@burdenoff/mcp-libs 2026.1021.1 → 2026.1028.1

package/dist/core/config/store.d.ts

@@ -0,0 +1,39 @@
+export interface McpConfig {
+    workspaceEndpoint: string;
+    globalEndpoint: string;
+    oidcIssuer?: string;
+    clientId?: string;
+    accessToken?: string;
+    refreshToken?: string;
+    workspaceToken?: string;
+    apiKey?: string;
+    workspaceId?: string;
+    organizationId?: string;
+    host: string;
+    httpPort: number;
+    corsOrigins: string;
+    allowedHosts: string;
+    logLevel: 'error' | 'warn' | 'info' | 'debug';
+    logFormat: 'json' | 'text';
+}
+export interface ProductDefaults {
+    configDirName: string;
+    oidcClientId: string;
+    oidcIssuerProd?: string;
+    workspaceEndpointDefault: string;
+    globalEndpointDefault: string;
+    httpPortDefault?: number;
+    hostDefault?: string;
+    envPrefix?: string;
+}
+export interface ConfigStore {
+    read(): McpConfig;
+    write(config: Partial<McpConfig>): void;
+    path(): string;
+    dir(): string;
+    resolveOIDC(): {
+        oidcIssuer: string;
+        clientId: string;
+    };
+}
+export declare function createConfigStore(defaults: ProductDefaults): ConfigStore;

package/dist/core/context.d.ts

@@ -0,0 +1,35 @@
+import { type AuthStore } from './auth/store.js';
+import { type ConfigStore, type ProductDefaults } from './config/store.js';
+import { type GqlClients } from './gql/client.js';
+import { type Logger, type LoggerOptions } from './logger.js';
+import { type ProgressFn } from './progress.js';
+export type Environment = 'prod' | 'alpha' | 'dev' | 'local';
+export interface McpContext {
+    productName: string;
+    productVersion: string;
+    serverName: string;
+    serverVersion: string;
+    defaults: ProductDefaults;
+    config: ConfigStore;
+    auth: AuthStore;
+    gql: GqlClients;
+    logger: Logger;
+    progress: ProgressFn;
+    env: Environment;
+    _internal: {
+        serverRef: {
+            current: import('@modelcontextprotocol/sdk/server/mcp.js').McpServer | null;
+        };
+    };
+}
+export interface BuildContextOptions {
+    productName: string;
+    productVersion: string;
+    serverName: string;
+    serverVersion: string;
+    defaults: ProductDefaults;
+    logger?: LoggerOptions | Logger;
+    env?: Environment;
+    tokenStorePath?: string;
+}
+export declare function buildContext(opts: BuildContextOptions): McpContext;

package/dist/core/errors.d.ts

@@ -0,0 +1,15 @@
+export declare class McpUserError extends Error {
+    readonly hint: string | undefined;
+    constructor(message: string, opts?: {
+        hint?: string;
+    });
+}
+export declare class McpAuthError extends McpUserError {
+    constructor(message: string, opts?: {
+        hint?: string;
+    });
+}
+export declare class McpInternalError extends Error {
+    readonly cause: unknown;
+    constructor(message: string, cause?: unknown);
+}

package/dist/core/gql/client.d.ts

@@ -0,0 +1,14 @@
+import { type RequestDocument, type Variables } from 'graphql-request';
+import type { AuthStore } from '../auth/store.js';
+import type { ConfigStore } from '../config/store.js';
+export interface GqlClient {
+    request<T>(document: RequestDocument, variables?: Variables): Promise<T>;
+}
+export interface GqlClients {
+    workspace: GqlClient;
+    global: GqlClient;
+    workspaceAuthOnly: GqlClient;
+    reset(): void;
+}
+export declare function extractGqlErrorMessage(error: unknown): string;
+export declare function createGqlClients(config: ConfigStore, authStore: AuthStore): GqlClients;

package/dist/core/index.cjs

@@ -7,6 +7,7 @@ var graphqlRequest = require('graphql-request');
 var fetch = require('cross-fetch');
 var mcp_js = require('@modelcontextprotocol/sdk/server/mcp.js');
 var types_js = require('@modelcontextprotocol/sdk/types.js');
+var crypto = require('crypto');
 var zod = require('zod');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
@@ -815,6 +816,63 @@ function inferReadOnlyHint(toolName) {
 }
 
 // src/core/tool-governance.ts
+function scopeToolFilter(scopes) {
+  if (scopes.includes("mcp:*")) return () => true;
+  const allowed = new Set(
+    scopes.filter((scope) => scope.startsWith("mcp:tool:")).map((scope) => scope.slice("mcp:tool:".length))
+  );
+  return (toolName) => allowed.has(toolName);
+}
+function canonicalJson(value, seen = /* @__PURE__ */ new Set()) {
+  if (value === null || value === void 0) return "null";
+  if (typeof value === "number") return Number.isFinite(value) ? JSON.stringify(value) : "null";
+  if (typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "bigint") return JSON.stringify(value.toString());
+  if (typeof value !== "object") return "null";
+  if (seen.has(value)) return "null";
+  seen.add(value);
+  try {
+    if (Array.isArray(value))
+      return `[${value.map((item) => canonicalJson(item, seen)).join(",")}]`;
+    const record = value;
+    const members = Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key], seen)}`);
+    return `{${members.join(",")}}`;
+  } finally {
+    seen.delete(value);
+  }
+}
+function toolArgsSha256(args) {
+  return crypto.createHash("sha256").update(canonicalJson(args), "utf8").digest("hex");
+}
+function isErrorResult(result) {
+  return typeof result === "object" && result !== null && result.isError === true;
+}
+function wrapAuditedHandler(name, handler, onToolCall) {
+  return async (...callbackArgs) => {
+    const started = Date.now();
+    const args = callbackArgs.length === 2 ? callbackArgs[0] : {};
+    const report = (status, error) => {
+      try {
+        onToolCall({
+          name,
+          argsSha256: toolArgsSha256(args),
+          status,
+          durationMs: Date.now() - started,
+          ...error ? { error } : {}
+        });
+      } catch {
+      }
+    };
+    try {
+      const result = await handler(...callbackArgs);
+      report(isErrorResult(result) ? "error" : "ok");
+      return result;
+    } catch (error) {
+      report("error", error instanceof Error ? error.message : String(error));
+      throw error;
+    }
+  };
+}
 var CONFIRM_FIELD_DESCRIPTION = "Must be true to execute this destructive tool. The call is rejected (no changes made) if omitted or false.";
 function resolveAnnotations(name, declared) {
   const destructiveHint = declared?.destructiveHint ?? inferDestructiveHint(name);
@@ -849,10 +907,11 @@ function wrapServerWithToolGovernance(server, options = {}) {
   const enforceConfirmation = options.enforceDestructiveConfirmation ?? false;
   const target = server;
   const originalRegisterTool = target.registerTool.bind(target);
-  target.registerTool = (name, config, handler) => {
+  const register = (name, config, handler) => {
     const annotations = resolveAnnotations(name, config.annotations);
+    const audited = options.onToolCall ? wrapAuditedHandler(name, handler, options.onToolCall) : handler;
     if (!enforceConfirmation || !annotations.destructiveHint) {
-      return originalRegisterTool(name, { ...config, annotations }, handler);
+      return originalRegisterTool(name, { ...config, annotations }, audited);
     }
     const gatedInputSchema = {
       ...config.inputSchema ?? {},
@@ -861,9 +920,16 @@ function wrapServerWithToolGovernance(server, options = {}) {
     return originalRegisterTool(
       name,
       { ...config, inputSchema: gatedInputSchema, annotations },
-      wrapDestructiveHandler(name, handler)
+      wrapDestructiveHandler(name, audited)
     );
   };
+  target.registerTool = (name, config, handler) => {
+    const registered = register(name, config, handler);
+    if (options.toolFilter && !options.toolFilter(name)) {
+      registered?.disable?.();
+    }
+    return registered;
+  };
   return server;
 }
 function withToolAnnotations(server, resolve, register) {
@@ -905,7 +971,9 @@ function createMcpServer(ctx, modules, opts) {
     { capabilities: toServerCapabilities(capabilities) }
   );
   wrapServerWithToolGovernance(server, {
-    enforceDestructiveConfirmation: opts.enforceDestructiveConfirmation
+    enforceDestructiveConfirmation: opts.enforceDestructiveConfirmation,
+    toolFilter: opts.toolFilter,
+    onToolCall: opts.onToolCall
   });
   ctx._internal.serverRef.current = server;
   const inner = server.server ?? server;
@@ -1061,10 +1129,12 @@ exports.mcpResourceUri = mcpResourceUri;
 exports.mcpToolName = mcpToolName;
 exports.pollDeviceTokenOnce = pollDeviceTokenOnce;
 exports.registerTool = registerTool;
+exports.scopeToolFilter = scopeToolFilter;
 exports.sortModules = sortModules;
 exports.startDeviceCodeFlow = startDeviceCodeFlow;
 exports.textResult = textResult;
 exports.toServerCapabilities = toServerCapabilities;
+exports.toolArgsSha256 = toolArgsSha256;
 exports.unionCapabilities = unionCapabilities;
 exports.withToolAnnotations = withToolAnnotations;
 exports.wrapServerWithToolGovernance = wrapServerWithToolGovernance;