arc-1 1.6.0 → 1.7.0

package/dist/server/tool-auth.js

@@ -1,10 +1,11 @@
 import { getActionPolicy, hasRequiredScope } from '../authz/policy.js';
+import { pruneQueryDefinition } from '../handlers/query-tool.js';
 import { isActionDenied } from './deny-actions.js';
 /**
  * Prune a tool's action or type enum based on the user's scopes and the server deny list.
  * SAPRead uses `type`; action-bearing tools use `action`.
  */
-function pruneToolByPolicy(tool, scopes, denyActions) {
+function pruneToolByPolicy(tool, scopes, denyActions, queryAvailable) {
     const schema = tool.inputSchema;
     const properties = schema.properties ?? {};
     const enumField = tool.name === 'SAPRead' ? 'type' : 'action';
@@ -13,13 +14,20 @@ function pruneToolByPolicy(tool, scopes, denyActions) {
     if (!enumValues)
         return tool;
     const filtered = enumValues.filter((value) => {
+        if (tool.name === 'SAP' && value === 'query' && !queryAvailable)
+            return false;
         const policy = getActionPolicy(tool.name, value);
         if (!policy)
             return true;
         return hasRequiredScope(scopes, policy.scope) && !isActionDenied(tool.name, value, denyActions);
     });
-    return {
+    const pruned = {
         ...tool,
+        ...(tool.name === 'SAP'
+            ? {
+                description: tool.description.replace(`Actions: ${enumValues.join(', ')}.`, `Actions: ${filtered.join(', ')}.`),
+            }
+            : {}),
         inputSchema: {
             ...schema,
             properties: {
@@ -31,6 +39,7 @@ function pruneToolByPolicy(tool, scopes, denyActions) {
             },
         },
     };
+    return pruneQueryDefinition(pruned, filtered);
 }
 function hasNonEmptyActionOrTypeEnum(tool) {
     const schema = tool.inputSchema;
@@ -46,7 +55,18 @@ function hasNonEmptyActionOrTypeEnum(tool) {
  * actions/types is allowed. Its enum is then narrowed to the entries the caller can invoke, and
  * tools with an empty enum are removed.
  */
-export function filterToolsByAuthScope(tools, scopes, denyActions = []) {
+export function filterToolsByAuthScope(tools, scopes, denyActions = [], queryDefinition) {
+    // The universal query delegator has no single scope: its enabled concrete actions
+    // must also permit this caller. A missing configured definition fails closed.
+    const queryProperties = queryDefinition?.inputSchema.properties;
+    const queryActions = queryProperties?.action?.enum ?? [];
+    const queryAvailable = queryDefinition?.name === 'SAPQuery' &&
+        !isActionDenied('SAPQuery', undefined, denyActions) &&
+        queryActions.some((value) => {
+            const action = String(value);
+            const policy = getActionPolicy('SAPQuery', action);
+            return policy && hasRequiredScope(scopes, policy.scope) && !isActionDenied('SAPQuery', action, denyActions);
+        });
     return tools
         .filter((tool) => {
         if (isActionDenied(tool.name, undefined, denyActions))
@@ -69,7 +89,7 @@ export function filterToolsByAuthScope(tools, scopes, denyActions = []) {
         }
         return true;
     })
-        .map((tool) => pruneToolByPolicy(tool, scopes, denyActions))
+        .map((tool) => pruneToolByPolicy(tool, scopes, denyActions, queryAvailable))
         .filter(hasNonEmptyActionOrTypeEnum);
 }
 //# sourceMappingURL=tool-auth.js.map

package/dist/server/tool-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-auth.js","sourceRoot":"","sources":["../../src/server/tool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAoB,EAAE,MAAgB,EAAE,WAAqB;IACtF,MAAM,MAAM,GAAG,IAAI,CAAC,WAAsC,CAAC;IAC3D,MAAM,UAAU,GAAI,MAAM,CAAC,UAAkD,IAAI,EAAE,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,OAAO,GAAI,UAAU,CAAC,SAAS,CAAyC,IAAI,EAAE,CAAC;IACrF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjF,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,IAAI;QACP,WAAW,EAAE;YACX,GAAG,MAAM;YACT,UAAU,EAAE;gBACV,GAAG,UAAU;gBACb,CAAC,SAAS,CAAC,EAAE;oBACX,GAAG,OAAO;oBACV,IAAI,EAAE,QAAQ;iBACf;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAoB;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAsC,CAAC;IAC3D,MAAM,UAAU,GAAI,MAAM,CAAC,UAAkD,IAAI,EAAE,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,OAAO,GAAI,UAAU,CAAC,SAAS,CAAyC,IAAI,EAAE,CAAC;IACrF,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAuB,EACvB,MAAgB,EAChB,WAAW,GAAa,EAAE;IAE1B,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACf,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QAEpE,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,UAAU,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAsC,CAAC;YAC3D,MAAM,UAAU,GAAI,MAAM,CAAC,UAAkD,IAAI,EAAE,CAAC;YACpF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC9D,MAAM,OAAO,GAAI,UAAU,CAAC,SAAS,CAAyC,IAAI,EAAE,CAAC;YACrF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACjF,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YAE9B,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC3C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACjD,OAAO,MAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;YAC5G,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;SAC3D,MAAM,CAAC,2BAA2B,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"tool-auth.js","sourceRoot":"","sources":["../../src/server/tool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;GAGG;AACH,SAAS,iBAAiB,CACxB,IAAoB,EACpB,MAAgB,EAChB,WAAqB,EACrB,cAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAsC,CAAC;IAC3D,MAAM,UAAU,GAAI,MAAM,CAAC,UAAkD,IAAI,EAAE,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,OAAO,GAAI,UAAU,CAAC,SAAS,CAAyC,IAAI,EAAE,CAAC;IACrF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjF,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO,IAAI,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;QAC9E,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG;QACb,GAAG,IAAI;QACP,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK;YACrB,CAAC,CAAC;gBACE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CACnC,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACpC,YAAY,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,WAAW,EAAE;YACX,GAAG,MAAM;YACT,UAAU,EAAE;gBACV,GAAG,UAAU;gBACb,CAAC,SAAS,CAAC,EAAE;oBACX,GAAG,OAAO;oBACV,IAAI,EAAE,QAAQ;iBACf;aACF;SACF;KACF,CAAC;IACF,OAAO,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAoB;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAsC,CAAC;IAC3D,MAAM,UAAU,GAAI,MAAM,CAAC,UAAkD,IAAI,EAAE,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,OAAO,GAAI,UAAU,CAAC,SAAS,CAAyC,IAAI,EAAE,CAAC;IACrF,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAuB,EACvB,MAAgB,EAChB,WAAW,GAAa,EAAE,EAC1B,eAAgC;IAEhC,kFAAkF;IAClF,8EAA8E;IAC9E,MAAM,eAAe,GAAG,eAAe,EAAE,WAAW,CAAC,UAAiD,CAAC;IACvG,MAAM,YAAY,GAAI,eAAe,EAAE,MAA2C,EAAE,IAAI,IAAI,EAAE,CAAC;IAC/F,MAAM,cAAc,GAClB,eAAe,EAAE,IAAI,KAAK,UAAU;QACpC,CAAC,cAAc,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC;QACnD,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,OAAO,MAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9G,CAAC,CAAC,CAAC;IACL,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACf,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QAEpE,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,UAAU,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAsC,CAAC;YAC3D,MAAM,UAAU,GAAI,MAAM,CAAC,UAAkD,IAAI,EAAE,CAAC;YACpF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC9D,MAAM,OAAO,GAAI,UAAU,CAAC,SAAS,CAAyC,IAAI,EAAE,CAAC;YACrF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACjF,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YAE9B,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC3C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACjD,OAAO,MAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;YAC5G,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;SAC3E,MAAM,CAAC,2BAA2B,CAAC,CAAC;AACzC,CAAC"}

package/dist/version.d.ts

@@ -1,3 +1,3 @@
 /** Shared release-managed ARC-1 version. */
-export declare const VERSION = "1.6.0";
+export declare const VERSION = "1.7.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 /** Shared release-managed ARC-1 version. */
-export const VERSION = '1.6.0'; // x-release-please-version
+export const VERSION = '1.7.0'; // x-release-please-version
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arc-1",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "mcpName": "io.github.arc-mcp/arc-1",
   "description": "ARC-1 — MCP Server for SAP ABAP Systems",
   "author": "Marian Zeis",
@@ -72,6 +72,8 @@
     "format": "biome format --write .",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.scripts.json && tsc --noEmit -p tsconfig.tests.json",
     "validate:policy": "tsx scripts/validate-action-policy.ts",
+    "build:sea": "node scripts/build-sea.mjs",
+    "test:sea-smoke": "node scripts/ci/smoke-sea.mjs",
     "check:sizes": "node scripts/ci/check-file-sizes.mjs && tsx scripts/ci/check-tool-schema-budget.ts",
     "cli": "tsx src/cli.ts",
     "extract-sap-cookies": "tsx src/extract-sap-cookies.ts",
@@ -106,7 +108,7 @@
     "audit:ci": "audit-ci --config audit-ci.json"
   },
   "dependencies": {
-    "@abaplint/core": "^2.120.71",
+    "@abaplint/core": "^2.120.80",
     "@arc-mcp/xsuaa-auth": "^1.1.0",
     "@modelcontextprotocol/sdk": "^1.32.1",
     "@sap-cloud-sdk/connectivity": "^4.9.1",
@@ -117,19 +119,19 @@
     "commander": "^15.0.0",
     "cors": "2.8.6",
     "diff": "^9.0.0",
-    "dotenv": "^18.0.6",
-    "express": "^5.2.1",
+    "dotenv": "^18.0.8",
+    "express": "^5.3.0",
     "express-rate-limit": "^8.7.1",
     "fast-xml-parser": "^5.11.2",
     "helmet": "^8.3.0",
     "jose": "^6.2.12",
     "on-headers": "^1.1.0",
-    "rate-limiter-flexible": "^11.2.1",
-    "undici": "^8.11.2",
-    "zod": "^4.6.5"
+    "rate-limiter-flexible": "^11.2.2",
+    "undici": "^8.12.2",
+    "zod": "^4.6.7"
   },
   "overrides": {
-    "@hono/node-server": "2.0.10",
+    "@hono/node-server": "2.1.5",
     "esbuild": "^0.28.1",
     "form-data": "^4.0.6",
     "vite": "^8.0.16"
@@ -145,10 +147,12 @@
     "@types/node": "^22.20.5",
     "@types/on-headers": "^1.0.4",
     "@types/supertest": "^7.2.1",
-    "@vitest/coverage-v8": "^5.0.3",
+    "@vitest/coverage-v8": "^5.0.5",
     "audit-ci": "7.1.0",
+    "esbuild": "^0.28.1",
     "husky": "^9.1.7",
     "lint-staged": "^17.6.0",
+    "postject": "^1.0.0-alpha.6",
     "supertest": "^7.3.1",
     "tsx": "^4.23.15",
     "typescript": "~7.0.2",