@taiga-ai/mcp-server 0.36.0-dev.916 → 0.36.0-dev.917

package/dist/index.js

@@ -26131,6 +26131,45 @@ const GITLAB_CONNECTION_STATUSES = [
 	"unreachable"
 ];
 //#endregion
+//#region ../../packages/types/dist/cloud-connections.js
+const CLOUD_CONNECTION_STATUSES = [
+	"pending_setup",
+	"validating",
+	"active",
+	"error",
+	"suspended",
+	"disconnected"
+];
+/**
+* Keys in `providerConfig` that only Taiga's provisioning path may write.
+*
+* PRO-858. `accountName` is the correlation key the AFT account-ready callback
+* arrives with, and the webhook resolves it under service context with no
+* tenant predicate -- it has to, because the callback carries no tenant. It is
+* also guessable: `generateAccountName` derives it from tenant, team and
+* project slugs. So a tenant that could write this key could plant a row
+* claiming another tenant's account name, wait for that callback, and have the
+* victim's `deployConfig` (accountId, deployRoleArn, stateBucket) delivered to
+* their own environment.
+*
+* `accountKey` is the same identity in unguessable form
+* (`sha256(tenantId:productId:envType)`), and is what the AFT module is named
+* for -- equally not the caller's to assert.
+*
+* Neither is tenant-facing: no provider schema models them, and
+* `providerConfigProblem` documents them as the shape a MANAGED row has. The
+* update path merges and persists the RAW config precisely so Zod does not
+* strip them off managed rows, which is what made a tenant-supplied value
+* durable. Rejecting rather than stripping, so a client sending one is told,
+* instead of silently having it dropped.
+*/
+const TAIGA_MANAGED_PROVIDER_CONFIG_KEYS = ["accountName", "accountKey"];
+/** Whether `config` leaves alone the keys only Taiga's provisioning writes. */
+function isTenantWritableProviderConfig(config) {
+	return !TAIGA_MANAGED_PROVIDER_CONFIG_KEYS.some((key) => key in config);
+}
+const TAIGA_MANAGED_PROVIDER_CONFIG_MESSAGE = `providerConfig may not set ${TAIGA_MANAGED_PROVIDER_CONFIG_KEYS.join(" or ")}: Taiga's provisioning owns those keys`;
+//#endregion
 //#region ../../packages/types/dist/environments.js
 const ENVIRONMENT_TYPES = [
 	"development",
@@ -27144,6 +27183,14 @@ const cloudProviderConfig = discriminatedUnion("provider", [
 		bestPractices: cloudBestPractices
 	})
 ]);
+const newCloudConnection = strictObject({
+	name: string$2().min(1).max(150),
+	provider: _enum(CLOUD_PROVIDERS),
+	providerConfig: cloudProviderConfig
+}).refine((connection) => connection.provider === connection.providerConfig.provider, {
+	message: "connection.provider must match connection.providerConfig.provider",
+	path: ["providerConfig", "provider"]
+});
 const columnIndex = number$1().int().min(1).max(EXCEL_MAX_COLUMN);
 const sheetMap = object({
 	sheetName: string$2().min(1).max(120),
@@ -27287,15 +27334,8 @@ strictObject({ type: productDocumentType }), object({
 		literal(12)
 	]),
 	note: string$2().trim().max(1e3).optional()
-}), strictObject({ environments: array(string$2()).default(["development"]) }), strictObject({
-	connection: object({
-		name: string$2().min(1).max(150),
-		provider: _enum(CLOUD_PROVIDERS),
-		providerConfig: cloudProviderConfig
-	}).refine((connection) => connection.provider === connection.providerConfig.provider, {
-		message: "connection.provider must match connection.providerConfig.provider",
-		path: ["providerConfig", "provider"]
-	}),
+}), strictObject({ environments: array(string$2()).default(["development"]) }), object({ id: string$2().uuid() }), strictObject({
+	connection: newCloudConnection,
 	environment: object({
 		name: string$2().min(1).max(100),
 		slug: string$2().min(1).max(63).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Slug must be lowercase letters, digits, and dashes"),
@@ -27487,6 +27527,11 @@ strictObject({ tier: _enum([
 	"staging",
 	"production"
 ]) });
+strictObject({
+	name: string$2().min(1).max(150).optional(),
+	status: _enum(CLOUD_CONNECTION_STATUSES).optional(),
+	providerConfig: record(string$2(), unknown$1()).refine(isTenantWritableProviderConfig, { message: TAIGA_MANAGED_PROVIDER_CONFIG_MESSAGE }).optional()
+});
 object({
 	url: string$2().url(),
 	expiresAt: string$2(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.36.0-dev.916",
+  "version": "0.36.0-dev.917",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "license": "UNLICENSED",