libre-webui 0.25.0 → 0.26.0

package/backend/dist/services/toolGatewayService.js

@@ -0,0 +1,249 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The tool gateway: assembles a user's effective tool catalog for a turn and
+ * executes resolved calls. Execution always resolves through catalog
+ * entries — never by parsing model-supplied names against the database — so
+ * a call can only reach a server the actor could see when the turn started.
+ * Permissions are re-checked at execution time, results are bounded, and
+ * every call leaves a redacted audit event.
+ */
+import { getPersistence } from '../persistence/index.js';
+import { ResourcePolicyError } from '../utils/resourceLimits.js';
+import { ToolEgressError } from '../utils/toolEgress.js';
+import { authorize } from './authorizationService.js';
+import { effectiveBuiltinTools, executeBuiltinTool, } from './builtinToolsService.js';
+import { encryptionService } from './encryptionService.js';
+import { mcpCallTool, mcpInitialize, McpClientError, } from './mcpClientService.js';
+import { executeOpenApiTool } from './openApiToolService.js';
+import { recordAuditEvent } from './securityAuditService.js';
+import { actorCanUseServer, effectiveServerTools, getToolServer, listServerTools, resolveAuthHeaders, } from './toolServerService.js';
+const MAX_CONCURRENT_CALLS_PER_USER = 4;
+const activeCallsByUser = new Map();
+const MAX_SELECTION_ENTRIES = 64;
+const MAX_SELECTION_ID_LENGTH = 128;
+const sanitizeSelectionIds = (value) => {
+    if (!Array.isArray(value))
+        return undefined;
+    const ids = value
+        .filter((entry) => typeof entry === 'string' &&
+        entry.trim().length > 0 &&
+        entry.length <= MAX_SELECTION_ID_LENGTH)
+        .slice(0, MAX_SELECTION_ENTRIES);
+    return ids;
+};
+/** Parse an untrusted per-turn tool selection from a client request. */
+export const sanitizeRequestedToolSelection = (value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return undefined;
+    }
+    const record = value;
+    const builtinTools = sanitizeSelectionIds(record.builtinTools);
+    const serverIds = sanitizeSelectionIds(record.serverIds);
+    if (builtinTools === undefined && serverIds === undefined)
+        return undefined;
+    return {
+        ...(builtinTools !== undefined ? { builtinTools } : {}),
+        ...(serverIds !== undefined ? { serverIds } : {}),
+    };
+};
+/**
+ * Combine a profile binding with a per-turn request. Undefined means "no
+ * restriction"; when both restrict, only their intersection is offered, so a
+ * turn can narrow a profile's tools but never widen them.
+ */
+export const intersectToolSelection = (binding, requested) => {
+    if (binding === undefined)
+        return requested;
+    if (requested === undefined)
+        return binding;
+    const allowed = new Set(binding);
+    return requested.filter(id => allowed.has(id));
+};
+/** Whether this actor may use chat tools at all (the feature gate). */
+export async function actorCanUseTools(actor) {
+    const decision = await authorize(actor, 'use', {
+        type: 'feature',
+        id: 'tools',
+    });
+    return decision.allowed;
+}
+export async function buildToolCatalog(actor, context, selection = {}) {
+    const builtinContext = {
+        actor,
+        ...(context.sessionId ? { sessionId: context.sessionId } : {}),
+        ...(selection.skillIds ? { skillIds: selection.skillIds } : {}),
+        ...(selection.collectionIds
+            ? { collectionIds: selection.collectionIds }
+            : {}),
+    };
+    const [builtins, serverTools] = await Promise.all([
+        effectiveBuiltinTools(builtinContext, selection.builtinTools),
+        effectiveServerTools(actor, selection.serverIds),
+    ]);
+    const tools = [...builtins, ...serverTools];
+    const byName = new Map(tools.map(tool => [tool.name, tool]));
+    return { tools, byName, selection };
+}
+const parseArguments = (argumentsJson) => {
+    if (!argumentsJson.trim())
+        return {};
+    const parsed = JSON.parse(argumentsJson);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('Tool arguments must be a JSON object');
+    }
+    return parsed;
+};
+export async function executeToolCall(input) {
+    const { actor, tool } = input;
+    const active = activeCallsByUser.get(actor.userId) ?? 0;
+    if (active >= MAX_CONCURRENT_CALLS_PER_USER) {
+        return {
+            text: 'Too many concurrent tool calls; try again in a moment.',
+            isError: true,
+            truncated: false,
+        };
+    }
+    activeCallsByUser.set(actor.userId, active + 1);
+    let result;
+    try {
+        let args;
+        try {
+            args = parseArguments(input.argumentsJson);
+        }
+        catch (error) {
+            return {
+                text: `Invalid tool arguments: ${error instanceof Error ? error.message : 'not JSON'}`,
+                isError: true,
+                truncated: false,
+            };
+        }
+        if (tool.source === 'builtin') {
+            result = await executeBuiltinTool(tool.toolName, args, {
+                actor,
+                ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+                ...(input.signal ? { signal: input.signal } : {}),
+                ...(input.selection?.skillIds
+                    ? { skillIds: input.selection.skillIds }
+                    : {}),
+                ...(input.selection?.collectionIds
+                    ? { collectionIds: input.selection.collectionIds }
+                    : {}),
+            });
+        }
+        else {
+            const server = tool.serverId ? await getToolServer(tool.serverId) : null;
+            if (!server || !(await actorCanUseServer(actor, server))) {
+                result = {
+                    text: 'This tool server is no longer available to you.',
+                    isError: true,
+                    truncated: false,
+                };
+            }
+            else {
+                const serverTools = await listServerTools(server.id);
+                const definition = serverTools.find(candidate => candidate.name === tool.toolName && candidate.enabled);
+                if (!definition) {
+                    result = {
+                        text: 'This tool is no longer offered by its server.',
+                        isError: true,
+                        truncated: false,
+                    };
+                }
+                else {
+                    const authHeaders = await resolveAuthHeaders(actor.userId, server);
+                    if (server.kind === 'openapi') {
+                        if (!definition.detail) {
+                            result = {
+                                text: 'The pinned specification has no execution detail for this tool.',
+                                isError: true,
+                                truncated: false,
+                            };
+                        }
+                        else {
+                            result = await executeOpenApiTool({
+                                baseUrl: server.baseUrl,
+                                detail: definition.detail,
+                                args,
+                                authHeaders,
+                                timeoutMs: server.timeoutMs,
+                                maxResponseBytes: server.maxResponseBytes,
+                                ...(input.signal ? { signal: input.signal } : {}),
+                            });
+                        }
+                    }
+                    else {
+                        const endpoint = {
+                            url: server.baseUrl,
+                            headers: authHeaders,
+                            timeoutMs: server.timeoutMs,
+                            maxResponseBytes: server.maxResponseBytes,
+                        };
+                        const session = await mcpInitialize(endpoint, input.signal);
+                        const call = await mcpCallTool(endpoint, session, tool.toolName, args, input.signal);
+                        const capped = call.text.slice(0, server.maxResponseBytes);
+                        result = {
+                            text: capped,
+                            isError: call.isError,
+                            truncated: capped.length < call.text.length,
+                        };
+                    }
+                }
+            }
+        }
+    }
+    catch (error) {
+        if (input.signal?.aborted)
+            throw error;
+        const message = error instanceof ToolEgressError ||
+            error instanceof McpClientError ||
+            error instanceof ResourcePolicyError
+            ? error.message
+            : 'The tool call failed unexpectedly.';
+        result = { text: message, isError: true, truncated: false };
+    }
+    finally {
+        const remaining = (activeCallsByUser.get(actor.userId) ?? 1) - 1;
+        if (remaining <= 0)
+            activeCallsByUser.delete(actor.userId);
+        else
+            activeCallsByUser.set(actor.userId, remaining);
+    }
+    recordAuditEvent({
+        action: 'tool.call',
+        result: result.isError ? 'failure' : 'success',
+        actorUserId: actor.userId,
+        targetType: tool.serverId ? 'tool-server' : 'builtin-tool',
+        targetId: tool.serverId ?? tool.toolName,
+        details: {
+            tool: tool.toolName,
+            source: tool.source,
+            sideEffect: tool.sideEffect,
+        },
+    });
+    return result;
+}
+/** Expire stale pending approvals opportunistically from the gateway path. */
+export const expireStaleApprovals = async () => {
+    try {
+        await getPersistence(encryptionService).repositories.resources.toolApprovals.expirePending(Date.now());
+    }
+    catch {
+        // Best-effort sweep; the waiting loop also expires on read.
+    }
+};
+//# sourceMappingURL=toolGatewayService.js.map

package/backend/dist/services/toolGatewayService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolGatewayService.js","sourceRoot":"","sources":["../../src/services/toolGatewayService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAmB,MAAM,2BAA2B,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,kBAAkB,GAEnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,GAEf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAyBpD,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,MAAM,oBAAoB,GAAG,CAC3B,KAAc,EACiB,EAAE;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAG,KAAK;SACd,MAAM,CACL,CAAC,KAAK,EAAmB,EAAE,CACzB,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACvB,KAAK,CAAC,MAAM,IAAI,uBAAuB,CAC1C;SACA,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,KAAc,EACsB,EAAE;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,YAAY,GAAG,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,YAAY,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5E,OAAO;QACL,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,OAAsC,EACtC,SAAwC,EACT,EAAE;IACjC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAiB;IACtD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE;QAC7C,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,OAAO;KACZ,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAiB,EACjB,OAA+B,EAC/B,SAAS,GAAyB,EAAE;IAEpC,MAAM,cAAc,GAAuB;QACzC,KAAK;QACL,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,SAAS,CAAC,aAAa;YACzB,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,aAAa,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,qBAAqB,CAAC,cAAc,EAAE,SAAS,CAAC,YAAY,CAAC;QAC7D,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC;KACjD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAkBD,MAAM,cAAc,GAAG,CAAC,aAAqB,EAA2B,EAAE;IACxE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAY,CAAC;IACpD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAyB;IAEzB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC9B,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,MAAM,IAAI,6BAA6B,EAAE,CAAC;QAC5C,OAAO;YACL,IAAI,EAAE,wDAAwD;YAC9D,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IACD,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;IAEhD,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,IAAI,EAAE,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE;gBACtF,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;gBACrD,KAAK;gBACL,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ;oBAC3B,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE;oBACxC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa;oBAChC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,GAAG;oBACP,IAAI,EAAE,iDAAiD;oBACvD,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACrD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CACjC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,OAAO,CACnE,CAAC;gBACF,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,GAAG;wBACP,IAAI,EAAE,+CAA+C;wBACrD,OAAO,EAAE,IAAI;wBACb,SAAS,EAAE,KAAK;qBACjB,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBACnE,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBAC9B,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;4BACvB,MAAM,GAAG;gCACP,IAAI,EAAE,iEAAiE;gCACvE,OAAO,EAAE,IAAI;gCACb,SAAS,EAAE,KAAK;6BACjB,CAAC;wBACJ,CAAC;6BAAM,CAAC;4BACN,MAAM,GAAG,MAAM,kBAAkB,CAAC;gCAChC,OAAO,EAAE,MAAM,CAAC,OAAO;gCACvB,MAAM,EAAE,UAAU,CAAC,MAAM;gCACzB,IAAI;gCACJ,WAAW;gCACX,SAAS,EAAE,MAAM,CAAC,SAAS;gCAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gCACzC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BAClD,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,QAAQ,GAAgB;4BAC5B,GAAG,EAAE,MAAM,CAAC,OAAO;4BACnB,OAAO,EAAE,WAAW;4BACpB,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;yBAC1C,CAAC;wBACF,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC5D,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,QAAQ,EACR,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,EACJ,KAAK,CAAC,MAAM,CACb,CAAC;wBACF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;wBAC3D,MAAM,GAAG;4BACP,IAAI,EAAE,MAAM;4BACZ,OAAO,EAAE,IAAI,CAAC,OAAO;4BACrB,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM;yBAC5C,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,KAAK,CAAC;QACvC,MAAM,OAAO,GACX,KAAK,YAAY,eAAe;YAChC,KAAK,YAAY,cAAc;YAC/B,KAAK,YAAY,mBAAmB;YAClC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,oCAAoC,CAAC;QAC3C,MAAM,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,SAAS,IAAI,CAAC;YAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;;YACtD,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,CAAC;IAED,gBAAgB,CAAC;QACf,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC9C,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc;QAC1D,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;QACxC,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B;KACF,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,IAAmB,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,cAAc,CAClB,iBAAiB,CAClB,CAAC,YAAY,CAAC,SAAS,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC,CAAC"}

package/backend/dist/services/toolServerService.d.ts

@@ -0,0 +1,57 @@
+import type { StoredToolServerRecord, StoredToolServerToolRecord } from '../persistence/index.js';
+import type { EffectiveTool, ToolDefinition, ToolServer, ToolServerAccessMode, ToolServerAuthMode, ToolServerKind } from '../types/tools.js';
+import { type AuthzActor } from './authorizationService.js';
+export declare const mapToolServerRow: (row: StoredToolServerRecord) => ToolServer;
+export declare const mapToolRow: (row: StoredToolServerToolRecord) => ToolDefinition;
+export interface ToolServerInput {
+    name: string;
+    description?: string;
+    kind: ToolServerKind;
+    baseUrl: string;
+    /** OpenAPI only: where the JSON specification lives; defaults to baseUrl. */
+    specUrl?: string;
+    authMode: ToolServerAuthMode;
+    authHeader?: string;
+    accessMode: ToolServerAccessMode;
+    enabled?: boolean;
+    timeoutMs?: number;
+    maxResponseBytes?: number;
+}
+export declare function registerToolServer(adminUserId: string, input: ToolServerInput): Promise<ToolServer>;
+export interface ToolServerUpdate {
+    name?: string;
+    description?: string | null;
+    authMode?: ToolServerAuthMode;
+    authHeader?: string | null;
+    accessMode?: ToolServerAccessMode;
+    enabled?: boolean;
+    timeoutMs?: number;
+    maxResponseBytes?: number;
+}
+/** Update mutable policy fields. The destination and pinned spec never change here. */
+export declare function updateToolServer(adminUserId: string, serverId: string, update: ToolServerUpdate): Promise<ToolServer | null>;
+/** Re-fetch the inventory; a changed digest advances the pinned revision. */
+export declare function refreshToolServer(adminUserId: string, serverId: string): Promise<ToolServer | null>;
+export declare function deleteToolServer(adminUserId: string, serverId: string): Promise<boolean>;
+export declare function getToolServer(serverId: string): Promise<ToolServer | null>;
+export declare function listToolServers(): Promise<ToolServer[]>;
+export declare function listServerTools(serverId: string): Promise<ToolDefinition[]>;
+export declare function overrideServerTool(adminUserId: string, serverId: string, toolName: string, overrides: {
+    enabled?: boolean;
+    sideEffect?: boolean;
+}): Promise<ToolDefinition | null>;
+/** Whether one server is usable by this actor (feature gate checked separately). */
+export declare function actorCanUseServer(actor: AuthzActor, server: ToolServer): Promise<boolean>;
+export declare function listVisibleToolServers(actor: AuthzActor): Promise<ToolServer[]>;
+export declare const serverNamespace: (name: string) => string;
+/**
+ * The effective server-tool catalog for one actor: enabled tools of every
+ * visible enabled server, namespaced `<server>__<tool>` for the provider.
+ */
+export declare function effectiveServerTools(actor: AuthzActor, serverIds?: readonly string[]): Promise<EffectiveTool[]>;
+export declare function setToolServerCredential(userId: string, serverId: string, secret: string): Promise<void>;
+export declare function deleteToolServerCredential(userId: string, serverId: string): Promise<boolean>;
+export declare function hasToolServerCredential(userId: string, serverId: string): Promise<boolean>;
+/** Resolve the outbound auth headers for this user on this server. */
+export declare function resolveAuthHeaders(userId: string, server: ToolServer): Promise<Record<string, string>>;
+//# sourceMappingURL=toolServerService.d.ts.map

package/backend/dist/services/toolServerService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolServerService.d.ts","sourceRoot":"","sources":["../../src/services/toolServerService.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EACV,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EAEf,MAAM,mBAAmB,CAAC;AAe3B,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAC;AA8BvE,eAAO,MAAM,gBAAgB,QAAS,sBAAsB,KAAG,UAmB7D,CAAC;AAEH,eAAO,MAAM,UAAU,QAChB,0BAA0B,KAC9B,cAqBD,CAAC;AAEH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,oBAAoB,CAAC;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AA4KD,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,UAAU,CAAC,CAwDrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,uFAAuF;AACvF,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA+D5B;AAED,6EAA6E;AAC7E,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA2C5B;AAED,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAG5B;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAG7D;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,EAAE,CAAC,CAG3B;AAED,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACrD,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAyBhC;AAED,oFAAoF;AACpF,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,UAAU,EAAE,CAAC,CAOvB;AAID,eAAO,MAAM,eAAe,SAAU,MAAM,KAAG,MAG9C,CAAC;AAEF;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,UAAU,EACjB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,GAC5B,OAAO,CAAC,aAAa,EAAE,CAAC,CA4B1B;AAID,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAelB;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED,sEAAsE;AACtE,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAoBjC"}