@softure-ai/mcp-access 0.0.0-stage → 0.1.6

package/dist/next/pages.js

@@ -0,0 +1,61 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+// The token page, ready to mount with one line:
+// `export { McpAccessPage as default } from "@softure-ai/mcp-access/next"`.
+// A server component for the signed-in user; without a session it redirects to the login page and
+// back. Everything the client part shows is prepared here, so dates are formatted once, in the
+// app's locale and time zone, and never differ between the server render and hydration.
+import { requireUser } from "@softure-ai/auth/next";
+import { formatMessage } from "@softure-ai/core";
+import { getSoftureConfig } from "@softure-ai/core/next";
+import { Card } from "@softure-ai/ui";
+import { getLocalizedText, getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes } from "../server/options.js";
+import { listAccessTokens } from "../server/tokens.js";
+import { getAccessTokenStatus } from "../token-status.js";
+import { TokenManager } from "../ui/token-manager.js";
+import { issueTokenAction, revokeTokenAction } from "./actions.js";
+import { getMcpAccessContext } from "./context.js";
+import { formatDate, formatDateTime } from "./format.js";
+const LAYOUT_CLASS = "sft:mx-auto sft:box-border sft:w-full sft:sm:max-w-3xl sft:px-4 sft:py-4";
+function describeStatus(status, messages) {
+    switch (status.kind) {
+        case "active":
+            return messages.list.active;
+        case "expired":
+            return messages.list.expired;
+        case "expiring":
+            if (status.daysLeft === 0)
+                return messages.list.expiresToday;
+            if (status.daysLeft === 1)
+                return messages.list.expiresTomorrow;
+            return formatMessage(messages.list.expiresInDays, { days: status.daysLeft });
+    }
+}
+function toRow(token, now, config, options, messages) {
+    const status = getAccessTokenStatus(token.expiresAt, now, { timezone: config.timezone, warningDays: options.expiryWarningDays });
+    const isExpired = status.kind === "expired";
+    const expiry = formatMessage(isExpired ? messages.list.expiredOn : messages.list.expiresOn, { date: formatDate(config, token.expiresAt) });
+    const lastUse = token.lastUsedAt === null ? messages.list.neverUsed : formatMessage(messages.list.lastUsed, { date: formatDateTime(config, token.lastUsedAt) });
+    return {
+        id: token.id,
+        name: token.name,
+        scopeText: token.canWrite && options.allowWrites ? messages.list.readWrite : messages.list.readOnly,
+        statusText: describeStatus(status, messages),
+        isExpired,
+        details: [formatMessage(messages.list.createdOn, { date: formatDate(config, token.createdAt) }), expiry, lastUse],
+    };
+}
+function toTool(tool, config, options, messages) {
+    const accessText = tool.access === "read" ? messages.tools.read : options.allowWrites ? messages.tools.write : messages.tools.writeUnavailable;
+    return { name: tool.name, description: getLocalizedText(tool.description, config.locale), accessText };
+}
+export async function McpAccessPage() {
+    const config = getSoftureConfig();
+    const user = await requireUser({ next: getMcpAccessRoutes(config).page });
+    const options = getMcpAccessOptions(config);
+    const messages = getMcpAccessMessages(config);
+    const ctx = await getMcpAccessContext(config);
+    const now = ctx.clock.now();
+    const tokens = await listAccessTokens(ctx, user.id);
+    return (_jsx("main", { className: LAYOUT_CLASS, children: _jsx(Card, { title: messages.page.title, subtitle: messages.page.lead, children: _jsx(TokenManager, { tools: options.tools.map((tool) => toTool(tool, config, options, messages)), tokens: tokens.map((token) => toRow(token, now, config, options, messages)), allowWrites: options.allowWrites, maxTokens: options.maxTokensPerUser, issueAction: issueTokenAction, revokeAction: revokeTokenAction, messages: messages, locale: config.locale }) }) }));
+}
+//# sourceMappingURL=pages.js.map

package/dist/next/pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../src/next/pages.tsx"],"names":[],"mappings":";AAAA,gDAAgD;AAChD,4EAA4E;AAC5E,kGAAkG;AAClG,+FAA+F;AAC/F,wFAAwF;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAsB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAItC,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACvH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAA+C,MAAM,wBAAwB,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,YAAY,GAAG,0EAA0E,CAAC;AAEhG,SAAS,cAAc,CAAC,MAAyB,EAAE,QAA2B;IAC5E,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QAC/B,KAAK,UAAU;YACb,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;YAC7D,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC;YAChE,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,KAAsB,EAAE,GAAS,EAAE,MAAqB,EAAE,OAAyB,EAAE,QAA2B;IAC7H,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACjI,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;IAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3I,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAChK,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ;QACnG,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC5C,SAAS;QACT,OAAO,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC;KAClH,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAuC,EAAE,MAAqB,EAAE,OAAyB,EAAE,QAA2B;IACpI,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC/I,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;AACzG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,OAAO,CACL,eAAM,SAAS,EAAE,YAAY,YAC3B,KAAC,IAAI,IAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,YAC5D,KAAC,YAAY,IACX,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAC3E,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAC3E,WAAW,EAAE,OAAO,CAAC,WAAW,EAChC,SAAS,EAAE,OAAO,CAAC,gBAAgB,EACnC,WAAW,EAAE,gBAAgB,EAC7B,YAAY,EAAE,iBAAiB,EAC/B,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,GACrB,GACG,GACF,CACR,CAAC;AACJ,CAAC"}

package/dist/next/route.d.ts

@@ -0,0 +1,3 @@
+import { type McpEndpointOptions } from "../server/endpoint.js";
+export declare function createMcpRoute(options: McpEndpointOptions): (request: Request) => Promise<Response>;
+//# sourceMappingURL=route.d.ts.map

package/dist/next/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../src/next/route.ts"],"names":[],"mappings":"AAMA,OAAO,EAAqB,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAKnF,wBAAgB,cAAc,CAAC,OAAO,EAAE,kBAAkB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAYnG"}

package/dist/next/route.js

@@ -0,0 +1,24 @@
+// `POST /api/mcp`, built around the app's MCP server factory and mounted with one line:
+// `app/api/mcp/route.ts → export const POST = createMcpRoute({ createServer });`
+// The factory lives in the app, next to its tools; the module brings the rate limit, the token
+// check and the identity the factory receives. GET and DELETE are not exported, so Next answers
+// them with 405: the endpoint is stateless and keeps no sessions.
+import { errorLogLabel } from "@softure-ai/core";
+import { createMcpEndpoint } from "../server/endpoint.js";
+import { getMcpAccessContext } from "./context.js";
+const NO_STORE = { "cache-control": "no-store" };
+export function createMcpRoute(options) {
+    const endpoint = createMcpEndpoint(options);
+    return async (request) => {
+        let ctx;
+        try {
+            ctx = await getMcpAccessContext();
+        }
+        catch (error) {
+            console.error(`@softure-ai/mcp-access: opening the database failed: ${errorLogLabel(error)}`);
+            return Response.json({ error: "temporarily_unavailable" }, { status: 503, headers: NO_STORE });
+        }
+        return endpoint(ctx, request);
+    };
+}
+//# sourceMappingURL=route.js.map

package/dist/next/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../src/next/route.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,iFAAiF;AACjF,+FAA+F;AAC/F,gGAAgG;AAChG,kEAAkE;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAA2B,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAEjD,MAAM,UAAU,cAAc,CAAC,OAA2B;IACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wDAAwD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9F,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC;AACJ,CAAC"}

package/dist/options.d.ts

@@ -0,0 +1,43 @@
+import { z } from "zod";
+/** The name an MCP client lists the server under: no spaces, so a shell command needs no quotes. */
+export declare const SERVER_NAME_PATTERN: RegExp;
+/** The MCP rule for tool names: 1 to 128 of A-Z, a-z, 0-9, `_`, `-` and `.`. */
+export declare const TOOL_NAME_PATTERN: RegExp;
+/** The longest token name the table takes (`access_tokens.name`). */
+export declare const MAX_TOKEN_NAME_LENGTH = 60;
+declare const toolSchema: z.ZodObject<{
+    name: z.ZodString;
+    access: z.ZodEnum<{
+        read: "read";
+        write: "write";
+    }>;
+    description: z.ZodRecord<z.ZodEnum<{
+        en: "en";
+        pl: "pl";
+    }> & z.core.$partial, z.ZodString>;
+}, z.core.$strict>;
+export declare const mcpAccessOptionsSchema: z.ZodObject<{
+    serverName: z.ZodString;
+    tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        access: z.ZodEnum<{
+            read: "read";
+            write: "write";
+        }>;
+        description: z.ZodRecord<z.ZodEnum<{
+            en: "en";
+            pl: "pl";
+        }> & z.core.$partial, z.ZodString>;
+    }, z.core.$strict>>>;
+    allowWrites: z.ZodDefault<z.ZodBoolean>;
+    tokenLifetimeDays: z.ZodDefault<z.ZodInt>;
+    maxTokensPerUser: z.ZodDefault<z.ZodInt>;
+    expiryWarningDays: z.ZodDefault<z.ZodInt>;
+}, z.core.$strict>;
+export type McpAccessOptionsInput = z.input<typeof mcpAccessOptionsSchema>;
+export type McpAccessOptions = z.output<typeof mcpAccessOptionsSchema>;
+export type McpToolDefinitionInput = z.input<typeof toolSchema>;
+export type McpToolDefinition = z.output<typeof toolSchema>;
+export type McpToolAccess = McpToolDefinition["access"];
+export {};
+//# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oGAAoG;AACpG,eAAO,MAAM,mBAAmB,QAA2C,CAAC;AAE5E,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,QAA4B,CAAC;AAE3D,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAKxC,QAAA,MAAM,UAAU;;;;;;;;;;kBAUd,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;kBAuB/B,CAAC;AAEL,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC3E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAChE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC;AAC5D,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC"}

package/dist/options.js

@@ -0,0 +1,47 @@
+// The options an app passes to `mcpAccess({ ... })` in softure.config.ts, parsed at startup.
+import { LOCALES } from "@softure-ai/core";
+import { z } from "zod";
+/** The name an MCP client lists the server under: no spaces, so a shell command needs no quotes. */
+export const SERVER_NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
+/** The MCP rule for tool names: 1 to 128 of A-Z, a-z, 0-9, `_`, `-` and `.`. */
+export const TOOL_NAME_PATTERN = /^[A-Za-z0-9_.-]{1,128}$/;
+/** The longest token name the table takes (`access_tokens.name`). */
+export const MAX_TOKEN_NAME_LENGTH = 60;
+/** Copy per locale; a locale without its own text falls back to `en`. */
+const localizedTextSchema = z.partialRecord(z.enum(LOCALES), z.string().trim().min(1).max(500));
+const toolSchema = z.strictObject({
+    /** The tool's name as the app's MCP server registers it. */
+    name: z.string().regex(TOOL_NAME_PATTERN, "must be 1 to 128 of A-Z, a-z, 0-9, _, - and ."),
+    /**
+     * `write` tools change data: the app registers them only for a token that can write. They stay
+     * listed while `allowWrites` is off, marked as unavailable.
+     */
+    access: z.enum(["read", "write"]),
+    /** What the tool does, for the owner deciding which token to issue. */
+    description: localizedTextSchema.refine((text) => text.en !== undefined, "needs at least an en text"),
+});
+export const mcpAccessOptionsSchema = z
+    .strictObject({
+    /** The name MCP clients list the server under, e.g. "acme". Used in the setup instructions. */
+    serverName: z.string().regex(SERVER_NAME_PATTERN, "must be lowercase letters, digits and inner dashes, at most 64 characters"),
+    /** The app's tool catalog, shown on the token page. The MCP server itself comes from the route. */
+    tools: z.array(toolSchema).default([]),
+    /** Lets write tokens be issued and used. Off, every token reads only, write tokens included. */
+    allowWrites: z.boolean().default(false),
+    /** How long a token works. A choice: longer than a session, never forever. */
+    tokenLifetimeDays: z.int().min(1).max(365).default(90),
+    /** How many unexpired tokens one account may hold. */
+    maxTokensPerUser: z.int().min(1).max(100).default(20),
+    /** From how many calendar days before its expiry the page warns about a token. */
+    expiryWarningDays: z.int().min(0).max(60).default(14),
+})
+    .superRefine((options, context) => {
+    const names = new Set();
+    options.tools.forEach((tool, index) => {
+        if (names.has(tool.name)) {
+            context.addIssue({ code: "custom", path: ["tools", index, "name"], message: `"${tool.name}" is listed twice` });
+        }
+        names.add(tool.name);
+    });
+});
+//# sourceMappingURL=options.js.map

package/dist/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oGAAoG;AACpG,MAAM,CAAC,MAAM,mBAAmB,GAAG,wCAAwC,CAAC;AAE5E,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAE3D,qEAAqE;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAEhG,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IAChC,4DAA4D;IAC5D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,+CAA+C,CAAC;IAC1F;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uEAAuE;IACvE,WAAW,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,EAAE,2BAA2B,CAAC;CACtG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,YAAY,CAAC;IACZ,+FAA+F;IAC/F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,2EAA2E,CAAC;IAC9H,mGAAmG;IACnG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,gGAAgG;IAChG,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,8EAA8E;IAC9E,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,sDAAsD;IACtD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,kFAAkF;IAClF,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACtD,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACpC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,145 @@
+export declare const mcpSchema: import("drizzle-orm/pg-core").PgSchema<"mcp">;
+export declare const accessTokens: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "access_tokens";
+    schema: "mcp";
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "access_tokens";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "access_tokens";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: import("drizzle-orm/pg-core").PgColumn<{
+            name: "name";
+            tableName: "access_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tokenHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "token_hash";
+            tableName: "access_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        canWrite: import("drizzle-orm/pg-core").PgColumn<{
+            name: "can_write";
+            tableName: "access_tokens";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "access_tokens";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "access_tokens";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        lastUsedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_used_at";
+            tableName: "access_tokens";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,SAAS,+CAAkB,CAAC;AAEzC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWvB,CAAC"}

package/dist/schema.js

@@ -0,0 +1,18 @@
+// Drizzle view of the module's table (migrations/0001_create_access_tokens.sql). The migration is
+// the source of truth; this file only types the queries.
+import { users } from "@softure-ai/auth";
+import { boolean, pgSchema, text, timestamp, uuid } from "drizzle-orm/pg-core";
+export const mcpSchema = pgSchema("mcp");
+export const accessTokens = mcpSchema.table("access_tokens", {
+    id: uuid("id").primaryKey().defaultRandom(),
+    userId: uuid("user_id")
+        .notNull()
+        .references(() => users.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    tokenHash: text("token_hash").notNull().unique("access_tokens_token_hash_key"),
+    canWrite: boolean("can_write").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+});
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,yDAAyD;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE/E,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,EAAE;IAC3D,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,8BAA8B,CAAC;IAC9E,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACpE,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACpE,UAAU,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;CAC9D,CAAC,CAAC"}

package/dist/server/endpoint.d.ts

@@ -0,0 +1,26 @@
+import { type McpServer, type Server } from "@modelcontextprotocol/server";
+import type { McpServerIdentity } from "../contract.js";
+import { type McpAccessContext } from "./tokens.js";
+/** Every valid token reads. */
+export declare const MCP_READ_SCOPE = "mcp:read";
+/** A token that may write: issued for writes, and the app allows them. */
+export declare const MCP_WRITE_SCOPE = "mcp:write";
+/** The security bucket the endpoint counts in; `MCP_RATE_LIMIT_BUCKETS` holds its default. */
+export declare const MCP_RATE_LIMIT_BUCKET = "mcp";
+/** Larger bodies get 413 from the SDK before anything is parsed. No tool call needs more. */
+export declare const MAX_MCP_REQUEST_BYTES: number;
+/** The app's MCP server for one request. It registers write tools only when `canWrite` is true. */
+export type McpServerFactory = (identity: McpServerIdentity) => McpServer | Server | Promise<McpServer | Server>;
+export interface McpEndpointOptions {
+    readonly createServer: McpServerFactory;
+}
+/** Serves one request to the MCP endpoint. */
+export type McpEndpoint = (ctx: McpAccessContext, request: Request) => Promise<Response>;
+/**
+ * The endpoint around the app's factory. The factory runs once per request with that request's
+ * identity, so one account's server never answers another's request. Answers are plain JSON
+ * (`responseMode: "json"`): a stream would add proxy buffering and timeouts for no tool that needs
+ * it, and mid-call notifications are dropped.
+ */
+export declare function createMcpEndpoint({ createServer }: McpEndpointOptions): McpEndpoint;
+//# sourceMappingURL=endpoint.d.ts.map

package/dist/server/endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint.d.ts","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAKA,OAAO,EAML,KAAK,SAAS,EACd,KAAK,MAAM,EACZ,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEvE,+BAA+B;AAC/B,eAAO,MAAM,cAAc,aAAa,CAAC;AACzC,0EAA0E;AAC1E,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C,8FAA8F;AAC9F,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAOjD,mGAAmG;AACnG,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,iBAAiB,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;AAEjH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;CACzC;AAED,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEzF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,YAAY,EAAE,EAAE,kBAAkB,GAAG,WAAW,CAmCnF"}

package/dist/server/endpoint.js

@@ -0,0 +1,107 @@
+// The MCP endpoint (FIRE_TRACKER `src/app/api/mcp/route.ts`, generalised). It takes a Web
+// `Request` and returns a `Response`, so it runs under any fetch-shaped host; the Next adapter only
+// supplies the context. Order: identify the client, count the request, verify the Bearer token,
+// then hand the request to a fresh server from the app's factory. Each refusal happens before the
+// next step costs anything.
+import { bearerAuthChallengeResponse, createMcpHandler, OAuthError, OAuthErrorCode, } from "@modelcontextprotocol/server";
+import { errorLogLabel, getModule } from "@softure-ai/core";
+import { consumeRateLimit, identifyClient } from "@softure-ai/security/server";
+import { verifyAccessToken } from "./tokens.js";
+/** Every valid token reads. */
+export const MCP_READ_SCOPE = "mcp:read";
+/** A token that may write: issued for writes, and the app allows them. */
+export const MCP_WRITE_SCOPE = "mcp:write";
+/** The security bucket the endpoint counts in; `MCP_RATE_LIMIT_BUCKETS` holds its default. */
+export const MCP_RATE_LIMIT_BUCKET = "mcp";
+/** Larger bodies get 413 from the SDK before anything is parsed. No tool call needs more. */
+export const MAX_MCP_REQUEST_BYTES = 1024 * 1024;
+/** `AuthInfo.extra` key that carries the owner's user id to the factory. */
+const USER_ID_CLAIM = "userId";
+const BEARER_PREFIX = /^Bearer[ \t]+/i;
+const NO_STORE = { "cache-control": "no-store" };
+/**
+ * The endpoint around the app's factory. The factory runs once per request with that request's
+ * identity, so one account's server never answers another's request. Answers are plain JSON
+ * (`responseMode: "json"`): a stream would add proxy buffering and timeouts for no tool that needs
+ * it, and mid-call notifications are dropped.
+ */
+export function createMcpEndpoint({ createServer }) {
+    const handler = createMcpHandler((requestContext) => createServer(readIdentity(requestContext.authInfo)), {
+        responseMode: "json",
+        maxRequestBodySize: MAX_MCP_REQUEST_BYTES,
+        onerror: (error) => console.error(`@softure-ai/mcp-access: the MCP handler reported: ${errorLogLabel(error)}`),
+    });
+    return async (ctx, request) => {
+        assertRateLimitBucket(ctx);
+        const client = identifyClient(ctx, request.headers);
+        if (!client.ok)
+            return Response.json({ error: "client_unidentified" }, { status: 400, headers: NO_STORE });
+        let limit;
+        try {
+            // Counted before verification, so a flood of guesses is stopped before any lookup.
+            limit = await consumeRateLimit(ctx, { bucket: MCP_RATE_LIMIT_BUCKET, key: client.value });
+        }
+        catch (error) {
+            // Fails closed and says nothing: the route is public and this runs before authentication.
+            console.error(`@softure-ai/mcp-access: counting a request failed: ${errorLogLabel(error)}`);
+            return Response.json({ error: "temporarily_unavailable" }, { status: 503, headers: NO_STORE });
+        }
+        if (!limit.ok) {
+            return Response.json({ error: "too_many_requests" }, { status: 429, headers: { ...NO_STORE, "retry-after": String(limit.retryAfterSeconds) } });
+        }
+        const authInfo = await authenticate(ctx, request.headers.get("authorization"));
+        if (authInfo instanceof Response)
+            return authInfo;
+        return handler.fetch(request, { authInfo });
+    };
+}
+/**
+ * The verified identity as the SDK's `AuthInfo`, or the challenge response. Unknown, revoked,
+ * expired and malformed tokens get the same `401 invalid_token`. Expiry is decided by the query on
+ * the module's clock, not by the SDK's own check on the wall clock.
+ */
+async function authenticate(ctx, header) {
+    const challenge = { requiredScopes: [MCP_READ_SCOPE] };
+    if (header === null || !BEARER_PREFIX.test(header)) {
+        return bearerAuthChallengeResponse(new OAuthError(OAuthErrorCode.InvalidToken, "Missing Bearer token"), challenge);
+    }
+    const token = header.replace(BEARER_PREFIX, "").trim();
+    let verified;
+    try {
+        verified = await verifyAccessToken(ctx, token);
+    }
+    catch (error) {
+        console.error(`@softure-ai/mcp-access: verifying a token failed: ${errorLogLabel(error)}`);
+        return bearerAuthChallengeResponse(new OAuthError(OAuthErrorCode.ServerError, "Internal Server Error"), challenge);
+    }
+    if (verified === null) {
+        return bearerAuthChallengeResponse(new OAuthError(OAuthErrorCode.InvalidToken, "Invalid access token"), challenge);
+    }
+    return {
+        token,
+        // The client is the token: it is what gets revoked, and its id may be logged.
+        clientId: verified.tokenId,
+        scopes: verified.canWrite ? [MCP_READ_SCOPE, MCP_WRITE_SCOPE] : [MCP_READ_SCOPE],
+        // AuthInfo counts seconds; Date counts milliseconds.
+        expiresAt: Math.floor(verified.expiresAt.getTime() / 1000),
+        extra: { [USER_ID_CLAIM]: verified.userId },
+    };
+}
+/** The factory's input from the request's `AuthInfo`; throws when the two sides disagree. */
+function readIdentity(authInfo) {
+    const userId = authInfo?.extra?.[USER_ID_CLAIM];
+    if (authInfo === undefined || typeof userId !== "string" || userId === "") {
+        // Unreachable through the endpoint, which always passes a verified identity. A server built
+        // without one would run queries with no account scope, so this refuses instead.
+        throw new Error("@softure-ai/mcp-access: an MCP request reached the factory without a verified identity");
+    }
+    return { userId, canWrite: authInfo.scopes.includes(MCP_WRITE_SCOPE), tokenId: authInfo.clientId };
+}
+/** A missing bucket is a setup bug: thrown, so it reaches the log by name instead of a quiet 503. */
+function assertRateLimitBucket(ctx) {
+    const options = getModule(ctx.config, "security")?.options;
+    if (options?.buckets?.[MCP_RATE_LIMIT_BUCKET] === undefined) {
+        throw new Error(`@softure-ai/mcp-access: the security module has no "${MCP_RATE_LIMIT_BUCKET}" bucket; spread MCP_RATE_LIMIT_BUCKETS into security({ buckets })`);
+    }
+}
+//# sourceMappingURL=endpoint.js.map

package/dist/server/endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,oGAAoG;AACpG,gGAAgG;AAChG,kGAAkG;AAClG,4BAA4B;AAC5B,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,UAAU,EACV,cAAc,GAIf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,iBAAiB,EAAyB,MAAM,aAAa,CAAC;AAEvE,+BAA+B;AAC/B,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AACzC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAYjD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAE,YAAY,EAAsB;IACpE,MAAM,OAAO,GAAG,gBAAgB,CAC9B,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EACvE;QACE,YAAY,EAAE,MAAM;QACpB,kBAAkB,EAAE,qBAAqB;QACzC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;KAC/G,CACF,CAAC;IAEF,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC5B,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE3G,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,mFAAmF;YACnF,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,OAAO,CAAC,KAAK,CAAC,sDAAsD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5F,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC/E,IAAI,QAAQ,YAAY,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,GAAqB,EAAE,MAAqB;IACtE,MAAM,SAAS,GAAG,EAAE,cAAc,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;IACvD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,OAAO;QACL,KAAK;QACL,8EAA8E;QAC9E,QAAQ,EAAE,QAAQ,CAAC,OAAO;QAC1B,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QAChF,qDAAqD;QACrD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC1D,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,QAA8B;IAClD,MAAM,MAAM,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1E,4FAA4F;QAC5F,gFAAgF;QAChF,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACrG,CAAC;AAED,qGAAqG;AACrG,SAAS,qBAAqB,CAAC,GAAqB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAChH,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,qBAAqB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uDAAuD,qBAAqB,oEAAoE,CACjJ,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/server/health.d.ts

@@ -0,0 +1,3 @@
+import { type HealthCheck } from "@softure-ai/core";
+export declare const checkAccessTokensTable: HealthCheck;
+//# sourceMappingURL=health.d.ts.map

package/dist/server/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/server/health.ts"],"names":[],"mappings":"AAEA,OAAO,EAAM,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAIxD,eAAO,MAAM,sBAAsB,EAAE,WAKpC,CAAC"}

package/dist/server/health.js

@@ -0,0 +1,11 @@
+// The module's readiness probe for `GET /api/health` of `@softure-ai/ops`: the tokens table exists
+// and answers, i.e. `softure migrate` ran. It reads no rows.
+import { ok } from "@softure-ai/core";
+import { sql } from "drizzle-orm";
+export const checkAccessTokensTable = async (context) => {
+    // Core types `db` as unknown; the health route passes the @softure-ai/db handle.
+    const db = context.db;
+    await db.execute(sql `select 1 from mcp.access_tokens limit 0`);
+    return ok();
+};
+//# sourceMappingURL=health.js.map

package/dist/server/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/server/health.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,6DAA6D;AAC7D,OAAO,EAAE,EAAE,EAAoB,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,MAAM,CAAC,MAAM,sBAAsB,GAAgB,KAAK,EAAE,OAAO,EAAE,EAAE;IACnE,iFAAiF;IACjF,MAAM,EAAE,GAAG,OAAO,CAAC,EAAe,CAAC;IACnC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,yCAAyC,CAAC,CAAC;IAC/D,OAAO,EAAE,EAAE,CAAC;AACd,CAAC,CAAC"}

package/dist/server/index.d.ts

@@ -0,0 +1,6 @@
+export { createMcpEndpoint, MAX_MCP_REQUEST_BYTES, MCP_RATE_LIMIT_BUCKET, MCP_READ_SCOPE, MCP_WRITE_SCOPE, type McpEndpoint, type McpEndpointOptions, type McpServerFactory, } from "./endpoint.js";
+export { checkAccessTokensTable } from "./health.js";
+export { getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes, getMcpEndpointUrl, type McpAccessRoutes } from "./options.js";
+export { deleteMcpAccessUserData, exportMcpAccessUserData, mcpAccessPrivacyContributor, type McpAccessUserData, } from "./privacy.js";
+export { ACCESS_TOKEN_PREFIX, hashAccessToken, isAccessTokenShape, issueAccessToken, listAccessTokens, pruneAccessTokens, revokeAccessToken, verifyAccessToken, type IssueAccessTokenInput, type IssueAccessTokenResult, type IssuedAccessToken, type McpAccessContext, type RevokeAccessTokenInput, type VerifiedAccessToken, } from "./tokens.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACtI,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC"}

package/dist/server/index.js

@@ -0,0 +1,8 @@
+// Server-only API of @softure-ai/mcp-access. Every function receives the module context
+// (`{ db, clock, config }`) and never reads request scope; the endpoint takes a Web `Request`.
+export { createMcpEndpoint, MAX_MCP_REQUEST_BYTES, MCP_RATE_LIMIT_BUCKET, MCP_READ_SCOPE, MCP_WRITE_SCOPE, } from "./endpoint.js";
+export { checkAccessTokensTable } from "./health.js";
+export { getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes, getMcpEndpointUrl } from "./options.js";
+export { deleteMcpAccessUserData, exportMcpAccessUserData, mcpAccessPrivacyContributor, } from "./privacy.js";
+export { ACCESS_TOKEN_PREFIX, hashAccessToken, isAccessTokenShape, issueAccessToken, listAccessTokens, pruneAccessTokens, revokeAccessToken, verifyAccessToken, } from "./tokens.js";
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,+FAA+F;AAC/F,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,GAIhB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACtI,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,GAE5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAOlB,MAAM,aAAa,CAAC"}

package/dist/server/options.d.ts

@@ -0,0 +1,20 @@
+import { type Locale, type SoftureConfig } from "@softure-ai/core";
+import type { McpAccessMessages } from "../messages/index.js";
+import type { McpAccessOptions } from "../options.js";
+/** The enabled module. Throws when the app did not enable it: calling its functions then is a bug. */
+export declare function getMcpAccessModule(config: SoftureConfig): import("@softure-ai/core").AnySoftureModule;
+export declare function getMcpAccessOptions(config: SoftureConfig): McpAccessOptions;
+export interface McpAccessRoutes {
+    /** The token page. */
+    readonly page: string;
+    /** `POST` MCP endpoint. */
+    readonly endpoint: string;
+}
+export declare function getMcpAccessRoutes(config: SoftureConfig): McpAccessRoutes;
+/** The absolute URL MCP clients call: the app's origin and the endpoint route. */
+export declare function getMcpEndpointUrl(config: SoftureConfig): string;
+/** The module's copy in the app's locale, with the app's overrides applied. */
+export declare function getMcpAccessMessages(config: SoftureConfig): McpAccessMessages;
+/** The text in `locale`, else in `en`. */
+export declare function getLocalizedText(text: Partial<Record<Locale, string>>, locale: Locale): string;
+//# sourceMappingURL=options.d.ts.map

package/dist/server/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/server/options.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAItD,sGAAsG;AACtG,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,+CAMvD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,CAG3E;AAED,MAAM,WAAW,eAAe;IAC9B,sBAAsB;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CASzE;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAE/D;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,iBAAiB,CAG7E;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE9F"}