@burdenoff/mcp-libs 2026.719.2 → 2026.720.2

package/dist/modules/mybodyshield/index.js

@@ -507,7 +507,13 @@ function registerProgramTools(server, ctx, track) {
     {
       title: "Archive Training Program",
       description: "Archive a training program by ID. Returns true on success.",
-      inputSchema: { id: z.string().describe("Program ID") }
+      inputSchema: { id: z.string().describe("Program ID") },
+      // BOFF-3859: ARCHIVED is a terminal lifecycle state (no transition back
+      // out per training.service.ts's PROGRAM_TRANSITIONS) and the resolver
+      // sets `deletedAt` — this is an irreversible soft-delete, not a naming
+      // pattern (`inferDestructiveHint` only matches `delete`), so it must be
+      // declared explicitly to be caught by the confirmation gate.
+      annotations: { destructiveHint: true }
     },
     async ({ id }) => {
       try {
@@ -1413,7 +1419,13 @@ function registerCoachingTools(server, ctx, track) {
         shareWorkouts: z.boolean().optional().describe("Share workout data with the coach"),
         shareNutrition: z.boolean().optional().describe("Share nutrition data with the coach"),
         shareMetrics: z.boolean().optional().describe("Share body-metric data with the coach")
-      }
+      },
+      // BOFF-3859: grants a third party (the coach) read access to a
+      // member's health data via the share* flags. Not a naming-pattern
+      // match for `inferDestructiveHint` (no "delete"), but it is exactly
+      // the class of health-data-governance mutation the confirmation gate
+      // exists for — declared explicitly rather than left ungated.
+      annotations: { destructiveHint: true }
     },
     async ({ coachId, memberId, specialty, shareWorkouts, shareNutrition, shareMetrics }) => {
       try {
@@ -1440,7 +1452,11 @@ function registerCoachingTools(server, ctx, track) {
       inputSchema: {
         id: z.string().describe("Coaching relationship ID"),
         status: CoachingStatusEnum.describe("Target coaching status")
-      }
+      },
+      // BOFF-3859: activates or revokes a coach's access to shared health
+      // data (ENDED is a terminal state per COACHING_TRANSITIONS) — same
+      // health-data-governance rationale as coaching_create above.
+      annotations: { destructiveHint: true }
     },
     async ({ id, status }) => {
       try {