@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/mcp/models/mcp-tool.backend.schemas.d.ts

@@ -41,6 +41,40 @@ export declare const MCP_TOOL_NAME_MAX_LENGTH = 128;
  * re-checked here: `buildResourceToolDescriptors` already de-dupes by name within a resource, and
  * the `__`-in-resource-identifier guard keeps names from colliding across resources.
  */
+/**
+ * The DERIVED upload-grant tool (issue #312, D11).
+ *
+ * For every exposed default CREATE / UPDATE operation whose request carries a user-uploadable file
+ * field, the catalogue also advertises `<resource>__<operation>.upload_grant.<fieldSegment>`, e.g.
+ * `todos__create.upload_grant.attachments`. Calling it mints a single-use upload grant for that field
+ * (see `FileUploadGrantBackendService`); it never carries bytes.
+ *
+ * ## Why dots
+ *
+ * `parseToolName` splits on the FIRST `__`, so everything after it is the "operation". Operation
+ * identifiers are snake_case and never contain `.`, while the naming guidance allows `.` — so a dotted
+ * suffix is unambiguous, cannot collide with an authored custom operation, and needs no second
+ * separator. Rejected: `_upload_grant_` (collides with a legitimately named custom operation, and
+ * refusing that operation would make the wrong party pay) and a standalone `files__…` tool taking the
+ * resource in its arguments (would have to re-implement the parent's exposure / instance / scope
+ * gating instead of inheriting it).
+ *
+ * The field segment is the SAME kebab-case segment the upload ROUTE uses (`…/files/<segment>`), so a
+ * tool name and its route agree by construction; resolution maps the segment back by recomputing it
+ * over the resource's uploadable fields rather than by inverting the transform.
+ */
+export declare const MCP_UPLOAD_GRANT_TOOL_MARKER = ".upload_grant.";
+/** `<parentOperation>.upload_grant.<fieldSegment>` — the operation part of a derived tool name. */
+export declare function buildUploadGrantToolOperationPart(parentOperationIdentifier: string, fieldRouteSegment: string): string;
+/**
+ * Split the operation part of a derived tool name, or `undefined` when it is not one. Strict on shape:
+ * exactly one marker, a non-empty snake_case parent and a non-empty kebab-case segment — anything
+ * else is an ordinary (possibly custom) operation identifier and is left to the ordinary resolver.
+ */
+export declare function parseUploadGrantToolOperationPart(operationPart: string): {
+    parentOperationIdentifier: string;
+    fieldRouteSegment: string;
+} | undefined;
 export declare function isSpecConformantMcpToolName(name: string): boolean;
 /**
  * Agent-facing behavioural hints on a tool, mirroring the MCP `ToolAnnotations`

package/dist/esm/mcp/models/mcp-tool.backend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-tool.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/mcp/models/mcp-tool.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE3E;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAW5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIjE;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oGAAoG;IACpG,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,4DAA4D;IAC5D,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;OAIG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B,mEAAmE;IACnE,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,0BAA0B,GAAG,CACvC,YAAY,EAAE,YAAY,EAC1B,mBAAmB,EAAE,MAAM,KACxB;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC;IAC/B,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,oBAAoB,CAAC,CAAC;IACpD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}
+{"version":3,"file":"mcp-tool.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/mcp/models/mcp-tool.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE3E;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAW5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,4BAA4B,mBAAmB,CAAC;AAE7D,mGAAmG;AACnG,wBAAgB,iCAAiC,CAAC,yBAAyB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAEtH;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAAC,aAAa,EAAE,MAAM,GAAG;IAAE,yBAAyB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAOrJ;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIjE;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oGAAoG;IACpG,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,4DAA4D;IAC5D,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;OAIG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B,mEAAmE;IACnE,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,0BAA0B,GAAG,CACvC,YAAY,EAAE,YAAY,EAC1B,mBAAmB,EAAE,MAAM,KACxB;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC;IAC/B,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,oBAAoB,CAAC,CAAC;IACpD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/esm/mcp/models/mcp-tool.backend.schemas.js

@@ -48,6 +48,48 @@ const MCP_TOOL_NAME_ALLOWED_CHARACTERS = /^[A-Za-z0-9_.-]+$/;
  * re-checked here: `buildResourceToolDescriptors` already de-dupes by name within a resource, and
  * the `__`-in-resource-identifier guard keeps names from colliding across resources.
  */
+/**
+ * The DERIVED upload-grant tool (issue #312, D11).
+ *
+ * For every exposed default CREATE / UPDATE operation whose request carries a user-uploadable file
+ * field, the catalogue also advertises `<resource>__<operation>.upload_grant.<fieldSegment>`, e.g.
+ * `todos__create.upload_grant.attachments`. Calling it mints a single-use upload grant for that field
+ * (see `FileUploadGrantBackendService`); it never carries bytes.
+ *
+ * ## Why dots
+ *
+ * `parseToolName` splits on the FIRST `__`, so everything after it is the "operation". Operation
+ * identifiers are snake_case and never contain `.`, while the naming guidance allows `.` — so a dotted
+ * suffix is unambiguous, cannot collide with an authored custom operation, and needs no second
+ * separator. Rejected: `_upload_grant_` (collides with a legitimately named custom operation, and
+ * refusing that operation would make the wrong party pay) and a standalone `files__…` tool taking the
+ * resource in its arguments (would have to re-implement the parent's exposure / instance / scope
+ * gating instead of inheriting it).
+ *
+ * The field segment is the SAME kebab-case segment the upload ROUTE uses (`…/files/<segment>`), so a
+ * tool name and its route agree by construction; resolution maps the segment back by recomputing it
+ * over the resource's uploadable fields rather than by inverting the transform.
+ */
+export const MCP_UPLOAD_GRANT_TOOL_MARKER = '.upload_grant.';
+/** `<parentOperation>.upload_grant.<fieldSegment>` — the operation part of a derived tool name. */
+export function buildUploadGrantToolOperationPart(parentOperationIdentifier, fieldRouteSegment) {
+    return `${parentOperationIdentifier}${MCP_UPLOAD_GRANT_TOOL_MARKER}${fieldRouteSegment}`;
+}
+/**
+ * Split the operation part of a derived tool name, or `undefined` when it is not one. Strict on shape:
+ * exactly one marker, a non-empty snake_case parent and a non-empty kebab-case segment — anything
+ * else is an ordinary (possibly custom) operation identifier and is left to the ordinary resolver.
+ */
+export function parseUploadGrantToolOperationPart(operationPart) {
+    const at = operationPart.indexOf(MCP_UPLOAD_GRANT_TOOL_MARKER);
+    if (at <= 0)
+        return undefined;
+    const parentOperationIdentifier = operationPart.slice(0, at);
+    const fieldRouteSegment = operationPart.slice(at + MCP_UPLOAD_GRANT_TOOL_MARKER.length);
+    if (!/^[a-z0-9_]+$/.test(parentOperationIdentifier) || !/^[a-z0-9-]+$/.test(fieldRouteSegment))
+        return undefined;
+    return { parentOperationIdentifier, fieldRouteSegment };
+}
 export function isSpecConformantMcpToolName(name) {
     return name.length > 0
         && name.length <= MCP_TOOL_NAME_MAX_LENGTH

package/dist/esm/mcp/models/mcp-tool.backend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-tool.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/mcp/models/mcp-tool.backend.schemas.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,gCAAgC,GAAG,mBAAmB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC;WACjB,IAAI,CAAC,MAAM,IAAI,wBAAwB;WACvC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC","sourcesContent":["import { ResourceType, ResourcePrimaryScope } from '@wildo-ai/saas-models';\n\n/**\n * Tool-name separator between the resource identifier and the operation\n * identifier: `<resourceIdentifier>__<operationIdentifier>` (e.g. `todos__create`).\n *\n * A DOUBLE underscore is used deliberately: resource identifiers themselves can\n * contain single underscores (`organization_members`), so a single-underscore\n * separator would be ambiguous. The double underscore is the first-slice identity\n * scheme; a `variantKey` suffix (`<resource>__<operation>__<variantKey>`) is a\n * follow-up once non-default variants are exposed (see the MCP child plan).\n */\nexport const MCP_TOOL_NAME_SEPARATOR = '__';\n\n/**\n * Upper bound on a tool name, from the naming guidance `2025-11-25` added (SEP-986).\n *\n * \"Tool names SHOULD be between 1 and 128 characters in length (inclusive).\"\n * spec-cite: MCP 2025-11-25 — Tools § Data Types → Tool Names\n */\nexport const MCP_TOOL_NAME_MAX_LENGTH = 128;\n\n/**\n * The character set the same section allows.\n *\n * \"The following SHOULD be the only allowed characters: uppercase and lowercase ASCII letters (A-Z,\n *  a-z), digits (0-9), underscore (_), hyphen (-), and dot (.)\"\n * spec-cite: MCP 2025-11-25 — Tools § Data Types → Tool Names\n */\nconst MCP_TOOL_NAME_ALLOWED_CHARACTERS = /^[A-Za-z0-9_.-]+$/;\n\n/**\n * Does this tool name satisfy the `2025-11-25` naming guidance?\n *\n * # Why a server-side gate for a SHOULD\n *\n * A tool name here is `<resourceIdentifier>__<operationIdentifier>`, and BOTH halves are authored by\n * the application, not by the engine. Nothing else constrains them: a resource identifier is a\n * TypeScript string and a custom operation identifier is whatever its author typed. So the guidance\n * binds an app developer who has never read it, through a name they did not know they were composing.\n *\n * The failure it prevents is not local. A name is not rejected by the tool that carries it — it is\n * carried inside a `tools/list` RESULT, so a client strict about the guidance can reject the whole\n * CATALOGUE, and every other tool in the application disappears with it. Refusing the one bad\n * descriptor is therefore the smaller failure by a wide margin, and it names the offender in a log\n * line instead of leaving an app developer to explain why one client sees no tools at all.\n *\n * Measured before choosing fail-closed: every tool name this repository actually produces matches\n * `[A-Za-z0-9_]+__[A-Za-z0-9_]+` (todos__create, user_preferences__read, todos__recent_todos, …), so\n * the gate withdraws nothing that exists today. It is a guard against a future name, not a migration.\n *\n * Uniqueness — the fourth SHOULD in that section — is enforced elsewhere and deliberately not\n * re-checked here: `buildResourceToolDescriptors` already de-dupes by name within a resource, and\n * the `__`-in-resource-identifier guard keeps names from colliding across resources.\n */\nexport function isSpecConformantMcpToolName(name: string): boolean {\n  return name.length > 0\n    && name.length <= MCP_TOOL_NAME_MAX_LENGTH\n    && MCP_TOOL_NAME_ALLOWED_CHARACTERS.test(name);\n}\n\n/**\n * Agent-facing behavioural hints on a tool, mirroring the MCP `ToolAnnotations`\n * shape. Advisory only — they never affect authorization (which is always\n * re-checked at `callTool` time). Derived from the operation's core identifier +\n * `riskLevel`.\n */\nexport interface McpToolAnnotations {\n  /** Human-readable title for display surfaces. */\n  title?: string;\n  /** True when the operation only reads (READ/LIST/SEARCH/COUNT). */\n  readOnlyHint?: boolean;\n  /** True when the operation may destroy/irreversibly mutate data (DELETE, or HIGH/CRITICAL risk). */\n  destructiveHint?: boolean;\n  /**\n   * True when repeating the call with the same arguments has no ADDITIONAL effect.\n   *\n   * \"(This property is meaningful only when `readOnlyHint == false`)\" and its default is `false`, so\n   * it is emitted ONLY for write operations — advertising it on a read tool would state something\n   * the specification defines as meaningless there.\n   * spec-cite: MCP schema — `ToolAnnotations.idempotentHint`\n   */\n  idempotentHint?: boolean;\n  /**\n   * True when the tool may reach an \"open world\" of external entities.\n   *\n   * **Its default is `true`**, which is why omitting it was not neutral: every tool this server\n   * exposed was advertised as potentially reaching arbitrary external systems. A Wildo tool operates\n   * on this application's OWN resources through its own authorization — a closed domain — so the\n   * honest value is `false`, and it is the difference between an agent treating a tool call as a\n   * local state change and treating it as a call out to the internet.\n   * spec-cite: MCP schema — `ToolAnnotations.openWorldHint` (\"If false, the tool's domain of\n   * interaction is closed. For example, the world of a web search tool is open, whereas that of a\n   * memory tool is not.\")\n   */\n  openWorldHint?: boolean;\n}\n\n/**\n * A single MCP tool descriptor as returned by `tools/list`. `inputSchema` is a\n * JSON Schema object derived from the operation `requestDto`.\n */\nexport interface McpToolDescriptor {\n  /** `<resourceIdentifier>__<operationIdentifier>` — unique per exposed default operation. */\n  name: string;\n  /** Agent-facing prose. Spec-sourced when a description provider is supplied, else synthesized. */\n  description: string;\n  /** JSON Schema object for the tool arguments (empty-object schema when the op takes no body). */\n  inputSchema: Record<string, unknown>;\n  /** Advisory behavioural hints (read-only / destructive). */\n  annotations?: McpToolAnnotations;\n  /**\n   * The resource type this tool maps to — retained so `callTool` can re-resolve\n   * the operation without re-parsing the name. NOT part of the wire `tools/list`\n   * payload (strip before serialising if a transport is added).\n   */\n  resourceType: ResourceType;\n  /** The operation identifier this tool maps to (core or custom). */\n  operationIdentifier: string;\n}\n\n/**\n * Resolves agent-facing description prose for one operation.\n *\n * # Why this is INJECTED rather than read from the spec layer directly\n *\n * The MCP child plan says tool descriptions source from the SPEC layer\n * (`ResourceOperationSpecification.purpose` / `whenToUse`). But\n * `@wildo-ai/saas-specifications` is DOWNSTREAM of `saas-backend-lib` in the\n * engine dependency graph — the backend cannot import specs without inverting the\n * layering. So the adapter accepts this provider and the caller (the app /\n * companion, which DOES have spec access) supplies spec-sourced prose. When no\n * provider is given, the adapter synthesizes a description from the operation's\n * own config metadata.\n *\n * The D4 config-local description field (`operation.mcp.description`, a dedicated\n * agent-facing slot on the operation config) has SHIPPED, and the adapter reads it\n * directly with top priority (see `McpToolAdapterBackendService.resolveDescription`).\n * This provider is therefore optional enrichment, consulted only when no authored\n * `mcp.description` is present.\n *\n * @returns the spec prose for the operation, or `undefined` to fall back to synthesis.\n */\nexport type McpToolDescriptionProvider = (\n  resourceType: ResourceType,\n  operationIdentifier: string,\n) => { purpose?: string; whenToUse?: string } | undefined;\n\n/**\n * Options for building the exposed tool descriptor set.\n */\nexport interface McpToolAdapterBuildOptions {\n  /**\n   * Optional narrowing allow-list of resource types to enumerate. When omitted,\n   * ALL registered ORGANIZATION/APPLICATION-scoped resources are considered.\n   *\n   * This is a coarse convenience filter, NOT the exposure gate: exposure is\n   * already fail-closed per-operation via `operation.mcp.exposed === true` (D4,\n   * shipped), so the default (no allow-list) never over-exposes — only operations\n   * that explicitly opt in become tools. Pass this only to further restrict the set.\n   */\n  resourceTypes?: ResourceType[];\n  /** Spec-sourced description provider (see {@link McpToolDescriptionProvider}). */\n  descriptionProvider?: McpToolDescriptionProvider;\n  /**\n   * The resource primary scopes the CALLER can reach (progressive principal-awareness). Omit → the\n   * default machine-reachable set (ORG / APP), which is the MACHINE principal's set. An ANONYMOUS\n   * caller is NOT a machine and reaches nothing; the transport challenges it rather than listing.\n   * A user-delegated caller passes the delegated set (adds `USER_SELF`) so their USER_SELF tools are\n   * advertised. Derived from the SAME source `callTool`'s exposability gate uses\n   * (`mcpReachableScopesForPrincipal`), so advertise ≡ callable per principal.\n   */\n  reachableScopes?: ReadonlySet<ResourcePrimaryScope>;\n  /**\n   * The NAMED MCP server instance being served (R-2), or omitted for the DEFAULT `/mcp` server.\n   * Filters the catalog to the operations that belong to that instance (`operation.mcp.servers`),\n   * composed with the scope + opt-in filters. Membership is exclusive: an operation with no declared\n   * `servers` appears ONLY on the default server, and one with declared servers ONLY on those.\n   */\n  instanceRef?: string;\n}\n"]}
+{"version":3,"file":"mcp-tool.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/mcp/models/mcp-tool.backend.schemas.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,gCAAgC,GAAG,mBAAmB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;AAE7D,mGAAmG;AACnG,MAAM,UAAU,iCAAiC,CAAC,yBAAiC,EAAE,iBAAyB;IAC5G,OAAO,GAAG,yBAAyB,GAAG,4BAA4B,GAAG,iBAAiB,EAAE,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAAC,aAAqB;IACrE,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC/D,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,yBAAyB,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACxF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAAE,OAAO,SAAS,CAAC;IACjH,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC;WACjB,IAAI,CAAC,MAAM,IAAI,wBAAwB;WACvC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC","sourcesContent":["import { ResourceType, ResourcePrimaryScope } from '@wildo-ai/saas-models';\n\n/**\n * Tool-name separator between the resource identifier and the operation\n * identifier: `<resourceIdentifier>__<operationIdentifier>` (e.g. `todos__create`).\n *\n * A DOUBLE underscore is used deliberately: resource identifiers themselves can\n * contain single underscores (`organization_members`), so a single-underscore\n * separator would be ambiguous. The double underscore is the first-slice identity\n * scheme; a `variantKey` suffix (`<resource>__<operation>__<variantKey>`) is a\n * follow-up once non-default variants are exposed (see the MCP child plan).\n */\nexport const MCP_TOOL_NAME_SEPARATOR = '__';\n\n/**\n * Upper bound on a tool name, from the naming guidance `2025-11-25` added (SEP-986).\n *\n * \"Tool names SHOULD be between 1 and 128 characters in length (inclusive).\"\n * spec-cite: MCP 2025-11-25 — Tools § Data Types → Tool Names\n */\nexport const MCP_TOOL_NAME_MAX_LENGTH = 128;\n\n/**\n * The character set the same section allows.\n *\n * \"The following SHOULD be the only allowed characters: uppercase and lowercase ASCII letters (A-Z,\n *  a-z), digits (0-9), underscore (_), hyphen (-), and dot (.)\"\n * spec-cite: MCP 2025-11-25 — Tools § Data Types → Tool Names\n */\nconst MCP_TOOL_NAME_ALLOWED_CHARACTERS = /^[A-Za-z0-9_.-]+$/;\n\n/**\n * Does this tool name satisfy the `2025-11-25` naming guidance?\n *\n * # Why a server-side gate for a SHOULD\n *\n * A tool name here is `<resourceIdentifier>__<operationIdentifier>`, and BOTH halves are authored by\n * the application, not by the engine. Nothing else constrains them: a resource identifier is a\n * TypeScript string and a custom operation identifier is whatever its author typed. So the guidance\n * binds an app developer who has never read it, through a name they did not know they were composing.\n *\n * The failure it prevents is not local. A name is not rejected by the tool that carries it — it is\n * carried inside a `tools/list` RESULT, so a client strict about the guidance can reject the whole\n * CATALOGUE, and every other tool in the application disappears with it. Refusing the one bad\n * descriptor is therefore the smaller failure by a wide margin, and it names the offender in a log\n * line instead of leaving an app developer to explain why one client sees no tools at all.\n *\n * Measured before choosing fail-closed: every tool name this repository actually produces matches\n * `[A-Za-z0-9_]+__[A-Za-z0-9_]+` (todos__create, user_preferences__read, todos__recent_todos, …), so\n * the gate withdraws nothing that exists today. It is a guard against a future name, not a migration.\n *\n * Uniqueness — the fourth SHOULD in that section — is enforced elsewhere and deliberately not\n * re-checked here: `buildResourceToolDescriptors` already de-dupes by name within a resource, and\n * the `__`-in-resource-identifier guard keeps names from colliding across resources.\n */\n/**\n * The DERIVED upload-grant tool (issue #312, D11).\n *\n * For every exposed default CREATE / UPDATE operation whose request carries a user-uploadable file\n * field, the catalogue also advertises `<resource>__<operation>.upload_grant.<fieldSegment>`, e.g.\n * `todos__create.upload_grant.attachments`. Calling it mints a single-use upload grant for that field\n * (see `FileUploadGrantBackendService`); it never carries bytes.\n *\n * ## Why dots\n *\n * `parseToolName` splits on the FIRST `__`, so everything after it is the \"operation\". Operation\n * identifiers are snake_case and never contain `.`, while the naming guidance allows `.` — so a dotted\n * suffix is unambiguous, cannot collide with an authored custom operation, and needs no second\n * separator. Rejected: `_upload_grant_` (collides with a legitimately named custom operation, and\n * refusing that operation would make the wrong party pay) and a standalone `files__…` tool taking the\n * resource in its arguments (would have to re-implement the parent's exposure / instance / scope\n * gating instead of inheriting it).\n *\n * The field segment is the SAME kebab-case segment the upload ROUTE uses (`…/files/<segment>`), so a\n * tool name and its route agree by construction; resolution maps the segment back by recomputing it\n * over the resource's uploadable fields rather than by inverting the transform.\n */\nexport const MCP_UPLOAD_GRANT_TOOL_MARKER = '.upload_grant.';\n\n/** `<parentOperation>.upload_grant.<fieldSegment>` — the operation part of a derived tool name. */\nexport function buildUploadGrantToolOperationPart(parentOperationIdentifier: string, fieldRouteSegment: string): string {\n  return `${parentOperationIdentifier}${MCP_UPLOAD_GRANT_TOOL_MARKER}${fieldRouteSegment}`;\n}\n\n/**\n * Split the operation part of a derived tool name, or `undefined` when it is not one. Strict on shape:\n * exactly one marker, a non-empty snake_case parent and a non-empty kebab-case segment — anything\n * else is an ordinary (possibly custom) operation identifier and is left to the ordinary resolver.\n */\nexport function parseUploadGrantToolOperationPart(operationPart: string): { parentOperationIdentifier: string; fieldRouteSegment: string } | undefined {\n  const at = operationPart.indexOf(MCP_UPLOAD_GRANT_TOOL_MARKER);\n  if (at <= 0) return undefined;\n  const parentOperationIdentifier = operationPart.slice(0, at);\n  const fieldRouteSegment = operationPart.slice(at + MCP_UPLOAD_GRANT_TOOL_MARKER.length);\n  if (!/^[a-z0-9_]+$/.test(parentOperationIdentifier) || !/^[a-z0-9-]+$/.test(fieldRouteSegment)) return undefined;\n  return { parentOperationIdentifier, fieldRouteSegment };\n}\n\nexport function isSpecConformantMcpToolName(name: string): boolean {\n  return name.length > 0\n    && name.length <= MCP_TOOL_NAME_MAX_LENGTH\n    && MCP_TOOL_NAME_ALLOWED_CHARACTERS.test(name);\n}\n\n/**\n * Agent-facing behavioural hints on a tool, mirroring the MCP `ToolAnnotations`\n * shape. Advisory only — they never affect authorization (which is always\n * re-checked at `callTool` time). Derived from the operation's core identifier +\n * `riskLevel`.\n */\nexport interface McpToolAnnotations {\n  /** Human-readable title for display surfaces. */\n  title?: string;\n  /** True when the operation only reads (READ/LIST/SEARCH/COUNT). */\n  readOnlyHint?: boolean;\n  /** True when the operation may destroy/irreversibly mutate data (DELETE, or HIGH/CRITICAL risk). */\n  destructiveHint?: boolean;\n  /**\n   * True when repeating the call with the same arguments has no ADDITIONAL effect.\n   *\n   * \"(This property is meaningful only when `readOnlyHint == false`)\" and its default is `false`, so\n   * it is emitted ONLY for write operations — advertising it on a read tool would state something\n   * the specification defines as meaningless there.\n   * spec-cite: MCP schema — `ToolAnnotations.idempotentHint`\n   */\n  idempotentHint?: boolean;\n  /**\n   * True when the tool may reach an \"open world\" of external entities.\n   *\n   * **Its default is `true`**, which is why omitting it was not neutral: every tool this server\n   * exposed was advertised as potentially reaching arbitrary external systems. A Wildo tool operates\n   * on this application's OWN resources through its own authorization — a closed domain — so the\n   * honest value is `false`, and it is the difference between an agent treating a tool call as a\n   * local state change and treating it as a call out to the internet.\n   * spec-cite: MCP schema — `ToolAnnotations.openWorldHint` (\"If false, the tool's domain of\n   * interaction is closed. For example, the world of a web search tool is open, whereas that of a\n   * memory tool is not.\")\n   */\n  openWorldHint?: boolean;\n}\n\n/**\n * A single MCP tool descriptor as returned by `tools/list`. `inputSchema` is a\n * JSON Schema object derived from the operation `requestDto`.\n */\nexport interface McpToolDescriptor {\n  /** `<resourceIdentifier>__<operationIdentifier>` — unique per exposed default operation. */\n  name: string;\n  /** Agent-facing prose. Spec-sourced when a description provider is supplied, else synthesized. */\n  description: string;\n  /** JSON Schema object for the tool arguments (empty-object schema when the op takes no body). */\n  inputSchema: Record<string, unknown>;\n  /** Advisory behavioural hints (read-only / destructive). */\n  annotations?: McpToolAnnotations;\n  /**\n   * The resource type this tool maps to — retained so `callTool` can re-resolve\n   * the operation without re-parsing the name. NOT part of the wire `tools/list`\n   * payload (strip before serialising if a transport is added).\n   */\n  resourceType: ResourceType;\n  /** The operation identifier this tool maps to (core or custom). */\n  operationIdentifier: string;\n}\n\n/**\n * Resolves agent-facing description prose for one operation.\n *\n * # Why this is INJECTED rather than read from the spec layer directly\n *\n * The MCP child plan says tool descriptions source from the SPEC layer\n * (`ResourceOperationSpecification.purpose` / `whenToUse`). But\n * `@wildo-ai/saas-specifications` is DOWNSTREAM of `saas-backend-lib` in the\n * engine dependency graph — the backend cannot import specs without inverting the\n * layering. So the adapter accepts this provider and the caller (the app /\n * companion, which DOES have spec access) supplies spec-sourced prose. When no\n * provider is given, the adapter synthesizes a description from the operation's\n * own config metadata.\n *\n * The D4 config-local description field (`operation.mcp.description`, a dedicated\n * agent-facing slot on the operation config) has SHIPPED, and the adapter reads it\n * directly with top priority (see `McpToolAdapterBackendService.resolveDescription`).\n * This provider is therefore optional enrichment, consulted only when no authored\n * `mcp.description` is present.\n *\n * @returns the spec prose for the operation, or `undefined` to fall back to synthesis.\n */\nexport type McpToolDescriptionProvider = (\n  resourceType: ResourceType,\n  operationIdentifier: string,\n) => { purpose?: string; whenToUse?: string } | undefined;\n\n/**\n * Options for building the exposed tool descriptor set.\n */\nexport interface McpToolAdapterBuildOptions {\n  /**\n   * Optional narrowing allow-list of resource types to enumerate. When omitted,\n   * ALL registered ORGANIZATION/APPLICATION-scoped resources are considered.\n   *\n   * This is a coarse convenience filter, NOT the exposure gate: exposure is\n   * already fail-closed per-operation via `operation.mcp.exposed === true` (D4,\n   * shipped), so the default (no allow-list) never over-exposes — only operations\n   * that explicitly opt in become tools. Pass this only to further restrict the set.\n   */\n  resourceTypes?: ResourceType[];\n  /** Spec-sourced description provider (see {@link McpToolDescriptionProvider}). */\n  descriptionProvider?: McpToolDescriptionProvider;\n  /**\n   * The resource primary scopes the CALLER can reach (progressive principal-awareness). Omit → the\n   * default machine-reachable set (ORG / APP), which is the MACHINE principal's set. An ANONYMOUS\n   * caller is NOT a machine and reaches nothing; the transport challenges it rather than listing.\n   * A user-delegated caller passes the delegated set (adds `USER_SELF`) so their USER_SELF tools are\n   * advertised. Derived from the SAME source `callTool`'s exposability gate uses\n   * (`mcpReachableScopesForPrincipal`), so advertise ≡ callable per principal.\n   */\n  reachableScopes?: ReadonlySet<ResourcePrimaryScope>;\n  /**\n   * The NAMED MCP server instance being served (R-2), or omitted for the DEFAULT `/mcp` server.\n   * Filters the catalog to the operations that belong to that instance (`operation.mcp.servers`),\n   * composed with the scope + opt-in filters. Membership is exclusive: an operation with no declared\n   * `servers` appears ONLY on the default server, and one with declared servers ONLY on those.\n   */\n  instanceRef?: string;\n}\n"]}

package/dist/esm/mcp/services/mcp-server.backend.service.d.ts

@@ -1,9 +1,12 @@
+import { FileUploadGrantBackendService } from '../../files/services/file-upload-grant.backend.service';
+import { AppConfigurationService } from '../../config/services/app-configuration.backend.service';
 import type { LoggerService } from '../../monitoring/logger/services/logger.service';
 import { ErrorBuilderBackendService } from '../../errors/services/error-builder.backend.service';
 import { ExecutionContext } from '../../runtime/models/execution-context.backend.schemas';
 import { AuthorizationsBackendService } from '../../security/authorizations/services/authorizations.backend.service';
 import { ServicesRegistryHandlerBackendService } from '../../base-classes/services/services/services-registry-handler.backend.service';
 import { ResourcesRegistryBackendService } from '../../resources/services/resources-registry.backend.service';
+import { RateLimitBackendService } from '../../errors/services/rate-limit.backend.service';
 import { McpToolAdapterBackendService } from '../../mcp/services/mcp-tool-adapter.backend.service';
 import { McpToolDescriptor, McpToolAdapterBuildOptions } from '../../mcp/models/mcp-tool.backend.schemas';
 /**
@@ -42,8 +45,11 @@ export declare class McpServerBackendService {
     protected readonly authorizer: AuthorizationsBackendService;
     protected readonly servicesHandler: ServicesRegistryHandlerBackendService;
     protected readonly resourcesRegistry: ResourcesRegistryBackendService;
+    protected readonly fileUploadGrantService: FileUploadGrantBackendService;
+    protected readonly appConfigService: AppConfigurationService;
+    protected readonly rateLimitService: RateLimitBackendService;
     protected logDebug: (message: string, context?: Record<string, unknown>) => void;
-    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, toolAdapter: McpToolAdapterBackendService, authorizer: AuthorizationsBackendService, servicesHandler: ServicesRegistryHandlerBackendService, resourcesRegistry: ResourcesRegistryBackendService);
+    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, toolAdapter: McpToolAdapterBackendService, authorizer: AuthorizationsBackendService, servicesHandler: ServicesRegistryHandlerBackendService, resourcesRegistry: ResourcesRegistryBackendService, fileUploadGrantService: FileUploadGrantBackendService, appConfigService: AppConfigurationService, rateLimitService: RateLimitBackendService);
     /**
      * Return the exposed tool descriptors for the caller's reachable scopes (`options.reachableScopes`).
      * PROGRESSIVE principal-awareness (C): a caller presenting a valid Bearer bound to this endpoint
@@ -65,6 +71,83 @@ export declare class McpServerBackendService {
      * @throws NOT_FOUND when the tool name does not map to an exposable operation.
      */
     callTool(toolName: string, args: unknown, executionContext: ExecutionContext<any>, options?: McpCallToolOptions): Promise<McpCallToolResult>;
+    /**
+     * Enforce the resolved operation's OWN `rateLimit?` policy on the tool plane.
+     *
+     * ## What was broken
+     *
+     * `rateLimit?` is authored on an `API_CALL` / `API_CALL_WITH_CALLBACK` variant and was enforced
+     * by exactly one consumer — `RateLimitBackendService.checkPolicyForVariant`, called from the
+     * resource controller's HTTP pre-flight. `callTool` dispatches the SAME operation through the
+     * SAME service pipeline while bypassing Express entirely, so the identical operation was
+     * throttled over REST and unthrottled as a tool. An application that declared a budget on an
+     * endpoint got one; an agent asked for the same endpoint by its tool name and got none.
+     *
+     * ## Subject: the CREDENTIAL, not the IP and not the tenant
+     *
+     * See {@link resolveDeclaredPolicySubjectKey} for the full argument. In short: the HTTP seam
+     * keys on the source IP because at its pre-flight moment no identity exists yet, so `5/min` has
+     * always meant "5/min per CLIENT". On this plane the client is the credential the agent
+     * presented — a server-verified field of the execution context, never anything the model
+     * supplied. Keying on the tenant instead would make the same authored number several times
+     * stricter here than over REST for any tenant running more than one agent.
+     *
+     * ## Scope: a SEPARATE bucket from the REST route, deliberately
+     *
+     * The key is namespaced `mcp:resource:<resource>:<operation>` rather than sharing the HTTP
+     * seam's `resource:<resource>:<operation>`. Sharing would be incoherent — the two seams count
+     * different SUBJECTS (an IP and a credential), so one bucket would mix two identity spaces and
+     * let a browser's traffic spend an agent's budget. Per-plane-per-client is the faithful
+     * extension of a policy that was already per-client rather than a global cap.
+     *
+     * ## Not applied to the derived upload-grant tool
+     *
+     * `callUploadGrantTool` MINTS a grant; it does not dispatch the parent operation. Charging the
+     * parent's budget there would spend two slots for one upload (mint + the upload itself, which
+     * traverses the real HTTP route and meets `checkPolicyForVariant`) while a REST client spends
+     * one — the declared number would mean something different depending on how the caller got the
+     * URL. It is left uncharged for that reason, not by omission.
+     *
+     * ## Postures
+     *
+     * - **No declared policy, or a non-HTTP variant** → no-op, zero Redis traffic. Mirrors
+     *   `checkPolicyForVariant`'s two early returns exactly; the variant guard is defensive, since
+     *   `resolveExposableOperation` only ever yields a URL-bearing default.
+     * - **Unkeyable subject** → not enforced, logged. Structurally unreachable: `callTool` is only
+     *   reached post-authentication, and `ExecutionContext`'s own constructor rejects an
+     *   authenticated principal carrying no identity field. It is not "unbounded" either — the
+     *   transport's blanket per-principal cap is the backstop, and it declines on exactly the same
+     *   input. Refusing a well-formed call here instead would invent an outage out of a branch that
+     *   cannot happen.
+     * - **Limiter outage** → propagates, as it does over HTTP for the same declared policy. An
+     *   authored budget must not quietly become "unlimited" on one plane while it is a 500 on the
+     *   other.
+     */
+    private assertOperationRateLimitPolicy;
+    /**
+     * Execute a derived upload-grant tool (issue #312, D11).
+     *
+     * Authorization is the PARENT's: the caller's context is bound to the parent operation and
+     * `authorizeInController` runs on it with the same `resourceId` the parent would take — so minting
+     * requires exactly the authority uploading would, which is the invariant the REST door gets from
+     * sharing the upload middleware. The upload URL is built from the parent's own route pattern with
+     * the parameters the context and the call supply, and the API origin comes from CONFIGURATION,
+     * never from a request header.
+     */
+    private callUploadGrantTool;
+    /** The tool arguments minus the resource's own id, which the transport already split out into `options.resourceId`. */
+    private withoutInstanceId;
+    /**
+     * The concrete upload-route PATH (mount prefix included) for one file field of the parent
+     * operation, from the parent's own route patterns — the same builder the resource controller used
+     * to REGISTER the route, so the grant's `uploadUrl` is a route that exists.
+     *
+     * A parent can carry several patterns (one per parent-resource combination); the one chosen is the
+     * first whose every `{param}` the call can supply: the resource's own id from `resourceId`, and scope
+     * / parent ids from the context's `initiatorIds`. Patterns are tried shortest first, so the
+     * primary-scope form wins over a nested FK form the MCP call cannot address anyway.
+     */
+    private resolveUploadRoutePath;
     /**
      * Split `<resourceIdentifier>__<operationIdentifier>` on the FIRST double
      * underscore. Resource identifiers use single underscores only, so the first

package/dist/esm/mcp/services/mcp-server.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/mcp/services/mcp-server.backend.service.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AAClI,OAAO,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AAGpJ,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EACL,4BAA4B,EAK7B,MAAM,kEAAkE,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAE3B,MAAM,wDAAwD,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AA0CD,qBACa,uBAAuB;IAIG,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa;IAC3B,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,0BAA0B;IAChE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,4BAA4B;IACrD,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,4BAA4B;IAClD,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,qCAAqC;IAChF,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,+BAA+B;IAR3H,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAGzB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7C,WAAW,EAAE,4BAA4B,EAClC,UAAU,EAAE,4BAA4B,EAC/B,eAAe,EAAE,qCAAqC,EAC7D,iBAAiB,EAAE,+BAA+B;IAM3H;;;;;;;OAOG;IACI,SAAS,CAAC,OAAO,GAAE,0BAA+B,GAAG,iBAAiB,EAAE;IAI/E;;;;;;;;;;OAUG;IACU,QAAQ,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC;IA8F7B;;;;OAIG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,OAAO,CAAC,mBAAmB;IAgD3B;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAIjC,OAAO,CAAC,aAAa;CAatB"}
+{"version":3,"file":"mcp-server.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/mcp/services/mcp-server.backend.service.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,6BAA6B,EAAE,MAAM,qEAAqE,CAAC;AACpH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AAClI,OAAO,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AAGpJ,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AAExG,OAAO,EACL,4BAA4B,EAK7B,MAAM,kEAAkE,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAE3B,MAAM,wDAAwD,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAoDD,qBACa,uBAAuB;IAIG,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa;IAC3B,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,0BAA0B;IAChE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,4BAA4B;IACrD,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,4BAA4B;IAClD,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,qCAAqC;IAChF,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,+BAA+B;IACtE,SAAS,CAAC,QAAQ,CAAC,sBAAsB,EAAE,6BAA6B;IAC9E,SAAS,CAAC,QAAQ,CAAC,gBAAgB,EAAE,uBAAuB;IACrD,SAAS,CAAC,QAAQ,CAAC,gBAAgB,EAAE,uBAAuB;IAXlH,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAGzB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7C,WAAW,EAAE,4BAA4B,EAClC,UAAU,EAAE,4BAA4B,EAC/B,eAAe,EAAE,qCAAqC,EAC7D,iBAAiB,EAAE,+BAA+B,EACnD,sBAAsB,EAAE,6BAA6B,EAC3D,gBAAgB,EAAE,uBAAuB,EAClC,gBAAgB,EAAE,uBAAuB;IAMlH;;;;;;;OAOG;IACI,SAAS,CAAC,OAAO,GAAE,0BAA+B,GAAG,iBAAiB,EAAE;IAI/E;;;;;;;;;;OAUG;IACU,QAAQ,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC;IA+G7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDG;YACW,8BAA8B;IAgC5C;;;;;;;;;OASG;YACW,mBAAmB;IA2DjC,uHAAuH;IACvH,OAAO,CAAC,iBAAiB;IAQzB;;;;;;;;;OASG;IACH,OAAO,CAAC,sBAAsB;IAuC9B;;;;OAIG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,OAAO,CAAC,mBAAmB;IAgD3B;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAIjC,OAAO,CAAC,aAAa;CAatB"}

package/dist/esm/mcp/services/mcp-server.backend.service.js

@@ -11,15 +11,20 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { injectable, inject } from 'inversify';
-import { ResourcesConfig_OperationPathUtils, CoreResourceOperation, ErrorType, ErrorCustomMessageReference, } from '@wildo-ai/saas-models';
+import { ResourceOperationVariantType, ResourcesConfig_OperationPathUtils, CoreResourceOperation, ErrorType, ErrorCustomMessageReference, BackendApiType, MAIN_API_BASE_PATH, FileUploadGrantMintRequestSchema, ResourcesConfigOperationsUrlsBuilderUtils, } from '@wildo-ai/saas-models';
 import { z } from 'zod';
 import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
+import { FileUploadGrantBackendService } from '../../files/services/file-upload-grant.backend.service.js';
+import { AppConfigurationService } from '../../config/services/app-configuration.backend.service.js';
+import { MCP_UPLOAD_GRANT_TOOL_MARKER } from '../../mcp/models/mcp-tool.backend.schemas.js';
 import { ErrorBuilderBackendService } from '../../errors/services/error-builder.backend.service.js';
 import { AuthorizationsBackendService } from '../../security/authorizations/services/authorizations.backend.service.js';
 import { ServicesRegistryHandlerBackendService } from '../../base-classes/services/services/services-registry-handler.backend.service.js';
 import { toResponseSafeToolOutput } from '../../base-classes/services/controllers/utils/operation-response-serializer.backend.utils.js';
 import { normalizeCollectionQueryRequestData } from '../../base-classes/services/controllers/controller-resource.backend.service.js';
 import { ResourcesRegistryBackendService } from '../../resources/services/resources-registry.backend.service.js';
+import { RateLimitBackendService } from '../../errors/services/rate-limit.backend.service.js';
+import { resolveDeclaredPolicySubjectKey } from '../../security/authentications/services/utils/external-turn-rate-limit.backend.utils.js';
 import { McpToolAdapterBackendService, mcpReachableScopesForPrincipal, mcpPrincipalForAuthenticatedCaller, resolveEffectiveMcpOperation, isCollectionQueryMcpOperation, } from '../../mcp/services/mcp-tool-adapter.backend.service.js';
 import { MCP_TOOL_NAME_SEPARATOR, } from '../../mcp/models/mcp-tool.backend.schemas.js';
 /**
@@ -34,14 +39,24 @@ import { MCP_TOOL_NAME_SEPARATOR, } from '../../mcp/models/mcp-tool.backend.sche
  *
  * - `listTools()` delegates to {@link McpToolAdapterBackendService}.
  * - `callTool()` resolves the target operation, RE-RUNS `authorizeInController`
- *   against the caller's execution context (fail-closed), then invokes the
- *   service pipeline DIRECTLY via {@link ServicesRegistryHandlerBackendService}
- *   (never re-HTTP). The service pipeline enforces `requiredFeatures` /
- *   `enabledCondition` downstream.
- * - KNOWN GAP (tracked — `.claude/plans/mcp-server-followups.md` Item 5): the
- *   per-route HTTP rate-limit middleware is bypassed on this direct dispatch path,
- *   so an operation's `rateLimit` policy is not yet enforced here. The planned fix
- *   is a per-principal quota shared with the A2A dispatch surface.
+ *   against the caller's execution context (fail-closed), enforces the operation's
+ *   own declared `rateLimit` policy (see `assertOperationRateLimitPolicy`), then
+ *   invokes the service pipeline DIRECTLY via
+ *   {@link ServicesRegistryHandlerBackendService} (never re-HTTP). The service
+ *   pipeline enforces `requiredFeatures` / `enabledCondition` downstream.
+ * - RATE LIMITING on this plane is now TWO guards, and they answer different questions:
+ *   the transport applies the framework's blanket per-principal `tools/call` cap
+ *   (`MCP_EXTERNAL_CALL_RATE_MAX`, an abuse throttle nobody declared, fails OPEN), and
+ *   THIS service applies the operation's own AUTHORED `rateLimit` (a statement the
+ *   application made about that endpoint, enforced identically to the HTTP seam). The
+ *   second one lives here rather than in the transport for the same reason
+ *   `authorizeInController` does: it is a property of the OPERATION, so a second
+ *   transport backed by this core must inherit it rather than re-implement it.
+ *   (Historical note: the block that stood here recorded the per-operation policy as a
+ *   KNOWN GAP whose "planned fix is a per-principal quota shared with the A2A dispatch
+ *   surface". That per-principal quota SHIPPED — `assertExternalTurnWithinRate`, used by
+ *   both `MCPControllerBackendService` and `A2ABackendService` — and the comment was
+ *   never updated, so it read as wholly open when only its per-operation half was.)
  * - Server-initiated streaming (SSE / notifications / progress) is intentionally
  *   absent: every exposed operation is synchronous request/response, for which a
  *   single JSON response is Streamable-HTTP-compliant (Item 1, deferred).
@@ -68,14 +83,20 @@ let McpServerBackendService = class McpServerBackendService {
     authorizer;
     servicesHandler;
     resourcesRegistry;
+    fileUploadGrantService;
+    appConfigService;
+    rateLimitService;
     logDebug;
-    constructor(logger, errorBuilder, toolAdapter, authorizer, servicesHandler, resourcesRegistry) {
+    constructor(logger, errorBuilder, toolAdapter, authorizer, servicesHandler, resourcesRegistry, fileUploadGrantService, appConfigService, rateLimitService) {
         this.logger = logger;
         this.errorBuilder = errorBuilder;
         this.toolAdapter = toolAdapter;
         this.authorizer = authorizer;
         this.servicesHandler = servicesHandler;
         this.resourcesRegistry = resourcesRegistry;
+        this.fileUploadGrantService = fileUploadGrantService;
+        this.appConfigService = appConfigService;
+        this.rateLimitService = rateLimitService;
         this.logDebug = this.logger.debugByType('McpServerBackendService');
         this.logger.setDebugTypeLogging('McpServerBackendService', false);
     }
@@ -113,6 +134,12 @@ let McpServerBackendService = class McpServerBackendService {
         // decide callability — the same pair `tools/list` filters on.
         // Post-authentication by construction: `callTool` is only reached with a validated token.
         const reachableScopes = mcpReachableScopesForPrincipal(mcpPrincipalForAuthenticatedCaller(executionContext.isUserExecution()));
+        // Issue #312, D11: a DERIVED upload-grant tool mints a grant instead of dispatching an operation.
+        // It resolves its PARENT through the same adapter gate (exposure, instance, scope inherited), is
+        // authorized exactly as the parent would be, then calls the ONE mint function the REST door calls.
+        if (operationIdentifier.includes(MCP_UPLOAD_GRANT_TOOL_MARKER)) {
+            return this.callUploadGrantTool(toolName, resourceType, operationIdentifier, args, executionContext, options, reachableScopes);
+        }
         const operation = this.toolAdapter.resolveExposableOperation(resourceType, operationIdentifier, reachableScopes, options.instanceRef);
         if (!operation) {
             throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {
@@ -128,6 +155,14 @@ let McpServerBackendService = class McpServerBackendService {
         // Fail-closed per-operation authorization: reads `operation.roles` +
         // `executionContext.initiatorRoles` / scope. Throws AUTHORIZATION on denial.
         await this.authorizer.authorizeInController(idOrIds, boundExecutionContext);
+        // The operation's OWN declared request budget. AFTER authorization on purpose: a caller who may
+        // not run the operation at all must be refused with AUTHORIZATION rather than told how much of a
+        // budget they have — and must not consume a slot of a budget that is not theirs, which would let
+        // an unauthorized caller exhaust an authorized one's quota. (The HTTP seam orders these the other
+        // way round because it has no choice: `checkPolicyForVariant` runs pre-flight, before the
+        // execution context that authorization needs even exists. Here the identity is already resolved,
+        // so the safer order is available and is taken.)
+        await this.assertOperationRateLimitPolicy(operation, boundExecutionContext);
         // Dispatch to the service layer directly (NOT re-HTTP). The service pipeline
         // enforces enabledCondition / requiredFeatures downstream.
         //
@@ -177,6 +212,189 @@ let McpServerBackendService = class McpServerBackendService {
         const safeResult = await toResponseSafeToolOutput(operation, result);
         return { toolName, result: safeResult };
     }
+    /**
+     * Enforce the resolved operation's OWN `rateLimit?` policy on the tool plane.
+     *
+     * ## What was broken
+     *
+     * `rateLimit?` is authored on an `API_CALL` / `API_CALL_WITH_CALLBACK` variant and was enforced
+     * by exactly one consumer — `RateLimitBackendService.checkPolicyForVariant`, called from the
+     * resource controller's HTTP pre-flight. `callTool` dispatches the SAME operation through the
+     * SAME service pipeline while bypassing Express entirely, so the identical operation was
+     * throttled over REST and unthrottled as a tool. An application that declared a budget on an
+     * endpoint got one; an agent asked for the same endpoint by its tool name and got none.
+     *
+     * ## Subject: the CREDENTIAL, not the IP and not the tenant
+     *
+     * See {@link resolveDeclaredPolicySubjectKey} for the full argument. In short: the HTTP seam
+     * keys on the source IP because at its pre-flight moment no identity exists yet, so `5/min` has
+     * always meant "5/min per CLIENT". On this plane the client is the credential the agent
+     * presented — a server-verified field of the execution context, never anything the model
+     * supplied. Keying on the tenant instead would make the same authored number several times
+     * stricter here than over REST for any tenant running more than one agent.
+     *
+     * ## Scope: a SEPARATE bucket from the REST route, deliberately
+     *
+     * The key is namespaced `mcp:resource:<resource>:<operation>` rather than sharing the HTTP
+     * seam's `resource:<resource>:<operation>`. Sharing would be incoherent — the two seams count
+     * different SUBJECTS (an IP and a credential), so one bucket would mix two identity spaces and
+     * let a browser's traffic spend an agent's budget. Per-plane-per-client is the faithful
+     * extension of a policy that was already per-client rather than a global cap.
+     *
+     * ## Not applied to the derived upload-grant tool
+     *
+     * `callUploadGrantTool` MINTS a grant; it does not dispatch the parent operation. Charging the
+     * parent's budget there would spend two slots for one upload (mint + the upload itself, which
+     * traverses the real HTTP route and meets `checkPolicyForVariant`) while a REST client spends
+     * one — the declared number would mean something different depending on how the caller got the
+     * URL. It is left uncharged for that reason, not by omission.
+     *
+     * ## Postures
+     *
+     * - **No declared policy, or a non-HTTP variant** → no-op, zero Redis traffic. Mirrors
+     *   `checkPolicyForVariant`'s two early returns exactly; the variant guard is defensive, since
+     *   `resolveExposableOperation` only ever yields a URL-bearing default.
+     * - **Unkeyable subject** → not enforced, logged. Structurally unreachable: `callTool` is only
+     *   reached post-authentication, and `ExecutionContext`'s own constructor rejects an
+     *   authenticated principal carrying no identity field. It is not "unbounded" either — the
+     *   transport's blanket per-principal cap is the backstop, and it declines on exactly the same
+     *   input. Refusing a well-formed call here instead would invent an outage out of a branch that
+     *   cannot happen.
+     * - **Limiter outage** → propagates, as it does over HTTP for the same declared policy. An
+     *   authored budget must not quietly become "unlimited" on one plane while it is a 500 on the
+     *   other.
+     */
+    async assertOperationRateLimitPolicy(operation, boundExecutionContext) {
+        if (operation.variantType !== ResourceOperationVariantType.API_CALL
+            && operation.variantType !== ResourceOperationVariantType.API_CALL_WITH_CALLBACK) {
+            return;
+        }
+        const policy = operation.rateLimit;
+        if (!policy) {
+            return;
+        }
+        const subjectKey = resolveDeclaredPolicySubjectKey(boundExecutionContext.initiatorIds);
+        if (!subjectKey) {
+            this.logger.warn('[mcp] declared rateLimit not enforced — the authenticated caller carries no keyable identity', {
+                resourceIdentifier: String(operation.resourceIdentifier),
+                operationIdentifier: String(operation.operationIdentifier),
+            });
+            return;
+        }
+        await this.rateLimitService.checkPolicyForSubject(policy, `mcp:resource:${String(operation.resourceIdentifier)}:${String(operation.operationIdentifier)}`, subjectKey, boundExecutionContext.organizationId);
+    }
+    /**
+     * Execute a derived upload-grant tool (issue #312, D11).
+     *
+     * Authorization is the PARENT's: the caller's context is bound to the parent operation and
+     * `authorizeInController` runs on it with the same `resourceId` the parent would take — so minting
+     * requires exactly the authority uploading would, which is the invariant the REST door gets from
+     * sharing the upload middleware. The upload URL is built from the parent's own route pattern with
+     * the parameters the context and the call supply, and the API origin comes from CONFIGURATION,
+     * never from a request header.
+     */
+    async callUploadGrantTool(toolName, resourceType, operationPart, args, executionContext, options, reachableScopes) {
+        const derived = this.toolAdapter.resolveUploadGrantTool(resourceType, operationPart, reachableScopes, options.instanceRef);
+        if (!derived) {
+            throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.SERVICE_NOT_FOUND,
+                context: { message: `MCP tool "${toolName}" does not map to an exposable upload-grant tool`, toolName },
+            });
+        }
+        const { parentOperation, fieldName, operationKind } = derived;
+        const boundExecutionContext = executionContext.withOperation(parentOperation);
+        const resourceId = options.resourceId;
+        if (operationKind === CoreResourceOperation.UPDATE && !resourceId) {
+            throw this.errorBuilder.buildError(ErrorType.VALIDATION, boundExecutionContext, {
+                customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                context: { message: 'An upload grant for an UPDATE requires the record id', toolName },
+            });
+        }
+        // Same gate, same order, same arguments as the parent operation.
+        await this.authorizer.authorizeInController(resourceId, boundExecutionContext);
+        const parsedArgs = FileUploadGrantMintRequestSchema.safeParse(this.withoutInstanceId(args, resourceType));
+        if (!parsedArgs.success) {
+            throw this.errorBuilder.buildError(ErrorType.VALIDATION, boundExecutionContext, {
+                customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                context: { toolName, errors: parsedArgs.error.issues.map((issue) => ({ path: issue.path.join('.'), message: issue.message })) },
+            });
+        }
+        const apiPublicUrl = this.appConfigService.config.runtime?.endPoints?.[BackendApiType.MAIN_BACKEND_API]?.publicUrl;
+        if (!apiPublicUrl) {
+            throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, boundExecutionContext, {
+                customMessageReference: ErrorCustomMessageReference.CONFIGURATION,
+                context: { message: `runtime.endPoints.${BackendApiType.MAIN_BACKEND_API}.publicUrl is required to mint a file upload grant` },
+            });
+        }
+        const origin = apiPublicUrl.replace(/\/+$/, '');
+        // Scope ids come from the CALLER's context: binding an operation onto a context never changes who is calling.
+        const uploadPath = this.resolveUploadRoutePath(parentOperation, resourceType, fieldName, operationKind, resourceId, executionContext);
+        const grant = await this.fileUploadGrantService.mint({
+            executionContext: boundExecutionContext,
+            target: { resourceType, fieldName, operation: operationKind, resourceId },
+            expiresInMinutes: parsedArgs.data.expiresInMinutes,
+            declared: { name: parsedArgs.data.name, mimeType: parsedArgs.data.mimeType, size: parsedArgs.data.size },
+            uploadUrl: `${origin}${uploadPath}`,
+            apiBaseUrl: `${origin}${MAIN_API_BASE_PATH}`,
+        });
+        this.logDebug('Executing MCP upload-grant tool call', { toolName, resourceType, fieldName, operationKind, hasResourceId: resourceId !== undefined });
+        return { toolName, result: grant };
+    }
+    /** The tool arguments minus the resource's own id, which the transport already split out into `options.resourceId`. */
+    withoutInstanceId(args, resourceType) {
+        if (!args || typeof args !== 'object')
+            return args ?? {};
+        const selfField = this.resourcesRegistry.getAllResourceFieldIdentifiers()[resourceType];
+        if (!selfField || !(selfField in args))
+            return args;
+        const { [selfField]: _dropped, ...rest } = args;
+        return rest;
+    }
+    /**
+     * The concrete upload-route PATH (mount prefix included) for one file field of the parent
+     * operation, from the parent's own route patterns — the same builder the resource controller used
+     * to REGISTER the route, so the grant's `uploadUrl` is a route that exists.
+     *
+     * A parent can carry several patterns (one per parent-resource combination); the one chosen is the
+     * first whose every `{param}` the call can supply: the resource's own id from `resourceId`, and scope
+     * / parent ids from the context's `initiatorIds`. Patterns are tried shortest first, so the
+     * primary-scope form wins over a nested FK form the MCP call cannot address anyway.
+     */
+    resolveUploadRoutePath(parentOperation, resourceType, fieldName, operationKind, resourceId, executionContext) {
+        const selfField = this.resourcesRegistry.getAllResourceFieldIdentifiers()[resourceType];
+        const initiatorInfos = [...(('initiatorInfos' in parentOperation ? parentOperation.initiatorInfos : undefined) ?? [])]
+            .sort((a, b) => (a.parameters?.length ?? 0) - (b.parameters?.length ?? 0));
+        const supplied = {
+            ...(executionContext.initiatorIds ?? {}),
+            ...(selfField && resourceId ? { [selfField]: resourceId } : {}),
+        };
+        for (const info of initiatorInfos) {
+            const route = ResourcesConfigOperationsUrlsBuilderUtils.buildFileUploadRouteForOperation({
+                operationRouteUrl: info.url,
+                operationParameters: info.parameters ?? [],
+                targetResourceType: resourceType,
+                targetResourceFieldIdentifier: selfField ?? 'id',
+                fieldName,
+                requiresTargetResourceId: operationKind === CoreResourceOperation.UPDATE,
+                isFrontend: false,
+            });
+            let unresolved = false;
+            const path = route.url.replace(/\{([^}]+)\}/g, (_m, param) => {
+                const value = supplied[param];
+                if (typeof value !== 'string' || value.length === 0) {
+                    unresolved = true;
+                    return `{${param}}`;
+                }
+                return encodeURIComponent(value);
+            });
+            if (!unresolved)
+                return path;
+        }
+        throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {
+            customMessageReference: ErrorCustomMessageReference.CONFIGURATION,
+            context: { message: 'No upload route of this operation can be addressed from the MCP call', resourceType, fieldName, operationKind, patterns: initiatorInfos.map((i) => i.url) },
+        });
+    }
     /**
      * Split `<resourceIdentifier>__<operationIdentifier>` on the FIRST double
      * underscore. Resource identifiers use single underscores only, so the first
@@ -276,11 +494,17 @@ McpServerBackendService = __decorate([
     __param(3, inject(SAAS_SERVICE_TYPES.AuthorizationsService)),
     __param(4, inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService)),
     __param(5, inject(SAAS_SERVICE_TYPES.ResourceRegistryService)),
+    __param(6, inject(SAAS_SERVICE_TYPES.FileUploadGrantService)),
+    __param(7, inject(SAAS_SERVICE_TYPES.AppConfigService)),
+    __param(8, inject(SAAS_SERVICE_TYPES.RateLimitBackendService)),
     __metadata("design:paramtypes", [Function, ErrorBuilderBackendService,
         McpToolAdapterBackendService,
         AuthorizationsBackendService,
         ServicesRegistryHandlerBackendService,
-        ResourcesRegistryBackendService])
+        ResourcesRegistryBackendService,
+        FileUploadGrantBackendService,
+        AppConfigurationService,
+        RateLimitBackendService])
 ], McpServerBackendService);
 export { McpServerBackendService };
 //# sourceMappingURL=mcp-server.backend.service.js.map