BC,eAAeI,OAAOJ,aAAa;gBACrC,CAAA;QAEJ,CAAC;IACP;AACF;AAEA,eAAeN,aAAanB,OAA8C;IACxE,IAAI;QACF,MAAMA,SAAS+B;IACjB,EAAE,OAAM;IACN,gEAAgE;IAClE;AACF;AAEA,SAASb,YAAYF,KAAc;IACjC,IAAIA,iBAAiBxB,0BAA0B;QAC7C,OAAO;YACLwC,MAAMhB,MAAMiB,MAAM;YAClBC,SAAS,CAAC,4BAA4B,EAAElB,MAAMiB,MAAM,EAAE;QACxD;IACF;IAEA,IAAIE,eAAenB,QAAQ;QACzB,OAAO;YACLgB,MAAM;YACNE,SAAS;QACX;IACF;IAEA,IAAIE,kBAAkBpB,QAAQ;QAC5B,OAAO;YACLgB,MAAM;YACNE,SAAS;QACX;IACF;IAEA,OAAO;QACLF,MAAM;QACNE,SAAS;IACX;AACF;AAEA,SAASC,eAAenB,KAAc;IACpC,IAAI,CAAEA,CAAAA,iBAAiBqB,KAAI,GAAI,OAAO;IACtC,OACErB,MAAMsB,IAAI,KAAK,gBACf7C,oBAAoB8C,IAAI,CAACvB,MAAMsB,IAAI,KACnC7C,oBAAoB8C,IAAI,CAACvB,MAAMkB,OAAO;AAE1C;AAEA,SAASE,kBAAkBpB,KAAc;IACvC,IAAI,CAAEA,CAAAA,iBAAiBqB,KAAI,GAAI,OAAO;IACtC,OAAO3C,2BAA2B6C,IAAI,CAACvB,MAAMsB,IAAI;AACnD;AAEA,SAASrB,UAAUrB,MAAuC;IACxD,OAAO;QACL4C,SAAS;QACTC,SAAS;YAAC;gBAACC,MAAM;gBAAQC,MAAM/C,OAAOsC,OAAO;YAAA;SAAE;QAC/CU,mBAAmB;YAACZ,MAAMpC,OAAOoC,IAAI;QAAA;IACvC;AACF"}

package/dist/presentation/routes/agent-tools-gateway/index.d.ts

@@ -0,0 +1,12 @@
+import { type RouteGroup } from '@shipfox/node-fastify';
+import type { IntegrationProviderRegistry } from '#core/providers/registry.js';
+import type { GetIntegrationConnectionByIdFn } from '#db/connections.js';
+import { type LeasedAgentStepLoader } from './resolve-authorized-tools.js';
+export type { LeasedAgentStepLoader } from './resolve-authorized-tools.js';
+export interface CreateAgentToolsGatewayRoutesParams {
+    loadLeasedAgentStep: LeasedAgentStepLoader;
+    registry: IntegrationProviderRegistry;
+    getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+}
+export declare function createAgentToolsGatewayRoutes(params: CreateAgentToolsGatewayRoutesParams): RouteGroup;
+//# sourceMappingURL=index.d.ts.map

package/dist/presentation/routes/agent-tools-gateway/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/agent-tools-gateway/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,UAAU,EAAC,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAC,2BAA2B,EAAC,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAC,8BAA8B,EAAC,MAAM,oBAAoB,CAAC;AAIvE,OAAO,EACL,KAAK,qBAAqB,EAE3B,MAAM,+BAA+B,CAAC;AAEvC,YAAY,EAAC,qBAAqB,EAAC,MAAM,+BAA+B,CAAC;AAEzE,MAAM,WAAW,mCAAmC;IAClD,mBAAmB,EAAE,qBAAqB,CAAC;IAC3C,QAAQ,EAAE,2BAA2B,CAAC;IACtC,4BAA4B,EAAE,8BAA8B,CAAC;CAC9D;AAED,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,mCAAmC,GAC1C,UAAU,CAqCZ"}

package/dist/presentation/routes/agent-tools-gateway/index.js

@@ -0,0 +1,46 @@
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { AUTH_LEASED_JOB, requireLeasedJobContext } from '@shipfox/api-auth-context';
+import { defineRoute } from '@shipfox/node-fastify';
+import { createIntegrationToolCallRecorder } from './audit.js';
+import { createIntegrationToolDispatcher } from './dispatch.js';
+import { buildAgentToolsMcpServer } from './mcp-server.js';
+import { resolveAuthorizedIntegrationTools } from './resolve-authorized-tools.js';
+export function createAgentToolsGatewayRoutes(params) {
+    const dispatchIntegrationToolCall = createIntegrationToolDispatcher({
+        registry: params.registry
+    });
+    return {
+        prefix: '/runs/jobs/current/integration-tools',
+        auth: AUTH_LEASED_JOB,
+        routes: [
+            defineRoute({
+                method: 'POST',
+                path: '/mcp',
+                description: 'Gateway MCP endpoint for integration-backed agent tools',
+                handler: async (request, reply)=>{
+                    const authorizedTools = await resolveAuthorizedIntegrationTools({
+                        request,
+                        loadLeasedAgentStep: params.loadLeasedAgentStep,
+                        registry: params.registry,
+                        getIntegrationConnectionById: params.getIntegrationConnectionById
+                    });
+                    const server = buildAgentToolsMcpServer({
+                        authorizedTools,
+                        dispatch: dispatchIntegrationToolCall,
+                        recordCall: createIntegrationToolCallRecorder(requireLeasedJobContext(request))
+                    });
+                    const transport = new StreamableHTTPServerTransport();
+                    await server.connect(transport);
+                    reply.raw.on('close', ()=>{
+                        void transport.close();
+                        void server.close();
+                    });
+                    reply.hijack();
+                    await transport.handleRequest(request.raw, reply.raw, request.body);
+                }
+            })
+        ]
+    };
+}
+
+//# sourceMappingURL=index.js.map

package/dist/presentation/routes/agent-tools-gateway/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/presentation/routes/agent-tools-gateway/index.ts"],"sourcesContent":["import {StreamableHTTPServerTransport} from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport type {Transport} from '@modelcontextprotocol/sdk/shared/transport.js';\nimport {AUTH_LEASED_JOB, requireLeasedJobContext} from '@shipfox/api-auth-context';\nimport {defineRoute, type RouteGroup} from '@shipfox/node-fastify';\nimport type {IntegrationProviderRegistry} from '#core/providers/registry.js';\nimport type {GetIntegrationConnectionByIdFn} from '#db/connections.js';\nimport {createIntegrationToolCallRecorder} from './audit.js';\nimport {createIntegrationToolDispatcher} from './dispatch.js';\nimport {buildAgentToolsMcpServer} from './mcp-server.js';\nimport {\n  type LeasedAgentStepLoader,\n  resolveAuthorizedIntegrationTools,\n} from './resolve-authorized-tools.js';\n\nexport type {LeasedAgentStepLoader} from './resolve-authorized-tools.js';\n\nexport interface CreateAgentToolsGatewayRoutesParams {\n  loadLeasedAgentStep: LeasedAgentStepLoader;\n  registry: IntegrationProviderRegistry;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n}\n\nexport function createAgentToolsGatewayRoutes(\n  params: CreateAgentToolsGatewayRoutesParams,\n): RouteGroup {\n  const dispatchIntegrationToolCall = createIntegrationToolDispatcher({registry: params.registry});\n\n  return {\n    prefix: '/runs/jobs/current/integration-tools',\n    auth: AUTH_LEASED_JOB,\n    routes: [\n      defineRoute({\n        method: 'POST',\n        path: '/mcp',\n        description: 'Gateway MCP endpoint for integration-backed agent tools',\n        handler: async (request, reply) => {\n          const authorizedTools = await resolveAuthorizedIntegrationTools({\n            request,\n            loadLeasedAgentStep: params.loadLeasedAgentStep,\n            registry: params.registry,\n            getIntegrationConnectionById: params.getIntegrationConnectionById,\n          });\n          const server = buildAgentToolsMcpServer({\n            authorizedTools,\n            dispatch: dispatchIntegrationToolCall,\n            recordCall: createIntegrationToolCallRecorder(requireLeasedJobContext(request)),\n          });\n          const transport = new StreamableHTTPServerTransport();\n\n          await server.connect(transport as unknown as Transport);\n          reply.raw.on('close', () => {\n            void transport.close();\n            void server.close();\n          });\n\n          reply.hijack();\n          await transport.handleRequest(request.raw, reply.raw, request.body);\n        },\n      }),\n    ],\n  };\n}\n"],"names":["StreamableHTTPServerTransport","AUTH_LEASED_JOB","requireLeasedJobContext","defineRoute","createIntegrationToolCallRecorder","createIntegrationToolDispatcher","buildAgentToolsMcpServer","resolveAuthorizedIntegrationTools","createAgentToolsGatewayRoutes","params","dispatchIntegrationToolCall","registry","prefix","auth","routes","method","path","description","handler","request","reply","authorizedTools","loadLeasedAgentStep","getIntegrationConnectionById","server","dispatch","recordCall","transport","connect","raw","on","close","hijack","handleRequest","body"],"mappings":"AAAA,SAAQA,6BAA6B,QAAO,qDAAqD;AAEjG,SAAQC,eAAe,EAAEC,uBAAuB,QAAO,4BAA4B;AACnF,SAAQC,WAAW,QAAwB,wBAAwB;AAGnE,SAAQC,iCAAiC,QAAO,aAAa;AAC7D,SAAQC,+BAA+B,QAAO,gBAAgB;AAC9D,SAAQC,wBAAwB,QAAO,kBAAkB;AACzD,SAEEC,iCAAiC,QAC5B,gCAAgC;AAUvC,OAAO,SAASC,8BACdC,MAA2C;IAE3C,MAAMC,8BAA8BL,gCAAgC;QAACM,UAAUF,OAAOE,QAAQ;IAAA;IAE9F,OAAO;QACLC,QAAQ;QACRC,MAAMZ;QACNa,QAAQ;YACNX,YAAY;gBACVY,QAAQ;gBACRC,MAAM;gBACNC,aAAa;gBACbC,SAAS,OAAOC,SAASC;oBACvB,MAAMC,kBAAkB,MAAMd,kCAAkC;wBAC9DY;wBACAG,qBAAqBb,OAAOa,mBAAmB;wBAC/CX,UAAUF,OAAOE,QAAQ;wBACzBY,8BAA8Bd,OAAOc,4BAA4B;oBACnE;oBACA,MAAMC,SAASlB,yBAAyB;wBACtCe;wBACAI,UAAUf;wBACVgB,YAAYtB,kCAAkCF,wBAAwBiB;oBACxE;oBACA,MAAMQ,YAAY,IAAI3B;oBAEtB,MAAMwB,OAAOI,OAAO,CAACD;oBACrBP,MAAMS,GAAG,CAACC,EAAE,CAAC,SAAS;wBACpB,KAAKH,UAAUI,KAAK;wBACpB,KAAKP,OAAOO,KAAK;oBACnB;oBAEAX,MAAMY,MAAM;oBACZ,MAAML,UAAUM,aAAa,CAACd,QAAQU,GAAG,EAAET,MAAMS,GAAG,EAAEV,QAAQe,IAAI;gBACpE;YACF;SACD;IACH;AACF"}

package/dist/presentation/routes/agent-tools-gateway/mcp-server.d.ts

@@ -0,0 +1,17 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { type CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import { type IntegrationToolCallRecorder } from './audit.js';
+import type { AuthorizedIntegrationTool, AuthorizedIntegrationToolMap } from './resolve-authorized-tools.js';
+export interface IntegrationToolDispatchInput {
+    authorizedTool: AuthorizedIntegrationTool;
+    arguments: Record<string, unknown>;
+    method?: string | undefined;
+}
+export type IntegrationToolDispatcher = (input: IntegrationToolDispatchInput) => Promise<CallToolResult>;
+export interface BuildAgentToolsMcpServerParams {
+    authorizedTools: AuthorizedIntegrationToolMap;
+    dispatch: IntegrationToolDispatcher;
+    recordCall?: IntegrationToolCallRecorder | undefined;
+}
+export declare function buildAgentToolsMcpServer(params: BuildAgentToolsMcpServerParams): Server;
+//# sourceMappingURL=mcp-server.d.ts.map

package/dist/presentation/routes/agent-tools-gateway/mcp-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/agent-tools-gateway/mcp-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,MAAM,EAAC,MAAM,2CAA2C,CAAC;AACjE,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAuB,KAAK,2BAA2B,EAAkB,MAAM,YAAY,CAAC;AACnG,OAAO,KAAK,EACV,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,4BAA4B;IAC3C,cAAc,EAAE,yBAAyB,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GAAG,CACtC,KAAK,EAAE,4BAA4B,KAChC,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B,MAAM,WAAW,8BAA8B;IAC7C,eAAe,EAAE,4BAA4B,CAAC;IAC9C,QAAQ,EAAE,yBAAyB,CAAC;IACpC,UAAU,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;CACtD;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAqFvF"}

package/dist/presentation/routes/agent-tools-gateway/mcp-server.js

@@ -0,0 +1,126 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { INVALID_METHOD_LABEL, NO_METHOD_LABEL } from './audit.js';
+export function buildAgentToolsMcpServer(params) {
+    const server = new Server({
+        name: 'shipfox-integration-tools',
+        version: '0.0.0'
+    }, {
+        capabilities: {
+            tools: {}
+        }
+    });
+    server.setRequestHandler(ListToolsRequestSchema, ()=>({
+            tools: [
+                ...params.authorizedTools.values()
+            ].map((authorizedTool)=>({
+                    name: authorizedTool.mcpName,
+                    description: authorizedTool.description,
+                    inputSchema: authorizedTool.inputSchema,
+                    ...authorizedTool.outputSchema ? {
+                        outputSchema: authorizedTool.outputSchema
+                    } : {}
+                }))
+        }));
+    server.setRequestHandler(CallToolRequestSchema, async (request)=>{
+        const authorizedTool = params.authorizedTools.get(request.params.name);
+        if (!authorizedTool) {
+            recordToolCall(params.recordCall, {
+                arguments: request.params.arguments ?? {},
+                method: NO_METHOD_LABEL,
+                outcome: 'invalid-request'
+            });
+            return toolError(`Unknown integration tool: ${request.params.name}`);
+        }
+        const args = request.params.arguments ?? {};
+        if (!isRecord(args)) {
+            recordToolCall(params.recordCall, {
+                authorizedTool,
+                arguments: args,
+                method: NO_METHOD_LABEL,
+                outcome: 'invalid-request'
+            });
+            return toolError('Tool arguments must be an object');
+        }
+        const methodValidation = validateMethod(authorizedTool, args);
+        if (methodValidation.kind === 'error') {
+            recordToolCall(params.recordCall, {
+                authorizedTool,
+                arguments: args,
+                method: INVALID_METHOD_LABEL,
+                outcome: 'invalid-request'
+            });
+            return toolError(methodValidation.message);
+        }
+        const method = methodValidation.method ?? NO_METHOD_LABEL;
+        try {
+            const result = await params.dispatch({
+                authorizedTool,
+                arguments: args,
+                method: methodValidation.method
+            });
+            recordToolCall(params.recordCall, {
+                authorizedTool,
+                arguments: args,
+                method,
+                outcome: result.isError === true ? 'tool-error' : 'success'
+            });
+            return result;
+        } catch (error) {
+            recordToolCall(params.recordCall, {
+                authorizedTool,
+                arguments: args,
+                method,
+                outcome: 'exception'
+            });
+            throw error;
+        }
+    });
+    return server;
+}
+function recordToolCall(recordCall, record) {
+    try {
+        recordCall?.(record);
+    } catch  {
+    // Audit and metrics must not affect MCP responses.
+    }
+}
+function validateMethod(authorizedTool, args) {
+    if (!authorizedTool.tool.methods) return {
+        kind: 'ok'
+    };
+    const method = args.method;
+    if (typeof method !== 'string') {
+        return {
+            kind: 'error',
+            message: 'Method-family tools require a string method argument'
+        };
+    }
+    const allowedMethods = new Set(authorizedTool.tool.methods.map((candidate)=>candidate.id));
+    if (!allowedMethods.has(method)) {
+        return {
+            kind: 'error',
+            message: `Unauthorized integration tool method: ${method}`
+        };
+    }
+    return {
+        kind: 'ok',
+        method
+    };
+}
+function toolError(message) {
+    return {
+        isError: true,
+        content: [
+            {
+                type: 'text',
+                text: message
+            }
+        ]
+    };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+//# sourceMappingURL=mcp-server.js.map

package/dist/presentation/routes/agent-tools-gateway/mcp-server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/presentation/routes/agent-tools-gateway/mcp-server.ts"],"sourcesContent":["import {Server} from '@modelcontextprotocol/sdk/server/index.js';\nimport {\n  CallToolRequestSchema,\n  type CallToolResult,\n  ListToolsRequestSchema,\n} from '@modelcontextprotocol/sdk/types.js';\nimport {INVALID_METHOD_LABEL, type IntegrationToolCallRecorder, NO_METHOD_LABEL} from './audit.js';\nimport type {\n  AuthorizedIntegrationTool,\n  AuthorizedIntegrationToolMap,\n} from './resolve-authorized-tools.js';\n\nexport interface IntegrationToolDispatchInput {\n  authorizedTool: AuthorizedIntegrationTool;\n  arguments: Record<string, unknown>;\n  method?: string | undefined;\n}\n\nexport type IntegrationToolDispatcher = (\n  input: IntegrationToolDispatchInput,\n) => Promise<CallToolResult>;\n\nexport interface BuildAgentToolsMcpServerParams {\n  authorizedTools: AuthorizedIntegrationToolMap;\n  dispatch: IntegrationToolDispatcher;\n  recordCall?: IntegrationToolCallRecorder | undefined;\n}\n\nexport function buildAgentToolsMcpServer(params: BuildAgentToolsMcpServerParams): Server {\n  const server = new Server(\n    {name: 'shipfox-integration-tools', version: '0.0.0'},\n    {capabilities: {tools: {}}},\n  );\n  server.setRequestHandler(ListToolsRequestSchema, () => ({\n    tools: [...params.authorizedTools.values()].map((authorizedTool) => ({\n      name: authorizedTool.mcpName,\n      description: authorizedTool.description,\n      inputSchema: authorizedTool.inputSchema as {\n        type: 'object';\n        properties?: Record<string, object> | undefined;\n        required?: string[] | undefined;\n      },\n      ...(authorizedTool.outputSchema\n        ? {\n            outputSchema: authorizedTool.outputSchema as {\n              type: 'object';\n              properties?: Record<string, object> | undefined;\n              required?: string[] | undefined;\n            },\n          }\n        : {}),\n    })),\n  }));\n\n  server.setRequestHandler(CallToolRequestSchema, async (request) => {\n    const authorizedTool = params.authorizedTools.get(request.params.name);\n    if (!authorizedTool) {\n      recordToolCall(params.recordCall, {\n        arguments: request.params.arguments ?? {},\n        method: NO_METHOD_LABEL,\n        outcome: 'invalid-request',\n      });\n      return toolError(`Unknown integration tool: ${request.params.name}`);\n    }\n\n    const args = request.params.arguments ?? {};\n    if (!isRecord(args)) {\n      recordToolCall(params.recordCall, {\n        authorizedTool,\n        arguments: args,\n        method: NO_METHOD_LABEL,\n        outcome: 'invalid-request',\n      });\n      return toolError('Tool arguments must be an object');\n    }\n\n    const methodValidation = validateMethod(authorizedTool, args);\n    if (methodValidation.kind === 'error') {\n      recordToolCall(params.recordCall, {\n        authorizedTool,\n        arguments: args,\n        method: INVALID_METHOD_LABEL,\n        outcome: 'invalid-request',\n      });\n      return toolError(methodValidation.message);\n    }\n    const method = methodValidation.method ?? NO_METHOD_LABEL;\n\n    try {\n      const result = await params.dispatch({\n        authorizedTool,\n        arguments: args,\n        method: methodValidation.method,\n      });\n      recordToolCall(params.recordCall, {\n        authorizedTool,\n        arguments: args,\n        method,\n        outcome: result.isError === true ? 'tool-error' : 'success',\n      });\n      return result;\n    } catch (error) {\n      recordToolCall(params.recordCall, {\n        authorizedTool,\n        arguments: args,\n        method,\n        outcome: 'exception',\n      });\n      throw error;\n    }\n  });\n\n  return server;\n}\n\nfunction recordToolCall(\n  recordCall: IntegrationToolCallRecorder | undefined,\n  record: Parameters<IntegrationToolCallRecorder>[0],\n): void {\n  try {\n    recordCall?.(record);\n  } catch {\n    // Audit and metrics must not affect MCP responses.\n  }\n}\n\nfunction validateMethod(\n  authorizedTool: AuthorizedIntegrationTool,\n  args: Record<string, unknown>,\n): {kind: 'ok'; method?: string | undefined} | {kind: 'error'; message: string} {\n  if (!authorizedTool.tool.methods) return {kind: 'ok'};\n\n  const method = args.method;\n  if (typeof method !== 'string') {\n    return {kind: 'error', message: 'Method-family tools require a string method argument'};\n  }\n\n  const allowedMethods = new Set(authorizedTool.tool.methods.map((candidate) => candidate.id));\n  if (!allowedMethods.has(method)) {\n    return {kind: 'error', message: `Unauthorized integration tool method: ${method}`};\n  }\n\n  return {kind: 'ok', method};\n}\n\nfunction toolError(message: string): CallToolResult {\n  return {\n    isError: true,\n    content: [{type: 'text', text: message}],\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n"],"names":["Server","CallToolRequestSchema","ListToolsRequestSchema","INVALID_METHOD_LABEL","NO_METHOD_LABEL","buildAgentToolsMcpServer","params","server","name","version","capabilities","tools","setRequestHandler","authorizedTools","values","map","authorizedTool","mcpName","description","inputSchema","outputSchema","request","get","recordToolCall","recordCall","arguments","method","outcome","toolError","args","isRecord","methodValidation","validateMethod","kind","message","result","dispatch","isError","error","record","tool","methods","allowedMethods","Set","candidate","id","has","content","type","text","value","Array","isArray"],"mappings":"AAAA,SAAQA,MAAM,QAAO,4CAA4C;AACjE,SACEC,qBAAqB,EAErBC,sBAAsB,QACjB,qCAAqC;AAC5C,SAAQC,oBAAoB,EAAoCC,eAAe,QAAO,aAAa;AAsBnG,OAAO,SAASC,yBAAyBC,MAAsC;IAC7E,MAAMC,SAAS,IAAIP,OACjB;QAACQ,MAAM;QAA6BC,SAAS;IAAO,GACpD;QAACC,cAAc;YAACC,OAAO,CAAC;QAAC;IAAC;IAE5BJ,OAAOK,iBAAiB,CAACV,wBAAwB,IAAO,CAAA;YACtDS,OAAO;mBAAIL,OAAOO,eAAe,CAACC,MAAM;aAAG,CAACC,GAAG,CAAC,CAACC,iBAAoB,CAAA;oBACnER,MAAMQ,eAAeC,OAAO;oBAC5BC,aAAaF,eAAeE,WAAW;oBACvCC,aAAaH,eAAeG,WAAW;oBAKvC,GAAIH,eAAeI,YAAY,GAC3B;wBACEA,cAAcJ,eAAeI,YAAY;oBAK3C,IACA,CAAC,CAAC;gBACR,CAAA;QACF,CAAA;IAEAb,OAAOK,iBAAiB,CAACX,uBAAuB,OAAOoB;QACrD,MAAML,iBAAiBV,OAAOO,eAAe,CAACS,GAAG,CAACD,QAAQf,MAAM,CAACE,IAAI;QACrE,IAAI,CAACQ,gBAAgB;YACnBO,eAAejB,OAAOkB,UAAU,EAAE;gBAChCC,WAAWJ,QAAQf,MAAM,CAACmB,SAAS,IAAI,CAAC;gBACxCC,QAAQtB;gBACRuB,SAAS;YACX;YACA,OAAOC,UAAU,CAAC,0BAA0B,EAAEP,QAAQf,MAAM,CAACE,IAAI,EAAE;QACrE;QAEA,MAAMqB,OAAOR,QAAQf,MAAM,CAACmB,SAAS,IAAI,CAAC;QAC1C,IAAI,CAACK,SAASD,OAAO;YACnBN,eAAejB,OAAOkB,UAAU,EAAE;gBAChCR;gBACAS,WAAWI;gBACXH,QAAQtB;gBACRuB,SAAS;YACX;YACA,OAAOC,UAAU;QACnB;QAEA,MAAMG,mBAAmBC,eAAehB,gBAAgBa;QACxD,IAAIE,iBAAiBE,IAAI,KAAK,SAAS;YACrCV,eAAejB,OAAOkB,UAAU,EAAE;gBAChCR;gBACAS,WAAWI;gBACXH,QAAQvB;gBACRwB,SAAS;YACX;YACA,OAAOC,UAAUG,iBAAiBG,OAAO;QAC3C;QACA,MAAMR,SAASK,iBAAiBL,MAAM,IAAItB;QAE1C,IAAI;YACF,MAAM+B,SAAS,MAAM7B,OAAO8B,QAAQ,CAAC;gBACnCpB;gBACAS,WAAWI;gBACXH,QAAQK,iBAAiBL,MAAM;YACjC;YACAH,eAAejB,OAAOkB,UAAU,EAAE;gBAChCR;gBACAS,WAAWI;gBACXH;gBACAC,SAASQ,OAAOE,OAAO,KAAK,OAAO,eAAe;YACpD;YACA,OAAOF;QACT,EAAE,OAAOG,OAAO;YACdf,eAAejB,OAAOkB,UAAU,EAAE;gBAChCR;gBACAS,WAAWI;gBACXH;gBACAC,SAAS;YACX;YACA,MAAMW;QACR;IACF;IAEA,OAAO/B;AACT;AAEA,SAASgB,eACPC,UAAmD,EACnDe,MAAkD;IAElD,IAAI;QACFf,aAAae;IACf,EAAE,OAAM;IACN,mDAAmD;IACrD;AACF;AAEA,SAASP,eACPhB,cAAyC,EACzCa,IAA6B;IAE7B,IAAI,CAACb,eAAewB,IAAI,CAACC,OAAO,EAAE,OAAO;QAACR,MAAM;IAAI;IAEpD,MAAMP,SAASG,KAAKH,MAAM;IAC1B,IAAI,OAAOA,WAAW,UAAU;QAC9B,OAAO;YAACO,MAAM;YAASC,SAAS;QAAsD;IACxF;IAEA,MAAMQ,iBAAiB,IAAIC,IAAI3B,eAAewB,IAAI,CAACC,OAAO,CAAC1B,GAAG,CAAC,CAAC6B,YAAcA,UAAUC,EAAE;IAC1F,IAAI,CAACH,eAAeI,GAAG,CAACpB,SAAS;QAC/B,OAAO;YAACO,MAAM;YAASC,SAAS,CAAC,sCAAsC,EAAER,QAAQ;QAAA;IACnF;IAEA,OAAO;QAACO,MAAM;QAAMP;IAAM;AAC5B;AAEA,SAASE,UAAUM,OAAe;IAChC,OAAO;QACLG,SAAS;QACTU,SAAS;YAAC;gBAACC,MAAM;gBAAQC,MAAMf;YAAO;SAAE;IAC1C;AACF;AAEA,SAASJ,SAASoB,KAAc;IAC9B,OAAO,OAAOA,UAAU,YAAYA,UAAU,QAAQ,CAACC,MAAMC,OAAO,CAACF;AACvE"}

package/dist/presentation/routes/agent-tools-gateway/resolve-authorized-tools.d.ts

@@ -0,0 +1,37 @@
+import { type MaterializedAgentIntegrationConfigDto, type MaterializedAgentIntegrationToolConfigDto } from '@shipfox/api-agent-dto';
+import type { IntegrationConnection } from '#core/entities/connection.js';
+import type { AgentToolJsonSchema } from '#core/providers/agent-tools.js';
+import type { IntegrationProviderRegistry } from '#core/providers/registry.js';
+import type { GetIntegrationConnectionByIdFn } from '#db/connections.js';
+export type LeasedAgentStepLoader = (params: {
+    request: object;
+    stepId: string;
+    attempt: number;
+}) => Promise<{
+    step: {
+        type: string;
+        config: Record<string, unknown>;
+    };
+    workspaceId: string;
+}>;
+export interface AuthorizedIntegrationTool {
+    mcpName: string;
+    integration: MaterializedAgentIntegrationConfigDto;
+    tool: MaterializedAgentIntegrationToolConfigDto;
+    connection: IntegrationConnection;
+    description: string;
+    inputSchema: AgentToolJsonSchema;
+    outputSchema?: AgentToolJsonSchema | undefined;
+}
+export type AuthorizedIntegrationToolMap = Map<string, AuthorizedIntegrationTool>;
+export interface ResolveAuthorizedToolsParams {
+    request: object;
+    loadLeasedAgentStep: LeasedAgentStepLoader;
+    registry: IntegrationProviderRegistry;
+    getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+}
+export declare function resolveAuthorizedIntegrationTools(params: ResolveAuthorizedToolsParams): Promise<AuthorizedIntegrationToolMap>;
+export declare function sanitizeSlug(slug: string): string;
+export declare function mcpToolName(connectionSlug: string, toolId: string): string;
+export declare function narrowMethodEnum(inputSchema: AgentToolJsonSchema, authorizedMethods: readonly string[]): AgentToolJsonSchema;
+//# sourceMappingURL=resolve-authorized-tools.d.ts.map

package/dist/presentation/routes/agent-tools-gateway/resolve-authorized-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-authorized-tools.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/agent-tools-gateway/resolve-authorized-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qCAAqC,EAC1C,KAAK,yCAAyC,EAE/C,MAAM,wBAAwB,CAAC;AAGhC,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,8BAA8B,CAAC;AAExE,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAC,2BAA2B,EAAC,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAC,8BAA8B,EAAC,MAAM,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,KAAK,OAAO,CAAC;IACZ,IAAI,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,CAAC;IACtD,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC,CAAC;AAEH,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,qCAAqC,CAAC;IACnD,IAAI,EAAE,yCAAyC,CAAC;IAChD,UAAU,EAAE,qBAAqB,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,mBAAmB,CAAC;IACjC,YAAY,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,MAAM,4BAA4B,GAAG,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;AAElF,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB,EAAE,qBAAqB,CAAC;IAC3C,QAAQ,EAAE,2BAA2B,CAAC;IACtC,4BAA4B,EAAE,8BAA8B,CAAC;CAC9D;AAED,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,4BAA4B,CAAC,CA2DvC;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,mBAAmB,EAChC,iBAAiB,EAAE,SAAS,MAAM,EAAE,GACnC,mBAAmB,CAYrB"}

package/dist/presentation/routes/agent-tools-gateway/resolve-authorized-tools.js

@@ -0,0 +1,145 @@
+import { materializedAgentStepConfigSchema } from '@shipfox/api-agent-dto';
+import { requireLeasedJobContext } from '@shipfox/api-auth-context';
+import { ClientError } from '@shipfox/node-fastify';
+export async function resolveAuthorizedIntegrationTools(params) {
+    const leasedJob = requireLeasedJobContext(params.request);
+    if (!leasedJob.currentStepId || leasedJob.currentStepAttempt === undefined) {
+        throw new ClientError('Lease does not identify a current step', 'lease-missing-step', {
+            status: 409
+        });
+    }
+    const { step, workspaceId } = await params.loadLeasedAgentStep({
+        request: params.request,
+        stepId: leasedJob.currentStepId,
+        attempt: leasedJob.currentStepAttempt
+    });
+    if (step.type !== 'agent') {
+        throw new ClientError('Current leased step is not an agent step', 'leased-step-not-agent', {
+            status: 409
+        });
+    }
+    const integrations = parseAgentIntegrations(step.config);
+    const authorizedTools = new Map();
+    for (const integration of integrations){
+        const connection = await loadAuthorizedConnection({
+            integration,
+            workspaceId,
+            registry: params.registry,
+            getIntegrationConnectionById: params.getIntegrationConnectionById
+        });
+        const catalog = await params.registry.getAdapter(integration.provider, 'agent_tools').catalog();
+        const catalogByToolId = new Map(catalog.map((entry)=>[
+                entry.id,
+                entry
+            ]));
+        for (const tool of integration.tools){
+            const catalogTool = catalogByToolId.get(tool.id);
+            const mcpName = mcpToolName(integration.connectionSlug, tool.id);
+            if (authorizedTools.has(mcpName)) {
+                throw new ClientError('Integration tool names collide after MCP namespacing', 'integration-tool-name-collision', {
+                    status: 409
+                });
+            }
+            authorizedTools.set(mcpName, {
+                mcpName,
+                integration,
+                tool,
+                connection,
+                // The live catalog enriches display metadata only. Frozen step config remains the allowlist.
+                description: catalogTool?.description ?? tool.id,
+                inputSchema: tool.methods ? toolInputSchema(tool) : tool.inputSchema,
+                outputSchema: tool.outputSchema ?? catalogTool?.outputSchema
+            });
+        }
+    }
+    return authorizedTools;
+}
+export function sanitizeSlug(slug) {
+    return slug.replaceAll('-', '_');
+}
+export function mcpToolName(connectionSlug, toolId) {
+    return `${sanitizeSlug(connectionSlug)}__${toolId}`;
+}
+export function narrowMethodEnum(inputSchema, authorizedMethods) {
+    const schema = cloneSchema(inputSchema);
+    const methodSchema = getObjectProperty(schema, 'method');
+    if (methodSchema) {
+        narrowEnumOrConst(methodSchema, authorizedMethods);
+    }
+    // Claude rejects MCP tools with a top-level oneOf. The narrowed method enum remains the
+    // authority boundary, while provider validation enforces method-specific argument shapes.
+    delete schema.oneOf;
+    return schema;
+}
+function toolInputSchema(tool) {
+    const authorizedMethods = tool.methods?.map((method)=>method.id) ?? [];
+    return narrowMethodEnum(tool.inputSchema, authorizedMethods);
+}
+function parseAgentIntegrations(config) {
+    try {
+        return materializedAgentStepConfigSchema.parse(config).integrations ?? [];
+    } catch (error) {
+        throw new ClientError('Agent step config is invalid', 'agent-step-config-invalid', {
+            status: 409,
+            cause: error
+        });
+    }
+}
+async function loadAuthorizedConnection(params) {
+    const connection = await params.getIntegrationConnectionById(params.integration.connectionId);
+    if (!connection) {
+        throw new ClientError('Integration connection is no longer available', 'integration-tool-connection-unavailable', {
+            status: 409
+        });
+    }
+    if (connection.workspaceId !== params.workspaceId) {
+        throw new ClientError('Integration connection does not belong to the leased workspace', 'integration-tool-connection-unavailable', {
+            status: 409
+        });
+    }
+    if (connection.lifecycleStatus !== 'active') {
+        throw new ClientError('Integration connection is not active', 'integration-tool-connection-unavailable', {
+            status: 409
+        });
+    }
+    if (connection.provider !== params.integration.provider) {
+        throw new ClientError('Integration connection provider changed', 'integration-tool-connection-unavailable', {
+            status: 409
+        });
+    }
+    if (!providerSupportsAgentTools(params.registry, params.integration.provider)) {
+        throw new ClientError('Integration provider no longer exposes agent tools', 'integration-tool-connection-unavailable', {
+            status: 409
+        });
+    }
+    return connection;
+}
+function providerSupportsAgentTools(registry, provider) {
+    try {
+        return registry.get(provider).capabilities.includes('agent_tools');
+    } catch  {
+        return false;
+    }
+}
+function cloneSchema(schema) {
+    return structuredClone(schema);
+}
+function getObjectProperty(schema, property) {
+    const properties = schema.properties;
+    if (!isRecord(properties)) return null;
+    const value = properties[property];
+    return isRecord(value) ? value : null;
+}
+function narrowEnumOrConst(schema, authorizedMethods) {
+    if (Array.isArray(schema.enum)) {
+        schema.enum = schema.enum.filter((value)=>typeof value === 'string' && authorizedMethods.includes(value));
+    }
+    if (typeof schema.const === 'string' && !authorizedMethods.includes(schema.const)) {
+        delete schema.const;
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+//# sourceMappingURL=resolve-authorized-tools.js.map

package/dist/presentation/routes/agent-tools-gateway/resolve-authorized-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/presentation/routes/agent-tools-gateway/resolve-authorized-tools.ts"],"sourcesContent":["import {\n  type MaterializedAgentIntegrationConfigDto,\n  type MaterializedAgentIntegrationToolConfigDto,\n  materializedAgentStepConfigSchema,\n} from '@shipfox/api-agent-dto';\nimport {requireLeasedJobContext} from '@shipfox/api-auth-context';\nimport {ClientError} from '@shipfox/node-fastify';\nimport type {IntegrationConnection} from '#core/entities/connection.js';\nimport type {IntegrationProviderKind} from '#core/entities/provider.js';\nimport type {AgentToolJsonSchema} from '#core/providers/agent-tools.js';\nimport type {IntegrationProviderRegistry} from '#core/providers/registry.js';\nimport type {GetIntegrationConnectionByIdFn} from '#db/connections.js';\n\nexport type LeasedAgentStepLoader = (params: {\n  request: object;\n  stepId: string;\n  attempt: number;\n}) => Promise<{\n  step: {type: string; config: Record<string, unknown>};\n  workspaceId: string;\n}>;\n\nexport interface AuthorizedIntegrationTool {\n  mcpName: string;\n  integration: MaterializedAgentIntegrationConfigDto;\n  tool: MaterializedAgentIntegrationToolConfigDto;\n  connection: IntegrationConnection;\n  description: string;\n  inputSchema: AgentToolJsonSchema;\n  outputSchema?: AgentToolJsonSchema | undefined;\n}\n\nexport type AuthorizedIntegrationToolMap = Map<string, AuthorizedIntegrationTool>;\n\nexport interface ResolveAuthorizedToolsParams {\n  request: object;\n  loadLeasedAgentStep: LeasedAgentStepLoader;\n  registry: IntegrationProviderRegistry;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n}\n\nexport async function resolveAuthorizedIntegrationTools(\n  params: ResolveAuthorizedToolsParams,\n): Promise<AuthorizedIntegrationToolMap> {\n  const leasedJob = requireLeasedJobContext(params.request);\n  if (!leasedJob.currentStepId || leasedJob.currentStepAttempt === undefined) {\n    throw new ClientError('Lease does not identify a current step', 'lease-missing-step', {\n      status: 409,\n    });\n  }\n\n  const {step, workspaceId} = await params.loadLeasedAgentStep({\n    request: params.request,\n    stepId: leasedJob.currentStepId,\n    attempt: leasedJob.currentStepAttempt,\n  });\n  if (step.type !== 'agent') {\n    throw new ClientError('Current leased step is not an agent step', 'leased-step-not-agent', {\n      status: 409,\n    });\n  }\n\n  const integrations = parseAgentIntegrations(step.config);\n  const authorizedTools: AuthorizedIntegrationToolMap = new Map();\n\n  for (const integration of integrations) {\n    const connection = await loadAuthorizedConnection({\n      integration,\n      workspaceId,\n      registry: params.registry,\n      getIntegrationConnectionById: params.getIntegrationConnectionById,\n    });\n    const catalog = await params.registry.getAdapter(integration.provider, 'agent_tools').catalog();\n    const catalogByToolId = new Map(catalog.map((entry) => [entry.id, entry]));\n\n    for (const tool of integration.tools) {\n      const catalogTool = catalogByToolId.get(tool.id);\n      const mcpName = mcpToolName(integration.connectionSlug, tool.id);\n      if (authorizedTools.has(mcpName)) {\n        throw new ClientError(\n          'Integration tool names collide after MCP namespacing',\n          'integration-tool-name-collision',\n          {\n            status: 409,\n          },\n        );\n      }\n\n      authorizedTools.set(mcpName, {\n        mcpName,\n        integration,\n        tool,\n        connection,\n        // The live catalog enriches display metadata only. Frozen step config remains the allowlist.\n        description: catalogTool?.description ?? tool.id,\n        inputSchema: tool.methods ? toolInputSchema(tool) : tool.inputSchema,\n        outputSchema: tool.outputSchema ?? catalogTool?.outputSchema,\n      });\n    }\n  }\n\n  return authorizedTools;\n}\n\nexport function sanitizeSlug(slug: string): string {\n  return slug.replaceAll('-', '_');\n}\n\nexport function mcpToolName(connectionSlug: string, toolId: string): string {\n  return `${sanitizeSlug(connectionSlug)}__${toolId}`;\n}\n\nexport function narrowMethodEnum(\n  inputSchema: AgentToolJsonSchema,\n  authorizedMethods: readonly string[],\n): AgentToolJsonSchema {\n  const schema = cloneSchema(inputSchema);\n  const methodSchema = getObjectProperty(schema, 'method');\n  if (methodSchema) {\n    narrowEnumOrConst(methodSchema, authorizedMethods);\n  }\n\n  // Claude rejects MCP tools with a top-level oneOf. The narrowed method enum remains the\n  // authority boundary, while provider validation enforces method-specific argument shapes.\n  delete schema.oneOf;\n\n  return schema;\n}\n\nfunction toolInputSchema(tool: MaterializedAgentIntegrationToolConfigDto): AgentToolJsonSchema {\n  const authorizedMethods = tool.methods?.map((method) => method.id) ?? [];\n  return narrowMethodEnum(tool.inputSchema, authorizedMethods);\n}\n\nfunction parseAgentIntegrations(\n  config: Record<string, unknown>,\n): MaterializedAgentIntegrationConfigDto[] {\n  try {\n    return materializedAgentStepConfigSchema.parse(config).integrations ?? [];\n  } catch (error) {\n    throw new ClientError('Agent step config is invalid', 'agent-step-config-invalid', {\n      status: 409,\n      cause: error,\n    });\n  }\n}\n\nasync function loadAuthorizedConnection(params: {\n  integration: MaterializedAgentIntegrationConfigDto;\n  workspaceId: string;\n  registry: IntegrationProviderRegistry;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n}): Promise<IntegrationConnection> {\n  const connection = await params.getIntegrationConnectionById(params.integration.connectionId);\n  if (!connection) {\n    throw new ClientError(\n      'Integration connection is no longer available',\n      'integration-tool-connection-unavailable',\n      {\n        status: 409,\n      },\n    );\n  }\n  if (connection.workspaceId !== params.workspaceId) {\n    throw new ClientError(\n      'Integration connection does not belong to the leased workspace',\n      'integration-tool-connection-unavailable',\n      {\n        status: 409,\n      },\n    );\n  }\n  if (connection.lifecycleStatus !== 'active') {\n    throw new ClientError(\n      'Integration connection is not active',\n      'integration-tool-connection-unavailable',\n      {\n        status: 409,\n      },\n    );\n  }\n  if (connection.provider !== params.integration.provider) {\n    throw new ClientError(\n      'Integration connection provider changed',\n      'integration-tool-connection-unavailable',\n      {\n        status: 409,\n      },\n    );\n  }\n  if (!providerSupportsAgentTools(params.registry, params.integration.provider)) {\n    throw new ClientError(\n      'Integration provider no longer exposes agent tools',\n      'integration-tool-connection-unavailable',\n      {\n        status: 409,\n      },\n    );\n  }\n\n  return connection;\n}\n\nfunction providerSupportsAgentTools(\n  registry: IntegrationProviderRegistry,\n  provider: IntegrationProviderKind,\n): boolean {\n  try {\n    return registry.get(provider).capabilities.includes('agent_tools');\n  } catch {\n    return false;\n  }\n}\n\nfunction cloneSchema(schema: AgentToolJsonSchema): AgentToolJsonSchema {\n  return structuredClone(schema);\n}\n\nfunction getObjectProperty(\n  schema: AgentToolJsonSchema,\n  property: string,\n): AgentToolJsonSchema | null {\n  const properties = schema.properties;\n  if (!isRecord(properties)) return null;\n  const value = properties[property];\n  return isRecord(value) ? value : null;\n}\n\nfunction narrowEnumOrConst(\n  schema: AgentToolJsonSchema,\n  authorizedMethods: readonly string[],\n): void {\n  if (Array.isArray(schema.enum)) {\n    schema.enum = schema.enum.filter(\n      (value): value is string => typeof value === 'string' && authorizedMethods.includes(value),\n    );\n  }\n  if (typeof schema.const === 'string' && !authorizedMethods.includes(schema.const)) {\n    delete schema.const;\n  }\n}\n\nfunction isRecord(value: unknown): value is AgentToolJsonSchema {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n"],"names":["materializedAgentStepConfigSchema","requireLeasedJobContext","ClientError","resolveAuthorizedIntegrationTools","params","leasedJob","request","currentStepId","currentStepAttempt","undefined","status","step","workspaceId","loadLeasedAgentStep","stepId","attempt","type","integrations","parseAgentIntegrations","config","authorizedTools","Map","integration","connection","loadAuthorizedConnection","registry","getIntegrationConnectionById","catalog","getAdapter","provider","catalogByToolId","map","entry","id","tool","tools","catalogTool","get","mcpName","mcpToolName","connectionSlug","has","set","description","inputSchema","methods","toolInputSchema","outputSchema","sanitizeSlug","slug","replaceAll","toolId","narrowMethodEnum","authorizedMethods","schema","cloneSchema","methodSchema","getObjectProperty","narrowEnumOrConst","oneOf","method","parse","error","cause","connectionId","lifecycleStatus","providerSupportsAgentTools","capabilities","includes","structuredClone","property","properties","isRecord","value","Array","isArray","enum","filter","const"],"mappings":"AAAA,SAGEA,iCAAiC,QAC5B,yBAAyB;AAChC,SAAQC,uBAAuB,QAAO,4BAA4B;AAClE,SAAQC,WAAW,QAAO,wBAAwB;AAmClD,OAAO,eAAeC,kCACpBC,MAAoC;IAEpC,MAAMC,YAAYJ,wBAAwBG,OAAOE,OAAO;IACxD,IAAI,CAACD,UAAUE,aAAa,IAAIF,UAAUG,kBAAkB,KAAKC,WAAW;QAC1E,MAAM,IAAIP,YAAY,0CAA0C,sBAAsB;YACpFQ,QAAQ;QACV;IACF;IAEA,MAAM,EAACC,IAAI,EAAEC,WAAW,EAAC,GAAG,MAAMR,OAAOS,mBAAmB,CAAC;QAC3DP,SAASF,OAAOE,OAAO;QACvBQ,QAAQT,UAAUE,aAAa;QAC/BQ,SAASV,UAAUG,kBAAkB;IACvC;IACA,IAAIG,KAAKK,IAAI,KAAK,SAAS;QACzB,MAAM,IAAId,YAAY,4CAA4C,yBAAyB;YACzFQ,QAAQ;QACV;IACF;IAEA,MAAMO,eAAeC,uBAAuBP,KAAKQ,MAAM;IACvD,MAAMC,kBAAgD,IAAIC;IAE1D,KAAK,MAAMC,eAAeL,aAAc;QACtC,MAAMM,aAAa,MAAMC,yBAAyB;YAChDF;YACAV;YACAa,UAAUrB,OAAOqB,QAAQ;YACzBC,8BAA8BtB,OAAOsB,4BAA4B;QACnE;QACA,MAAMC,UAAU,MAAMvB,OAAOqB,QAAQ,CAACG,UAAU,CAACN,YAAYO,QAAQ,EAAE,eAAeF,OAAO;QAC7F,MAAMG,kBAAkB,IAAIT,IAAIM,QAAQI,GAAG,CAAC,CAACC,QAAU;gBAACA,MAAMC,EAAE;gBAAED;aAAM;QAExE,KAAK,MAAME,QAAQZ,YAAYa,KAAK,CAAE;YACpC,MAAMC,cAAcN,gBAAgBO,GAAG,CAACH,KAAKD,EAAE;YAC/C,MAAMK,UAAUC,YAAYjB,YAAYkB,cAAc,EAAEN,KAAKD,EAAE;YAC/D,IAAIb,gBAAgBqB,GAAG,CAACH,UAAU;gBAChC,MAAM,IAAIpC,YACR,wDACA,mCACA;oBACEQ,QAAQ;gBACV;YAEJ;YAEAU,gBAAgBsB,GAAG,CAACJ,SAAS;gBAC3BA;gBACAhB;gBACAY;gBACAX;gBACA,6FAA6F;gBAC7FoB,aAAaP,aAAaO,eAAeT,KAAKD,EAAE;gBAChDW,aAAaV,KAAKW,OAAO,GAAGC,gBAAgBZ,QAAQA,KAAKU,WAAW;gBACpEG,cAAcb,KAAKa,YAAY,IAAIX,aAAaW;YAClD;QACF;IACF;IAEA,OAAO3B;AACT;AAEA,OAAO,SAAS4B,aAAaC,IAAY;IACvC,OAAOA,KAAKC,UAAU,CAAC,KAAK;AAC9B;AAEA,OAAO,SAASX,YAAYC,cAAsB,EAAEW,MAAc;IAChE,OAAO,GAAGH,aAAaR,gBAAgB,EAAE,EAAEW,QAAQ;AACrD;AAEA,OAAO,SAASC,iBACdR,WAAgC,EAChCS,iBAAoC;IAEpC,MAAMC,SAASC,YAAYX;IAC3B,MAAMY,eAAeC,kBAAkBH,QAAQ;IAC/C,IAAIE,cAAc;QAChBE,kBAAkBF,cAAcH;IAClC;IAEA,wFAAwF;IACxF,0FAA0F;IAC1F,OAAOC,OAAOK,KAAK;IAEnB,OAAOL;AACT;AAEA,SAASR,gBAAgBZ,IAA+C;IACtE,MAAMmB,oBAAoBnB,KAAKW,OAAO,EAAEd,IAAI,CAAC6B,SAAWA,OAAO3B,EAAE,KAAK,EAAE;IACxE,OAAOmB,iBAAiBlB,KAAKU,WAAW,EAAES;AAC5C;AAEA,SAASnC,uBACPC,MAA+B;IAE/B,IAAI;QACF,OAAOnB,kCAAkC6D,KAAK,CAAC1C,QAAQF,YAAY,IAAI,EAAE;IAC3E,EAAE,OAAO6C,OAAO;QACd,MAAM,IAAI5D,YAAY,gCAAgC,6BAA6B;YACjFQ,QAAQ;YACRqD,OAAOD;QACT;IACF;AACF;AAEA,eAAetC,yBAAyBpB,MAKvC;IACC,MAAMmB,aAAa,MAAMnB,OAAOsB,4BAA4B,CAACtB,OAAOkB,WAAW,CAAC0C,YAAY;IAC5F,IAAI,CAACzC,YAAY;QACf,MAAM,IAAIrB,YACR,iDACA,2CACA;YACEQ,QAAQ;QACV;IAEJ;IACA,IAAIa,WAAWX,WAAW,KAAKR,OAAOQ,WAAW,EAAE;QACjD,MAAM,IAAIV,YACR,kEACA,2CACA;YACEQ,QAAQ;QACV;IAEJ;IACA,IAAIa,WAAW0C,eAAe,KAAK,UAAU;QAC3C,MAAM,IAAI/D,YACR,wCACA,2CACA;YACEQ,QAAQ;QACV;IAEJ;IACA,IAAIa,WAAWM,QAAQ,KAAKzB,OAAOkB,WAAW,CAACO,QAAQ,EAAE;QACvD,MAAM,IAAI3B,YACR,2CACA,2CACA;YACEQ,QAAQ;QACV;IAEJ;IACA,IAAI,CAACwD,2BAA2B9D,OAAOqB,QAAQ,EAAErB,OAAOkB,WAAW,CAACO,QAAQ,GAAG;QAC7E,MAAM,IAAI3B,YACR,sDACA,2CACA;YACEQ,QAAQ;QACV;IAEJ;IAEA,OAAOa;AACT;AAEA,SAAS2C,2BACPzC,QAAqC,EACrCI,QAAiC;IAEjC,IAAI;QACF,OAAOJ,SAASY,GAAG,CAACR,UAAUsC,YAAY,CAACC,QAAQ,CAAC;IACtD,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA,SAASb,YAAYD,MAA2B;IAC9C,OAAOe,gBAAgBf;AACzB;AAEA,SAASG,kBACPH,MAA2B,EAC3BgB,QAAgB;IAEhB,MAAMC,aAAajB,OAAOiB,UAAU;IACpC,IAAI,CAACC,SAASD,aAAa,OAAO;IAClC,MAAME,QAAQF,UAAU,CAACD,SAAS;IAClC,OAAOE,SAASC,SAASA,QAAQ;AACnC;AAEA,SAASf,kBACPJ,MAA2B,EAC3BD,iBAAoC;IAEpC,IAAIqB,MAAMC,OAAO,CAACrB,OAAOsB,IAAI,GAAG;QAC9BtB,OAAOsB,IAAI,GAAGtB,OAAOsB,IAAI,CAACC,MAAM,CAC9B,CAACJ,QAA2B,OAAOA,UAAU,YAAYpB,kBAAkBe,QAAQ,CAACK;IAExF;IACA,IAAI,OAAOnB,OAAOwB,KAAK,KAAK,YAAY,CAACzB,kBAAkBe,QAAQ,CAACd,OAAOwB,KAAK,GAAG;QACjF,OAAOxB,OAAOwB,KAAK;IACrB;AACF;AAEA,SAASN,SAASC,KAAc;IAC9B,OAAO,OAAOA,UAAU,YAAYA,UAAU,QAAQ,CAACC,MAAMC,OAAO,CAACF;AACvE"}

package/dist/presentation/routes/errors.d.ts

@@ -0,0 +1,2 @@
+export declare function integrationRouteErrorHandler(error: unknown): never;
+//# sourceMappingURL=errors.d.ts.map

package/dist/presentation/routes/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/errors.ts"],"names":[],"mappings":"AAoCA,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CA0BlE"}