@alfe.ai/myob-mcp 0.3.15 → 0.3.17

package/README.md

@@ -1,6 +1,7 @@
 # @alfe.ai/myob-mcp
 
-MYOB Business MCP server — direct API integration with Alfe OAuth credentials and automatic token refresh
+MYOB Business MCP server with explicit multi-business selection, Alfe-managed
+OAuth credentials, and per-Connection automatic token refresh.
 
 Part of [**Alfe**](https://alfe.ai) — the operating system for AI agents: build, deploy, and run agents with persistent memory, identity, integrations, and channels. See the [documentation](https://docs.alfe.ai) to get started.
 
@@ -10,6 +11,11 @@ Part of [**Alfe**](https://alfe.ai) — the operating system for AI agents: buil
 npm install @alfe.ai/myob-mcp
 ```
 
+Every MYOB API tool requires the `myobBusinessId` returned by
+`myob_list_businesses`, so reads and financial writes cannot silently target a
+default company file. Access tokens are refreshed independently for each
+connected business.
+
 ## Links
 
 - 🌐 Website: <https://alfe.ai>

package/dist/server.js

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
 import { resolveConfig } from "@alfe.ai/config";
 import { AgentApiClient } from "@alfe.ai/agent-api-client";
-import { z } from "zod";
+import { assertPatternA } from "@alfe.ai/mcp-bundler";
 //#region src/myob-client.ts
 /**
 * MYOB Business API client — wraps fetch with required headers,
@@ -15,6 +16,7 @@ import { z } from "zod";
 * - x-myobapi-version: v2
 */
 const MYOB_API_BASE = "https://api.myob.com/accountright";
+const MYOB_REQUEST_TIMEOUT_MS = 3e4;
 var MyobClient = class {
 	accessToken;
 	clientId;
@@ -30,7 +32,7 @@ var MyobClient = class {
 		this.accessToken = accessToken;
 	}
 	get baseUrl() {
-		return `${MYOB_API_BASE}/${this.businessId}`;
+		return `${MYOB_API_BASE}/${encodeURIComponent(this.businessId)}`;
 	}
 	headers() {
 		return {
@@ -62,7 +64,8 @@ var MyobClient = class {
 		const doFetch = async () => {
 			const init = {
 				method,
-				headers: this.headers()
+				headers: this.headers(),
+				signal: AbortSignal.timeout(MYOB_REQUEST_TIMEOUT_MS)
 			};
 			if (body !== void 0) init.body = JSON.stringify(body);
 			return fetch(url, init);
@@ -89,13 +92,36 @@ var MyobClient = class {
 * expects a raw Zod shape (`{ field: z.string() }`), NOT a JSON-Schema
 * object — passing JSON-Schema throws synchronously at registration time.
 */
-const myobBusinessIdField = z.string().describe("MYOB Business ID — use the value from myob_list_businesses to pick which connected business this call should target.");
+const myobBusinessIdField = z.string().min(1).describe("MYOB Business ID — use the value from myob_list_businesses to pick which connected business this call should target.");
+const myobResourceUidField = z.string().min(1).describe("MYOB resource UID (GUID)");
+function myobResourcePath(collectionPath, uid) {
+	return `${collectionPath}/${encodeURIComponent(uid)}`;
+}
+const readOnlyToolAnnotations = {
+	readOnlyHint: true,
+	destructiveHint: false,
+	idempotentHint: true,
+	openWorldHint: true
+};
+const additiveToolAnnotations = {
+	readOnlyHint: false,
+	destructiveHint: false,
+	idempotentHint: false,
+	openWorldHint: true
+};
+const updateToolAnnotations = {
+	readOnlyHint: false,
+	destructiveHint: true,
+	idempotentHint: false,
+	openWorldHint: true
+};
 //#endregion
 //#region src/tools/contacts.ts
 function registerContactTools(server, resolveClient) {
 	const register = server.registerTool.bind(server);
 	register("myob_list_customers", {
 		description: "List customer contacts from a connected MYOB Business.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			filter: z.string().optional().describe("OData $filter expression (e.g. \"IsActive eq true\")"),
@@ -116,12 +142,13 @@ function registerContactTools(server, resolveClient) {
 	});
 	register("myob_get_customer", {
 		description: "Get a specific customer contact by UID from a connected MYOB Business.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
-			uid: z.string().describe("The customer UID (GUID)")
+			uid: myobResourceUidField.describe("The customer UID (GUID)")
 		}
 	}, async (args) => {
-		const result = await resolveClient(args.myobBusinessId).get(`/Contact/Customer/${args.uid}`);
+		const result = await resolveClient(args.myobBusinessId).get(myobResourcePath("/Contact/Customer", args.uid));
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
@@ -129,6 +156,7 @@ function registerContactTools(server, resolveClient) {
 	});
 	register("myob_create_customer", {
 		description: "Create a new customer contact in a connected MYOB Business.",
+		annotations: additiveToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			CompanyName: z.string().optional().describe("Company name"),
@@ -154,13 +182,14 @@ function registerContactTools(server, resolveClient) {
 	});
 	register("myob_update_customer", {
 		description: "Update an existing customer contact in a connected MYOB Business.",
+		annotations: updateToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
-			uid: z.string().describe("The customer UID (GUID) to update"),
+			uid: myobResourceUidField.describe("The customer UID (GUID) to update"),
 			data: z.record(z.string(), z.unknown()).describe("Customer data fields to update")
 		}
 	}, async (args) => {
-		const result = await resolveClient(args.myobBusinessId).put(`/Contact/Customer/${args.uid}`, args.data);
+		const result = await resolveClient(args.myobBusinessId).put(myobResourcePath("/Contact/Customer", args.uid), args.data);
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
@@ -168,6 +197,7 @@ function registerContactTools(server, resolveClient) {
 	});
 	register("myob_list_suppliers", {
 		description: "List supplier contacts from a connected MYOB Business.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			filter: z.string().optional().describe("OData $filter expression"),
@@ -188,12 +218,13 @@ function registerContactTools(server, resolveClient) {
 	});
 	register("myob_get_supplier", {
 		description: "Get a specific supplier contact by UID from a connected MYOB Business.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
-			uid: z.string().describe("The supplier UID (GUID)")
+			uid: myobResourceUidField.describe("The supplier UID (GUID)")
 		}
 	}, async (args) => {
-		const result = await resolveClient(args.myobBusinessId).get(`/Contact/Supplier/${args.uid}`);
+		const result = await resolveClient(args.myobBusinessId).get(myobResourcePath("/Contact/Supplier", args.uid));
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
@@ -201,6 +232,7 @@ function registerContactTools(server, resolveClient) {
 	});
 	register("myob_create_supplier", {
 		description: "Create a new supplier contact in a connected MYOB Business.",
+		annotations: additiveToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			CompanyName: z.string().optional().describe("Company name"),
@@ -231,6 +263,7 @@ function registerSalesTools(server, resolveClient) {
 	const register = server.registerTool.bind(server);
 	register("myob_list_invoices", {
 		description: "List sale invoices from a connected MYOB Business.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			filter: z.string().optional().describe("OData $filter expression (e.g. \"Status eq 'Open'\")"),
@@ -251,12 +284,13 @@ function registerSalesTools(server, resolveClient) {
 	});
 	register("myob_get_invoice", {
 		description: "Get a specific sale invoice by UID from a connected MYOB Business.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
-			uid: z.string().describe("The invoice UID (GUID)")
+			uid: myobResourceUidField.describe("The invoice UID (GUID)")
 		}
 	}, async (args) => {
-		const result = await resolveClient(args.myobBusinessId).get(`/Sale/Invoice/${args.uid}`);
+		const result = await resolveClient(args.myobBusinessId).get(myobResourcePath("/Sale/Invoice", args.uid));
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
@@ -264,6 +298,7 @@ function registerSalesTools(server, resolveClient) {
 	});
 	register("myob_create_invoice", {
 		description: "Create a new sale invoice in a connected MYOB Business. Provide customer, line items, and dates.",
+		annotations: additiveToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			data: z.record(z.string(), z.unknown()).describe("Full invoice data object including Customer, Date, Lines, etc.")
@@ -277,6 +312,7 @@ function registerSalesTools(server, resolveClient) {
 	});
 	register("myob_list_quotes", {
 		description: "List sale quotes from a connected MYOB Business.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			filter: z.string().optional().describe("OData $filter expression"),
@@ -297,6 +333,7 @@ function registerSalesTools(server, resolveClient) {
 	});
 	register("myob_create_quote", {
 		description: "Create a new sale quote in a connected MYOB Business.",
+		annotations: additiveToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			data: z.record(z.string(), z.unknown()).describe("Full quote data object including Customer, Date, Lines, etc.")
@@ -315,6 +352,7 @@ function registerPurchaseTools(server, resolveClient) {
 	const register = server.registerTool.bind(server);
 	register("myob_list_bills", {
 		description: "List purchase bills from a connected MYOB Business.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			filter: z.string().optional().describe("OData $filter expression"),
@@ -335,12 +373,13 @@ function registerPurchaseTools(server, resolveClient) {
 	});
 	register("myob_get_bill", {
 		description: "Get a specific purchase bill by UID from a connected MYOB Business.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
-			uid: z.string().describe("The bill UID (GUID)")
+			uid: myobResourceUidField.describe("The bill UID (GUID)")
 		}
 	}, async (args) => {
-		const result = await resolveClient(args.myobBusinessId).get(`/Purchase/Bill/${args.uid}`);
+		const result = await resolveClient(args.myobBusinessId).get(myobResourcePath("/Purchase/Bill", args.uid));
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
@@ -348,6 +387,7 @@ function registerPurchaseTools(server, resolveClient) {
 	});
 	register("myob_create_bill", {
 		description: "Create a new purchase bill in a connected MYOB Business.",
+		annotations: additiveToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			data: z.record(z.string(), z.unknown()).describe("Full bill data object including Supplier, Date, Lines, etc.")
@@ -366,6 +406,7 @@ function registerGeneralLedgerTools(server, resolveClient) {
 	const register = server.registerTool.bind(server);
 	register("myob_list_accounts", {
 		description: "List chart of accounts (ledger accounts) from a connected MYOB Business. NOT the connected businesses themselves — for that, use myob_list_businesses.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			filter: z.string().optional().describe("OData $filter expression (e.g. \"Type eq 'Bank'\")"),
@@ -386,12 +427,13 @@ function registerGeneralLedgerTools(server, resolveClient) {
 	});
 	register("myob_get_account", {
 		description: "Get a specific general ledger account by UID from a connected MYOB Business.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
-			uid: z.string().describe("The account UID (GUID)")
+			uid: myobResourceUidField.describe("The account UID (GUID)")
 		}
 	}, async (args) => {
-		const result = await resolveClient(args.myobBusinessId).get(`/GeneralLedger/Account/${args.uid}`);
+		const result = await resolveClient(args.myobBusinessId).get(myobResourcePath("/GeneralLedger/Account", args.uid));
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
@@ -399,6 +441,7 @@ function registerGeneralLedgerTools(server, resolveClient) {
 	});
 	register("myob_list_journal_entries", {
 		description: "List journal transactions from a connected MYOB Business general ledger.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			filter: z.string().optional().describe("OData $filter expression"),
@@ -419,6 +462,7 @@ function registerGeneralLedgerTools(server, resolveClient) {
 	});
 	register("myob_create_journal_entry", {
 		description: "Create a new journal transaction in a connected MYOB Business.",
+		annotations: additiveToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			data: z.record(z.string(), z.unknown()).describe("Full journal transaction data object including Lines, DateOccurred, Memo, etc.")
@@ -432,6 +476,7 @@ function registerGeneralLedgerTools(server, resolveClient) {
 	});
 	register("myob_list_tax_codes", {
 		description: "List tax codes from a connected MYOB Business (read-only for MYOB Essentials).",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			filter: z.string().optional().describe("OData $filter expression")
@@ -453,6 +498,7 @@ function registerInventoryTools(server, resolveClient) {
 	const register = server.registerTool.bind(server);
 	register("myob_list_items", {
 		description: "List inventory items from a connected MYOB Business.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			filter: z.string().optional().describe("OData $filter expression"),
@@ -473,12 +519,13 @@ function registerInventoryTools(server, resolveClient) {
 	});
 	register("myob_get_item", {
 		description: "Get a specific inventory item by UID from a connected MYOB Business.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
-			uid: z.string().describe("The item UID (GUID)")
+			uid: myobResourceUidField.describe("The item UID (GUID)")
 		}
 	}, async (args) => {
-		const result = await resolveClient(args.myobBusinessId).get(`/Inventory/Item/${args.uid}`);
+		const result = await resolveClient(args.myobBusinessId).get(myobResourcePath("/Inventory/Item", args.uid));
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
@@ -486,6 +533,7 @@ function registerInventoryTools(server, resolveClient) {
 	});
 	register("myob_create_item", {
 		description: "Create a new inventory item in a connected MYOB Business.",
+		annotations: additiveToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			data: z.record(z.string(), z.unknown()).describe("Full item data object including Name, Number, SellingDetails, BuyingDetails, etc.")
@@ -499,13 +547,14 @@ function registerInventoryTools(server, resolveClient) {
 	});
 	register("myob_update_item", {
 		description: "Update an existing inventory item in a connected MYOB Business.",
+		annotations: updateToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
-			uid: z.string().describe("The item UID (GUID) to update"),
+			uid: myobResourceUidField.describe("The item UID (GUID) to update"),
 			data: z.record(z.string(), z.unknown()).describe("Item data fields to update")
 		}
 	}, async (args) => {
-		const result = await resolveClient(args.myobBusinessId).put(`/Inventory/Item/${args.uid}`, args.data);
+		const result = await resolveClient(args.myobBusinessId).put(myobResourcePath("/Inventory/Item", args.uid), args.data);
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
@@ -518,6 +567,7 @@ function registerPaymentTools(server, resolveClient) {
 	const register = server.registerTool.bind(server);
 	register("myob_list_customer_payments", {
 		description: "List customer payments (receipts) from a connected MYOB Business.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			filter: z.string().optional().describe("OData $filter expression"),
@@ -538,6 +588,7 @@ function registerPaymentTools(server, resolveClient) {
 	});
 	register("myob_record_customer_payment", {
 		description: "Record a customer payment against invoices in a connected MYOB Business.",
+		annotations: additiveToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			data: z.record(z.string(), z.unknown()).describe("Full customer payment data including Customer, Account, Invoices, AmountReceived, etc.")
@@ -551,6 +602,7 @@ function registerPaymentTools(server, resolveClient) {
 	});
 	register("myob_list_supplier_payments", {
 		description: "List supplier payments from a connected MYOB Business.",
+		annotations: readOnlyToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			filter: z.string().optional().describe("OData $filter expression"),
@@ -571,6 +623,7 @@ function registerPaymentTools(server, resolveClient) {
 	});
 	register("myob_record_supplier_payment", {
 		description: "Record a supplier payment against bills in a connected MYOB Business.",
+		annotations: additiveToolAnnotations,
 		inputSchema: {
 			myobBusinessId: myobBusinessIdField,
 			data: z.record(z.string(), z.unknown()).describe("Full supplier payment data including Supplier, Account, Bills, AmountPaid, etc.")
@@ -584,6 +637,39 @@ function registerPaymentTools(server, resolveClient) {
 	});
 }
 //#endregion
+//#region src/token-refresh.ts
+/**
+* Coordinates MYOB refreshes without allowing credentials to cross business
+* boundaries. Calls for the same Connection share one request; calls for
+* different Connections remain independent.
+*/
+var MyobTokenRefreshCoordinator = class {
+	inFlight = /* @__PURE__ */ new Map();
+	constructor(apiClient, targets) {
+		this.apiClient = apiClient;
+		this.targets = targets;
+	}
+	refreshBusiness(myobBusinessId) {
+		const target = this.targets.get(myobBusinessId);
+		if (!target) return Promise.reject(/* @__PURE__ */ new Error(`Unknown myobBusinessId: ${myobBusinessId}`));
+		const existing = this.inFlight.get(target.accountIdentifier);
+		if (existing) return existing;
+		const refresh = this.apiClient.refreshMYOBAccountToken(target.accountIdentifier).then(({ accessToken }) => {
+			target.client.updateToken(accessToken);
+			return accessToken;
+		}).finally(() => {
+			if (this.inFlight.get(target.accountIdentifier) === refresh) this.inFlight.delete(target.accountIdentifier);
+		});
+		this.inFlight.set(target.accountIdentifier, refresh);
+		return refresh;
+	}
+	async refreshAll() {
+		const businessIds = [...this.targets.keys()];
+		await Promise.all(businessIds.map((businessId) => this.refreshBusiness(businessId)));
+		return businessIds;
+	}
+};
+//#endregion
 //#region src/server.ts
 /**
 * MYOB Business MCP Server (Pattern A multi-account)
@@ -603,67 +689,59 @@ function registerPaymentTools(server, resolveClient) {
 */
 const clients = /* @__PURE__ */ new Map();
 let refreshTimer = null;
-let inFlightRefresh = null;
 const REFRESH_INTERVAL_MS = 900 * 1e3;
 const REFRESH_RETRY_MS = 60 * 1e3;
 function log(msg) {
 	process.stderr.write(`[myob-mcp-server] ${msg}\n`);
 }
 /**
+* Convert a McpServer.registerTool Zod raw shape into the JSON-Schema-ish
+* {@link ValidatableTool} the Pattern A validator inspects. Direct-MCP
+* servers register Zod shapes (not JSON Schema), so the guard maps each
+* property's presence / optionality / string-ness across.
+*/
+function zodShapeToValidatable(name, shape) {
+	const properties = {};
+	const required = [];
+	for (const [key, schema] of Object.entries(shape ?? {})) {
+		properties[key] = { type: schema instanceof z.ZodString ? "string" : "non-string" };
+		if (!schema.safeParse(void 0).success) required.push(key);
+	}
+	return {
+		name,
+		parameters: {
+			type: "object",
+			properties,
+			required
+		}
+	};
+}
+/**
 * Resolve a `myobBusinessId` selector to its `MyobClient`. Throws if
 * unknown — the LLM should call `myob_list_businesses` to discover
 * the valid set. This is the per-call dispatch contract for Pattern A.
 */
 function resolveMyobClient(myobBusinessId) {
-	const c = clients.get(myobBusinessId);
-	if (!c) throw new Error(`Unknown myobBusinessId: ${myobBusinessId}. Call myob_list_businesses to see the connected businesses on this agent.`);
-	return c;
-}
-/**
-* Single fan-out point for token refresh. Used by:
-*   - the scheduled timer (performRefresh)
-*   - the `myob_refresh_token` tool
-*   - every cached `MyobClient`'s `onRefresh` callback (on 401 retry)
-*
-* Concurrent callers share one in-flight `refreshMYOBToken()` request
-* via `inFlightRefresh`, and the resolved token is fanned out to every
-* cached client so siblings don't re-hit the network on their own 401s.
-*
-* v1 limitation: `apiClient.refreshMYOBToken()` refreshes the primary
-* connection's token only and we fan it across all clients. This works
-* as long as MYOB access tokens are interchangeable across businesses
-* sharing a partner appId (true today). Per-connection refresh is a v2
-* follow-up — see DEVELOPING.md.
-*/
-async function refreshAndFanOut(apiClient) {
-	if (inFlightRefresh) return inFlightRefresh;
-	inFlightRefresh = (async () => {
-		try {
-			const { accessToken } = await apiClient.refreshMYOBToken();
-			for (const client of clients.values()) client.updateToken(accessToken);
-			return accessToken;
-		} finally {
-			inFlightRefresh = null;
-		}
-	})();
-	return inFlightRefresh;
+	const account = clients.get(myobBusinessId);
+	if (!account) throw new Error(`Unknown myobBusinessId: ${myobBusinessId}. Call myob_list_businesses to see the connected businesses on this agent.`);
+	return account.client;
 }
-async function performRefresh(apiClient) {
+async function performRefresh(tokenRefresher) {
 	log("Refreshing MYOB access tokens across all connected businesses...");
-	await refreshAndFanOut(apiClient);
-	log("Token refresh applied to all clients");
+	const refreshed = await tokenRefresher.refreshAll();
+	log(`Refreshed ${String(refreshed.length)} MYOB business token(s)`);
 }
-function scheduleRefresh(apiClient) {
+function scheduleRefresh(tokenRefresher) {
 	if (refreshTimer) clearTimeout(refreshTimer);
 	refreshTimer = setTimeout(() => {
 		(async () => {
 			try {
-				await performRefresh(apiClient);
-				scheduleRefresh(apiClient);
+				await performRefresh(tokenRefresher);
+				scheduleRefresh(tokenRefresher);
 			} catch (err) {
 				log(`Token refresh failed: ${err instanceof Error ? err.message : String(err)}`);
 				refreshTimer = setTimeout(() => {
-					scheduleRefresh(apiClient);
+					scheduleRefresh(tokenRefresher);
 				}, REFRESH_RETRY_MS);
 			}
 		})();
@@ -677,25 +755,39 @@ async function main() {
 	});
 	const { accounts } = await apiClient.getMYOBAccounts();
 	if (accounts.length === 0) log("No MYOB businesses connected — server will start with myob_list_businesses + myob_refresh_token only");
+	const tokenRefresher = new MyobTokenRefreshCoordinator(apiClient, clients);
 	for (const acct of accounts) {
 		if (clients.has(acct.myobBusinessId)) {
 			log(`Duplicate myobBusinessId ${acct.myobBusinessId} returned by getMYOBAccounts() — keeping the first cached client`);
 			continue;
 		}
-		clients.set(acct.myobBusinessId, new MyobClient({
+		const client = new MyobClient({
 			accessToken: acct.accessToken,
 			clientId: acct.clientId,
 			businessId: acct.myobBusinessId,
 			onRefresh: async () => {
-				return { accessToken: await refreshAndFanOut(apiClient) };
+				return { accessToken: await tokenRefresher.refreshBusiness(acct.myobBusinessId) };
 			}
-		}));
+		});
+		clients.set(acct.myobBusinessId, {
+			accountIdentifier: acct.accountIdentifier,
+			displayName: acct.displayName,
+			connectedAt: acct.connectedAt,
+			client
+		});
 		log(`Cached client for business ${acct.myobBusinessId} (${acct.displayName ?? "no display name"})`);
 	}
 	const server = new McpServer({
 		name: "myob-mcp-server",
 		version: "2.0.0"
 	});
+	const validatableTools = [];
+	const originalRegisterTool = server.registerTool.bind(server);
+	server.registerTool = (...args) => {
+		const [name, config] = args;
+		validatableTools.push(zodShapeToValidatable(name, config?.inputSchema));
+		return originalRegisterTool(...args);
+	};
 	registerContactTools(server, resolveMyobClient);
 	registerSalesTools(server, resolveMyobClient);
 	registerPurchaseTools(server, resolveMyobClient);
@@ -703,23 +795,32 @@ async function main() {
 	registerInventoryTools(server, resolveMyobClient);
 	registerPaymentTools(server, resolveMyobClient);
 	const registerTool = server.registerTool.bind(server);
-	registerTool("myob_list_businesses", { description: "List the MYOB Business accounts (companies) the agent has connected. Returns one entry per OAuth connection — use the returned myobBusinessId values as the `myobBusinessId` selector arg on every other myob_* tool." }, () => {
-		const summaries = accounts.map((a) => ({
-			myobBusinessId: a.myobBusinessId,
-			displayName: a.displayName,
-			connectedAt: a.connectedAt
+	registerTool("myob_list_businesses", {
+		description: "List the MYOB Business accounts (companies) the agent has connected. Returns one entry per OAuth connection — use the returned myobBusinessId values as the `myobBusinessId` selector arg on every other myob_* tool.",
+		annotations: readOnlyToolAnnotations
+	}, () => {
+		const summaries = [...clients.entries()].map(([myobBusinessId, account]) => ({
+			myobBusinessId,
+			displayName: account.displayName,
+			connectedAt: account.connectedAt
 		}));
 		return { content: [{
 			type: "text",
 			text: JSON.stringify({ businesses: summaries }, null, 2)
 		}] };
 	});
-	registerTool("myob_refresh_token", { description: "Force-refresh the MYOB OAuth2 access token. Affects every connected MYOB business (tokens are interchangeable across businesses sharing a partner appId). Use this if API calls are failing with authentication errors." }, async () => {
+	registerTool("myob_refresh_token", {
+		description: "Force-refresh every connected MYOB business. Each Connection is refreshed independently so credentials never cross business boundaries. Use this if API calls are failing with authentication errors.",
+		annotations: additiveToolAnnotations
+	}, async () => {
 		try {
-			await performRefresh(apiClient);
+			const refreshed = await tokenRefresher.refreshAll();
 			return { content: [{
 				type: "text",
-				text: JSON.stringify({ refreshed: true })
+				text: JSON.stringify({
+					refreshed: true,
+					businesses: refreshed
+				})
 			}] };
 		} catch (err) {
 			return {
@@ -731,7 +832,11 @@ async function main() {
 			};
 		}
 	});
-	scheduleRefresh(apiClient);
+	assertPatternA(validatableTools, {
+		selector: "myobBusinessId",
+		exempt: ["myob_list_businesses", "myob_refresh_token"]
+	});
+	scheduleRefresh(tokenRefresher);
 	const transport = new StdioServerTransport();
 	await server.connect(transport);
 	log(`MYOB MCP server running with ${String(accounts.length)} connected business(es) and Pattern A selector enforcement`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/myob-mcp",
-  "version": "0.3.15",
+  "version": "0.3.17",
   "description": "MYOB Business MCP server — direct API integration with Alfe OAuth credentials and automatic token refresh",
   "type": "module",
   "main": "./dist/server.js",
@@ -19,8 +19,9 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^4.0.5",
-    "@alfe.ai/config": "0.3.0",
-    "@alfe.ai/agent-api-client": "0.13.0"
+    "@alfe.ai/agent-api-client": "0.15.0",
+    "@alfe.ai/config": "0.4.1",
+    "@alfe.ai/mcp-bundler": "0.4.1"
   },
   "license": "UNLICENSED",
   "homepage": "https://alfe.ai",
@@ -36,6 +37,7 @@
   "scripts": {
     "build": "tsdown",
     "dev": "tsdown --watch",
+    "test": "vitest run",
     "typecheck": "tsc --noEmit",
     "lint": "eslint ."
   }