@burdenoff/mcp-libs 2026.1026.1 → 2026.1028.1

package/dist/modules/semanticfed/index.js

@@ -1,4 +1,4 @@
-import { mcpToolName, errorResult, jsonResult, mcpResourceUri, mcpPromptName } from '../../chunk-FHXCNP2U.js';
+import { mcpToolName, errorResult, jsonResult, mcpResourceUri, mcpPromptName } from '../../chunk-J74ZKEXL.js';
 import { z } from 'zod';
 
 // src/modules/semanticfed/operations.ts

package/dist/modules/store/index.cjs

@@ -4,6 +4,7 @@ require('graphql-request');
 require('cross-fetch');
 require('@modelcontextprotocol/sdk/server/mcp.js');
 require('@modelcontextprotocol/sdk/types.js');
+require('crypto');
 require('zod');
 
 // src/core/auth/store.ts

package/dist/modules/store/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/core/errors.ts","../../../src/core/tool-name.ts","../../../src/core/result.ts","../../../src/modules/store/tools.ts","../../../src/modules/store/index.ts"],"names":[],"mappings":";;;;;;;;;;;AA8BO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EACjB,KAAA;AAAA,EAEzB,WAAA,CAAY,SAAiB,KAAA,EAAiB;AAC5C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF,CAAA;;;AC1BA,IAAM,oBAAA,GAAuB,EAAA;AAE7B,SAAS,cAAA,CAAe,MAAc,IAAA,EAA8C;AAClF,EAAA,IAAuB,IAAA,CAAK,MAAA,GAAS,oBAAA,EAAsB;AACzD,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,CAAA,WAAA,EAAc,IAAI,CAAA,UAAA,EAAa,oBAAoB,CAAA,8CAAA;AAAA,KACrD;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,WAAA,CAAY,gBAAwB,KAAA,EAAyB;AAC3E,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,iBAAiB,sCAAsC,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,IAAA,GAAO,CAAC,WAAA,EAAa,GAAG,KAAK,EAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC7D,EAAA,OAAO,cAAA,CAAe,IAAY,CAAA;AACpC;;;AC4BO,SAAS,WAAA,CAAY,SAAiB,IAAA,EAA2B;AACtE,EAAA,MAAM,IAAA,GAAO,IAAA,GAAO,CAAA,EAAG,OAAO;;AAAA,MAAA,EAAa,IAAI,CAAA,CAAA,GAAK,OAAA;AACpD,EAAA,OAAO,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,CAAA,EAAG,OAAA,EAAS,IAAA,EAAK;AAC5D;;;AC3DA,SAAS,YACP,MAAA,EACA,QAAA,EACA,OACA,WAAA,EACA,WAAA,EACA,aACA,cAAA,EACM;AACN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,QAAA;AAAA,IACA;AAAA,MACE,KAAA;AAAA,MACA,WAAA,EAAa,GAAG,WAAW,CAAA,OAAA,CAAA;AAAA,MAC3B;AAAA,KACF;AAAA,IACA,YACE,WAAA;AAAA,MACE,aAAa,WAAW,CAAA,KAAA,EAAQ,cAAA,CAAe,IAAA,CAAK,IAAI,CAAC,CAAA,oHAAA;AAAA;AAC3D,GACJ;AACF;AAEO,SAAS,kBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AAQN,EAAA,MAAM,WAAA,GACJ,+LAAA;AACF,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,uEAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,KAAA,GAAyC;AAAA,IAC7C,CAAC,cAAA,EAAgB,cAAA,EAAgB,yBAAyB,CAAA;AAAA,IAC1D,CAAC,cAAA,EAAgB,cAAA,EAAgB,yBAAyB,CAAA;AAAA,IAC1D,CAAC,mBAAA,EAAqB,aAAA,EAAe,sBAAsB,CAAA;AAAA,IAC3D,CAAC,iBAAA,EAAmB,aAAA,EAAe,8BAA8B,CAAA;AAAA,IACjE,CAAC,gBAAA,EAAkB,aAAA,EAAe,4BAA4B,CAAA;AAAA,IAC9D,CAAC,mBAAA,EAAqB,kBAAA,EAAoB,iCAAiC,CAAA;AAAA,IAC3E,CAAC,qBAAA,EAAuB,eAAA,EAAiB,6BAA6B,CAAA;AAAA,IACtE,CAAC,kBAAA,EAAoB,YAAA,EAAc,iBAAiB,CAAA;AAAA,IACpD,CAAC,mBAAA,EAAqB,aAAA,EAAe,cAAc,CAAA;AAAA,IACnD,CAAC,kBAAA,EAAoB,WAAA,EAAa,qBAAqB,CAAA;AAAA,IACvD,CAAC,sBAAA,EAAwB,yBAAA,EAA2B,0BAA0B,CAAA;AAAA,IAC9E,CAAC,2BAAA,EAA6B,mBAAA,EAAqB,sBAAsB,CAAA;AAAA,IACzE,CAAC,qBAAA,EAAuB,eAAA,EAAiB,wBAAwB,CAAA;AAAA,IACjE,CAAC,qBAAA,EAAuB,kBAAA,EAAoB,qCAAqC,CAAA;AAAA,IACjF;AAAA,MACE,0BAAA;AAAA,MACA,4BAAA;AAAA,MACA;AAAA;AACF,GACF;AACA,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAA,EAAO,IAAI,KAAK,KAAA,EAAO;AACvC,IAAA,WAAA;AAAA,MACE,MAAA;AAAA,MACA,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,IAAI,CAAC,CAAA;AAAA,MACxC,KAAA;AAAA,MACA,IAAA;AAAA,MACA,WAAA;AAAA,MACA,EAAC;AAAA,MACD;AAAA,KACF;AAAA,EACF;AACF;;;ACrEA,IAAM,WAAA,GAAyB;AAAA,EAC7B,EAAA,EAAI,OAAA;AAAA,EACJ,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAa,OAAA;AAAA,EACb,SAAA,EAAW,CAAC,MAAM,CAAA;AAAA,EAClB,YAAA,EAAc,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,EAE1B,QAAA,CAAS,QAAmB,GAAA,EAAqC;AAC/D,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KAAsB;AACnC,MAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AACZ,MAAA,OAAO,CAAA;AAAA,IACT,CAAA;AAEA,IAAA,kBAAA,CAAmB,MAAA,EAAQ,KAAK,KAAK,CAAA;AAErC,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,EAAC,EAAG,OAAA,EAAS,EAAC,EAAE;AAAA,EAC7C;AACF,CAAA;AAEA,IAAO,aAAA,GAAQ","file":"index.cjs","sourcesContent":["/**\n * Error classes for MCP SDK.\n *\n * Modules MUST throw these instead of throwing raw Errors. The registerTool\n * wrapper in result.ts catches and maps them to MCP-protocol-compliant\n * `{ isError: true, content: [...] }` responses.\n *\n * Throwing past the wrapper to the protocol surfaces as JSON-RPC -32603 to\n * the client and is a protocol bug.\n */\n\nexport class McpUserError extends Error {\n  public readonly hint: string | undefined;\n\n  constructor(message: string, opts?: { hint?: string }) {\n    super(message);\n    this.name = 'McpUserError';\n    this.hint = opts?.hint;\n  }\n}\n\nexport class McpAuthError extends McpUserError {\n  constructor(message: string, opts?: { hint?: string }) {\n    super(message, {\n      hint: opts?.hint ?? 'Run the auth_login tool to authenticate.',\n    });\n    this.name = 'McpAuthError';\n  }\n}\n\nexport class McpInternalError extends Error {\n  public override readonly cause: unknown;\n\n  constructor(message: string, cause?: unknown) {\n    super(message);\n    this.name = 'McpInternalError';\n    this.cause = cause;\n  }\n}\n","/**\n * Tool / resource / prompt naming helpers.\n *\n * Mandatory product prefix avoids collisions when Claude Desktop runs\n * multiple MCP servers concurrently (typical setup is ~6).\n *\n * Tool names are capped at 63 characters — Claude Desktop pre-1.x\n * truncated at 64 in some versions.\n */\n\nimport { McpInternalError } from './errors.js';\n\nconst MAX_TOOL_NAME_LENGTH = 63;\n\nfunction assertSafeName(name: string, kind: 'tool' | 'resource' | 'prompt'): string {\n  if (kind === 'tool' && name.length > MAX_TOOL_NAME_LENGTH) {\n    throw new McpInternalError(\n      `Tool name '${name}' exceeds ${MAX_TOOL_NAME_LENGTH} characters (some MCP clients truncate at 64).`,\n    );\n  }\n  return name;\n}\n\n/**\n * Build a tool name. Format: `<productName>_<...parts>` (snake_case).\n * Example: mcpToolName('vibecontrols', 'vibes', 'list') -> 'vibecontrols_vibes_list'\n */\nexport function mcpToolName(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpToolName: productName is required');\n  }\n  const name = [productName, ...parts].filter(Boolean).join('_');\n  return assertSafeName(name, 'tool');\n}\n\n/**\n * Build a resource URI. Format: `<productName>://<...parts>`.\n * Example: mcpResourceUri('vibecontrols', 'schema') -> 'vibecontrols://schema'\n */\nexport function mcpResourceUri(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpResourceUri: productName is required');\n  }\n  return `${productName}://${parts.filter(Boolean).join('/')}`;\n}\n\n/**\n * Build a prompt name. Format: `<productName>-<...parts>` (kebab-case).\n * Example: mcpPromptName('vibecontrols', 'setup') -> 'vibecontrols-setup'\n */\nexport function mcpPromptName(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpPromptName: productName is required');\n  }\n  return [productName, ...parts].filter(Boolean).join('-');\n}\n\nexport const TOOL_NAME_LIMIT = MAX_TOOL_NAME_LENGTH;\n\n/**\n * Name-based hint heuristics for MCP `annotations` (readOnlyHint /\n * destructiveHint). Used by tool-governance.ts to auto-fill annotations for\n * the fleet of product modules that call `server.registerTool` directly\n * (bypassing the `registerTool()` core helper) and so never set them\n * explicitly today (BOFF-3903). Deliberately conservative — matched against\n * whole `_`-delimited segments so e.g. `timeentries_delete` and\n * `pomodoro_delete_goal` match, but a hypothetical `undeletable_check`\n * would not.\n *\n * The destructive verb set covers more than `delete`: stopping, killing or\n * terminating a running process, revoking or rotating a credential/share,\n * resetting settings and removing/purging/uninstalling are all actions an\n * MCP client must not auto-run without the user's intent (VC/FG parity G57 —\n * e.g. `vibecontrols_sessions_kill`, `vibecontrols_tunnels_rotate_credentials`\n * were previously reported as non-destructive).\n *\n * A module can always override the inference by passing an explicit\n * `annotations` object to `registerTool()` / `server.registerTool()` — do\n * that for the rare verb match that is harmless (e.g. a typing indicator's\n * `typing_stop`).\n */\nexport const DESTRUCTIVE_NAME_VERBS = [\n  'delete',\n  'destroy',\n  'erase',\n  'kill',\n  'purge',\n  'remove',\n  'reset',\n  'revoke',\n  'rotate',\n  'stop',\n  'terminate',\n  'uninstall',\n  'wipe',\n] as const;\nconst DESTRUCTIVE_NAME_SEGMENT = new RegExp(\n  `(?:^|_)(?:${DESTRUCTIVE_NAME_VERBS.join('|')})(?:_|$)`,\n  'i',\n);\nconst READ_ONLY_NAME_SEGMENT = /(?:^|_)(?:list|get|search|check|read|count|stats|by_date)(?:_|$)/i;\n\n/** True when a tool name looks destructive (irreversibly deletes data) by naming convention. */\nexport function inferDestructiveHint(toolName: string): boolean {\n  return DESTRUCTIVE_NAME_SEGMENT.test(toolName);\n}\n\n/**\n * True when a tool name looks read-only by naming convention. Never true for\n * a name that also looks destructive (a tool can't be both).\n */\nexport function inferReadOnlyHint(toolName: string): boolean {\n  return !inferDestructiveHint(toolName) && READ_ONLY_NAME_SEGMENT.test(toolName);\n}\n","/**\n * MCP tool result helpers + central handler.\n *\n * Modules NEVER call server.registerTool directly — they use registerTool()\n * from this module so the central try/catch wraps the handler and:\n *   - maps thrown McpUserError / McpAuthError / McpInternalError to\n *     MCP-protocol-compliant `{ isError: true, content: [...] }` shapes\n *   - threads `_meta.progressToken` into ctx.progress for long ops\n *   - emits a structured log line on every error\n *   - never leaks `cause` from McpInternalError to the client\n *\n * This is the analog of cli-sdk's createProgram() central error handler.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { ZodRawShape } from 'zod';\nimport type { McpContext } from './context.js';\nimport { McpAuthError, McpInternalError, McpUserError } from './errors.js';\nimport type { ToolAnnotations } from './tool-governance.js';\n\nexport interface ToolTextContent {\n  type: 'text';\n  text: string;\n  [k: string]: unknown;\n}\n\nexport interface ToolResult {\n  content: ToolTextContent[];\n  isError?: boolean;\n  structuredContent?: Record<string, unknown>;\n  [k: string]: unknown;\n}\n\nexport interface ToolMeta {\n  progressToken?: string | number;\n}\n\n/**\n * Build a successful tool result with JSON content (pretty-printed).\n */\nexport function jsonResult(data: unknown, structured?: Record<string, unknown>): ToolResult {\n  const result: ToolResult = {\n    content: [{ type: 'text', text: JSON.stringify(data, null, 2) }],\n  };\n  if (structured !== undefined) {\n    result.structuredContent = structured;\n  }\n  return result;\n}\n\n/**\n * Build a successful tool result with plain text content.\n */\nexport function textResult(text: string): ToolResult {\n  return { content: [{ type: 'text', text }] };\n}\n\n/**\n * Build an error tool result. Honors MCP's `{ isError: true, content }` shape.\n * Optional hint is appended on a new line so the LLM can react.\n */\nexport function errorResult(message: string, hint?: string): ToolResult {\n  const text = hint ? `${message}\\n\\nHint: ${hint}` : message;\n  return { content: [{ type: 'text', text }], isError: true };\n}\n\nexport interface ToolMetadata {\n  title: string;\n  description: string;\n  inputSchema?: ZodRawShape;\n  /**\n   * Explicit MCP annotations (readOnlyHint / destructiveHint / ...). Optional\n   * — when omitted, `wrapServerWithToolGovernance` (applied centrally in\n   * `createMcpServer`) infers them from the tool name. Set this to override\n   * the inference for a tool whose name doesn't match the naming convention.\n   */\n  annotations?: ToolAnnotations;\n}\n\nexport type ToolHandler<TArgs = Record<string, unknown>> = (\n  args: TArgs,\n  ctx: McpContext,\n  meta: ToolMeta,\n) => Promise<unknown>;\n\n/**\n * Register a tool with the central error wrapper.\n *\n * The handler returns a plain value or void. The wrapper:\n *   - wraps non-undefined returns in jsonResult()\n *   - if the value already looks like a ToolResult (has `content`), passes through\n *   - catches McpAuthError / McpUserError / McpInternalError / generic Error\n *   - logs every error via ctx.logger.error\n */\nexport function registerTool<TArgs extends Record<string, unknown>>(\n  server: McpServer,\n  ctx: McpContext,\n  name: string,\n  metadata: ToolMetadata,\n  handler: ToolHandler<TArgs>,\n): void {\n  const sdkConfig = {\n    title: metadata.title,\n    description: metadata.description,\n    ...(metadata.inputSchema ? { inputSchema: metadata.inputSchema } : {}),\n    ...(metadata.annotations ? { annotations: metadata.annotations } : {}),\n  };\n\n  // The MCP SDK's registerTool signature is `(name, config, handler)`. The\n  // handler arity depends on whether inputSchema is present (1-arg without,\n  // 2-arg with). We accept a unified handler shape and dispatch at runtime.\n  // The SDK's typing is strict and conditional on the inputSchema generic;\n  // bypass with a cast since runtime acceptance is unconditional.\n  const wrapped = async (...callbackArgs: unknown[]): Promise<ToolResult> => {\n    const hasArgs = callbackArgs.length === 2;\n    const args = (hasArgs ? callbackArgs[0] : {}) as TArgs;\n    const extra = (hasArgs ? callbackArgs[1] : callbackArgs[0]) as\n      { _meta?: { progressToken?: string | number } } | undefined;\n\n    const progressToken = extra?._meta?.progressToken;\n    const meta: ToolMeta = progressToken !== undefined ? { progressToken } : {};\n\n    try {\n      const result = await handler(args, ctx, meta);\n      if (isToolResult(result)) return result;\n      if (result === undefined) return textResult('OK');\n      return jsonResult(result);\n    } catch (error) {\n      return mapErrorToResult(error, ctx, name);\n    }\n  };\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  (server as any).registerTool(name, sdkConfig, wrapped);\n}\n\nfunction isToolResult(value: unknown): value is ToolResult {\n  return (\n    !!value &&\n    typeof value === 'object' &&\n    'content' in value &&\n    Array.isArray((value as ToolResult).content)\n  );\n}\n\nfunction mapErrorToResult(error: unknown, ctx: McpContext, toolName: string): ToolResult {\n  if (error instanceof McpAuthError) {\n    ctx.logger.warn(`${toolName}: auth required`, { message: error.message });\n    return errorResult(error.message, error.hint);\n  }\n  if (error instanceof McpUserError) {\n    ctx.logger.info(`${toolName}: user error`, { message: error.message });\n    return errorResult(error.message, error.hint);\n  }\n  if (error instanceof McpInternalError) {\n    ctx.logger.error(`${toolName}: internal error`, {\n      message: error.message,\n      cause: stringifyCause(error.cause),\n    });\n    return errorResult(`Internal error in ${toolName}.`);\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  ctx.logger.error(`${toolName}: unhandled error`, { message });\n  return errorResult(`${toolName}: ${message}`);\n}\n\nfunction stringifyCause(cause: unknown): string | undefined {\n  if (cause === undefined || cause === null) return undefined;\n  if (cause instanceof Error) return cause.message;\n  try {\n    return JSON.stringify(cause);\n  } catch {\n    return String(cause);\n  }\n}\n","import { z } from 'zod';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { errorResult, mcpToolName, type McpContext } from '../../core/index.js';\n\ntype StubInputSchema = Record<string, z.ZodTypeAny>;\nfunction stubbedTool(\n  server: McpServer,\n  toolName: string,\n  title: string,\n  description: string,\n  featureNote: string,\n  inputSchema: StubInputSchema,\n  altSuggestions: string[],\n): void {\n  server.registerTool(\n    toolName,\n    {\n      title,\n      description: `${description} [STUB]`,\n      inputSchema,\n    },\n    async () =>\n      errorResult(\n        `[stubbed] ${featureNote} Use ${altSuggestions.join(', ')} instead. The tool remains registered so callers receive a meaningful response instead of a schema-validation error.`,\n      ),\n  );\n}\n\nexport function registerStoreTools(\n  server: McpServer,\n  ctx: McpContext,\n  track: (n: string) => string,\n): void {\n  // BOFF-8199: `Query.storeProducts` (and the related `searchStore`,\n  // `browseStore`, `myCart`, etc.) are gone from the live alpha gateway.\n  // The closest survivors are `searchProducts`, `featuredProducts`,\n  // `i18nProducts`, `lowStockProducts`, `platformProducts` — a\n  // different domain. Stub all 14 store tools so callers get a clean\n  // \"[stubbed]\" error and the per-call wiring is in place for the day\n  // the store service re-exposes the public surface.\n  const featureNote =\n    'Live alpha removed `Query.storeProducts` and the `searchStore` / `browseStore` / `myCart` family. The closest survivors (`searchProducts` / `featuredProducts`) are a different domain shape.';\n  const alts = [\n    'the next alpha release that restores the public `storeProducts` query',\n    'the SDK store API (which the MCP will mirror once it lands)',\n  ];\n\n  const tools: Array<[string, string, string]> = [\n    ['store_browse', 'Browse Store', 'Browse the marketplace.'],\n    ['store_search', 'Search Store', 'Search the marketplace.'],\n    ['store_get_product', 'Get Product', 'Get a product by ID.'],\n    ['store_cart_list', 'Get My Cart', \"Get the current user's cart.\"],\n    ['store_cart_add', 'Add to Cart', 'Add a product to the cart.'],\n    ['store_cart_remove', 'Remove from Cart', 'Remove a product from the cart.'],\n    ['store_cart_checkout', 'Checkout Cart', 'Complete the cart checkout.'],\n    ['store_cart_clear', 'Clear Cart', 'Clear the cart.'],\n    ['store_orders_list', 'List Orders', 'List orders.'],\n    ['store_orders_get', 'Get Order', 'Get an order by ID.'],\n    ['store_installed_list', 'List Installed Products', 'List installed products.'],\n    ['store_installed_uninstall', 'Uninstall Product', 'Uninstall a product.'],\n    ['store_licenses_list', 'List Licenses', 'List product licenses.'],\n    ['store_publisher_get', 'Get My Publisher', \"Get the caller's publisher profile.\"],\n    [\n      'store_publisher_products',\n      'List My Publisher Products',\n      'List products published by the caller.',\n    ],\n  ];\n  for (const [tool, title, desc] of tools) {\n    stubbedTool(\n      server,\n      track(mcpToolName(ctx.productName, tool)),\n      title,\n      desc,\n      featureNote,\n      {},\n      alts,\n    );\n  }\n}\n","/**\n * Store module — marketplace search/browse, cart, orders, installed apps,\n * licenses. Backend: ~/products/global/store/global-store-svc/.\n * Ported from cli-sdk/src/modules/store/.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { McpContext, McpModule, ModuleRegistration } from '../../core/index.js';\nimport { registerStoreTools } from './tools.js';\n\nconst storeModule: McpModule = {\n  id: 'store',\n  version: '0.0.1',\n  displayName: 'Store',\n  dependsOn: ['auth'],\n  capabilities: { tools: {} },\n\n  register(server: McpServer, ctx: McpContext): ModuleRegistration {\n    const tools: string[] = [];\n    const track = (n: string): string => {\n      tools.push(n);\n      return n;\n    };\n\n    registerStoreTools(server, ctx, track);\n\n    return { tools, resources: [], prompts: [] };\n  },\n};\n\nexport default storeModule;\n"]}
+{"version":3,"sources":["../../../src/core/errors.ts","../../../src/core/tool-name.ts","../../../src/core/result.ts","../../../src/modules/store/tools.ts","../../../src/modules/store/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AA8BO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EACjB,KAAA;AAAA,EAEzB,WAAA,CAAY,SAAiB,KAAA,EAAiB;AAC5C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF,CAAA;;;AC1BA,IAAM,oBAAA,GAAuB,EAAA;AAE7B,SAAS,cAAA,CAAe,MAAc,IAAA,EAA8C;AAClF,EAAA,IAAuB,IAAA,CAAK,MAAA,GAAS,oBAAA,EAAsB;AACzD,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,CAAA,WAAA,EAAc,IAAI,CAAA,UAAA,EAAa,oBAAoB,CAAA,8CAAA;AAAA,KACrD;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,WAAA,CAAY,gBAAwB,KAAA,EAAyB;AAC3E,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,iBAAiB,sCAAsC,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,IAAA,GAAO,CAAC,WAAA,EAAa,GAAG,KAAK,EAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC7D,EAAA,OAAO,cAAA,CAAe,IAAY,CAAA;AACpC;;;AC4BO,SAAS,WAAA,CAAY,SAAiB,IAAA,EAA2B;AACtE,EAAA,MAAM,IAAA,GAAO,IAAA,GAAO,CAAA,EAAG,OAAO;;AAAA,MAAA,EAAa,IAAI,CAAA,CAAA,GAAK,OAAA;AACpD,EAAA,OAAO,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,CAAA,EAAG,OAAA,EAAS,IAAA,EAAK;AAC5D;;;AC3DA,SAAS,YACP,MAAA,EACA,QAAA,EACA,OACA,WAAA,EACA,WAAA,EACA,aACA,cAAA,EACM;AACN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,QAAA;AAAA,IACA;AAAA,MACE,KAAA;AAAA,MACA,WAAA,EAAa,GAAG,WAAW,CAAA,OAAA,CAAA;AAAA,MAC3B;AAAA,KACF;AAAA,IACA,YACE,WAAA;AAAA,MACE,aAAa,WAAW,CAAA,KAAA,EAAQ,cAAA,CAAe,IAAA,CAAK,IAAI,CAAC,CAAA,oHAAA;AAAA;AAC3D,GACJ;AACF;AAEO,SAAS,kBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AAQN,EAAA,MAAM,WAAA,GACJ,+LAAA;AACF,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,uEAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,KAAA,GAAyC;AAAA,IAC7C,CAAC,cAAA,EAAgB,cAAA,EAAgB,yBAAyB,CAAA;AAAA,IAC1D,CAAC,cAAA,EAAgB,cAAA,EAAgB,yBAAyB,CAAA;AAAA,IAC1D,CAAC,mBAAA,EAAqB,aAAA,EAAe,sBAAsB,CAAA;AAAA,IAC3D,CAAC,iBAAA,EAAmB,aAAA,EAAe,8BAA8B,CAAA;AAAA,IACjE,CAAC,gBAAA,EAAkB,aAAA,EAAe,4BAA4B,CAAA;AAAA,IAC9D,CAAC,mBAAA,EAAqB,kBAAA,EAAoB,iCAAiC,CAAA;AAAA,IAC3E,CAAC,qBAAA,EAAuB,eAAA,EAAiB,6BAA6B,CAAA;AAAA,IACtE,CAAC,kBAAA,EAAoB,YAAA,EAAc,iBAAiB,CAAA;AAAA,IACpD,CAAC,mBAAA,EAAqB,aAAA,EAAe,cAAc,CAAA;AAAA,IACnD,CAAC,kBAAA,EAAoB,WAAA,EAAa,qBAAqB,CAAA;AAAA,IACvD,CAAC,sBAAA,EAAwB,yBAAA,EAA2B,0BAA0B,CAAA;AAAA,IAC9E,CAAC,2BAAA,EAA6B,mBAAA,EAAqB,sBAAsB,CAAA;AAAA,IACzE,CAAC,qBAAA,EAAuB,eAAA,EAAiB,wBAAwB,CAAA;AAAA,IACjE,CAAC,qBAAA,EAAuB,kBAAA,EAAoB,qCAAqC,CAAA;AAAA,IACjF;AAAA,MACE,0BAAA;AAAA,MACA,4BAAA;AAAA,MACA;AAAA;AACF,GACF;AACA,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAA,EAAO,IAAI,KAAK,KAAA,EAAO;AACvC,IAAA,WAAA;AAAA,MACE,MAAA;AAAA,MACA,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,IAAI,CAAC,CAAA;AAAA,MACxC,KAAA;AAAA,MACA,IAAA;AAAA,MACA,WAAA;AAAA,MACA,EAAC;AAAA,MACD;AAAA,KACF;AAAA,EACF;AACF;;;ACrEA,IAAM,WAAA,GAAyB;AAAA,EAC7B,EAAA,EAAI,OAAA;AAAA,EACJ,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAa,OAAA;AAAA,EACb,SAAA,EAAW,CAAC,MAAM,CAAA;AAAA,EAClB,YAAA,EAAc,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,EAE1B,QAAA,CAAS,QAAmB,GAAA,EAAqC;AAC/D,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KAAsB;AACnC,MAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AACZ,MAAA,OAAO,CAAA;AAAA,IACT,CAAA;AAEA,IAAA,kBAAA,CAAmB,MAAA,EAAQ,KAAK,KAAK,CAAA;AAErC,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,EAAC,EAAG,OAAA,EAAS,EAAC,EAAE;AAAA,EAC7C;AACF,CAAA;AAEA,IAAO,aAAA,GAAQ","file":"index.cjs","sourcesContent":["/**\n * Error classes for MCP SDK.\n *\n * Modules MUST throw these instead of throwing raw Errors. The registerTool\n * wrapper in result.ts catches and maps them to MCP-protocol-compliant\n * `{ isError: true, content: [...] }` responses.\n *\n * Throwing past the wrapper to the protocol surfaces as JSON-RPC -32603 to\n * the client and is a protocol bug.\n */\n\nexport class McpUserError extends Error {\n  public readonly hint: string | undefined;\n\n  constructor(message: string, opts?: { hint?: string }) {\n    super(message);\n    this.name = 'McpUserError';\n    this.hint = opts?.hint;\n  }\n}\n\nexport class McpAuthError extends McpUserError {\n  constructor(message: string, opts?: { hint?: string }) {\n    super(message, {\n      hint: opts?.hint ?? 'Run the auth_login tool to authenticate.',\n    });\n    this.name = 'McpAuthError';\n  }\n}\n\nexport class McpInternalError extends Error {\n  public override readonly cause: unknown;\n\n  constructor(message: string, cause?: unknown) {\n    super(message);\n    this.name = 'McpInternalError';\n    this.cause = cause;\n  }\n}\n","/**\n * Tool / resource / prompt naming helpers.\n *\n * Mandatory product prefix avoids collisions when Claude Desktop runs\n * multiple MCP servers concurrently (typical setup is ~6).\n *\n * Tool names are capped at 63 characters — Claude Desktop pre-1.x\n * truncated at 64 in some versions.\n */\n\nimport { McpInternalError } from './errors.js';\n\nconst MAX_TOOL_NAME_LENGTH = 63;\n\nfunction assertSafeName(name: string, kind: 'tool' | 'resource' | 'prompt'): string {\n  if (kind === 'tool' && name.length > MAX_TOOL_NAME_LENGTH) {\n    throw new McpInternalError(\n      `Tool name '${name}' exceeds ${MAX_TOOL_NAME_LENGTH} characters (some MCP clients truncate at 64).`,\n    );\n  }\n  return name;\n}\n\n/**\n * Build a tool name. Format: `<productName>_<...parts>` (snake_case).\n * Example: mcpToolName('vibecontrols', 'vibes', 'list') -> 'vibecontrols_vibes_list'\n */\nexport function mcpToolName(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpToolName: productName is required');\n  }\n  const name = [productName, ...parts].filter(Boolean).join('_');\n  return assertSafeName(name, 'tool');\n}\n\n/**\n * Build a resource URI. Format: `<productName>://<...parts>`.\n * Example: mcpResourceUri('vibecontrols', 'schema') -> 'vibecontrols://schema'\n */\nexport function mcpResourceUri(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpResourceUri: productName is required');\n  }\n  return `${productName}://${parts.filter(Boolean).join('/')}`;\n}\n\n/**\n * Build a prompt name. Format: `<productName>-<...parts>` (kebab-case).\n * Example: mcpPromptName('vibecontrols', 'setup') -> 'vibecontrols-setup'\n */\nexport function mcpPromptName(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpPromptName: productName is required');\n  }\n  return [productName, ...parts].filter(Boolean).join('-');\n}\n\nexport const TOOL_NAME_LIMIT = MAX_TOOL_NAME_LENGTH;\n\n/**\n * Name-based hint heuristics for MCP `annotations` (readOnlyHint /\n * destructiveHint). Used by tool-governance.ts to auto-fill annotations for\n * the fleet of product modules that call `server.registerTool` directly\n * (bypassing the `registerTool()` core helper) and so never set them\n * explicitly today (BOFF-3903). Deliberately conservative — matched against\n * whole `_`-delimited segments so e.g. `timeentries_delete` and\n * `pomodoro_delete_goal` match, but a hypothetical `undeletable_check`\n * would not.\n *\n * The destructive verb set covers more than `delete`: stopping, killing or\n * terminating a running process, revoking or rotating a credential/share,\n * resetting settings and removing/purging/uninstalling are all actions an\n * MCP client must not auto-run without the user's intent (VC/FG parity G57 —\n * e.g. `vibecontrols_sessions_kill`, `vibecontrols_tunnels_rotate_credentials`\n * were previously reported as non-destructive).\n *\n * A module can always override the inference by passing an explicit\n * `annotations` object to `registerTool()` / `server.registerTool()` — do\n * that for the rare verb match that is harmless (e.g. a typing indicator's\n * `typing_stop`).\n */\nexport const DESTRUCTIVE_NAME_VERBS = [\n  'delete',\n  'destroy',\n  'erase',\n  'kill',\n  'purge',\n  'remove',\n  'reset',\n  'revoke',\n  'rotate',\n  'stop',\n  'terminate',\n  'uninstall',\n  'wipe',\n] as const;\nconst DESTRUCTIVE_NAME_SEGMENT = new RegExp(\n  `(?:^|_)(?:${DESTRUCTIVE_NAME_VERBS.join('|')})(?:_|$)`,\n  'i',\n);\nconst READ_ONLY_NAME_SEGMENT = /(?:^|_)(?:list|get|search|check|read|count|stats|by_date)(?:_|$)/i;\n\n/** True when a tool name looks destructive (irreversibly deletes data) by naming convention. */\nexport function inferDestructiveHint(toolName: string): boolean {\n  return DESTRUCTIVE_NAME_SEGMENT.test(toolName);\n}\n\n/**\n * True when a tool name looks read-only by naming convention. Never true for\n * a name that also looks destructive (a tool can't be both).\n */\nexport function inferReadOnlyHint(toolName: string): boolean {\n  return !inferDestructiveHint(toolName) && READ_ONLY_NAME_SEGMENT.test(toolName);\n}\n","/**\n * MCP tool result helpers + central handler.\n *\n * Modules NEVER call server.registerTool directly — they use registerTool()\n * from this module so the central try/catch wraps the handler and:\n *   - maps thrown McpUserError / McpAuthError / McpInternalError to\n *     MCP-protocol-compliant `{ isError: true, content: [...] }` shapes\n *   - threads `_meta.progressToken` into ctx.progress for long ops\n *   - emits a structured log line on every error\n *   - never leaks `cause` from McpInternalError to the client\n *\n * This is the analog of cli-sdk's createProgram() central error handler.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { ZodRawShape } from 'zod';\nimport type { McpContext } from './context.js';\nimport { McpAuthError, McpInternalError, McpUserError } from './errors.js';\nimport type { ToolAnnotations } from './tool-governance.js';\n\nexport interface ToolTextContent {\n  type: 'text';\n  text: string;\n  [k: string]: unknown;\n}\n\nexport interface ToolResult {\n  content: ToolTextContent[];\n  isError?: boolean;\n  structuredContent?: Record<string, unknown>;\n  [k: string]: unknown;\n}\n\nexport interface ToolMeta {\n  progressToken?: string | number;\n}\n\n/**\n * Build a successful tool result with JSON content (pretty-printed).\n */\nexport function jsonResult(data: unknown, structured?: Record<string, unknown>): ToolResult {\n  const result: ToolResult = {\n    content: [{ type: 'text', text: JSON.stringify(data, null, 2) }],\n  };\n  if (structured !== undefined) {\n    result.structuredContent = structured;\n  }\n  return result;\n}\n\n/**\n * Build a successful tool result with plain text content.\n */\nexport function textResult(text: string): ToolResult {\n  return { content: [{ type: 'text', text }] };\n}\n\n/**\n * Build an error tool result. Honors MCP's `{ isError: true, content }` shape.\n * Optional hint is appended on a new line so the LLM can react.\n */\nexport function errorResult(message: string, hint?: string): ToolResult {\n  const text = hint ? `${message}\\n\\nHint: ${hint}` : message;\n  return { content: [{ type: 'text', text }], isError: true };\n}\n\nexport interface ToolMetadata {\n  title: string;\n  description: string;\n  inputSchema?: ZodRawShape;\n  /**\n   * Explicit MCP annotations (readOnlyHint / destructiveHint / ...). Optional\n   * — when omitted, `wrapServerWithToolGovernance` (applied centrally in\n   * `createMcpServer`) infers them from the tool name. Set this to override\n   * the inference for a tool whose name doesn't match the naming convention.\n   */\n  annotations?: ToolAnnotations;\n}\n\nexport type ToolHandler<TArgs = Record<string, unknown>> = (\n  args: TArgs,\n  ctx: McpContext,\n  meta: ToolMeta,\n) => Promise<unknown>;\n\n/**\n * Register a tool with the central error wrapper.\n *\n * The handler returns a plain value or void. The wrapper:\n *   - wraps non-undefined returns in jsonResult()\n *   - if the value already looks like a ToolResult (has `content`), passes through\n *   - catches McpAuthError / McpUserError / McpInternalError / generic Error\n *   - logs every error via ctx.logger.error\n */\nexport function registerTool<TArgs extends Record<string, unknown>>(\n  server: McpServer,\n  ctx: McpContext,\n  name: string,\n  metadata: ToolMetadata,\n  handler: ToolHandler<TArgs>,\n): void {\n  const sdkConfig = {\n    title: metadata.title,\n    description: metadata.description,\n    ...(metadata.inputSchema ? { inputSchema: metadata.inputSchema } : {}),\n    ...(metadata.annotations ? { annotations: metadata.annotations } : {}),\n  };\n\n  // The MCP SDK's registerTool signature is `(name, config, handler)`. The\n  // handler arity depends on whether inputSchema is present (1-arg without,\n  // 2-arg with). We accept a unified handler shape and dispatch at runtime.\n  // The SDK's typing is strict and conditional on the inputSchema generic;\n  // bypass with a cast since runtime acceptance is unconditional.\n  const wrapped = async (...callbackArgs: unknown[]): Promise<ToolResult> => {\n    const hasArgs = callbackArgs.length === 2;\n    const args = (hasArgs ? callbackArgs[0] : {}) as TArgs;\n    const extra = (hasArgs ? callbackArgs[1] : callbackArgs[0]) as\n      { _meta?: { progressToken?: string | number } } | undefined;\n\n    const progressToken = extra?._meta?.progressToken;\n    const meta: ToolMeta = progressToken !== undefined ? { progressToken } : {};\n\n    try {\n      const result = await handler(args, ctx, meta);\n      if (isToolResult(result)) return result;\n      if (result === undefined) return textResult('OK');\n      return jsonResult(result);\n    } catch (error) {\n      return mapErrorToResult(error, ctx, name);\n    }\n  };\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  (server as any).registerTool(name, sdkConfig, wrapped);\n}\n\nfunction isToolResult(value: unknown): value is ToolResult {\n  return (\n    !!value &&\n    typeof value === 'object' &&\n    'content' in value &&\n    Array.isArray((value as ToolResult).content)\n  );\n}\n\nfunction mapErrorToResult(error: unknown, ctx: McpContext, toolName: string): ToolResult {\n  if (error instanceof McpAuthError) {\n    ctx.logger.warn(`${toolName}: auth required`, { message: error.message });\n    return errorResult(error.message, error.hint);\n  }\n  if (error instanceof McpUserError) {\n    ctx.logger.info(`${toolName}: user error`, { message: error.message });\n    return errorResult(error.message, error.hint);\n  }\n  if (error instanceof McpInternalError) {\n    ctx.logger.error(`${toolName}: internal error`, {\n      message: error.message,\n      cause: stringifyCause(error.cause),\n    });\n    return errorResult(`Internal error in ${toolName}.`);\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  ctx.logger.error(`${toolName}: unhandled error`, { message });\n  return errorResult(`${toolName}: ${message}`);\n}\n\nfunction stringifyCause(cause: unknown): string | undefined {\n  if (cause === undefined || cause === null) return undefined;\n  if (cause instanceof Error) return cause.message;\n  try {\n    return JSON.stringify(cause);\n  } catch {\n    return String(cause);\n  }\n}\n","import { z } from 'zod';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { errorResult, mcpToolName, type McpContext } from '../../core/index.js';\n\ntype StubInputSchema = Record<string, z.ZodTypeAny>;\nfunction stubbedTool(\n  server: McpServer,\n  toolName: string,\n  title: string,\n  description: string,\n  featureNote: string,\n  inputSchema: StubInputSchema,\n  altSuggestions: string[],\n): void {\n  server.registerTool(\n    toolName,\n    {\n      title,\n      description: `${description} [STUB]`,\n      inputSchema,\n    },\n    async () =>\n      errorResult(\n        `[stubbed] ${featureNote} Use ${altSuggestions.join(', ')} instead. The tool remains registered so callers receive a meaningful response instead of a schema-validation error.`,\n      ),\n  );\n}\n\nexport function registerStoreTools(\n  server: McpServer,\n  ctx: McpContext,\n  track: (n: string) => string,\n): void {\n  // BOFF-8199: `Query.storeProducts` (and the related `searchStore`,\n  // `browseStore`, `myCart`, etc.) are gone from the live alpha gateway.\n  // The closest survivors are `searchProducts`, `featuredProducts`,\n  // `i18nProducts`, `lowStockProducts`, `platformProducts` — a\n  // different domain. Stub all 14 store tools so callers get a clean\n  // \"[stubbed]\" error and the per-call wiring is in place for the day\n  // the store service re-exposes the public surface.\n  const featureNote =\n    'Live alpha removed `Query.storeProducts` and the `searchStore` / `browseStore` / `myCart` family. The closest survivors (`searchProducts` / `featuredProducts`) are a different domain shape.';\n  const alts = [\n    'the next alpha release that restores the public `storeProducts` query',\n    'the SDK store API (which the MCP will mirror once it lands)',\n  ];\n\n  const tools: Array<[string, string, string]> = [\n    ['store_browse', 'Browse Store', 'Browse the marketplace.'],\n    ['store_search', 'Search Store', 'Search the marketplace.'],\n    ['store_get_product', 'Get Product', 'Get a product by ID.'],\n    ['store_cart_list', 'Get My Cart', \"Get the current user's cart.\"],\n    ['store_cart_add', 'Add to Cart', 'Add a product to the cart.'],\n    ['store_cart_remove', 'Remove from Cart', 'Remove a product from the cart.'],\n    ['store_cart_checkout', 'Checkout Cart', 'Complete the cart checkout.'],\n    ['store_cart_clear', 'Clear Cart', 'Clear the cart.'],\n    ['store_orders_list', 'List Orders', 'List orders.'],\n    ['store_orders_get', 'Get Order', 'Get an order by ID.'],\n    ['store_installed_list', 'List Installed Products', 'List installed products.'],\n    ['store_installed_uninstall', 'Uninstall Product', 'Uninstall a product.'],\n    ['store_licenses_list', 'List Licenses', 'List product licenses.'],\n    ['store_publisher_get', 'Get My Publisher', \"Get the caller's publisher profile.\"],\n    [\n      'store_publisher_products',\n      'List My Publisher Products',\n      'List products published by the caller.',\n    ],\n  ];\n  for (const [tool, title, desc] of tools) {\n    stubbedTool(\n      server,\n      track(mcpToolName(ctx.productName, tool)),\n      title,\n      desc,\n      featureNote,\n      {},\n      alts,\n    );\n  }\n}\n","/**\n * Store module — marketplace search/browse, cart, orders, installed apps,\n * licenses. Backend: ~/products/global/store/global-store-svc/.\n * Ported from cli-sdk/src/modules/store/.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { McpContext, McpModule, ModuleRegistration } from '../../core/index.js';\nimport { registerStoreTools } from './tools.js';\n\nconst storeModule: McpModule = {\n  id: 'store',\n  version: '0.0.1',\n  displayName: 'Store',\n  dependsOn: ['auth'],\n  capabilities: { tools: {} },\n\n  register(server: McpServer, ctx: McpContext): ModuleRegistration {\n    const tools: string[] = [];\n    const track = (n: string): string => {\n      tools.push(n);\n      return n;\n    };\n\n    registerStoreTools(server, ctx, track);\n\n    return { tools, resources: [], prompts: [] };\n  },\n};\n\nexport default storeModule;\n"]}

package/dist/modules/store/index.js

@@ -1,4 +1,4 @@
-import { mcpToolName, errorResult } from '../../chunk-FHXCNP2U.js';
+import { mcpToolName, errorResult } from '../../chunk-J74ZKEXL.js';
 
 // src/modules/store/tools.ts
 function stubbedTool(server, toolName, title, description, featureNote, inputSchema, altSuggestions) {

package/dist/modules/subscriberbot/index.cjs

@@ -4,6 +4,7 @@ require('graphql-request');
 require('cross-fetch');
 require('@modelcontextprotocol/sdk/server/mcp.js');
 require('@modelcontextprotocol/sdk/types.js');
+require('crypto');
 var zod = require('zod');
 
 // src/core/auth/store.ts