@stigmer/mcp-server 3.0.8-dev.20260612122433

package/cli/mcp-server-stigmer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server-stigmer.js","sourceRoot":"","sources":["../../src/cli/mcp-server-stigmer.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,uDAAuD;AACvD,EAAE;AACF,SAAS;AACT,uFAAuF;AACvF,wDAAwD;AACxD,kDAAkD;AAClD,iEAAiE;AACjE,EAAE;AACF,4EAA4E;AAC5E,qCAAqC;AAErC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAkB,MAAM,aAAa,CAAC;AAEjE,MAAM,gBAAgB,GAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAEtE,KAAK,UAAU,IAAI;IACjB,IAAI,GAAG,GAAG,aAAa,EAAE,CAAC;IAE1B,iEAAiE;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,qCAAqC,CAAC,CAAC;YACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,GAAgB,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAElC,MAAM,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/config.d.ts

@@ -0,0 +1,44 @@
+import { type LogFormat, type LogLevel } from "./logger.js";
+/** Communication mode between MCP clients and the server. */
+export type Transport = "stdio" | "http" | "both";
+/**
+ * OAuth 2.0 Protected Resource Metadata (RFC 9728) discovery settings.
+ *
+ * Purely additive: the server stays a stateless Bearer passthrough that never
+ * validates tokens. Issuer values come from deployment config, never code, so
+ * the OSS server is issuer-agnostic. (HTTP discovery wiring itself lands in T02.)
+ */
+export interface OAuthConfig {
+    readonly enabled: boolean;
+    readonly resource: string;
+    readonly authorizationServers: string[];
+    readonly scopesSupported: string[];
+}
+/** Runtime configuration for the MCP server. */
+export interface Config {
+    /** gRPC dial target for stigmer-server (e.g. "localhost:7234"). */
+    readonly stigmerServerAddress: string;
+    /**
+     * API key for stigmer-server. Used for stdio/both; in http mode every
+     * request carries its own Bearer token. Empty when targeting an
+     * unauthenticated local backend.
+     */
+    readonly apiKey: string;
+    readonly transport: Transport;
+    readonly httpPort: string;
+    /** Whether HTTP requests require an Authorization: Bearer header. */
+    readonly httpAuthEnabled: boolean;
+    readonly oauth: OAuthConfig;
+    readonly logFormat: LogFormat;
+    readonly logLevel: LogLevel;
+}
+/** Reads configuration from the process environment, applying defaults. */
+export declare function loadConfigFromEnv(env?: NodeJS.ProcessEnv): Config;
+/**
+ * Validates invariants that must hold before the server starts. Throws on hard
+ * errors; emits warnings (via the configured logger) for the soft cases the Go
+ * server warns about. Configure the logger before calling this so warnings are
+ * formatted consistently.
+ */
+export declare function validateConfig(cfg: Config): void;
+//# sourceMappingURL=config.d.ts.map

package/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAQA,OAAO,EAAO,KAAK,SAAS,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjE,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;CACpC;AAED,gDAAgD;AAChD,MAAM,WAAW,MAAM;IACrB,mEAAmE;IACnE,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAMD,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAiB9E;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CA8ChD"}

package/config.js

@@ -0,0 +1,92 @@
+// Environment-variable configuration for mcp-server-stigmer.
+//
+// Every value is read from a STIGMER_-prefixed environment variable with a
+// development-friendly default. This is the embeddable configuration surface
+// (plain types, no internal coupling) and the parity mirror of the Go server's
+// internal/config + pkg/mcpserver Config (inventory §4.4) — the validation
+// reproduces Go's hard-errors AND warnings, not just the defaults.
+import { log } from "./logger.js";
+const VALID_TRANSPORTS = ["stdio", "http", "both"];
+const VALID_LOG_FORMATS = ["text", "json"];
+const VALID_LOG_LEVELS = ["debug", "info", "warn", "error"];
+/** Reads configuration from the process environment, applying defaults. */
+export function loadConfigFromEnv(env = process.env) {
+    return {
+        stigmerServerAddress: envOr(env, "STIGMER_SERVER_ADDRESS", "localhost:7234"),
+        apiKey: env.STIGMER_API_KEY ?? "",
+        transport: envOr(env, "STIGMER_MCP_TRANSPORT", "stdio").toLowerCase(),
+        httpPort: envOr(env, "STIGMER_MCP_HTTP_PORT", "8080"),
+        // Go semantics: only the exact string "true" enables auth.
+        httpAuthEnabled: envOr(env, "STIGMER_MCP_HTTP_AUTH_ENABLED", "true") === "true",
+        oauth: {
+            enabled: env.STIGMER_MCP_OAUTH_ENABLED === "true",
+            resource: (env.STIGMER_MCP_OAUTH_RESOURCE ?? "").trim(),
+            authorizationServers: splitList(env.STIGMER_MCP_OAUTH_AUTHORIZATION_SERVERS),
+            scopesSupported: splitList(env.STIGMER_MCP_OAUTH_SCOPES_SUPPORTED),
+        },
+        logFormat: envOr(env, "STIGMER_MCP_LOG_FORMAT", "text").toLowerCase(),
+        logLevel: envOr(env, "STIGMER_MCP_LOG_LEVEL", "info").toLowerCase(),
+    };
+}
+/**
+ * Validates invariants that must hold before the server starts. Throws on hard
+ * errors; emits warnings (via the configured logger) for the soft cases the Go
+ * server warns about. Configure the logger before calling this so warnings are
+ * formatted consistently.
+ */
+export function validateConfig(cfg) {
+    if (!VALID_TRANSPORTS.includes(cfg.transport)) {
+        throw new Error(`invalid STIGMER_MCP_TRANSPORT "${cfg.transport}": must be stdio, http, or both`);
+    }
+    if (cfg.stigmerServerAddress === "") {
+        throw new Error("STIGMER_SERVER_ADDRESS must not be empty");
+    }
+    if (cfg.stigmerServerAddress.includes("://")) {
+        log.warn("STIGMER_SERVER_ADDRESS contains a URL scheme; gRPC targets are host:port — " +
+            "the scheme is informational and TLS is derived from the port", { value: cfg.stigmerServerAddress });
+    }
+    else if (!hasExplicitPort(cfg.stigmerServerAddress)) {
+        log.warn("STIGMER_SERVER_ADDRESS has no explicit port; :443 with TLS is assumed for non-loopback addresses", { value: cfg.stigmerServerAddress });
+    }
+    if (!VALID_LOG_FORMATS.includes(cfg.logFormat)) {
+        throw new Error(`invalid STIGMER_MCP_LOG_FORMAT "${cfg.logFormat}": must be text or json`);
+    }
+    if (!VALID_LOG_LEVELS.includes(cfg.logLevel)) {
+        throw new Error(`invalid STIGMER_MCP_LOG_LEVEL "${cfg.logLevel}": must be debug, info, warn, or error`);
+    }
+    if (cfg.oauth.enabled) {
+        if (cfg.oauth.resource === "") {
+            throw new Error("STIGMER_MCP_OAUTH_RESOURCE must be set when STIGMER_MCP_OAUTH_ENABLED is true");
+        }
+        if (cfg.oauth.authorizationServers.length === 0) {
+            throw new Error("STIGMER_MCP_OAUTH_AUTHORIZATION_SERVERS must list at least one issuer when STIGMER_MCP_OAUTH_ENABLED is true");
+        }
+    }
+}
+function envOr(env, key, fallback) {
+    const v = env[key];
+    return v !== undefined && v !== "" ? v : fallback;
+}
+/** Parses a comma-separated value into trimmed, non-empty entries. */
+function splitList(raw) {
+    if (!raw || raw.trim() === "")
+        return [];
+    return raw
+        .split(",")
+        .map((p) => p.trim())
+        .filter((p) => p !== "");
+}
+/**
+ * Reports whether an authority carries an explicit port. Tolerates bracketed
+ * IPv6 (`[::1]:443`) and treats bare IPv6 (`::1`) as port-less, matching the
+ * intent of Go's net.SplitHostPort in the config warning path.
+ */
+function hasExplicitPort(authority) {
+    if (authority.startsWith("[")) {
+        const close = authority.indexOf("]");
+        return close !== -1 && authority.slice(close + 1).startsWith(":");
+    }
+    const lastColon = authority.lastIndexOf(":");
+    return lastColon !== -1 && authority.indexOf(":") === lastColon;
+}
+//# sourceMappingURL=config.js.map

package/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,mEAAmE;AAEnE,OAAO,EAAE,GAAG,EAAiC,MAAM,aAAa,CAAC;AAsCjE,MAAM,gBAAgB,GAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACtE,MAAM,iBAAiB,GAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC9D,MAAM,gBAAgB,GAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAE/E,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,OAAO;QACL,oBAAoB,EAAE,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,gBAAgB,CAAC;QAC5E,MAAM,EAAE,GAAG,CAAC,eAAe,IAAI,EAAE;QACjC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,uBAAuB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAe;QAClF,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,uBAAuB,EAAE,MAAM,CAAC;QACrD,2DAA2D;QAC3D,eAAe,EAAE,KAAK,CAAC,GAAG,EAAE,+BAA+B,EAAE,MAAM,CAAC,KAAK,MAAM;QAC/E,KAAK,EAAE;YACL,OAAO,EAAE,GAAG,CAAC,yBAAyB,KAAK,MAAM;YACjD,QAAQ,EAAE,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACvD,oBAAoB,EAAE,SAAS,CAAC,GAAG,CAAC,uCAAuC,CAAC;YAC5E,eAAe,EAAE,SAAS,CAAC,GAAG,CAAC,kCAAkC,CAAC;SACnE;QACD,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,MAAM,CAAC,CAAC,WAAW,EAAe;QAClF,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC,WAAW,EAAc;KAChF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,kCAAkC,GAAG,CAAC,SAAS,iCAAiC,CACjF,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,oBAAoB,KAAK,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,GAAG,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CACN,6EAA6E;YAC3E,8DAA8D,EAChE,EAAE,KAAK,EAAE,GAAG,CAAC,oBAAoB,EAAE,CACpC,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,IAAI,CACN,kGAAkG,EAClG,EAAE,KAAK,EAAE,GAAG,CAAC,oBAAoB,EAAE,CACpC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,SAAS,yBAAyB,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,kCAAkC,GAAG,CAAC,QAAQ,wCAAwC,CACvF,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,GAAsB,EAAE,GAAW,EAAE,QAAgB;IAClE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,sEAAsE;AACtE,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,SAAiB;IACxC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,KAAK,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;AAClE,CAAC"}

package/domains/agents/apply.d.ts

@@ -0,0 +1,4 @@
+import { type AgentInput } from "../../gen/agent.js";
+/** Create or update an agent, returning the persisted agent as protojson. */
+export declare function applyAgent(serverAddress: string, token: string, input: AgentInput): Promise<string>;
+//# sourceMappingURL=apply.d.ts.map

package/domains/agents/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../../src/domains/agents/apply.ts"],"names":[],"mappings":"AAQA,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKxE,6EAA6E;AAC7E,wBAAsB,UAAU,CAC9B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,MAAM,CAAC,CAWjB"}

package/domains/agents/apply.js

@@ -0,0 +1,25 @@
+// Agent apply path: create-or-update via the AgentCommandController.apply RPC.
+// The flat MCP input is projected into a fully-formed Agent proto by the
+// generated agentInputToProto bridge (codegen, src/gen/agent.ts) before the call.
+// Go parity: mcp-server/internal/domains/agents/apply.go.
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
+import { agentInputToProto } from "../../gen/agent.js";
+import { withClient } from "../client.js";
+import { toProtoJson } from "../marshal.js";
+import { rpcError } from "../rpcerr.js";
+/** Create or update an agent, returning the persisted agent as protojson. */
+export async function applyAgent(serverAddress, token, input) {
+    const agent = agentInputToProto(input);
+    const desc = `agent "${agent.metadata?.slug ?? ""}" in org "${agent.metadata?.org ?? ""}"`;
+    return withClient(AgentCommandController, serverAddress, token, async (client, callOptions) => {
+        try {
+            const result = await client.apply(agent, callOptions);
+            return toProtoJson(AgentSchema, result);
+        }
+        catch (err) {
+            throw rpcError(err, desc);
+        }
+    });
+}
+//# sourceMappingURL=apply.js.map

package/domains/agents/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../../src/domains/agents/apply.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,yEAAyE;AACzE,kFAAkF;AAClF,0DAA0D;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wDAAwD,CAAC;AAEhG,OAAO,EAAE,iBAAiB,EAAmB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,aAAqB,EACrB,KAAa,EACb,KAAiB;IAEjB,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,aAAa,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC;IAC3F,OAAO,UAAU,CAAC,sBAAsB,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE;QAC5F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YACtD,OAAO,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/domains/agents/delete.d.ts

@@ -0,0 +1,3 @@
+/** Delete an agent by org and slug, returning the deleted agent as protojson. */
+export declare function deleteAgent(serverAddress: string, token: string, org: string, slug: string): Promise<string>;
+//# sourceMappingURL=delete.d.ts.map

package/domains/agents/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/domains/agents/delete.ts"],"names":[],"mappings":"AAcA,iFAAiF;AACjF,wBAAsB,WAAW,CAC/B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAoBjB"}

package/domains/agents/delete.js

@@ -0,0 +1,35 @@
+// Agent delete path: resolve org/slug → id via the Query controller, then
+// delete via the Command controller, both over a single shared transport.
+// Go parity: mcp-server/internal/domains/agents/delete.go.
+import { createClient } from "@connectrpc/connect";
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
+import { AgentQueryController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/query_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { withTransport } from "../client.js";
+import { toProtoJson } from "../marshal.js";
+import { rpcError } from "../rpcerr.js";
+/** Delete an agent by org and slug, returning the deleted agent as protojson. */
+export async function deleteAgent(serverAddress, token, org, slug) {
+    const desc = `agent "${slug}" in org "${org}"`;
+    return withTransport(serverAddress, token, async (transport, callOptions) => {
+        const query = createClient(AgentQueryController, transport);
+        let id;
+        try {
+            const agent = await query.getByReference({ org, kind: ApiResourceKind.agent, slug }, callOptions);
+            id = agent.metadata?.id ?? "";
+        }
+        catch (err) {
+            throw rpcError(err, desc);
+        }
+        const command = createClient(AgentCommandController, transport);
+        try {
+            const deleted = await command.delete({ value: id }, callOptions);
+            return toProtoJson(AgentSchema, deleted);
+        }
+        catch (err) {
+            throw rpcError(err, desc);
+        }
+    });
+}
+//# sourceMappingURL=delete.js.map

package/domains/agents/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../src/domains/agents/delete.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,0EAA0E;AAC1E,2DAA2D;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wDAAwD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,aAAqB,EACrB,KAAa,EACb,GAAW,EACX,IAAY;IAEZ,MAAM,IAAI,GAAG,UAAU,IAAI,aAAa,GAAG,GAAG,CAAC;IAC/C,OAAO,aAAa,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE;QAC1E,MAAM,KAAK,GAAG,YAAY,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;YAClG,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;YACjE,OAAO,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/domains/agents/fetch.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Retrieve an agent by org and slug, returning its protojson representation.
+ * Errors are classified into user-facing messages via {@link rpcError}.
+ */
+export declare function fetchAgent(serverAddress: string, token: string, org: string, slug: string): Promise<string>;
+//# sourceMappingURL=fetch.d.ts.map

package/domains/agents/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../../src/domains/agents/fetch.ts"],"names":[],"mappings":"AAWA;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAYjB"}

package/domains/agents/fetch.js

@@ -0,0 +1,24 @@
+// Agent read path: the single RPC both the get_agent tool and the agent
+// resource template delegate to. Mirrors Go internal/domains/agents/fetch.go.
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { AgentQueryController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/query_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { withClient } from "../client.js";
+import { toProtoJson } from "../marshal.js";
+import { rpcError } from "../rpcerr.js";
+/**
+ * Retrieve an agent by org and slug, returning its protojson representation.
+ * Errors are classified into user-facing messages via {@link rpcError}.
+ */
+export async function fetchAgent(serverAddress, token, org, slug) {
+    return withClient(AgentQueryController, serverAddress, token, async (client, callOptions) => {
+        try {
+            const agent = await client.getByReference({ org, kind: ApiResourceKind.agent, slug }, callOptions);
+            return toProtoJson(AgentSchema, agent);
+        }
+        catch (err) {
+            throw rpcError(err, `agent "${slug}" in org "${org}"`);
+        }
+    });
+}
+//# sourceMappingURL=fetch.js.map

package/domains/agents/fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../../src/domains/agents/fetch.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,8EAA8E;AAE9E,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,aAAqB,EACrB,KAAa,EACb,GAAW,EACX,IAAY;IAEZ,OAAO,UAAU,CAAC,oBAAoB,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,cAAc,CACvC,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,EAC1C,WAAW,CACZ,CAAC;YACF,OAAO,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,GAAG,EAAE,UAAU,IAAI,aAAa,GAAG,GAAG,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/domains/agents/resources.d.ts

@@ -0,0 +1,5 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { BackendTarget } from "../client.js";
+/** Register the agent resource template; returns the registered resource names. */
+export declare function registerAgentResources(server: McpServer, target: BackendTarget): string[];
+//# sourceMappingURL=resources.d.ts.map

package/domains/agents/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../../src/domains/agents/resources.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIlD,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,GAAG,MAAM,EAAE,CASzF"}

package/domains/agents/resources.js

@@ -0,0 +1,16 @@
+// Agent resource template (stigmer://agents/{org}/{slug}).
+// Go parity: mcp-server/internal/domains/agents/resources.go.
+import { registerResource } from "../resourcehandler.js";
+import { fetchAgent } from "./fetch.js";
+/** Register the agent resource template; returns the registered resource names. */
+export function registerAgentResources(server, target) {
+    registerResource(server, target, {
+        name: "stigmer_agent",
+        title: "Stigmer Agent",
+        description: "Full definition of a Stigmer agent, identified by organization and slug.",
+        template: "stigmer://agents/{org}/{slug}",
+        fetch: fetchAgent,
+    });
+    return ["stigmer_agent"];
+}
+//# sourceMappingURL=resources.js.map

package/domains/agents/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../../src/domains/agents/resources.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,8DAA8D;AAK9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAAqB;IAC7E,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE;QAC/B,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,0EAA0E;QACvF,QAAQ,EAAE,+BAA+B;QACzC,KAAK,EAAE,UAAU;KAClB,CAAC,CAAC;IACH,OAAO,CAAC,eAAe,CAAC,CAAC;AAC3B,CAAC"}

package/domains/agents/tools.d.ts

@@ -0,0 +1,5 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type BackendTarget } from "../client.js";
+/** Register every Agent-domain tool; returns the registered tool names. */
+export declare function registerAgentTools(server: McpServer, target: BackendTarget): string[];
+//# sourceMappingURL=tools.d.ts.map

package/domains/agents/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/domains/agents/tools.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIzE,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAMhE,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,GAAG,MAAM,EAAE,CAgDrF"}

package/domains/agents/tools.js

@@ -0,0 +1,41 @@
+// MCP tools for the Agent domain. Mirrors Go internal/domains/agents/tools.go.
+//
+// The tool name, description, and per-field input descriptions are part of the
+// parity contract (MCP clients surface them to the model verbatim), so they are
+// copied exactly from the Go definitions. This file is the canonical pattern the
+// remaining domains follow in T02: define the tool, resolve the per-request
+// credential, delegate to the domain fetch, and shape the result.
+import { z } from "zod";
+import { AgentInputShape } from "../../gen/agent.js";
+import { resolveToken } from "../client.js";
+import { textOrError } from "../toolresult.js";
+import { applyAgent } from "./apply.js";
+import { deleteAgent } from "./delete.js";
+import { fetchAgent } from "./fetch.js";
+/** Register every Agent-domain tool; returns the registered tool names. */
+export function registerAgentTools(server, target) {
+    server.registerTool("get_agent", {
+        description: "Get full details of a Stigmer agent by its org and slug (e.g. org=stigmer slug=code-reviewer).",
+        inputSchema: {
+            org: z.string().describe("Organization slug that owns the agent (e.g. stigmer)."),
+            slug: z
+                .string()
+                .describe("Agent slug — the unique identifier within the org (e.g. code-reviewer)."),
+        },
+    }, (args, extra) => textOrError(() => fetchAgent(target.serverAddress, resolveToken(extra, target.apiKey), args.org, args.slug)));
+    server.registerTool("apply_agent", {
+        description: "Create or update a Stigmer agent (idempotent). Provide identity fields (name, org) and agent configuration (instructions, skills, MCP servers, etc.).",
+        inputSchema: AgentInputShape,
+    }, (args, extra) => textOrError(() => applyAgent(target.serverAddress, resolveToken(extra, target.apiKey), args)));
+    server.registerTool("delete_agent", {
+        description: "Delete a Stigmer agent by its org and slug. Returns the deleted agent.",
+        inputSchema: {
+            org: z.string().describe("Organization slug that owns the agent (e.g. stigmer)."),
+            slug: z
+                .string()
+                .describe("Agent slug — the unique identifier within the org (e.g. code-reviewer)."),
+        },
+    }, (args, extra) => textOrError(() => deleteAgent(target.serverAddress, resolveToken(extra, target.apiKey), args.org, args.slug)));
+    return ["get_agent", "apply_agent", "delete_agent"];
+}
+//# sourceMappingURL=tools.js.map

package/domains/agents/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../src/domains/agents/tools.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,4EAA4E;AAC5E,kEAAkE;AAGlE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,MAAqB;IACzE,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,WAAW,EACT,gGAAgG;QAClG,WAAW,EAAE;YACX,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;YACjF,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,QAAQ,CAAC,yEAAyE,CAAC;SACvF;KACF,EACD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,WAAW,CAAC,GAAG,EAAE,CACf,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAC1F,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,WAAW,EACT,uJAAuJ;QACzJ,WAAW,EAAE,eAAe;KAC7B,EACD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,WAAW,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAChG,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,WAAW,EAAE,wEAAwE;QACrF,WAAW,EAAE;YACX,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;YACjF,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,QAAQ,CAAC,yEAAyE,CAAC;SACvF;KACF,EACD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,WAAW,CAAC,GAAG,EAAE,CACf,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAC3F,CACJ,CAAC;IAEF,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;AACtD,CAAC"}

package/domains/client.d.ts

@@ -0,0 +1,53 @@
+import { type Client, type CallOptions, type Transport } from "@connectrpc/connect";
+import type { DescService } from "@bufbuild/protobuf";
+/**
+ * Per-call RPC timeout. Mirrors Go's DefaultRPCTimeout: generous for both
+ * localhost (milliseconds) and remote endpoints (low seconds), while still
+ * failing fast against a misconfigured or unreachable address.
+ */
+export declare const DEFAULT_RPC_TIMEOUT_MS = 30000;
+/**
+ * The stigmer-server endpoint and startup credential captured at registration
+ * time and shared by every tool handler. Mirrors the `serverAddress` closure +
+ * startup API key that the Go handlers capture.
+ */
+export interface BackendTarget {
+    readonly serverAddress: string;
+    /** stdio startup API key; "" when targeting an unauthenticated backend. */
+    readonly apiKey: string;
+}
+/** The subset of the MCP request `extra` this layer reads to resolve a token. */
+export interface RequestAuth {
+    readonly authInfo?: {
+        readonly token?: string;
+    };
+}
+/**
+ * Resolve the credential for an inbound tool call: the per-request Bearer token
+ * (http) when present, otherwise the startup API key (stdio). Returns "" when
+ * targeting an unauthenticated backend, in which case no credential is attached.
+ */
+export declare function resolveToken(extra: RequestAuth | undefined, fallback: string): string;
+/**
+ * Build an authenticated transport to stigmer-server for a single credential.
+ * The address is normalized (scheme/TLS rules) before the transport is built;
+ * an empty token attaches no Authorization header.
+ */
+export declare function transportForToken(serverAddress: string, token: string): Transport;
+/**
+ * Open a short-lived authenticated transport and invoke `fn` with it and the
+ * standard call options (RPC timeout pre-applied). Mirrors Go's WithConnection:
+ * the single place that owns transport construction and the timeout. Use this
+ * when an operation needs more than one controller over the SAME connection —
+ * e.g. the two-step deletes that resolve via the Query controller and delete via
+ * the Command controller.
+ */
+export declare function withTransport<T>(serverAddress: string, token: string, fn: (transport: Transport, callOptions: CallOptions) => Promise<T>): Promise<T>;
+/**
+ * Open a short-lived raw controller client and invoke `fn` with it and the
+ * standard call options. The single-controller convenience over
+ * {@link withTransport}; call sites that only touch one service stay a
+ * one-liner.
+ */
+export declare function withClient<S extends DescService, T>(service: S, serverAddress: string, token: string, fn: (client: Client<S>, callOptions: CallOptions) => Promise<T>): Promise<T>;
+//# sourceMappingURL=client.d.ts.map

package/domains/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/domains/client.ts"],"names":[],"mappings":"AAcA,OAAO,EAAgB,KAAK,MAAM,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAKjF;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GACjE,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,EACvD,OAAO,EAAE,CAAC,EACV,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9D,OAAO,CAAC,CAAC,CAAC,CAIZ"}

package/domains/client.js

@@ -0,0 +1,62 @@
+// Per-request gRPC client construction for tool handlers.
+//
+// Parity contract (mirrors Go internal/domains/conn.go WithConnection + the
+// auth/grpc layer): each tool call resolves its credential, opens a short-lived
+// authenticated client to stigmer-server with a fixed RPC timeout, runs the
+// call, and discards the client. This is intentionally simple — the MCP server
+// handles a low volume of calls and transport setup is cheap. Pooling can be
+// introduced later without touching call sites.
+//
+// Credential source mirrors Go precisely:
+//   - stdio: the API key is captured once at startup (constant per process).
+//   - http: every request carries its own Bearer token via authInfo, which the
+//     transport injected from the Authorization header.
+import { createClient } from "@connectrpc/connect";
+import { createNodeTransport, normalizeEndpoint } from "@stigmer/sdk/node";
+/**
+ * Per-call RPC timeout. Mirrors Go's DefaultRPCTimeout: generous for both
+ * localhost (milliseconds) and remote endpoints (low seconds), while still
+ * failing fast against a misconfigured or unreachable address.
+ */
+export const DEFAULT_RPC_TIMEOUT_MS = 30_000;
+/**
+ * Resolve the credential for an inbound tool call: the per-request Bearer token
+ * (http) when present, otherwise the startup API key (stdio). Returns "" when
+ * targeting an unauthenticated backend, in which case no credential is attached.
+ */
+export function resolveToken(extra, fallback) {
+    const token = extra?.authInfo?.token;
+    return token !== undefined && token !== "" ? token : fallback;
+}
+/**
+ * Build an authenticated transport to stigmer-server for a single credential.
+ * The address is normalized (scheme/TLS rules) before the transport is built;
+ * an empty token attaches no Authorization header.
+ */
+export function transportForToken(serverAddress, token) {
+    return createNodeTransport({
+        baseUrl: normalizeEndpoint(serverAddress),
+        apiKey: token === "" ? undefined : token,
+    });
+}
+/**
+ * Open a short-lived authenticated transport and invoke `fn` with it and the
+ * standard call options (RPC timeout pre-applied). Mirrors Go's WithConnection:
+ * the single place that owns transport construction and the timeout. Use this
+ * when an operation needs more than one controller over the SAME connection —
+ * e.g. the two-step deletes that resolve via the Query controller and delete via
+ * the Command controller.
+ */
+export async function withTransport(serverAddress, token, fn) {
+    return fn(transportForToken(serverAddress, token), { timeoutMs: DEFAULT_RPC_TIMEOUT_MS });
+}
+/**
+ * Open a short-lived raw controller client and invoke `fn` with it and the
+ * standard call options. The single-controller convenience over
+ * {@link withTransport}; call sites that only touch one service stay a
+ * one-liner.
+ */
+export async function withClient(service, serverAddress, token, fn) {
+    return withTransport(serverAddress, token, (transport, callOptions) => fn(createClient(service, transport), callOptions));
+}
+//# sourceMappingURL=client.js.map

package/domains/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/domains/client.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,gDAAgD;AAChD,EAAE;AACF,0CAA0C;AAC1C,6EAA6E;AAC7E,+EAA+E;AAC/E,wDAAwD;AAExD,OAAO,EAAE,YAAY,EAAiD,MAAM,qBAAqB,CAAC;AAElG,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAkB7C;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAA8B,EAAE,QAAgB;IAC3E,MAAM,KAAK,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC;IACrC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,aAAqB,EAAE,KAAa;IACpE,OAAO,mBAAmB,CAAC;QACzB,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC;QACzC,MAAM,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;KACzC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,aAAqB,EACrB,KAAa,EACb,EAAkE;IAElE,OAAO,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAU,EACV,aAAqB,EACrB,KAAa,EACb,EAA+D;IAE/D,OAAO,aAAa,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,CACpE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,WAAW,CAAC,CAClD,CAAC;AACJ,CAAC"}

package/domains/marshal.d.ts

@@ -0,0 +1,8 @@
+import { type DescMessage, type MessageShape } from "@bufbuild/protobuf";
+/**
+ * Serialize a protobuf message to the human-friendly JSON string returned in
+ * MCP tool output. Field names use the proto (snake_case) names so the payload
+ * is byte-comparable, after parsing, with the Go server's protojson.
+ */
+export declare function toProtoJson<Desc extends DescMessage>(schema: Desc, message: MessageShape<Desc>): string;
+//# sourceMappingURL=marshal.d.ts.map

package/domains/marshal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marshal.d.ts","sourceRoot":"","sources":["../../src/domains/marshal.ts"],"names":[],"mappings":"AAQA,OAAO,EAAU,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEjF;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,SAAS,WAAW,EAClD,MAAM,EAAE,IAAI,EACZ,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,GAC1B,MAAM,CAER"}

package/domains/marshal.js

@@ -0,0 +1,17 @@
+// Canonical protobuf → JSON serialization shared by every tool response.
+//
+// Parity contract (mirrors Go internal/domains/marshal.go): the Go server emits
+// protojson with UseProtoNames=true and EmitUnpopulated=false, 2-space indented.
+// protobuf-es `toJson` with { useProtoFieldName: true } reproduces this exactly —
+// snake_case field names, omitted defaults, base64 bytes, string enums, and
+// RFC-3339 timestamps — and JSON.stringify(..., 2) applies the same indentation.
+import { toJson } from "@bufbuild/protobuf";
+/**
+ * Serialize a protobuf message to the human-friendly JSON string returned in
+ * MCP tool output. Field names use the proto (snake_case) names so the payload
+ * is byte-comparable, after parsing, with the Go server's protojson.
+ */
+export function toProtoJson(schema, message) {
+    return JSON.stringify(toJson(schema, message, { useProtoFieldName: true }), null, 2);
+}
+//# sourceMappingURL=marshal.js.map

package/domains/marshal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marshal.js","sourceRoot":"","sources":["../../src/domains/marshal.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,4EAA4E;AAC5E,iFAAiF;AAEjF,OAAO,EAAE,MAAM,EAAuC,MAAM,oBAAoB,CAAC;AAEjF;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,MAAY,EACZ,OAA2B;IAE3B,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC"}

package/domains/mcpservers/apply.d.ts

@@ -0,0 +1,4 @@
+import { type McpServerInput } from "../../gen/mcpserver.js";
+/** Create or update an MCP server, returning the persisted server as protojson. */
+export declare function applyMcpServer(serverAddress: string, token: string, input: McpServerInput): Promise<string>;
+//# sourceMappingURL=apply.d.ts.map

package/domains/mcpservers/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../../src/domains/mcpservers/apply.ts"],"names":[],"mappings":"AASA,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAKpF,mFAAmF;AACnF,wBAAsB,cAAc,CAClC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,MAAM,CAAC,CAgBjB"}

package/domains/mcpservers/apply.js

@@ -0,0 +1,26 @@
+// McpServer apply path: create-or-update via the McpServerCommandController.apply
+// RPC. The flat MCP input is projected into a fully-formed McpServer proto by the
+// generated mcpServerInputToProto bridge (codegen, src/gen/mcpserver.ts), which
+// also rebuilds the stdio/http oneof, before the call.
+// Go parity: mcp-server/internal/domains/mcpservers/apply.go.
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { McpServerCommandController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/command_pb";
+import { mcpServerInputToProto } from "../../gen/mcpserver.js";
+import { withClient } from "../client.js";
+import { toProtoJson } from "../marshal.js";
+import { rpcError } from "../rpcerr.js";
+/** Create or update an MCP server, returning the persisted server as protojson. */
+export async function applyMcpServer(serverAddress, token, input) {
+    const server = mcpServerInputToProto(input);
+    const desc = `mcp server "${server.metadata?.slug ?? ""}" in org "${server.metadata?.org ?? ""}"`;
+    return withClient(McpServerCommandController, serverAddress, token, async (client, callOptions) => {
+        try {
+            const result = await client.apply(server, callOptions);
+            return toProtoJson(McpServerSchema, result);
+        }
+        catch (err) {
+            throw rpcError(err, desc);
+        }
+    });
+}
+//# sourceMappingURL=apply.js.map

package/domains/mcpservers/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../../src/domains/mcpservers/apply.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,kFAAkF;AAClF,gFAAgF;AAChF,uDAAuD;AACvD,8DAA8D;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AAExG,OAAO,EAAE,qBAAqB,EAAuB,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,aAAqB,EACrB,KAAa,EACb,KAAqB;IAErB,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,eAAe,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,aAAa,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC;IAClG,OAAO,UAAU,CACf,0BAA0B,EAC1B,aAAa,EACb,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACvD,OAAO,WAAW,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/domains/mcpservers/delete.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Delete an MCP server by org and slug, returning the deleted MCP server as
+ * protojson.
+ */
+export declare function deleteMcpServer(serverAddress: string, token: string, org: string, slug: string): Promise<string>;
+//# sourceMappingURL=delete.d.ts.map

package/domains/mcpservers/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/domains/mcpservers/delete.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAuBjB"}