@burdenoff/mcp-libs 2026.908.2 → 2026.928.2

package/dist/modules/planmagnet/index.cjs

@@ -5,6 +5,7 @@ require('graphql-request');
 require('cross-fetch');
 require('@modelcontextprotocol/sdk/server/mcp.js');
 require('@modelcontextprotocol/sdk/types.js');
+var crypto = require('crypto');
 
 // src/modules/planmagnet/tools/projects.ts
 
@@ -193,9 +194,6 @@ var SYNC_RESULT_FIELDS = `
   syncId success itemsCreated itemsUpdated itemsSkipped errorCount errors
   durationMs syncedAt
 `;
-var UI_SESSION_FIELDS = `
-  id userId state metadata workspaceId createdAt updatedAt
-`;
 var GET_PROJECT = `
   query PlanmagnetProject($id: ID!) {
     planmagnetProject(id: $id) { ${PROJECT_FIELDS} }
@@ -1135,33 +1133,6 @@ var IMPORT_FROM_EXTERNAL = `
     planmagnetImportFromExternal(input: $input) { ${SYNC_RESULT_FIELDS} }
   }
 `;
-var GET_OR_CREATE_UI_SESSION = `
-  query PlanmagnetGetOrCreateUISession($workspaceId: ID!) {
-    planmagnetGetOrCreateUISession(workspaceId: $workspaceId) { ${UI_SESSION_FIELDS} }
-  }
-`;
-var LIST_UI_SESSIONS = `
-  query PlanmagnetUiSessions(
-    $workspaceId: ID!
-    $filter: PlanmagnetUISessionFilter
-    $pagination: PlanmagnetPaginationInput
-  ) {
-    planmagnetUiSessions(workspaceId: $workspaceId, filter: $filter, pagination: $pagination) {
-      items { ${UI_SESSION_FIELDS} }
-      ${PAGE_INFO}
-    }
-  }
-`;
-var UPDATE_UI_SESSION = `
-  mutation PlanmagnetUpdateUISession($input: PlanmagnetUISessionViewStateInput!) {
-    planmagnetUpdateUISession(input: $input) { ${UI_SESSION_FIELDS} }
-  }
-`;
-var DELETE_UI_SESSION = `
-  mutation PlanmagnetDeleteUISession($id: ID!) {
-    planmagnetDeleteUISession(id: $id)
-  }
-`;
 var JsonObject = zod.z.record(zod.z.string(), zod.z.unknown());
 var JsonValue = zod.z.union([JsonObject, zod.z.array(zod.z.unknown())]);
 var paginationInputShape = {
@@ -5827,101 +5798,80 @@ function registerSyncTools(server, ctx, track) {
     }
   );
 }
-function registerUiSessionTools(server, ctx, track) {
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "ui_sessions_list")),
-    {
-      title: "List UI Sessions",
-      description: "List persisted UI sessions for the current user in a workspace.",
-      inputSchema: {
-        workspaceId: zod.z.string().describe("Workspace ID (required)"),
-        userId: zod.z.string().optional().describe("Filter by user actor ID"),
-        ...paginationInputShape
-      }
-    },
-    async ({ workspaceId, userId, first, after }) => {
-      try {
-        const filter = {};
-        if (userId !== void 0) filter.userId = userId;
-        const data = await ctx.gql.workspace.request(LIST_UI_SESSIONS, {
-          workspaceId,
-          filter: Object.keys(filter).length > 0 ? filter : void 0,
-          pagination: buildPagination(first, after)
-        });
-        return jsonResult(data.planmagnetUiSessions);
-      } catch (error) {
-        ctx.logger.error("planmagnet ui_sessions_list failed", { error: String(error) });
-        return errorResult(
-          `Failed to list UI sessions: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "ui_sessions_get_or_create")),
-    {
-      title: "Get or Create UI Session",
-      description: "Get (or lazily create) the UI session for the current user in a workspace.",
-      inputSchema: { workspaceId: zod.z.string().describe("Workspace ID (required)") }
-    },
-    async ({ workspaceId }) => {
-      try {
-        const data = await ctx.gql.workspace.request(GET_OR_CREATE_UI_SESSION, { workspaceId });
-        return jsonResult(data.planmagnetGetOrCreateUISession);
-      } catch (error) {
-        ctx.logger.error("planmagnet ui_sessions_get_or_create failed", { error: String(error) });
-        return errorResult(
-          `Failed to get/create UI session: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "ui_sessions_update")),
-    {
-      title: "Update UI Session",
-      description: "Update the current user\u2019s UI-session view state.",
-      inputSchema: {
-        viewState: JsonValue.describe("Persisted view state JSON (filters, columns, sort, \u2026)"),
-        metadata: JsonObject.optional().describe("Arbitrary metadata JSON")
-      }
-    },
-    async ({ viewState, metadata }) => {
-      try {
-        const input = { viewState };
-        if (metadata !== void 0) input.metadata = metadata;
-        const data = await ctx.gql.workspace.request(UPDATE_UI_SESSION, { input });
-        return jsonResult(data.planmagnetUpdateUISession);
-      } catch (error) {
-        ctx.logger.error("planmagnet ui_sessions_update failed", { error: String(error) });
-        return errorResult(
-          `Failed to update UI session: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "ui_sessions_delete")),
-    {
-      title: "Delete UI Session",
-      description: "Delete a UI session by ID.",
-      inputSchema: { id: zod.z.string().describe("UI session ID") }
-    },
-    async ({ id }) => {
-      try {
-        const data = await ctx.gql.workspace.request(
-          DELETE_UI_SESSION,
-          { id }
-        );
-        return jsonResult({ id, deleted: data.planmagnetDeleteUISession });
-      } catch (error) {
-        ctx.logger.error("planmagnet ui_sessions_delete failed", { error: String(error) });
-        return errorResult(
-          `Failed to delete UI session: ${error instanceof Error ? error.message : String(error)}`
-        );
+var DESTRUCTIVE_TOOL = /_(delete|remove|unlink)(_|$)/;
+var SALT = crypto.randomBytes(16).toString("hex");
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a.localeCompare(b));
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function confirmTokenFor(tool, args) {
+  return crypto.createHash("sha256").update(`${SALT}|${tool}|${canonical(args)}`).digest("hex").slice(0, 16);
+}
+function gateDestructiveTools(server) {
+  const register = server.registerTool.bind(server);
+  const gated = (name, config, handler) => {
+    if (!DESTRUCTIVE_TOOL.test(name)) return register(name, config, handler);
+    const declared = config;
+    if (declared.inputSchema instanceof zod.z.ZodType) {
+      throw new Error(`${name}: destructive tools must declare inputSchema as a raw zod shape`);
+    }
+    const annotations = { ...declared.annotations, destructiveHint: true, readOnlyHint: false };
+    const inputSchema = {
+      ...declared.inputSchema ?? {},
+      confirmToken: zod.z.string().optional().describe(
+        "Leave empty to preview (nothing changes). To act, pass the confirmToken from the preview of these exact arguments."
+      )
+    };
+    const description = `${declared.description ?? ""} DESTRUCTIVE: the first call only previews and returns a confirmToken; call again with the same arguments and that token to proceed.`.trim();
+    return register(
+      name,
+      // Cast: the SDK's config type is generic over the schema; the gate adds one optional field, a sentence and
+      // the destructive annotations.
+      {
+        ...config,
+        description,
+        inputSchema,
+        annotations
+      },
+      (args, extra) => {
+        const { confirmToken, ...rest } = args;
+        const token = confirmTokenFor(name, rest);
+        if (confirmToken !== token) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(
+                  {
+                    dryRun: true,
+                    tool: name,
+                    arguments: rest,
+                    wouldDo: declared.description ?? name,
+                    confirmToken: token,
+                    note: confirmToken === void 0 ? "Nothing was changed. To proceed, call this tool again with the same arguments and this confirmToken." : "Nothing was changed: the confirmToken does not match these arguments. Review this preview and confirm with the new token."
+                  },
+                  null,
+                  2
+                )
+              }
+            ]
+          };
+        }
+        return handler(rest, extra);
       }
+    );
+  };
+  return new Proxy(server, {
+    get(target, prop, receiver) {
+      if (prop === "registerTool") return gated;
+      const value = Reflect.get(target, prop, receiver);
+      return typeof value === "function" ? value.bind(target) : value;
     }
-  );
+  });
 }
 
 // src/modules/planmagnet/resources.ts
@@ -5963,7 +5913,6 @@ Portfolio > Program > Project > (Work Items, Sprints, Boards, Milestones, \u2026
 - CustomFieldDefinition (+CustomFieldValue) \u2014 extensible fields
 - ProjectTemplate \u2014 reusable blueprints
 - ExternalSync (+ExternalMapping) \u2014 integrations (Jira, GitHub, Linear, \u2026)
-- PlanmagnetUISession \u2014 persisted per-user view state
 
 ## Key enums
 - WorkItemType: BUG, EPIC, STORY, SUB_TASK, TASK
@@ -6141,24 +6090,24 @@ var planmagnetModule = {
       prompts.push(n);
       return n;
     };
-    registerProjectTools(server, ctx, trackTool);
-    registerWorkItemTools(server, ctx, trackTool);
-    registerSprintTools(server, ctx, trackTool);
-    registerBoardTools(server, ctx, trackTool);
-    registerMilestoneTools(server, ctx, trackTool);
-    registerDependencyTools(server, ctx, trackTool);
-    registerBudgetTools(server, ctx, trackTool);
-    registerRiskTools(server, ctx, trackTool);
-    registerReleaseTools(server, ctx, trackTool);
-    registerQualityGateTools(server, ctx, trackTool);
-    registerRoadmapTools(server, ctx, trackTool);
-    registerTimeTrackingTools(server, ctx, trackTool);
-    registerAutomationTools(server, ctx, trackTool);
-    registerFeatureTools(server, ctx, trackTool);
-    registerCustomFieldTools(server, ctx, trackTool);
-    registerTemplateTools(server, ctx, trackTool);
-    registerSyncTools(server, ctx, trackTool);
-    registerUiSessionTools(server, ctx, trackTool);
+    const toolServer = gateDestructiveTools(server);
+    registerProjectTools(toolServer, ctx, trackTool);
+    registerWorkItemTools(toolServer, ctx, trackTool);
+    registerSprintTools(toolServer, ctx, trackTool);
+    registerBoardTools(toolServer, ctx, trackTool);
+    registerMilestoneTools(toolServer, ctx, trackTool);
+    registerDependencyTools(toolServer, ctx, trackTool);
+    registerBudgetTools(toolServer, ctx, trackTool);
+    registerRiskTools(toolServer, ctx, trackTool);
+    registerReleaseTools(toolServer, ctx, trackTool);
+    registerQualityGateTools(toolServer, ctx, trackTool);
+    registerRoadmapTools(toolServer, ctx, trackTool);
+    registerTimeTrackingTools(toolServer, ctx, trackTool);
+    registerAutomationTools(toolServer, ctx, trackTool);
+    registerFeatureTools(toolServer, ctx, trackTool);
+    registerCustomFieldTools(toolServer, ctx, trackTool);
+    registerTemplateTools(toolServer, ctx, trackTool);
+    registerSyncTools(toolServer, ctx, trackTool);
     registerPlanmagnetResources(server, ctx, trackResource);
     registerPlanmagnetPrompts(server, ctx, trackPrompt);
     return { tools, resources, prompts };