@burdenoff/mcp-libs 2026.1009.1 → 2026.1009.2

package/dist/modules/security/index.cjs

@@ -1,12 +1,12 @@
 'use strict';
 
-var zod = require('zod');
 require('graphql-request');
 require('cross-fetch');
 require('@modelcontextprotocol/sdk/server/mcp.js');
 require('@modelcontextprotocol/sdk/types.js');
+require('zod');
 
-// src/modules/security/tools.ts
+// src/core/auth/store.ts
 
 // src/core/errors.ts
 var McpInternalError = class extends Error {
@@ -37,12 +37,6 @@ function mcpToolName(productName, ...parts) {
 }
 
 // src/core/result.ts
-function jsonResult(data, structured) {
-  const result = {
-    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
-  };
-  return result;
-}
 function errorResult(message, hint) {
   const text = hint ? `${message}
 
@@ -50,511 +44,52 @@ Hint: ${hint}` : message;
   return { content: [{ type: "text", text }], isError: true };
 }
 
-// src/modules/security/operations.ts
-var GET_VAULTS = `
-  query GetVaults($filter: VaultFilterInput, $pagination: SecurityPaginationInput) {
-    getVaults(filter: $filter, pagination: $pagination) {
-      items { id name description scope status createdAt }
-      total hasMore
-    }
-  }
-`;
-var GET_VAULT = `
-  query GetVault($id: ID!) {
-    getVault(id: $id) {
-      id name description scope scopeId status lockAfterMinutes createdAt updatedAt
-    }
-  }
-`;
-var CREATE_VAULT = `
-  mutation CreateVault($input: CreateVaultInput!) {
-    createVault(input: $input) {
-      id name scope scopeId status
-    }
-  }
-`;
-var UPDATE_VAULT = `
-  mutation UpdateVault($id: ID!, $input: UpdateVaultInput!) {
-    updateVault(id: $id, input: $input) {
-      id name description scope status lockAfterMinutes updatedAt
-    }
-  }
-`;
-var DELETE_VAULT = `
-  mutation DeleteVault($id: ID!) {
-    deleteVault(id: $id)
-  }
-`;
-var ARCHIVE_VAULT = `
-  mutation ArchiveVault($id: ID!) {
-    archiveVault(id: $id) { id status }
-  }
-`;
-var GET_SECRETS = `
-  query GetSecrets($vaultId: ID!, $filter: SecretFilterInput, $pagination: SecurityPaginationInput) {
-    getSecrets(vaultId: $vaultId, filter: $filter, pagination: $pagination) {
-      items { id key name description type status isEphemeral createdAt }
-      total hasMore
-    }
-  }
-`;
-var GET_SECRET = `
-  query GetSecret($id: ID!) {
-    getSecret(id: $id) {
-      id key name description type status isEphemeral expiresAt createdAt updatedAt
-    }
-  }
-`;
-var DECRYPT_SECRET = `
-  query DecryptSecret($id: ID!) {
-    decryptSecret(id: $id) {
-      id key value
-    }
-  }
-`;
-var CREATE_SECRET = `
-  mutation CreateSecret($input: CreateSecretInput!) {
-    createSecret(input: $input) {
-      id key name type status
-    }
-  }
-`;
-var UPDATE_SECRET = `
-  mutation UpdateSecret($id: ID!, $input: UpdateSecretInput!) {
-    updateSecret(id: $id, input: $input) {
-      id key name status updatedAt
-    }
-  }
-`;
-var DELETE_SECRET = `
-  mutation DeleteSecret($id: ID!) {
-    deleteSecret(id: $id)
-  }
-`;
-var ROTATE_SECRET = `
-  mutation RotateSecret($id: ID!, $newValue: String!) {
-    rotateSecret(id: $id, newValue: $newValue) {
-      id key updatedAt
-    }
-  }
-`;
-
 // src/modules/security/tools.ts
-var VaultScopeEnum = zod.z.enum(["WORKSPACE", "GLOBAL", "VIBE"]);
-var VaultStatusEnum = zod.z.enum(["ACTIVE", "LOCKED", "ARCHIVED"]);
-var SecretTypeEnum = zod.z.enum(["API_KEY", "PASSWORD", "CERTIFICATE", "TOKEN", "OTHER"]);
-var SecretStatusEnum = zod.z.enum(["ACTIVE", "EXPIRED", "REVOKED"]);
-function readWorkspaceContext(ctx) {
-  const auth = ctx.auth.read();
-  if (!auth?.workspaceId) return null;
-  return { workspaceId: auth.workspaceId };
-}
-function registerSecurityTools(server, ctx, track) {
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "security_vaults_list")),
-    {
-      title: "List Vaults",
-      description: "List vaults in the current workspace with optional filters and pagination.",
-      inputSchema: {
-        scope: VaultScopeEnum.optional().describe("Filter by vault scope"),
-        status: VaultStatusEnum.optional().describe("Filter by status"),
-        search: zod.z.string().optional().describe("Free-text search"),
-        limit: zod.z.number().optional().describe("Page size (default 50)"),
-        offset: zod.z.number().optional().describe("Skip results")
-      }
-    },
-    async ({ scope, status, search, limit, offset }) => {
-      try {
-        const workspaceCtx = readWorkspaceContext(ctx);
-        if (!workspaceCtx) {
-          return errorResult(
-            "No active workspace. Bind a workspace via the auth login flow first."
-          );
-        }
-        const filter = { context: workspaceCtx };
-        if (scope !== void 0) filter.scope = scope;
-        if (status !== void 0) filter.status = status;
-        if (search !== void 0) filter.search = search;
-        const pagination = {};
-        if (limit !== void 0) pagination.limit = limit;
-        if (offset !== void 0) pagination.offset = offset;
-        const data = await ctx.gql.workspace.request(GET_VAULTS, {
-          filter,
-          pagination: Object.keys(pagination).length > 0 ? pagination : void 0
-        });
-        return jsonResult(data.getVaults);
-      } catch (error) {
-        ctx.logger.error("security_vaults_list failed", { error });
-        return errorResult(
-          `Failed to list vaults: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "security_vaults_get")),
-    {
-      title: "Get Vault",
-      description: "Get a vault by ID.",
-      inputSchema: {
-        id: zod.z.string().describe("Vault ID")
-      }
-    },
-    async ({ id }) => {
-      try {
-        const data = await ctx.gql.workspace.request(GET_VAULT, {
-          id
-        });
-        if (!data.getVault) {
-          return errorResult(`Vault ${id} not found`);
-        }
-        return jsonResult(data.getVault);
-      } catch (error) {
-        ctx.logger.error("security_vaults_get failed", { error });
-        return errorResult(
-          `Failed to get vault: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "security_vaults_create")),
-    {
-      title: "Create Vault",
-      description: "Create a new vault scoped to the current workspace.",
-      inputSchema: {
-        name: zod.z.string().describe("Vault name"),
-        description: zod.z.string().optional().describe("Vault description"),
-        scope: VaultScopeEnum.optional().describe("Vault scope (default: WORKSPACE)"),
-        scopeId: zod.z.string().optional().describe("Scope ID (defaults to current workspace ID when scope is WORKSPACE)"),
-        lockAfterMinutes: zod.z.number().optional().describe("Auto-lock after N minutes of inactivity")
-      }
-    },
-    async ({ name, description, scope, scopeId, lockAfterMinutes }) => {
-      try {
-        const workspaceCtx = readWorkspaceContext(ctx);
-        if (!workspaceCtx) {
-          return errorResult(
-            "No active workspace. Bind a workspace via the auth login flow first."
-          );
-        }
-        const resolvedScope = scope ?? "WORKSPACE";
-        const input = {
-          context: workspaceCtx,
-          name,
-          scope: resolvedScope,
-          scopeId: scopeId ?? workspaceCtx.workspaceId
-        };
-        if (description !== void 0) input.description = description;
-        if (lockAfterMinutes !== void 0) input.lockAfterMinutes = lockAfterMinutes;
-        const data = await ctx.gql.workspace.request(CREATE_VAULT, {
-          input
-        });
-        return jsonResult(data.createVault);
-      } catch (error) {
-        ctx.logger.error("security_vaults_create failed", { error });
-        return errorResult(
-          `Failed to create vault: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "security_vaults_update")),
-    {
-      title: "Update Vault",
-      description: "Update a vault (name/description/lockAfterMinutes/status). At least one field must be provided. The workspace context is implicit. Returns the updated Vault.",
-      inputSchema: {
-        id: zod.z.string().describe("Vault ID"),
-        name: zod.z.string().optional().describe("Updated vault name"),
-        description: zod.z.string().optional().describe("Updated description"),
-        status: VaultStatusEnum.optional().describe("Updated vault status"),
-        lockAfterMinutes: zod.z.number().int().optional().describe("Auto-lock after N minutes of inactivity")
-      }
-    },
-    async ({ id, name, description, status, lockAfterMinutes }) => {
-      try {
-        const workspaceCtx = readWorkspaceContext(ctx);
-        if (!workspaceCtx) {
-          return errorResult(
-            "No active workspace. Bind a workspace via the auth login flow first."
-          );
-        }
-        const input = { context: workspaceCtx };
-        if (name !== void 0) input.name = name;
-        if (description !== void 0) input.description = description;
-        if (status !== void 0) input.status = status;
-        if (lockAfterMinutes !== void 0) input.lockAfterMinutes = lockAfterMinutes;
-        if (Object.keys(input).length === 1) {
-          return errorResult(
-            "No updates specified \u2014 provide at least one of name/description/status/lockAfterMinutes"
-          );
-        }
-        const data = await ctx.gql.workspace.request(UPDATE_VAULT, {
-          id,
-          input
-        });
-        return jsonResult(data.updateVault);
-      } catch (error) {
-        ctx.logger.error("security_vaults_update failed", { error });
-        return errorResult(
-          `Failed to update vault: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "security_vaults_delete")),
-    {
-      title: "Delete Vault",
-      description: "Delete a vault. Set archive=true to soft-archive instead of permanently deleting.",
-      inputSchema: {
-        id: zod.z.string().describe("Vault ID"),
-        archive: zod.z.boolean().optional().describe("Archive instead of hard delete")
-      }
-    },
-    async ({ id, archive }) => {
-      try {
-        if (archive === true) {
-          const data2 = await ctx.gql.workspace.request(ARCHIVE_VAULT, { id });
-          return jsonResult({ archived: true, vault: data2.archiveVault });
-        }
-        const data = await ctx.gql.workspace.request(DELETE_VAULT, {
-          id
-        });
-        return jsonResult({ deleted: data.deleteVault, vaultId: id });
-      } catch (error) {
-        ctx.logger.error("security_vaults_delete failed", { error });
-        return errorResult(
-          `Failed to delete vault: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "security_secrets_list")),
-    {
-      title: "List Secrets",
-      description: "List secrets in a vault with optional filters and pagination.",
-      inputSchema: {
-        vaultId: zod.z.string().describe("Vault ID"),
-        type: SecretTypeEnum.optional().describe("Filter by secret type"),
-        search: zod.z.string().optional().describe("Free-text search"),
-        limit: zod.z.number().optional().describe("Page size (default 100)"),
-        offset: zod.z.number().optional().describe("Skip results")
-      }
-    },
-    async ({ vaultId, type, search, limit, offset }) => {
-      try {
-        const workspaceCtx = readWorkspaceContext(ctx);
-        if (!workspaceCtx) {
-          return errorResult(
-            "No active workspace. Bind a workspace via the auth login flow first."
-          );
-        }
-        const filter = { context: workspaceCtx };
-        if (type !== void 0) filter.type = type;
-        if (search !== void 0) filter.search = search;
-        const pagination = {};
-        if (limit !== void 0) pagination.limit = limit;
-        if (offset !== void 0) pagination.offset = offset;
-        const data = await ctx.gql.workspace.request(GET_SECRETS, {
-          vaultId,
-          filter,
-          pagination: Object.keys(pagination).length > 0 ? pagination : void 0
-        });
-        return jsonResult(data.getSecrets);
-      } catch (error) {
-        ctx.logger.error("security_secrets_list failed", { error });
-        return errorResult(
-          `Failed to list secrets: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "security_secrets_get")),
-    {
-      title: "Get Secret Metadata",
-      description: "Get a secret's metadata. Does NOT decrypt the value \u2014 use security_secrets_reveal for that.",
-      inputSchema: {
-        id: zod.z.string().describe("Secret ID")
-      }
-    },
-    async ({ id }) => {
-      try {
-        const data = await ctx.gql.workspace.request(GET_SECRET, {
-          id
-        });
-        if (!data.getSecret) {
-          return errorResult(`Secret ${id} not found`);
-        }
-        return jsonResult(data.getSecret);
-      } catch (error) {
-        ctx.logger.error("security_secrets_get failed", { error });
-        return errorResult(
-          `Failed to get secret: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "security_secrets_reveal")),
-    {
-      title: "Reveal Secret Value",
-      description: "Decrypt and return the secret value. This action is audited server-side. Treat the result as sensitive and avoid persisting it.",
-      inputSchema: {
-        id: zod.z.string().describe("Secret ID")
-      }
-    },
-    async ({ id }) => {
-      try {
-        const data = await ctx.gql.workspace.request(DECRYPT_SECRET, { id });
-        return jsonResult(data.decryptSecret);
-      } catch (error) {
-        ctx.logger.error("security_secrets_reveal failed", { error });
-        return errorResult(
-          `Failed to reveal secret: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  );
+function stubbedTool(server, toolName, title, description, featureNote, inputSchema, altSuggestions) {
   server.registerTool(
-    track(mcpToolName(ctx.productName, "security_secrets_set")),
+    toolName,
     {
-      title: "Create Secret",
-      description: "Create a new secret in a vault. The value is encrypted server-side.",
-      inputSchema: {
-        vaultId: zod.z.string().describe("Vault ID"),
-        key: zod.z.string().describe("Secret key (unique within the vault)"),
-        name: zod.z.string().describe("Human-readable secret name"),
-        value: zod.z.string().describe("Secret value (will be encrypted server-side)"),
-        description: zod.z.string().optional().describe("Secret description"),
-        type: SecretTypeEnum.optional().describe("Secret type (default: OTHER)"),
-        isEphemeral: zod.z.boolean().optional().describe("Mark as ephemeral"),
-        expiresAt: zod.z.string().optional().describe("Expiry timestamp in ISO 8601")
-      }
+      title,
+      description: `${description} [STUB]`,
+      inputSchema
     },
-    async ({ vaultId, key, name, value, description, type, isEphemeral, expiresAt }) => {
-      try {
-        const workspaceCtx = readWorkspaceContext(ctx);
-        if (!workspaceCtx) {
-          return errorResult(
-            "No active workspace. Bind a workspace via the auth login flow first."
-          );
-        }
-        const input = {
-          context: workspaceCtx,
-          vaultId,
-          key,
-          name,
-          value,
-          type: type ?? "OTHER",
-          isEphemeral: isEphemeral === true
-        };
-        if (description !== void 0) input.description = description;
-        if (expiresAt !== void 0) input.expiresAt = expiresAt;
-        const data = await ctx.gql.workspace.request(CREATE_SECRET, {
-          input
-        });
-        return jsonResult(data.createSecret);
-      } catch (error) {
-        ctx.logger.error("security_secrets_set failed", { error });
-        return errorResult(
-          `Failed to create secret: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "security_secrets_update")),
-    {
-      title: "Update Secret Metadata",
-      description: "Update secret metadata (name, description, status). To rotate the value, use security_secrets_rotate.",
-      inputSchema: {
-        id: zod.z.string().describe("Secret ID"),
-        name: zod.z.string().optional().describe("Updated name"),
-        description: zod.z.string().optional().describe("Updated description"),
-        status: SecretStatusEnum.optional().describe("Updated status")
-      }
-    },
-    async ({ id, name, description, status }) => {
-      try {
-        const workspaceCtx = readWorkspaceContext(ctx);
-        if (!workspaceCtx) {
-          return errorResult(
-            "No active workspace. Bind a workspace via the auth login flow first."
-          );
-        }
-        const input = { context: workspaceCtx };
-        if (name !== void 0) input.name = name;
-        if (description !== void 0) input.description = description;
-        if (status !== void 0) input.status = status;
-        if (Object.keys(input).length === 1) {
-          return errorResult("No updates specified");
-        }
-        const data = await ctx.gql.workspace.request(UPDATE_SECRET, {
-          id,
-          input
-        });
-        return jsonResult(data.updateSecret);
-      } catch (error) {
-        ctx.logger.error("security_secrets_update failed", { error });
-        return errorResult(
-          `Failed to update secret: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "security_secrets_rotate")),
-    {
-      title: "Rotate Secret Value",
-      description: "Replace a secret's encrypted value with a new one.",
-      inputSchema: {
-        id: zod.z.string().describe("Secret ID"),
-        newValue: zod.z.string().describe("New secret value")
-      }
-    },
-    async ({ id, newValue }) => {
-      try {
-        const data = await ctx.gql.workspace.request(ROTATE_SECRET, {
-          id,
-          newValue
-        });
-        return jsonResult(data.rotateSecret);
-      } catch (error) {
-        ctx.logger.error("security_secrets_rotate failed", { error });
-        return errorResult(
-          `Failed to rotate secret: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "security_secrets_delete")),
-    {
-      title: "Delete Secret",
-      description: "Delete a secret by ID.",
-      inputSchema: {
-        id: zod.z.string().describe("Secret ID")
-      }
-    },
-    async ({ id }) => {
-      try {
-        const data = await ctx.gql.workspace.request(DELETE_SECRET, {
-          id
-        });
-        return jsonResult({ deleted: data.deleteSecret, secretId: id });
-      } catch (error) {
-        ctx.logger.error("security_secrets_delete failed", { error });
-        return errorResult(
-          `Failed to delete secret: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+    async () => errorResult(
+      `[stubbed] ${featureNote} Use ${altSuggestions.join(", ")} instead. The tool remains registered so callers receive a meaningful response instead of a schema-validation error.`
+    )
   );
 }
+function registerSecurityTools(server, ctx, track) {
+  const featureNote = "Live alpha removed `Mutation.createSecret` and `CreateSecretInput`. The surviving workspaces-endpoint variant requires a `SecretType!` value whose enum members are unlistable from outside the gateway (introspection disabled). The original `OTHER` default is no longer a valid enum member.";
+  const alts = [
+    "the next alpha release that restores the global `createSecret` mutation",
+    "the SDK security API (which the MCP will mirror once it lands)"
+  ];
+  const tools = [
+    ["security_vaults_list", "List Vaults", "List vaults in the active workspace."],
+    ["security_vaults_get", "Get Vault", "Get a vault by ID."],
+    ["security_vaults_create", "Create Vault", "Create a new vault."],
+    ["security_vaults_update", "Update Vault", "Update a vault."],
+    ["security_vaults_delete", "Delete Vault", "Delete a vault."],
+    ["security_secrets_list", "List Secrets", "List secrets in a vault."],
+    ["security_secrets_get", "Get Secret", "Get a secret by ID."],
+    ["security_secrets_reveal", "Reveal Secret", "Decrypt a secret."],
+    ["security_secrets_set", "Set Secret", "Create or update a secret."],
+    ["security_secrets_update", "Update Secret", "Update secret metadata."],
+    ["security_secrets_delete", "Delete Secret", "Delete a secret."],
+    ["security_secrets_rotate", "Rotate Secret", "Rotate a secret's value."]
+  ];
+  for (const [tool, title, desc] of tools) {
+    stubbedTool(
+      server,
+      track(mcpToolName(ctx.productName, tool)),
+      title,
+      desc,
+      featureNote,
+      {},
+      alts
+    );
+  }
+}
 
 // src/modules/security/index.ts
 var securityModule = {