@taiga-ai/mcp-server 0.36.0-dev.916 → 0.36.0-dev.918

package/dist/index.js

@@ -26131,6 +26131,45 @@ const GITLAB_CONNECTION_STATUSES = [
 	"unreachable"
 ];
 //#endregion
+//#region ../../packages/types/dist/cloud-connections.js
+const CLOUD_CONNECTION_STATUSES = [
+	"pending_setup",
+	"validating",
+	"active",
+	"error",
+	"suspended",
+	"disconnected"
+];
+/**
+* Keys in `providerConfig` that only Taiga's provisioning path may write.
+*
+* PRO-858. `accountName` is the correlation key the AFT account-ready callback
+* arrives with, and the webhook resolves it under service context with no
+* tenant predicate -- it has to, because the callback carries no tenant. It is
+* also guessable: `generateAccountName` derives it from tenant, team and
+* project slugs. So a tenant that could write this key could plant a row
+* claiming another tenant's account name, wait for that callback, and have the
+* victim's `deployConfig` (accountId, deployRoleArn, stateBucket) delivered to
+* their own environment.
+*
+* `accountKey` is the same identity in unguessable form
+* (`sha256(tenantId:productId:envType)`), and is what the AFT module is named
+* for -- equally not the caller's to assert.
+*
+* Neither is tenant-facing: no provider schema models them, and
+* `providerConfigProblem` documents them as the shape a MANAGED row has. The
+* update path merges and persists the RAW config precisely so Zod does not
+* strip them off managed rows, which is what made a tenant-supplied value
+* durable. Rejecting rather than stripping, so a client sending one is told,
+* instead of silently having it dropped.
+*/
+const TAIGA_MANAGED_PROVIDER_CONFIG_KEYS = ["accountName", "accountKey"];
+/** Whether `config` leaves alone the keys only Taiga's provisioning writes. */
+function isTenantWritableProviderConfig(config) {
+	return !TAIGA_MANAGED_PROVIDER_CONFIG_KEYS.some((key) => key in config);
+}
+const TAIGA_MANAGED_PROVIDER_CONFIG_MESSAGE = `providerConfig may not set ${TAIGA_MANAGED_PROVIDER_CONFIG_KEYS.join(" or ")}: Taiga's provisioning owns those keys`;
+//#endregion
 //#region ../../packages/types/dist/environments.js
 const ENVIRONMENT_TYPES = [
 	"development",
@@ -27144,6 +27183,14 @@ const cloudProviderConfig = discriminatedUnion("provider", [
 		bestPractices: cloudBestPractices
 	})
 ]);
+const newCloudConnection = strictObject({
+	name: string$2().min(1).max(150),
+	provider: _enum(CLOUD_PROVIDERS),
+	providerConfig: cloudProviderConfig
+}).refine((connection) => connection.provider === connection.providerConfig.provider, {
+	message: "connection.provider must match connection.providerConfig.provider",
+	path: ["providerConfig", "provider"]
+});
 const columnIndex = number$1().int().min(1).max(EXCEL_MAX_COLUMN);
 const sheetMap = object({
 	sheetName: string$2().min(1).max(120),
@@ -27287,15 +27334,8 @@ strictObject({ type: productDocumentType }), object({
 		literal(12)
 	]),
 	note: string$2().trim().max(1e3).optional()
-}), strictObject({ environments: array(string$2()).default(["development"]) }), strictObject({
-	connection: object({
-		name: string$2().min(1).max(150),
-		provider: _enum(CLOUD_PROVIDERS),
-		providerConfig: cloudProviderConfig
-	}).refine((connection) => connection.provider === connection.providerConfig.provider, {
-		message: "connection.provider must match connection.providerConfig.provider",
-		path: ["providerConfig", "provider"]
-	}),
+}), strictObject({ environments: array(string$2()).default(["development"]) }), object({ id: string$2().uuid() }), strictObject({
+	connection: newCloudConnection,
 	environment: object({
 		name: string$2().min(1).max(100),
 		slug: string$2().min(1).max(63).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Slug must be lowercase letters, digits, and dashes"),
@@ -27384,7 +27424,16 @@ strictObject({
 	status: _enum(GITLAB_CONNECTION_STATUSES),
 	lastValidatedAt: string$2(),
 	detail: string$2().nullable()
-}), object({ finished: boolean() });
+}), object({ finished: boolean() }), strictObject({ search: string$2().trim().max(100).optional() }), object({
+	projects: array(object({
+		id: number$1().int(),
+		pathWithNamespace: string$2(),
+		nameWithNamespace: string$2(),
+		webUrl: string$2(),
+		defaultBranch: string$2().nullable()
+	})).nullable(),
+	truncated: boolean()
+});
 object({
 	outcome: _enum([
 		"uninstalled",
@@ -27393,6 +27442,8 @@ object({
 	]),
 	manageUrl: string$2().nullable()
 });
+/** A value GitHub's redirect carries back: a state token, or a one-time code. */
+const githubCallbackSecret = string$2().trim().min(1).max(1024);
 strictObject({
 	displayName: string$2().trim().min(1).max(255),
 	baseUrl: string$2().trim().min(1).max(480),
@@ -27410,7 +27461,16 @@ strictObject({
 	expiresAt: isoInstant.nullable().optional(),
 	credential: registryCredential,
 	testPackage: registryTestPackage.optional()
-}), strictObject({ hostId: uuid.optional() }), object({ installUrl: string$2().url() }), strictObject({
+}), strictObject({ hostId: uuid.optional() }), object({ installUrl: string$2().url() }), strictObject({ state: githubCallbackSecret }), object({
+	clientId: string$2(),
+	authorizeUrl: string$2(),
+	redirectUri: string$2().optional()
+}), strictObject({
+	installationId: number$1().int().positive(),
+	setupAction: _enum(["install", "update"]),
+	state: githubCallbackSecret.optional(),
+	code: githubCallbackSecret.optional()
+}), strictObject({
 	subdomain: string$2().min(1).max(39).optional(),
 	serverUrl: string$2().min(1).max(2048).optional(),
 	caBundlePem: string$2().max(65536).optional(),
@@ -27420,6 +27480,9 @@ strictObject({
 	manifest: record(string$2(), unknown$1()),
 	postUrl: string$2().url(),
 	state: string$2()
+}), strictObject({
+	state: githubCallbackSecret,
+	code: githubCallbackSecret
 }), strictObject({ type: _enum(TENANT_DOCUMENT_TYPES) }), strictObject({ type: _enum(TENANT_DOCUMENT_TYPES).refine((type) => type !== "design_standards", { message: "The design standards draft is not made through sync" }) }), strictObject({
 	name: string$2().min(1).max(50),
 	action: _enum(["accept", "decline"])
@@ -27465,6 +27528,9 @@ strictObject({
 }).refine((a) => Boolean(a.approve) !== Boolean(a.remove), { message: "Name one license to approve or remove" }), object({
 	enrolled: number$1().int().nonnegative(),
 	total: number$1().int().nonnegative()
+}), object({
+	principalArn: string$2().nullable(),
+	externalId: string$2()
 });
 strictObject({ kind: _enum(["sbom", "notices"]) }), object({
 	url: string$2().url().nullable(),
@@ -27487,6 +27553,11 @@ strictObject({ tier: _enum([
 	"staging",
 	"production"
 ]) });
+strictObject({
+	name: string$2().min(1).max(150).optional(),
+	status: _enum(CLOUD_CONNECTION_STATUSES).optional(),
+	providerConfig: record(string$2(), unknown$1()).refine(isTenantWritableProviderConfig, { message: TAIGA_MANAGED_PROVIDER_CONFIG_MESSAGE }).optional()
+});
 object({
 	url: string$2().url(),
 	expiresAt: string$2(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.36.0-dev.916",
+  "version": "0.36.0-dev.918",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "license": "UNLICENSED",