@burdenoff/mcp-libs 2026.703.3 → 2026.719.1

package/dist/modules/proserviceworld/index.js

@@ -1,4 +1,4 @@
-import { mcpToolName, errorResult, jsonResult, mcpResourceUri, mcpPromptName } from '../../chunk-H2OYWLOA.js';
+import { mcpToolName, errorResult, jsonResult, mcpResourceUri, mcpPromptName } from '../../chunk-YOSQUY3M.js';
 import { z } from 'zod';
 
 // src/modules/proserviceworld/operations.ts

package/dist/modules/rbac/index.cjs

@@ -18,20 +18,6 @@ var McpInternalError = class extends Error {
   }
 };
 
-// src/core/result.ts
-function jsonResult(data, structured) {
-  const result = {
-    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
-  };
-  return result;
-}
-function errorResult(message, hint) {
-  const text = hint ? `${message}
-
-Hint: ${hint}` : message;
-  return { content: [{ type: "text", text }], isError: true };
-}
-
 // src/core/tool-name.ts
 var MAX_TOOL_NAME_LENGTH = 63;
 function assertSafeName(name, kind) {
@@ -50,6 +36,20 @@ function mcpToolName(productName, ...parts) {
   return assertSafeName(name);
 }
 
+// src/core/result.ts
+function jsonResult(data, structured) {
+  const result = {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+  return result;
+}
+function errorResult(message, hint) {
+  const text = hint ? `${message}
+
+Hint: ${hint}` : message;
+  return { content: [{ type: "text", text }], isError: true };
+}
+
 // src/modules/rbac/operations.ts
 var LIST_ROLES = `
   query ListRoles($filter: RoleFilterInput, $pagination: PaginationInput, $scopeId: String!) {

package/dist/modules/rbac/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/core/errors.ts","../../../src/core/result.ts","../../../src/core/tool-name.ts","../../../src/modules/rbac/operations.ts","../../../src/modules/rbac/tools.ts","../../../src/modules/rbac/index.ts"],"names":["z"],"mappings":";;;;;;;;;;;AA8BO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EACjB,KAAA;AAAA,EAEzB,WAAA,CAAY,SAAiB,KAAA,EAAiB;AAC5C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF,CAAA;;;ACCO,SAAS,UAAA,CAAW,MAAe,UAAA,EAAkD;AAC1F,EAAA,MAAM,MAAA,GAAqB;AAAA,IACzB,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG;AAAA,GACjE;AAIA,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,WAAA,CAAY,SAAiB,IAAA,EAA2B;AACtE,EAAA,MAAM,IAAA,GAAO,IAAA,GAAO,CAAA,EAAG,OAAO;;AAAA,MAAA,EAAa,IAAI,CAAA,CAAA,GAAK,OAAA;AACpD,EAAA,OAAO,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,CAAA,EAAG,OAAA,EAAS,IAAA,EAAK;AAC5D;;;ACnDA,IAAM,oBAAA,GAAuB,EAAA;AAE7B,SAAS,cAAA,CAAe,MAAc,IAAA,EAA8C;AAClF,EAAA,IAAuB,IAAA,CAAK,MAAA,GAAS,oBAAA,EAAsB;AACzD,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,CAAA,WAAA,EAAc,IAAI,CAAA,UAAA,EAAa,oBAAoB,CAAA,8CAAA;AAAA,KACrD;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,WAAA,CAAY,gBAAwB,KAAA,EAAyB;AAC3E,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,iBAAiB,sCAAsC,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,IAAA,GAAO,CAAC,WAAA,EAAa,GAAG,KAAK,EAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC7D,EAAA,OAAO,cAAA,CAAe,IAAY,CAAA;AACpC;;;ACjCO,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiBnB,IAAM,QAAA,GAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiBjB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWpB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWpB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA,CAAA;AAMpB,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAYzB,IAAM,sBAAA,GAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiB/B,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAYtB,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA,CAAA;;;ACxF7B,IAAM,YAAYA,KAAA,CAAE,IAAA,CAAK,CAAC,WAAA,EAAa,QAAQ,CAAC,CAAA;AAChD,IAAM,aAAA,GAAgBA,MAAE,IAAA,CAAK,CAAC,QAAQ,KAAA,EAAO,OAAA,EAAS,aAAA,EAAe,iBAAiB,CAAC,CAAA;AAIvF,SAAS,cAAA,CAAe,KAAiB,KAAA,EAAc;AACrD,EAAA,OAAO,UAAU,WAAA,GAAc,GAAA,CAAI,GAAA,CAAI,SAAA,GAAY,IAAI,GAAA,CAAI,MAAA;AAC7D;AAEA,SAAS,cAAA,CAAe,KAAiB,KAAA,EAA6B;AACpE,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI,KAAA,KAAU,WAAA,EAAa,OAAO,IAAA,CAAK,WAAA,IAAe,IAAA;AACtD,EAAA,OAAO,KAAK,cAAA,IAAkB,IAAA;AAChC;AAEO,SAAS,iBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AACN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,YAAA;AAAA,MACP,WAAA,EAAa,kDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C,CAAA;AAAA,QAC/E,SAASA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,yCAAyC,CAAA;AAAA,QACjF,eAAeA,KAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,sBAAsB,CAAA;AAAA,QACrE,OAAOA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,WAAW;AAAA;AACnD,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,OAAA,EAAS,aAAA,EAAe,OAAM,KAAM;AAClD,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,aAAA,GAAgB,OAAA,IAAW,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA;AAChE,QAAA,IAAI,CAAC,aAAA,EAAe;AAClB,UAAA,OAAO,WAAA;AAAA,YACL,MAAM,WAAW,CAAA,iEAAA;AAAA,WACnB;AAAA,QACF;AACA,QAAA,MAAM,SAAkC,EAAC;AACzC,QAAA,IAAI,aAAA,SAAsB,aAAA,GAAgB,IAAA;AAC1C,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,UAAA;AAAA,UACA;AAAA,YACE,QAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,SAAS,MAAA,GAAS,KAAA,CAAA;AAAA,YAC9C,YAAY,EAAE,KAAA,EAAO,KAAA,IAAS,GAAA,EAAK,QAAQ,CAAA,EAAE;AAAA,YAC7C,OAAA,EAAS;AAAA;AACX,SACF;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,KAAK,CAAA;AAAA,MAC9B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,wBAAA,EAA0B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACnE,QAAA,OAAO,WAAA;AAAA,UACL,yBAAyB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACjF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,gBAAgB,CAAC,CAAA;AAAA,IACpD;AAAA,MACE,KAAA,EAAO,UAAA;AAAA,MACP,WAAA,EAAa,sDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAIA,KAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACjC,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAM,KAAM;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,QAAA;AAAA,UACA,EAAE,EAAA;AAAG,SACP;AACA,QAAA,IAAI,CAAC,IAAA,CAAK,IAAA,SAAa,WAAA,CAAY,CAAA,KAAA,EAAQ,EAAE,CAAA,UAAA,CAAY,CAAA;AACzD,QAAA,OAAO,UAAA,CAAW,KAAK,IAAI,CAAA;AAAA,MAC7B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,uBAAA,EAAyB,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAClE,QAAA,OAAO,WAAA;AAAA,UACL,uBAAuB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC/E;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAAA,IACvD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,0DAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,IAAA,EAAMA,KAAA,CAAE,MAAA,EAAO,CAAE,SAAS,WAAW,CAAA;AAAA,QACrC,aAAaA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,kBAAkB,CAAA;AAAA,QAC9D,UAAUA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,gBAAgB,CAAA;AAAA,QACzD,UAAUA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,UAAU,CAAA;AAAA,QACnD,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C,CAAA;AAAA,QAC/E,SAASA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,mBAAmB,CAAA;AAAA,QAC3D,WAAWA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,mCAAmC;AAAA;AAC/E,KACF;AAAA,IACA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,UAAU,QAAA,EAAU,KAAA,EAAO,OAAA,EAAS,SAAA,EAAU,KAAM;AAC9E,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,aAAA,GAAgB,OAAA,IAAW,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA;AAChE,QAAA,IAAI,CAAC,aAAA,EAAe;AAClB,UAAA,OAAO,WAAA;AAAA,YACL,MAAM,WAAW,CAAA,iEAAA;AAAA,WACnB;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAiC,EAAE,IAAA,EAAM,OAAA,EAAS,aAAA,EAAc;AACtE,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,WAAA,KAAgB,QAAA,IAAY,SAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAC7D,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,WAAA;AAAA,UACA,EAAE,KAAA;AAAM,SACV;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,UAAU,CAAA;AAAA,MACnC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,0BAAA,EAA4B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACrE,QAAA,OAAO,WAAA;AAAA,UACL,0BAA0B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAClF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAAA,IACvD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,0BAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAIA,KAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACjC,MAAMA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,cAAc,CAAA;AAAA,QACnD,aAAaA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qBAAqB,CAAA;AAAA,QACjE,UAAUA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,kBAAkB,CAAA;AAAA,QAC3D,UAAUA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wBAAwB,CAAA;AAAA,QACjE,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,aAAa,QAAA,EAAU,QAAA,EAAU,OAAM,KAAM;AAC9D,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,QAAiC,EAAC;AACxC,QAAA,IAAI,IAAA,KAAS,KAAA,CAAA,EAAW,KAAA,CAAM,IAAA,GAAO,IAAA;AACrC,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,KAAK,EAAE,MAAA,EAAQ;AAC9B,UAAA,OAAO,YAAY,sBAAsB,CAAA;AAAA,QAC3C;AACA,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,WAAA;AAAA,UACA,EAAE,IAAI,KAAA;AAAM,SACd;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,UAAU,CAAA;AAAA,MACnC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,0BAAA,EAA4B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACrE,QAAA,OAAO,WAAA;AAAA,UACL,0BAA0B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAClF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAAA,IACvD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAIA,KAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACjC,kBAAkBA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,8BAA8B,CAAA;AAAA,QAC/E,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,gBAAA,EAAkB,OAAM,KAAM;AACzC,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,WAAA;AAAA,UACA,EAAE,IAAI,gBAAA;AAAiB,SACzB;AACA,QAAA,OAAO,WAAW,EAAE,OAAA,EAAS,KAAK,UAAA,EAAY,MAAA,EAAQ,IAAI,CAAA;AAAA,MAC5D,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,0BAAA,EAA4B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACrE,QAAA,OAAO,WAAA;AAAA,UACL,0BAA0B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAClF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAGA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oBAAoB,CAAC,CAAA;AAAA,IACxD;AAAA,MACE,KAAA,EAAO,wBAAA;AAAA,MACP,WAAA,EACE,8KAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C,CAAA;AAAA,QAC/E,cAAcA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wCAAwC,CAAA;AAAA,QACrF,QAAQA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,2CAA2C,CAAA;AAAA,QAClF,UAAUA,KAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,+BAA+B,CAAA;AAAA,QACzE,KAAA,EAAOA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,yBAAyB,CAAA;AAAA,QACrE,MAAA,EAAQA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,+BAA+B;AAAA;AAC9E,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,YAAA,EAAc,QAAQ,QAAA,EAAU,KAAA,EAAO,QAAO,KAAM;AAClE,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,SAAkC,EAAC;AACzC,QAAA,IAAI,YAAA,KAAiB,KAAA,CAAA,EAAW,MAAA,CAAO,YAAA,GAAe,YAAA;AACtD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,MAAA,CAAO,MAAA,GAAS,MAAA;AAC1C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,MAAA,CAAO,QAAA,GAAW,QAAA;AAC9C,QAAA,MAAM,OAAO,MAAM,cAAA,CAAe,KAAK,WAAW,CAAA,CAAE,QAEjD,sBAAA,EAAwB;AAAA,UACzB,QAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,SAAS,MAAA,GAAS,KAAA,CAAA;AAAA,UAC9C,YAAY,EAAE,KAAA,EAAO,SAAS,GAAA,EAAK,MAAA,EAAQ,UAAU,CAAA;AAAE,SACxD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW,KAAK,gBAAgB,CAAA;AAAA,MACzC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,2BAAA,EAA6B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACtE,QAAA,OAAO,WAAA;AAAA,UACL,qCAAqC,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC7F;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,uBAAA;AAAA,MACP,WAAA,EACE,uGAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,MAAA,EAAQA,KAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACrC,QAAA,EAAUA,KAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAClD,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,OAAM,KAAM;AACrC,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA,CAEjD,aAAA,EAAe,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACtC,QAAA,OAAO,UAAA,CAAW,KAAK,kBAAkB,CAAA;AAAA,MAC3C,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,6BAAA,EAA+B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxE,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,yBAAA;AAAA,MACP,WAAA,EACE,oHAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,MAAA,EAAQA,KAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACrC,QAAA,EAAUA,KAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAClD,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,OAAM,KAAM;AACrC,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA,CAEjD,aAAA,EAAe,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACtC,QAAA,OAAO,WAAW,EAAE,QAAA,EAAU,KAAK,oBAAA,EAAsB,MAAA,EAAQ,UAAU,CAAA;AAAA,MAC7E,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,6BAAA,EAA+B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxE,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,YAAY,CAAC,CAAA;AAAA,IAChD;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EAAa,oEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAA,EAASA,KAAA,CAAE,MAAA,EAAO,CAAE,SAAS,yCAAyC,CAAA;AAAA,QACtE,MAAA,EAAQA,KAAA,CAAE,MAAA,EAAO,CAAE,SAAS,+BAA+B,CAAA;AAAA,QAC3D,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,SAAS,iCAAiC,CAAA;AAAA,QACnE,SAAA,EAAW,aAAA,CAAc,QAAA,EAAS,CAAE,SAAS,4BAA4B,CAAA;AAAA,QACzE,YAAYA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,iCAAiC,CAAA;AAAA,QAC5E,SAASA,KAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,oCAAoC,CAAA;AAAA,QAC5E,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,cAAc,SAAA,EAAW,UAAA,EAAY,OAAA,EAAS,KAAA,EAAM,KAAM;AAClF,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,aAAA,GAAgB,OAAA,IAAW,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA;AAChE,QAAA,IAAI,CAAC,aAAA,EAAe;AAClB,UAAA,OAAO,WAAA;AAAA,YACL,MAAM,WAAW,CAAA,iEAAA;AAAA,WACnB;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAiC;AAAA,UACrC,OAAA;AAAA,UACA,WAAW,SAAA,IAAa,MAAA;AAAA,UACxB,MAAA;AAAA,UACA,YAAA;AAAA,UACA,OAAA,EAAS;AAAA,SACX;AACA,QAAA,IAAI,UAAA,KAAe,KAAA,CAAA,EAAW,KAAA,CAAM,UAAA,GAAa,UAAA;AACjD,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,gBAAA;AAAA,UACA,EAAE,KAAA;AAAM,SACV;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,eAAe,CAAA;AAAA,MACxC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,mBAAA,EAAqB,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAC9D,QAAA,OAAO,WAAA;AAAA,UACL,+BAA+B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACvF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AACF;;;ACrVA,IAAM,UAAA,GAAwB;AAAA,EAC5B,EAAA,EAAI,MAAA;AAAA,EACJ,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAa,MAAA;AAAA,EACb,SAAA,EAAW,CAAC,MAAM,CAAA;AAAA,EAClB,YAAA,EAAc,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,EAE1B,QAAA,CAAS,QAAmB,GAAA,EAAqC;AAC/D,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KAAsB;AACnC,MAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AACZ,MAAA,OAAO,CAAA;AAAA,IACT,CAAA;AAEA,IAAA,iBAAA,CAAkB,MAAA,EAAQ,KAAK,KAAK,CAAA;AAEpC,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,EAAC,EAAG,OAAA,EAAS,EAAC,EAAE;AAAA,EAC7C;AACF,CAAA;AAEA,IAAO,YAAA,GAAQ","file":"index.cjs","sourcesContent":["/**\n * Error classes for MCP SDK.\n *\n * Modules MUST throw these instead of throwing raw Errors. The registerTool\n * wrapper in result.ts catches and maps them to MCP-protocol-compliant\n * `{ isError: true, content: [...] }` responses.\n *\n * Throwing past the wrapper to the protocol surfaces as JSON-RPC -32603 to\n * the client and is a protocol bug.\n */\n\nexport class McpUserError extends Error {\n  public readonly hint: string | undefined;\n\n  constructor(message: string, opts?: { hint?: string }) {\n    super(message);\n    this.name = 'McpUserError';\n    this.hint = opts?.hint;\n  }\n}\n\nexport class McpAuthError extends McpUserError {\n  constructor(message: string, opts?: { hint?: string }) {\n    super(message, {\n      hint: opts?.hint ?? 'Run the auth_login tool to authenticate.',\n    });\n    this.name = 'McpAuthError';\n  }\n}\n\nexport class McpInternalError extends Error {\n  public override readonly cause: unknown;\n\n  constructor(message: string, cause?: unknown) {\n    super(message);\n    this.name = 'McpInternalError';\n    this.cause = cause;\n  }\n}\n","/**\n * MCP tool result helpers + central handler.\n *\n * Modules NEVER call server.registerTool directly — they use registerTool()\n * from this module so the central try/catch wraps the handler and:\n *   - maps thrown McpUserError / McpAuthError / McpInternalError to\n *     MCP-protocol-compliant `{ isError: true, content: [...] }` shapes\n *   - threads `_meta.progressToken` into ctx.progress for long ops\n *   - emits a structured log line on every error\n *   - never leaks `cause` from McpInternalError to the client\n *\n * This is the analog of cli-sdk's createProgram() central error handler.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { ZodRawShape } from 'zod';\nimport type { McpContext } from './context.js';\nimport { McpAuthError, McpInternalError, McpUserError } from './errors.js';\n\nexport interface ToolTextContent {\n  type: 'text';\n  text: string;\n  [k: string]: unknown;\n}\n\nexport interface ToolResult {\n  content: ToolTextContent[];\n  isError?: boolean;\n  structuredContent?: Record<string, unknown>;\n  [k: string]: unknown;\n}\n\nexport interface ToolMeta {\n  progressToken?: string | number;\n}\n\n/**\n * Build a successful tool result with JSON content (pretty-printed).\n */\nexport function jsonResult(data: unknown, structured?: Record<string, unknown>): ToolResult {\n  const result: ToolResult = {\n    content: [{ type: 'text', text: JSON.stringify(data, null, 2) }],\n  };\n  if (structured !== undefined) {\n    result.structuredContent = structured;\n  }\n  return result;\n}\n\n/**\n * Build a successful tool result with plain text content.\n */\nexport function textResult(text: string): ToolResult {\n  return { content: [{ type: 'text', text }] };\n}\n\n/**\n * Build an error tool result. Honors MCP's `{ isError: true, content }` shape.\n * Optional hint is appended on a new line so the LLM can react.\n */\nexport function errorResult(message: string, hint?: string): ToolResult {\n  const text = hint ? `${message}\\n\\nHint: ${hint}` : message;\n  return { content: [{ type: 'text', text }], isError: true };\n}\n\nexport interface ToolMetadata {\n  title: string;\n  description: string;\n  inputSchema?: ZodRawShape;\n}\n\nexport type ToolHandler<TArgs = Record<string, unknown>> = (\n  args: TArgs,\n  ctx: McpContext,\n  meta: ToolMeta,\n) => Promise<unknown>;\n\n/**\n * Register a tool with the central error wrapper.\n *\n * The handler returns a plain value or void. The wrapper:\n *   - wraps non-undefined returns in jsonResult()\n *   - if the value already looks like a ToolResult (has `content`), passes through\n *   - catches McpAuthError / McpUserError / McpInternalError / generic Error\n *   - logs every error via ctx.logger.error\n */\nexport function registerTool<TArgs extends Record<string, unknown>>(\n  server: McpServer,\n  ctx: McpContext,\n  name: string,\n  metadata: ToolMetadata,\n  handler: ToolHandler<TArgs>,\n): void {\n  const sdkConfig = {\n    title: metadata.title,\n    description: metadata.description,\n    ...(metadata.inputSchema ? { inputSchema: metadata.inputSchema } : {}),\n  };\n\n  // The MCP SDK's registerTool signature is `(name, config, handler)`. The\n  // handler arity depends on whether inputSchema is present (1-arg without,\n  // 2-arg with). We accept a unified handler shape and dispatch at runtime.\n  // The SDK's typing is strict and conditional on the inputSchema generic;\n  // bypass with a cast since runtime acceptance is unconditional.\n  const wrapped = async (...callbackArgs: unknown[]): Promise<ToolResult> => {\n    const hasArgs = callbackArgs.length === 2;\n    const args = (hasArgs ? callbackArgs[0] : {}) as TArgs;\n    const extra = (hasArgs ? callbackArgs[1] : callbackArgs[0]) as\n      | { _meta?: { progressToken?: string | number } }\n      | undefined;\n\n    const progressToken = extra?._meta?.progressToken;\n    const meta: ToolMeta = progressToken !== undefined ? { progressToken } : {};\n\n    try {\n      const result = await handler(args, ctx, meta);\n      if (isToolResult(result)) return result;\n      if (result === undefined) return textResult('OK');\n      return jsonResult(result);\n    } catch (error) {\n      return mapErrorToResult(error, ctx, name);\n    }\n  };\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  (server as any).registerTool(name, sdkConfig, wrapped);\n}\n\nfunction isToolResult(value: unknown): value is ToolResult {\n  return (\n    !!value &&\n    typeof value === 'object' &&\n    'content' in value &&\n    Array.isArray((value as ToolResult).content)\n  );\n}\n\nfunction mapErrorToResult(error: unknown, ctx: McpContext, toolName: string): ToolResult {\n  if (error instanceof McpAuthError) {\n    ctx.logger.warn(`${toolName}: auth required`, { message: error.message });\n    return errorResult(error.message, error.hint);\n  }\n  if (error instanceof McpUserError) {\n    ctx.logger.info(`${toolName}: user error`, { message: error.message });\n    return errorResult(error.message, error.hint);\n  }\n  if (error instanceof McpInternalError) {\n    ctx.logger.error(`${toolName}: internal error`, {\n      message: error.message,\n      cause: stringifyCause(error.cause),\n    });\n    return errorResult(`Internal error in ${toolName}.`);\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  ctx.logger.error(`${toolName}: unhandled error`, { message });\n  return errorResult(`${toolName}: ${message}`);\n}\n\nfunction stringifyCause(cause: unknown): string | undefined {\n  if (cause === undefined || cause === null) return undefined;\n  if (cause instanceof Error) return cause.message;\n  try {\n    return JSON.stringify(cause);\n  } catch {\n    return String(cause);\n  }\n}\n","/**\n * Tool / resource / prompt naming helpers.\n *\n * Mandatory product prefix avoids collisions when Claude Desktop runs\n * multiple MCP servers concurrently (typical setup is ~6).\n *\n * Tool names are capped at 63 characters — Claude Desktop pre-1.x\n * truncated at 64 in some versions.\n */\n\nimport { McpInternalError } from './errors.js';\n\nconst MAX_TOOL_NAME_LENGTH = 63;\n\nfunction assertSafeName(name: string, kind: 'tool' | 'resource' | 'prompt'): string {\n  if (kind === 'tool' && name.length > MAX_TOOL_NAME_LENGTH) {\n    throw new McpInternalError(\n      `Tool name '${name}' exceeds ${MAX_TOOL_NAME_LENGTH} characters (some MCP clients truncate at 64).`,\n    );\n  }\n  return name;\n}\n\n/**\n * Build a tool name. Format: `<productName>_<...parts>` (snake_case).\n * Example: mcpToolName('vibecontrols', 'vibes', 'list') -> 'vibecontrols_vibes_list'\n */\nexport function mcpToolName(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpToolName: productName is required');\n  }\n  const name = [productName, ...parts].filter(Boolean).join('_');\n  return assertSafeName(name, 'tool');\n}\n\n/**\n * Build a resource URI. Format: `<productName>://<...parts>`.\n * Example: mcpResourceUri('vibecontrols', 'schema') -> 'vibecontrols://schema'\n */\nexport function mcpResourceUri(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpResourceUri: productName is required');\n  }\n  return `${productName}://${parts.filter(Boolean).join('/')}`;\n}\n\n/**\n * Build a prompt name. Format: `<productName>-<...parts>` (kebab-case).\n * Example: mcpPromptName('vibecontrols', 'setup') -> 'vibecontrols-setup'\n */\nexport function mcpPromptName(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpPromptName: productName is required');\n  }\n  return [productName, ...parts].filter(Boolean).join('-');\n}\n\nexport const TOOL_NAME_LIMIT = MAX_TOOL_NAME_LENGTH;\n","export const LIST_ROLES = `\n  query ListRoles($filter: RoleFilterInput, $pagination: PaginationInput, $scopeId: String!) {\n    roles(filter: $filter, pagination: $pagination, scopeId: $scopeId) {\n      id\n      name\n      description\n      isSystem\n      scopeId\n      priority\n      defaultPermissions {\n        level\n        resourceType\n      }\n    }\n  }\n`;\n\nexport const GET_ROLE = `\n  query GetRole($id: ID!) {\n    role(id: $id) {\n      id\n      name\n      description\n      isSystem\n      scopeId\n      priority\n      defaultPermissions {\n        level\n        resourceType\n      }\n    }\n  }\n`;\n\nexport const CREATE_ROLE = `\n  mutation CreateRole($input: CreateRoleInput!) {\n    createRole(input: $input) {\n      id\n      name\n      description\n      scopeId\n    }\n  }\n`;\n\nexport const UPDATE_ROLE = `\n  mutation UpdateRole($id: ID!, $input: UpdateRoleInput!) {\n    updateRole(id: $id, input: $input) {\n      id\n      name\n      description\n      priority\n    }\n  }\n`;\n\nexport const DELETE_ROLE = `\n  mutation DeleteRole($id: ID!, $reassignToRoleId: ID) {\n    deleteRole(id: $id, reassignToRoleId: $reassignToRoleId)\n  }\n`;\n\nexport const CHECK_PERMISSION = `\n  query CheckPermission($input: PermissionCheckInput!) {\n    checkPermission(input: $input) {\n      allowed\n      decisionPath\n      roleName\n      roleLevel\n      overrideType\n    }\n  }\n`;\n\nexport const LIST_POLICY_REFERENCES = `\n  query PolicyReferences($filter: PolicyReferenceFilterInput, $pagination: PaginationInput) {\n    policyReferences(filter: $filter, pagination: $pagination) {\n      id\n      name\n      description\n      opaPackage\n      resourceType\n      action\n      isActive\n      priority\n      createdAt\n      updatedAt\n    }\n  }\n`;\n\nexport const ATTACH_POLICY = `\n  mutation AttachPolicy($roleId: ID!, $policyId: ID!) {\n    attachPolicyToRole(roleId: $roleId, policyId: $policyId) {\n      id\n      name\n      resourceType\n      action\n      isActive\n    }\n  }\n`;\n\nexport const DETACH_POLICY = `\n  mutation DetachPolicy($roleId: ID!, $policyId: ID!) {\n    detachPolicyFromRole(roleId: $roleId, policyId: $policyId)\n  }\n`;\n","import { z } from 'zod';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\nimport {\n  LIST_ROLES,\n  GET_ROLE,\n  CREATE_ROLE,\n  UPDATE_ROLE,\n  DELETE_ROLE,\n  CHECK_PERMISSION,\n  LIST_POLICY_REFERENCES,\n  ATTACH_POLICY,\n  DETACH_POLICY,\n} from './operations.js';\n\nconst LayerEnum = z.enum(['workspace', 'global']);\nconst ActorTypeEnum = z.enum(['USER', 'BOT', 'GROUP', 'INTEGRATION', 'DELEGATED_AGENT']);\n\ntype Layer = 'workspace' | 'global';\n\nfunction clientForLayer(ctx: McpContext, layer: Layer) {\n  return layer === 'workspace' ? ctx.gql.workspace : ctx.gql.global;\n}\n\nfunction defaultScopeId(ctx: McpContext, layer: Layer): string | null {\n  const auth = ctx.auth.read();\n  if (!auth) return null;\n  if (layer === 'workspace') return auth.workspaceId ?? null;\n  return auth.organizationId ?? null;\n}\n\nexport function registerRbacTools(\n  server: McpServer,\n  ctx: McpContext,\n  track: (n: string) => string,\n): void {\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_roles_list')),\n    {\n      title: 'List Roles',\n      description: 'List RBAC roles for a workspace or global scope.',\n      inputSchema: {\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n        scopeId: z.string().optional().describe('Override scope id (workspace or tenant)'),\n        includeSystem: z.boolean().optional().describe('Include system roles'),\n        limit: z.number().optional().describe('Page size'),\n      },\n    },\n    async ({ layer, scopeId, includeSystem, limit }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);\n        if (!resolvedScope) {\n          return errorResult(\n            `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`,\n          );\n        }\n        const filter: Record<string, unknown> = {};\n        if (includeSystem) filter.includeSystem = true;\n        const data = await clientForLayer(ctx, targetLayer).request<{ roles: unknown }>(\n          LIST_ROLES,\n          {\n            filter: Object.keys(filter).length ? filter : undefined,\n            pagination: { limit: limit ?? 100, offset: 0 },\n            scopeId: resolvedScope,\n          },\n        );\n        return jsonResult(data.roles);\n      } catch (error) {\n        ctx.logger.error('rbac_roles_list failed', { error: String(error) });\n        return errorResult(\n          `Failed to list roles: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_roles_get')),\n    {\n      title: 'Get Role',\n      description: 'Get a role by id from the workspace or global layer.',\n      inputSchema: {\n        id: z.string().describe('Role ID'),\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n      },\n    },\n    async ({ id, layer }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const data = await clientForLayer(ctx, targetLayer).request<{ role: unknown | null }>(\n          GET_ROLE,\n          { id },\n        );\n        if (!data.role) return errorResult(`Role ${id} not found`);\n        return jsonResult(data.role);\n      } catch (error) {\n        ctx.logger.error('rbac_roles_get failed', { error: String(error) });\n        return errorResult(\n          `Failed to get role: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_roles_create')),\n    {\n      title: 'Create Role',\n      description: 'Create a new RBAC role at the workspace or global layer.',\n      inputSchema: {\n        name: z.string().describe('Role name'),\n        description: z.string().optional().describe('Role description'),\n        parentId: z.string().optional().describe('Parent role id'),\n        priority: z.number().optional().describe('Priority'),\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n        scopeId: z.string().optional().describe('Override scope id'),\n        scopeType: z.string().optional().describe('wspace|entity (global layer only)'),\n      },\n    },\n    async ({ name, description, parentId, priority, layer, scopeId, scopeType }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);\n        if (!resolvedScope) {\n          return errorResult(\n            `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`,\n          );\n        }\n        const input: Record<string, unknown> = { name, scopeId: resolvedScope };\n        if (description !== undefined) input.description = description;\n        if (parentId !== undefined) input.parentId = parentId;\n        if (priority !== undefined) input.priority = priority;\n        if (targetLayer === 'global' && scopeType) input.scopeType = scopeType;\n        const data = await clientForLayer(ctx, targetLayer).request<{ createRole: unknown }>(\n          CREATE_ROLE,\n          { input },\n        );\n        return jsonResult(data.createRole);\n      } catch (error) {\n        ctx.logger.error('rbac_roles_create failed', { error: String(error) });\n        return errorResult(\n          `Failed to create role: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_roles_update')),\n    {\n      title: 'Update Role',\n      description: 'Update an existing role.',\n      inputSchema: {\n        id: z.string().describe('Role ID'),\n        name: z.string().optional().describe('Updated name'),\n        description: z.string().optional().describe('Updated description'),\n        priority: z.number().optional().describe('Updated priority'),\n        parentId: z.string().optional().describe('Updated parent role id'),\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n      },\n    },\n    async ({ id, name, description, priority, parentId, layer }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const input: Record<string, unknown> = {};\n        if (name !== undefined) input.name = name;\n        if (description !== undefined) input.description = description;\n        if (priority !== undefined) input.priority = priority;\n        if (parentId !== undefined) input.parentId = parentId;\n        if (!Object.keys(input).length) {\n          return errorResult('No updates specified');\n        }\n        const data = await clientForLayer(ctx, targetLayer).request<{ updateRole: unknown }>(\n          UPDATE_ROLE,\n          { id, input },\n        );\n        return jsonResult(data.updateRole);\n      } catch (error) {\n        ctx.logger.error('rbac_roles_update failed', { error: String(error) });\n        return errorResult(\n          `Failed to update role: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_roles_delete')),\n    {\n      title: 'Delete Role',\n      description: 'Delete a role, optionally reassigning actors to another role.',\n      inputSchema: {\n        id: z.string().describe('Role ID'),\n        reassignToRoleId: z.string().optional().describe('Reassign actors to this role'),\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n      },\n    },\n    async ({ id, reassignToRoleId, layer }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const data = await clientForLayer(ctx, targetLayer).request<{ deleteRole: unknown }>(\n          DELETE_ROLE,\n          { id, reassignToRoleId },\n        );\n        return jsonResult({ deleted: data.deleteRole, roleId: id });\n      } catch (error) {\n        ctx.logger.error('rbac_roles_delete failed', { error: String(error) });\n        return errorResult(\n          `Failed to delete role: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  // ── Policies ────────────────────────────────────────────────────────────\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_policies_list')),\n    {\n      title: 'List Policy References',\n      description:\n        'List OPA policy references registered on the chosen gateway (workspace or global), optionally filtered by resource/action/active state. Returns an array of PolicyReference.',\n      inputSchema: {\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n        resourceType: z.string().optional().describe('Filter by resource type (e.g. project)'),\n        action: z.string().optional().describe('Filter by action (e.g. read/write/delete)'),\n        isActive: z.boolean().optional().describe('Only active/inactive policies'),\n        limit: z.number().int().optional().describe('Page size (default 100)'),\n        offset: z.number().int().optional().describe('Pagination offset (default 0)'),\n      },\n    },\n    async ({ layer, resourceType, action, isActive, limit, offset }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const filter: Record<string, unknown> = {};\n        if (resourceType !== undefined) filter.resourceType = resourceType;\n        if (action !== undefined) filter.action = action;\n        if (isActive !== undefined) filter.isActive = isActive;\n        const data = await clientForLayer(ctx, targetLayer).request<{\n          policyReferences: unknown[];\n        }>(LIST_POLICY_REFERENCES, {\n          filter: Object.keys(filter).length ? filter : undefined,\n          pagination: { limit: limit ?? 100, offset: offset ?? 0 },\n        });\n        return jsonResult(data.policyReferences);\n      } catch (error) {\n        ctx.logger.error('rbac_policies_list failed', { error: String(error) });\n        return errorResult(\n          `Failed to list policy references: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_policies_attach')),\n    {\n      title: 'Attach Policy To Role',\n      description:\n        'Attach an OPA policy reference to a role on the chosen gateway. Returns the attached PolicyReference.',\n      inputSchema: {\n        roleId: z.string().describe('Role ID'),\n        policyId: z.string().describe('PolicyReference ID'),\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n      },\n    },\n    async ({ roleId, policyId, layer }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const data = await clientForLayer(ctx, targetLayer).request<{\n          attachPolicyToRole: unknown;\n        }>(ATTACH_POLICY, { roleId, policyId });\n        return jsonResult(data.attachPolicyToRole);\n      } catch (error) {\n        ctx.logger.error('rbac_policies_attach failed', { error: String(error) });\n        return errorResult(\n          `Failed to attach policy: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_policies_detach')),\n    {\n      title: 'Detach Policy From Role',\n      description:\n        'Detach an OPA policy reference from a role on the chosen gateway. Returns { detached: boolean, roleId, policyId }.',\n      inputSchema: {\n        roleId: z.string().describe('Role ID'),\n        policyId: z.string().describe('PolicyReference ID'),\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n      },\n    },\n    async ({ roleId, policyId, layer }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const data = await clientForLayer(ctx, targetLayer).request<{\n          detachPolicyFromRole: boolean;\n        }>(DETACH_POLICY, { roleId, policyId });\n        return jsonResult({ detached: data.detachPolicyFromRole, roleId, policyId });\n      } catch (error) {\n        ctx.logger.error('rbac_policies_detach failed', { error: String(error) });\n        return errorResult(\n          `Failed to detach policy: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_check')),\n    {\n      title: 'Check Permission',\n      description: 'Check whether an actor has permission for an action on a resource.',\n      inputSchema: {\n        actorId: z.string().describe('Actor id (user/app/service/super_admin)'),\n        action: z.string().describe('Action like read/write/delete'),\n        resourceType: z.string().describe('Resource type like project/task'),\n        actorType: ActorTypeEnum.optional().describe('Actor type (default: USER)'),\n        resourceId: z.string().optional().describe('Specific resource id (optional)'),\n        scopeId: z.string().optional().describe('Scope id (workspaceId or tenantId)'),\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n      },\n    },\n    async ({ actorId, action, resourceType, actorType, resourceId, scopeId, layer }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);\n        if (!resolvedScope) {\n          return errorResult(\n            `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`,\n          );\n        }\n        const input: Record<string, unknown> = {\n          actorId,\n          actorType: actorType ?? 'USER',\n          action,\n          resourceType,\n          scopeId: resolvedScope,\n        };\n        if (resourceId !== undefined) input.resourceId = resourceId;\n        const data = await clientForLayer(ctx, targetLayer).request<{ checkPermission: unknown }>(\n          CHECK_PERMISSION,\n          { input },\n        );\n        return jsonResult(data.checkPermission);\n      } catch (error) {\n        ctx.logger.error('rbac_check failed', { error: String(error) });\n        return errorResult(\n          `Failed to check permission: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n}\n","/**\n * RBAC module — role-based access control across workspace + global layers.\n *\n * Tools:\n *   <product>_rbac_roles_{list,get,create,update,delete}\n *   <product>_rbac_check\n *\n * Backend: ~/products/wspace/rbac/wspace-rbac-svc/, ~/products/global/rbac/global-rbac-svc/.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { McpContext, McpModule, ModuleRegistration } from '../../core/index.js';\nimport { registerRbacTools } from './tools.js';\n\nconst rbacModule: McpModule = {\n  id: 'rbac',\n  version: '0.0.1',\n  displayName: 'RBAC',\n  dependsOn: ['auth'],\n  capabilities: { tools: {} },\n\n  register(server: McpServer, ctx: McpContext): ModuleRegistration {\n    const tools: string[] = [];\n    const track = (n: string): string => {\n      tools.push(n);\n      return n;\n    };\n\n    registerRbacTools(server, ctx, track);\n\n    return { tools, resources: [], prompts: [] };\n  },\n};\n\nexport default rbacModule;\n"]}
+{"version":3,"sources":["../../../src/core/errors.ts","../../../src/core/tool-name.ts","../../../src/core/result.ts","../../../src/modules/rbac/operations.ts","../../../src/modules/rbac/tools.ts","../../../src/modules/rbac/index.ts"],"names":["z"],"mappings":";;;;;;;;;;;AA8BO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EACjB,KAAA;AAAA,EAEzB,WAAA,CAAY,SAAiB,KAAA,EAAiB;AAC5C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF,CAAA;;;AC1BA,IAAM,oBAAA,GAAuB,EAAA;AAE7B,SAAS,cAAA,CAAe,MAAc,IAAA,EAA8C;AAClF,EAAA,IAAuB,IAAA,CAAK,MAAA,GAAS,oBAAA,EAAsB;AACzD,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,CAAA,WAAA,EAAc,IAAI,CAAA,UAAA,EAAa,oBAAoB,CAAA,8CAAA;AAAA,KACrD;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,WAAA,CAAY,gBAAwB,KAAA,EAAyB;AAC3E,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,iBAAiB,sCAAsC,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,IAAA,GAAO,CAAC,WAAA,EAAa,GAAG,KAAK,EAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC7D,EAAA,OAAO,cAAA,CAAe,IAAY,CAAA;AACpC;;;ACOO,SAAS,UAAA,CAAW,MAAe,UAAA,EAAkD;AAC1F,EAAA,MAAM,MAAA,GAAqB;AAAA,IACzB,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG;AAAA,GACjE;AAIA,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,WAAA,CAAY,SAAiB,IAAA,EAA2B;AACtE,EAAA,MAAM,IAAA,GAAO,IAAA,GAAO,CAAA,EAAG,OAAO;;AAAA,MAAA,EAAa,IAAI,CAAA,CAAA,GAAK,OAAA;AACpD,EAAA,OAAO,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,CAAA,EAAG,OAAA,EAAS,IAAA,EAAK;AAC5D;;;AChEO,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiBnB,IAAM,QAAA,GAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiBjB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWpB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWpB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA,CAAA;AAMpB,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAYzB,IAAM,sBAAA,GAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiB/B,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAYtB,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA,CAAA;;;ACxF7B,IAAM,YAAYA,KAAAA,CAAE,IAAA,CAAK,CAAC,WAAA,EAAa,QAAQ,CAAC,CAAA;AAChD,IAAM,aAAA,GAAgBA,MAAE,IAAA,CAAK,CAAC,QAAQ,KAAA,EAAO,OAAA,EAAS,aAAA,EAAe,iBAAiB,CAAC,CAAA;AAIvF,SAAS,cAAA,CAAe,KAAiB,KAAA,EAAc;AACrD,EAAA,OAAO,UAAU,WAAA,GAAc,GAAA,CAAI,GAAA,CAAI,SAAA,GAAY,IAAI,GAAA,CAAI,MAAA;AAC7D;AAEA,SAAS,cAAA,CAAe,KAAiB,KAAA,EAA6B;AACpE,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI,KAAA,KAAU,WAAA,EAAa,OAAO,IAAA,CAAK,WAAA,IAAe,IAAA;AACtD,EAAA,OAAO,KAAK,cAAA,IAAkB,IAAA;AAChC;AAEO,SAAS,iBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AACN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,YAAA;AAAA,MACP,WAAA,EAAa,kDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C,CAAA;AAAA,QAC/E,SAASA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,yCAAyC,CAAA;AAAA,QACjF,eAAeA,KAAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,sBAAsB,CAAA;AAAA,QACrE,OAAOA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,WAAW;AAAA;AACnD,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,OAAA,EAAS,aAAA,EAAe,OAAM,KAAM;AAClD,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,aAAA,GAAgB,OAAA,IAAW,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA;AAChE,QAAA,IAAI,CAAC,aAAA,EAAe;AAClB,UAAA,OAAO,WAAA;AAAA,YACL,MAAM,WAAW,CAAA,iEAAA;AAAA,WACnB;AAAA,QACF;AACA,QAAA,MAAM,SAAkC,EAAC;AACzC,QAAA,IAAI,aAAA,SAAsB,aAAA,GAAgB,IAAA;AAC1C,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,UAAA;AAAA,UACA;AAAA,YACE,QAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,SAAS,MAAA,GAAS,KAAA,CAAA;AAAA,YAC9C,YAAY,EAAE,KAAA,EAAO,KAAA,IAAS,GAAA,EAAK,QAAQ,CAAA,EAAE;AAAA,YAC7C,OAAA,EAAS;AAAA;AACX,SACF;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,KAAK,CAAA;AAAA,MAC9B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,wBAAA,EAA0B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACnE,QAAA,OAAO,WAAA;AAAA,UACL,yBAAyB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACjF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,gBAAgB,CAAC,CAAA;AAAA,IACpD;AAAA,MACE,KAAA,EAAO,UAAA;AAAA,MACP,WAAA,EAAa,sDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAIA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACjC,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAM,KAAM;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,QAAA;AAAA,UACA,EAAE,EAAA;AAAG,SACP;AACA,QAAA,IAAI,CAAC,IAAA,CAAK,IAAA,SAAa,WAAA,CAAY,CAAA,KAAA,EAAQ,EAAE,CAAA,UAAA,CAAY,CAAA;AACzD,QAAA,OAAO,UAAA,CAAW,KAAK,IAAI,CAAA;AAAA,MAC7B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,uBAAA,EAAyB,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAClE,QAAA,OAAO,WAAA;AAAA,UACL,uBAAuB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC/E;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAAA,IACvD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,0DAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,IAAA,EAAMA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,WAAW,CAAA;AAAA,QACrC,aAAaA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,kBAAkB,CAAA;AAAA,QAC9D,UAAUA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,gBAAgB,CAAA;AAAA,QACzD,UAAUA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,UAAU,CAAA;AAAA,QACnD,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C,CAAA;AAAA,QAC/E,SAASA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,mBAAmB,CAAA;AAAA,QAC3D,WAAWA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,mCAAmC;AAAA;AAC/E,KACF;AAAA,IACA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,UAAU,QAAA,EAAU,KAAA,EAAO,OAAA,EAAS,SAAA,EAAU,KAAM;AAC9E,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,aAAA,GAAgB,OAAA,IAAW,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA;AAChE,QAAA,IAAI,CAAC,aAAA,EAAe;AAClB,UAAA,OAAO,WAAA;AAAA,YACL,MAAM,WAAW,CAAA,iEAAA;AAAA,WACnB;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAiC,EAAE,IAAA,EAAM,OAAA,EAAS,aAAA,EAAc;AACtE,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,WAAA,KAAgB,QAAA,IAAY,SAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAC7D,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,WAAA;AAAA,UACA,EAAE,KAAA;AAAM,SACV;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,UAAU,CAAA;AAAA,MACnC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,0BAAA,EAA4B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACrE,QAAA,OAAO,WAAA;AAAA,UACL,0BAA0B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAClF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAAA,IACvD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,0BAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAIA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACjC,MAAMA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,cAAc,CAAA;AAAA,QACnD,aAAaA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qBAAqB,CAAA;AAAA,QACjE,UAAUA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,kBAAkB,CAAA;AAAA,QAC3D,UAAUA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wBAAwB,CAAA;AAAA,QACjE,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,aAAa,QAAA,EAAU,QAAA,EAAU,OAAM,KAAM;AAC9D,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,QAAiC,EAAC;AACxC,QAAA,IAAI,IAAA,KAAS,KAAA,CAAA,EAAW,KAAA,CAAM,IAAA,GAAO,IAAA;AACrC,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,KAAK,EAAE,MAAA,EAAQ;AAC9B,UAAA,OAAO,YAAY,sBAAsB,CAAA;AAAA,QAC3C;AACA,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,WAAA;AAAA,UACA,EAAE,IAAI,KAAA;AAAM,SACd;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,UAAU,CAAA;AAAA,MACnC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,0BAAA,EAA4B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACrE,QAAA,OAAO,WAAA;AAAA,UACL,0BAA0B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAClF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAAA,IACvD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAIA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACjC,kBAAkBA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,8BAA8B,CAAA;AAAA,QAC/E,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,gBAAA,EAAkB,OAAM,KAAM;AACzC,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,WAAA;AAAA,UACA,EAAE,IAAI,gBAAA;AAAiB,SACzB;AACA,QAAA,OAAO,WAAW,EAAE,OAAA,EAAS,KAAK,UAAA,EAAY,MAAA,EAAQ,IAAI,CAAA;AAAA,MAC5D,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,0BAAA,EAA4B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACrE,QAAA,OAAO,WAAA;AAAA,UACL,0BAA0B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAClF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAGA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oBAAoB,CAAC,CAAA;AAAA,IACxD;AAAA,MACE,KAAA,EAAO,wBAAA;AAAA,MACP,WAAA,EACE,8KAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C,CAAA;AAAA,QAC/E,cAAcA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wCAAwC,CAAA;AAAA,QACrF,QAAQA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,2CAA2C,CAAA;AAAA,QAClF,UAAUA,KAAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,+BAA+B,CAAA;AAAA,QACzE,KAAA,EAAOA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,yBAAyB,CAAA;AAAA,QACrE,MAAA,EAAQA,MAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,+BAA+B;AAAA;AAC9E,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,YAAA,EAAc,QAAQ,QAAA,EAAU,KAAA,EAAO,QAAO,KAAM;AAClE,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,SAAkC,EAAC;AACzC,QAAA,IAAI,YAAA,KAAiB,KAAA,CAAA,EAAW,MAAA,CAAO,YAAA,GAAe,YAAA;AACtD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,MAAA,CAAO,MAAA,GAAS,MAAA;AAC1C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,MAAA,CAAO,QAAA,GAAW,QAAA;AAC9C,QAAA,MAAM,OAAO,MAAM,cAAA,CAAe,KAAK,WAAW,CAAA,CAAE,QAEjD,sBAAA,EAAwB;AAAA,UACzB,QAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,SAAS,MAAA,GAAS,KAAA,CAAA;AAAA,UAC9C,YAAY,EAAE,KAAA,EAAO,SAAS,GAAA,EAAK,MAAA,EAAQ,UAAU,CAAA;AAAE,SACxD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW,KAAK,gBAAgB,CAAA;AAAA,MACzC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,2BAAA,EAA6B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACtE,QAAA,OAAO,WAAA;AAAA,UACL,qCAAqC,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC7F;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,uBAAA;AAAA,MACP,WAAA,EACE,uGAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACrC,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAClD,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,OAAM,KAAM;AACrC,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA,CAEjD,aAAA,EAAe,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACtC,QAAA,OAAO,UAAA,CAAW,KAAK,kBAAkB,CAAA;AAAA,MAC3C,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,6BAAA,EAA+B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxE,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,yBAAA;AAAA,MACP,WAAA,EACE,oHAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACrC,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAClD,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,OAAM,KAAM;AACrC,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA,CAEjD,aAAA,EAAe,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACtC,QAAA,OAAO,WAAW,EAAE,QAAA,EAAU,KAAK,oBAAA,EAAsB,MAAA,EAAQ,UAAU,CAAA;AAAA,MAC7E,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,6BAAA,EAA+B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxE,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,YAAY,CAAC,CAAA;AAAA,IAChD;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EAAa,oEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAA,EAASA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,yCAAyC,CAAA;AAAA,QACtE,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,+BAA+B,CAAA;AAAA,QAC3D,YAAA,EAAcA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,iCAAiC,CAAA;AAAA,QACnE,SAAA,EAAW,aAAA,CAAc,QAAA,EAAS,CAAE,SAAS,4BAA4B,CAAA;AAAA,QACzE,YAAYA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,iCAAiC,CAAA;AAAA,QAC5E,SAASA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,oCAAoC,CAAA;AAAA,QAC5E,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,cAAc,SAAA,EAAW,UAAA,EAAY,OAAA,EAAS,KAAA,EAAM,KAAM;AAClF,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,aAAA,GAAgB,OAAA,IAAW,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA;AAChE,QAAA,IAAI,CAAC,aAAA,EAAe;AAClB,UAAA,OAAO,WAAA;AAAA,YACL,MAAM,WAAW,CAAA,iEAAA;AAAA,WACnB;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAiC;AAAA,UACrC,OAAA;AAAA,UACA,WAAW,SAAA,IAAa,MAAA;AAAA,UACxB,MAAA;AAAA,UACA,YAAA;AAAA,UACA,OAAA,EAAS;AAAA,SACX;AACA,QAAA,IAAI,UAAA,KAAe,KAAA,CAAA,EAAW,KAAA,CAAM,UAAA,GAAa,UAAA;AACjD,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,gBAAA;AAAA,UACA,EAAE,KAAA;AAAM,SACV;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,eAAe,CAAA;AAAA,MACxC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,mBAAA,EAAqB,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAC9D,QAAA,OAAO,WAAA;AAAA,UACL,+BAA+B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACvF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AACF;;;ACrVA,IAAM,UAAA,GAAwB;AAAA,EAC5B,EAAA,EAAI,MAAA;AAAA,EACJ,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAa,MAAA;AAAA,EACb,SAAA,EAAW,CAAC,MAAM,CAAA;AAAA,EAClB,YAAA,EAAc,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,EAE1B,QAAA,CAAS,QAAmB,GAAA,EAAqC;AAC/D,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KAAsB;AACnC,MAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AACZ,MAAA,OAAO,CAAA;AAAA,IACT,CAAA;AAEA,IAAA,iBAAA,CAAkB,MAAA,EAAQ,KAAK,KAAK,CAAA;AAEpC,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,EAAC,EAAG,OAAA,EAAS,EAAC,EAAE;AAAA,EAC7C;AACF,CAAA;AAEA,IAAO,YAAA,GAAQ","file":"index.cjs","sourcesContent":["/**\n * Error classes for MCP SDK.\n *\n * Modules MUST throw these instead of throwing raw Errors. The registerTool\n * wrapper in result.ts catches and maps them to MCP-protocol-compliant\n * `{ isError: true, content: [...] }` responses.\n *\n * Throwing past the wrapper to the protocol surfaces as JSON-RPC -32603 to\n * the client and is a protocol bug.\n */\n\nexport class McpUserError extends Error {\n  public readonly hint: string | undefined;\n\n  constructor(message: string, opts?: { hint?: string }) {\n    super(message);\n    this.name = 'McpUserError';\n    this.hint = opts?.hint;\n  }\n}\n\nexport class McpAuthError extends McpUserError {\n  constructor(message: string, opts?: { hint?: string }) {\n    super(message, {\n      hint: opts?.hint ?? 'Run the auth_login tool to authenticate.',\n    });\n    this.name = 'McpAuthError';\n  }\n}\n\nexport class McpInternalError extends Error {\n  public override readonly cause: unknown;\n\n  constructor(message: string, cause?: unknown) {\n    super(message);\n    this.name = 'McpInternalError';\n    this.cause = cause;\n  }\n}\n","/**\n * Tool / resource / prompt naming helpers.\n *\n * Mandatory product prefix avoids collisions when Claude Desktop runs\n * multiple MCP servers concurrently (typical setup is ~6).\n *\n * Tool names are capped at 63 characters — Claude Desktop pre-1.x\n * truncated at 64 in some versions.\n */\n\nimport { McpInternalError } from './errors.js';\n\nconst MAX_TOOL_NAME_LENGTH = 63;\n\nfunction assertSafeName(name: string, kind: 'tool' | 'resource' | 'prompt'): string {\n  if (kind === 'tool' && name.length > MAX_TOOL_NAME_LENGTH) {\n    throw new McpInternalError(\n      `Tool name '${name}' exceeds ${MAX_TOOL_NAME_LENGTH} characters (some MCP clients truncate at 64).`,\n    );\n  }\n  return name;\n}\n\n/**\n * Build a tool name. Format: `<productName>_<...parts>` (snake_case).\n * Example: mcpToolName('vibecontrols', 'vibes', 'list') -> 'vibecontrols_vibes_list'\n */\nexport function mcpToolName(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpToolName: productName is required');\n  }\n  const name = [productName, ...parts].filter(Boolean).join('_');\n  return assertSafeName(name, 'tool');\n}\n\n/**\n * Build a resource URI. Format: `<productName>://<...parts>`.\n * Example: mcpResourceUri('vibecontrols', 'schema') -> 'vibecontrols://schema'\n */\nexport function mcpResourceUri(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpResourceUri: productName is required');\n  }\n  return `${productName}://${parts.filter(Boolean).join('/')}`;\n}\n\n/**\n * Build a prompt name. Format: `<productName>-<...parts>` (kebab-case).\n * Example: mcpPromptName('vibecontrols', 'setup') -> 'vibecontrols-setup'\n */\nexport function mcpPromptName(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpPromptName: productName is required');\n  }\n  return [productName, ...parts].filter(Boolean).join('-');\n}\n\nexport const TOOL_NAME_LIMIT = MAX_TOOL_NAME_LENGTH;\n\n/**\n * Name-based hint heuristics for MCP `annotations` (readOnlyHint /\n * destructiveHint). Used by tool-governance.ts to auto-fill annotations for\n * the fleet of product modules that call `server.registerTool` directly\n * (bypassing the `registerTool()` core helper) and so never set them\n * explicitly today (BOFF-3903). Deliberately conservative — matched against\n * whole `_`-delimited segments so e.g. `timeentries_delete` and\n * `pomodoro_delete_goal` match, but a hypothetical `undeletable_check`\n * would not.\n *\n * A module can always override the inference by passing an explicit\n * `annotations` object to `registerTool()` / `server.registerTool()`.\n */\nconst DESTRUCTIVE_NAME_SEGMENT = /(?:^|_)delete(?:_|$)/i;\nconst READ_ONLY_NAME_SEGMENT = /(?:^|_)(?:list|get|search|check|read|count|stats|by_date)(?:_|$)/i;\n\n/** True when a tool name looks destructive (irreversibly deletes data) by naming convention. */\nexport function inferDestructiveHint(toolName: string): boolean {\n  return DESTRUCTIVE_NAME_SEGMENT.test(toolName);\n}\n\n/**\n * True when a tool name looks read-only by naming convention. Never true for\n * a name that also looks destructive (a tool can't be both).\n */\nexport function inferReadOnlyHint(toolName: string): boolean {\n  return !inferDestructiveHint(toolName) && READ_ONLY_NAME_SEGMENT.test(toolName);\n}\n","/**\n * MCP tool result helpers + central handler.\n *\n * Modules NEVER call server.registerTool directly — they use registerTool()\n * from this module so the central try/catch wraps the handler and:\n *   - maps thrown McpUserError / McpAuthError / McpInternalError to\n *     MCP-protocol-compliant `{ isError: true, content: [...] }` shapes\n *   - threads `_meta.progressToken` into ctx.progress for long ops\n *   - emits a structured log line on every error\n *   - never leaks `cause` from McpInternalError to the client\n *\n * This is the analog of cli-sdk's createProgram() central error handler.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { ZodRawShape } from 'zod';\nimport type { McpContext } from './context.js';\nimport { McpAuthError, McpInternalError, McpUserError } from './errors.js';\nimport type { ToolAnnotations } from './tool-governance.js';\n\nexport interface ToolTextContent {\n  type: 'text';\n  text: string;\n  [k: string]: unknown;\n}\n\nexport interface ToolResult {\n  content: ToolTextContent[];\n  isError?: boolean;\n  structuredContent?: Record<string, unknown>;\n  [k: string]: unknown;\n}\n\nexport interface ToolMeta {\n  progressToken?: string | number;\n}\n\n/**\n * Build a successful tool result with JSON content (pretty-printed).\n */\nexport function jsonResult(data: unknown, structured?: Record<string, unknown>): ToolResult {\n  const result: ToolResult = {\n    content: [{ type: 'text', text: JSON.stringify(data, null, 2) }],\n  };\n  if (structured !== undefined) {\n    result.structuredContent = structured;\n  }\n  return result;\n}\n\n/**\n * Build a successful tool result with plain text content.\n */\nexport function textResult(text: string): ToolResult {\n  return { content: [{ type: 'text', text }] };\n}\n\n/**\n * Build an error tool result. Honors MCP's `{ isError: true, content }` shape.\n * Optional hint is appended on a new line so the LLM can react.\n */\nexport function errorResult(message: string, hint?: string): ToolResult {\n  const text = hint ? `${message}\\n\\nHint: ${hint}` : message;\n  return { content: [{ type: 'text', text }], isError: true };\n}\n\nexport interface ToolMetadata {\n  title: string;\n  description: string;\n  inputSchema?: ZodRawShape;\n  /**\n   * Explicit MCP annotations (readOnlyHint / destructiveHint / ...). Optional\n   * — when omitted, `wrapServerWithToolGovernance` (applied centrally in\n   * `createMcpServer`) infers them from the tool name. Set this to override\n   * the inference for a tool whose name doesn't match the naming convention.\n   */\n  annotations?: ToolAnnotations;\n}\n\nexport type ToolHandler<TArgs = Record<string, unknown>> = (\n  args: TArgs,\n  ctx: McpContext,\n  meta: ToolMeta,\n) => Promise<unknown>;\n\n/**\n * Register a tool with the central error wrapper.\n *\n * The handler returns a plain value or void. The wrapper:\n *   - wraps non-undefined returns in jsonResult()\n *   - if the value already looks like a ToolResult (has `content`), passes through\n *   - catches McpAuthError / McpUserError / McpInternalError / generic Error\n *   - logs every error via ctx.logger.error\n */\nexport function registerTool<TArgs extends Record<string, unknown>>(\n  server: McpServer,\n  ctx: McpContext,\n  name: string,\n  metadata: ToolMetadata,\n  handler: ToolHandler<TArgs>,\n): void {\n  const sdkConfig = {\n    title: metadata.title,\n    description: metadata.description,\n    ...(metadata.inputSchema ? { inputSchema: metadata.inputSchema } : {}),\n    ...(metadata.annotations ? { annotations: metadata.annotations } : {}),\n  };\n\n  // The MCP SDK's registerTool signature is `(name, config, handler)`. The\n  // handler arity depends on whether inputSchema is present (1-arg without,\n  // 2-arg with). We accept a unified handler shape and dispatch at runtime.\n  // The SDK's typing is strict and conditional on the inputSchema generic;\n  // bypass with a cast since runtime acceptance is unconditional.\n  const wrapped = async (...callbackArgs: unknown[]): Promise<ToolResult> => {\n    const hasArgs = callbackArgs.length === 2;\n    const args = (hasArgs ? callbackArgs[0] : {}) as TArgs;\n    const extra = (hasArgs ? callbackArgs[1] : callbackArgs[0]) as\n      | { _meta?: { progressToken?: string | number } }\n      | undefined;\n\n    const progressToken = extra?._meta?.progressToken;\n    const meta: ToolMeta = progressToken !== undefined ? { progressToken } : {};\n\n    try {\n      const result = await handler(args, ctx, meta);\n      if (isToolResult(result)) return result;\n      if (result === undefined) return textResult('OK');\n      return jsonResult(result);\n    } catch (error) {\n      return mapErrorToResult(error, ctx, name);\n    }\n  };\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  (server as any).registerTool(name, sdkConfig, wrapped);\n}\n\nfunction isToolResult(value: unknown): value is ToolResult {\n  return (\n    !!value &&\n    typeof value === 'object' &&\n    'content' in value &&\n    Array.isArray((value as ToolResult).content)\n  );\n}\n\nfunction mapErrorToResult(error: unknown, ctx: McpContext, toolName: string): ToolResult {\n  if (error instanceof McpAuthError) {\n    ctx.logger.warn(`${toolName}: auth required`, { message: error.message });\n    return errorResult(error.message, error.hint);\n  }\n  if (error instanceof McpUserError) {\n    ctx.logger.info(`${toolName}: user error`, { message: error.message });\n    return errorResult(error.message, error.hint);\n  }\n  if (error instanceof McpInternalError) {\n    ctx.logger.error(`${toolName}: internal error`, {\n      message: error.message,\n      cause: stringifyCause(error.cause),\n    });\n    return errorResult(`Internal error in ${toolName}.`);\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  ctx.logger.error(`${toolName}: unhandled error`, { message });\n  return errorResult(`${toolName}: ${message}`);\n}\n\nfunction stringifyCause(cause: unknown): string | undefined {\n  if (cause === undefined || cause === null) return undefined;\n  if (cause instanceof Error) return cause.message;\n  try {\n    return JSON.stringify(cause);\n  } catch {\n    return String(cause);\n  }\n}\n","export const LIST_ROLES = `\n  query ListRoles($filter: RoleFilterInput, $pagination: PaginationInput, $scopeId: String!) {\n    roles(filter: $filter, pagination: $pagination, scopeId: $scopeId) {\n      id\n      name\n      description\n      isSystem\n      scopeId\n      priority\n      defaultPermissions {\n        level\n        resourceType\n      }\n    }\n  }\n`;\n\nexport const GET_ROLE = `\n  query GetRole($id: ID!) {\n    role(id: $id) {\n      id\n      name\n      description\n      isSystem\n      scopeId\n      priority\n      defaultPermissions {\n        level\n        resourceType\n      }\n    }\n  }\n`;\n\nexport const CREATE_ROLE = `\n  mutation CreateRole($input: CreateRoleInput!) {\n    createRole(input: $input) {\n      id\n      name\n      description\n      scopeId\n    }\n  }\n`;\n\nexport const UPDATE_ROLE = `\n  mutation UpdateRole($id: ID!, $input: UpdateRoleInput!) {\n    updateRole(id: $id, input: $input) {\n      id\n      name\n      description\n      priority\n    }\n  }\n`;\n\nexport const DELETE_ROLE = `\n  mutation DeleteRole($id: ID!, $reassignToRoleId: ID) {\n    deleteRole(id: $id, reassignToRoleId: $reassignToRoleId)\n  }\n`;\n\nexport const CHECK_PERMISSION = `\n  query CheckPermission($input: PermissionCheckInput!) {\n    checkPermission(input: $input) {\n      allowed\n      decisionPath\n      roleName\n      roleLevel\n      overrideType\n    }\n  }\n`;\n\nexport const LIST_POLICY_REFERENCES = `\n  query PolicyReferences($filter: PolicyReferenceFilterInput, $pagination: PaginationInput) {\n    policyReferences(filter: $filter, pagination: $pagination) {\n      id\n      name\n      description\n      opaPackage\n      resourceType\n      action\n      isActive\n      priority\n      createdAt\n      updatedAt\n    }\n  }\n`;\n\nexport const ATTACH_POLICY = `\n  mutation AttachPolicy($roleId: ID!, $policyId: ID!) {\n    attachPolicyToRole(roleId: $roleId, policyId: $policyId) {\n      id\n      name\n      resourceType\n      action\n      isActive\n    }\n  }\n`;\n\nexport const DETACH_POLICY = `\n  mutation DetachPolicy($roleId: ID!, $policyId: ID!) {\n    detachPolicyFromRole(roleId: $roleId, policyId: $policyId)\n  }\n`;\n","import { z } from 'zod';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\nimport {\n  LIST_ROLES,\n  GET_ROLE,\n  CREATE_ROLE,\n  UPDATE_ROLE,\n  DELETE_ROLE,\n  CHECK_PERMISSION,\n  LIST_POLICY_REFERENCES,\n  ATTACH_POLICY,\n  DETACH_POLICY,\n} from './operations.js';\n\nconst LayerEnum = z.enum(['workspace', 'global']);\nconst ActorTypeEnum = z.enum(['USER', 'BOT', 'GROUP', 'INTEGRATION', 'DELEGATED_AGENT']);\n\ntype Layer = 'workspace' | 'global';\n\nfunction clientForLayer(ctx: McpContext, layer: Layer) {\n  return layer === 'workspace' ? ctx.gql.workspace : ctx.gql.global;\n}\n\nfunction defaultScopeId(ctx: McpContext, layer: Layer): string | null {\n  const auth = ctx.auth.read();\n  if (!auth) return null;\n  if (layer === 'workspace') return auth.workspaceId ?? null;\n  return auth.organizationId ?? null;\n}\n\nexport function registerRbacTools(\n  server: McpServer,\n  ctx: McpContext,\n  track: (n: string) => string,\n): void {\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_roles_list')),\n    {\n      title: 'List Roles',\n      description: 'List RBAC roles for a workspace or global scope.',\n      inputSchema: {\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n        scopeId: z.string().optional().describe('Override scope id (workspace or tenant)'),\n        includeSystem: z.boolean().optional().describe('Include system roles'),\n        limit: z.number().optional().describe('Page size'),\n      },\n    },\n    async ({ layer, scopeId, includeSystem, limit }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);\n        if (!resolvedScope) {\n          return errorResult(\n            `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`,\n          );\n        }\n        const filter: Record<string, unknown> = {};\n        if (includeSystem) filter.includeSystem = true;\n        const data = await clientForLayer(ctx, targetLayer).request<{ roles: unknown }>(\n          LIST_ROLES,\n          {\n            filter: Object.keys(filter).length ? filter : undefined,\n            pagination: { limit: limit ?? 100, offset: 0 },\n            scopeId: resolvedScope,\n          },\n        );\n        return jsonResult(data.roles);\n      } catch (error) {\n        ctx.logger.error('rbac_roles_list failed', { error: String(error) });\n        return errorResult(\n          `Failed to list roles: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_roles_get')),\n    {\n      title: 'Get Role',\n      description: 'Get a role by id from the workspace or global layer.',\n      inputSchema: {\n        id: z.string().describe('Role ID'),\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n      },\n    },\n    async ({ id, layer }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const data = await clientForLayer(ctx, targetLayer).request<{ role: unknown | null }>(\n          GET_ROLE,\n          { id },\n        );\n        if (!data.role) return errorResult(`Role ${id} not found`);\n        return jsonResult(data.role);\n      } catch (error) {\n        ctx.logger.error('rbac_roles_get failed', { error: String(error) });\n        return errorResult(\n          `Failed to get role: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_roles_create')),\n    {\n      title: 'Create Role',\n      description: 'Create a new RBAC role at the workspace or global layer.',\n      inputSchema: {\n        name: z.string().describe('Role name'),\n        description: z.string().optional().describe('Role description'),\n        parentId: z.string().optional().describe('Parent role id'),\n        priority: z.number().optional().describe('Priority'),\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n        scopeId: z.string().optional().describe('Override scope id'),\n        scopeType: z.string().optional().describe('wspace|entity (global layer only)'),\n      },\n    },\n    async ({ name, description, parentId, priority, layer, scopeId, scopeType }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);\n        if (!resolvedScope) {\n          return errorResult(\n            `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`,\n          );\n        }\n        const input: Record<string, unknown> = { name, scopeId: resolvedScope };\n        if (description !== undefined) input.description = description;\n        if (parentId !== undefined) input.parentId = parentId;\n        if (priority !== undefined) input.priority = priority;\n        if (targetLayer === 'global' && scopeType) input.scopeType = scopeType;\n        const data = await clientForLayer(ctx, targetLayer).request<{ createRole: unknown }>(\n          CREATE_ROLE,\n          { input },\n        );\n        return jsonResult(data.createRole);\n      } catch (error) {\n        ctx.logger.error('rbac_roles_create failed', { error: String(error) });\n        return errorResult(\n          `Failed to create role: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_roles_update')),\n    {\n      title: 'Update Role',\n      description: 'Update an existing role.',\n      inputSchema: {\n        id: z.string().describe('Role ID'),\n        name: z.string().optional().describe('Updated name'),\n        description: z.string().optional().describe('Updated description'),\n        priority: z.number().optional().describe('Updated priority'),\n        parentId: z.string().optional().describe('Updated parent role id'),\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n      },\n    },\n    async ({ id, name, description, priority, parentId, layer }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const input: Record<string, unknown> = {};\n        if (name !== undefined) input.name = name;\n        if (description !== undefined) input.description = description;\n        if (priority !== undefined) input.priority = priority;\n        if (parentId !== undefined) input.parentId = parentId;\n        if (!Object.keys(input).length) {\n          return errorResult('No updates specified');\n        }\n        const data = await clientForLayer(ctx, targetLayer).request<{ updateRole: unknown }>(\n          UPDATE_ROLE,\n          { id, input },\n        );\n        return jsonResult(data.updateRole);\n      } catch (error) {\n        ctx.logger.error('rbac_roles_update failed', { error: String(error) });\n        return errorResult(\n          `Failed to update role: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_roles_delete')),\n    {\n      title: 'Delete Role',\n      description: 'Delete a role, optionally reassigning actors to another role.',\n      inputSchema: {\n        id: z.string().describe('Role ID'),\n        reassignToRoleId: z.string().optional().describe('Reassign actors to this role'),\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n      },\n    },\n    async ({ id, reassignToRoleId, layer }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const data = await clientForLayer(ctx, targetLayer).request<{ deleteRole: unknown }>(\n          DELETE_ROLE,\n          { id, reassignToRoleId },\n        );\n        return jsonResult({ deleted: data.deleteRole, roleId: id });\n      } catch (error) {\n        ctx.logger.error('rbac_roles_delete failed', { error: String(error) });\n        return errorResult(\n          `Failed to delete role: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  // ── Policies ────────────────────────────────────────────────────────────\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_policies_list')),\n    {\n      title: 'List Policy References',\n      description:\n        'List OPA policy references registered on the chosen gateway (workspace or global), optionally filtered by resource/action/active state. Returns an array of PolicyReference.',\n      inputSchema: {\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n        resourceType: z.string().optional().describe('Filter by resource type (e.g. project)'),\n        action: z.string().optional().describe('Filter by action (e.g. read/write/delete)'),\n        isActive: z.boolean().optional().describe('Only active/inactive policies'),\n        limit: z.number().int().optional().describe('Page size (default 100)'),\n        offset: z.number().int().optional().describe('Pagination offset (default 0)'),\n      },\n    },\n    async ({ layer, resourceType, action, isActive, limit, offset }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const filter: Record<string, unknown> = {};\n        if (resourceType !== undefined) filter.resourceType = resourceType;\n        if (action !== undefined) filter.action = action;\n        if (isActive !== undefined) filter.isActive = isActive;\n        const data = await clientForLayer(ctx, targetLayer).request<{\n          policyReferences: unknown[];\n        }>(LIST_POLICY_REFERENCES, {\n          filter: Object.keys(filter).length ? filter : undefined,\n          pagination: { limit: limit ?? 100, offset: offset ?? 0 },\n        });\n        return jsonResult(data.policyReferences);\n      } catch (error) {\n        ctx.logger.error('rbac_policies_list failed', { error: String(error) });\n        return errorResult(\n          `Failed to list policy references: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_policies_attach')),\n    {\n      title: 'Attach Policy To Role',\n      description:\n        'Attach an OPA policy reference to a role on the chosen gateway. Returns the attached PolicyReference.',\n      inputSchema: {\n        roleId: z.string().describe('Role ID'),\n        policyId: z.string().describe('PolicyReference ID'),\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n      },\n    },\n    async ({ roleId, policyId, layer }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const data = await clientForLayer(ctx, targetLayer).request<{\n          attachPolicyToRole: unknown;\n        }>(ATTACH_POLICY, { roleId, policyId });\n        return jsonResult(data.attachPolicyToRole);\n      } catch (error) {\n        ctx.logger.error('rbac_policies_attach failed', { error: String(error) });\n        return errorResult(\n          `Failed to attach policy: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_policies_detach')),\n    {\n      title: 'Detach Policy From Role',\n      description:\n        'Detach an OPA policy reference from a role on the chosen gateway. Returns { detached: boolean, roleId, policyId }.',\n      inputSchema: {\n        roleId: z.string().describe('Role ID'),\n        policyId: z.string().describe('PolicyReference ID'),\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n      },\n    },\n    async ({ roleId, policyId, layer }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const data = await clientForLayer(ctx, targetLayer).request<{\n          detachPolicyFromRole: boolean;\n        }>(DETACH_POLICY, { roleId, policyId });\n        return jsonResult({ detached: data.detachPolicyFromRole, roleId, policyId });\n      } catch (error) {\n        ctx.logger.error('rbac_policies_detach failed', { error: String(error) });\n        return errorResult(\n          `Failed to detach policy: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'rbac_check')),\n    {\n      title: 'Check Permission',\n      description: 'Check whether an actor has permission for an action on a resource.',\n      inputSchema: {\n        actorId: z.string().describe('Actor id (user/app/service/super_admin)'),\n        action: z.string().describe('Action like read/write/delete'),\n        resourceType: z.string().describe('Resource type like project/task'),\n        actorType: ActorTypeEnum.optional().describe('Actor type (default: USER)'),\n        resourceId: z.string().optional().describe('Specific resource id (optional)'),\n        scopeId: z.string().optional().describe('Scope id (workspaceId or tenantId)'),\n        layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n      },\n    },\n    async ({ actorId, action, resourceType, actorType, resourceId, scopeId, layer }) => {\n      try {\n        const targetLayer: Layer = layer ?? 'workspace';\n        const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);\n        if (!resolvedScope) {\n          return errorResult(\n            `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`,\n          );\n        }\n        const input: Record<string, unknown> = {\n          actorId,\n          actorType: actorType ?? 'USER',\n          action,\n          resourceType,\n          scopeId: resolvedScope,\n        };\n        if (resourceId !== undefined) input.resourceId = resourceId;\n        const data = await clientForLayer(ctx, targetLayer).request<{ checkPermission: unknown }>(\n          CHECK_PERMISSION,\n          { input },\n        );\n        return jsonResult(data.checkPermission);\n      } catch (error) {\n        ctx.logger.error('rbac_check failed', { error: String(error) });\n        return errorResult(\n          `Failed to check permission: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n}\n","/**\n * RBAC module — role-based access control across workspace + global layers.\n *\n * Tools:\n *   <product>_rbac_roles_{list,get,create,update,delete}\n *   <product>_rbac_check\n *\n * Backend: ~/products/wspace/rbac/wspace-rbac-svc/, ~/products/global/rbac/global-rbac-svc/.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { McpContext, McpModule, ModuleRegistration } from '../../core/index.js';\nimport { registerRbacTools } from './tools.js';\n\nconst rbacModule: McpModule = {\n  id: 'rbac',\n  version: '0.0.1',\n  displayName: 'RBAC',\n  dependsOn: ['auth'],\n  capabilities: { tools: {} },\n\n  register(server: McpServer, ctx: McpContext): ModuleRegistration {\n    const tools: string[] = [];\n    const track = (n: string): string => {\n      tools.push(n);\n      return n;\n    };\n\n    registerRbacTools(server, ctx, track);\n\n    return { tools, resources: [], prompts: [] };\n  },\n};\n\nexport default rbacModule;\n"]}

package/dist/modules/rbac/index.js

@@ -1,4 +1,4 @@
-import { mcpToolName, errorResult, jsonResult } from '../../chunk-H2OYWLOA.js';
+import { mcpToolName, errorResult, jsonResult } from '../../chunk-YOSQUY3M.js';
 import { z } from 'zod';
 
 // src/modules/rbac/operations.ts

package/dist/modules/sandbox/index.cjs

@@ -18,20 +18,6 @@ var McpInternalError = class extends Error {
   }
 };
 
-// src/core/result.ts
-function jsonResult(data, structured) {
-  const result = {
-    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
-  };
-  return result;
-}
-function errorResult(message, hint) {
-  const text = hint ? `${message}
-
-Hint: ${hint}` : message;
-  return { content: [{ type: "text", text }], isError: true };
-}
-
 // src/core/tool-name.ts
 var MAX_TOOL_NAME_LENGTH = 63;
 function assertSafeName(name, kind) {
@@ -49,6 +35,20 @@ function mcpToolName(productName, ...parts) {
   const name = [productName, ...parts].filter(Boolean).join("_");
   return assertSafeName(name);
 }
+
+// src/core/result.ts
+function jsonResult(data, structured) {
+  const result = {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+  return result;
+}
+function errorResult(message, hint) {
+  const text = hint ? `${message}
+
+Hint: ${hint}` : message;
+  return { content: [{ type: "text", text }], isError: true };
+}
 var SANDBOX_FIELDS = `
   id name description template mode status
   crdName podName namespace runtimeClass