@baref00t/mcp-server 0.2.0

package/dist/logger.d.ts

@@ -0,0 +1,3 @@
+import { type Logger } from 'pino';
+export declare function logger(): Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAa,EAAE,KAAK,MAAM,EAAE,MAAM,MAAM,CAAA;AAKxC,wBAAgB,MAAM,IAAI,MAAM,CAyB/B"}

package/dist/logger.js

@@ -0,0 +1,31 @@
+import pino from 'pino';
+import { env } from './env.js';
+let _logger = null;
+export function logger() {
+    if (_logger)
+        return _logger;
+    const e = env();
+    _logger = pino({
+        level: process.env['MCP_LOG_LEVEL'] ?? 'info',
+        base: {
+            service: 'baref00t-mcp-server',
+            env: e.ENVIRONMENT,
+        },
+        formatters: {
+            level: (label) => ({ level: label }),
+        },
+        redact: {
+            paths: [
+                'apiKey',
+                'authorization',
+                'req.headers.authorization',
+                'req.headers["x-partner-key"]',
+                'req.headers["x-distributor-key"]',
+                'req.headers.cookie',
+            ],
+            censor: '[REDACTED]',
+        },
+    });
+    return _logger;
+}
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAqB,MAAM,MAAM,CAAA;AACxC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAE9B,IAAI,OAAO,GAAkB,IAAI,CAAA;AAEjC,MAAM,UAAU,MAAM;IACpB,IAAI,OAAO;QAAE,OAAO,OAAO,CAAA;IAC3B,MAAM,CAAC,GAAG,GAAG,EAAE,CAAA;IACf,OAAO,GAAG,IAAI,CAAC;QACb,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,MAAM;QAC7C,IAAI,EAAE;YACJ,OAAO,EAAE,qBAAqB;YAC9B,GAAG,EAAE,CAAC,CAAC,WAAW;SACnB;QACD,UAAU,EAAE;YACV,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;SACrC;QACD,MAAM,EAAE;YACN,KAAK,EAAE;gBACL,QAAQ;gBACR,eAAe;gBACf,2BAA2B;gBAC3B,8BAA8B;gBAC9B,kCAAkC;gBAClC,oBAAoB;aACrB;YACD,MAAM,EAAE,YAAY;SACrB;KACF,CAAC,CAAA;IACF,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Tool registry — central index of every MCP tool the server exposes.
+ *
+ * Each tool module under `tools/<scope>/<name>.ts` exports an object
+ * conforming to the `Tool` shape below. The registry walks the imports
+ * at startup, builds the `tools/list` response, and dispatches
+ * `tools/call` to the right handler.
+ *
+ * `inputSchema` is generated from each tool's Zod schema via
+ * zod-to-json-schema so the JSON Schema published to clients always
+ * matches the runtime parser.
+ */
+import { z } from 'zod';
+import type { Scope } from './auth.js';
+import type { ExtractedKey } from './auth.js';
+export interface ToolContext {
+    /** Authenticated scope + raw API key (don't log the raw key). */
+    auth: ExtractedKey;
+    /** Per-call request id for log correlation. */
+    requestId: string;
+}
+export interface Tool<TInput extends z.ZodTypeAny = z.ZodTypeAny, TOutput = unknown> {
+    /** Unique tool name, e.g. `partner_list_customers`. Snake_case. */
+    name: string;
+    /** Required scope. Tools are filtered out of tools/list when caller's scope mismatches. */
+    scope: Scope;
+    /** Plain-text description shown verbatim to LLMs. 1-3 sentences. */
+    description: string;
+    /** Zod schema for the tool input. */
+    schema: TInput;
+    /** Implementation. Receives parsed input + context. Returns serialisable output. */
+    handler: (input: z.infer<TInput>, ctx: ToolContext) => Promise<TOutput>;
+}
+/** Register a tool. Throws if name already taken. */
+export declare function registerTool<TInput extends z.ZodTypeAny, TOutput>(tool: Tool<TInput, TOutput>): void;
+/** All registered tools. */
+export declare function allTools(): Tool[];
+/**
+ * Tools available to a given scope, after applying the runtime
+ * `MCPEnabledTools` allow-list (empty = all enabled).
+ */
+export declare function visibleTools(scope: Scope): Promise<Tool[]>;
+/** Build the MCP `tools/list` response payload. */
+export declare function listToolsForScope(scope: Scope): Promise<{
+    name: string;
+    description: string;
+    inputSchema: import("zod-to-json-schema").JsonSchema7Type & {
+        $schema?: string | undefined;
+        definitions?: {
+            [key: string]: import("zod-to-json-schema").JsonSchema7Type;
+        } | undefined;
+    };
+}[]>;
+/** Dispatch a `tools/call`. Throws if tool unknown / wrong scope / disabled / input invalid. */
+export declare function callTool(name: string, rawInput: unknown, ctx: ToolContext): Promise<unknown>;
+/** Test-only — clear all registrations. */
+export declare function _resetRegistry(): void;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAI7C,MAAM,WAAW,WAAW;IAC1B,iEAAiE;IACjE,IAAI,EAAE,YAAY,CAAA;IAClB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,IAAI,CAAC,MAAM,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO;IACjF,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,2FAA2F;IAC3F,KAAK,EAAE,KAAK,CAAA;IACZ,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAA;IACnB,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,oFAAoF;IACpF,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACxE;AAID,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,MAAM,SAAS,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,QAK7F;AAED,4BAA4B;AAC5B,wBAAgB,QAAQ,IAAI,IAAI,EAAE,CAEjC;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAOhE;AAED,mDAAmD;AACnD,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,KAAK;;;;;;;;;KAOnD;AAED,gGAAgG;AAChG,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EACjB,GAAG,EAAE,WAAW,GACf,OAAO,CAAC,OAAO,CAAC,CA8ClB;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,SAE7B"}

package/dist/registry.js

@@ -0,0 +1,94 @@
+/**
+ * Tool registry — central index of every MCP tool the server exposes.
+ *
+ * Each tool module under `tools/<scope>/<name>.ts` exports an object
+ * conforming to the `Tool` shape below. The registry walks the imports
+ * at startup, builds the `tools/list` response, and dispatches
+ * `tools/call` to the right handler.
+ *
+ * `inputSchema` is generated from each tool's Zod schema via
+ * zod-to-json-schema so the JSON Schema published to clients always
+ * matches the runtime parser.
+ */
+import { zodToJsonSchema } from 'zod-to-json-schema';
+import { getConfig } from './config.js';
+import { logger } from './logger.js';
+const tools = new Map();
+/** Register a tool. Throws if name already taken. */
+export function registerTool(tool) {
+    if (tools.has(tool.name)) {
+        throw new Error(`tool already registered: ${tool.name}`);
+    }
+    tools.set(tool.name, tool);
+}
+/** All registered tools. */
+export function allTools() {
+    return [...tools.values()];
+}
+/**
+ * Tools available to a given scope, after applying the runtime
+ * `MCPEnabledTools` allow-list (empty = all enabled).
+ */
+export async function visibleTools(scope) {
+    const config = await getConfig();
+    return allTools().filter((t) => {
+        if (t.scope !== scope)
+            return false;
+        if (config.enabledTools.length > 0 && !config.enabledTools.includes(t.name))
+            return false;
+        return true;
+    });
+}
+/** Build the MCP `tools/list` response payload. */
+export async function listToolsForScope(scope) {
+    const visible = await visibleTools(scope);
+    return visible.map((t) => ({
+        name: t.name,
+        description: t.description,
+        inputSchema: zodToJsonSchema(t.schema, { target: 'jsonSchema7' }),
+    }));
+}
+/** Dispatch a `tools/call`. Throws if tool unknown / wrong scope / disabled / input invalid. */
+export async function callTool(name, rawInput, ctx) {
+    const tool = tools.get(name);
+    if (!tool)
+        throw new Error(`unknown tool: ${name}`);
+    if (tool.scope !== ctx.auth.scope) {
+        throw new Error(`tool '${name}' requires scope '${tool.scope}'; caller is '${ctx.auth.scope}'`);
+    }
+    const config = await getConfig();
+    if (config.enabledTools.length > 0 && !config.enabledTools.includes(name)) {
+        throw new Error(`tool '${name}' is disabled by MCPEnabledTools`);
+    }
+    const parsed = tool.schema.safeParse(rawInput ?? {});
+    if (!parsed.success) {
+        const issues = parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; ');
+        throw new Error(`invalid input for '${name}': ${issues}`);
+    }
+    const startedAt = Date.now();
+    try {
+        const result = await tool.handler(parsed.data, ctx);
+        logger().info({
+            tool: name,
+            scope: tool.scope,
+            latencyMs: Date.now() - startedAt,
+            requestId: ctx.requestId,
+        }, 'tool_call_succeeded');
+        return result;
+    }
+    catch (err) {
+        logger().error({
+            tool: name,
+            scope: tool.scope,
+            latencyMs: Date.now() - startedAt,
+            requestId: ctx.requestId,
+            err: err instanceof Error ? err.message : String(err),
+        }, 'tool_call_failed');
+        throw err;
+    }
+}
+/** Test-only — clear all registrations. */
+export function _resetRegistry() {
+    tools.clear();
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAsBpC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAA;AAErC,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAuC,IAA2B;IAC5F,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1D,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAuB,CAAC,CAAA;AAC/C,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,QAAQ;IACtB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAY;IAC7C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,OAAO,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7B,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QACnC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACzF,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAY;IAClD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAA;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;KAClE,CAAC,CAAC,CAAA;AACL,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,QAAiB,EACjB,GAAgB;IAEhB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAA;IACnD,IAAI,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,qBAAqB,IAAI,CAAC,KAAK,iBAAiB,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAC/E,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,kCAAkC,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7F,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,MAAM,MAAM,EAAE,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACnD,MAAM,EAAE,CAAC,IAAI,CACX;YACE,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACjC,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,EACD,qBAAqB,CACtB,CAAA;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,KAAK,CACZ;YACE,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACjC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACtD,EACD,kBAAkB,CACnB,CAAA;QACD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,cAAc;IAC5B,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC"}

package/dist/sdkCache.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Per-tenant SDK client cache.
+ *
+ * Keyed by sha256(apiKey) so the raw key never enters the cache key set.
+ * 1000 entries max, 10-minute TTL — eliminates per-call SDK construction
+ * during chatty agent loops without retaining keys longer than necessary.
+ */
+import { PartnerClient } from '@baref00t/sdk/partner';
+import { DistributorClient } from '@baref00t/sdk/distributor';
+import type { Scope } from './auth.js';
+export declare function getPartnerClient(apiKey: string): PartnerClient;
+export declare function getDistributorClient(apiKey: string): DistributorClient;
+/** Test-only. */
+export declare function _resetSdkCache(): void;
+/** Telemetry helper — first 8 chars of the sha256(apiKey) for log correlation. */
+export declare function keyHashShort(apiKey: string): string;
+/** Hint that the configured cache key for `apiKey` is `key`. Useful for unit tests. */
+export declare function _cacheSize(): number;
+export type { Scope };
+//# sourceMappingURL=sdkCache.d.ts.map

package/dist/sdkCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkCache.d.ts","sourceRoot":"","sources":["../src/sdkCache.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAE7D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAiBtC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAe9D;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAetE;AAED,iBAAiB;AACjB,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,uFAAuF;AACvF,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,YAAY,EAAE,KAAK,EAAE,CAAA"}

package/dist/sdkCache.js

@@ -0,0 +1,65 @@
+/**
+ * Per-tenant SDK client cache.
+ *
+ * Keyed by sha256(apiKey) so the raw key never enters the cache key set.
+ * 1000 entries max, 10-minute TTL — eliminates per-call SDK construction
+ * during chatty agent loops without retaining keys longer than necessary.
+ */
+import { createHash } from 'node:crypto';
+import { LRUCache } from 'lru-cache';
+import { PartnerClient } from '@baref00t/sdk/partner';
+import { DistributorClient } from '@baref00t/sdk/distributor';
+import { env } from './env.js';
+const cache = new LRUCache({
+    max: 1000,
+    ttl: 10 * 60 * 1000, // 10 minutes
+    updateAgeOnGet: false,
+});
+function hashKey(apiKey) {
+    return createHash('sha256').update(apiKey).digest('hex').slice(0, 32);
+}
+export function getPartnerClient(apiKey) {
+    const hash = hashKey(apiKey);
+    let entry = cache.get(hash);
+    if (!entry) {
+        entry = {};
+        cache.set(hash, entry);
+    }
+    if (!entry.partner) {
+        entry.partner = new PartnerClient({
+            apiKey,
+            baseUrl: env().BAREF00T_API_BASE,
+            defaultHeaders: { 'X-Mcp-Server': '1' },
+        });
+    }
+    return entry.partner;
+}
+export function getDistributorClient(apiKey) {
+    const hash = hashKey(apiKey);
+    let entry = cache.get(hash);
+    if (!entry) {
+        entry = {};
+        cache.set(hash, entry);
+    }
+    if (!entry.distributor) {
+        entry.distributor = new DistributorClient({
+            apiKey,
+            baseUrl: env().BAREF00T_API_BASE,
+            defaultHeaders: { 'X-Mcp-Server': '1' },
+        });
+    }
+    return entry.distributor;
+}
+/** Test-only. */
+export function _resetSdkCache() {
+    cache.clear();
+}
+/** Telemetry helper — first 8 chars of the sha256(apiKey) for log correlation. */
+export function keyHashShort(apiKey) {
+    return hashKey(apiKey).slice(0, 8);
+}
+/** Hint that the configured cache key for `apiKey` is `key`. Useful for unit tests. */
+export function _cacheSize() {
+    return cache.size;
+}
+//# sourceMappingURL=sdkCache.js.map

package/dist/sdkCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkCache.js","sourceRoot":"","sources":["../src/sdkCache.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAQ9B,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAqB;IAC7C,GAAG,EAAE,IAAI;IACT,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IAClC,cAAc,EAAE,KAAK;CACtB,CAAC,CAAA;AAEF,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5B,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,EAAE,CAAA;QACV,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC;YAChC,MAAM;YACN,OAAO,EAAE,GAAG,EAAE,CAAC,iBAAiB;YAChC,cAAc,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE;SACxC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAA;AACtB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5B,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,EAAE,CAAA;QACV,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,CAAC,WAAW,GAAG,IAAI,iBAAiB,CAAC;YACxC,MAAM;YACN,OAAO,EAAE,GAAG,EAAE,CAAC,iBAAiB;YAChC,cAAc,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE;SACxC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,CAAA;AAC1B,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,cAAc;IAC5B,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACpC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU;IACxB,OAAO,KAAK,CAAC,IAAI,CAAA;AACnB,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+/**
+ * baref00t MCP server — hosted multi-tenant entry point.
+ *
+ * Pin: @modelcontextprotocol/sdk@1.29.0 (current at 2026-04-30).
+ *
+ * Wire model:
+ *
+ *   POST /mcp                  → Streamable HTTP transport (MCP messages)
+ *   GET  /healthz              → liveness (Node up)
+ *   GET  /readyz               → readiness (config load OK + tools registered)
+ *
+ * Per-request:
+ *   1. extractKey() validates the API key prefix against MCPAllowedKeyPrefixes
+ *      and routes to partner|distributor scope.
+ *   2. A fresh Server instance + transport is created per request, bound to
+ *      this caller's auth context. Stateless mode (sessionIdGenerator
+ *      undefined) — each MCP message is processed independently. This
+ *      matches how Anthropic's MCP bridge + Claude Desktop's connector
+ *      actually call us in practice (fresh connection per tool invocation,
+ *      no session ID reuse). Stateful mode broke because clients open a
+ *      new initialize for every tool call instead of carrying session IDs.
+ */
+export {};
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;GAqBG"}

package/dist/server.js

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+/**
+ * baref00t MCP server — hosted multi-tenant entry point.
+ *
+ * Pin: @modelcontextprotocol/sdk@1.29.0 (current at 2026-04-30).
+ *
+ * Wire model:
+ *
+ *   POST /mcp                  → Streamable HTTP transport (MCP messages)
+ *   GET  /healthz              → liveness (Node up)
+ *   GET  /readyz               → readiness (config load OK + tools registered)
+ *
+ * Per-request:
+ *   1. extractKey() validates the API key prefix against MCPAllowedKeyPrefixes
+ *      and routes to partner|distributor scope.
+ *   2. A fresh Server instance + transport is created per request, bound to
+ *      this caller's auth context. Stateless mode (sessionIdGenerator
+ *      undefined) — each MCP message is processed independently. This
+ *      matches how Anthropic's MCP bridge + Claude Desktop's connector
+ *      actually call us in practice (fresh connection per tool invocation,
+ *      no session ID reuse). Stateful mode broke because clients open a
+ *      new initialize for every tool call instead of carrying session IDs.
+ */
+import { createServer } from 'node:http';
+import { randomUUID } from 'node:crypto';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { env } from './env.js';
+import { logger } from './logger.js';
+import { initTelemetry } from './telemetry.js';
+import { extractKey } from './auth.js';
+import { keyHashShort } from './sdkCache.js';
+import { callTool, listToolsForScope } from './registry.js';
+import { registerAllTools } from './tools/index.js';
+const SDK_NAME = 'baref00t-mcp-server';
+const SDK_VERSION = '0.1.6';
+async function main() {
+    const e = env();
+    const log = logger();
+    await initTelemetry();
+    registerAllTools();
+    const server = createServer(handleRequest);
+    server.listen(e.PORT, () => {
+        log.info({ port: e.PORT, env: e.ENVIRONMENT }, 'MCP server listening');
+    });
+    const shutdown = (signal) => {
+        log.info({ signal }, 'shutdown requested — draining');
+        server.close(() => process.exit(0));
+        setTimeout(() => process.exit(1), 10_000).unref();
+    };
+    process.on('SIGTERM', () => shutdown('SIGTERM'));
+    process.on('SIGINT', () => shutdown('SIGINT'));
+}
+async function handleRequest(req, res) {
+    const requestId = randomUUID();
+    res.setHeader('X-Request-Id', requestId);
+    // CORS preflight passthrough — MCP clients (Claude Desktop, Inspector)
+    // may send OPTIONS depending on transport.
+    if (req.method === 'OPTIONS') {
+        res.writeHead(204, {
+            'Access-Control-Allow-Origin': '*',
+            'Access-Control-Allow-Methods': 'POST, GET, OPTIONS',
+            'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Partner-Key, X-Distributor-Key, MCP-Session-Id',
+            'Access-Control-Max-Age': '86400',
+        });
+        res.end();
+        return;
+    }
+    const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+    if (url.pathname === '/healthz') {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ status: 'ok', service: SDK_NAME, version: SDK_VERSION }));
+        return;
+    }
+    if (url.pathname === '/readyz') {
+        // Ready iff at least one tool is registered (config errors will throw above).
+        const { allTools } = await import('./registry.js');
+        const ok = allTools().length > 0;
+        res.writeHead(ok ? 200 : 503, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ status: ok ? 'ready' : 'not_ready', tools: allTools().length }));
+        return;
+    }
+    if (url.pathname !== '/mcp') {
+        res.writeHead(404, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: { code: 'NOT_FOUND', message: 'POST /mcp' } }));
+        return;
+    }
+    // Auth + scope routing.
+    const key = await extractKey(req);
+    if ('status' in key) {
+        res.writeHead(key.status, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(key.body));
+        return;
+    }
+    // Build a per-request MCP Server instance bound to this caller's auth.
+    const mcp = new Server({ name: SDK_NAME, version: SDK_VERSION }, { capabilities: { tools: {} } });
+    // List tools — filter by caller's scope + runtime allow-list.
+    mcp.setRequestHandler(ListToolsRequestSchema, async () => {
+        const tools = await listToolsForScope(key.scope);
+        return { tools };
+    });
+    // Call tool — dispatch via registry, capture errors as MCP error-results.
+    mcp.setRequestHandler(CallToolRequestSchema, async (cr) => {
+        const ctx = { auth: key, requestId };
+        try {
+            const result = await callTool(cr.params.name, cr.params.arguments, ctx);
+            return {
+                content: [
+                    { type: 'text', text: JSON.stringify(result, null, 2) },
+                ],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return {
+                isError: true,
+                content: [{ type: 'text', text: message }],
+            };
+        }
+    });
+    // Stateless transport — each HTTP request is processed independently.
+    // sessionIdGenerator: undefined disables session tracking; the SDK
+    // doesn't enforce init-first ordering on messages, so a tools/call
+    // arriving without a prior initialize round-trip is processed normally.
+    // This matches how Anthropic's bridge + Claude Desktop's connector
+    // actually call MCP servers (fresh per tool invocation).
+    const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: undefined,
+        enableJsonResponse: true,
+    });
+    await mcp.connect(transport);
+    await transport.handleRequest(req, res);
+    logger().debug({
+        requestId,
+        scope: key.scope,
+        keyHash: keyHashShort(key.apiKey),
+    }, 'mcp_request_handled');
+}
+main().catch((err) => {
+    console.error('fatal:', err);
+    process.exit(1);
+});
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAA;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAClG,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEnD,MAAM,QAAQ,GAAG,qBAAqB,CAAA;AACtC,MAAM,WAAW,GAAG,OAAO,CAAA;AAE3B,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,GAAG,EAAE,CAAA;IACf,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IAEpB,MAAM,aAAa,EAAE,CAAA;IACrB,gBAAgB,EAAE,CAAA;IAElB,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAA;IAE1C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE;QACzB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,sBAAsB,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAA;QACrD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACnC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAA;IACnD,CAAC,CAAA;IACD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;IAChD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAoB,EAAE,GAAmB;IACpE,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;IAC9B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;IAExC,uEAAuE;IACvE,2CAA2C;IAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,6BAA6B,EAAE,GAAG;YAClC,8BAA8B,EAAE,oBAAoB;YACpD,8BAA8B,EAC5B,+EAA+E;YACjF,wBAAwB,EAAE,OAAO;SAClC,CAAC,CAAA;QACF,GAAG,CAAC,GAAG,EAAE,CAAA;QACT,OAAM;IACR,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAA;IAEhF,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAChC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QAClF,OAAM;IACR,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,8EAA8E;QAC9E,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAA;QAClD,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;QAChC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QACrE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QACzF,OAAM;IACR,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/E,OAAM;IACR,CAAC;IAED,wBAAwB;IACxB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;QACpB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QACjE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;QACjC,OAAM;IACR,CAAC;IAED,uEAAuE;IACvE,MAAM,GAAG,GAAG,IAAI,MAAM,CACpB,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,EACxC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAA;IAED,8DAA8D;IAC9D,GAAG,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAChD,OAAO,EAAE,KAAK,EAAE,CAAA;IAClB,CAAC,CAAC,CAAA;IAEF,0EAA0E;IAC1E,GAAG,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACxD,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;YACvE,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;iBACxD;aACF,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAChE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;aAC3C,CAAA;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,sEAAsE;IACtE,mEAAmE;IACnE,mEAAmE;IACnE,wEAAwE;IACxE,mEAAmE;IACnE,yDAAyD;IACzD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;QAClD,kBAAkB,EAAE,SAAS;QAC7B,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAA;IACF,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAE5B,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAEvC,MAAM,EAAE,CAAC,KAAK,CACZ;QACE,SAAS;QACT,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;KAClC,EACD,qBAAqB,CACtB,CAAA;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/telemetry.d.ts

@@ -0,0 +1,8 @@
+/**
+ * OpenTelemetry + Azure Monitor (App Insights) bootstrap.
+ *
+ * Mirrors the pattern apps/functions uses today. No-op when
+ * APPLICATIONINSIGHTS_CONNECTION_STRING is unset.
+ */
+export declare function initTelemetry(): Promise<void>;
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAwBnD"}

package/dist/telemetry.js

@@ -0,0 +1,32 @@
+/**
+ * OpenTelemetry + Azure Monitor (App Insights) bootstrap.
+ *
+ * Mirrors the pattern apps/functions uses today. No-op when
+ * APPLICATIONINSIGHTS_CONNECTION_STRING is unset.
+ */
+import { env } from './env.js';
+import { logger } from './logger.js';
+let _initialised = false;
+export async function initTelemetry() {
+    if (_initialised)
+        return;
+    _initialised = true;
+    const e = env();
+    if (!e.APPLICATIONINSIGHTS_CONNECTION_STRING) {
+        logger().info('telemetry: APPLICATIONINSIGHTS_CONNECTION_STRING unset — skipping OTel bootstrap');
+        return;
+    }
+    try {
+        const { useAzureMonitor } = await import('@azure/monitor-opentelemetry');
+        useAzureMonitor({
+            azureMonitorExporterOptions: { connectionString: e.APPLICATIONINSIGHTS_CONNECTION_STRING },
+            enableLiveMetrics: true,
+            samplingRatio: 1.0,
+        });
+        logger().info('telemetry: Azure Monitor OpenTelemetry initialised');
+    }
+    catch (err) {
+        logger().warn({ err: err instanceof Error ? err.message : String(err) }, 'telemetry: failed to initialise Azure Monitor (non-fatal)');
+    }
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,IAAI,YAAY,GAAG,KAAK,CAAA;AAExB,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,YAAY;QAAE,OAAM;IACxB,YAAY,GAAG,IAAI,CAAA;IAEnB,MAAM,CAAC,GAAG,GAAG,EAAE,CAAA;IACf,IAAI,CAAC,CAAC,CAAC,qCAAqC,EAAE,CAAC;QAC7C,MAAM,EAAE,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAA;QACjG,OAAM;IACR,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAA;QACxE,eAAe,CAAC;YACd,2BAA2B,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,qCAAqC,EAAE;YAC1F,iBAAiB,EAAE,IAAI;YACvB,aAAa,EAAE,GAAG;SACnB,CAAC,CAAA;QACF,MAAM,EAAE,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAA;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,IAAI,CACX,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzD,2DAA2D,CAC5D,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/tools/distributor/getUsage.d.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+import type { Tool } from '../../registry.js';
+declare const inputSchema: z.ZodObject<{
+    month: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    month?: string | undefined;
+}, {
+    month?: string | undefined;
+}>;
+declare const tool: Tool<typeof inputSchema>;
+export default tool;
+//# sourceMappingURL=getUsage.d.ts.map

package/dist/tools/distributor/getUsage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUsage.d.ts","sourceRoot":"","sources":["../../../src/tools/distributor/getUsage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAE7C,QAAA,MAAM,WAAW;;;;;;EAQN,CAAA;AAEX,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,OAAO,WAAW,CAYlC,CAAA;AAED,eAAe,IAAI,CAAA"}

package/dist/tools/distributor/getUsage.js

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+import { getDistributorClient } from '../../sdkCache.js';
+const inputSchema = z
+    .object({
+    month: z
+        .string()
+        .regex(/^\d{4}-\d{2}$/, 'YYYY-MM')
+        .optional()
+        .describe('Filter to a specific billing month (YYYY-MM). Defaults to current month.'),
+})
+    .strict();
+const tool = {
+    name: 'distributor_get_usage',
+    scope: 'distributor',
+    description: 'Aggregated assessment usage across all sub-partners for a billing month. Returns ' +
+        'totalPartners, activePartners, totalRuns, and per-partner breakdown (runs vs limit). ' +
+        'Use to answer "how much have my sub-partners used this month?".',
+    schema: inputSchema,
+    async handler(input, ctx) {
+        const client = getDistributorClient(ctx.auth.apiKey);
+        return client.usage.get(input);
+    },
+};
+export default tool;
+//# sourceMappingURL=getUsage.js.map

package/dist/tools/distributor/getUsage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUsage.js","sourceRoot":"","sources":["../../../src/tools/distributor/getUsage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAGxD,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,eAAe,EAAE,SAAS,CAAC;SACjC,QAAQ,EAAE;SACV,QAAQ,CAAC,0EAA0E,CAAC;CACxF,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,IAAI,GAA6B;IACrC,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,aAAa;IACpB,WAAW,EACT,mFAAmF;QACnF,uFAAuF;QACvF,iEAAiE;IACnE,MAAM,EAAE,WAAW;IACnB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACpD,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;CACF,CAAA;AAED,eAAe,IAAI,CAAA"}

package/dist/tools/distributor/listPartners.d.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+import type { Tool } from '../../registry.js';
+declare const inputSchema: z.ZodObject<{
+    status: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status?: string | undefined;
+}, {
+    status?: string | undefined;
+}>;
+declare const tool: Tool<typeof inputSchema>;
+export default tool;
+//# sourceMappingURL=listPartners.d.ts.map

package/dist/tools/distributor/listPartners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listPartners.d.ts","sourceRoot":"","sources":["../../../src/tools/distributor/listPartners.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAE7C,QAAA,MAAM,WAAW;;;;;;EAIN,CAAA;AAEX,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,OAAO,WAAW,CAWlC,CAAA;AAED,eAAe,IAAI,CAAA"}

package/dist/tools/distributor/listPartners.js

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+import { getDistributorClient } from '../../sdkCache.js';
+const inputSchema = z
+    .object({
+    status: z.string().optional().describe('Filter by status (active, suspended, pending, cancelled)'),
+})
+    .strict();
+const tool = {
+    name: 'distributor_list_partners',
+    scope: 'distributor',
+    description: 'List all sub-partners owned by this distributor. Optionally filter by status. ' +
+        'Returns each partner\'s id, company, email, plan, billing, and status.',
+    schema: inputSchema,
+    async handler(input, ctx) {
+        const client = getDistributorClient(ctx.auth.apiKey);
+        return client.partners.list(input);
+    },
+};
+export default tool;
+//# sourceMappingURL=listPartners.js.map

package/dist/tools/distributor/listPartners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listPartners.js","sourceRoot":"","sources":["../../../src/tools/distributor/listPartners.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAGxD,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;CACnG,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,IAAI,GAA6B;IACrC,IAAI,EAAE,2BAA2B;IACjC,KAAK,EAAE,aAAa;IACpB,WAAW,EACT,gFAAgF;QAChF,wEAAwE;IAC1E,MAAM,EAAE,WAAW;IACnB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACpD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;CACF,CAAA;AAED,eAAe,IAAI,CAAA"}

package/dist/tools/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Tool registration entry point.
+ *
+ * Importing this module registers all built-in tools into the registry.
+ * Called once from server.ts at startup.
+ */
+export declare function registerAllTools(): void;
+//# sourceMappingURL=index.d.ts.map