[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_456":457,"_458":459},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_342":-5,"_20":343,"_22":344,"_345":346,"_347":348,"_25":349,"_24":-5,"_350":-5,"_351":-5,"_352":55,"_353":354,"_355":46,"_356":-5,"_357":-5,"_358":359},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","c15r","name","ContextualLite","branchName","main","version","path","","project",{"_35":289,"_13":14,"_47":290,"_291":-5,"_292":55,"_293":294,"_295":294,"_296":-5,"_297":-5,"_298":299,"_300":39,"_301":46,"_302":46,"_303":-5,"_304":71,"_305":306,"_307":-5,"_308":-5,"_309":-5,"_310":-5,"_311":312,"_313":312,"_314":315,"_316":315,"_317":315,"_318":312,"_319":312,"_320":321,"_322":323,"_324":325,"_326":55},"tree",[74,75,76],"file","contents",[32,33,34],"upstream","pull","ahead","behind","envVars",{"_35":66,"_13":67,"_38":68,"_40":-5,"_41":42,"_43":69,"_45":46,"_47":70,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_18":73},{"_35":58,"_13":59,"_38":60,"_40":-5,"_41":42,"_43":61,"_45":46,"_47":62,"_17":63,"_50":24,"_52":64,"_54":55,"_56":-5,"_18":65},{"_35":36,"_13":37,"_38":39,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":48,"_17":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_18":57},"id","f7398b46-59de-11f0-b916-f69ea79377d9","index.ts","fileId","6e010d7c-45d4-11f0-a0c9-76b3cceeab13","parentId","branchId","c5966aa0-4557-11f0-999b-76b3cceeab13","branchVersion",445,"latest",true,"createdAt",["D",1751747461372],41,"fileType","http","content","/**\n * Remote HTTP Model Context Protocol (MCP) Server\n * Uses streamable HTTP transport with raw Web API\n * Exposes prompts, S3 resources, and tools for DynamoDB/S3 operations\n */\n\nimport { AuthManager, ExtendedAuthContext } from \"./src/auth/auth-manager.ts\";\nimport { MCPHandler } from \"./src/mcp/handler.ts\";\n\n// Environment variables\nconst MCP_SERVER_NAME = Deno.env.get(\"MCP_SERVER_NAME\") || \"aws-mcp-server\";\nconst MCP_SERVER_VERSION = Deno.env.get(\"MCP_SERVER_VERSION\") || \"1.0.0\";\n\nconst mcpHandler = new MCPHandler();\nconst authManager = new AuthManager();\n\n// Authentication function for MCP requests\nfunction authenticateRequest(request: Request): string | null {\n const authHeader = request.headers.get(\"Authorization\");\n\n if (!authHeader || !authHeader.startsWith(\"Bearer \")) {\n return null;\n }\n\n const awsSecretAccessKey = authHeader.substring(7); // Remove \"Bearer \" prefix\n\n if (!awsSecretAccessKey) {\n return null;\n }\n\n return awsSecretAccessKey;\n}\n\n// Create JSON-RPC error response\nfunction createErrorResponse(id: any, code: number, message: string): Response {\n return new Response(\n JSON.stringify({\n jsonrpc: \"2.0\",\n id,\n error: {\n code,\n message,\n },\n }),\n {\n status: code === -32001 ? 401 : 400,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization\",\n },\n },\n );\n}\n\n// Main request handler using raw Web API\nexport default async function handler(request: Request): Promise {\n const url = new URL(request.url);\n const pathname = url.pathname;\n\n // Handle CORS preflight requests\n if (request.method === \"OPTIONS\") {\n return new Response(null, {\n status: 200,\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization\",\n },\n });\n }\n\n // Only handle POST requests to /mcp\n if (pathname !== \"/mcp\" || request.method !== \"POST\") {\n console.error(`[Server] Invalid request: ${request.method} ${pathname}`);\n return new Response(\n JSON.stringify(\n {\n error: \"Only POST requests to /mcp are supported\",\n note: \"This server only supports the MCP JSON-RPC endpoint at POST /mcp\",\n },\n null,\n 2,\n ),\n {\n status: 404,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n },\n );\n }\n\n try {\n // Parse request body\n const body = await request.json();\n\n // Resolve authentication context\n const authContext: ExtendedAuthContext = authManager.resolveAuthContext(request);\n\n // Check if this is a notification request\n const isNotification = body?.method?.startsWith(\"notifications/\");\n\n if (isNotification) {\n console.warn(`[Server] Notification request: ${request.method} ${pathname}`);\n return new Response(null, {\n status: 202,\n headers: {\n // \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization\",\n },\n });\n }\n\n // Check if this is an admin-only operation\n const isAdminOperation = body?.params?.name?.startsWith(\"admin-\");\n \n // Admin operations require valid authentication\n if (isAdminOperation && authContext.isDemo) {\n return createErrorResponse(\n body?.id || null,\n -32001,\n \"Admin operations require authentication. Expected: Bearer \",\n );\n }\n\n // All other operations are allowed in demo mode with limited capabilities\n\n // Connect and handle the request using streamable HTTP transport\n const response = await mcpHandler.handleStreamableRequest(request, body, authContext);\n\n return new Response(JSON.stringify(response), {\n status: 200,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization\",\n },\n });\n } catch (error) {\n console.error(`[Server] Error:`, error);\n\n // Try to get request ID from body if possible\n let requestId = null;\n try {\n const body = await request.clone().json();\n requestId = body?.id || null;\n } catch {\n // Ignore parsing errors for error response\n }\n\n return createErrorResponse(\n requestId,\n -32700,\n \"Parse error: Invalid JSON-RPC request\",\n );\n }\n}","deleted",false,"label",[37],"e8541cdc-5ea6-11f0-8d73-0224a6c84d84","README.md","929abcdc-45d4-11f0-a87c-76b3cceeab13",560,["D",1752273140378],75,"# Remote HTTP AWS MCP Server\n\nA remote HTTP Model Context Protocol (MCP) server that provides access to AWS services including DynamoDB and S3. This server now uses the official MCP SDK for JSON-RPC handling and exposes prompts, resources, and tools via both JSON-RPC and legacy HTTP endpoints with bearer token authentication.\n\n## Project Structure\n\nThe codebase is organized into a clean, modular structure:\n\n```\n├── index.ts # Main HTTP entry point\n├── src/\n│ ├── auth/\n│ │ └── auth-manager.ts # Authentication and namespace management\n│ ├── aws/\n│ │ └── clients.ts # AWS client configuration utilities\n│ ├── mcp/\n│ │ ├── handler.ts # Main MCP request handler\n│ │ └── protocol-handlers.ts # MCP protocol-specific handlers (prompts, resources)\n│ ├── storage/\n│ │ ├── kv-store.ts # Namespaced DynamoDB key-value store\n│ │ └── files-store.ts # Namespaced S3 files store\n│ ├── tools/\n│ │ ├── definitions.ts # Tool schema definitions\n│ │ └── handlers/\n│ │ ├── index.ts # Unified tool handlers export\n│ │ ├── kv-tools.ts # Key-value store tool handlers\n│ │ ├── files-tools.ts # Files store tool handlers\n│ │ ├── code-tools.ts # Code execution tool handlers\n│ │ └── openai-tools.ts # OpenAI API tool handlers\n│ └── valtown/\n│ └── client.ts # Val Town API client (for admin features)\n└── README.md\n```\n\nThis modular structure provides:\n- **Separation of concerns**: Each component has a single responsibility\n- **Easy testing**: Individual components can be tested in isolation\n- **Maintainability**: Changes to one area don't affect others\n- **Extensibility**: New tools and handlers can be easily added\n\n## Features\n\n### JSON-RPC Endpoint (Recommended)\n- **POST /mcp**: Primary JSON-RPC endpoint using MCP SDK for all operations\n- Supports all MCP operations: prompts, resources, and tools\n- Proper JSON-RPC 2.0 protocol compliance\n- Batch request support\n\n### HTTP Endpoints\n- **GET /**: Server information and capabilities\n- **GET /health**: Health check endpoint\n\n### Authentication\n\n- Uses Bearer token authentication\n- AWS_SECRET_ACCESS_KEY is passed via `Authorization: Bearer ` header\n- Other AWS credentials are configured via environment variables\n- **User Isolation**: Each bearer token creates an isolated namespace for data storage\n - KV Store operations are automatically namespaced per user\n - Files Store operations are automatically namespaced per user\n - Resources (file listings) are automatically filtered per user namespace\n- **Demo Mode**: Requests without valid authentication use a shared \"demo\" namespace with limited capabilities\n- **Admin Mode**: When the bearer token matches the AWS_SECRET_ACCESS_KEY environment variable, the system enters \"admin mode\" with access to:\n - All regular user tools and operations within the user's own namespace\n - Special admin tools for managing system-wide skills\n - Enhanced administration features\n - **Important**: Admin mode preserves the original user's namespace instead of switching to a separate \"admin\" namespace, ensuring consistent data access across modes\n\n### Prompts\n- **analyze-data**: Analyze data from DynamoDB and S3 resources\n- **data-summary**: Generate a summary of available data sources\n\n### Resources\n- **Files**: Access and read files from your personal file store\n- Automatic MIME type detection\n- File metadata (size, last modified, version information)\n- Namespace isolation per user\n\n### Tools\n\n#### Key-Value Store Operations (Namespaced)\n- **kv-get**: Get a value by key from your personal key-value store\n- **kv-put**: Store a key-value pair in your personal key-value store\n- **kv-delete**: Delete a key-value pair from your personal key-value store\n- **kv-list**: List keys in your personal key-value store with optional prefix filter\n- **kv-query**: Query key-value pairs by key pattern from your personal key-value store\n\n#### Files Store Operations (Namespaced)\n- **files-get**: Get a file by key from your personal file store (supports versioning)\n- **files-put**: Store a file in your personal file store\n- **files-delete**: Delete a file from your personal file store (supports version-specific deletion)\n- **files-list**: List files in your personal file store with optional prefix filter\n- **files-list-versions**: List all versions of files in your personal file store\n- **files-move**: Move/rename a file within your personal file store\n- **files-copy**: Copy a file within your personal file store\n- **files-exists**: Check if a file exists in your personal file store\n- **files-metadata**: Get metadata for a file in your personal file store (supports versioning)\n\n#### Code Execution\n- **code-exec**: Execute JavaScript/TypeScript code with access to all MCP tools. Supports both legacy function format and ES6 module format. Code can be provided directly as a string or referenced via files store key\n\n#### Skill Management\n- **register-skill**: Register a stored code file as a reusable skill tool. By default registers as ES6 module. ES6 modules can export inputSchema, getPrompts, and metadata. Legacy skills require explicit moduleType='legacy'\n- **unregister-skill**: Remove a previously registered skill\n- **list-skills**: List all registered skills for the current user\n- **[user-skills]**: Dynamically registered skills appear as individual tools with their own schemas\n\n#### Admin Tools (Admin Mode Only)\n- **admin-promote-skill**: Promote an existing user skill to system-wide availability (admin only). If userNamespace is not provided, promotes from the current user's namespace.\n- **admin-demote-skill**: Remove system-wide availability of a promoted skill (admin only)\n- **admin-list-promoted-skills**: List all skills that have been promoted to system-wide availability (admin only)\n- **admin-update-promoted-skill**: Update a promoted skill with the latest version from its original user (admin only)\n- **admin-read-val-file**: Read a source code file from the project using Val Town API (admin only)\n- **admin-write-val-file**: Write/update a source code file in the project using Val Town API (admin only)\n- **admin-list-val-files**: List all files in the project directory structure using Val Town API (admin only)\n- **admin-project-info**: Get project information and structure overview using Val Town API (admin only)\n\n#### OpenAI API Tools\n- **openai-chat-completion**: Create chat completions using OpenAI's API via Val Town's built-in OpenAI integration (supports GPT-4, GPT-3.5, and other models)\n\n## OpenAI Integration\n\nThe server includes OpenAI chat completion functionality using Val Town's built-in OpenAI integration. This provides seamless access to OpenAI's models without requiring additional API key configuration.\n\n### Example Usage\n\n```bash\n# Simple chat completion\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"openai-chat-completion\",\n \"arguments\": {\n \"messages\": [\n {\"role\": \"user\", \"content\": \"Say hello in a creative way\"}\n ],\n \"model\": \"gpt-4o-mini\",\n \"max_tokens\": 30\n }\n },\n \"id\": 1\n }'\n\n# Chat with system prompt\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"openai-chat-completion\",\n \"arguments\": {\n \"messages\": [\n {\"role\": \"system\", \"content\": \"You are a helpful assistant.\"},\n {\"role\": \"user\", \"content\": \"Explain quantum computing in simple terms.\"}\n ],\n \"model\": \"gpt-4o-mini\",\n \"max_tokens\": 500,\n \"temperature\": 0.7\n }\n },\n \"id\": 1\n }'\n```\n\n## Code Execution Feature\n\nThe `code-exec` tool allows you to execute JavaScript/TypeScript code with full access to all MCP tools (KV store and Files store operations). This enables powerful automation and data processing workflows.\n\n## Skill Management System\n\nThe skill management system allows you to register stored code files as reusable tools with custom input schemas. The system supports both user-specific skills and system-wide skills managed by administrators.\n\n#### Promotion-Based System Skills\n\nThe system uses a **promotion-based approach** for system skills, which simplifies management and ensures consistency:\n\n1. **User Skills First**: Users create and test skills in their personal namespace using `register-skill`\n2. **Promote to System**: Admins can promote proven user skills to system-wide availability using `admin-promote-skill`\n3. **File Isolation**: When promoting, the skill file is copied to the system folder (`system/skills/skillName.js`) to ensure complete isolation from the original user's namespace\n4. **Automatic Sync**: Promoted skills maintain a link to their original user skill for easy updates via `admin-update-promoted-skill`\n5. **No Namespace Confusion**: System skills execute using files from the system folder, eliminating namespace-related execution issues\n\n#### Benefits of Promotion-Based Approach:\n- ✅ **No Duplication**: Promote existing user skills directly without re-entering metadata\n- ✅ **Consistency**: System skills are always based on actual tested user skills\n- ✅ **Simplicity**: Single source of truth for skill definitions\n- ✅ **Maintenance**: Easy to update promoted skills from their source\n- ✅ **Audit Trail**: Clear tracking of who created and promoted each skill\n- ✅ **Isolation**: Complete file isolation prevents namespace-related execution failures\n\n### Skill Types\n\n#### User Skills\n- **Scope**: Personal to each user\n- **Registration**: Use `register-skill` tool\n- **Override**: User skills can override system skills with the same name\n- **Namespace**: Stored with user-specific namespace isolation\n\n#### System Skills (Admin Only)\n- **Scope**: Available to all users\n- **Registration**: Use `admin-promote-skill` tool to promote existing user skills\n- **Management**: Only administrators can promote, demote, or update system skills\n- **Priority**: User skills take precedence over system skills with the same name\n- **Promotion**: Promoted skills maintain a link to their original user for easy updates\n\n### System Folder\n\nThe system includes a \"system\" folder that provides:\n- **Read access** for all users to view system resources\n- **Write access** for administrators in admin mode only\n- **Shared storage** for system-wide files and resources\n\nSystem files are stored with the `system/` prefix and are accessible to all users but can only be modified by administrators.\n\n### Skill Resolution Priority\n\nWhen a skill is called, the system resolves it in this order:\n1. **User Skills**: Check if the user has registered a skill with that name\n2. **System Skills**: Fall back to system-wide skills if no user skill exists\n3. **Error**: Return \"skill not found\" if neither exists\n\n### Admin Skill Management (Admin Mode Only)\n\nAdministrators can promote user skills to system-wide availability using the promotion-based approach:\n\n#### Promotion Workflow Example:\n\n```json\n{\n \"userNamespace\": \"user123\",\n \"skillName\": \"data-analyzer\",\n \"description\": \"Analyzes data from KV store and generates reports (promoted from user123)\"\n}\n```\n\n#### Admin Promotion Tools\n\n- **admin-promote-skill**: Promote an existing user skill to system-wide availability\n- **admin-demote-skill**: Remove system-wide availability of a promoted skill \n- **admin-list-promoted-skills**: List all promoted skills with source information\n- **admin-update-promoted-skill**: Update promoted skills from their original source\n\n### Skill Management Tools\n\n- **register-skill**: Register a new skill from a files store key\n- **unregister-skill**: Remove a registered skill\n- **list-skills**: List all your registered skills\n\n### Using Registered Skills\n\nOnce registered, skills appear in the tools list and can be called directly:\n\n```json\n{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"data-analyzer\",\n \"arguments\": {\n \"dataKey\": \"user-data-2024\",\n \"reportType\": \"detailed\"\n }\n },\n \"id\": 1\n}\n```\n\n### Dynamic Prompt System\n\nSkills can expose prompts that are evaluated dynamically at runtime, allowing for context-aware prompt generation:\n\n#### ES6 Module Prompt Interface\n\n```javascript\n// The getPrompts function receives the tools context for dynamic evaluation\nexport const getPrompts = (tools) => {\n return [\n {\n name: \"prompt-name\",\n description: \"Description of the prompt\",\n arguments: [ // Must match base prompt argument structure\n {\n name: \"arg1\",\n description: \"Argument description\",\n required: true // Optional boolean field\n }\n ],\n // Content can be static string or async function\n content: async (args) => {\n // Dynamic content generation with access to tools\n const data = await tools[\"kv-get\"]({key: args.key});\n return `Analyze this data: ${JSON.stringify(data)}`;\n }\n },\n {\n name: \"static-prompt\",\n description: \"A static prompt\",\n arguments: [], // Empty array for no arguments\n content: \"This is static content\"\n }\n ];\n};\n```\n\n#### Prompt Structure Requirements:\n\n**Required Fields:**\n- `name` (string): Unique prompt identifier\n- `description` (string): Human-readable description\n\n**Optional Fields:**\n- `arguments` (array): Array of argument definitions, each with:\n - `name` (string): Argument name\n - `description` (string): Argument description \n - `required` (boolean, optional): Whether argument is required\n- `content` (string | function): Static content or async function for dynamic generation\n\n#### Key Features:\n\n- **Runtime Evaluation**: `getPrompts()` is called at runtime, not registration time\n- **Tools Access**: The function receives the tools context for dynamic data access\n- **Flexible Content**: Prompt content can be static strings or async functions\n- **Dynamic Arguments**: Prompts can be generated based on current system state\n- **Context Awareness**: Access to user's data and system state when generating prompts\n\n#### Prompt Content Types:\n\n1. **Static String**: Simple text content that doesn't change\n2. **Async Function**: Dynamic content generation with access to:\n - User arguments passed to the prompt\n - Full tools context (KV store, files, etc.)\n - Current system state\n\n### Code Requirements\n\nSkills can be written in two formats:\n\n#### ES6 Module Format (Recommended - Default)\n\nYour code should be an ES6 module that exports the required functions:\n\n```javascript\n// Required: Main execution function\nexport const execute = async (input, tools) => {\n // Your skill logic here\n const result = await tools[\"kv-get\"]({key: input.key});\n return { message: \"Processing complete\", data: result };\n};\n\n// Optional: Input schema definition\nexport const inputSchema = {\n type: \"object\",\n properties: {\n key: {\n type: \"string\",\n description: \"The key to process\"\n }\n },\n required: [\"key\"]\n};\n\n// Optional: Prompts exposed by this skill (evaluated dynamically at runtime)\nexport const getPrompts = (tools) => {\n return [\n {\n name: \"analyze-key\",\n description: \"Analyze a specific key from storage\",\n arguments: [\n {\n name: \"key\",\n description: \"Key to analyze\",\n required: true\n }\n ],\n content: async (args) => {\n // Dynamic content generation using tools context\n const data = await tools[\"kv-get\"]({key: args.key});\n return `Please analyze this data: ${JSON.stringify(data)}`;\n }\n },\n {\n name: \"static-prompt\",\n description: \"A static prompt example\",\n arguments: [], // No arguments required\n content: \"This is a static prompt content\"\n }\n ];\n};\n\n// Optional: Additional metadata\nexport const metadata = {\n version: \"1.0.0\",\n author: \"username\",\n tags: [\"data\", \"analysis\"]\n};\n```\n\n#### Legacy Function Format\n\nFor backward compatibility, you can still use the legacy function format by explicitly setting `moduleType: \"legacy\"`:\n\n```javascript\nasync function execute(input, tools) {\n // Your code logic here\n const result = await tools[\"kv-get\"]({key: input.key});\n return { message: \"Processing complete\", data: result };\n}\n```\n\n**Note**: Legacy format requires `inputSchema` to be provided during registration and cannot expose prompts.\n\n### Available Tools in Code Context\n\nWithin your executed code, you have access to all MCP tools via the `tools` object:\n- `tools[\"kv-get\"](args)` - Get from your personal key-value store\n- `tools[\"kv-put\"](args)` - Put to your personal key-value store \n- `tools[\"kv-delete\"](args)` - Delete from your personal key-value store\n- `tools[\"kv-list\"](args)` - List keys in your personal key-value store\n- `tools[\"kv-query\"](args)` - Query your personal key-value store\n- `tools[\"files-get\"](args)` - Get file from your personal file store\n- `tools[\"files-put\"](args)` - Put file to your personal file store\n- `tools[\"files-delete\"](args)` - Delete file from your personal file store\n- `tools[\"files-list\"](args)` - List files in your personal file store\n- `tools[\"files-list-versions\"](args)` - List file versions in your personal file store\n- `tools[\"files-move\"](args)` - Move file in your personal file store\n- `tools[\"files-copy\"](args)` - Copy file in your personal file store\n- `tools[\"files-exists\"](args)` - Check if file exists in your personal file store\n- `tools[\"files-metadata\"](args)` - Get file metadata from your personal file store\n- `tools[\"openai-chat-completion\"](args)` - Create OpenAI chat completions\n\n### Two Execution Modes\n\n#### 1. Direct Code Execution\nProvide the code directly in the request:\n\n```json\n{\n \"code\": \"async function execute(input, tools) { /* your code */ }\",\n \"input\": { \"param1\": \"value1\" }\n}\n```\n\n#### 2. Files Store Code Execution \nStore your code in your personal file store and reference it by key:\n\n```json\n{\n \"key\": \"scripts/my-processor.js\",\n \"input\": { \"param1\": \"value1\" }\n}\n```\n\nThis approach is ideal for:\n- Reusable scripts and workflows\n- Version control of automation code (files store supports versioning)\n- Sharing scripts across different executions\n- Complex multi-function scripts\n- Personal script libraries isolated per user\n\n### Security Considerations\n\n- Code execution runs in a sandboxed environment\n- No access to global objects or external network calls\n- Only MCP tools are available for external operations\n- All AWS operations use the same authentication as other MCP tools\n\n## Setup\n\n### Environment Variables\n\nSet the following environment variables on your Val Town:\n\n```bash\nAWS_REGION=us-east-1\nAWS_ACCESS_KEY_ID=your-access-key-id\nS3_BUCKET=your-bucket-name\nDYNAMODB_TABLE=your-table-name\nMCP_SERVER_NAME=aws-mcp-server\nMCP_SERVER_VERSION=1.0.0\n```\n\n**Note**: `AWS_SECRET_ACCESS_KEY` is NOT set as an environment variable. Instead, it's passed via the Authorization header for security.\n\n**OpenAI Integration**: OpenAI functionality uses Val Town's built-in OpenAI integration, which automatically handles API key management. No additional environment variables are required for OpenAI tools.\n\n### DynamoDB Table Schema\n\nThe KV Store requires a DynamoDB table with the following schema:\n\n**Table Configuration:**\n- **Partition Key**: `pk` (String) - Contains the user namespace\n- **Sort Key**: `sk` (String) - Contains the user's key\n- **Billing Mode**: On-demand or Provisioned (your choice)\n- **TTL**: Optional - Set TTL attribute to `ttl` if you want automatic expiration\n\n**Example AWS CLI command to create the table:**\n```bash\naws dynamodb create-table \\\n --table-name your-table-name \\\n --attribute-definitions \\\n AttributeName=pk,AttributeType=S \\\n AttributeName=sk,AttributeType=S \\\n --key-schema \\\n AttributeName=pk,KeyType=HASH \\\n AttributeName=sk,KeyType=RANGE \\\n --billing-mode PAY_PER_REQUEST\n```\n\n**Example CloudFormation template:**\n```yaml\nDynamoDBTable:\n Type: AWS::DynamoDB::Table\n Properties:\n TableName: your-table-name\n AttributeDefinitions:\n - AttributeName: pk\n AttributeType: S\n - AttributeName: sk\n AttributeType: S\n KeySchema:\n - AttributeName: pk\n KeyType: HASH\n - AttributeName: sk\n KeyType: RANGE\n BillingMode: PAY_PER_REQUEST\n TimeToLiveSpecification:\n AttributeName: ttl\n Enabled: true\n```\n\n**Data Structure:**\nEach item in the table has the following structure:\n- `pk` (String): User namespace (e.g., \"user123\", \"demo\")\n- `sk` (String): User's key (e.g., \"settings\", \"config-app\")\n- `data` (Any): The actual value stored by the user\n- `created` (String): ISO timestamp when item was created\n- `updated` (String): ISO timestamp when item was last updated\n- `ttl` (Number, Optional): Unix timestamp for automatic expiration\n\n### Deployment\n\n1. Deploy to Val Town as an HTTP val\n2. Set the required environment variables\n3. The server will be available at your Val Town URL\n\n## Usage Examples\n\n### JSON-RPC Endpoint (Recommended)\n\nAll MCP operations should now use the JSON-RPC endpoint at `POST /mcp`. This provides proper MCP protocol compliance and better error handling.\n\n#### Authentication\n\nAll authenticated requests require the Authorization header:\n\n```bash\nAuthorization: Bearer your-aws-secret-access-key\n```\n\n#### List Prompts\n\n```bash\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"prompts/list\",\n \"params\": {},\n \"id\": 1\n }'\n```\n\n#### Get Prompt Content\n\n```bash\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"prompts/get\",\n \"params\": {\n \"name\": \"analyze-data\",\n \"arguments\": {\n \"table_key\": \"user123\",\n \"s3_key\": \"data/analytics.json\"\n }\n },\n \"id\": 1\n }'\n```\n\n#### List Resources (Files)\n\n```bash\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"resources/list\",\n \"params\": {},\n \"id\": 1\n }'\n```\n\n#### Read Files Resource\n\n```bash\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"resources/read\",\n \"params\": {\n \"uri\": \"files://path/to/file.txt\"\n },\n \"id\": 1\n }'\n```\n\n#### List Tools\n\n```bash\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/list\",\n \"params\": {},\n \"id\": 1\n }'\n```\n\n#### Execute Files Operations\n\n```bash\n# Store a file in your personal file store\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"files-put\",\n \"arguments\": {\n \"key\": \"documents/my-file.txt\",\n \"content\": \"Hello, World!\",\n \"contentType\": \"text/plain\"\n }\n },\n \"id\": 1\n }'\n\n# Get a file from your personal file store\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"files-get\",\n \"arguments\": {\n \"key\": \"documents/my-file.txt\"\n }\n },\n \"id\": 1\n }'\n\n# List files in your personal file store\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"files-list\",\n \"arguments\": {\n \"prefix\": \"documents/\"\n }\n },\n \"id\": 1\n }'\n\n# List all versions of a file\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"files-list-versions\",\n \"arguments\": {\n \"key\": \"documents/my-file.txt\"\n }\n },\n \"id\": 1\n }'\n\n# Get a specific version of a file\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"files-get\",\n \"arguments\": {\n \"key\": \"documents/my-file.txt\",\n \"versionId\": \"specific-version-id\"\n }\n },\n \"id\": 1\n }'\n\n# Copy a file within your personal file store\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"files-copy\",\n \"arguments\": {\n \"sourceKey\": \"documents/my-file.txt\",\n \"destinationKey\": \"backup/my-file-backup.txt\"\n }\n },\n \"id\": 1\n }'\n\n# Check if a file exists\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"files-exists\",\n \"arguments\": {\n \"key\": \"documents/my-file.txt\"\n }\n },\n \"id\": 1\n }'\n\n# Get file metadata\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"files-metadata\",\n \"arguments\": {\n \"key\": \"documents/my-file.txt\"\n }\n },\n \"id\": 1\n }'\n\n# Delete a file\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"files-delete\",\n \"arguments\": {\n \"key\": \"documents/my-file.txt\"\n }\n },\n \"id\": 1\n }'\n```\n\n#### Execute KV Store Operations\n\n```bash\n# Store a key-value pair in your personal store\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"kv-put\",\n \"arguments\": {\n \"key\": \"user-settings\",\n \"value\": {\"theme\": \"dark\", \"language\": \"en\"},\n \"ttl\": 3600\n }\n },\n \"id\": 1\n }'\n\n# Get a value from your personal store\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"kv-get\",\n \"arguments\": {\n \"key\": \"user-settings\"\n }\n },\n \"id\": 1\n }'\n\n# List keys in your personal store\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"kv-list\",\n \"arguments\": {\n \"prefix\": \"user-\"\n }\n },\n \"id\": 1\n }'\n\n# Query key-value pairs by pattern\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"kv-query\",\n \"arguments\": {\n \"keyPattern\": \"config*\"\n }\n },\n \"id\": 1\n }'\n```\n\n#### Execute Skill Management Operations\n\n```bash\n# Register an ES6 module skill (default)\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"register-skill\",\n \"arguments\": {\n \"name\": \"data-analyzer\",\n \"description\": \"Analyzes data from KV store and generates reports\",\n \"fileKey\": \"skills/data-analyzer.js\"\n }\n },\n \"id\": 1\n }'\n\n# Register a legacy function-based skill\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"register-skill\",\n \"arguments\": {\n \"name\": \"legacy-processor\",\n \"description\": \"Legacy data processor\",\n \"fileKey\": \"skills/legacy-processor.js\",\n \"moduleType\": \"legacy\",\n \"inputSchema\": {\n \"type\": \"object\",\n \"properties\": {\n \"dataKey\": {\n \"type\": \"string\",\n \"description\": \"Key of data to process\"\n }\n },\n \"required\": [\"dataKey\"]\n }\n }\n },\n \"id\": 1\n }'\n\n# List registered skills\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"list-skills\",\n \"arguments\": {}\n },\n \"id\": 1\n }'\n\n# Execute a registered skill\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"data-analyzer\",\n \"arguments\": {\n \"dataKey\": \"user-data-2024\",\n \"reportType\": \"detailed\"\n }\n },\n \"id\": 1\n }'\n\n# Unregister a skill\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"unregister-skill\",\n \"arguments\": {\n \"name\": \"data-analyzer\"\n }\n },\n \"id\": 1\n }'\n```\n\n#### Execute Admin Skill Promotion Operations\n\n```bash\n# Promote a skill from your own namespace (userNamespace inferred from auth context)\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"admin-promote-skill\",\n \"arguments\": {\n \"skillName\": \"data-analyzer\"\n }\n },\n \"id\": 1\n }'\n\n# Promote a skill from a specific user namespace\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"admin-promote-skill\",\n \"arguments\": {\n \"userNamespace\": \"user123\",\n \"skillName\": \"data-analyzer\"\n }\n },\n \"id\": 1\n }'\n\n# List all promoted skills\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"admin-list-promoted-skills\",\n \"arguments\": {}\n },\n \"id\": 1\n }'\n\n# Update a promoted skill with latest version from original user\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"admin-update-promoted-skill\",\n \"arguments\": {\n \"skillName\": \"data-analyzer\"\n }\n },\n \"id\": 1\n }'\n\n# Demote a skill from system-wide availability\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"admin-demote-skill\",\n \"arguments\": {\n \"skillName\": \"data-analyzer\"\n }\n },\n \"id\": 1\n }'\n\n# List all system skills (both promoted and directly registered)\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"admin-list-system-skills\",\n \"arguments\": {}\n },\n \"id\": 1\n }'\n```\n\n#### Execute Admin File Operations\n\n```bash\n# Read a project source file using Val Town API (admin only)\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"admin-read-val-file\",\n \"arguments\": {\n \"path\": \"src/auth/auth-manager.ts\"\n }\n },\n \"id\": 1\n }'\n\n# Write/update a project source file using Val Town API (admin only)\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"admin-write-val-file\",\n \"arguments\": {\n \"path\": \"src/config/new-config.ts\",\n \"content\": \"export const config = { version: \\\"1.0.0\\\" };\"\n }\n },\n \"id\": 1\n }'\n\n# List project files recursively using Val Town API (admin only)\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"admin-list-val-files\",\n \"arguments\": {\n \"path\": \"/src\",\n \"recursive\": true\n }\n },\n \"id\": 1\n }'\n\n# Get comprehensive project information using Val Town API (admin only)\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"admin-project-info\",\n \"arguments\": {}\n },\n \"id\": 1\n }'\n```\n\n#### Execute Code Operations\n\n```bash\n# Execute code directly (inline)\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"code-exec\",\n \"arguments\": {\n \"code\": \"async function execute(input, tools) { const result = await tools[\\\"kv-get\\\"]({key: input.key}); return {message: \\\"Data retrieved\\\", data: result}; }\",\n \"input\": {\n \"key\": \"user-settings\"\n },\n \"moduleType\": \"legacy\"\n }\n },\n \"id\": 1\n }'\n\n# Execute code from files store\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '{\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/call\",\n \"params\": {\n \"name\": \"code-exec\",\n \"arguments\": {\n \"key\": \"scripts/data-processor.js\",\n \"input\": {\n \"operation\": \"analyze\"\n },\n \"moduleType\": \"es6\"\n }\n },\n \"id\": 1\n }'\n```\n\n#### Batch Requests\n\nYou can send multiple JSON-RPC requests in a single HTTP request:\n\n```bash\ncurl -X POST https://your-val-town-url.web.val.run/mcp \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer your-aws-secret-access-key\" \\\n -d '[\n {\n \"jsonrpc\": \"2.0\",\n \"method\": \"prompts/list\",\n \"params\": {},\n \"id\": 1\n },\n {\n \"jsonrpc\": \"2.0\",\n \"method\": \"tools/list\",\n \"params\": {},\n \"id\": 2\n },\n {\n \"jsonrpc\": \"2.0\",\n \"method\": \"resources/list\",\n \"params\": {},\n \"id\": 3\n }\n ]'\n```\n\n### HTTP Endpoints\n\n#### Server Information\n\n```bash\ncurl https://your-val-town-url.web.val.run/\n```\n\n#### Health Check\n\n```bash\ncurl https://your-val-town-url.web.val.run/health\n```\n\nResponse:\n```json\n{\n \"status\": \"healthy\",\n \"timestamp\": \"2024-01-01T00:00:00.000Z\"\n}\n```\n\n## MCP Client Integration\n\nTo integrate with MCP clients like Claude Desktop, you can create a client that makes JSON-RPC requests to the `/mcp` endpoint. Here's an example configuration:\n\n```json\n{\n \"mcpServers\": {\n \"aws-http-mcp-server\": {\n \"command\": \"node\",\n \"args\": [\"mcp-http-client.js\"],\n \"env\": {\n \"MCP_SERVER_URL\": \"https://your-val-town-url.web.val.run\",\n \"AWS_SECRET_ACCESS_KEY\": \"${AWS_SECRET_ACCESS_KEY}\"\n }\n }\n }\n}\n```\n\n## JSON-RPC Response Format\n\n### Success Response\n```json\n{\n \"jsonrpc\": \"2.0\",\n \"result\": {\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"Response content here\"\n }\n ]\n },\n \"id\": 1\n}\n```\n\n### Error Response\n```json\n{\n \"jsonrpc\": \"2.0\",\n \"error\": {\n \"code\": -32603,\n \"message\": \"Error message description\"\n },\n \"id\": 1\n}\n```\n\n## JSON-RPC Error Codes\n\n- `-32700`: Parse error (Invalid JSON)\n- `-32600`: Invalid Request\n- `-32601`: Method not found\n- `-32602`: Invalid params\n- `-32603`: Internal error\n- `-32001`: Authentication error (custom)\n\n## Security Considerations\n\n- **Bearer Token Authentication**: AWS_SECRET_ACCESS_KEY is passed via Authorization header, not stored in environment variables\n- **HTTPS Only**: Always use HTTPS in production to protect the bearer token\n- **IAM Permissions**: Use IAM roles with minimal required permissions\n- **Token Rotation**: Regularly rotate your AWS secret access keys\n- **Rate Limiting**: Consider implementing rate limiting for production use\n\n## Required AWS Permissions\n\n### S3 Permissions\n```json\n{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"s3:GetObject\",\n \"s3:PutObject\",\n \"s3:DeleteObject\",\n \"s3:ListBucket\"\n ],\n \"Resource\": [\n \"arn:aws:s3:::your-bucket-name\",\n \"arn:aws:s3:::your-bucket-name/*\"\n ]\n }\n ]\n}\n```\n\n### DynamoDB Permissions\n```json\n{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"dynamodb:GetItem\",\n \"dynamodb:PutItem\",\n \"dynamodb:DeleteItem\",\n \"dynamodb:Query\"\n ],\n \"Resource\": \"arn:aws:dynamodb:region:account:table/your-table-name\"\n }\n ]\n}\n```\n\n**Note**: The KV Store uses DynamoDB Query operations with a composite key structure (partition key + sort key) for efficient namespace isolation and prefix matching. Scan operations are not required.\n\n## Error Handling\n\nThe server includes comprehensive error handling for:\n- Missing or invalid Authorization headers\n- AWS service errors\n- Invalid parameters\n- Network connectivity issues\n- JSON-RPC protocol errors\n\n### JSON-RPC Errors\nAll JSON-RPC errors follow the standard format with appropriate error codes.\n\n### HTTP Errors\nHTTP endpoints return errors with HTTP status codes:\n- `401`: Authentication errors\n- `400`: Bad request (invalid parameters)\n- `404`: Resource or tool not found\n- `500`: Server errors (AWS service errors, etc.)\n```",[59],"dfa62db2-482d-11f0-9ead-76b3cceeab13","src","53b7bdb3-6a5e-44df-afa8-213c578e7981",248,["D",1749802231134],0,"directory",[67],{"_35":66,"_13":67,"_38":68,"_40":-5,"_41":42,"_43":69,"_45":46,"_47":84,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":85,"_18":86},{"_35":58,"_13":59,"_38":60,"_40":-5,"_41":42,"_43":61,"_45":46,"_47":81,"_17":63,"_50":24,"_52":64,"_54":55,"_56":-5,"_78":82,"_18":83},{"_35":36,"_13":37,"_38":39,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":77,"_17":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_78":79,"_18":80},["D",1751747461372],"children",[],[37],["D",1752273140378],[],[59],["D",1749802231134],[87,88,89,90,91,92],[67],{"_35":272,"_13":273,"_38":274,"_40":68,"_41":42,"_43":275,"_45":46,"_47":276,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":277,"_18":278},{"_35":255,"_13":256,"_38":257,"_40":68,"_41":42,"_43":258,"_45":46,"_47":259,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":260,"_18":261},{"_35":228,"_13":229,"_38":230,"_40":68,"_41":42,"_43":231,"_45":46,"_47":232,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":233,"_18":234},{"_35":191,"_13":192,"_38":193,"_40":68,"_41":42,"_43":194,"_45":46,"_47":195,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":196,"_18":197},{"_35":111,"_13":112,"_38":113,"_40":68,"_41":42,"_43":114,"_45":46,"_47":115,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":116,"_18":117},{"_35":93,"_13":94,"_38":95,"_40":68,"_41":42,"_43":96,"_45":46,"_47":97,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":98,"_18":99},"be22fed8-490c-11f0-86a6-76b3cceeab13","valtown","eb9bc72c-0a73-4702-99de-ff29d53e0c02",315,["D",1749897952677],[100],[67,94],{"_35":101,"_13":102,"_38":103,"_40":95,"_41":42,"_43":104,"_45":46,"_47":105,"_17":106,"_50":107,"_52":108,"_54":55,"_56":-5,"_78":109,"_18":110},"a10af0cc-59cd-11f0-ab2e-f69ea79377d9","client.ts","be22ebfa-490c-11f0-86a6-76b3cceeab13",412,["D",1751740015343],4,"script","/**\n * Val Town API Client\n * Provides access to Val Town's API for reading project files and structure\n */\n\nexport interface ValTownFile {\n name: string;\n type: 'file' | 'directory';\n path: string;\n content?: string;\n size?: number;\n lastModified?: string;\n}\n\nexport interface ValTownProjectInfo {\n name: string;\n description?: string;\n files: ValTownFile[];\n environment?: Record;\n}\n\nexport class ValTownClient {\n private baseUrl: string;\n private apiToken?: string;\n\n constructor(apiToken?: string) {\n this.baseUrl = 'https://api.val.town';\n this.apiToken = apiToken;\n }\n\n /**\n * Get project information including file structure\n */\n async getProjectInfo(): Promise {\n try {\n // For now, we'll use the import.meta.url to determine the project structure\n // This is a placeholder implementation that would need to be replaced with actual Val Town API calls\n const projectUrl = import.meta.url;\n const projectName = this.extractProjectName(projectUrl);\n \n // Get file list using the listFiles utility\n const files = await this.listProjectFiles();\n \n return {\n name: projectName,\n description: 'Val Town MCP Server Project',\n files,\n environment: this.getEnvironmentInfo()\n };\n } catch (error) {\n throw new Error(`Failed to get project info: ${error.message}`);\n }\n }\n\n /**\n * Read a specific file from the project\n */\n async readFile(path: string): Promise {\n try {\n // Import the readFile utility from Val Town's standard library\n const { readFile } = await import(\"https://esm.town/v/std/utils@85-main/index.ts\");\n \n // Normalize path - ensure it starts with /\n const normalizedPath = path.startsWith('/') ? path : `/${path}`;\n \n const content = await readFile(normalizedPath, import.meta.url);\n return content;\n } catch (error) {\n if (error.message?.includes('not found') || error.message?.includes('ENOENT')) {\n throw new Error(`File not found: ${path}`);\n }\n throw new Error(`Failed to read file ${path}: ${error.message}`);\n }\n }\n\n /**\n * Write a file to the project (admin only)\n * Note: This is a placeholder implementation. Val Town doesn't currently provide\n * a writeFile utility in their standard library. This would need to be implemented\n * using Val Town's API or other mechanisms.\n */\n async writeFile(path: string, content: string): Promise {\n try {\n // Normalize path - ensure it starts with /\n const normalizedPath = path.startsWith('/') ? path : `/${path}`;\n \n // For now, this is a placeholder that would need to be implemented\n // with actual Val Town API calls or other mechanisms\n throw new Error(\"File writing is not yet implemented in Val Town's standard library. This feature requires direct API access.\");\n } catch (error) {\n throw new Error(`Failed to write file ${path}: ${error.message}`);\n }\n }\n\n /**\n * List all files in the project\n */\n async listProjectFiles(path: string = '/', recursive: boolean = false): Promise {\n try {\n // Import the listFiles utility from Val Town's standard library\n const { listFiles } = await import(\"https://esm.town/v/std/utils@85-main/index.ts\");\n \n const fileList = await listFiles(import.meta.url);\n \n // Convert the file list to our format\n const files: ValTownFile[] = [];\n \n for (const item of fileList) {\n // Handle the Val Town file object structure\n if (item && typeof item === 'object' && item.path) {\n const pathStr = item.path;\n const isDirectory = item.type === 'directory';\n const name = item.name || pathStr.split('/').pop() || pathStr;\n \n files.push({\n name,\n type: isDirectory ? 'directory' : 'file',\n path: pathStr.startsWith('/') ? pathStr : `/${pathStr}`\n });\n }\n }\n\n // Filter by path if specified\n if (path !== '/') {\n const normalizedPath = path.startsWith('/') ? path.substring(1) : path;\n const filtered = files.filter(file => {\n const filePath = file.path.startsWith('/') ? file.path.substring(1) : file.path;\n return filePath.startsWith(normalizedPath) && filePath !== normalizedPath;\n });\n return filtered;\n }\n\n // Apply recursive filtering if needed\n if (!recursive && path === '/') {\n // Only return top-level files and directories\n return files.filter(file => {\n const pathParts = file.path.substring(1).split('/').filter(part => part.length > 0);\n return pathParts.length === 1;\n });\n }\n\n return files;\n } catch (error) {\n throw new Error(`Failed to list files: ${error.message}`);\n }\n }\n\n /**\n * Check if a file exists in the project\n */\n async fileExists(path: string): Promise {\n try {\n await this.readFile(path);\n return true;\n } catch (error) {\n if (error.message?.includes('File not found')) {\n return false;\n }\n throw error;\n }\n }\n\n /**\n * Get file metadata\n */\n async getFileMetadata(path: string): Promise> {\n try {\n const content = await this.readFile(path);\n const name = path.split('/').pop() || path;\n \n return {\n name,\n type: 'file',\n path: path.startsWith('/') ? path : `/${path}`,\n size: content.length,\n lastModified: new Date().toISOString() // Val Town doesn't provide this, so use current time\n };\n } catch (error) {\n throw new Error(`Failed to get file metadata for ${path}: ${error.message}`);\n }\n }\n\n /**\n * Extract project name from import.meta.url\n */\n private extractProjectName(url: string): string {\n try {\n // Extract project name from Val Town URL pattern\n const match = url.match(/https:\\/\\/([^.]+)\\.web\\.val\\.run/);\n if (match) {\n return match[1];\n }\n \n // Fallback to generic name\n return 'val-town-project';\n } catch {\n return 'val-town-project';\n }\n }\n\n /**\n * Get environment information (non-sensitive)\n */\n private getEnvironmentInfo(): Record {\n const envVars = [\n 'AWS_REGION',\n 'S3_BUCKET',\n 'DYNAMODB_TABLE',\n 'MCP_SERVER_NAME',\n 'MCP_SERVER_VERSION'\n ];\n \n const env: Record = {};\n \n for (const key of envVars) {\n const value = Deno.env.get(key);\n env[key] = value || 'not set';\n }\n \n // Add sensitive keys as redacted\n const sensitiveKeys = ['AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY'];\n for (const key of sensitiveKeys) {\n const value = Deno.env.get(key);\n env[key] = value ? '[REDACTED]' : 'not set';\n }\n \n return env;\n }\n}",[],[67,94,102],"1d9b8a9a-482e-11f0-a175-76b3cceeab13","tools","8ca530fd-5572-459f-a5cb-36d769fb7219",252,["D",1749802335051],[118,119],[67,112],{"_35":129,"_13":130,"_38":131,"_40":113,"_41":42,"_43":132,"_45":46,"_47":133,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":134,"_18":135},{"_35":120,"_13":121,"_38":122,"_40":113,"_41":42,"_43":123,"_45":46,"_47":124,"_17":125,"_50":107,"_52":126,"_54":55,"_56":-5,"_78":127,"_18":128},"3e755ca8-5ea6-11f0-9508-0224a6c84d84","definitions.ts","1d9b767c-482e-11f0-a175-76b3cceeab13",553,["D",1752272855382],20,"/**\n * Tool definitions for the AWS MCP Server\n */\n\n// Key-Value Store Tools (Namespaced)\nexport const KV_TOOLS = [\n {\n name: \"kv-get\",\n description: \"Get a value by key from your personal key-value store\",\n inputSchema: {\n type: \"object\",\n properties: {\n key: {\n type: \"string\",\n description: \"The key to retrieve\",\n },\n },\n required: [\"key\"],\n },\n },\n {\n name: \"kv-put\",\n description: \"Store a key-value pair in your personal key-value store\",\n inputSchema: {\n type: \"object\",\n properties: {\n key: {\n type: \"string\",\n description: \"The key to store\",\n },\n value: {\n description: \"The value to store (can be any JSON-serializable data)\",\n },\n ttl: {\n type: \"number\",\n description: \"Optional time-to-live in seconds (data will be automatically deleted after this time)\",\n },\n },\n required: [\"key\", \"value\"],\n },\n },\n {\n name: \"kv-delete\",\n description: \"Delete a key-value pair from your personal key-value store\",\n inputSchema: {\n type: \"object\",\n properties: {\n key: {\n type: \"string\",\n description: \"The key to delete\",\n },\n },\n required: [\"key\"],\n },\n },\n {\n name: \"kv-list\",\n description: \"List keys in your personal key-value store with optional prefix filter\",\n inputSchema: {\n type: \"object\",\n properties: {\n prefix: {\n type: \"string\",\n description: \"Optional key prefix to filter by (e.g., 'user-' to list all keys starting with 'user-')\",\n },\n limit: {\n type: \"number\",\n description: \"Maximum number of keys to return (1-1000)\",\n default: 100,\n minimum: 1,\n maximum: 1000,\n },\n },\n },\n },\n {\n name: \"kv-query\",\n description: \"Query key-value pairs by key pattern from your personal key-value store\",\n inputSchema: {\n type: \"object\",\n properties: {\n keyPattern: {\n type: \"string\",\n description:\n \"Key pattern to match (supports prefix matching, e.g., 'config*' matches all keys starting with 'config')\",\n },\n limit: {\n type: \"number\",\n description: \"Maximum number of items to return (1-1000)\",\n default: 100,\n minimum: 1,\n maximum: 1000,\n },\n },\n required: [\"keyPattern\"],\n },\n },\n] as const;\n\n// Files Store Tools (Namespaced)\nexport const FILES_TOOLS = [\n {\n name: \"files-get\",\n description: \"Get a file by key from your personal file store\",\n inputSchema: {\n type: \"object\",\n properties: {\n key: {\n type: \"string\",\n description: \"The file key to retrieve\",\n },\n versionId: {\n type: \"string\",\n description: \"Optional version ID to retrieve a specific version\",\n },\n },\n required: [\"key\"],\n },\n },\n {\n name: \"files-put\",\n description: \"Store a file in your personal file store\",\n inputSchema: {\n type: \"object\",\n properties: {\n key: {\n type: \"string\",\n description: \"The file key to store\",\n },\n content: {\n type: \"string\",\n description: \"The file content to store\",\n },\n contentType: {\n type: \"string\",\n description: \"Optional content type (will be inferred from file extension if not provided)\",\n },\n metadata: {\n type: \"object\",\n description: \"Optional metadata key-value pairs to store with the file\",\n },\n },\n required: [\"key\", \"content\"],\n },\n },\n {\n name: \"files-delete\",\n description: \"Delete a file from your personal file store\",\n inputSchema: {\n type: \"object\",\n properties: {\n key: {\n type: \"string\",\n description: \"The file key to delete\",\n },\n versionId: {\n type: \"string\",\n description: \"Optional version ID to delete a specific version\",\n },\n },\n required: [\"key\"],\n },\n },\n {\n name: \"files-list\",\n description: \"List files in your personal file store with optional prefix filter\",\n inputSchema: {\n type: \"object\",\n properties: {\n prefix: {\n type: \"string\",\n description: \"Optional key prefix to filter by (e.g., 'documents/' to list all files in documents folder)\",\n },\n limit: {\n type: \"number\",\n description: \"Maximum number of files to return (1-1000)\",\n default: 100,\n minimum: 1,\n maximum: 1000,\n },\n },\n },\n },\n {\n name: \"files-list-versions\",\n description: \"List all versions of files in your personal file store\",\n inputSchema: {\n type: \"object\",\n properties: {\n key: {\n type: \"string\",\n description:\n \"Optional specific file key to list versions for (if not provided, lists versions for all files)\",\n },\n limit: {\n type: \"number\",\n description: \"Maximum number of versions to return (1-1000)\",\n default: 100,\n minimum: 1,\n maximum: 1000,\n },\n },\n },\n },\n {\n name: \"files-move\",\n description: \"Move/rename a file within your personal file store\",\n inputSchema: {\n type: \"object\",\n properties: {\n sourceKey: {\n type: \"string\",\n description: \"The source file key\",\n },\n destinationKey: {\n type: \"string\",\n description: \"The destination file key\",\n },\n },\n required: [\"sourceKey\", \"destinationKey\"],\n },\n },\n {\n name: \"files-copy\",\n description: \"Copy a file within your personal file store\",\n inputSchema: {\n type: \"object\",\n properties: {\n sourceKey: {\n type: \"string\",\n description: \"The source file key\",\n },\n destinationKey: {\n type: \"string\",\n description: \"The destination file key\",\n },\n },\n required: [\"sourceKey\", \"destinationKey\"],\n },\n },\n {\n name: \"files-exists\",\n description: \"Check if a file exists in your personal file store\",\n inputSchema: {\n type: \"object\",\n properties: {\n key: {\n type: \"string\",\n description: \"The file key to check\",\n },\n },\n required: [\"key\"],\n },\n },\n {\n name: \"files-metadata\",\n description: \"Get metadata for a file in your personal file store\",\n inputSchema: {\n type: \"object\",\n properties: {\n key: {\n type: \"string\",\n description: \"The file key to get metadata for\",\n },\n versionId: {\n type: \"string\",\n description: \"Optional version ID to get metadata for a specific version\",\n },\n },\n required: [\"key\"],\n },\n },\n] as const;\n\n// Code Execution Tools\nexport const CODE_TOOLS = [\n {\n name: \"code-exec\",\n description:\n \"Execute JavaScript/TypeScript code with access to all MCP tools. Supports both legacy function format (async function execute(input, tools)) and ES6 module format (export const execute). Code can be provided directly as a string or referenced via files store key.\",\n inputSchema: {\n type: \"object\",\n properties: {\n code: {\n type: \"string\",\n description: \"The JavaScript code to execute directly (mutually exclusive with 'key')\",\n },\n key: {\n type: \"string\",\n description: \"Files store key containing the code to execute (mutually exclusive with 'code')\",\n },\n input: {\n type: \"object\",\n description: \"Input parameters for the code execution\",\n },\n moduleType: {\n type: \"string\",\n enum: [\"legacy\", \"es6\"],\n default: \"legacy\",\n description: \"Execution mode: 'legacy' for function-based code with async execute(input, tools), 'es6' for ES6 modules with export const execute\",\n },\n },\n required: [\"input\"],\n },\n },\n {\n name: \"register-skill\",\n description:\n \"Register a stored code file as a reusable skill tool. By default, skills are registered as ES6 modules. ES6 modules should export: 'execute' (required function), 'inputSchema' (optional), 'getPrompts' (optional function that returns prompts dynamically at runtime), 'metadata' (optional). The getPrompts function receives tools context and can return prompts with content as either static strings or async functions. Legacy skills require explicit moduleType='legacy' and must define async function execute(input, tools).\",\n inputSchema: {\n type: \"object\",\n properties: {\n name: {\n type: \"string\",\n description: \"The name for the skill (will be used as the tool name)\",\n pattern: \"^[a-zA-Z][a-zA-Z0-9_-]*$\",\n },\n description: {\n type: \"string\",\n description: \"Description of what the skill does\",\n },\n fileKey: {\n type: \"string\",\n description: \"Files store key containing the skill code\",\n },\n inputSchema: {\n type: \"object\",\n description: \"JSON Schema defining the input parameters for the skill (optional for ES6 modules if exported from code)\",\n },\n moduleType: {\n type: \"string\",\n enum: [\"legacy\", \"es6\"],\n default: \"es6\",\n description: \"Module type: 'es6' for ES6 modules (default), 'legacy' for function-based skills\",\n },\n },\n required: [\"name\", \"description\", \"fileKey\"],\n },\n },\n {\n name: \"unregister-skill\",\n description: \"Unregister a previously registered skill tool.\",\n inputSchema: {\n type: \"object\",\n properties: {\n name: {\n type: \"string\",\n description: \"The name of the skill to unregister\",\n },\n },\n required: [\"name\"],\n },\n },\n {\n name: \"list-skills\",\n description: \"List all registered skills for the current user.\",\n inputSchema: {\n type: \"object\",\n properties: {},\n },\n },\n] as const;\n\n// OpenAI Tools\nexport const OPENAI_TOOLS = [\n {\n name: \"openai-chat-completion\",\n description: \"Create a chat completion using OpenAI's API via Val Town's OpenAI integration\",\n inputSchema: {\n type: \"object\",\n properties: {\n messages: {\n type: \"array\",\n description: \"Array of message objects for the conversation\",\n items: {\n type: \"object\",\n properties: {\n role: {\n type: \"string\",\n enum: [\"system\", \"user\", \"assistant\"],\n description: \"The role of the message author\",\n },\n content: {\n type: \"string\",\n description: \"The content of the message\",\n },\n },\n required: [\"role\", \"content\"],\n },\n },\n model: {\n type: \"string\",\n description: \"The OpenAI model to use\",\n default: \"gpt-4o-mini\",\n enum: [\n \"gpt-4o\",\n \"gpt-4o-mini\",\n \"gpt-4-turbo\",\n \"gpt-4\",\n \"gpt-3.5-turbo\",\n ],\n },\n max_tokens: {\n type: \"number\",\n description: \"Maximum number of tokens to generate\",\n minimum: 1,\n maximum: 4096,\n },\n temperature: {\n type: \"number\",\n description: \"Sampling temperature (0-2)\",\n minimum: 0,\n maximum: 2,\n default: 1,\n },\n top_p: {\n type: \"number\",\n description: \"Nucleus sampling parameter (0-1)\",\n minimum: 0,\n maximum: 1,\n default: 1,\n },\n frequency_penalty: {\n type: \"number\",\n description: \"Frequency penalty (-2 to 2)\",\n minimum: -2,\n maximum: 2,\n default: 0,\n },\n presence_penalty: {\n type: \"number\",\n description: \"Presence penalty (-2 to 2)\",\n minimum: -2,\n maximum: 2,\n default: 0,\n },\n },\n required: [\"messages\"],\n },\n },\n] as const;\n\n\n\n// Admin Tools for System Skill Management (Only available in admin mode)\nexport const ADMIN_TOOLS = [\n {\n name: \"admin-promote-skill\",\n description: \"Promote an existing user skill to system-wide availability (admin only). If userNamespace is not provided, promotes from the current user's namespace.\",\n inputSchema: {\n type: \"object\",\n properties: {\n userNamespace: {\n type: \"string\",\n description: \"Optional namespace of the user who owns the skill to promote. If not provided, uses the current user's namespace.\",\n },\n skillName: {\n type: \"string\",\n description: \"The name of the skill to promote to system-wide availability\",\n },\n },\n required: [\"skillName\"],\n },\n },\n {\n name: \"admin-demote-skill\",\n description: \"Remove system-wide availability of a promoted skill (admin only)\",\n inputSchema: {\n type: \"object\",\n properties: {\n skillName: {\n type: \"string\",\n description: \"The name of the promoted skill to demote (remove from system-wide availability)\",\n },\n },\n required: [\"skillName\"],\n },\n },\n {\n name: \"admin-list-promoted-skills\",\n description: \"List all skills that have been promoted to system-wide availability (admin only)\",\n inputSchema: {\n type: \"object\",\n properties: {},\n },\n },\n {\n name: \"admin-update-promoted-skill\",\n description: \"Update a promoted skill with the latest version from its original user (admin only)\",\n inputSchema: {\n type: \"object\",\n properties: {\n skillName: {\n type: \"string\",\n description: \"The name of the promoted skill to update from its source\",\n },\n },\n required: [\"skillName\"],\n },\n },\n {\n name: \"admin-read-val-file\",\n description: \"Read a source code file from the project using Val Town API (admin only)\",\n inputSchema: {\n type: \"object\",\n properties: {\n path: {\n type: \"string\",\n description: \"The file path to read (e.g., 'src/auth/auth-manager.ts', 'index.ts', '/README.md')\",\n },\n },\n required: [\"path\"],\n },\n },\n {\n name: \"admin-write-val-file\",\n description: \"Write/update a source code file in the project using Val Town API (admin only)\",\n inputSchema: {\n type: \"object\",\n properties: {\n path: {\n type: \"string\",\n description: \"The file path to write (e.g., 'src/auth/auth-manager.ts', 'index.ts', '/README.md')\",\n },\n content: {\n type: \"string\",\n description: \"The file content to write\",\n },\n },\n required: [\"path\", \"content\"],\n },\n },\n {\n name: \"admin-list-val-files\",\n description: \"List all files in the project directory structure using Val Town API (admin only)\",\n inputSchema: {\n type: \"object\",\n properties: {\n path: {\n type: \"string\",\n description: \"Optional directory path to list (defaults to root '/')\",\n default: \"/\",\n },\n recursive: {\n type: \"boolean\",\n description: \"Whether to list files recursively\",\n default: false,\n },\n },\n },\n },\n {\n name: \"admin-project-info\",\n description: \"Get project information and structure overview using Val Town API (admin only)\",\n inputSchema: {\n type: \"object\",\n properties: {},\n },\n },\n] as const;\n\n// All tools combined\nexport const ALL_TOOLS = [\n ...KV_TOOLS,\n ...FILES_TOOLS,\n ...CODE_TOOLS,\n ...OPENAI_TOOLS,\n] as const;\n\n// All tools including admin tools (for admin mode)\nexport const ALL_TOOLS_WITH_ADMIN = [\n ...KV_TOOLS,\n ...FILES_TOOLS,\n ...CODE_TOOLS,\n ...OPENAI_TOOLS,\n ...ADMIN_TOOLS,\n] as const;",[],[67,112,121],"263cb1c4-482e-11f0-80de-76b3cceeab13","handlers","c4074bc4-47df-472c-97b7-7eec60d9dc23",253,["D",1749802349557],[136,137,138,139,140,141],[67,112,130],{"_35":182,"_13":183,"_38":184,"_40":131,"_41":42,"_43":185,"_45":46,"_47":186,"_17":187,"_50":107,"_52":188,"_54":55,"_56":-5,"_78":189,"_18":190},{"_35":173,"_13":174,"_38":175,"_40":131,"_41":42,"_43":176,"_45":46,"_47":177,"_17":178,"_50":107,"_52":179,"_54":55,"_56":-5,"_78":180,"_18":181},{"_35":164,"_13":165,"_38":166,"_40":131,"_41":42,"_43":167,"_45":46,"_47":168,"_17":169,"_50":107,"_52":170,"_54":55,"_56":-5,"_78":171,"_18":172},{"_35":157,"_13":37,"_38":158,"_40":131,"_41":42,"_43":159,"_45":46,"_47":160,"_17":106,"_50":107,"_52":161,"_54":55,"_56":-5,"_78":162,"_18":163},{"_35":150,"_13":151,"_38":152,"_40":131,"_41":42,"_43":132,"_45":46,"_47":153,"_17":71,"_50":107,"_52":154,"_54":55,"_56":-5,"_78":155,"_18":156},{"_35":142,"_13":143,"_38":144,"_40":131,"_41":42,"_43":145,"_45":46,"_47":146,"_17":71,"_50":107,"_52":147,"_54":55,"_56":-5,"_78":148,"_18":149},"83d3f400-4d5b-11f0-92e9-76b3cceeab13","openai-tools.ts","83d3f50e-4d5b-11f0-92e9-76b3cceeab13",354,["D",1750371589742],"/**\n * OpenAI API tool handlers using Val Town's OpenAI integration\n */\n\nimport { OpenAI } from \"https://esm.town/v/std/openai\";\nimport { AuthContext } from \"../../storage/kv-store.ts\";\n\n// OpenAI API types\ninterface ChatMessage {\n role: \"system\" | \"user\" | \"assistant\";\n content: string;\n}\n\ninterface ChatCompletionRequest {\n messages: ChatMessage[];\n model?: string;\n max_tokens?: number;\n temperature?: number;\n top_p?: number;\n frequency_penalty?: number;\n presence_penalty?: number;\n}\n\nexport class OpenAIToolHandlers {\n private openai: OpenAI;\n\n constructor() {\n this.openai = new OpenAI();\n }\n\n async handleChatCompletion(args: ChatCompletionRequest, authContext: AuthContext) {\n try {\n const completion = await this.openai.chat.completions.create({\n messages: args.messages,\n model: args.model || \"gpt-4o-mini\",\n ...(args.max_tokens && { max_tokens: args.max_tokens }),\n ...(args.temperature !== undefined && { temperature: args.temperature }),\n ...(args.top_p !== undefined && { top_p: args.top_p }),\n ...(args.frequency_penalty !== undefined && { frequency_penalty: args.frequency_penalty }),\n ...(args.presence_penalty !== undefined && { presence_penalty: args.presence_penalty })\n });\n\n return {\n content: [\n {\n type: \"text\",\n text: JSON.stringify(completion, null, 2)\n }\n ]\n };\n } catch (error) {\n throw new Error(`OpenAI API error: ${error.message}`);\n }\n }\n}",[],[67,112,130,143],"263ca3aa-482e-11f0-80de-76b3cceeab13","kv-tools.ts","263ca47c-482e-11f0-80de-76b3cceeab13",["D",1749802349557],"/**\n * Key-Value Store tool handlers\n */\n\nimport { DynamoDBDocumentClient } from \"https://esm.sh/@aws-sdk/lib-dynamodb@3.490.0\";\nimport { NamespacedKVStore, AuthContext } from \"../../storage/kv-store.ts\";\n\nexport class KVToolHandlers {\n private docClient: DynamoDBDocumentClient;\n private tableName: string;\n\n constructor(docClient: DynamoDBDocumentClient, tableName: string) {\n this.docClient = docClient;\n this.tableName = tableName;\n }\n\n async handleKVGet(args: any, authContext: AuthContext) {\n const { key } = args;\n if (!key) {\n throw new Error(\"Key is required for KV get operation\");\n }\n\n const kvStore = new NamespacedKVStore(authContext, this.docClient, this.tableName);\n \n const value = await kvStore.get(key);\n \n return {\n content: [\n {\n type: \"text\",\n text: JSON.stringify(value, null, 2),\n },\n ],\n };\n }\n\n async handleKVPut(args: any, authContext: AuthContext) {\n const { key, value, ttl } = args;\n if (!key || value === undefined) {\n throw new Error(\"Key and value are required for KV put operation\");\n }\n\n const kvStore = new NamespacedKVStore(authContext, this.docClient, this.tableName);\n \n await kvStore.put(key, value, ttl);\n \n return {\n content: [\n {\n type: \"text\",\n text: `Successfully stored key: ${key}${ttl ? ` (TTL: ${ttl}s)` : ''}`,\n },\n ],\n };\n }\n\n async handleKVDelete(args: any, authContext: AuthContext) {\n const { key } = args;\n if (!key) {\n throw new Error(\"Key is required for KV delete operation\");\n }\n\n const kvStore = new NamespacedKVStore(authContext, this.docClient, this.tableName);\n \n await kvStore.delete(key);\n \n return {\n content: [\n {\n type: \"text\",\n text: `Successfully deleted key: ${key}`,\n },\n ],\n };\n }\n\n async handleKVList(args: any, authContext: AuthContext) {\n const { prefix, limit = 100 } = args;\n\n const kvStore = new NamespacedKVStore(authContext, this.docClient, this.tableName);\n \n const keys = await kvStore.list(prefix, limit);\n \n return {\n content: [\n {\n type: \"text\",\n text: JSON.stringify(keys, null, 2),\n },\n ],\n };\n }\n\n async handleKVQuery(args: any, authContext: AuthContext) {\n const { keyPattern, limit = 100 } = args;\n if (!keyPattern) {\n throw new Error(\"Key pattern is required for KV query operation\");\n }\n\n const kvStore = new NamespacedKVStore(authContext, this.docClient, this.tableName);\n \n const items = await kvStore.query(keyPattern, limit);\n \n return {\n content: [\n {\n type: \"text\",\n text: JSON.stringify(items, null, 2),\n },\n ],\n };\n }\n}",[],[67,112,130,151],"a7e7f3cc-59cd-11f0-93e7-f69ea79377d9","6e8fab8e-482e-11f0-bd4c-76b3cceeab13",413,["D",1751740026852],"/**\n * Unified tool handlers export\n */\n\nexport { KVToolHandlers } from \"./kv-tools.ts\";\nexport { FilesToolHandlers } from \"./files-tools.ts\";\nexport { CodeToolHandlers } from \"./code-tools.ts\";\nexport { OpenAIToolHandlers } from \"./openai-tools.ts\";\nexport { AdminToolHandlers } from \"./admin-tools.ts\";",[],[67,112,130,37],"18fe8bd8-59e3-11f0-9d7b-f69ea79377d9","files-tools.ts","6071be8e-482e-11f0-afaf-76b3cceeab13",460,["D",1751749236020],14,"/**\n * Files Store tool handlers\n */\n\nimport { S3Client } from \"https://esm.sh/@aws-sdk/client-s3@3.490.0\";\nimport { NamespacedFilesStore, AuthContext } from \"../../storage/files-store.ts\";\nimport { ExtendedAuthContext } from \"../../auth/auth-manager.ts\";\n\nexport class FilesToolHandlers {\n private s3Client: S3Client;\n private bucketName: string;\n\n constructor(s3Client: S3Client, bucketName: string) {\n this.s3Client = s3Client;\n this.bucketName = bucketName;\n }\n\n async handleFilesGet(args: any, authContext: AuthContext) {\n const { key, versionId } = args;\n if (!key) {\n throw new Error(\"Key is required for files get operation\");\n }\n\n const filesStore = new NamespacedFilesStore(authContext, this.s3Client, this.bucketName);\n \n // Use enhanced get method that supports system folder access\n const extendedAuthContext = authContext as ExtendedAuthContext;\n const file = await filesStore.getWithSystemFolder(key, versionId, extendedAuthContext);\n \n if (!file) {\n return {\n content: [\n {\n type: \"text\",\n text: \"File not found\",\n },\n ],\n };\n }\n \n return {\n content: [\n {\n type: \"text\",\n text: file.content,\n },\n ],\n };\n }\n\n async handleFilesPut(args: any, authContext: AuthContext) {\n const { key, content, contentType, metadata } = args;\n if (!key || content === undefined) {\n throw new Error(\"Key and content are required for files put operation\");\n }\n\n const filesStore = new NamespacedFilesStore(authContext, this.s3Client, this.bucketName);\n \n // Use enhanced put method that supports system folder access with permission checking\n const extendedAuthContext = authContext as ExtendedAuthContext;\n const result = await filesStore.putWithSystemFolder(key, content, contentType, metadata, extendedAuthContext);\n \n return {\n content: [\n {\n type: \"text\",\n text: `Successfully stored file: ${key}${result.versionId ? ` (Version: ${result.versionId})` : ''}`,\n },\n ],\n };\n }\n\n async handleFilesDelete(args: any, authContext: AuthContext) {\n const { key, versionId } = args;\n if (!key) {\n throw new Error(\"Key is required for files delete operation\");\n }\n\n const filesStore = new NamespacedFilesStore(authContext, this.s3Client, this.bucketName);\n \n // Use enhanced delete method that supports system folder access with permission checking\n const extendedAuthContext = authContext as ExtendedAuthContext;\n await filesStore.deleteWithSystemFolder(key, versionId, extendedAuthContext);\n \n return {\n content: [\n {\n type: \"text\",\n text: `Successfully deleted file: ${key}${versionId ? ` (Version: ${versionId})` : ''}`,\n },\n ],\n };\n }\n\n async handleFilesList(args: any, authContext: AuthContext) {\n const { prefix, limit = 100 } = args;\n\n const filesStore = new NamespacedFilesStore(authContext, this.s3Client, this.bucketName);\n \n // Use enhanced list method that supports system folder\n const extendedAuthContext = authContext as ExtendedAuthContext;\n const files = await filesStore.listWithSystemFolder(prefix, limit, extendedAuthContext);\n \n return {\n content: [\n {\n type: \"text\",\n text: JSON.stringify(files, null, 2),\n },\n ],\n };\n }\n\n async handleFilesListVersions(args: any, authContext: AuthContext) {\n const { key, limit = 100 } = args;\n\n const filesStore = new NamespacedFilesStore(authContext, this.s3Client, this.bucketName);\n \n const versions = await filesStore.listVersions(key, limit);\n \n return {\n content: [\n {\n type: \"text\",\n text: JSON.stringify(versions, null, 2),\n },\n ],\n };\n }\n\n async handleFilesMove(args: any, authContext: AuthContext) {\n const { sourceKey, destinationKey } = args;\n if (!sourceKey || !destinationKey) {\n throw new Error(\"Source and destination keys are required for files move operation\");\n }\n\n const filesStore = new NamespacedFilesStore(authContext, this.s3Client, this.bucketName);\n \n // Use enhanced move method that supports system folder access with permission checking\n const extendedAuthContext = authContext as ExtendedAuthContext;\n await filesStore.moveWithSystemFolder(sourceKey, destinationKey, extendedAuthContext);\n \n return {\n content: [\n {\n type: \"text\",\n text: `Successfully moved file from ${sourceKey} to ${destinationKey}`,\n },\n ],\n };\n }\n\n async handleFilesCopy(args: any, authContext: AuthContext) {\n const { sourceKey, destinationKey } = args;\n if (!sourceKey || !destinationKey) {\n throw new Error(\"Source and destination keys are required for files copy operation\");\n }\n\n const filesStore = new NamespacedFilesStore(authContext, this.s3Client, this.bucketName);\n \n // Use enhanced copy method that supports system folder access with permission checking\n const extendedAuthContext = authContext as ExtendedAuthContext;\n const result = await filesStore.copyWithSystemFolder(sourceKey, destinationKey, extendedAuthContext);\n \n return {\n content: [\n {\n type: \"text\",\n text: `Successfully copied file from ${sourceKey} to ${destinationKey}${result.versionId ? ` (Version: ${result.versionId})` : ''}`,\n },\n ],\n };\n }\n\n async handleFilesExists(args: any, authContext: AuthContext) {\n const { key } = args;\n if (!key) {\n throw new Error(\"Key is required for files exists operation\");\n }\n\n const filesStore = new NamespacedFilesStore(authContext, this.s3Client, this.bucketName);\n \n const exists = await filesStore.exists(key);\n \n return {\n content: [\n {\n type: \"text\",\n text: JSON.stringify({ key, exists }, null, 2),\n },\n ],\n };\n }\n\n async handleFilesMetadata(args: any, authContext: AuthContext) {\n const { key, versionId } = args;\n if (!key) {\n throw new Error(\"Key is required for files metadata operation\");\n }\n\n const filesStore = new NamespacedFilesStore(authContext, this.s3Client, this.bucketName);\n \n const metadata = await filesStore.getMetadata(key, versionId);\n \n if (!metadata) {\n return {\n content: [\n {\n type: \"text\",\n text: \"File not found\",\n },\n ],\n };\n }\n \n return {\n content: [\n {\n type: \"text\",\n text: JSON.stringify(metadata, null, 2),\n },\n ],\n };\n }\n}",[],[67,112,130,165],"d7735388-5ea6-11f0-b85a-0224a6c84d84","code-tools.ts","6a58110a-482e-11f0-a3ea-76b3cceeab13",557,["D",1752273112065],48,"/**\n * Code execution tool handlers\n */\n\nimport { DynamoDBDocumentClient } from \"https://esm.sh/@aws-sdk/lib-dynamodb@3.490.0\";\nimport { AuthContext } from \"../../storage/kv-store.ts\";\nimport { SkillRegistry } from \"../../storage/skill-registry.ts\";\nimport { FilesToolHandlers } from \"./files-tools.ts\";\n\n// Import Node.js VM module for better code execution\nimport { createContext, runInNewContext } from \"node:vm\";\n\nexport class CodeToolHandlers {\n private filesHandler: FilesToolHandlers;\n private toolsContext: Record;\n private skillRegistry: SkillRegistry;\n\n constructor(\n filesHandler: FilesToolHandlers,\n toolsContext: Record,\n docClient: DynamoDBDocumentClient,\n tableName: string,\n ) {\n this.filesHandler = filesHandler;\n this.toolsContext = toolsContext;\n this.skillRegistry = new SkillRegistry(docClient, tableName);\n }\n\n /**\n * Execute ES6 module using dynamic import with blob URL\n */\n private async executeWithModule(codeSource: string, input: any, authContext: AuthContext): Promise {\n // Create blob URL for dynamic import\n const blob = new Blob([codeSource], { type: \"application/javascript\" });\n const url = URL.createObjectURL(blob);\n \n try {\n // Dynamic import the module\n const module = await import(url);\n \n // Check if module exports execute function\n if (typeof module.execute !== 'function') {\n throw new Error('ES6 module must export an execute function');\n }\n \n // Execute the module's execute function\n const result = await module.execute(input, this.toolsContext);\n \n return result;\n } catch (error) {\n // Re-throw with enhanced error information\n if (error instanceof Error) {\n throw error;\n }\n throw new Error(`ES6 module execution failed: ${String(error)}`);\n } finally {\n // Always clean up the blob URL\n URL.revokeObjectURL(url);\n }\n }\n\n /**\n * Extract metadata from ES6 module exports without executing\n */\n private async extractModuleMetadata(codeSource: string): Promise<{\n inputSchema?: any;\n hasGetPrompts?: boolean;\n metadata?: any;\n }> {\n const blob = new Blob([codeSource], { type: \"application/javascript\" });\n const url = URL.createObjectURL(blob);\n \n try {\n const module = await import(url);\n \n return {\n inputSchema: module.inputSchema,\n hasGetPrompts: typeof module.getPrompts === 'function',\n metadata: module.metadata,\n };\n } catch (error) {\n console.warn('Failed to extract module metadata:', error);\n return {};\n } finally {\n URL.revokeObjectURL(url);\n }\n }\n private async executeWithVM(codeSource: string, input: any, authContext: AuthContext): Promise {\n // Create execution context with tools and input\n const context = createContext({\n input,\n tools: this.toolsContext,\n console: {\n log: console.log,\n error: console.error,\n warn: console.warn,\n info: console.info,\n },\n // Restricted environment - no access to dangerous globals\n setTimeout,\n clearTimeout,\n setInterval,\n clearInterval,\n Promise,\n JSON,\n Math,\n Date,\n Array,\n Object,\n String,\n Number,\n Boolean,\n RegExp,\n Error,\n TypeError,\n ReferenceError,\n SyntaxError,\n fetch,\n URL,\n Blob,\n });\n\n // Build the execution script:\n // 1. User code first (preserves line numbers)\n // 2. Execution logic appended\n const executionScript = `${codeSource}\n\n// === EXECUTION LOGIC (appended to preserve user code line numbers) ===\n(async () => {\n if (typeof execute !== 'function') {\n throw new Error('Code must define an execute function');\n }\n \n return await execute(input, tools);\n})();`;\n\n try {\n // Execute in VM context with proper filename for stack traces\n const result = runInNewContext(executionScript, context, {\n filename: \"user-code.js\", // This provides proper filenames in stack traces\n timeout: 60000, // 60 second timeout\n displayErrors: true,\n });\n\n // Handle promise results\n if (result instanceof Promise) {\n return await result;\n }\n\n return result;\n } catch (error) {\n // Re-throw with enhanced error information\n if (error instanceof Error) {\n // The VM module preserves original line numbers and provides better stack traces\n throw error;\n }\n throw new Error(`Code execution failed: ${String(error)}`);\n }\n }\n\n /**\n * Validate code syntax before execution using VM\n */\n private async validateCodeSyntax(code: string): Promise<{ valid: boolean; error?: string }> {\n try {\n // Try to create a VM context and compile the code\n const context = createContext({});\n\n // Test compilation without execution\n runInNewContext(\n `\n ${code}\n // Check if execute function exists\n if (typeof execute !== 'function') {\n throw new Error('Code must define an execute function');\n }\n `,\n context,\n {\n filename: \"syntax-check.js\",\n timeout: 1000,\n displayErrors: true,\n },\n );\n\n return { valid: true };\n } catch (error) {\n return {\n valid: false,\n error: error instanceof Error ? error.message : String(error),\n };\n }\n }\n\n async handleCodeExec(args: any, authContext: AuthContext) {\n const { code, key, input, moduleType = 'legacy' } = args;\n let codeSource: string;\n\n try {\n // Determine code source: either direct code string or fetch from Files Store key\n if (code && key) {\n throw new Error(\"Cannot specify both 'code' and 'key' parameters. Use either direct code or Files Store key.\");\n }\n\n if (!code && !key) {\n throw new Error(\n \"Must specify either 'code' (direct code string) or 'key' (Files Store object key containing code).\",\n );\n }\n\n if (key) {\n // Fetch code from Files Store (namespaced)\n console.log(`[CodeExec] Fetching code from files key: ${key}`);\n const filesResponse = await this.filesHandler.handleFilesGet({ key }, authContext);\n codeSource = filesResponse.content[0].text;\n console.log(`[CodeExec] Retrieved code from files store (${codeSource.length} characters)`);\n } else {\n // Use direct code string\n codeSource = code;\n console.log(`[CodeExec] Using direct code string (${codeSource.length} characters)`);\n }\n\n console.log(`[CodeExec] Executing code with ${moduleType} mode`);\n\n // Execute code based on module type\n let result;\n if (moduleType === 'es6') {\n result = await this.executeWithModule(codeSource, input, authContext);\n } else {\n result = await this.executeWithVM(codeSource, input, authContext);\n }\n\n console.log(\"[MCP] Code execution result\", result);\n\n return {\n content: [\n {\n type: \"text\",\n text: JSON.stringify(result, null, 2),\n },\n ],\n };\n } catch (error) {\n console.error(\"Error executing code\", error);\n\n // Format error with better stack trace information\n let errorText = `❌ **Code Execution Error**\\n\\n**Message:** ${error.message}\\n\\n`;\n\n if (error.stack) {\n errorText += `**Stack Trace:**\\n\\`\\`\\`\\n${error.stack}\\n\\`\\`\\`\\n`;\n }\n\n return {\n content: [\n {\n type: \"text\",\n text: errorText,\n },\n ],\n };\n }\n }\n\n async handleRegisterSkill(args: any, authContext: AuthContext) {\n const { name, description, fileKey, inputSchema, moduleType = 'es6' } = args;\n\n try {\n // Validate skill name format\n if (!/^[a-zA-Z][a-zA-Z0-9_-]*$/.test(name)) {\n throw new Error(\n \"Skill name must start with a letter and contain only letters, numbers, underscores, and hyphens\",\n );\n }\n\n // Validate moduleType\n if (moduleType !== 'legacy' && moduleType !== 'es6') {\n throw new Error(\"moduleType must be either 'legacy' or 'es6'\");\n }\n\n // Check if skill already exists\n const existingSkill = await this.skillRegistry.getSkill(authContext, name);\n if (existingSkill) {\n throw new Error(`Skill '${name}' already exists. Use unregister-skill first to replace it.`);\n }\n\n // Verify the file exists and validate its syntax\n let skillCode: string;\n try {\n const filesResponse = await this.filesHandler.handleFilesGet({ key: fileKey }, authContext);\n skillCode = filesResponse.content[0].text;\n } catch (error) {\n throw new Error(`File '${fileKey}' not found in your file store: ${error.message}`);\n }\n\n // Extract metadata and validate based on module type\n let extractedInputSchema = inputSchema;\n let hasGetPrompts = false;\n let extractedMetadata: any = {};\n\n if (moduleType === 'es6') {\n // For ES6 modules, try to extract metadata from exports\n try {\n const moduleInfo = await this.extractModuleMetadata(skillCode);\n \n // Use exported inputSchema if available and no inputSchema provided in args\n if (!inputSchema && moduleInfo.inputSchema) {\n extractedInputSchema = moduleInfo.inputSchema;\n }\n \n // Check if module has getPrompts function and extract metadata\n hasGetPrompts = moduleInfo.hasGetPrompts || false;\n extractedMetadata = moduleInfo.metadata || {};\n \n console.log(`[RegisterSkill] Extracted ES6 module metadata:`, {\n hasInputSchema: !!moduleInfo.inputSchema,\n hasGetPrompts: hasGetPrompts,\n hasMetadata: !!moduleInfo.metadata\n });\n } catch (error) {\n console.warn(`[RegisterSkill] Failed to extract ES6 module metadata: ${error.message}`);\n }\n } else {\n // For legacy modules, validate the execute function syntax\n const syntaxCheck = await this.validateCodeSyntax(skillCode);\n if (!syntaxCheck.valid) {\n throw new Error(`Legacy skill code has syntax errors:\\n${syntaxCheck.error}`);\n }\n }\n\n // Validate input schema is provided or extracted\n if (!extractedInputSchema) {\n throw new Error(\"inputSchema must be provided either as parameter or exported from ES6 module\");\n }\n\n if (typeof extractedInputSchema !== \"object\" || extractedInputSchema === null) {\n throw new Error(\"inputSchema must be a valid JSON Schema object\");\n }\n\n // Register the skill with enhanced information\n await this.skillRegistry.registerSkill(\n authContext, \n name, \n description, \n fileKey, \n extractedInputSchema,\n moduleType,\n hasGetPrompts,\n extractedMetadata\n );\n\n const moduleTypeText = moduleType === 'es6' ? 'ES6 Module' : 'Legacy Function';\n const promptsText = hasGetPrompts ? ' with dynamic prompts' : '';\n \n return {\n content: [\n {\n type: \"text\",\n text: `✅ Skill '${name}' registered successfully as ${moduleTypeText}${promptsText}. It is now available as a tool.`,\n },\n ],\n };\n } catch (error) {\n console.error(\"Error registering skill\", error);\n return {\n content: [\n {\n type: \"text\",\n text: `❌ Error registering skill: ${error.message}`,\n },\n ],\n };\n }\n }\n\n async handleUnregisterSkill(args: any, authContext: AuthContext) {\n const { name } = args;\n\n try {\n const success = await this.skillRegistry.unregisterSkill(authContext, name);\n\n if (success) {\n return {\n content: [\n {\n type: \"text\",\n text: `✅ Skill '${name}' unregistered successfully.`,\n },\n ],\n };\n } else {\n return {\n content: [\n {\n type: \"text\",\n text: `⚠️ Skill '${name}' not found.`,\n },\n ],\n };\n }\n } catch (error) {\n console.error(\"Error unregistering skill\", error);\n return {\n content: [\n {\n type: \"text\",\n text: `❌ Error unregistering skill: ${error.message}`,\n },\n ],\n };\n }\n }\n\n async handleListSkills(args: any, authContext: AuthContext) {\n try {\n const skills = await this.skillRegistry.listSkills(authContext);\n\n if (skills.length === 0) {\n return {\n content: [\n {\n type: \"text\",\n text: \"No skills registered.\",\n },\n ],\n };\n }\n\n const skillsList = skills.map(skill => `- **${skill.name}**: ${skill.description} (file: ${skill.fileKey})`).join(\n \"\\n\",\n );\n\n return {\n content: [\n {\n type: \"text\",\n text: `📋 **Registered Skills:**\\n\\n${skillsList}`,\n },\n ],\n };\n } catch (error) {\n console.error(\"Error listing skills\", error);\n return {\n content: [\n {\n type: \"text\",\n text: `❌ Error listing skills: ${error.message}`,\n },\n ],\n };\n }\n }\n\n async handleSkillExecution(skillName: string, args: any, authContext: AuthContext) {\n try {\n // Get the skill definition using enhanced resolution (user skills override system skills)\n const skill = await this.skillRegistry.resolveSkill(authContext, skillName);\n if (!skill) {\n throw new Error(`Skill '${skillName}' not found`);\n }\n\n // Determine execution mode based on skill's module type (default to legacy for backward compatibility)\n const moduleType = skill.moduleType || 'legacy';\n \n console.log(`[SkillExecution] Executing skill '${skillName}' with ${moduleType} mode`);\n\n // Execute the skill using the appropriate execution method\n return await this.handleCodeExec({\n key: skill.fileKey,\n input: args,\n moduleType: moduleType\n }, authContext);\n } catch (error) {\n console.error(`Error executing skill ${skillName}`, error);\n return {\n content: [\n {\n type: \"text\",\n text: `❌ Error executing skill '${skillName}': ${error.message}`,\n },\n ],\n };\n }\n }\n\n /**\n * Dynamically evaluate prompts from an ES6 skill module at runtime\n */\n private async evaluateSkillPrompts(codeSource: string, authContext: AuthContext): Promise {\n const blob = new Blob([codeSource], { type: \"application/javascript\" });\n const url = URL.createObjectURL(blob);\n \n try {\n const module = await import(url);\n \n if (typeof module.getPrompts === 'function') {\n // Call getPrompts with tools context for dynamic evaluation\n const prompts = await module.getPrompts(this.toolsContext);\n \n // Validate that prompts is an array\n if (!Array.isArray(prompts)) {\n console.warn('getPrompts() must return an array');\n return [];\n }\n \n // Validate each prompt structure to match base prompt format\n return prompts.filter(prompt => {\n if (!prompt || typeof prompt !== 'object') {\n console.warn('Invalid prompt: must be an object');\n return false;\n }\n \n if (!prompt.name || typeof prompt.name !== 'string') {\n console.warn('Invalid prompt: must have a string name');\n return false;\n }\n \n if (!prompt.description || typeof prompt.description !== 'string') {\n console.warn('Invalid prompt: must have a string description');\n return false;\n }\n \n // Validate arguments array structure (should match base prompts format)\n if (prompt.arguments !== undefined) {\n if (!Array.isArray(prompt.arguments)) {\n console.warn('Invalid prompt: arguments must be an array');\n return false;\n }\n \n // Validate each argument structure\n for (const arg of prompt.arguments) {\n if (!arg || typeof arg !== 'object') {\n console.warn('Invalid prompt argument: must be an object');\n return false;\n }\n \n if (!arg.name || typeof arg.name !== 'string') {\n console.warn('Invalid prompt argument: must have a string name');\n return false;\n }\n \n if (!arg.description || typeof arg.description !== 'string') {\n console.warn('Invalid prompt argument: must have a string description');\n return false;\n }\n \n if (arg.required !== undefined && typeof arg.required !== 'boolean') {\n console.warn('Invalid prompt argument: required must be a boolean');\n return false;\n }\n }\n }\n \n // content can be a string or function\n if (prompt.content && typeof prompt.content !== 'string' && typeof prompt.content !== 'function') {\n console.warn('Invalid prompt: content must be a string or function');\n return false;\n }\n \n return true;\n });\n }\n \n return [];\n } catch (error) {\n console.warn('Failed to evaluate skill prompts:', error);\n return [];\n } finally {\n URL.revokeObjectURL(url);\n }\n }\n\n /**\n * Get prompts from a specific skill at runtime\n */\n async getSkillPrompts(skillName: string, authContext: AuthContext): Promise {\n try {\n // Get the skill definition\n const skill = await this.skillRegistry.resolveSkill(authContext, skillName);\n if (!skill) {\n return [];\n }\n\n // Only ES6 modules with getPrompts function can provide dynamic prompts\n if (skill.moduleType !== 'es6' || !skill.hasGetPrompts) {\n return [];\n }\n\n // Get the skill code\n let skillCode: string;\n try {\n const filesResponse = await this.filesHandler.handleFilesGet({ key: skill.fileKey }, authContext);\n skillCode = filesResponse.content[0].text;\n } catch (error) {\n console.warn(`Failed to load skill code for prompts: ${error.message}`);\n return [];\n }\n\n // Evaluate prompts dynamically\n return await this.evaluateSkillPrompts(skillCode, authContext);\n } catch (error) {\n console.error(`Error getting prompts for skill ${skillName}:`, error);\n return [];\n }\n }\n\n /**\n * Execute a specific prompt from a skill\n */\n async executeSkillPrompt(skillName: string, promptName: string, args: any, authContext: AuthContext): Promise {\n try {\n // Get the skill prompts\n const prompts = await this.getSkillPrompts(skillName, authContext);\n \n // Find the specific prompt\n const prompt = prompts.find(p => p.name === promptName);\n if (!prompt) {\n throw new Error(`Prompt '${promptName}' not found in skill '${skillName}'`);\n }\n\n // Execute the prompt content\n if (typeof prompt.content === 'function') {\n return await prompt.content(args);\n } else if (typeof prompt.content === 'string') {\n return prompt.content;\n } else {\n throw new Error(`Invalid prompt content type for '${promptName}' in skill '${skillName}'`);\n }\n } catch (error) {\n console.error(`Error executing prompt ${promptName} from skill ${skillName}:`, error);\n throw error;\n }\n }\n\n async getRegisteredSkills(authContext: AuthContext) {\n return await this.skillRegistry.listAllAvailableSkills(authContext);\n }\n\n /**\n * Get all prompts from all registered skills at runtime\n */\n async getAllSkillPrompts(authContext: AuthContext): Promise {\n try {\n const skills = await this.skillRegistry.listAllAvailableSkills(authContext);\n const allPrompts: any[] = [];\n\n for (const skill of skills) {\n if (skill.moduleType === 'es6' && skill.hasGetPrompts) {\n try {\n const skillPrompts = await this.getSkillPrompts(skill.name, authContext);\n \n // Prefix prompt names with skill name to avoid conflicts\n const prefixedPrompts = skillPrompts.map(prompt => ({\n ...prompt,\n name: `${skill.name}-${prompt.name}`,\n description: `${prompt.description} (from skill: ${skill.name})`,\n skillName: skill.name,\n originalName: prompt.name,\n }));\n \n allPrompts.push(...prefixedPrompts);\n } catch (error) {\n console.warn(`Failed to get prompts from skill ${skill.name}:`, error);\n }\n }\n }\n\n return allPrompts;\n } catch (error) {\n console.error('Error getting all skill prompts:', error);\n return [];\n }\n }\n}",[],[67,112,130,174],"f402557e-59f3-11f0-8e0d-f69ea79377d9","admin-tools.ts","8839d9ae-599c-11f0-b75d-f69ea79377d9",492,["D",1751756475411],18,"/**\n * Admin Tools Handlers\n * Provides system skill management and Val Town file access capabilities (admin mode only)\n */\n\nimport { DynamoDBDocumentClient } from \"https://esm.sh/@aws-sdk/lib-dynamodb@3.490.0\";\nimport { ExtendedAuthContext } from \"../../auth/auth-manager.ts\";\nimport { SkillRegistry } from \"../../storage/skill-registry.ts\";\nimport { FilesToolHandlers } from \"./files-tools.ts\";\nimport { ValTownClient } from \"../../valtown/client.ts\";\nimport { NamespacedFilesStore } from \"../../storage/files-store.ts\";\n\nexport class AdminToolHandlers {\n private skillRegistry: SkillRegistry;\n private filesHandler: FilesToolHandlers;\n private valTownClient: ValTownClient;\n private s3Client: any;\n private bucketName: string;\n\n constructor(\n docClient: DynamoDBDocumentClient,\n tableName: string,\n filesHandler: FilesToolHandlers,\n s3Client: any,\n bucketName: string\n ) {\n this.skillRegistry = new SkillRegistry(docClient, tableName);\n this.filesHandler = filesHandler;\n this.valTownClient = new ValTownClient();\n this.s3Client = s3Client;\n this.bucketName = bucketName;\n }\n\n /**\n * Promote an existing user skill to system-wide availability\n */\n async handleAdminPromoteSkill(args: any, authContext: ExtendedAuthContext) {\n if (!authContext.isSystemMode) {\n throw new Error(\"Admin tools are only available in admin mode\");\n }\n\n const { userNamespace, skillName } = args;\n \n // Use current user's namespace if userNamespace is not provided\n const targetNamespace = userNamespace || authContext.namespace;\n\n try {\n // Create a files store instance to pass to the skill registry\n const filesStore = new NamespacedFilesStore(authContext, this.s3Client, this.bucketName);\n \n // Promote the skill with file copying\n await this.skillRegistry.promoteSkillToSystem(authContext, targetNamespace, skillName, filesStore);\n\n const namespaceInfo = userNamespace ? `from user '${targetNamespace}'` : `from your namespace '${targetNamespace}'`;\n return {\n content: [\n {\n type: \"text\",\n text: `✅ Skill '${skillName}' ${namespaceInfo} has been promoted to system-wide availability. The skill file has been copied to the system folder and is now available to all users.`,\n },\n ],\n };\n } catch (error) {\n console.error(\"Error promoting skill\", error);\n return {\n content: [\n {\n type: \"text\",\n text: `❌ Error promoting skill: ${error.message}`,\n },\n ],\n };\n }\n }\n\n /**\n * Remove system-wide availability of a promoted skill\n */\n async handleAdminDemoteSkill(args: any, authContext: ExtendedAuthContext) {\n if (!authContext.isSystemMode) {\n throw new Error(\"Admin tools are only available in admin mode\");\n }\n\n const { skillName } = args;\n\n try {\n // Create a files store instance to pass to the skill registry\n const filesStore = new NamespacedFilesStore(authContext, this.s3Client, this.bucketName);\n \n // Demote the skill with file cleanup\n const success = await this.skillRegistry.demoteSkillFromSystem(authContext, skillName, filesStore);\n\n if (success) {\n return {\n content: [\n {\n type: \"text\",\n text: `✅ Skill '${skillName}' has been demoted from system-wide availability. The skill file has been removed from the system folder and is no longer available to all users.`,\n },\n ],\n };\n } else {\n return {\n content: [\n {\n type: \"text\",\n text: `⚠️ Promoted skill '${skillName}' not found.`,\n },\n ],\n };\n }\n } catch (error) {\n console.error(\"Error demoting skill\", error);\n return {\n content: [\n {\n type: \"text\",\n text: `❌ Error demoting skill: ${error.message}`,\n },\n ],\n };\n }\n }\n\n /**\n * List all skills that have been promoted to system-wide availability\n */\n async handleAdminListPromotedSkills(args: any, authContext: ExtendedAuthContext) {\n if (!authContext.isSystemMode) {\n throw new Error(\"Admin tools are only available in admin mode\");\n }\n\n try {\n const promotedSkills = await this.skillRegistry.listPromotedSkills();\n\n if (promotedSkills.length === 0) {\n return {\n content: [\n {\n type: \"text\",\n text: \"No skills have been promoted to system-wide availability.\",\n },\n ],\n };\n }\n\n const skillsList = promotedSkills.map(skill => {\n const promotedInfo = skill.promotedFrom ? ` (promoted from user: ${skill.promotedFrom})` : '';\n const promotedDate = skill.promotedAt ? ` on ${new Date(skill.promotedAt).toLocaleDateString()}` : '';\n return `- **${skill.name}**: ${skill.description}${promotedInfo}${promotedDate}`;\n }).join(\"\\n\");\n\n return {\n content: [\n {\n type: \"text\",\n text: `🔧 **Promoted Skills (Available to All Users):**\\n\\n${skillsList}`,\n },\n ],\n };\n } catch (error) {\n console.error(\"Error listing promoted skills\", error);\n return {\n content: [\n {\n type: \"text\",\n text: `❌ Error listing promoted skills: ${error.message}`,\n },\n ],\n };\n }\n }\n\n /**\n * Update a promoted skill with the latest version from its original user\n */\n async handleAdminUpdatePromotedSkill(args: any, authContext: ExtendedAuthContext) {\n if (!authContext.isSystemMode) {\n throw new Error(\"Admin tools are only available in admin mode\");\n }\n\n const { skillName } = args;\n\n try {\n // Create a files store instance to pass to the skill registry\n const filesStore = new NamespacedFilesStore(authContext, this.s3Client, this.bucketName);\n \n // Update the promoted skill with file copying\n await this.skillRegistry.updatePromotedSkill(authContext, skillName, filesStore);\n\n return {\n content: [\n {\n type: \"text\",\n text: `✅ Promoted skill '${skillName}' has been updated with the latest version from its original user. The skill file in the system folder has been updated.`,\n },\n ],\n };\n } catch (error) {\n console.error(\"Error updating promoted skill\", error);\n return {\n content: [\n {\n type: \"text\",\n text: `❌ Error updating promoted skill: ${error.message}`,\n },\n ],\n };\n }\n }\n /**\n * Validate JavaScript/TypeScript code syntax\n */\n private async validateCodeSyntax(code: string): Promise<{ valid: boolean; error?: string }> {\n try {\n // Basic syntax validation using Function constructor\n new Function(code);\n \n // Check for required execute function\n if (!code.includes(\"function execute\") && !code.includes(\"execute =\") && !code.includes(\"execute:\")) {\n return {\n valid: false,\n error: \"Code must define an 'execute' function\"\n };\n }\n \n return { valid: true };\n } catch (error) {\n return {\n valid: false,\n error: error.message\n };\n }\n }\n\n /**\n * Read a source code file from the project using Val Town API\n */\n async handleAdminReadValFile(args: any, authContext: ExtendedAuthContext) {\n if (!authContext.isSystemMode) {\n throw new Error(\"Admin tools are only available in admin mode\");\n }\n\n const { path } = args;\n \n if (!path) {\n throw new Error(\"Path parameter is required\");\n }\n\n try {\n const fileContent = await this.valTownClient.readFile(path);\n \n return {\n content: [{\n type: \"text\",\n text: `File: ${path}\\n\\n${fileContent}`\n }]\n };\n } catch (error) {\n if (error.message?.includes('File not found')) {\n return {\n content: [{\n type: \"text\",\n text: `Error: File not found: ${path}`\n }]\n };\n }\n throw error;\n }\n }\n\n /**\n * Write/update a source code file in the project using Val Town API\n */\n async handleAdminWriteValFile(args: any, authContext: ExtendedAuthContext) {\n if (!authContext.isSystemMode) {\n throw new Error(\"Admin tools are only available in admin mode\");\n }\n\n const { path, content } = args;\n \n if (!path) {\n throw new Error(\"Path parameter is required\");\n }\n \n if (!content) {\n throw new Error(\"Content parameter is required\");\n }\n\n try {\n await this.valTownClient.writeFile(path, content);\n \n return {\n content: [{\n type: \"text\",\n text: `✅ File '${path}' written successfully.`\n }]\n };\n } catch (error) {\n return {\n content: [{\n type: \"text\",\n text: `❌ Error writing file '${path}': ${error.message}`\n }]\n };\n }\n }\n\n /**\n * List files in the project directory using Val Town API\n */\n async handleAdminListValFiles(args: any, authContext: ExtendedAuthContext) {\n if (!authContext.isSystemMode) {\n throw new Error(\"Admin tools are only available in admin mode\");\n }\n\n const { path = \"/\", recursive = false } = args;\n \n try {\n const files = await this.valTownClient.listProjectFiles(path, recursive);\n \n const formattedFiles = files.map(file => {\n const icon = file.type === 'directory' ? '📁' : '📄';\n const suffix = file.type === 'directory' ? '/' : '';\n return `${icon} ${file.path}${suffix}`;\n });\n \n formattedFiles.sort();\n \n return {\n content: [{\n type: \"text\",\n text: `Files in ${path}:\\n\\n${formattedFiles.join('\\n')}`\n }]\n };\n } catch (error) {\n return {\n content: [{\n type: \"text\",\n text: `Error: Failed to list files in ${path}: ${error.message}`\n }]\n };\n }\n }\n\n /**\n * Get project information and structure overview using Val Town API\n */\n async handleAdminProjectInfo(args: any, authContext: ExtendedAuthContext) {\n if (!authContext.isSystemMode) {\n throw new Error(\"Admin tools are only available in admin mode\");\n }\n\n try {\n const projectInfo = await this.valTownClient.getProjectInfo();\n \n // Format file structure\n const structure = projectInfo.files.map(file => {\n const icon = file.type === 'directory' ? '📁' : '📄';\n const suffix = file.type === 'directory' ? '/' : '';\n return `${icon} ${file.path}${suffix}`;\n });\n \n // Read README if it exists\n let readmeContent = \"\";\n try {\n readmeContent = await this.valTownClient.readFile(\"README.md\");\n } catch {\n // README doesn't exist or can't be read\n }\n \n // Format environment info\n const envInfo = Object.entries(projectInfo.environment || {})\n .map(([key, value]) => `${key}: ${value}`)\n .join('\\n');\n \n const projectInfoText = [\n \"# Project Information\",\n \"\",\n `## Project: ${projectInfo.name}`,\n projectInfo.description ? projectInfo.description : \"\",\n \"\",\n \"## Environment Configuration\",\n envInfo,\n \"\",\n \"## Project Structure\",\n structure.slice(0, 50).join('\\n'), // Limit to first 50 files\n structure.length > 50 ? `\\n... and ${structure.length - 50} more files` : \"\",\n \"\",\n \"## README Content\",\n readmeContent ? readmeContent.substring(0, 2000) + (readmeContent.length > 2000 ? \"\\n\\n[README truncated...]\" : \"\") : \"No README.md found\"\n ].join('\\n');\n \n return {\n content: [{\n type: \"text\",\n text: projectInfoText\n }]\n };\n } catch (error) {\n throw new Error(`Failed to get project info: ${error.message}`);\n }\n }\n}",[],[67,112,130,183],"eaec6524-482d-11f0-8228-76b3cceeab13","storage","338c38a4-b6f8-498d-8466-5e15fa8a1559",249,["D",1749802250047],[198,199,200],[67,192],{"_35":219,"_13":220,"_38":221,"_40":193,"_41":42,"_43":222,"_45":46,"_47":223,"_17":224,"_50":107,"_52":225,"_54":55,"_56":-5,"_78":226,"_18":227},{"_35":210,"_13":211,"_38":212,"_40":193,"_41":42,"_43":213,"_45":46,"_47":214,"_17":215,"_50":107,"_52":216,"_54":55,"_56":-5,"_78":217,"_18":218},{"_35":201,"_13":202,"_38":203,"_40":193,"_41":42,"_43":204,"_45":46,"_47":205,"_17":206,"_50":107,"_52":207,"_54":55,"_56":-5,"_78":208,"_18":209},"da8cb762-5ea6-11f0-a497-0224a6c84d84","skill-registry.ts","bf0810a2-4850-11f0-95df-76b3cceeab13",558,["D",1752273117262],39,"/**\n * Enhanced Skill Registry for managing both user-registered and system-wide skills\n * Skills are stored in the KV store with special prefixes for different scopes\n */\n\nimport { AuthContext, NamespacedKVStore } from \"./kv-store.ts\";\nimport { ExtendedAuthContext } from \"../auth/auth-manager.ts\";\nimport { DynamoDBDocumentClient } from \"https://esm.sh/@aws-sdk/lib-dynamodb@3.490.0\";\n\ninterface SkillPrompt {\n name: string;\n description: string;\n arguments?: Array<{\n name: string;\n description: string;\n required?: boolean;\n }>;\n content: string | ((args: any) => Promise);\n}\n\nexport interface SkillDefinition {\n name: string;\n description: string;\n fileKey: string;\n inputSchema: any;\n createdAt: string;\n updatedAt: string;\n isSystemSkill?: boolean; // Flag to indicate if this is a system skill\n promotedFrom?: string; // Namespace of the original user who created this skill (for promoted skills)\n promotedAt?: string; // When this skill was promoted to system-wide\n promotedBy?: string; // Admin who promoted this skill\n \n // Enhanced fields for ES6 module support\n moduleType?: 'legacy' | 'es6'; // Type of skill module (defaults to 'es6' for new skills)\n hasGetPrompts?: boolean; // Whether the skill exports a getPrompts function (for runtime evaluation)\n metadata?: any; // Additional metadata from module exports\n}\n\nexport class SkillRegistry {\n private kvStore: NamespacedKVStore;\n private static readonly USER_SKILL_PREFIX = \"__skills__:\";\n private static readonly SYSTEM_SKILL_PREFIX = \"__system_skills__:\";\n\n constructor(docClient: DynamoDBDocumentClient, tableName: string) {\n // Create a dummy auth context for the KV store - we'll override the namespace\n const dummyAuthContext: AuthContext = { namespace: \"dummy\", isDemo: false };\n this.kvStore = new NamespacedKVStore(dummyAuthContext, docClient, tableName);\n }\n\n // User skill key methods\n private getUserSkillKey(userNamespace: string, skillName: string): string {\n return `${SkillRegistry.USER_SKILL_PREFIX}${userNamespace}:${skillName}`;\n }\n\n private getUserSkillsPrefix(userNamespace: string): string {\n return `${SkillRegistry.USER_SKILL_PREFIX}${userNamespace}:`;\n }\n\n // System skill key methods\n private getSystemSkillKey(skillName: string): string {\n return `${SkillRegistry.SYSTEM_SKILL_PREFIX}system:${skillName}`;\n }\n\n private getSystemSkillsPrefix(): string {\n return `${SkillRegistry.SYSTEM_SKILL_PREFIX}system:`;\n }\n\n // User skill management methods\n async registerSkill(\n authContext: AuthContext,\n skillName: string,\n description: string,\n fileKey: string,\n inputSchema: any,\n moduleType: 'legacy' | 'es6' = 'es6',\n hasGetPrompts?: boolean,\n metadata?: any\n ): Promise {\n console.log('[SkillRegistry] registerSkill', skillName, fileKey);\n const skillKey = this.getUserSkillKey(authContext.namespace, skillName);\n const now = new Date().toISOString();\n\n const skillDefinition: SkillDefinition = {\n name: skillName,\n description,\n fileKey,\n inputSchema,\n createdAt: now,\n updatedAt: now,\n isSystemSkill: false,\n moduleType,\n hasGetPrompts: hasGetPrompts || false,\n metadata: metadata || {},\n };\n\n console.log('[SkillRegistry] skillDefinition', skillKey, skillDefinition);\n // Store in KV with a special key structure that bypasses normal namespacing\n await this.kvStore.put(skillKey, skillDefinition, undefined, true); // true = bypass namespace\n }\n\n async getSkill(authContext: AuthContext, skillName: string): Promise {\n console.log('[SkillRegistry] getSkill', skillName);\n const skillKey = this.getUserSkillKey(authContext.namespace, skillName);\n console.log('[SkillRegistry] skillKey', skillKey);\n return await this.kvStore.get(skillKey, true); // true = bypass namespace\n }\n\n async listSkills(authContext: AuthContext): Promise {\n // For bypassed namespace queries, we need to provide pk:sk_pattern format\n // User skills are stored with pk=\"__skills__\" and sk=\"namespace:skillName\"\n const queryPattern = `__skills__:${authContext.namespace}:*`;\n const results = await this.kvStore.query(queryPattern, 1000, true); // true = bypass namespace\n \n return results.map(item => ({ \n ...item.value as SkillDefinition,\n isSystemSkill: false\n }));\n }\n\n async unregisterSkill(authContext: AuthContext, skillName: string): Promise {\n const skillKey = this.getUserSkillKey(authContext.namespace, skillName);\n return await this.kvStore.delete(skillKey, true); // true = bypass namespace\n }\n\n async skillExists(authContext: AuthContext, skillName: string): Promise {\n const skill = await this.getSkill(authContext, skillName);\n return skill !== null;\n }\n\n // System skill management methods (admin only) - PROMOTION BASED\n async promoteSkillToSystem(\n authContext: ExtendedAuthContext,\n userNamespace: string,\n skillName: string,\n filesStore?: any // FilesStore instance for copying file content\n ): Promise {\n if (!authContext.isSystemMode) {\n throw new Error(\"Skill promotion requires admin mode access\");\n }\n\n console.log('[SkillRegistry] promoteSkillToSystem', userNamespace, skillName);\n \n // Get the original user skill\n const userSkillKey = this.getUserSkillKey(userNamespace, skillName);\n const userSkill = await this.kvStore.get(userSkillKey, true);\n \n if (!userSkill) {\n throw new Error(`User skill '${skillName}' not found in namespace '${userNamespace}'`);\n }\n\n // Check if system skill already exists\n const existingSystemSkill = await this.getSystemSkill(skillName);\n if (existingSystemSkill) {\n throw new Error(`System skill '${skillName}' already exists. Use admin-update-promoted-skill to update it or admin-demote-skill to remove it first.`);\n }\n\n // Copy the skill file to system folder if filesStore is provided\n let systemFileKey = userSkill.fileKey;\n if (filesStore) {\n try {\n console.log(`[SkillRegistry] Copying skill file from user namespace ${userNamespace}`);\n \n // Create a temporary auth context for the original user to fetch their file\n const originalUserAuthContext = { namespace: userNamespace, isDemo: false };\n const originalUserFilesStore = new (filesStore.constructor)(originalUserAuthContext, filesStore.s3Client, filesStore.bucketName);\n \n // Get the file content from the original user's namespace\n const originalFile = await originalUserFilesStore.get(userSkill.fileKey);\n if (!originalFile) {\n throw new Error(`Original skill file '${userSkill.fileKey}' not found in user namespace '${userNamespace}'`);\n }\n\n // Define the system file key\n systemFileKey = `system/skills/${skillName}.js`;\n \n // Store the file content in the system folder using admin context\n await filesStore.putWithSystemFolder(\n systemFileKey,\n originalFile.content,\n originalFile.contentType || 'application/javascript',\n {\n originalFileKey: userSkill.fileKey,\n originalNamespace: userNamespace,\n promotedBy: authContext.namespace,\n promotedAt: new Date().toISOString(),\n skillName: skillName\n },\n authContext\n );\n \n console.log(`[SkillRegistry] Skill file copied to system folder: ${systemFileKey}`);\n } catch (error) {\n console.error('[SkillRegistry] Failed to copy skill file to system folder:', error);\n throw new Error(`Failed to copy skill file to system folder: ${error.message}`);\n }\n }\n\n const systemSkillKey = this.getSystemSkillKey(skillName);\n const now = new Date().toISOString();\n\n // Create promoted system skill based on user skill\n const promotedSkillDefinition: SkillDefinition = {\n ...userSkill,\n fileKey: systemFileKey, // Use the system file key instead of the original user file key\n isSystemSkill: true,\n promotedFrom: userNamespace,\n promotedAt: now,\n promotedBy: authContext.namespace, // Admin who promoted it\n updatedAt: now,\n };\n\n console.log('[SkillRegistry] promoted skillDefinition', systemSkillKey, promotedSkillDefinition);\n // Store in KV with a special key structure that bypasses normal namespacing\n await this.kvStore.put(systemSkillKey, promotedSkillDefinition, undefined, true); // true = bypass namespace\n }\n\n async demoteSkillFromSystem(authContext: ExtendedAuthContext, skillName: string, filesStore?: any): Promise {\n if (!authContext.isSystemMode) {\n throw new Error(\"Skill demotion requires admin mode access\");\n }\n\n console.log('[SkillRegistry] demoteSkillFromSystem', skillName);\n \n // Check if system skill exists and is promoted\n const systemSkill = await this.getSystemSkill(skillName);\n if (!systemSkill) {\n return false; // Skill doesn't exist\n }\n\n if (!systemSkill.promotedFrom) {\n throw new Error(`System skill '${skillName}' was not promoted from a user skill and cannot be demoted. Use admin-unregister-system-skill instead.`);\n }\n\n // Delete the system file if it exists in the system folder and filesStore is provided\n if (filesStore && systemSkill.fileKey.startsWith('system/')) {\n try {\n console.log(`[SkillRegistry] Checking if system skill file exists: ${systemSkill.fileKey}`);\n \n // Check if the file exists before trying to delete it\n const fileExists = await filesStore.getWithSystemFolder(systemSkill.fileKey, undefined, authContext);\n \n if (fileExists) {\n console.log(`[SkillRegistry] Deleting system skill file: ${systemSkill.fileKey}`);\n await filesStore.deleteWithSystemFolder(systemSkill.fileKey, undefined, authContext);\n console.log(`[SkillRegistry] System skill file deleted: ${systemSkill.fileKey}`);\n } else {\n console.log(`[SkillRegistry] System skill file does not exist (backward compatibility): ${systemSkill.fileKey}`);\n }\n } catch (error) {\n console.warn(`[SkillRegistry] Failed to delete system skill file ${systemSkill.fileKey}:`, error);\n // Don't fail the demotion if file deletion fails - this ensures backward compatibility\n // with skills that were promoted before the file copying feature was implemented\n }\n }\n\n const systemSkillKey = this.getSystemSkillKey(skillName);\n return await this.kvStore.delete(systemSkillKey, true); // true = bypass namespace\n }\n\n async updatePromotedSkill(authContext: ExtendedAuthContext, skillName: string, filesStore?: any): Promise {\n if (!authContext.isSystemMode) {\n throw new Error(\"Promoted skill update requires admin mode access\");\n }\n\n console.log('[SkillRegistry] updatePromotedSkill', skillName);\n \n // Get the current system skill\n const systemSkill = await this.getSystemSkill(skillName);\n if (!systemSkill) {\n throw new Error(`System skill '${skillName}' not found`);\n }\n\n if (!systemSkill.promotedFrom) {\n throw new Error(`System skill '${skillName}' was not promoted from a user skill and cannot be updated this way. Use admin-update-system-skill instead.`);\n }\n\n // Get the latest version of the original user skill\n const userSkillKey = this.getUserSkillKey(systemSkill.promotedFrom, skillName);\n const latestUserSkill = await this.kvStore.get(userSkillKey, true);\n \n if (!latestUserSkill) {\n throw new Error(`Original user skill '${skillName}' no longer exists in namespace '${systemSkill.promotedFrom}'. Cannot update promoted skill.`);\n }\n\n // Update the skill file in system folder if filesStore is provided\n let systemFileKey = systemSkill.fileKey;\n if (filesStore) {\n try {\n console.log(`[SkillRegistry] Updating skill file from user namespace ${systemSkill.promotedFrom}`);\n \n // Create a temporary auth context for the original user to fetch their file\n const originalUserAuthContext = { namespace: systemSkill.promotedFrom, isDemo: false };\n const originalUserFilesStore = new (filesStore.constructor)(originalUserAuthContext, filesStore.s3Client, filesStore.bucketName);\n \n // Get the latest file content from the original user's namespace\n const originalFile = await originalUserFilesStore.get(latestUserSkill.fileKey);\n if (!originalFile) {\n throw new Error(`Original skill file '${latestUserSkill.fileKey}' not found in user namespace '${systemSkill.promotedFrom}'`);\n }\n\n // If the current system skill doesn't have a system file key (backward compatibility),\n // create one now\n if (!systemSkill.fileKey.startsWith('system/')) {\n systemFileKey = `system/skills/${skillName}.js`;\n console.log(`[SkillRegistry] Migrating skill to system folder: ${systemFileKey}`);\n }\n\n // Update/create the file content in the system folder using admin context\n await filesStore.putWithSystemFolder(\n systemFileKey,\n originalFile.content,\n originalFile.contentType || 'application/javascript',\n {\n originalFileKey: latestUserSkill.fileKey,\n originalNamespace: systemSkill.promotedFrom,\n updatedBy: authContext.namespace,\n updatedAt: new Date().toISOString(),\n skillName: skillName\n },\n authContext\n );\n \n console.log(`[SkillRegistry] Skill file updated in system folder: ${systemFileKey}`);\n } catch (error) {\n console.error('[SkillRegistry] Failed to update skill file in system folder:', error);\n // For backward compatibility, don't fail the update if file operations fail\n // Just use the original fileKey\n console.warn('[SkillRegistry] Continuing with original fileKey for backward compatibility');\n systemFileKey = systemSkill.fileKey;\n }\n }\n\n const systemSkillKey = this.getSystemSkillKey(skillName);\n const now = new Date().toISOString();\n\n // Update promoted system skill with latest user skill data\n const updatedPromotedSkill: SkillDefinition = {\n ...latestUserSkill,\n fileKey: systemFileKey, // Use the system file key\n isSystemSkill: true,\n promotedFrom: systemSkill.promotedFrom,\n promotedAt: systemSkill.promotedAt,\n promotedBy: systemSkill.promotedBy,\n updatedAt: now,\n };\n\n console.log('[SkillRegistry] updated promoted skillDefinition', systemSkillKey, updatedPromotedSkill);\n await this.kvStore.put(systemSkillKey, updatedPromotedSkill, undefined, true); // true = bypass namespace\n }\n\n async listPromotedSkills(): Promise {\n const systemSkills = await this.listSystemSkills();\n return systemSkills.filter(skill => skill.promotedFrom);\n }\n\n async getSystemSkill(skillName: string): Promise {\n console.log('[SkillRegistry] getSystemSkill', skillName);\n const skillKey = this.getSystemSkillKey(skillName);\n console.log('[SkillRegistry] system skillKey', skillKey);\n const skill = await this.kvStore.get(skillKey, true); // true = bypass namespace\n if (skill) {\n return { ...skill, isSystemSkill: true };\n }\n return null;\n }\n\n async listSystemSkills(): Promise {\n // For bypassed namespace queries, we need to provide pk:sk_pattern format\n // System skills are stored with pk=\"__system_skills__\" and sk=\"system:skillName\"\n // So we query with \"__system_skills__:system:*\" to get all skills in that partition\n const queryPattern = `__system_skills__:system:*`;\n const results = await this.kvStore.query(queryPattern, 1000, true); // true = bypass namespace\n \n return results.map(item => ({ ...item.value as SkillDefinition, isSystemSkill: true }));\n }\n\n async deleteSystemSkill(authContext: ExtendedAuthContext, skillName: string): Promise {\n if (!authContext.isSystemMode) {\n throw new Error(\"System skill deletion requires admin mode access\");\n }\n\n const skillKey = this.getSystemSkillKey(skillName);\n return await this.kvStore.delete(skillKey, true); // true = bypass namespace\n }\n\n async systemSkillExists(skillName: string): Promise {\n const skill = await this.getSystemSkill(skillName);\n return skill !== null;\n }\n\n // Combined skill resolution (user skills take precedence over system skills)\n async resolveSkill(authContext: AuthContext, skillName: string): Promise {\n // 1. Check user skills first (user can override system skills)\n const userSkill = await this.getSkill(authContext, skillName);\n if (userSkill) {\n return userSkill;\n }\n\n // 2. Fall back to system skills\n const systemSkill = await this.getSystemSkill(skillName);\n if (systemSkill) {\n return systemSkill;\n }\n\n return null;\n }\n\n // List all available skills (user + system) for a user\n async listAllAvailableSkills(authContext: AuthContext): Promise {\n const userSkills = await this.listSkills(authContext);\n const systemSkills = await this.listSystemSkills();\n \n // Create a map to handle user skill overrides\n const skillMap = new Map();\n \n // Add system skills first\n systemSkills.forEach(skill => {\n skillMap.set(skill.name, {...skill});\n });\n \n // Add user skills (will override system skills with same name)\n userSkills.forEach(skill => {\n skillMap.set(skill.name, skill);\n });\n \n return Array.from(skillMap.values());\n }\n}",[],[67,192,202],"18d174ca-486f-11f0-9566-76b3cceeab13","kv-store.ts","eaec58c2-482d-11f0-8228-76b3cceeab13",296,["D",1749830244335],8,"/**\n * Namespaced Key-Value Store abstraction over DynamoDB\n * Provides transparent multi-tenancy with namespace isolation\n */\n\nimport {\n DeleteCommand,\n DynamoDBDocumentClient,\n GetCommand,\n PutCommand,\n QueryCommand,\n} from \"https://esm.sh/@aws-sdk/lib-dynamodb@3.490.0\";\n\nexport interface AuthContext {\n namespace: string;\n isDemo: boolean;\n}\n\nexport interface KVItem {\n key: string;\n value: any;\n}\n\nexport interface NamespacedKVItem {\n pk: string; // Partition key: namespace\n sk: string; // Sort key: user key\n data: any; // User's value\n ttl?: number; // Optional TTL\n created: string; // Timestamp\n updated: string; // Timestamp\n}\n\nexport class NamespacedKVStore {\n private namespace: string;\n private docClient: DynamoDBDocumentClient;\n private tableName: string;\n\n constructor(authContext: AuthContext, docClient: DynamoDBDocumentClient, tableName: string) {\n this.namespace = authContext.namespace;\n this.docClient = docClient;\n this.tableName = tableName;\n }\n\n // Convert user key to partition and sort keys\n private getKeys(userKey: string, bypassNamespace: boolean = false): { pk: string; sk: string } {\n if (bypassNamespace) {\n // For bypassing namespace, the userKey should contain both pk and sk separated by ':'\n const parts = userKey.split(':');\n if (parts.length > 1) {\n return { pk: parts[0], sk: parts.slice(1).join(':') };\n }\n // If no separator, treat the whole key as sk with empty pk\n return { pk: '', sk: userKey };\n }\n \n return {\n pk: this.namespace,\n sk: userKey\n };\n }\n\n async get(key: string, bypassNamespace: boolean = false): Promise {\n if (!key) {\n throw new Error(\"Key is required\");\n }\n\n const { pk, sk } = this.getKeys(key, bypassNamespace);\n const response = await this.docClient.send(new GetCommand({\n TableName: this.tableName,\n Key: { pk, sk }\n }));\n\n return response.Item?.data || null;\n }\n\n async put(key: string, value: any, ttl?: number, bypassNamespace: boolean = false): Promise {\n if (!key || value === undefined) {\n throw new Error(\"Key and value are required\");\n }\n\n const now = new Date().toISOString();\n const { pk, sk } = this.getKeys(key, bypassNamespace);\n const item: NamespacedKVItem = {\n pk,\n sk,\n data: value,\n created: now,\n updated: now\n };\n\n if (ttl && ttl > 0) {\n item.ttl = Math.floor(Date.now() / 1000) + ttl;\n }\n\n await this.docClient.send(new PutCommand({\n TableName: this.tableName,\n Item: item\n }));\n }\n\n async delete(key: string, bypassNamespace: boolean = false): Promise {\n if (!key) {\n throw new Error(\"Key is required\");\n }\n\n const { pk, sk } = this.getKeys(key, bypassNamespace);\n const response = await this.docClient.send(new DeleteCommand({\n TableName: this.tableName,\n Key: { pk, sk }\n }));\n\n // Return true if item was deleted (existed before deletion)\n return response.$metadata.httpStatusCode === 200;\n }\n\n async list(prefix?: string, limit: number = 100): Promise {\n if (limit <= 0 || limit > 1000) {\n throw new Error(\"Limit must be between 1 and 1000\");\n }\n\n const queryParams: any = {\n TableName: this.tableName,\n KeyConditionExpression: 'pk = :pk',\n ExpressionAttributeValues: {\n ':pk': this.namespace\n },\n Limit: limit,\n ProjectionExpression: 'sk'\n };\n\n // If prefix is provided, add begins_with condition on sort key\n if (prefix) {\n queryParams.KeyConditionExpression += ' AND begins_with(sk, :prefix)';\n queryParams.ExpressionAttributeValues[':prefix'] = prefix;\n }\n\n const response = await this.docClient.send(new QueryCommand(queryParams));\n\n return (response.Items || []).map(item => item.sk);\n }\n\n async query(keyPattern: string, limit: number = 100, bypassNamespace: boolean = false): Promise {\n if (!keyPattern) {\n throw new Error(\"Key pattern is required\");\n }\n \n if (limit <= 0 || limit > 1000) {\n throw new Error(\"Limit must be between 1 and 1000\");\n }\n\n if (bypassNamespace) {\n // For bypassed namespace queries, the pattern should be in format \"pk:sk_pattern\"\n const parts = keyPattern.split(':');\n \n if (parts.length <= 2) {\n throw new Error(\"For bypassed namespace queries, pattern must be in format 'pk:sk_pattern'\");\n }\n\n const pk = parts[0];\n const skPattern = parts.slice(1).join(':');\n const cleanPattern = skPattern.replace(/\\*+$/, ''); // Remove trailing wildcards\n\n const queryParams: any = {\n TableName: this.tableName,\n KeyConditionExpression: 'pk = :pk AND begins_with(sk, :pattern)',\n ExpressionAttributeValues: {\n ':pk': pk,\n ':pattern': cleanPattern\n },\n Limit: limit\n };\n\n const response = await this.docClient.send(new QueryCommand(queryParams));\n\n return (response.Items || []).map(item => ({\n key: item.sk,\n value: item.data\n }));\n }\n\n // For now, treat pattern as prefix (can be enhanced later for wildcards)\n const cleanPattern = keyPattern.replace(/\\*+$/, ''); // Remove trailing wildcards\n\n const queryParams: any = {\n TableName: this.tableName,\n KeyConditionExpression: 'pk = :pk AND begins_with(sk, :pattern)',\n ExpressionAttributeValues: {\n ':pk': this.namespace,\n ':pattern': cleanPattern\n },\n Limit: limit\n };\n\n const response = await this.docClient.send(new QueryCommand(queryParams));\n\n return (response.Items || []).map(item => ({\n key: item.sk,\n value: item.data\n }));\n }\n}",[],[67,192,211],"fa3f8f5a-59ea-11f0-91ef-f69ea79377d9","files-store.ts","0176517e-482e-11f0-a96d-76b3cceeab13",471,["D",1751752620408],28,"/**\n * Namespaced Files Store abstraction over S3\n * Provides transparent multi-tenancy with namespace isolation and versioning support\n */\n\nimport {\n CopyObjectCommand,\n DeleteObjectCommand,\n GetObjectCommand,\n HeadObjectCommand,\n ListObjectsV2Command,\n ListObjectVersionsCommand,\n PutObjectCommand,\n S3Client,\n} from \"https://esm.sh/@aws-sdk/client-s3@3.490.0\";\nimport { ExtendedAuthContext } from \"../auth/auth-manager.ts\";\n\nexport interface AuthContext {\n namespace: string;\n isDemo: boolean;\n}\n\nexport interface FileItem {\n key: string;\n content: string;\n contentType?: string;\n size?: number;\n lastModified?: Date;\n versionId?: string;\n isLatest?: boolean;\n isReadOnly?: boolean; // For system files accessed by non-admin users\n}\n\nexport interface FileMetadata {\n key: string;\n size: number;\n lastModified: Date;\n contentType: string;\n versionId?: string;\n isLatest?: boolean;\n etag?: string;\n isReadOnly?: boolean; // For system files accessed by non-admin users\n}\n\nexport interface NamespacedFileItem {\n key: string; // Namespaced key: `${namespace}/${userKey}`\n content: string;\n contentType: string;\n metadata?: Record;\n versionId?: string;\n}\n\nexport class NamespacedFilesStore {\n private namespace: string;\n private s3Client: S3Client;\n private bucketName: string;\n private isDemo: boolean;\n\n constructor(authContext: AuthContext, s3Client: S3Client, bucketName: string) {\n this.namespace = authContext.namespace;\n this.s3Client = s3Client;\n this.bucketName = bucketName;\n this.isDemo = authContext.isDemo;\n }\n\n // Convert user key to namespaced key\n private namespacedKey(userKey: string): string {\n // Remove leading slash if present to avoid double slashes\n const cleanKey = userKey.startsWith(\"/\") ? userKey.substring(1) : userKey;\n return `${this.namespace}/${cleanKey}`;\n }\n\n // Strip namespace from key to return to user\n private stripNamespace(namespacedKey: string): string {\n const prefix = `${this.namespace}/`;\n return namespacedKey.startsWith(prefix)\n ? namespacedKey.substring(prefix.length)\n : namespacedKey;\n }\n\n // Utility function to determine MIME type\n private getMimeType(filename: string): string {\n const ext = filename.split(\".\").pop()?.toLowerCase();\n const mimeTypes: Record = {\n \"txt\": \"text/plain\",\n \"json\": \"application/json\",\n \"csv\": \"text/csv\",\n \"xml\": \"application/xml\",\n \"html\": \"text/html\",\n \"js\": \"application/javascript\",\n \"ts\": \"application/typescript\",\n \"md\": \"text/markdown\",\n \"pdf\": \"application/pdf\",\n \"png\": \"image/png\",\n \"jpg\": \"image/jpeg\",\n \"jpeg\": \"image/jpeg\",\n \"gif\": \"image/gif\",\n \"svg\": \"image/svg+xml\",\n \"css\": \"text/css\",\n \"yaml\": \"application/x-yaml\",\n \"yml\": \"application/x-yaml\",\n };\n\n return mimeTypes[ext || \"\"] || \"application/octet-stream\";\n }\n\n async get(key: string, versionId?: string): Promise {\n if (!key) {\n throw new Error(\"Key is required\");\n }\n\n const command = new GetObjectCommand({\n Bucket: this.bucketName,\n Key: this.namespacedKey(key),\n VersionId: versionId,\n });\n\n try {\n const response = await this.s3Client.send(command);\n const content = await response.Body?.transformToString() || \"\";\n\n return {\n key,\n content,\n contentType: response.ContentType || this.getMimeType(key),\n size: response.ContentLength,\n lastModified: response.LastModified,\n versionId: response.VersionId,\n };\n } catch (error: any) {\n if (error.name === \"NoSuchKey\") {\n return null;\n }\n throw error;\n }\n }\n\n // Check if a key is in the system folder and validate write permissions\n private validateSystemFolderAccess(key: string, operation: string, extendedAuthContext?: ExtendedAuthContext): void {\n if (key.startsWith(\"system/\")) {\n if (!extendedAuthContext?.isSystemMode) {\n throw new Error(`Access denied: ${operation} operations on system folder require admin privileges`);\n }\n }\n }\n\n async put(\n key: string,\n content: string,\n contentType?: string,\n metadata?: Record,\n ): Promise<{ versionId?: string }> {\n if (!key || content === undefined) {\n throw new Error(\"Key and content are required\");\n }\n\n // Demo namespace restrictions\n if (this.isDemo) {\n const maxSize = 10 * 1024; // 10KB limit for demo\n if (content.length > maxSize) {\n throw new Error(`Demo accounts are limited to ${maxSize} bytes per file`);\n }\n }\n\n // For system files, use the key as-is (don't add user namespace)\n // For regular files, use the namespaced key\n const finalKey = key.startsWith(\"system/\") ? key : this.namespacedKey(key);\n\n const command = new PutObjectCommand({\n Bucket: this.bucketName,\n Key: finalKey,\n Body: content,\n ContentType: contentType || this.getMimeType(key),\n Metadata: {\n ...metadata,\n namespace: key.startsWith(\"system/\") ? \"system\" : this.namespace,\n originalKey: key,\n uploadedAt: new Date().toISOString(),\n },\n });\n\n const response = await this.s3Client.send(command);\n return {\n versionId: response.VersionId,\n };\n }\n\n // Enhanced put method that supports system folder access with permission checking\n async putWithSystemFolder(\n key: string,\n content: string,\n contentType?: string,\n metadata?: Record,\n extendedAuthContext?: ExtendedAuthContext\n ): Promise<{ versionId?: string }> {\n // Check system folder write permissions\n this.validateSystemFolderAccess(key, \"write\", extendedAuthContext);\n \n // Use the standard put method which now handles system files correctly\n return this.put(key, content, contentType, metadata);\n }\n\n // Enhanced delete method that supports system folder access with permission checking\n async deleteWithSystemFolder(key: string, versionId?: string, extendedAuthContext?: ExtendedAuthContext): Promise {\n if (!key) {\n throw new Error(\"Key is required\");\n }\n\n // Check system folder write permissions\n this.validateSystemFolderAccess(key, \"delete\", extendedAuthContext);\n\n // For system files, use the key as-is (don't add user namespace)\n // For regular files, use the namespaced key\n const finalKey = key.startsWith(\"system/\") ? key : this.namespacedKey(key);\n\n const command = new DeleteObjectCommand({\n Bucket: this.bucketName,\n Key: finalKey,\n VersionId: versionId,\n });\n\n await this.s3Client.send(command);\n }\n\n // Enhanced move method that supports system folder access with permission checking\n async moveWithSystemFolder(sourceKey: string, destinationKey: string, extendedAuthContext?: ExtendedAuthContext): Promise {\n if (!sourceKey || !destinationKey) {\n throw new Error(\"Source and destination keys are required\");\n }\n\n // Check system folder write permissions for both source and destination\n this.validateSystemFolderAccess(sourceKey, \"move\", extendedAuthContext);\n this.validateSystemFolderAccess(destinationKey, \"move\", extendedAuthContext);\n\n // Handle system files correctly\n const finalSourceKey = sourceKey.startsWith(\"system/\") ? sourceKey : this.namespacedKey(sourceKey);\n const finalDestinationKey = destinationKey.startsWith(\"system/\") ? destinationKey : this.namespacedKey(destinationKey);\n\n // Copy object to new location\n const copyCommand = new CopyObjectCommand({\n Bucket: this.bucketName,\n CopySource: `${this.bucketName}/${finalSourceKey}`,\n Key: finalDestinationKey,\n });\n\n await this.s3Client.send(copyCommand);\n\n // Delete original object\n await this.deleteWithSystemFolder(sourceKey, undefined, extendedAuthContext);\n }\n\n // Enhanced copy method that supports system folder access with permission checking\n async copyWithSystemFolder(sourceKey: string, destinationKey: string, extendedAuthContext?: ExtendedAuthContext): Promise<{ versionId?: string }> {\n if (!sourceKey || !destinationKey) {\n throw new Error(\"Source and destination keys are required\");\n }\n\n // Check system folder write permissions for destination (reading source is always allowed)\n this.validateSystemFolderAccess(destinationKey, \"copy\", extendedAuthContext);\n\n // Handle system files correctly\n const finalSourceKey = sourceKey.startsWith(\"system/\") ? sourceKey : this.namespacedKey(sourceKey);\n const finalDestinationKey = destinationKey.startsWith(\"system/\") ? destinationKey : this.namespacedKey(destinationKey);\n\n const copyCommand = new CopyObjectCommand({\n Bucket: this.bucketName,\n CopySource: `${this.bucketName}/${finalSourceKey}`,\n Key: finalDestinationKey,\n });\n\n const response = await this.s3Client.send(copyCommand);\n return {\n versionId: response.VersionId,\n };\n }\n\n async delete(key: string, versionId?: string): Promise {\n if (!key) {\n throw new Error(\"Key is required\");\n }\n\n const command = new DeleteObjectCommand({\n Bucket: this.bucketName,\n Key: this.namespacedKey(key),\n VersionId: versionId,\n });\n\n await this.s3Client.send(command);\n }\n\n async list(prefix?: string, limit: number = 100): Promise {\n if (limit <= 0 || limit > 1000) {\n throw new Error(\"Limit must be between 1 and 1000\");\n }\n\n const keyPrefix = prefix\n ? this.namespacedKey(prefix)\n : `${this.namespace}/`;\n\n const command = new ListObjectsV2Command({\n Bucket: this.bucketName,\n Prefix: keyPrefix,\n MaxKeys: limit,\n });\n\n const response = await this.s3Client.send(command);\n\n return (response.Contents || []).map(object => ({\n key: this.stripNamespace(object.Key || \"\"),\n size: object.Size || 0,\n lastModified: object.LastModified || new Date(),\n contentType: this.getMimeType(object.Key || \"\"),\n etag: object.ETag,\n }));\n }\n\n async listVersions(key?: string, limit: number = 100): Promise {\n if (limit <= 0 || limit > 1000) {\n throw new Error(\"Limit must be between 1 and 1000\");\n }\n\n const keyPrefix = key\n ? this.namespacedKey(key)\n : `${this.namespace}/`;\n\n const command = new ListObjectVersionsCommand({\n Bucket: this.bucketName,\n Prefix: keyPrefix,\n MaxKeys: limit,\n });\n\n const response = await this.s3Client.send(command);\n\n const versions: FileMetadata[] = [];\n\n // Add object versions\n if (response.Versions) {\n versions.push(...response.Versions.map(version => ({\n key: this.stripNamespace(version.Key || \"\"),\n size: version.Size || 0,\n lastModified: version.LastModified || new Date(),\n contentType: this.getMimeType(version.Key || \"\"),\n versionId: version.VersionId,\n isLatest: version.IsLatest,\n etag: version.ETag,\n })));\n }\n\n // Add delete markers (if any)\n if (response.DeleteMarkers) {\n versions.push(...response.DeleteMarkers.map(marker => ({\n key: this.stripNamespace(marker.Key || \"\"),\n size: 0,\n lastModified: marker.LastModified || new Date(),\n contentType: \"application/x-delete-marker\",\n versionId: marker.VersionId,\n isLatest: marker.IsLatest,\n })));\n }\n\n // Sort by last modified date (newest first)\n return versions.sort((a, b) => b.lastModified.getTime() - a.lastModified.getTime());\n }\n\n async move(sourceKey: string, destinationKey: string): Promise {\n if (!sourceKey || !destinationKey) {\n throw new Error(\"Source and destination keys are required\");\n }\n\n // Copy object to new location\n const copyCommand = new CopyObjectCommand({\n Bucket: this.bucketName,\n CopySource: `${this.bucketName}/${this.namespacedKey(sourceKey)}`,\n Key: this.namespacedKey(destinationKey),\n });\n\n await this.s3Client.send(copyCommand);\n\n // Delete original object\n await this.delete(sourceKey);\n }\n\n async copy(sourceKey: string, destinationKey: string): Promise<{ versionId?: string }> {\n if (!sourceKey || !destinationKey) {\n throw new Error(\"Source and destination keys are required\");\n }\n\n const copyCommand = new CopyObjectCommand({\n Bucket: this.bucketName,\n CopySource: `${this.bucketName}/${this.namespacedKey(sourceKey)}`,\n Key: this.namespacedKey(destinationKey),\n });\n\n const response = await this.s3Client.send(copyCommand);\n return {\n versionId: response.VersionId,\n };\n }\n\n async exists(key: string): Promise {\n if (!key) {\n throw new Error(\"Key is required\");\n }\n\n try {\n const command = new HeadObjectCommand({\n Bucket: this.bucketName,\n Key: this.namespacedKey(key),\n });\n\n await this.s3Client.send(command);\n return true;\n } catch (error: any) {\n if (error.name === \"NotFound\" || error.name === \"NoSuchKey\") {\n return false;\n }\n throw error;\n }\n }\n\n async getMetadata(key: string, versionId?: string): Promise {\n if (!key) {\n throw new Error(\"Key is required\");\n }\n\n try {\n const command = new HeadObjectCommand({\n Bucket: this.bucketName,\n Key: this.namespacedKey(key),\n VersionId: versionId,\n });\n\n const response = await this.s3Client.send(command);\n\n return {\n key,\n size: response.ContentLength || 0,\n lastModified: response.LastModified || new Date(),\n contentType: response.ContentType || this.getMimeType(key),\n versionId: response.VersionId,\n etag: response.ETag,\n };\n } catch (error: any) {\n if (error.name === \"NotFound\" || error.name === \"NoSuchKey\") {\n return null;\n }\n throw error;\n }\n }\n\n // Enhanced get method that supports system folder access\n async getWithSystemFolder(key: string, versionId?: string, extendedAuthContext?: ExtendedAuthContext): Promise {\n if (!key) {\n throw new Error(\"Key is required\");\n }\n\n // Check if this is a system folder access\n if (key.startsWith(\"system/\")) {\n // For system folder access, all users can read but only admins can write\n // Use the existing S3 client (which already has admin credentials from environment)\n const command = new GetObjectCommand({\n Bucket: this.bucketName,\n Key: key, // Use key as-is for system files (already includes \"system/\" prefix)\n VersionId: versionId,\n });\n\n try {\n const response = await this.s3Client.send(command);\n const content = await response.Body?.transformToString() || \"\";\n\n return {\n key,\n content,\n contentType: response.ContentType || this.getMimeType(key),\n size: response.ContentLength,\n lastModified: response.LastModified,\n versionId: response.VersionId,\n isReadOnly: !extendedAuthContext?.isSystemMode, // Read-only for non-admin users\n };\n } catch (error: any) {\n if (error.name === \"NoSuchKey\") {\n return null;\n }\n throw error;\n }\n }\n\n // For regular files, use the standard get method\n const result = await this.get(key, versionId);\n return result;\n }\n\n // Enhanced list method that supports system folder access\n async listWithSystemFolder(prefix?: string, limit: number = 100, extendedAuthContext?: ExtendedAuthContext): Promise {\n if (limit <= 0 || limit > 1000) {\n throw new Error(\"Limit must be between 1 and 1000\");\n }\n\n const results: FileMetadata[] = [];\n\n // Always include system files for all users (shared read-only access)\n if (!prefix || prefix.startsWith(\"system/\")) {\n const systemPrefix = prefix?.startsWith(\"system/\") ? prefix.substring(7) : \"\";\n \n // For system files, use the existing S3 client (which already has admin credentials)\n // This allows all users to see system files, but only admins can modify them\n const systemCommand = new ListObjectsV2Command({\n Bucket: this.bucketName,\n Prefix: systemPrefix ? `system/${systemPrefix}` : \"system/\",\n MaxKeys: Math.min(limit, 500), // Reserve half the limit for system files\n });\n\n try {\n const systemResponse = await this.s3Client.send(systemCommand);\n const systemFiles = (systemResponse.Contents || []).map(object => ({\n key: object.Key || \"\", // Use the full key as-is from S3\n size: object.Size || 0,\n lastModified: object.LastModified || new Date(),\n contentType: this.getMimeType(object.Key || \"\"),\n etag: object.ETag,\n isReadOnly: !extendedAuthContext?.isSystemMode, // Read-only for non-admin users\n }));\n results.push(...systemFiles);\n } catch (error: any) {\n console.warn(\"System folder access failed:\", error.message);\n }\n }\n\n // If no prefix or prefix doesn't start with \"system/\", include user files\n if (!prefix || !prefix.startsWith(\"system/\")) {\n const userFiles = await this.list(prefix, limit - results.length);\n results.push(...userFiles);\n }\n\n // Sort by key and limit results\n return results\n .sort((a, b) => a.key.localeCompare(b.key))\n .slice(0, limit);\n }\n\n // Utility method to get namespace info (for debugging/admin)\n getNamespaceInfo(): { namespace: string; isDemo: boolean } {\n return {\n namespace: this.namespace,\n isDemo: this.isDemo,\n };\n }\n}",[],[67,192,220],"81310904-482e-11f0-adb9-76b3cceeab13","mcp","6935723a-650d-4d16-90b7-662be8ca3f3c",258,["D",1749802502157],[235,236],[67,229],{"_35":246,"_13":247,"_38":248,"_40":230,"_41":42,"_43":249,"_45":46,"_47":250,"_17":251,"_50":107,"_52":252,"_54":55,"_56":-5,"_78":253,"_18":254},{"_35":237,"_13":238,"_38":239,"_40":230,"_41":42,"_43":240,"_45":46,"_47":241,"_17":242,"_50":107,"_52":243,"_54":55,"_56":-5,"_78":244,"_18":245},"2fd8e84a-5ea6-11f0-b98e-0224a6c84d84","protocol-handlers.ts","8130f2e8-482e-11f0-adb9-76b3cceeab13",552,["D",1752272830873],21,"/**\n * MCP protocol-specific handlers (prompts, resources, etc.)\n */\n\nimport { S3Client } from \"https://esm.sh/@aws-sdk/client-s3@3.490.0\";\nimport { ExtendedAuthContext } from \"../auth/auth-manager.ts\";\nimport { NamespacedFilesStore } from \"../storage/files-store.ts\";\nimport { AuthContext } from \"../storage/kv-store.ts\";\nimport { ALL_TOOLS, ALL_TOOLS_WITH_ADMIN } from \"../tools/definitions.ts\";\nimport { CodeToolHandlers } from \"../tools/handlers/code-tools.ts\";\n\n// Environment variables\nconst S3_BUCKET = Deno.env.get(\"S3_BUCKET\") || \"example-bucket\";\nconst DYNAMODB_TABLE = Deno.env.get(\"DYNAMODB_TABLE\") || \"example-table\";\nconst MCP_SERVER_NAME = Deno.env.get(\"MCP_SERVER_NAME\") || \"aws-mcp-server\";\nconst MCP_SERVER_VERSION = Deno.env.get(\"MCP_SERVER_VERSION\") || \"1.0.0\";\n\nexport class MCPProtocolHandlers {\n private s3Client: S3Client;\n private codeHandlers?: CodeToolHandlers;\n\n constructor(s3Client: S3Client) {\n this.s3Client = s3Client;\n }\n\n setCodeHandlers(codeHandlers: CodeToolHandlers) {\n this.codeHandlers = codeHandlers;\n }\n\n async handleInitialize(params: any) {\n const { protocolVersion, capabilities, clientInfo } = params;\n\n // Validate protocol version\n if (protocolVersion !== \"2025-03-26\") {\n // throw new Error(`Unsupported protocol version: ${protocolVersion}. Expected: 2024-11-05`);\n }\n\n return {\n protocolVersion,\n capabilities: {\n prompts: {},\n resources: {},\n tools: {},\n },\n serverInfo: {\n name: MCP_SERVER_NAME,\n version: MCP_SERVER_VERSION,\n },\n };\n }\n\n async handleListPrompts(authContext?: ExtendedAuthContext) {\n const basePrompts = [\n {\n name: \"analyze-data\",\n description: \"Analyze data from DynamoDB and S3 resources\",\n arguments: [\n {\n name: \"table_key\",\n description: \"Key to query in DynamoDB table\",\n required: true,\n },\n {\n name: \"s3_key\",\n description: \"S3 object key to analyze\",\n required: false,\n },\n ],\n },\n {\n name: \"data-summary\",\n description: \"Generate a summary of available data sources\",\n arguments: [],\n },\n ];\n\n // Add skill prompts if available - now evaluated dynamically at runtime\n if (authContext && this.codeHandlers) {\n try {\n const skillPrompts = await this.codeHandlers.getAllSkillPrompts(authContext);\n return { prompts: [...basePrompts, ...skillPrompts] };\n } catch (error) {\n console.error(\"Error loading skill prompts:\", error);\n // Continue without skill prompts\n }\n }\n\n return { prompts: basePrompts };\n }\n\n async handleGetPrompt(params: any, authContext?: ExtendedAuthContext) {\n const { name, arguments: args } = params;\n\n let content = \"\";\n\n switch (name) {\n case \"analyze-data\":\n content = `Please analyze the following data:\n \nDynamoDB Table: ${DYNAMODB_TABLE}\nQuery Key: ${args?.table_key || \"Not specified\"}\n${args?.s3_key ? `S3 Object: s3://${S3_BUCKET}/${args.s3_key}` : \"\"}\n\nProvide insights on patterns, anomalies, and recommendations.`;\n break;\n\n case \"data-summary\":\n content = `Please provide a comprehensive summary of the available data sources:\n\n1. DynamoDB Table: ${DYNAMODB_TABLE}\n2. S3 Bucket: ${S3_BUCKET}\n\nInclude information about data structure, volume, and potential use cases.`;\n break;\n\n default:\n // Check if it's a skill prompt - now handled dynamically\n if (authContext && this.codeHandlers && name.includes(\"-\")) {\n try {\n // Parse skill name and prompt name from the combined name\n const dashIndex = name.indexOf(\"-\");\n const skillName = name.substring(0, dashIndex);\n const promptName = name.substring(dashIndex + 1);\n\n // Execute the skill prompt dynamically\n content = await this.codeHandlers.executeSkillPrompt(skillName, promptName, args, authContext);\n\n return {\n messages: [\n {\n role: \"user\",\n content: {\n type: \"text\",\n text: content,\n },\n },\n ],\n };\n } catch (error) {\n console.error(\"Error executing skill prompt:\", error);\n throw new Error(`Failed to execute skill prompt '${name}': ${error.message}`);\n }\n }\n\n throw new Error(`Prompt not found: ${name}`);\n }\n\n return {\n messages: [\n {\n role: \"user\",\n content: {\n type: \"text\",\n text: content,\n },\n },\n ],\n };\n }\n\n async handleListResources(authContext: AuthContext) {\n const filesStore = new NamespacedFilesStore(authContext, this.s3Client, S3_BUCKET);\n\n const files = await filesStore.list(undefined, 100);\n const resources = files.map((file) => ({\n uri: `file://${file.key}`,\n name: file.key,\n description: `File: ${file.key} (${file.size} bytes, modified: ${file.lastModified})`,\n mimeType: file.contentType,\n }));\n\n return { resources };\n }\n\n async handleReadResource(params: any, authContext: AuthContext) {\n const { uri } = params;\n\n if (!uri.startsWith(\"file://\")) {\n throw new Error(\"Only file:// URIs are supported\");\n }\n\n const key = uri.replace(\"file://\", \"\");\n const filesStore = new NamespacedFilesStore(authContext, this.s3Client, S3_BUCKET);\n\n const file = await filesStore.get(key);\n\n if (!file) {\n throw new Error(`File not found: ${key}`);\n }\n\n return {\n contents: [\n {\n uri: `file://${key}`,\n mimeType: file.contentType || \"text/plain\",\n text: file.content,\n },\n ],\n };\n }\n\n async handleListTools(authContext?: ExtendedAuthContext) {\n // Use admin tools if in admin mode, otherwise use regular tools\n let tools = authContext?.isSystemMode ? [...ALL_TOOLS_WITH_ADMIN] : [...ALL_TOOLS];\n\n // Add registered skills if we have an auth context and code handlers\n if (authContext && this.codeHandlers) {\n try {\n const registeredSkills = await this.codeHandlers.getRegisteredSkills(authContext);\n const skillTools = registeredSkills.map(skill => {\n const moduleTypeText = skill.moduleType === \"es6\" ? \"ES6 Module\" : \"Legacy Function\";\n const systemText = skill.isSystemSkill ? \" (System Skill)\" : \" (User Skill)\";\n const promptsText = skill.hasGetPrompts ? \" [Dynamic Prompts]\" : \"\";\n\n return {\n name: skill.name,\n description: `${skill.description}${systemText} - ${moduleTypeText}${promptsText}`,\n inputSchema: skill.inputSchema,\n };\n });\n tools = [...tools, ...skillTools];\n } catch (error) {\n console.error(\"Error loading registered skills:\", error);\n // Continue without registered skills\n }\n }\n\n return {\n tools,\n };\n }\n}",[],[67,229,238],"dc80a89e-5dde-11f0-ba0a-0224a6c84d84","handler.ts","94f6ca0a-482e-11f0-8e60-76b3cceeab13",535,["D",1752187221190],25,"/**\n * Refactored MCP SDK Handler for JSON-RPC requests\n * Uses extracted tool handlers and protocol handlers\n */\n\nimport { AuthManager, ExtendedAuthContext } from \"../auth/auth-manager.ts\";\nimport { createAWSClients } from \"../aws/clients.ts\";\nimport { AuthContext } from \"../storage/kv-store.ts\";\nimport {\n CodeToolHandlers,\n FilesToolHandlers,\n KVToolHandlers,\n OpenAIToolHandlers,\n AdminToolHandlers,\n} from \"../tools/handlers/index.ts\";\nimport { MCPProtocolHandlers } from \"./protocol-handlers.ts\";\n\n// Environment variables\nconst S3_BUCKET = Deno.env.get(\"S3_BUCKET\") || \"example-bucket\";\nconst DYNAMODB_TABLE = Deno.env.get(\"DYNAMODB_TABLE\") || \"example-table\";\n\nexport class MCPHandler {\n private authManager: AuthManager;\n private protocolHandlers: MCPProtocolHandlers;\n private kvHandlers: KVToolHandlers;\n private filesHandlers: FilesToolHandlers;\n private codeHandlers: CodeToolHandlers;\n private openaiHandlers: OpenAIToolHandlers;\n private adminHandlers: AdminToolHandlers;\n\n constructor() {\n this.authManager = new AuthManager();\n\n // Create AWS clients\n const { docClient, s3Client } = createAWSClients();\n\n // Initialize handlers\n this.protocolHandlers = new MCPProtocolHandlers(s3Client);\n this.kvHandlers = new KVToolHandlers(docClient, DYNAMODB_TABLE);\n this.filesHandlers = new FilesToolHandlers(s3Client, S3_BUCKET);\n this.openaiHandlers = new OpenAIToolHandlers();\n this.adminHandlers = new AdminToolHandlers(docClient, DYNAMODB_TABLE, this.filesHandlers, s3Client, S3_BUCKET);\n\n // Create tools context for code execution\n const toolsContext = this.createToolsContext();\n this.codeHandlers = new CodeToolHandlers(this.filesHandlers, toolsContext, docClient, DYNAMODB_TABLE);\n\n // Set code handlers reference in protocol handlers for skill listing\n this.protocolHandlers.setCodeHandlers(this.codeHandlers);\n }\n\n private createToolsContext(): Record {\n const toolsContext: Record = {\n test: () => \"noOp\",\n };\n\n // Add all available tools to the context\n const allTools = [\n {\n name: \"kv-get\",\n handler: (args: any, authContext: AuthContext) => this.kvHandlers.handleKVGet(args, authContext),\n },\n {\n name: \"kv-put\",\n handler: (args: any, authContext: AuthContext) => this.kvHandlers.handleKVPut(args, authContext),\n },\n {\n name: \"kv-delete\",\n handler: (args: any, authContext: AuthContext) => this.kvHandlers.handleKVDelete(args, authContext),\n },\n {\n name: \"kv-list\",\n handler: (args: any, authContext: AuthContext) => this.kvHandlers.handleKVList(args, authContext),\n },\n {\n name: \"kv-query\",\n handler: (args: any, authContext: AuthContext) => this.kvHandlers.handleKVQuery(args, authContext),\n },\n {\n name: \"files-get\",\n handler: (args: any, authContext: AuthContext) => this.filesHandlers.handleFilesGet(args, authContext),\n },\n {\n name: \"files-put\",\n handler: (args: any, authContext: AuthContext) => this.filesHandlers.handleFilesPut(args, authContext),\n },\n {\n name: \"files-delete\",\n handler: (args: any, authContext: AuthContext) => this.filesHandlers.handleFilesDelete(args, authContext),\n },\n {\n name: \"files-list\",\n handler: (args: any, authContext: AuthContext) => this.filesHandlers.handleFilesList(args, authContext),\n },\n {\n name: \"files-list-versions\",\n handler: (args: any, authContext: AuthContext) => this.filesHandlers.handleFilesListVersions(args, authContext),\n },\n {\n name: \"files-move\",\n handler: (args: any, authContext: AuthContext) => this.filesHandlers.handleFilesMove(args, authContext),\n },\n {\n name: \"files-copy\",\n handler: (args: any, authContext: AuthContext) => this.filesHandlers.handleFilesCopy(args, authContext),\n },\n {\n name: \"files-exists\",\n handler: (args: any, authContext: AuthContext) => this.filesHandlers.handleFilesExists(args, authContext),\n },\n {\n name: \"files-metadata\",\n handler: (args: any, authContext: AuthContext) => this.filesHandlers.handleFilesMetadata(args, authContext),\n },\n {\n name: \"openai-chat-completion\",\n handler: (args: any, authContext: AuthContext) => this.openaiHandlers.handleChatCompletion(args, authContext),\n },\n {\n name: \"code-exec\",\n handler: (args: any, authContext: AuthContext) => this.codeHandlers.handleCodeExec(args, authContext),\n },\n ];\n\n // Store the auth context for later use in tool execution\n let currentAuthContext: AuthContext;\n\n allTools.forEach(tool => {\n toolsContext[tool.name] = async (args: any) => {\n console.log(`[CodeExec] Executing tool ${tool.name}`, args);\n return await tool.handler(args, currentAuthContext);\n };\n });\n\n // Store a reference to set the auth context\n (toolsContext as any)._setAuthContext = (authContext: AuthContext) => {\n currentAuthContext = authContext;\n };\n\n return toolsContext;\n }\n\n // Handle streamable HTTP request\n async handleStreamableRequest(request: Request, body: any, authContext: ExtendedAuthContext): Promise {\n try {\n // Set auth context for code execution tools\n (this.codeHandlers as any).toolsContext._setAuthContext(authContext);\n\n // Process JSON-RPC request directly\n console.log(\"[MCP] Received JSON-RPC request:\", body);\n const { jsonrpc, method, params, id } = body;\n\n if (jsonrpc !== \"2.0\") {\n return {\n jsonrpc: \"2.0\",\n id,\n error: {\n code: -32600,\n message: \"Invalid Request: jsonrpc must be '2.0'\",\n },\n };\n }\n\n // Route the method to appropriate handler\n let result;\n\n switch (method) {\n case \"initialize\":\n result = await this.protocolHandlers.handleInitialize(params);\n break;\n case \"prompts/list\":\n result = await this.protocolHandlers.handleListPrompts(authContext);\n break;\n case \"prompts/get\":\n result = await this.protocolHandlers.handleGetPrompt(params, authContext);\n break;\n case \"resources/list\":\n result = await this.protocolHandlers.handleListResources(authContext);\n break;\n case \"resources/read\":\n result = await this.protocolHandlers.handleReadResource(params, authContext);\n break;\n case \"tools/list\":\n result = await this.protocolHandlers.handleListTools(authContext);\n break;\n case \"tools/call\":\n result = await this.handleCallTool(params, authContext);\n break;\n case \"notifications/initialized\":\n return null;\n default:\n console.error(`[MCP] Unknown method: ${method}`);\n return {\n jsonrpc: \"2.0\",\n id,\n error: {\n code: -32601,\n message: `Method not found: ${method}`,\n },\n };\n }\n console.log(\"[MCP] Response:\", result);\n return {\n jsonrpc: \"2.0\",\n id,\n result,\n };\n } catch (error) {\n console.error(`[MCP] handleStreamableRequest Error:`, error);\n return {\n jsonrpc: \"2.0\",\n id: body?.id || null,\n error: {\n code: -32603,\n message: error.message || \"Internal error\",\n },\n };\n }\n }\n\n private async handleCallTool(params: any, authContext: ExtendedAuthContext) {\n const { name, arguments: args } = params;\n\n console.log(`[MCP] Calling tool: ${name}`, args);\n\n const toolErrorWrapper = async (p: Promise) => {\n try {\n return await p;\n } catch (err) {\n console.error(`[MCP] Tool (${name}) error`, err);\n return {\n content: [{\n type: \"text\",\n text: `Error: ${name} tool failed. With error: ${\n JSON.stringify({ message: err.message, stack: err.stack })\n }`,\n }],\n };\n }\n };\n\n switch (name) {\n // KV Store tools\n case \"kv-get\":\n return await toolErrorWrapper(this.kvHandlers.handleKVGet(args, authContext));\n case \"kv-put\":\n return await toolErrorWrapper(this.kvHandlers.handleKVPut(args, authContext));\n case \"kv-delete\":\n return await toolErrorWrapper(this.kvHandlers.handleKVDelete(args, authContext));\n case \"kv-list\":\n return await toolErrorWrapper(this.kvHandlers.handleKVList(args, authContext));\n case \"kv-query\":\n return await toolErrorWrapper(this.kvHandlers.handleKVQuery(args, authContext));\n\n // Files Store tools\n case \"files-get\":\n return await toolErrorWrapper(this.filesHandlers.handleFilesGet(args, authContext));\n case \"files-put\":\n return await toolErrorWrapper(this.filesHandlers.handleFilesPut(args, authContext));\n case \"files-delete\":\n return await toolErrorWrapper(this.filesHandlers.handleFilesDelete(args, authContext));\n case \"files-list\":\n return await toolErrorWrapper(this.filesHandlers.handleFilesList(args, authContext));\n case \"files-list-versions\":\n return await toolErrorWrapper(this.filesHandlers.handleFilesListVersions(args, authContext));\n case \"files-move\":\n return await toolErrorWrapper(this.filesHandlers.handleFilesMove(args, authContext));\n case \"files-copy\":\n return await toolErrorWrapper(this.filesHandlers.handleFilesCopy(args, authContext));\n case \"files-exists\":\n return await toolErrorWrapper(this.filesHandlers.handleFilesExists(args, authContext));\n case \"files-metadata\":\n return await toolErrorWrapper(this.filesHandlers.handleFilesMetadata(args, authContext));\n\n // Code execution\n case \"code-exec\":\n return await toolErrorWrapper(this.codeHandlers.handleCodeExec(args, authContext));\n\n // Skill management\n case \"register-skill\":\n return await toolErrorWrapper(this.codeHandlers.handleRegisterSkill(args, authContext));\n case \"unregister-skill\":\n return await toolErrorWrapper(this.codeHandlers.handleUnregisterSkill(args, authContext));\n case \"list-skills\":\n return await toolErrorWrapper(this.codeHandlers.handleListSkills(args, authContext));\n\n // OpenAI tools\n case \"openai-chat-completion\":\n return await toolErrorWrapper(this.openaiHandlers.handleChatCompletion(args, authContext));\n\n // Admin tools (only available in admin mode)\n case \"admin-promote-skill\":\n return await toolErrorWrapper(this.adminHandlers.handleAdminPromoteSkill(args, authContext));\n case \"admin-demote-skill\":\n return await toolErrorWrapper(this.adminHandlers.handleAdminDemoteSkill(args, authContext));\n case \"admin-list-promoted-skills\":\n return await toolErrorWrapper(this.adminHandlers.handleAdminListPromotedSkills(args, authContext));\n case \"admin-update-promoted-skill\":\n return await toolErrorWrapper(this.adminHandlers.handleAdminUpdatePromotedSkill(args, authContext));\n case \"admin-read-val-file\":\n return await toolErrorWrapper(this.adminHandlers.handleAdminReadValFile(args, authContext));\n case \"admin-write-val-file\":\n return await toolErrorWrapper(this.adminHandlers.handleAdminWriteValFile(args, authContext));\n case \"admin-list-val-files\":\n return await toolErrorWrapper(this.adminHandlers.handleAdminListValFiles(args, authContext));\n case \"admin-project-info\":\n return await toolErrorWrapper(this.adminHandlers.handleAdminProjectInfo(args, authContext));\n\n default:\n // Check if it's a registered skill\n try {\n const registeredSkills = await this.codeHandlers.getRegisteredSkills(authContext);\n const skill = registeredSkills.find(s => s.name === name);\n if (skill) {\n return await toolErrorWrapper(this.codeHandlers.handleSkillExecution(name, args, authContext));\n }\n } catch (error) {\n console.error(`Error checking registered skills: ${error.message}`);\n }\n\n throw new Error(`Unknown tool: ${name}`);\n }\n }\n}",[],[67,229,247],"74109f3c-482e-11f0-a0d4-76b3cceeab13","aws","658b598d-2ff9-412b-824f-70971a62fcc3",257,["D",1749802480132],[262],[67,256],{"_35":263,"_13":264,"_38":265,"_40":257,"_41":42,"_43":266,"_45":46,"_47":267,"_17":268,"_50":107,"_52":269,"_54":55,"_56":-5,"_78":270,"_18":271},"02b61516-59e4-11f0-8d96-f69ea79377d9","clients.ts","74109582-482e-11f0-a0d4-76b3cceeab13",468,["D",1751749628127],2,"/**\n * AWS client configuration and creation utilities\n */\n\nimport { DynamoDBClient } from \"https://esm.sh/@aws-sdk/client-dynamodb@3.490.0\";\nimport { S3Client } from \"https://esm.sh/@aws-sdk/client-s3@3.490.0\";\nimport { DynamoDBDocumentClient } from \"https://esm.sh/@aws-sdk/lib-dynamodb@3.490.0\";\n\n// Environment variables\nconst AWS_REGION = Deno.env.get(\"AWS_REGION\") || \"us-east-1\";\nconst AWS_ACCESS_KEY_ID = Deno.env.get(\"AWS_ACCESS_KEY_ID\") || \"EXAMPLE_ACCESS_KEY\";\nconst AWS_SECRET_ACCESS_KEY = Deno.env.get(\"AWS_SECRET_ACCESS_KEY\") || \"EXAMPLE_SECRET_KEY\";\n\nexport interface AWSClients {\n docClient: DynamoDBDocumentClient;\n s3Client: S3Client;\n}\n\n// Create AWS clients with credentials from environment\nexport function createAWSClients(): AWSClients {\n const credentials = {\n accessKeyId: AWS_ACCESS_KEY_ID!,\n secretAccessKey: AWS_SECRET_ACCESS_KEY!,\n };\n\n const dynamoClient = new DynamoDBClient({\n region: AWS_REGION,\n credentials,\n });\n\n const docClient = DynamoDBDocumentClient.from(dynamoClient);\n\n const s3Client = new S3Client({\n region: AWS_REGION,\n credentials,\n });\n\n return { docClient, s3Client };\n}",[],[67,256,264],"0ba29f0e-482e-11f0-836e-76b3cceeab13","auth","0fff4559-6788-4a29-8f41-301920f67e08",251,["D",1749802304930],[279],[67,273],{"_35":280,"_13":281,"_38":282,"_40":274,"_41":42,"_43":283,"_45":46,"_47":284,"_17":285,"_50":107,"_52":286,"_54":55,"_56":-5,"_78":287,"_18":288},"3511c87e-4914-11f0-a87a-76b3cceeab13","auth-manager.ts","0ba2940a-482e-11f0-836e-76b3cceeab13",328,["D",1749901158691],5,"/**\n * Authentication and namespace management\n * Handles token-to-namespace resolution and access control\n */\n\nimport { AuthContext } from \"../storage/kv-store.ts\";\n\nexport interface ExtendedAuthContext extends AuthContext {\n isSystemMode?: boolean;\n originalToken?: string;\n}\n\nexport class AuthManager {\n /**\n * Resolve authentication context from request\n * Returns namespace and authentication status, including system mode detection\n */\n resolveAuthContext(request: Request): ExtendedAuthContext {\n const authHeader = request.headers.get(\"Authorization\");\n \n if (!authHeader?.startsWith(\"Bearer \")) {\n return { namespace: \"demo\", isDemo: true };\n }\n \n const token = authHeader.substring(7).trim();\n \n if (!token) {\n return { namespace: \"demo\", isDemo: true };\n }\n \n // Store original token for namespace generation\n const originalToken = token;\n \n // Check if token matches AWS secret key for system mode\n const awsSecretKey = Deno.env.get(\"AWS_SECRET_ACCESS_KEY\");\n const systemModeToken = Deno.env.get(\"SYSTEM_MODE_TOKEN\") || \"system-admin-key\";\n \n // System mode can be activated by either AWS secret key or system mode token\n const isSystemMode = (awsSecretKey && token === awsSecretKey) || \n (token === systemModeToken);\n \n if (isSystemMode) {\n // SURGICAL CHANGE: Generate namespace from original token \n // This ensures consistent namespace across modes\n const systemNamespace = this.tokenToNamespace(originalToken);\n return { \n namespace: systemNamespace, // Use generated namespace instead of hardcoded \"system\"\n isDemo: false, \n isSystemMode: true,\n originalToken // Optionally store original token for additional context\n };\n }\n \n // Generate namespace from token\n const namespace = this.tokenToNamespace(token);\n \n return { namespace, isDemo: false, isSystemMode: false };\n }\n\n /**\n * Extract AWS secret key from request for AWS operations\n * Returns null if not authenticated or invalid format\n */\n extractAWSCredentials(request: Request): string | null {\n const authHeader = request.headers.get(\"Authorization\");\n \n if (!authHeader?.startsWith(\"Bearer \")) {\n return null;\n }\n \n const token = authHeader.substring(7).trim();\n \n if (!token) {\n return null;\n }\n \n return token;\n }\n\n /**\n * Convert token to namespace identifier\n * Uses a simple hash for now, can be enhanced with lookup tables\n */\n private tokenToNamespace(token: string): string {\n // Simple hash function for namespace generation\n let hash = 0;\n for (let i = 0; i < token.length; i++) {\n const char = token.charCodeAt(i);\n hash = ((hash << 5) - hash) + char;\n hash = hash & hash; // Convert to 32-bit integer\n }\n \n // Create a readable namespace identifier\n const hashStr = Math.abs(hash).toString(36);\n return `ns_${hashStr}`;\n }\n\n /**\n * Validate if a namespace has access to perform operations\n * System mode has access to all operations including system tools\n */\n validateAccess(namespace: string, operation: string, isSystemMode: boolean = false): boolean {\n // System mode has access to everything\n if (isSystemMode) {\n return true;\n }\n \n // Demo namespace has limited access (could add restrictions here)\n if (namespace === \"demo\") {\n return true; // Allow demo operations for now\n }\n \n // All other namespaces have full access to their own data\n return true;\n }\n\n /**\n * Check if the current context has system-level access\n */\n hasSystemAccess(authContext: ExtendedAuthContext): boolean {\n return authContext.isSystemMode === true;\n }\n}",[],[67,273,281],"c5961c8a-4557-11f0-999b-76b3cceeab13",["D",1749490372788],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","21f2e37e-8066-4730-9dc7-d27cf8d3c9f3","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","0630d977-f678-453e-926c-52043293f59f","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_341":337},"org",{"_11":12,"_335":-5,"_336":337,"_298":299,"_338":339,"_340":55},"branch",{"_17":61,"_13":16,"_35":42,"_327":289,"_328":-5,"_329":-5,"_330":-5,"_331":-5,"_332":-5,"_333":14,"_334":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yb2RJNlc1czZ1NlpZRmoxdGJ2eFVNNVhmeTYifQ","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_35":289,"_13":14,"_47":452,"_291":-5,"_292":55,"_293":294,"_295":294,"_296":-5,"_297":-5,"_298":299,"_300":39,"_301":46,"_302":46,"_303":-5,"_304":71,"_305":306,"_307":-5,"_308":-5,"_309":-5,"_310":-5,"_311":312,"_313":312,"_314":315,"_316":315,"_317":315,"_318":312,"_319":312,"_320":453,"_322":454,"_324":455,"_326":55},[377,400,401],"files",[377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401],"counts",{"_367":71,"_368":268,"_369":71,"_31":370,"_371":372},[361,362,363],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{"_39":360},"contextual.parc.land",{"_35":66,"_13":67,"_38":68,"_40":-5,"_41":42,"_43":69,"_45":46,"_47":70,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_18":366},{"_35":58,"_13":59,"_38":60,"_40":-5,"_41":42,"_43":61,"_45":46,"_47":62,"_17":63,"_50":24,"_52":64,"_54":55,"_56":-5,"_18":365},{"_35":36,"_13":37,"_38":39,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":48,"_17":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_18":364},[37],[59],[67],"pulls","branches","forks",{"_373":375,"_376":71},"connections",{"_373":71,"_374":71},"count","unfilledCount",7,"emptyCount",{"_35":66,"_13":67,"_38":68,"_40":-5,"_41":42,"_43":69,"_45":46,"_47":84,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":450,"_18":451},{"_35":272,"_13":273,"_38":274,"_40":68,"_41":42,"_43":275,"_45":46,"_47":276,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":448,"_18":449},{"_35":280,"_13":281,"_38":282,"_40":274,"_41":42,"_43":283,"_45":46,"_47":284,"_17":285,"_50":107,"_52":286,"_54":55,"_56":-5,"_78":446,"_18":447},{"_35":255,"_13":256,"_38":257,"_40":68,"_41":42,"_43":258,"_45":46,"_47":259,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":444,"_18":445},{"_35":263,"_13":264,"_38":265,"_40":257,"_41":42,"_43":266,"_45":46,"_47":267,"_17":268,"_50":107,"_52":269,"_54":55,"_56":-5,"_78":442,"_18":443},{"_35":228,"_13":229,"_38":230,"_40":68,"_41":42,"_43":231,"_45":46,"_47":232,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":440,"_18":441},{"_35":246,"_13":247,"_38":248,"_40":230,"_41":42,"_43":249,"_45":46,"_47":250,"_17":251,"_50":107,"_52":252,"_54":55,"_56":-5,"_78":438,"_18":439},{"_35":237,"_13":238,"_38":239,"_40":230,"_41":42,"_43":240,"_45":46,"_47":241,"_17":242,"_50":107,"_52":243,"_54":55,"_56":-5,"_78":436,"_18":437},{"_35":191,"_13":192,"_38":193,"_40":68,"_41":42,"_43":194,"_45":46,"_47":195,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":434,"_18":435},{"_35":219,"_13":220,"_38":221,"_40":193,"_41":42,"_43":222,"_45":46,"_47":223,"_17":224,"_50":107,"_52":225,"_54":55,"_56":-5,"_78":432,"_18":433},{"_35":210,"_13":211,"_38":212,"_40":193,"_41":42,"_43":213,"_45":46,"_47":214,"_17":215,"_50":107,"_52":216,"_54":55,"_56":-5,"_78":430,"_18":431},{"_35":201,"_13":202,"_38":203,"_40":193,"_41":42,"_43":204,"_45":46,"_47":205,"_17":206,"_50":107,"_52":207,"_54":55,"_56":-5,"_78":428,"_18":429},{"_35":111,"_13":112,"_38":113,"_40":68,"_41":42,"_43":114,"_45":46,"_47":115,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":426,"_18":427},{"_35":129,"_13":130,"_38":131,"_40":113,"_41":42,"_43":132,"_45":46,"_47":133,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":424,"_18":425},{"_35":182,"_13":183,"_38":184,"_40":131,"_41":42,"_43":185,"_45":46,"_47":186,"_17":187,"_50":107,"_52":188,"_54":55,"_56":-5,"_78":422,"_18":423},{"_35":173,"_13":174,"_38":175,"_40":131,"_41":42,"_43":176,"_45":46,"_47":177,"_17":178,"_50":107,"_52":179,"_54":55,"_56":-5,"_78":420,"_18":421},{"_35":164,"_13":165,"_38":166,"_40":131,"_41":42,"_43":167,"_45":46,"_47":168,"_17":169,"_50":107,"_52":170,"_54":55,"_56":-5,"_78":418,"_18":419},{"_35":157,"_13":37,"_38":158,"_40":131,"_41":42,"_43":159,"_45":46,"_47":160,"_17":106,"_50":107,"_52":161,"_54":55,"_56":-5,"_78":416,"_18":417},{"_35":150,"_13":151,"_38":152,"_40":131,"_41":42,"_43":132,"_45":46,"_47":153,"_17":71,"_50":107,"_52":154,"_54":55,"_56":-5,"_78":414,"_18":415},{"_35":142,"_13":143,"_38":144,"_40":131,"_41":42,"_43":145,"_45":46,"_47":146,"_17":71,"_50":107,"_52":147,"_54":55,"_56":-5,"_78":412,"_18":413},{"_35":120,"_13":121,"_38":122,"_40":113,"_41":42,"_43":123,"_45":46,"_47":124,"_17":125,"_50":107,"_52":126,"_54":55,"_56":-5,"_78":410,"_18":411},{"_35":93,"_13":94,"_38":95,"_40":68,"_41":42,"_43":96,"_45":46,"_47":97,"_17":71,"_50":72,"_52":-5,"_54":55,"_56":-5,"_78":408,"_18":409},{"_35":101,"_13":102,"_38":103,"_40":95,"_41":42,"_43":104,"_45":46,"_47":105,"_17":106,"_50":107,"_52":108,"_54":55,"_56":-5,"_78":406,"_18":407},{"_35":58,"_13":59,"_38":60,"_40":-5,"_41":42,"_43":61,"_45":46,"_47":81,"_17":63,"_50":24,"_52":64,"_54":55,"_56":-5,"_78":404,"_18":405},{"_35":36,"_13":37,"_38":39,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":77,"_17":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_78":402,"_18":403},[],[37],[],[59],[],[67,94,102],[399],[67,94],[],[67,112,121],[],[67,112,130,143],[],[67,112,130,151],[],[67,112,130,37],[],[67,112,130,165],[],[67,112,130,174],[],[67,112,130,183],[391,392,393,394,395,396],[67,112,130],[390,397],[67,112],[],[67,192,202],[],[67,192,211],[],[67,192,220],[386,387,388],[67,192],[],[67,229,238],[],[67,229,247],[383,384],[67,229],[],[67,256,264],[381],[67,256],[],[67,273,281],[379],[67,273],[378,380,382,385,389,398],[67],["D",1749490372788],{"_11":12,"_341":337},{"_11":12,"_335":-5,"_336":337,"_298":299,"_338":339,"_340":55},{"_17":61,"_13":16,"_35":42,"_327":289,"_328":-5,"_329":-5,"_330":-5,"_331":-5,"_332":-5,"_333":14,"_334":12},"ctx",{"_320":-5,"_357":489,"_490":491,"_492":493,"_494":55,"_495":55,"_496":55,"_497":46,"_498":-5,"_499":-7,"_500":-7,"_501":71,"_502":55,"_503":55,"_504":-5,"_505":55,"_506":55,"_507":55,"_508":-5},"ENV",{"_460":461,"_462":463,"_464":16,"_465":466,"_467":468,"_469":470,"_471":472,"_473":474,"_475":476,"_477":478,"_479":480,"_481":482,"_483":484,"_485":486,"_487":488},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]