openbotcity-mcp 0.2.44 → 0.2.51

package/build/remote.d.ts

@@ -1,7 +1,21 @@
 export interface Env {
     UPSTASH_REDIS_REST_URL?: string;
     UPSTASH_REDIS_REST_TOKEN?: string;
+    /** Domain-verification token issued by OpenAI's plugins dashboard (wrangler secret). */
+    OPENAI_APPS_CHALLENGE?: string;
 }
+/**
+ * Which server a path serves. /mcp is the everyday server. /directory/mcp is the
+ * variant listed in Anthropic's directory (no AI-media generation). /plugin/mcp is
+ * the variant listed in OpenAI's Plugins Directory: every tool of /mcp, but no
+ * raw-token argument in any tool input (session handles only).
+ */
+export declare function doorFor(pathname: string): {
+    profile: "full" | "directory";
+    legacyJwt: boolean;
+} | null;
+/** OpenAI domain verification: the dashboard's token, exactly, as plain text. 404 until the secret is set. */
+export declare function openAiChallengeResponse(env: Env): Response;
 declare const _default: {
     fetch(request: Request, env: Env): Promise<Response>;
 };

package/build/remote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,GAAG;IAClB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;;mBAGsB,OAAO,OAAO,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;;AAD5D,wBA4CE"}
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,GAAG;IAClB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,wFAAwF;IACxF,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,GAAG,WAAW,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAKtG;AAED,8GAA8G;AAC9G,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,GAAG,GAAG,QAAQ,CAO1D;;mBAGsB,OAAO,OAAO,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;;AAD5D,wBAgDE"}

package/build/remote.js

@@ -1,6 +1,6 @@
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { createServer } from "./server.js";
-import { clearRequestToken } from "./services/credentials.js";
+import { runInRequestScope } from "./services/credentials.js";
 import { createSessionStore } from "./services/sessionStore.js";
 const CORS_HEADERS = {
     "Access-Control-Allow-Origin": "*",
@@ -14,6 +14,31 @@ function addCorsHeaders(response) {
         headers.set(k, v);
     return new Response(response.body, { status: response.status, headers });
 }
+/**
+ * Which server a path serves. /mcp is the everyday server. /directory/mcp is the
+ * variant listed in Anthropic's directory (no AI-media generation). /plugin/mcp is
+ * the variant listed in OpenAI's Plugins Directory: every tool of /mcp, but no
+ * raw-token argument in any tool input (session handles only).
+ */
+export function doorFor(pathname) {
+    if (pathname === "/mcp")
+        return { profile: "full", legacyJwt: true };
+    if (pathname === "/directory/mcp")
+        return { profile: "directory", legacyJwt: true };
+    if (pathname === "/plugin/mcp")
+        return { profile: "full", legacyJwt: false };
+    return null;
+}
+/** OpenAI domain verification: the dashboard's token, exactly, as plain text. 404 until the secret is set. */
+export function openAiChallengeResponse(env) {
+    const token = env.OPENAI_APPS_CHALLENGE?.trim();
+    if (!token)
+        return new Response("Not found", { status: 404, headers: CORS_HEADERS });
+    return new Response(token, {
+        status: 200,
+        headers: { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-store", ...CORS_HEADERS },
+    });
+}
 export default {
     async fetch(request, env) {
         const url = new URL(request.url);
@@ -27,24 +52,29 @@ export default {
                 headers: { "Content-Type": "application/json", ...CORS_HEADERS },
             });
         }
+        if (url.pathname === "/.well-known/openai-apps-challenge" && (request.method === "GET" || request.method === "HEAD")) {
+            return openAiChallengeResponse(env);
+        }
         // MCP endpoint — stateless: new server + transport per request
         // CF Workers are ephemeral, no in-memory session storage
-        if (url.pathname === "/mcp") {
+        // Three doors, one server (see doorFor).
+        const door = doorFor(url.pathname);
+        if (door) {
+            // Extract Bearer token from Authorization header (e.g. Codex sends OPENBOTCITY_JWT)
+            const authHeader = request.headers.get("authorization");
+            const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : undefined;
             try {
-                // Extract Bearer token from Authorization header (e.g. Codex sends OPENBOTCITY_JWT)
-                const authHeader = request.headers.get("authorization");
-                const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : undefined;
-                const sessionStore = createSessionStore(env);
-                const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined });
-                const server = createServer(bearerToken, sessionStore);
-                await server.connect(transport);
-                const response = await transport.handleRequest(request);
-                // Clear request-scoped token to prevent leakage to next request on same isolate
-                clearRequestToken();
-                return addCorsHeaders(response);
+                // Every credential this request touches lives in its own scope: requests on a
+                // shared isolate interleave, so nothing may sit in module state (see credentials.ts).
+                return await runInRequestScope(bearerToken, async () => {
+                    const sessionStore = createSessionStore(env);
+                    const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+                    const server = createServer(bearerToken, sessionStore, door.profile, { legacyJwt: door.legacyJwt });
+                    await server.connect(transport);
+                    return addCorsHeaders(await transport.handleRequest(request));
+                });
             }
             catch (err) {
-                clearRequestToken();
                 return new Response(JSON.stringify({ error: err instanceof Error ? err.message : "Internal error" }), { status: 500, headers: { "Content-Type": "application/json", ...CORS_HEADERS } });
             }
         }

package/build/remote.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote.js","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAC;AACzH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,YAAY,GAA2B;IAC3C,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,4BAA4B;IAC5D,8BAA8B,EAAE,mEAAmE;IACnG,+BAA+B,EAAE,sCAAsC;CACxE,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AAOD,eAAe;IACb,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAQ;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,iBAAiB;QACjB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,eAAe;QACf,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,EAAE;gBAChF,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QAED,+DAA+D;QAC/D,yDAAyD;QACzD,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,oFAAoF;gBACpF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBACxD,MAAM,WAAW,GAAG,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAExF,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBAE7C,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;gBAClG,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;gBACvD,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAChC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBACxD,gFAAgF;gBAChF,iBAAiB,EAAE,CAAC;gBACpB,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,iBAAiB,EAAE,CAAC;gBACpB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,EAChF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,EAAE,EAAE,CAClF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC"}
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAC;AACzH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,YAAY,GAA2B;IAC3C,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,4BAA4B;IAC5D,8BAA8B,EAAE,mEAAmE;IACnG,+BAA+B,EAAE,sCAAsC;CACxE,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,QAAgB;IACtC,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,QAAQ,KAAK,gBAAgB;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACpF,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,uBAAuB,CAAC,GAAQ;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IACrF,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,YAAY,EAAE;KACvG,CAAC,CAAC;AACL,CAAC;AAED,eAAe;IACb,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAQ;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,iBAAiB;QACjB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,eAAe;QACf,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,EAAE;gBAChF,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,oCAAoC,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YACrH,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,+DAA+D;QAC/D,yDAAyD;QACzD,yCAAyC;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,oFAAoF;YACpF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACxD,MAAM,WAAW,GAAG,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,IAAI,CAAC;gBACH,8EAA8E;gBAC9E,sFAAsF;gBACtF,OAAO,MAAM,iBAAiB,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;oBACrD,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;oBAC7C,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;oBAClG,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;oBACpG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAChC,OAAO,cAAc,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChE,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,EAChF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,YAAY,EAAE,EAAE,CAClF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC"}

package/build/server.d.ts

@@ -1,10 +1,15 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type ServerProfile } from "./tools/action.js";
 import { type SessionStore } from "./services/sessionStore.js";
 /**
  * Create a configured MCP server instance.
  * @param bearerToken Optional Bearer token from HTTP transport (scoped to this request only).
+ * @param profile "full" (default, /mcp) or "directory" (/directory/mcp: no AI-media generation, for Anthropic's directory listing).
+ * @param options.legacyJwt false hides the raw-token argument from the tool schemas (/plugin/mcp, OpenAI's Plugins Directory). Default true.
  * @param sessionStore Optional Redis-backed session store. If omitted, a no-op store is used
  *   (stdio/local mode falls back to the filesystem credential cache).
  */
-export declare function createServer(bearerToken?: string, sessionStore?: SessionStore): McpServer;
+export declare function createServer(bearerToken?: string, sessionStore?: SessionStore, profile?: ServerProfile, options?: {
+    legacyJwt?: boolean;
+}): McpServer;
 //# sourceMappingURL=server.d.ts.map

package/build/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAQpE,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAEnF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CA0BzF"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKnE,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAEnF;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,WAAW,CAAC,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,GAAE,aAAsB,EAC/B,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,SAAS,CA4BX"}

package/build/server.js

@@ -3,6 +3,7 @@ import { registerTool } from "./tools/register.js";
 import { reconnectTool } from "./tools/reconnect.js";
 import { heartbeatTool } from "./tools/heartbeat.js";
 import { actionTool } from "./tools/action.js";
+import { queryTool } from "./tools/query.js";
 import { skillResource } from "./resources/skill.js";
 import { heartbeatDocResource } from "./resources/heartbeat-doc.js";
 import { setRequestToken, clearRequestToken, setStatelessMode } from "./services/credentials.js";
@@ -10,10 +11,13 @@ import { createSessionStore } from "./services/sessionStore.js";
 /**
  * Create a configured MCP server instance.
  * @param bearerToken Optional Bearer token from HTTP transport (scoped to this request only).
+ * @param profile "full" (default, /mcp) or "directory" (/directory/mcp: no AI-media generation, for Anthropic's directory listing).
+ * @param options.legacyJwt false hides the raw-token argument from the tool schemas (/plugin/mcp, OpenAI's Plugins Directory). Default true.
  * @param sessionStore Optional Redis-backed session store. If omitted, a no-op store is used
  *   (stdio/local mode falls back to the filesystem credential cache).
  */
-export function createServer(bearerToken, sessionStore) {
+export function createServer(bearerToken, sessionStore, profile = "full", options = {}) {
+    const legacyJwt = options.legacyJwt ?? true;
     // Mark stateless mode — memory won't persist between requests in CF Workers
     setStatelessMode();
     // Scope token to this request — avoids cross-user leakage on shared CF Worker isolates
@@ -30,8 +34,9 @@ export function createServer(bearerToken, sessionStore) {
     });
     registerTool(server, store);
     reconnectTool(server, store);
-    heartbeatTool(server, store);
-    actionTool(server, store);
+    heartbeatTool(server, store, legacyJwt);
+    queryTool(server, store, legacyJwt);
+    actionTool(server, store, profile, legacyJwt);
     skillResource(server);
     heartbeatDocResource(server);
     return server;

package/build/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAqB,MAAM,4BAA4B,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,WAAoB,EAAE,YAA2B;IAC5E,4EAA4E;IAC5E,gBAAgB,EAAE,CAAC;IAEnB,uFAAuF;IACvF,IAAI,WAAW,EAAE,CAAC;QAChB,eAAe,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,iBAAiB,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5B,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1B,aAAa,CAAC,MAAM,CAAC,CAAC;IACtB,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAE7B,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAsB,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAqB,MAAM,4BAA4B,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,WAAoB,EACpB,YAA2B,EAC3B,UAAyB,MAAM,EAC/B,UAAmC,EAAE;IAErC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAC5C,4EAA4E;IAC5E,gBAAgB,EAAE,CAAC;IAEnB,uFAAuF;IACvF,IAAI,WAAW,EAAE,CAAC;QAChB,eAAe,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,iBAAiB,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5B,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACxC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACpC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9C,aAAa,CAAC,MAAM,CAAC,CAAC;IACtB,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAE7B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/build/services/credentials.d.ts

@@ -4,9 +4,13 @@ interface StoredCredentials {
     display_name?: string;
     slug?: string;
 }
-/** Set a request-scoped Bearer token (called by createServer in remote mode). */
+/** Run one remote request with its own credential scope. `bearer` is the Authorization header token, if any. */
+export declare function runInRequestScope<T>(bearer: string | undefined, fn: () => Promise<T>): Promise<T>;
+/** True while handling a request of the remote server. */
+export declare function isRemoteRequest(): boolean;
+/** Set the Bearer token for the current request (scope-local on the remote server). */
 export declare function setRequestToken(token: string): void;
-/** Clear the request-scoped token and any cached token (called between requests in remote mode). */
+/** Clear the current request's token (scope-local on the remote server). */
 export declare function clearRequestToken(): void;
 /** Mark that we're running in stateless mode (no persistent memory between requests). */
 export declare function setStatelessMode(): void;
@@ -28,5 +32,16 @@ export declare function getToken(): string | null;
 export declare function getOrCreateAgentKey(): string | null;
 /** Get stored bot info (if available). */
 export declare function getStoredBotInfo(): Omit<StoredCredentials, "jwt"> | null;
+/**
+ * A fresh, never-reused agent_key for a registration made through the remote server.
+ *
+ * The City API hands an UNCLAIMED agent back to any keyless caller who registers
+ * with its exact name (meant as retry recovery). The remote server has no way to
+ * tell a retry from a stranger: every user arrives from the same address with no
+ * stored key. A key that matches nothing makes the API answer NAME_TAKEN instead,
+ * so one user can never be handed another user's agent by asking for its name.
+ * Their own agent is recovered with openbotcity_reconnect (slug + code or email).
+ */
+export declare function oneTimeAgentKey(): string;
 export {};
 //# sourceMappingURL=credentials.d.ts.map

package/build/services/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/services/credentials.ts"],"names":[],"mappings":"AASA,UAAU,iBAAiB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAcD,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGnD;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED,wCAAwC;AACxC,wBAAgB,WAAW,IAAI,OAAO,CAErC;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAElD;AAED,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAQ/D;AAED,+EAA+E;AAC/E,wBAAgB,QAAQ,IAAI,MAAM,GAAG,IAAI,CA2BxC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAgBnD;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,IAAI,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,GAAG,IAAI,CAOxE"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/services/credentials.ts"],"names":[],"mappings":"AAUA,UAAU,iBAAiB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAiBD,gHAAgH;AAChH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEjG;AAED,0DAA0D;AAC1D,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAQD,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAQnD;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,IAAI,IAAI,CAQxC;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED,wCAAwC;AACxC,wBAAgB,WAAW,IAAI,OAAO,CAErC;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAElD;AAED,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAc/D;AAED,+EAA+E;AAC/E,wBAAgB,QAAQ,IAAI,MAAM,GAAG,IAAI,CA6BxC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAgBnD;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,IAAI,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,GAAG,IAAI,CAOxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC"}

package/build/services/credentials.js

@@ -2,25 +2,41 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { randomUUID } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
 const CRED_DIR = join(homedir(), ".openbotcity");
 const CRED_FILE = join(CRED_DIR, "credentials.json");
 const AGENT_KEY_FILE = join(CRED_DIR, "agent_key");
 let cachedToken = null;
-/**
- * Request-scoped token for CF Workers.
- * Set at the start of each request, cleared after. Avoids cross-user leakage
- * on shared isolates where module-level state persists across requests.
- */
+const requestScope = new AsyncLocalStorage();
+/** Run one remote request with its own credential scope. `bearer` is the Authorization header token, if any. */
+export function runInRequestScope(bearer, fn) {
+    return requestScope.run({ token: bearer ?? null }, fn);
+}
+/** True while handling a request of the remote server. */
+export function isRemoteRequest() {
+    return requestScope.getStore() !== undefined;
+}
+/** Legacy module-level request token (stdio / callers outside a request scope). */
 let requestToken = null;
 /** Whether we're running in stateless mode (CF Workers) where memory doesn't persist between requests. */
 let statelessMode = false;
-/** Set a request-scoped Bearer token (called by createServer in remote mode). */
+/** Set the Bearer token for the current request (scope-local on the remote server). */
 export function setRequestToken(token) {
+    const scope = requestScope.getStore();
+    if (scope) {
+        scope.token = token;
+        return;
+    }
     requestToken = token;
     statelessMode = true; // If setRequestToken is called, we're in remote/stateless mode
 }
-/** Clear the request-scoped token and any cached token (called between requests in remote mode). */
+/** Clear the current request's token (scope-local on the remote server). */
 export function clearRequestToken() {
+    const scope = requestScope.getStore();
+    if (scope) {
+        scope.token = null;
+        return;
+    }
     requestToken = null;
     cachedToken = null;
 }
@@ -30,14 +46,20 @@ export function setStatelessMode() {
 }
 /** Check if we're in stateless mode. */
 export function isStateless() {
-    return statelessMode;
+    return statelessMode || isRemoteRequest();
 }
 /** @deprecated Use setRequestToken instead. Kept for backwards compat with older callers. */
 export function setBearerToken(token) {
-    requestToken = token;
+    setRequestToken(token);
 }
 /** Store JWT and optional bot info to disk. Falls back to memory-only if filesystem unavailable. */
 export function storeCredentials(creds) {
+    const scope = requestScope.getStore();
+    if (scope) {
+        // Remote server: visible to the rest of THIS request only. Never the module cache, never disk.
+        scope.token = creds.jwt;
+        return;
+    }
     cachedToken = creds.jwt;
     try {
         mkdirSync(CRED_DIR, { recursive: true });
@@ -49,6 +71,9 @@ export function storeCredentials(creds) {
 }
 /** Get JWT token. Priority: request-scoped > memory cache > env var > file. */
 export function getToken() {
+    const scope = requestScope.getStore();
+    if (scope)
+        return scope.token; // remote: this request's token or nothing
     if (requestToken)
         return requestToken;
     if (cachedToken)
@@ -85,7 +110,7 @@ export function getToken() {
  * Returns null in stateless mode (CF Workers) or when the filesystem is unavailable.
  */
 export function getOrCreateAgentKey() {
-    if (statelessMode)
+    if (isStateless())
         return null;
     try {
         const existing = readFileSync(AGENT_KEY_FILE, "utf-8").trim();
@@ -115,4 +140,17 @@ export function getStoredBotInfo() {
         return null;
     }
 }
+/**
+ * A fresh, never-reused agent_key for a registration made through the remote server.
+ *
+ * The City API hands an UNCLAIMED agent back to any keyless caller who registers
+ * with its exact name (meant as retry recovery). The remote server has no way to
+ * tell a retry from a stranger: every user arrives from the same address with no
+ * stored key. A key that matches nothing makes the API answer NAME_TAKEN instead,
+ * so one user can never be handed another user's agent by asking for its name.
+ * Their own agent is recovered with openbotcity_reconnect (slug + code or email).
+ */
+export function oneTimeAgentKey() {
+    return `obck_once_${randomUUID().replace(/-/g, "")}`;
+}
 //# sourceMappingURL=credentials.js.map

package/build/services/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/services/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACjD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AACrD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AASnD,IAAI,WAAW,GAAkB,IAAI,CAAC;AAEtC;;;;GAIG;AACH,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC,0GAA0G;AAC1G,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,YAAY,GAAG,KAAK,CAAC;IACrB,aAAa,GAAG,IAAI,CAAC,CAAC,+DAA+D;AACvF,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB;IAC/B,YAAY,GAAG,IAAI,CAAC;IACpB,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,gBAAgB;IAC9B,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,WAAW;IACzB,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,YAAY,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC;IACxB,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,mFAAmF;IACrF,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ;IACtB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,gBAAgB;IAChB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC7C,IAAI,QAAQ,EAAE,CAAC;YACb,WAAW,GAAG,QAAQ,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;IAED,aAAa;IACb,IAAI,CAAC;QACH,MAAM,IAAI,GAAsB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC;YACvB,OAAO,IAAI,CAAC,GAAG,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,aAAa;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IACD,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,QAAQ,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;QACrD,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,yBAAyB;IACxC,CAAC;AACH,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAsB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/services/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACjD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AACrD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AASnD,IAAI,WAAW,GAAkB,IAAI,CAAC;AAatC,MAAM,YAAY,GAAG,IAAI,iBAAiB,EAAgB,CAAC;AAE3D,gHAAgH;AAChH,MAAM,UAAU,iBAAiB,CAAI,MAA0B,EAAE,EAAoB;IACnF,OAAO,YAAY,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC,0GAA0G;AAC1G,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QACpB,OAAO;IACT,CAAC;IACD,YAAY,GAAG,KAAK,CAAC;IACrB,aAAa,GAAG,IAAI,CAAC,CAAC,+DAA+D;AACvF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,OAAO;IACT,CAAC;IACD,YAAY,GAAG,IAAI,CAAC;IACpB,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,gBAAgB;IAC9B,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,WAAW;IACzB,OAAO,aAAa,IAAI,eAAe,EAAE,CAAC;AAC5C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,eAAe,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,+FAA+F;QAC/F,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC;QACxB,OAAO;IACT,CAAC;IACD,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC;IACxB,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,mFAAmF;IACrF,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ;IACtB,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IACtC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,0CAA0C;IACzE,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,gBAAgB;IAChB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC7C,IAAI,QAAQ,EAAE,CAAC;YACb,WAAW,GAAG,QAAQ,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;IAED,aAAa;IACb,IAAI,CAAC;QACH,MAAM,IAAI,GAAsB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC;YACvB,OAAO,IAAI,CAAC,GAAG,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,WAAW,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IACD,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,QAAQ,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;QACrD,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,yBAAyB;IACxC,CAAC;AACH,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAsB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,aAAa,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC"}

package/build/services/resolveToken.d.ts

@@ -0,0 +1,8 @@
+import type { SessionStore } from "./sessionStore.js";
+/**
+ * Resolve the bearer token for a tool call from, in order: an explicit session
+ * handle (obc_...), a legacy raw JWT, the session store, or the local credential
+ * cache (stdio mode). Returns null when nothing authenticates the call.
+ */
+export declare function resolveToken(session: string | undefined, jwt: string | undefined, sessionStore: SessionStore): Promise<string | null>;
+//# sourceMappingURL=resolveToken.d.ts.map

package/build/services/resolveToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveToken.d.ts","sourceRoot":"","sources":["../../src/services/resolveToken.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcxB"}

package/build/services/resolveToken.js

@@ -0,0 +1,25 @@
+import { getToken } from "./credentials.js";
+/**
+ * Resolve the bearer token for a tool call from, in order: an explicit session
+ * handle (obc_...), a legacy raw JWT, the session store, or the local credential
+ * cache (stdio mode). Returns null when nothing authenticates the call.
+ */
+export async function resolveToken(session, jwt, sessionStore) {
+    let token = null;
+    let handle = session || null;
+    if (jwt && jwt.startsWith("obc_")) {
+        handle = jwt;
+    }
+    else if (jwt) {
+        token = jwt;
+    }
+    if (!token && handle) {
+        const payload = await sessionStore.get(handle);
+        if (payload)
+            token = payload.jwt;
+    }
+    if (!token)
+        token = getToken();
+    return token;
+}
+//# sourceMappingURL=resolveToken.js.map

package/build/services/resolveToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveToken.js","sourceRoot":"","sources":["../../src/services/resolveToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA2B,EAC3B,GAAuB,EACvB,YAA0B;IAE1B,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,MAAM,GAAkB,OAAO,IAAI,IAAI,CAAC;IAC5C,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,CAAC;IACf,CAAC;SAAM,IAAI,GAAG,EAAE,CAAC;QACf,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,OAAO;YAAE,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,KAAK,GAAG,QAAQ,EAAE,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC"}

package/build/services/sessionStore.d.ts

@@ -8,7 +8,7 @@
  * call, which fails in practice — models truncate, redact, or omit the token.
  *
  * Fix: store the JWT server-side in Upstash Redis keyed by a short opaque
- * handle (obc_<12hex>). The model only has to remember the handle — 16 chars,
+ * handle (obc_<24hex>). The model only has to remember the handle — 28 chars,
  * no dots, doesn't look like a credential, so it's not mistaken for PII.
  *
  * Uses the Upstash REST API directly via fetch — no SDK dep needed.
@@ -28,7 +28,7 @@ export interface SessionStore {
     /** Delete a session handle (best-effort). */
     del(handle: string): Promise<void>;
 }
-/** Validate that a string looks like a session handle. */
+/** Validate that a string looks like a session handle (24 hex; 12 hex for handles issued before 0.2.50, until they expire). */
 export declare function isSessionHandle(value: string): boolean;
 export declare function createSessionStore(env: {
     UPSTASH_REDIS_REST_URL?: string;

package/build/services/sessionStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionStore.d.ts","sourceRoot":"","sources":["../../src/services/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,gHAAgH;IAChH,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,sGAAsG;IACtG,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACpD,6CAA6C;IAC7C,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAeD,0DAA0D;AAC1D,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtD;AA8DD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE;IACtC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC,GAAG,YAAY,CAKf"}
+{"version":3,"file":"sessionStore.d.ts","sourceRoot":"","sources":["../../src/services/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,gHAAgH;IAChH,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,sGAAsG;IACtG,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACpD,6CAA6C;IAC7C,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAoBD,+HAA+H;AAC/H,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtD;AA8DD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE;IACtC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC,GAAG,YAAY,CAKf"}

package/build/services/sessionStore.js

@@ -8,7 +8,7 @@
  * call, which fails in practice — models truncate, redact, or omit the token.
  *
  * Fix: store the JWT server-side in Upstash Redis keyed by a short opaque
- * handle (obc_<12hex>). The model only has to remember the handle — 16 chars,
+ * handle (obc_<24hex>). The model only has to remember the handle — 28 chars,
  * no dots, doesn't look like a credential, so it's not mistaken for PII.
  *
  * Uses the Upstash REST API directly via fetch — no SDK dep needed.
@@ -16,18 +16,23 @@
 const KEY_PREFIX = "mcp_sess:";
 const DEFAULT_TTL = 7 * 24 * 60 * 60; // 7 days
 const HANDLE_PREFIX = "obc_";
-/** Generate a short opaque handle — 12 hex chars (48 bits of entropy). */
+/**
+ * Generate an opaque handle: 24 hex chars (96 bits). The handle is the only thing
+ * standing between a caller and an agent for 7 days, so it must not be guessable;
+ * the earlier 12-char handles (48 bits) were too short for that once many sessions
+ * are live at the same time.
+ */
 function generateHandle() {
-    const bytes = new Uint8Array(6);
+    const bytes = new Uint8Array(12);
     crypto.getRandomValues(bytes);
     let hex = "";
     for (const b of bytes)
         hex += b.toString(16).padStart(2, "0");
     return HANDLE_PREFIX + hex;
 }
-/** Validate that a string looks like a session handle. */
+/** Validate that a string looks like a session handle (24 hex; 12 hex for handles issued before 0.2.50, until they expire). */
 export function isSessionHandle(value) {
-    return /^obc_[0-9a-f]{12}$/i.test(value);
+    return /^obc_(?:[0-9a-f]{12}|[0-9a-f]{24})$/i.test(value);
 }
 class UpstashSessionStore {
     url;

package/build/services/sessionStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionStore.js","sourceRoot":"","sources":["../../src/services/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAmBH,MAAM,UAAU,GAAG,WAAW,CAAC;AAC/B,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;AAC/C,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,0EAA0E;AAC1E,SAAS,cAAc;IACrB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,aAAa,GAAG,GAAG,CAAC;AAC7B,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,mBAAmB;IAEM;IAA8B;IADlD,UAAU,GAAG,IAAI,CAAC;IAC3B,YAA6B,GAAW,EAAmB,KAAa;QAA3C,QAAG,GAAH,GAAG,CAAQ;QAAmB,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAEpE,KAAK,CAAC,IAAI,CAAC,OAA4B;QAC7C,4DAA4D;QAC5D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;gBACrC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA0C,CAAC;QACtE,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAuB,EAAE,UAAU,GAAG,WAAW;QACzD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;YACzF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc;QACtB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACvD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAmB,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc;QACtB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAAE,OAAO;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;CACF;AAED,MAAM,gBAAgB;IACX,UAAU,GAAG,KAAK,CAAC;IAC5B,KAAK,CAAC,GAAG,KAA6B,OAAO,IAAI,CAAC,CAAC,CAAC;IACpD,KAAK,CAAC,GAAG,KAAqC,OAAO,IAAI,CAAC,CAAC,CAAC;IAC5D,KAAK,CAAC,GAAG,KAAgC,CAAC;CAC3C;AAED,MAAM,UAAU,kBAAkB,CAAC,GAGlC;IACC,MAAM,GAAG,GAAG,GAAG,CAAC,sBAAsB,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,wBAAwB,CAAC;IAC3C,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,gBAAgB,EAAE,CAAC;IAClD,OAAO,IAAI,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"sessionStore.js","sourceRoot":"","sources":["../../src/services/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAmBH,MAAM,UAAU,GAAG,WAAW,CAAC;AAC/B,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;AAC/C,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B;;;;;GAKG;AACH,SAAS,cAAc;IACrB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,aAAa,GAAG,GAAG,CAAC;AAC7B,CAAC;AAED,+HAA+H;AAC/H,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,mBAAmB;IAEM;IAA8B;IADlD,UAAU,GAAG,IAAI,CAAC;IAC3B,YAA6B,GAAW,EAAmB,KAAa;QAA3C,QAAG,GAAH,GAAG,CAAQ;QAAmB,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAEpE,KAAK,CAAC,IAAI,CAAC,OAA4B;QAC7C,4DAA4D;QAC5D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;gBACrC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA0C,CAAC;QACtE,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAuB,EAAE,UAAU,GAAG,WAAW;QACzD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;YACzF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc;QACtB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACvD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAmB,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc;QACtB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAAE,OAAO;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;CACF;AAED,MAAM,gBAAgB;IACX,UAAU,GAAG,KAAK,CAAC;IAC5B,KAAK,CAAC,GAAG,KAA6B,OAAO,IAAI,CAAC,CAAC,CAAC;IACpD,KAAK,CAAC,GAAG,KAAqC,OAAO,IAAI,CAAC,CAAC,CAAC;IAC5D,KAAK,CAAC,GAAG,KAAgC,CAAC;CAC3C;AAED,MAAM,UAAU,kBAAkB,CAAC,GAGlC;IACC,MAAM,GAAG,GAAG,GAAG,CAAC,sBAAsB,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,wBAAwB,CAAC;IAC3C,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,gBAAgB,EAAE,CAAC;IAClD,OAAO,IAAI,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC"}

package/build/tools/action.d.ts

@@ -1,4 +1,22 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { SessionStore } from "../services/sessionStore.js";
-export declare function actionTool(server: McpServer, sessionStore: SessionStore): void;
+/**
+ * Server profile. "full" is the everyday server at /mcp. "directory" is the
+ * variant listed in Anthropic's directory, whose review rules do not accept
+ * connectors that generate images, video or audio through AI models: those
+ * three routes are hidden from the quick reference and refused at call time.
+ */
+export type ServerProfile = "full" | "directory";
+/**
+ * Maps friendly MCP action paths to real Worker API endpoints.
+ * Some actions need body-to-URL rewriting (e.g. react needs artifact ID in the path).
+ */
+interface ResolvedEndpoint {
+    path: string;
+    body?: Record<string, unknown>;
+    plainText?: string;
+}
+export declare function resolveEndpoint(endpoint: string, body?: Record<string, unknown>): ResolvedEndpoint;
+export declare function actionTool(server: McpServer, sessionStore: SessionStore, profile?: ServerProfile, legacyJwt?: boolean): void;
+export {};
 //# sourceMappingURL=action.d.ts.map

package/build/tools/action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../src/tools/action.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AA0LhE,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,GAAG,IAAI,CA6K9E"}
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../src/tools/action.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAMhE;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,WAAW,CAAC;AAcjD;;;GAGG;AACH,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,gBAAgB,CAqGlB;AAsDD,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,GAAE,aAAsB,EAAE,SAAS,UAAO,GAAG,IAAI,CA0KjI"}