@stackwright-pro/mcp 0.2.0-alpha.90 → 0.2.0-alpha.92

package/dist/server.mjs

@@ -1595,6 +1595,9 @@ var OTTER_NAME_TO_PHASE = [
   ["dashboard", "dashboard"],
   ["data", "data"],
   ["page", "pages"],
+  // swp-4071: workflow-otter renamed to form-wizard-otter; keep 'workflow' for
+  // any in-flight session that still uses the old name (belt-and-suspenders)
+  ["form-wizard", "workflow"],
   ["workflow", "workflow"],
   ["services", "services"],
   ["polish", "polish"],
@@ -1609,7 +1612,7 @@ var PHASE_TO_OTTER = {
   pages: "stackwright-pro-page-otter",
   dashboard: "stackwright-pro-dashboard-otter",
   data: "stackwright-pro-data-otter",
-  workflow: "stackwright-pro-workflow-otter",
+  workflow: "stackwright-pro-form-wizard-otter",
   services: "stackwright-services-otter",
   polish: "stackwright-pro-polish-otter",
   geo: "stackwright-pro-geo-otter"
@@ -2757,7 +2760,7 @@ var PHASE_TO_OTTER2 = {
   data: "stackwright-pro-data-otter",
   pages: "stackwright-pro-page-otter",
   dashboard: "stackwright-pro-dashboard-otter",
-  workflow: "stackwright-pro-workflow-otter",
+  workflow: "stackwright-pro-form-wizard-otter",
   services: "stackwright-services-otter",
   polish: "stackwright-pro-polish-otter",
   geo: "stackwright-pro-geo-otter"
@@ -3470,7 +3473,7 @@ var PHASE_ARTIFACT_SCHEMA = {
   workflow: JSON.stringify(
     {
       version: "1.0",
-      generatedBy: "stackwright-pro-workflow-otter",
+      generatedBy: "stackwright-pro-form-wizard-otter",
       // Root key is `workflow` — NOT `workflowConfig` (see swp-k7cl)
       workflow: {
         id: "procurement-approval",
@@ -3680,6 +3683,57 @@ function handleValidateArtifact(input) {
         const issues = result.error.issues.slice(0, 3).map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
         return { success: false, error: { message: issues } };
       }
+      const rbacRoles = authConfig["rbacRoles"];
+      const rbacDefaultRole = authConfig["rbacDefaultRole"];
+      const protectedRoutes = authConfig["protectedRoutes"];
+      if (Array.isArray(rbacRoles) && rbacRoles.length > 2 && Array.isArray(protectedRoutes) && protectedRoutes.length > 0 && typeof rbacDefaultRole === "string") {
+        const uniqueRoles = new Set(
+          protectedRoutes.map(
+            (r) => typeof r === "string" ? rbacDefaultRole : r.requiredRole ?? rbacDefaultRole
+          )
+        );
+        if (uniqueRoles.size === 1 && uniqueRoles.has(rbacDefaultRole)) {
+          return {
+            success: false,
+            error: {
+              message: `RBAC theatre detected: all ${protectedRoutes.length} protectedRoutes require '${rbacDefaultRole}' (the defaultRole), but ${rbacRoles.length} roles are defined. This defeats the RBAC hierarchy. Each route MUST have the minimum role required for its function. See auth-otter PER-ROUTE RBAC GRANULARITY section.`
+            }
+          };
+        }
+      }
+      return { success: true };
+    },
+    // swp-4071 — opt-in cross-reference validator for the services phase.
+    // If workflow-config exists and declares serviceHooks, every hook ref must resolve
+    // to a flow or state-machine in this services-config artifact.
+    // Skips gracefully when wizard-otter didn't run (Pro-only install) or declared no hooks.
+    services: (artifact2) => {
+      const workflowArtifactPath = join4(cwd, ".stackwright", "artifacts", "workflow-config.json");
+      if (!existsSync5(workflowArtifactPath)) {
+        return { success: true };
+      }
+      let workflowArtifact;
+      try {
+        workflowArtifact = JSON.parse(readFileSync4(workflowArtifactPath, "utf-8"));
+      } catch {
+        return { success: true };
+      }
+      const declaredHooks = workflowArtifact.serviceHooks ?? [];
+      if (declaredHooks.length === 0) {
+        return { success: true };
+      }
+      const flows = artifact2["flows"] ?? [];
+      const workflows = artifact2["workflows"] ?? [];
+      const flowNames = /* @__PURE__ */ new Set([...flows.map((f) => f.name), ...workflows.map((w) => w.name)]);
+      const unresolved = declaredHooks.filter((h) => !flowNames.has(h.ref));
+      if (unresolved.length > 0) {
+        return {
+          success: false,
+          error: {
+            message: `Workflow declared ${declaredHooks.length} service hook(s) but ${unresolved.length} unresolved by services-config: ` + unresolved.map((h) => `${h.ref} (${h.kind ?? "unknown"}: ${h.purpose ?? "no purpose"})`).join("; ") + ". Either add matching flows to services-config OR remove the hooks from the workflow YAML."
+          }
+        };
+      }
       return { success: true };
     }
   };
@@ -3919,7 +3973,7 @@ var OTTER_WRITE_ALLOWLISTS = {
     { prefix: "pages/", suffix: "/content.yaml", description: "Dashboard content YAML" },
     { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Dashboard manifest" }
   ],
-  "stackwright-pro-workflow-otter": [
+  "stackwright-pro-form-wizard-otter": [
     { prefix: "workflows/", suffix: ".yml", description: "Workflow definition" },
     { prefix: "workflows/", suffix: ".yaml", description: "Workflow definition" },
     { prefix: ".stackwright/artifacts/", suffix: ".json", description: "Workflow config" }
@@ -4321,9 +4375,14 @@ function hierarchyToYaml(hierarchy, indent) {
 function rolesToYaml(roles, indent) {
   return roles.map((r) => `${indent}- ${r}`).join("\n");
 }
-function routesToYaml(routes, defaultRole, indent) {
-  return routes.map((r) => `${indent}- pattern: ${r}
-${indent}  requiredRole: ${defaultRole}`).join("\n");
+function normalizeRoutes(routes, defaultRole) {
+  return routes.map(
+    (r) => typeof r === "string" ? { pattern: r, requiredRole: defaultRole } : { pattern: r.pattern, requiredRole: r.requiredRole ?? defaultRole }
+  );
+}
+function routesToYaml(routes, indent) {
+  return routes.map((r) => `${indent}- pattern: ${r.pattern}
+${indent}  requiredRole: ${r.requiredRole}`).join("\n");
 }
 function detectNextMajorVersion(cwd) {
   try {
@@ -4367,9 +4426,10 @@ function generateMiddlewareContent(method, params, roles, defaultRole, hierarchy
     enabled: ${auditEnabled},
     retentionDays: ${auditRetentionDays},
   },`;
-  const routesBlock = `  protectedRoutes: ${JSON.stringify(protectedRoutes)},`;
+  const patterns = protectedRoutes.map((r) => r.pattern);
+  const routesBlock = `  protectedRoutes: ${JSON.stringify(patterns)},`;
   const configBlock = `export const config = {
-  matcher: ${JSON.stringify(protectedRoutes)},
+  matcher: ${JSON.stringify(patterns)},
 };`;
   if (method === "cac") {
     const caBundle = params.cacCaBundle ?? "./certs/dod-ca-bundle.pem";
@@ -4452,9 +4512,10 @@ function generateProxyContent(method, params, roles, defaultRole, hierarchy, aud
     enabled: ${auditEnabled},
     retentionDays: ${auditRetentionDays},
   },`;
-  const routesBlock = `  protectedRoutes: ${JSON.stringify(protectedRoutes)},`;
+  const patterns = protectedRoutes.map((r) => r.pattern);
+  const routesBlock = `  protectedRoutes: ${JSON.stringify(patterns)},`;
   const configBlock = `export const config = {
-  matcher: ${JSON.stringify(protectedRoutes)},
+  matcher: ${JSON.stringify(patterns)},
 };`;
   if (method === "cac") {
     const caBundle = params.cacCaBundle ?? "./certs/dod-ca-bundle.pem";
@@ -4563,10 +4624,7 @@ ${hierarchyToYaml(hierarchy, "      ")}`;
   const auditSection = `  audit:
     enabled: ${auditEnabled}
     retentionDays: ${auditRetentionDays}`;
-  const routesSection = `  protectedRoutes:
-${routesToYaml(protectedRoutes, "    ", defaultRole)}`.replace(/\n\s+,/g, "");
-  const routeLines = protectedRoutes.map((r) => `    - pattern: ${r}
-      requiredRole: ${defaultRole}`).join("\n");
+  const routeLines = routesToYaml(protectedRoutes, "    ");
   const providerLine = params.provider ? `  provider: ${params.provider}
 ` : "";
   if (method === "cac") {
@@ -4632,9 +4690,10 @@ function generateDevOnlyMiddlewareContent(method, params, roles, defaultRole, hi
     enabled: ${auditEnabled},
     retentionDays: ${auditRetentionDays},
   },`;
-  const routesBlock = `  protectedRoutes: ${JSON.stringify(protectedRoutes)},`;
+  const patterns = protectedRoutes.map((r) => r.pattern);
+  const routesBlock = `  protectedRoutes: ${JSON.stringify(patterns)},`;
   const configBlock = `export const config = {
-  matcher: ${JSON.stringify(protectedRoutes)},
+  matcher: ${JSON.stringify(patterns)},
 };`;
   const devHeader = [
     "// middleware.ts \u2014 generated by @stackwright-pro/auth-nextjs (dev-only mock)",
@@ -4721,9 +4780,10 @@ function generateDevOnlyProxyContent(method, params, roles, defaultRole, hierarc
     enabled: ${auditEnabled},
     retentionDays: ${auditRetentionDays},
   },`;
-  const routesBlock = `  protectedRoutes: ${JSON.stringify(protectedRoutes)},`;
+  const patterns = protectedRoutes.map((r) => r.pattern);
+  const routesBlock = `  protectedRoutes: ${JSON.stringify(patterns)},`;
   const configBlock = `export const config = {
-  matcher: ${JSON.stringify(protectedRoutes)},
+  matcher: ${JSON.stringify(patterns)},
 };`;
   const devHeader = [
     "// proxy.ts -- generated by @stackwright-pro/auth (Next.js >=16, dev-only mock)",
@@ -4810,8 +4870,8 @@ ${hierarchyToYaml(hierarchy, "      ")}`;
   const auditSection = `  audit:
     enabled: ${auditEnabled}
     retentionDays: ${auditRetentionDays}`;
-  const routeLines = protectedRoutes.map((r) => `    - pattern: ${r}
-      requiredRole: ${defaultRole}`).join("\n");
+  const routeLines = protectedRoutes.map((r) => `    - pattern: ${r.pattern}
+      requiredRole: ${r.requiredRole}`).join("\n");
   const providerLine = params.provider ? `  provider: ${params.provider}
 ` : "";
   if (method === "cac") {
@@ -4944,6 +5004,7 @@ async function configureAuthHandler(params, cwd) {
   } = params;
   const roles = rbacRoles;
   const defaultRole = params.rbacDefaultRole ?? roles[roles.length - 1];
+  const normalizedRoutes = normalizeRoutes(protectedRoutes, defaultRole);
   const hierarchy = buildHierarchy(roles);
   const detectedVersion = params.nextMajorVersion ?? detectNextMajorVersion(cwd);
   const useProxy = (detectedVersion ?? 0) >= 16;
@@ -4980,7 +5041,7 @@ async function configureAuthHandler(params, cwd) {
       hierarchy,
       auditEnabled,
       auditRetentionDays,
-      protectedRoutes
+      normalizedRoutes
     ) : generateDevOnlyMiddlewareContent(
       effectiveMethod,
       params,
@@ -4989,7 +5050,7 @@ async function configureAuthHandler(params, cwd) {
       hierarchy,
       auditEnabled,
       auditRetentionDays,
-      protectedRoutes
+      normalizedRoutes
     ) : useProxy ? generateProxyContent(
       effectiveMethod,
       params,
@@ -4998,7 +5059,7 @@ async function configureAuthHandler(params, cwd) {
       hierarchy,
       auditEnabled,
       auditRetentionDays,
-      protectedRoutes
+      normalizedRoutes
     ) : generateMiddlewareContent(
       effectiveMethod,
       params,
@@ -5007,7 +5068,7 @@ async function configureAuthHandler(params, cwd) {
       hierarchy,
       auditEnabled,
       auditRetentionDays,
-      protectedRoutes
+      normalizedRoutes
     );
     writeFileSync6(join6(cwd, conventionFile), authFileContent, "utf8");
     filesWritten.push(conventionFile);
@@ -5105,7 +5166,7 @@ async function configureAuthHandler(params, cwd) {
       hierarchy,
       auditEnabled,
       auditRetentionDays,
-      protectedRoutes,
+      normalizedRoutes,
       useProxy
     ) : generateYamlBlock(
       effectiveMethod,
@@ -5115,7 +5176,7 @@ async function configureAuthHandler(params, cwd) {
       hierarchy,
       auditEnabled,
       auditRetentionDays,
-      protectedRoutes,
+      normalizedRoutes,
       useProxy
     );
     const ymlPath = join6(cwd, "stackwright.yml");
@@ -5204,8 +5265,15 @@ function registerAuthTools(server2) {
       // Audit
       auditEnabled: boolCoerce(z15.boolean().optional()),
       auditRetentionDays: numCoerce(z15.number().int().positive().optional()),
-      // Routes
-      protectedRoutes: jsonCoerce(z15.array(z15.string()).optional()),
+      // Routes — accepts bare strings (backward-compat) or per-route objects (swp-owu0)
+      protectedRoutes: jsonCoerce(
+        z15.array(
+          z15.union([
+            z15.string(),
+            z15.object({ pattern: z15.string(), requiredRole: z15.string().optional() })
+          ])
+        ).optional()
+      ),
       // Injection for tests
       _cwd: z15.string().optional(),
       devOnly: boolCoerce(z15.boolean().optional()),
@@ -5230,7 +5298,7 @@ var _checksums = /* @__PURE__ */ new Map([
   ],
   [
     "stackwright-pro-auth-otter.json",
-    "07134125ab4f8c82ee015f27587e4d84bdeefca5ec211d1563bcb25b8aa61eb3"
+    "643344b88e42992e0467845fb0184d3932e115b85130fbc6a47a3175759678c8"
   ],
   [
     "stackwright-pro-dashboard-otter.json",
@@ -5252,6 +5320,10 @@ var _checksums = /* @__PURE__ */ new Map([
     "stackwright-pro-foreman-otter.json",
     "438b03d2c35f64536055c68b3a9044fe3b5e4f2889acde4500dd801fad724be1"
   ],
+  [
+    "stackwright-pro-form-wizard-otter.json",
+    "3dffa3ef2d2ef057578391f784cbea779d768e87d98321894ea5bcd9e3ab7e60"
+  ],
   [
     "stackwright-pro-geo-otter.json",
     "2ec83c26a08c413d9553ff8b8f0f0f643c1a8da043741b356e27106cad78f05f"
@@ -5272,10 +5344,6 @@ var _checksums = /* @__PURE__ */ new Map([
     "stackwright-pro-theme-otter.json",
     "fe10108e3ba67106751ea662f512bb5f4eb58f7abda26880ef4cf6b0f9feb944"
   ],
-  [
-    "stackwright-pro-workflow-otter.json",
-    "5f6209fadc1355580e2455a16386f06bd7d5814f047b2dd5b33800abf6a48ff8"
-  ],
   [
     "stackwright-services-otter.json",
     "c013d7fc2475e62d0af54d57bc988182feee7766bac0edf841cbfad5c73e9261"
@@ -5919,7 +5987,7 @@ function buildTypeSchemaSummary() {
           "TransitionConditionSchema",
           "PersistenceSchema"
         ],
-        otter: "stackwright-pro-workflow-otter",
+        otter: "stackwright-pro-form-wizard-otter",
         artifactKey: "workflowConfig"
       },
       auth: {
@@ -6500,7 +6568,7 @@ var package_default = {
     "test:coverage": "vitest run --coverage"
   },
   name: "@stackwright-pro/mcp",
-  version: "0.2.0-alpha.90",
+  version: "0.2.0-alpha.92",
   description: "MCP tools for Stackwright Pro - Data Explorer, Security, ISR, and Dashboard generation",
   license: "SEE LICENSE IN LICENSE",
   main: "./dist/server.js",