@burdenoff/mcp-libs 2026.819.1 → 2026.820.1

package/dist/modules/mybodyshield/index.cjs

@@ -378,7 +378,8 @@ function registerProgramTools(server, ctx, track) {
     {
       title: "Get Training Program",
       description: "Fetch a single Mybodyshield training program by ID, including its nested workouts and exercises.",
-      inputSchema: { id: zod.z.string().describe("Program ID") }
+      inputSchema: { id: zod.z.string().describe("Program ID") },
+      annotations: { readOnlyHint: true }
     },
     async ({ id }) => {
       try {
@@ -404,7 +405,8 @@ function registerProgramTools(server, ctx, track) {
         limit: zod.z.number().int().optional().describe("Page size (default 50)"),
         offset: zod.z.number().int().optional().describe("Pagination offset (default 0)"),
         cursor: zod.z.string().optional().describe("Opaque pagination cursor")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ memberId, status, limit, offset, cursor }) => {
       try {
@@ -598,7 +600,8 @@ function registerWorkoutTools(server, ctx, track) {
     {
       title: "List Program Workouts",
       description: "List the workouts for a program (ordered), each with its nested exercises.",
-      inputSchema: { programId: zod.z.string().describe("Program ID") }
+      inputSchema: { programId: zod.z.string().describe("Program ID") },
+      annotations: { readOnlyHint: true }
     },
     async ({ programId }) => {
       try {
@@ -713,7 +716,8 @@ function registerSessionTools(server, ctx, track) {
     {
       title: "Get Workout Session",
       description: "Fetch a single workout session by ID, including its logged sets.",
-      inputSchema: { id: zod.z.string().describe("Workout session ID") }
+      inputSchema: { id: zod.z.string().describe("Workout session ID") },
+      annotations: { readOnlyHint: true }
     },
     async ({ id }) => {
       try {
@@ -739,7 +743,8 @@ function registerSessionTools(server, ctx, track) {
         limit: zod.z.number().int().optional().describe("Page size (default 50)"),
         offset: zod.z.number().int().optional().describe("Pagination offset (default 0)"),
         cursor: zod.z.string().optional().describe("Opaque pagination cursor")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ programId, status, limit, offset, cursor }) => {
       try {
@@ -865,7 +870,8 @@ function registerNutritionTools(server, ctx, track) {
     {
       title: "Get Nutrition Plan",
       description: "Fetch a single nutrition plan by ID, including its logged meals.",
-      inputSchema: { id: zod.z.string().describe("Nutrition plan ID") }
+      inputSchema: { id: zod.z.string().describe("Nutrition plan ID") },
+      annotations: { readOnlyHint: true }
     },
     async ({ id }) => {
       try {
@@ -887,7 +893,8 @@ function registerNutritionTools(server, ctx, track) {
       description: "Fetch the active nutrition plan for a member (defaults to the calling actor when memberId is omitted). Returns null when there's no active plan.",
       inputSchema: {
         memberId: zod.z.string().optional().describe("Member (user) ID (default: calling actor)")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ memberId }) => {
       try {
@@ -1016,7 +1023,11 @@ function registerNutritionTools(server, ctx, track) {
     {
       title: "Activate Nutrition Plan",
       description: "Make a nutrition plan the active plan for its member (deactivating any other active plan).",
-      inputSchema: { id: zod.z.string().describe("Nutrition plan ID") }
+      inputSchema: { id: zod.z.string().describe("Nutrition plan ID") },
+      // BOFF-3859: activation implicitly deactivates the prior active plan, so
+      // this is a destructive side-effect mutation despite the absence of a
+      // `delete` segment in the tool name.
+      annotations: { destructiveHint: true }
     },
     async ({ id }) => {
       try {
@@ -1038,7 +1049,8 @@ function registerNutritionTools(server, ctx, track) {
       inputSchema: {
         memberId: zod.z.string().optional().describe("Member (user) ID (default: calling actor)"),
         date: zod.z.string().optional().describe("Day to roll up (ISO-8601 DateTime; default: today)")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ memberId, date }) => {
       try {
@@ -1065,7 +1077,8 @@ function registerMealTools(server, ctx, track) {
         limit: zod.z.number().int().optional().describe("Page size (default 50)"),
         offset: zod.z.number().int().optional().describe("Pagination offset (default 0)"),
         cursor: zod.z.string().optional().describe("Opaque pagination cursor")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ planId, mealType, limit, offset, cursor }) => {
       try {
@@ -1139,7 +1152,11 @@ function registerMealTools(server, ctx, track) {
     {
       title: "Delete Meal Log",
       description: "Delete a logged meal by ID. Returns true on success.",
-      inputSchema: { id: zod.z.string().describe("Meal log ID") }
+      inputSchema: { id: zod.z.string().describe("Meal log ID") },
+      // BOFF-3859: hard delete of a logged meal. The name heuristic already
+      // treats `*_delete` as destructive, but we declare it explicitly for the
+      // audit trail.
+      annotations: { destructiveHint: true }
     },
     async ({ id }) => {
       try {
@@ -1162,7 +1179,8 @@ function registerGoalTools(server, ctx, track) {
     {
       title: "Get Goal",
       description: "Fetch a single goal by ID.",
-      inputSchema: { id: zod.z.string().describe("Goal ID") }
+      inputSchema: { id: zod.z.string().describe("Goal ID") },
+      annotations: { readOnlyHint: true }
     },
     async ({ id }) => {
       try {
@@ -1188,7 +1206,8 @@ function registerGoalTools(server, ctx, track) {
         limit: zod.z.number().int().optional().describe("Page size (default 50)"),
         offset: zod.z.number().int().optional().describe("Pagination offset (default 0)"),
         cursor: zod.z.string().optional().describe("Opaque pagination cursor")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ memberId, status, limit, offset, cursor }) => {
       try {
@@ -1336,7 +1355,8 @@ function registerMetricTools(server, ctx, track) {
         limit: zod.z.number().int().optional().describe("Page size (default 50)"),
         offset: zod.z.number().int().optional().describe("Pagination offset (default 0)"),
         cursor: zod.z.string().optional().describe("Opaque pagination cursor")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ memberId, type, limit, offset, cursor }) => {
       try {
@@ -1397,7 +1417,8 @@ function registerRecoveryTools(server, ctx, track) {
       inputSchema: {
         memberId: zod.z.string().optional().describe("Filter by member (user) ID"),
         metric: RecoveryMetricEnum.optional().describe("Filter by recovery metric")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ memberId, metric }) => {
       try {
@@ -1454,7 +1475,8 @@ function registerCoachingTools(server, ctx, track) {
       inputSchema: {
         memberId: zod.z.string().optional().describe("Filter by member (user) ID"),
         status: CoachingStatusEnum.optional().describe("Filter by coaching status")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ memberId, status }) => {
       try {
@@ -1540,7 +1562,8 @@ function registerHealthTools(server, ctx, track) {
     {
       title: "Mybodyshield Health Check",
       description: "Public liveness/identity probe for the Mybodyshield subgraph (mybHealth). Requires no authentication.",
-      inputSchema: {}
+      inputSchema: {},
+      annotations: { readOnlyHint: true }
     },
     async () => {
       try {