@burdenoff/mcp-libs 2026.819.1 → 2026.820.1

package/dist/modules/mybodyshield/index.js

@@ -317,7 +317,8 @@ function registerProgramTools(server, ctx, track) {
     {
       title: "Get Training Program",
       description: "Fetch a single Mybodyshield training program by ID, including its nested workouts and exercises.",
-      inputSchema: { id: z.string().describe("Program ID") }
+      inputSchema: { id: z.string().describe("Program ID") },
+      annotations: { readOnlyHint: true }
     },
     async ({ id }) => {
       try {
@@ -343,7 +344,8 @@ function registerProgramTools(server, ctx, track) {
         limit: z.number().int().optional().describe("Page size (default 50)"),
         offset: z.number().int().optional().describe("Pagination offset (default 0)"),
         cursor: z.string().optional().describe("Opaque pagination cursor")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ memberId, status, limit, offset, cursor }) => {
       try {
@@ -537,7 +539,8 @@ function registerWorkoutTools(server, ctx, track) {
     {
       title: "List Program Workouts",
       description: "List the workouts for a program (ordered), each with its nested exercises.",
-      inputSchema: { programId: z.string().describe("Program ID") }
+      inputSchema: { programId: z.string().describe("Program ID") },
+      annotations: { readOnlyHint: true }
     },
     async ({ programId }) => {
       try {
@@ -652,7 +655,8 @@ function registerSessionTools(server, ctx, track) {
     {
       title: "Get Workout Session",
       description: "Fetch a single workout session by ID, including its logged sets.",
-      inputSchema: { id: z.string().describe("Workout session ID") }
+      inputSchema: { id: z.string().describe("Workout session ID") },
+      annotations: { readOnlyHint: true }
     },
     async ({ id }) => {
       try {
@@ -678,7 +682,8 @@ function registerSessionTools(server, ctx, track) {
         limit: z.number().int().optional().describe("Page size (default 50)"),
         offset: z.number().int().optional().describe("Pagination offset (default 0)"),
         cursor: z.string().optional().describe("Opaque pagination cursor")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ programId, status, limit, offset, cursor }) => {
       try {
@@ -804,7 +809,8 @@ function registerNutritionTools(server, ctx, track) {
     {
       title: "Get Nutrition Plan",
       description: "Fetch a single nutrition plan by ID, including its logged meals.",
-      inputSchema: { id: z.string().describe("Nutrition plan ID") }
+      inputSchema: { id: z.string().describe("Nutrition plan ID") },
+      annotations: { readOnlyHint: true }
     },
     async ({ id }) => {
       try {
@@ -826,7 +832,8 @@ function registerNutritionTools(server, ctx, track) {
       description: "Fetch the active nutrition plan for a member (defaults to the calling actor when memberId is omitted). Returns null when there's no active plan.",
       inputSchema: {
         memberId: z.string().optional().describe("Member (user) ID (default: calling actor)")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ memberId }) => {
       try {
@@ -955,7 +962,11 @@ function registerNutritionTools(server, ctx, track) {
     {
       title: "Activate Nutrition Plan",
       description: "Make a nutrition plan the active plan for its member (deactivating any other active plan).",
-      inputSchema: { id: z.string().describe("Nutrition plan ID") }
+      inputSchema: { id: z.string().describe("Nutrition plan ID") },
+      // BOFF-3859: activation implicitly deactivates the prior active plan, so
+      // this is a destructive side-effect mutation despite the absence of a
+      // `delete` segment in the tool name.
+      annotations: { destructiveHint: true }
     },
     async ({ id }) => {
       try {
@@ -977,7 +988,8 @@ function registerNutritionTools(server, ctx, track) {
       inputSchema: {
         memberId: z.string().optional().describe("Member (user) ID (default: calling actor)"),
         date: z.string().optional().describe("Day to roll up (ISO-8601 DateTime; default: today)")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ memberId, date }) => {
       try {
@@ -1004,7 +1016,8 @@ function registerMealTools(server, ctx, track) {
         limit: z.number().int().optional().describe("Page size (default 50)"),
         offset: z.number().int().optional().describe("Pagination offset (default 0)"),
         cursor: z.string().optional().describe("Opaque pagination cursor")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ planId, mealType, limit, offset, cursor }) => {
       try {
@@ -1078,7 +1091,11 @@ function registerMealTools(server, ctx, track) {
     {
       title: "Delete Meal Log",
       description: "Delete a logged meal by ID. Returns true on success.",
-      inputSchema: { id: z.string().describe("Meal log ID") }
+      inputSchema: { id: z.string().describe("Meal log ID") },
+      // BOFF-3859: hard delete of a logged meal. The name heuristic already
+      // treats `*_delete` as destructive, but we declare it explicitly for the
+      // audit trail.
+      annotations: { destructiveHint: true }
     },
     async ({ id }) => {
       try {
@@ -1101,7 +1118,8 @@ function registerGoalTools(server, ctx, track) {
     {
       title: "Get Goal",
       description: "Fetch a single goal by ID.",
-      inputSchema: { id: z.string().describe("Goal ID") }
+      inputSchema: { id: z.string().describe("Goal ID") },
+      annotations: { readOnlyHint: true }
     },
     async ({ id }) => {
       try {
@@ -1127,7 +1145,8 @@ function registerGoalTools(server, ctx, track) {
         limit: z.number().int().optional().describe("Page size (default 50)"),
         offset: z.number().int().optional().describe("Pagination offset (default 0)"),
         cursor: z.string().optional().describe("Opaque pagination cursor")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ memberId, status, limit, offset, cursor }) => {
       try {
@@ -1275,7 +1294,8 @@ function registerMetricTools(server, ctx, track) {
         limit: z.number().int().optional().describe("Page size (default 50)"),
         offset: z.number().int().optional().describe("Pagination offset (default 0)"),
         cursor: z.string().optional().describe("Opaque pagination cursor")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ memberId, type, limit, offset, cursor }) => {
       try {
@@ -1336,7 +1356,8 @@ function registerRecoveryTools(server, ctx, track) {
       inputSchema: {
         memberId: z.string().optional().describe("Filter by member (user) ID"),
         metric: RecoveryMetricEnum.optional().describe("Filter by recovery metric")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ memberId, metric }) => {
       try {
@@ -1393,7 +1414,8 @@ function registerCoachingTools(server, ctx, track) {
       inputSchema: {
         memberId: z.string().optional().describe("Filter by member (user) ID"),
         status: CoachingStatusEnum.optional().describe("Filter by coaching status")
-      }
+      },
+      annotations: { readOnlyHint: true }
     },
     async ({ memberId, status }) => {
       try {
@@ -1479,7 +1501,8 @@ function registerHealthTools(server, ctx, track) {
     {
       title: "Mybodyshield Health Check",
       description: "Public liveness/identity probe for the Mybodyshield subgraph (mybHealth). Requires no authentication.",
-      inputSchema: {}
+      inputSchema: {},
+      annotations: { readOnlyHint: true }
     },
     async () => {
       try {