@softure-ai/mcp-access 0.1.14 → 0.1.15

package/CHANGELOG.md

@@ -4,6 +4,13 @@ Newest first. Each version lists what changed for an app that uses `@softure-ai/
 production, the version gets a line `verified in: <app>@<commit>` ([docs/05](../../docs/05-adoption-playbook.md),
 "Definition of done"). Versions before the first one below are described in their GitHub Releases (`mcp-access@x.y.z`).
 
+## 0.1.15
+
+- The stdio entry resolves its account with `resolveOnlyAccount` from `@softure-ai/auth/server` instead of a private
+  copy; codes and messages are unchanged (#411). Needs the auth release that exports it.
+- The `@softure-ai/ui` peer range also accepts 0.2.0.
+- Requires `@softure-ai/auth` `^0.1.13`, the release with `resolveOnlyAccount` (#411).
+
 ## 0.1.14
 
 - `issueToken` can replace an app's own token-issue action (#386):

package/README.md

@@ -195,7 +195,7 @@ claude mcp add acme -e MCP_USER_ID=<account id> -- npx tsx --import @softure-ai/
 
 - The account: `MCP_USER_ID` (or `userIdEnv`) when set, which must name an account; else the only account in the
   database. With several accounts and no id the entry refuses (`mcp-access.stdio_account_ambiguous`): it never
-  picks one.
+  picks one. The lookup is `resolveOnlyAccount` from `@softure-ai/auth/server`, which an app's own scripts can use too.
 - `canWrite` needs `allowWrites: true` here and the app's `allowWrites`. The token id is `"stdio"`.
 - The database opens like a package command's (`database.handle`, else `database.url`) and closes with the
   connection. Messages go to stderr; stdout is the protocol.

package/dist/index.js

@@ -30,7 +30,7 @@ export const MCP_RATE_LIMIT_BUCKETS = {
 export const mcpAccess = defineModule({
     manifest: {
         id: MODULE_ID,
-        version: "0.1.14",
+        version: "0.1.15",
         dependsOn: { security: "^0.1.0", auth: "^0.1.0" },
         dbSchema: "mcp",
         tables: ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants"],

package/dist/stdio/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/stdio/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAG9D,OAAO,EAAiB,KAAK,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAE3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AAErD,6EAA6E;AAC7E,eAAO,MAAM,cAAc,UAAU,CAAC;AAItC,MAAM,MAAM,iBAAiB,GAAG,8BAA8B,GAAG,6BAA6B,GAAG,oCAAoC,GAAG,kCAAkC,CAAC;AAE3K,8GAA8G;AAC9G,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAE3I,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,8BAA8B;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,iDAAiD;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,oFAAoF;IACpF,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,qBAAqB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACvF;AAED,uGAAuG;AACvG,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoD1F"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/stdio/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAG9D,OAAO,EAAiB,KAAK,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AAErD,6EAA6E;AAC7E,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC,MAAM,MAAM,iBAAiB,GAAG,8BAA8B,GAAG,6BAA6B,GAAG,oCAAoC,GAAG,kCAAkC,CAAC;AAE3K,8GAA8G;AAC9G,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAE3I,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,8BAA8B;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,iDAAiD;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,oFAAoF;IACpF,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,qBAAqB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACvF;AAED,uGAAuG;AACvG,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoD1F"}

package/dist/stdio/serve.js

@@ -1,14 +1,12 @@
 import { serveStdio, StdioServerTransport } from "@modelcontextprotocol/server/stdio";
-import { users } from "@softure-ai/auth";
+import { resolveOnlyAccount } from "@softure-ai/auth/server";
 import { errorLogLabel } from "@softure-ai/core";
 import { openCommandDatabase } from "@softure-ai/db";
-import { eq } from "drizzle-orm";
 import { getMcpAccessOptions } from "../server/options.js";
 /** The variable naming the account to serve, unless the entry is told another one. */
 export const DEFAULT_MCP_USER_ID_ENV = "MCP_USER_ID";
 /** The token id the factory receives over stdio, where there is no token. */
 export const STDIO_TOKEN_ID = "stdio";
-const UUID_SHAPE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /** Resolves the account, then serves the app's server for it over stdio until the client goes away. */
 export async function serveMcpStdio(options) {
     const { config } = options;
@@ -19,7 +17,7 @@ export async function serveMcpStdio(options) {
     const database = await (options.openDatabase ?? ((settings) => openCommandDatabase(settings, { max: 1 })))(config.database);
     let userId;
     try {
-        userId = await resolveAccount(database, env[userIdEnv]?.trim() ?? "", userIdEnv);
+        userId = await resolveAccount(database, env, userIdEnv);
     }
     catch (error) {
         await database.close();
@@ -64,24 +62,22 @@ export async function serveMcpStdio(options) {
         },
     };
 }
-/** The account id, or why there is none. Never the first of several accounts: that could be another person's data. */
-async function resolveAccount(database, requested, userIdEnv) {
-    const { db } = database.handle;
-    if (requested !== "") {
-        const unknown = { code: "mcp-access.stdio_account_unknown", message: `@softure-ai/mcp-access: ${userIdEnv} names no account` };
-        if (!UUID_SHAPE.test(requested))
-            return unknown;
-        const found = await db.select({ id: users.id }).from(users).where(eq(users.id, requested)).limit(1);
-        return found[0]?.id ?? unknown;
+/** The account id (`resolveOnlyAccount` from auth), or why there is none in this entry's own words. */
+async function resolveAccount(database, env, userIdEnv) {
+    const resolved = await resolveOnlyAccount({ db: database.handle.db, envName: userIdEnv, env });
+    if (resolved.ok)
+        return resolved.value;
+    switch (resolved.error) {
+        case "auth.account_unknown":
+            return { code: "mcp-access.stdio_account_unknown", message: `@softure-ai/mcp-access: ${userIdEnv} names no account` };
+        case "auth.no_account":
+            return { code: "mcp-access.stdio_no_account", message: "@softure-ai/mcp-access: the database has no account to serve" };
+        case "auth.account_ambiguous":
+            return {
+                code: "mcp-access.stdio_account_ambiguous",
+                message: `@softure-ai/mcp-access: the database has several accounts; set ${userIdEnv} to the id of the one to serve`,
+            };
     }
-    const accounts = await db.select({ id: users.id }).from(users).limit(2);
-    const [only, second] = accounts;
-    if (only === undefined)
-        return { code: "mcp-access.stdio_no_account", message: "@softure-ai/mcp-access: the database has no account to serve" };
-    if (second !== undefined) {
-        return { code: "mcp-access.stdio_account_ambiguous", message: `@softure-ai/mcp-access: the database has several accounts; set ${userIdEnv} to the id of the one to serve` };
-    }
-    return only.id;
 }
 function refuse(code, reason) {
     return { ok: false, error: { code, message: `@softure-ai/mcp-access: ${reason}` } };

package/dist/stdio/serve.js.map

@@ -1 +1 @@
-{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../src/stdio/serve.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,aAAa,EAAkD,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAwB,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAErD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC,MAAM,UAAU,GAAG,iEAAiE,CAAC;AAkCrF,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA6B;IAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,8BAA8B,EAAE,yDAAyD,CAAC,CAAC;IACvI,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5H,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mEAAmE,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAsB;QAClC,MAAM;QACN,QAAQ,EAAE,CAAC,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,WAAW;QACnF,OAAO,EAAE,cAAc;KACxB,CAAC;IACF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;QAC/B,IAAI,MAAM;YAAE,OAAO;QACnB,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE;QAC9D,SAAS;QACT,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,0DAA0D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;KACpH,CAAC,CAAC;IACH,mGAAmG;IACnG,8DAA8D;IAC9D,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC;IACxC,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;QACvB,aAAa,EAAE,EAAE,CAAC;QAClB,KAAK,aAAa,EAAE,CAAC;IACvB,CAAC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,QAAQ;YACR,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,aAAa,EAAE,CAAC;YACxB,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,sHAAsH;AACtH,KAAK,UAAU,cAAc,CAAC,QAAyB,EAAE,SAAiB,EAAE,SAAiB;IAC3F,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,kCAAkC,EAAE,OAAO,EAAE,2BAA2B,SAAS,mBAAmB,EAAW,CAAC;QACxI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,OAAO,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpG,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,OAAO,CAAC;IACjC,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC;IAChC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;IAChJ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,oCAAoC,EAAE,OAAO,EAAE,kEAAkE,SAAS,gCAAgC,EAAE,CAAC;IAC9K,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,IAAuB,EAAE,MAAc;IACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,MAAM,EAAE,EAAE,EAAE,CAAC;AACtF,CAAC"}
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../src/stdio/serve.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAkD,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAwB,MAAM,gBAAgB,CAAC;AAG3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAErD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAkCtC,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA6B;IAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,8BAA8B,EAAE,yDAAyD,CAAC,CAAC;IACvI,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5H,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mEAAmE,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAsB;QAClC,MAAM;QACN,QAAQ,EAAE,CAAC,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,WAAW;QACnF,OAAO,EAAE,cAAc;KACxB,CAAC;IACF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;QAC/B,IAAI,MAAM;YAAE,OAAO;QACnB,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE;QAC9D,SAAS;QACT,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,0DAA0D,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;KACpH,CAAC,CAAC;IACH,mGAAmG;IACnG,8DAA8D;IAC9D,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC;IACxC,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;QACvB,aAAa,EAAE,EAAE,CAAC;QAClB,KAAK,aAAa,EAAE,CAAC;IACvB,CAAC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,QAAQ;YACR,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,aAAa,EAAE,CAAC;YACxB,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,cAAc,CAAC,QAAyB,EAAE,GAAgC,EAAE,SAAiB;IAC1G,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/F,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;IACvC,QAAQ,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,kCAAkC,EAAE,OAAO,EAAE,2BAA2B,SAAS,mBAAmB,EAAE,CAAC;QACxH,KAAK,iBAAiB;YACpB,OAAO,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;QAC1H,KAAK,wBAAwB;YAC3B,OAAO;gBACL,IAAI,EAAE,oCAAoC;gBAC1C,OAAO,EAAE,kEAAkE,SAAS,gCAAgC;aACrH,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAuB,EAAE,MAAc;IACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,MAAM,EAAE,EAAE,EAAE,CAAC;AACtF,CAAC"}

package/module.json

@@ -1,6 +1,6 @@
 {
   "id": "mcp-access",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "dependsOn": { "security": "^0.1.0", "auth": "^0.1.0" },
   "dbSchema": "mcp",
   "tables": ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softure-ai/mcp-access",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "SOFTURE AI MCP access module: hashed, scoped, expiring access tokens, a rate-limited Bearer endpoint around the app's MCP server factory, and a token page with client setup instructions for Next.js; tool result helpers with a safe error boundary, a stdio entry, a catalog parity check and the softure-mcp prune command.",
   "license": "MIT",
   "type": "module",
@@ -79,7 +79,7 @@
     "build": "tsc -p tsconfig.build.json"
   },
   "dependencies": {
-    "@softure-ai/auth": "^0.1.0",
+    "@softure-ai/auth": "^0.1.13",
     "@softure-ai/core": "^0.1.9",
     "@softure-ai/db": "^0.1.0",
     "@softure-ai/security": "^0.1.8",
@@ -87,12 +87,12 @@
   },
   "peerDependencies": {
     "@modelcontextprotocol/server": "^2.0.0",
-    "@softure-ai/ui": "^0.1.0",
+    "@softure-ai/ui": "^0.1.0 || ^0.2.0",
     "drizzle-orm": "^0.45.2",
     "next": "^16.0.0",
     "react": "^19.0.0"
   },
   "devDependencies": {
-    "@softure-ai/ui": "^0.1.7"
+    "@softure-ai/ui": "^0.1.7 || ^0.2.0"
   }
 }

package/src/index.ts

@@ -34,7 +34,7 @@ export const MCP_RATE_LIMIT_BUCKETS = {
 export const mcpAccess = defineModule({
   manifest: {
     id: MODULE_ID,
-    version: "0.1.14",
+    version: "0.1.15",
     dependsOn: { security: "^0.1.0", auth: "^0.1.0" },
     dbSchema: "mcp",
     tables: ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants"],

package/src/stdio/serve.ts

@@ -7,10 +7,9 @@
 //   if (!started.ok) { console.error(started.error.message); process.exitCode = 1; }
 import type { Transport } from "@modelcontextprotocol/server";
 import { serveStdio, StdioServerTransport } from "@modelcontextprotocol/server/stdio";
-import { users } from "@softure-ai/auth";
+import { resolveOnlyAccount } from "@softure-ai/auth/server";
 import { errorLogLabel, type SoftureConfig, type SoftureDatabaseConfig } from "@softure-ai/core";
 import { openCommandDatabase, type CommandDatabase } from "@softure-ai/db";
-import { eq } from "drizzle-orm";
 import type { McpServerIdentity } from "../contract.js";
 import type { McpServerFactory } from "../server/endpoint.js";
 import { getMcpAccessOptions } from "../server/options.js";
@@ -21,8 +20,6 @@ export const DEFAULT_MCP_USER_ID_ENV = "MCP_USER_ID";
 /** The token id the factory receives over stdio, where there is no token. */
 export const STDIO_TOKEN_ID = "stdio";
 
-const UUID_SHAPE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-
 export type McpStdioErrorCode = "mcp-access.stdio_no_database" | "mcp-access.stdio_no_account" | "mcp-access.stdio_account_ambiguous" | "mcp-access.stdio_account_unknown";
 
 /** Why the entry did not start, with a message for the person running it (stderr: stdout is the protocol). */
@@ -65,7 +62,7 @@ export async function serveMcpStdio(options: ServeMcpStdioOptions): Promise<McpS
 
   let userId: string | McpStdioError;
   try {
-    userId = await resolveAccount(database, env[userIdEnv]?.trim() ?? "", userIdEnv);
+    userId = await resolveAccount(database, env, userIdEnv);
   } catch (error) {
     await database.close();
     throw new Error(`@softure-ai/mcp-access: looking up the account to serve failed: ${errorLogLabel(error)}`, { cause: error });
@@ -110,22 +107,21 @@ export async function serveMcpStdio(options: ServeMcpStdioOptions): Promise<McpS
   };
 }
 
-/** The account id, or why there is none. Never the first of several accounts: that could be another person's data. */
-async function resolveAccount(database: CommandDatabase, requested: string, userIdEnv: string): Promise<string | McpStdioError> {
-  const { db } = database.handle;
-  if (requested !== "") {
-    const unknown = { code: "mcp-access.stdio_account_unknown", message: `@softure-ai/mcp-access: ${userIdEnv} names no account` } as const;
-    if (!UUID_SHAPE.test(requested)) return unknown;
-    const found = await db.select({ id: users.id }).from(users).where(eq(users.id, requested)).limit(1);
-    return found[0]?.id ?? unknown;
-  }
-  const accounts = await db.select({ id: users.id }).from(users).limit(2);
-  const [only, second] = accounts;
-  if (only === undefined) return { code: "mcp-access.stdio_no_account", message: "@softure-ai/mcp-access: the database has no account to serve" };
-  if (second !== undefined) {
-    return { code: "mcp-access.stdio_account_ambiguous", message: `@softure-ai/mcp-access: the database has several accounts; set ${userIdEnv} to the id of the one to serve` };
+/** The account id (`resolveOnlyAccount` from auth), or why there is none in this entry's own words. */
+async function resolveAccount(database: CommandDatabase, env: ServeMcpStdioOptions["env"], userIdEnv: string): Promise<string | McpStdioError> {
+  const resolved = await resolveOnlyAccount({ db: database.handle.db, envName: userIdEnv, env });
+  if (resolved.ok) return resolved.value;
+  switch (resolved.error) {
+    case "auth.account_unknown":
+      return { code: "mcp-access.stdio_account_unknown", message: `@softure-ai/mcp-access: ${userIdEnv} names no account` };
+    case "auth.no_account":
+      return { code: "mcp-access.stdio_no_account", message: "@softure-ai/mcp-access: the database has no account to serve" };
+    case "auth.account_ambiguous":
+      return {
+        code: "mcp-access.stdio_account_ambiguous",
+        message: `@softure-ai/mcp-access: the database has several accounts; set ${userIdEnv} to the id of the one to serve`,
+      };
   }
-  return only.id;
 }
 
 function refuse(code: McpStdioErrorCode, reason: string): McpStdioResult {