@cyanheads/brapi-mcp-server 0.3.5

package/changelog/0.2.x/0.2.0.md

@@ -0,0 +1,35 @@
+---
+summary: "Read-side surface expansion — 11 new tools (variables, observations, images, genotype calls, locations, variants, pedigree walks, dataset lifecycle, raw passthrough) plus OntologyResolver and binary image fetch."
+breaking: false
+---
+
+# 0.2.0 — 2026-04-23
+
+Fills out the read-side BrAPI surface. The orient + studies/germplasm trio from 0.1.1 is joined by variables, observations, images, locations, variants, genotype calls, pedigree DAG walks, a dataset lifecycle tool, and raw-endpoint escape hatches. Tool count: 7 → 18.
+
+## Added
+
+- **Pedigree traversal** — `brapi_walk_pedigree` BFS-walks germplasm ancestry or descendancy as a deduplicated DAG. BrAPI only exposes one generation per call; this tool handles cycle detection, depth limits (default 3, cap 10), and a 1000-node safety cap. Up to 20 roots per call, each walked concurrently. Returns nodes + edges plus traversal stats (`depthReached`, `leafCount`, `cycleCount`, `deadEndCount`, `truncated`).
+- **Observation variables** — `brapi_find_variables` with free-text ranking via the new `OntologyResolver` service (`src/services/ontology-resolver/`). Scores variable records against a query across PUI / name / synonym / trait-class / trait description and surfaces the top 10 candidates alongside the full result set. Falls back to substring matching when the server doesn't expose `/ontologies`.
+- **Observations** — `brapi_find_observations` with filters for study, germplasm, variable, season, observation unit, observation level, timestamp range, program, and trial. Distributions across variable / study / germplasm / level / season; dataset spillover on the standard `find_*` pattern.
+- **Images** — `brapi_find_images` (metadata only, distributions across MIME type / study / observation unit / ontology terms) and `brapi_get_image` (fetch bytes inline as `type: image` content blocks, up to 5 images per call, 20 MB per image). `get_image` prefers `/images/{id}/imagecontent` and falls back to the `imageURL` metadata field; relative URLs resolve against the registered base URL, absolute URLs pass through without auth.
+- **Locations** — `brapi_find_locations` with filters for country / type / abbreviation / ID and an optional client-side bounding-box filter (BrAPI has no spec-level bbox). All four corners required to activate; mismatched ranges produce a warning and the filter is skipped.
+- **Variants** — `brapi_find_variants` with genomic-region filters (1-based inclusive `start` / exclusive `end` per the BrAPI spec). Distributions across `variantType`, `referenceName`, `variantSetDbId`.
+- **Genotype calls** — `brapi_find_genotype_calls` handles the async-search pattern (`POST /search/calls` → `GET /search/calls/{id}` with 202-retry) transparently. Default cap of 100k calls per call, hard cap of 500k. Rows beyond `loadLimit` spill to `DatasetStore` for export. Server-reported genotype-encoding hints (`expandHomozygotes`, `unknownString`, `sepPhased`, `sepUnphased`) are echoed so the agent can interpret the values. Requires at least one filter — unfiltered pulls are rejected at the input boundary.
+- **Dataset lifecycle** — `brapi_manage_dataset` consolidates list / summary / load / delete operations against `DatasetStore`. `mode: load` supports paged rows (up to 1000 per page) and optional column projection. Export (CSV / Parquet) remains deferred until a storage write path lands.
+- **Raw passthroughs** — `brapi_raw_get` (any BrAPI GET) and `brapi_raw_search` (any BrAPI `POST /search/{noun}` with async polling) for niche endpoints the curated tools don't cover. Both emit a `suggestion` field routing to the goal-shaped tool when one exists — e.g. `raw_get /studies` nudges to `brapi_find_studies`. `raw_get` blocks absolute URLs in `path` to prevent cross-origin smuggling via the registered base URL.
+- **`OntologyResolver` service** (`src/services/ontology-resolver/`) — stateless scorer ranking `VariableLike` records against a query. PUI exact match (100) > name exact (90) > name substring (60) > variable synonym (50) > trait synonym (40) > trait name (35) > trait class exact (30) > trait description (20). Swappable backend — an embedding-backed implementation can replace this one without changing the tool surface.
+- **Binary fetch** on `BrapiClient` — new `getBinary()` honors the same retry policy as `get()` and threads the private-IP guard; `fetchBinaryUrl()` pulls arbitrary URLs (e.g. CDN-backed `imageURL`) without attaching auth. Both return a `BinaryResponse` (`{ bytes, contentType }`).
+- **Shared routing hints** (`src/mcp-server/tools/shared/raw-routing-hints.ts`) — centralized map from path segment / search noun to the curated-tool suggestion, powering `raw_get` / `raw_search`.
+
+## Changed
+
+- **`find-helpers.ts`** — extracted shared utilities previously duplicated between `brapi_find_studies` and `brapi_find_germplasm`:
+  - `DatasetHandleSchema` + `toDatasetHandle()` — the in-context dataset handle shape (drops provenance fields available via `brapi_manage_dataset summary`).
+  - `maybeSpill()` — wraps `spillToDataset()` with the "only spill when `hasMore` and `totalCount > loadLimit`" guard. All nine `find_*` tools use it.
+  - `asString()`, `asStringArray()`, `buildRefinementHint()` — scalar / array coercion and the refinement-hint heuristic (pick the highest-cardinality non-empty distribution).
+  - `brapi_find_studies` and `brapi_find_germplasm` slimmed down to use the extracted helpers; the two files dropped ~100 lines of duplication.
+- **`src/index.ts`** — registers 11 new tools and calls `initOntologyResolver()` in `setup()`.
+- **`README.md`** — tool count 7 → 18, tool tables regrouped by axis (orient / retrieve / orchestrate / escape hatches), per-tool sections added for every new tool, BrAPI-specific feature bullets expanded (async-search transparency, pedigree DAG walks, image content, free-text variable ranking, last-resort escape hatches), project-structure table gains `ontology-resolver`.
+- **`CLAUDE.md`** — structure section updated with all 18 tool files and the `ontology-resolver` service.
+- **`docs/tree.md`** — regenerated to reflect the new files.

package/changelog/0.2.x/0.2.1.md

@@ -0,0 +1,36 @@
+---
+summary: "Framework bump to @cyanheads/mcp-ts-core 0.6.16 — recursive describe-on-fields linting, synced skills, and .describe() coverage on every nested field, array element, and union variant across the 18-tool surface."
+breaking: false
+---
+
+# 0.2.1 — 2026-04-24
+
+Housekeeping release. Tracks the `@cyanheads/mcp-ts-core` 0.6.16 linter upgrade, syncs the external skills bundle, and resolves every new `describe-on-fields` warning surfaced by the recursive schema walk. No runtime behavior changes; no new tools.
+
+## Changed
+
+- **`@cyanheads/mcp-ts-core`** bumped to `^0.6.16`. Notable upstream changes the server adopts:
+  - `describe-on-fields` linter now recurses into nested objects, array element types, and union variants (previously top-level only). Diagnostic path syntax: `.key`, `[]`, `|<i>`.
+  - Resource `output` schemas now lint through `checkFieldDescriptions` (no-op here — no resources yet).
+  - `maintenance` skill gains Phase C (content-hash sync of framework scripts into `scripts/`).
+  - `add-tool` + `design-mcp-server` skills add "seed orientation context" guidance (the `brapi_connect` envelope already implements this pattern).
+  - `setup` + `polish-docs-meta` skills add guardrails against editing synced SKILL.md files directly.
+- **Synced skills** (`skills/add-tool`, `skills/design-mcp-server`, `skills/maintenance`, `skills/polish-docs-meta`, `skills/setup`) — overwritten by content since the package did not bump the embedded `metadata.version` fields. `.claude/skills/` mirror refreshed via Phase B.
+- **Schema `.describe()` coverage** — resolved every new warning (360 → 0) across the 18-tool surface:
+  - Row schemas for every `find_*` tool carry a container describe plus field describes — Study, Germplasm, Observation, Image, Location, Variant, GenotypeCall, Variable rows.
+  - Nested sub-objects in variables (trait / scale / method), genotype calls (`genotype.values` + `callFormatting`), images, synonyms, and related records.
+  - `brapi_manage_dataset` discriminated-union variants (ListResult / SummaryResult / LoadResult / DeleteResult) each carry their own describe.
+  - `DatasetHandleSchema` fields in `find-helpers.ts`.
+  - `ConnectAuthSchema` union variants (none / bearer / api_key / sgn / oauth2); oauth2 gains `clientId` / `clientSecret` / `tokenUrl` describes.
+  - `OrientationEnvelope` array element describes (supported services, notable gaps, crops, notes).
+  - `brapi_find_locations.bbox.{minLat,maxLat,minLon,maxLon}` describes.
+  - `brapi_raw_get` / `brapi_raw_search` `PaginationSchema` field describes.
+  - `brapi_get_germplasm` Parent / Attribute and `brapi_get_image` Payload / Error container describes.
+  - Distribution maps (`z.record`) on every `find_*` tool describe what the count represents.
+  - `brapi_describe_filters` `FilterDescriptorSchema` container describe.
+- Biome auto-formatted 7 files during the lint pass (line wrapping); no semantic changes.
+
+## Verified
+
+- `bun run lint:mcp` — `All definitions valid.` (was 360 warnings pre-bump)
+- `bun run test` — 101/101 pass

package/changelog/0.3.x/0.3.0.md

@@ -0,0 +1,38 @@
+---
+summary: "Surface complete — adds brapi_submit_observations write tool, six brapi:// resources, two workflow prompts (eda_study, meta_analysis), POST/PUT methods on BrapiClient, and full test backfill (101 → 191 tests)."
+breaking: false
+---
+
+# 0.3.0 — 2026-04-25
+
+Closes the MVP design surface from `docs/design.md`. The read side (18 tools, 6 services) shipped in 0.1.x / 0.2.x; this release adds the only write tool, the additive resource layer for URI-addressable clients, two workflow prompts that package the canonical multi-step BrAPI flows, and backfills tests for every untested handler.
+
+## Added
+
+- **`brapi_submit_observations` tool** — additive write surface for observation rows. Two-phase: `mode: preview` (default) validates rows against the study's `observationvariables` and reports a `routing` breakdown (POST for new, PUT for rows carrying `observationDbId`); `mode: apply` elicits user confirmation via `ctx.elicit`, fans the rows out to POST + PUT in parallel, then re-probes `studies/{id}/observations?pageSize=0` to return the post-write total. Apply requires `ctx.elicit` support OR an explicit `force: true` flag (rejected with `Forbidden` otherwise). Per-row warnings flag unknown variables, empty values, and missing FK fields. Auth scope: `brapi:write:observations`.
+- **Six MCP resources** under the `brapi://` scheme — additive layer for URI-addressable clients. Each mirrors an existing tool's payload through the default connection:
+  - `brapi://server/info` — orientation envelope (mirror of `brapi_server_info`).
+  - `brapi://calls` — raw capability profile from `CapabilityRegistry`.
+  - `brapi://study/{studyDbId}` — single study with FKs resolved (mirror of `brapi_get_study`).
+  - `brapi://germplasm/{germplasmDbId}` — single germplasm with attributes + parents (mirror of `brapi_get_germplasm`).
+  - `brapi://dataset/{datasetId}` — dataset metadata + provenance (rows via `brapi_manage_dataset`).
+  - `brapi://filters/{endpoint}` — static filter catalog (mirror of `brapi_describe_filters`).
+- **Two MCP prompts** — multi-step workflow templates that package the canonical BrAPI flows into ready-to-fire user messages:
+  - `brapi_eda_study(studyDbId, alias?)` — exploratory-data-analysis playbook for one study (orient → variables → coverage → missing → outliers → pedigree → report).
+  - `brapi_meta_analysis(germplasmDbIds, traitName, alias?)` — cross-study trait meta-analysis (resolve trait → discover studies → harmonize → per-germplasm × per-study summary → across-study summary → pedigree side-quest → report).
+- **`BrapiClient.post()` / `BrapiClient.put()`** — generic JSON request helpers shared by the new write tool. Same retry policy, HTTP error reclassification, and SSRF guard as `get()`.
+
+## Changed
+
+- **`brapi_raw_get` cross-origin guard** — `rejectCrossOrigin()` now runs against the raw `input.path` before `normalizePath` adds the leading `/`. Previous order let `https://evil/leak` slip past the regex (the leading slash blocked the `/^https?:\/\//` match) and instead concatenate into the registered baseUrl path, where the URL constructor escaped it benignly. Defense-in-depth restored.
+- **README** — version badge bumped, surface counters updated to `19 Tools · 6 Resources · 2 Prompts`, new sections for resources and prompts, write-tool entry in the tools table, project structure expanded with `mcp-server/resources/` and `mcp-server/prompts/`.
+
+## Fixed
+
+- **State key validation** — switched every service prefix from colon-separated to slash-separated (`brapi:conn:` → `brapi/conn/`, `brapi:capability:` → `brapi/capability/`, `brapi:ds:meta:` / `brapi:ds:rows:` → `brapi/ds/meta/` / `brapi/ds/rows/`, `brapi:ref:…` → `brapi/ref/…`). `@cyanheads/mcp-ts-core` 0.7.x storage rejects keys outside `/^[a-zA-Z0-9_.\-/]+$/`, which broke every state-using tool at runtime in HTTP mode (`ServerRegistry.register`, `CapabilityRegistry`, `DatasetStore`, `ReferenceDataCache`). Unit tests passed because `createMockContext` skips key validation; field-testing the HTTP transport surfaced the regression. Also updated the matching state-key assertions in `tests/tools/brapi-connect.tool.test.ts`.
+
+## Verified
+
+- `bun run devcheck` — all 11 sub-checks pass (lint, format, typecheck, MCP definitions, framework antipatterns, docs/skills/changelog sync, secrets, deps audit, outdated).
+- `bun run test` — 191/191 pass across 32 test files (+90 new tests covering the 12 previously untested tools, 6 resources, and 2 prompts).
+- `bun run lint:mcp` — `All definitions valid.` (19 tools, 6 resources, 2 prompts).

package/changelog/0.3.x/0.3.1.md

@@ -0,0 +1,40 @@
+---
+summary: "Per-alias env-var fallback for brapi_connect — credentials live in BRAPI_<ALIAS>_* and never enter the LLM context. Plus a Breedbase /token form-encoding fix that unblocks SGN auth against Cassavabase et al."
+breaking: false
+---
+
+# 0.3.1 — 2026-04-29
+
+Connect-time credentials no longer have to ride through agent input. `brapi_connect` now fills `baseUrl` and `auth` from `BRAPI_<ALIAS>_*` env vars (then `BRAPI_DEFAULT_*`) when the agent omits them, so the LLM can call `brapi_connect({ alias: 'cassava' })` with nothing else and the server resolves the rest from `.env`. This is meaningful for security: passwords stop being prompt-engineered into every session.
+
+Also fixes a real bug — the SGN/Breedbase token-exchange request was sending JSON, but Breedbase's `/token` follows the OAuth2 spec and requires `application/x-www-form-urlencoded`. SGN auth now works against Cassavabase, Sweetpotatobase, Yambase, Musabase, Solgenomics, etc.
+
+## Added
+
+- **Env-var fallback for `brapi_connect`** — `baseUrl` and `auth` are now optional inputs. When omitted, the handler resolves them via the new `resolveConnectInput` helper with three layers of precedence:
+  1. Explicit agent input (always wins).
+  2. Per-alias env vars: `BRAPI_<ALIAS>_*` where the alias name is uppercased and hyphens become underscores (`my-server` → `BRAPI_MY_SERVER_*`).
+  3. Default env vars: `BRAPI_DEFAULT_*` — only consulted when alias differs from `default`.
+- **Per-alias credential families.** Each alias's env vars can carry one credential family — the auth mode is derived from which fields are set:
+  - `_USERNAME` + `_PASSWORD` → `mode: 'sgn'` (Breedbase token exchange)
+  - `_BEARER_TOKEN` → `mode: 'bearer'`
+  - `_API_KEY` (+ optional `_API_KEY_HEADER`) → `mode: 'api_key'`
+  - `_OAUTH_CLIENT_ID` + `_OAUTH_CLIENT_SECRET` (+ optional `_OAUTH_TOKEN_URL`) → `mode: 'oauth2'`
+  - None → `mode: 'none'`
+
+  Setting multiple families within a single alias raises a `ValidationError` naming the conflict.
+- **`src/config/alias-credentials.ts`** module exposes `aliasEnvPrefix`, `readAliasCredentials`, `deriveAuthFromCredentials`, and `resolveConnectInput` — all unit-tested with 28 cases covering the resolution matrix.
+- **`.env.example`** documents the per-alias pattern with examples for `default`, `cassava`, `sweetpotato`, `t3wheat`, `gigwa`, plus an API-key example (`prod`) and a bearer-token example (`cgiar`).
+
+## Changed
+
+- **`brapi_connect.input` schema** — `baseUrl` and `auth` are now `optional()` rather than required / defaulted. Tool description and field descriptions updated to point at the env-var fallback. Existing callers that pass both fields explicitly continue to work unchanged.
+- **`brapi_connect.handler`** logs the auth source (`'agent'` vs `'env'`) alongside the existing alias / baseUrl / authMode fields.
+
+## Fixed
+
+- **SGN token exchange against Breedbase servers.** `defaultTokenFetcher` now POSTs `application/x-www-form-urlencoded` with `URLSearchParams`-encoded credentials instead of JSON. Breedbase's `/token` endpoint follows the OAuth2 password-grant spec and rejects JSON bodies (`HTTP 400 "JSON array body required"`); the JSON form would silently fail against every SGN-family server. Verified end-to-end against Cassavabase (`access_token` issued, `/serverinfo` returns 118 supported calls).
+
+## Removed
+
+- **`dev:stdio` and `dev:http` package.json scripts.** Both wrapped `tsx --watch` — a long-running foreground process that's incompatible with agent-driven validation (an agent invoking it either blocks indefinitely or backgrounds the process and mistakes silence for success). Finite verification paths remain: `bun run test`, `bun run devcheck`, and JSON-RPC against a one-shot built binary via the `field-test` skill. Humans who want hot-reload can run `tsx --watch src/index.ts` directly.

package/changelog/0.3.x/0.3.2.md

@@ -0,0 +1,29 @@
+---
+summary: "Adopt mcp-ts-core 0.8.6 typed-error contracts across the BrAPI surface, fix a germplasmOrigin schema bug that broke output validation against spec-compliant servers."
+breaking: false
+---
+
+# 0.3.2 — 2026-04-29
+
+Tools and resources now declare typed `errors: [...]` contracts and throw via `ctx.fail(reason, …)` instead of `notFound()`/`validationError()` factories. Each declared failure carries a stable `data.reason`, an auto-mirrored `recovery.hint` on the wire, and a `code` that matches its contract entry — so agent clients can route errors deterministically. Verified end-to-end against `test-server.brapi.org`. Also ships a real bug fix: `germplasmOrigin` was schema-typed as a string, but BrAPI v2 spec defines it as an array of collection-site objects, so `find_germplasm` and `get_germplasm` were throwing on every call against a compliant server.
+
+## Added
+
+- **Typed error contracts on tools & resources.** New `errors: [{ reason, code, when, recovery }]` blocks declared on:
+  - Tools: `brapi_connect` (auth_token_exchange_failed, auth_no_access_token), `brapi_describe_filters` (unknown_endpoint), `brapi_find_genotype_calls` (no_filters), `brapi_get_germplasm` (germplasm_not_found), `brapi_get_image` (images_unsupported), `brapi_get_study` (study_not_found), `brapi_manage_dataset` (datasetid_required, dataset_not_found, dataset_rows_missing), `brapi_raw_get` (cross_origin_path), `brapi_submit_observations` (observations_unsupported, post_unsupported, put_unsupported, elicit_unavailable, user_declined).
+  - Resources: `brapi://filters/{endpoint}` (unknown_endpoint), `brapi://germplasm/{germplasmDbId}` (germplasm_not_found), `brapi://study/{studyDbId}` (study_not_found).
+- **`bun run start` script** — defers transport selection to `MCP_TRANSPORT_TYPE` (stdio default) so consumers can wire one entry point and switch transports via env.
+
+## Changed
+
+- **Bumped `@cyanheads/mcp-ts-core` from `^0.7.4` → `^0.8.6`** to pick up the typed-`HandlerContext<R>` API, `ctx.fail` / `ctx.recoveryFor`, and the `error-contract-conformance` lint.
+- **Tool & resource handlers** swapped ad-hoc `notFound()` / `validationError()` / `forbidden()` throws for `ctx.fail('reason', msg, { ...ctx.recoveryFor('reason') })` against their declared contracts. Recovery hints now ride on `data.recovery.hint` and are auto-mirrored into `content[].text`.
+- **`brapi_submit_observations` confirmApply** typed against `HandlerContext<reason>` via a new `SubmitCtx` alias so all five declared failure modes are catchable at compile time.
+- **Service-layer errors** (`brapi-client`, `dataset-store`, `server-registry`) now stamp a stable `reason` field into `error.data` for upstream-classified failures (`upstream_not_found`, `upstream_unauthorized`, `upstream_rate_limited`, `auth_no_access_token`, `dataset_rows_missing`, `unknown_alias`, etc.) — observable even though they're thrown outside a contract.
+- **Skills synced to framework 0.8.6** — `add-tool`, `add-resource`, `add-service`, `api-context`, `api-errors`, `api-linter`, `api-testing`, `field-test`, and others updated with the typed-contract guidance and current API surface.
+- **Project `CLAUDE.md`** updated with the typed-contract pattern and the `bun run start` script.
+
+## Fixed
+
+- **`germplasmOrigin` schema** in `brapi_find_germplasm` and `brapi_get_germplasm` was declared as `z.string()`, but BrAPI v2 spec defines the field as an array of `GermplasmOrigin` objects (collection coordinates + uncertainty). Output validation was failing on every response from a spec-compliant server — confirmed end-to-end against `test-server.brapi.org`. Schema is now `z.array(z.object({}).passthrough())` and the format renderers report `germplasmOrigin=<count> record(s)` instead of stringifying objects.
+- **`brapi_raw_get` cross-origin guard** is now thrown via `ctx.fail('cross_origin_path', …)` rather than the bare `validationError` factory so the recovery hint surfaces on the wire.

package/changelog/0.3.x/0.3.3.md

@@ -0,0 +1,19 @@
+---
+summary: "Tighten recovery hints across BrAPI tool/resource error contracts and wire service-layer throws so declared hints actually reach the wire."
+breaking: false
+---
+
+# 0.3.3 — 2026-04-29
+
+Audit pass on every declared `recovery` field added in 0.3.2. Six hints were either restating the failure (`brapi_get_image`, `brapi_submit_observations` `observations_unsupported`, two `unknown_endpoint` variants) or actively misleading (`brapi_submit_observations` `post_unsupported` had inverted POST/PUT routing logic; `put_unsupported` suggested dropping `observationDbId` without flagging the duplicate hazard). Four more were declared on tool contracts but thrown from service code that never spread `ctx.recoveryFor`, so the hints were documentation-only — `auth_token_exchange_failed`, `auth_no_access_token`, `dataset_not_found`, `dataset_rows_missing` now carry their hints to clients.
+
+## Changed
+
+- **`brapi_submit_observations` recovery hints** — `observations_unsupported`, `post_unsupported`, `put_unsupported` rewritten to point at `brapi_server_info` for capability discovery, and to warn that dropping `observationDbId` to bypass `put_unsupported` would create duplicates rather than update existing rows.
+- **`brapi_get_image` `images_unsupported`** rewritten from a restate-the-problem hint to a concrete recovery: run `brapi_server_info` or reconnect under a different alias.
+- **`brapi_describe_filters` and `brapi://filters/{endpoint}` `unknown_endpoint`** hints now name the supported endpoints inline and reference `data.availableEndpoints` instead of the opaque "previous response" / "list field" wording.
+
+## Fixed
+
+- **Service-layer throws now spread `ctx.recoveryFor(reason)`** so contract hints surface on the wire. `dataset-store.ts` (`dataset_not_found`, `dataset_rows_missing`) and `server-registry.ts` (`auth_token_exchange_failed`, `auth_no_access_token`) previously declared hints on the parent tool's contract but never wired them through their `notFound()` / `forbidden()` factory throws — clients saw `data.reason` but no `data.recovery.hint`.
+- **`brapi_submit_observations` `post_unsupported` hint** corrected: the prior text said "remove observationDbId so all rows route to PUT" but removing the ID actually routes a row to POST (the failing path). Now correctly advises dropping the new rows or switching servers.

package/changelog/0.3.x/0.3.4.md

@@ -0,0 +1,33 @@
+---
+summary: "Field-test pass against real BrAPI servers — capability-gated companion lookups, top-level study FK probes, structured-season + multi-set variant tolerance, and a multi-tenant HTTP deployment notice."
+breaking: false
+---
+
+# 0.3.4 — 2026-04-29
+
+A robustness pass shaped by exercising every tool against live BrAPI servers (Breedbase, T3, Sweetpotatobase, and the test server). The headline change is that companion lookups in `brapi_get_germplasm` and `brapi_get_study` now consult the cached capability profile before firing — saving a 404 round-trip per unsupported endpoint. Several `find_*` tools learned to surface upstream sparsity (free-text filters that aren't honored, bbox windows that exclude all rows, named filters that return zero calls) instead of silently returning empty results.
+
+## Added
+
+- **`brapi_connect` multi-tenant deployment notice** — when a connection authenticates over HTTP without per-client auth (`MCP_TRANSPORT_TYPE=http` and `MCP_AUTH_MODE=none|unset`), the tool now emits a `notice`-level log warning that the resolved bearer token persists under the shared `default` tenant and is reachable to any other connected client. README gains a "Multi-user HTTP deployments" section documenting tenant resolution and the cross-user state caveat.
+- **Typed `study_not_found` / `germplasm_not_found` errors** — `brapi_get_study`, `brapi_get_germplasm`, and `brapi_submit_observations` now translate upstream 404s into a typed contract entry with a routing recovery hint, replacing the generic `serviceUnavailable` bubble-up.
+- **`brapi_walk_pedigree` root-existence pre-flight** — when `germplasm/{germplasmDbId}/pedigree` is supported, each requested root is probed before the BFS so missing roots surface as warnings up front. Handles servers (e.g. `test-server.brapi.org`) that reply 200 + `result: null` for unknown germplasm rather than 404.
+- **Dataset handle truncation flags** — `DatasetHandle` now carries `truncated` and `maxRows` fields when the producing tool capped rows before exhausting upstream. `brapi_find_genotype_calls` and the shared `spillToDataset` helper plumb these through so consumers can detect partial datasets.
+
+## Changed
+
+- **`brapi_get_study` / `brapi_get_germplasm` companion lookups gate on capability profile** — pedigree, attribute, progeny, observation, observation-unit, and variable count probes now skip when the cached `/serverinfo` profile doesn't advertise the corresponding service. This avoids the per-request 404 storm against servers that only expose a subset of the spec.
+- **Study FK count probes use top-level endpoints** — `brapi_get_study` and `brapi_submit_observations` now call `/observations?studyDbIds=…`, `/observationunits?studyDbIds=…`, and `/variables?studyDbId=…` (BrAPI v2.1 canonical routes) instead of `/studies/{id}/observations`, `/studies/{id}/observationunits`, `/studies/{id}/observationvariables`. `pageSize=0` was replaced with `pageSize=1` so servers that reject zero-page sizes still return a `totalCount`.
+- **`brapi_find_observations` accepts structured `season` payloads** — output schema and distribution rendering now handle the BrAPI v2.1 `{seasonDbId, year, season, seasonName}` form alongside the legacy flat-string variant.
+- **`brapi_find_variants` tolerates multi-set membership** — `variantSetDbId` accepts string OR string[] OR a separate `variantSetDbIds` plural form per spec drift across servers; `variantType`, `referenceBases`, `alternateBases`, `referenceName`, `start`, `end`, and the filter fields are now `nullish()` to accept upstream nulls without dropping rows.
+- **`brapi_get_image` requires GET on `images/{imageDbId}/imagecontent`** — many servers expose the endpoint for PUT-only upload; the tool now only routes to `/imagecontent` when the capability profile lists GET, otherwise falls back to the metadata `imageURL`.
+- **`brapi_submit_observations` study existence check** — `fetchStudyName` is now `fetchStudyExistence`, throwing `study_not_found` for upstream 404s and propagating transient errors (timeouts, 5xx) rather than swallowing them into a missing study name.
+- **Tool descriptions tightened** — `brapi_connect`, `brapi_find_genotype_calls`, `brapi_find_locations`, `brapi_find_variables`, `brapi_get_image`, `brapi_raw_get`, and `brapi_submit_observations` rewrote their headline lines to drop redundant or prescriptive copy.
+
+## Fixed
+
+- **`brapi_find_germplasm` free-text heuristic warning** — when the requested `text` filter would have narrowed the result and the server returned every row that matches the other filters, the tool now warns that the free-text filter may not be honored. Catches servers that silently ignore unrecognized query parameters.
+- **`brapi_find_locations` bbox warnings** — surfaces a warning when a bbox window excludes every upstream row (likely a coordinate-convention mismatch) or some-but-not-all rows, instead of returning a quietly-empty list.
+- **`brapi_find_genotype_calls` empty-result warning** — when a named filter (variant set, germplasm, callset, variant) was provided and upstream returned zero calls, surfaces a warning that the filter combination may not match data on this server.
+- **`renderDatasetHandle` consolidation** — six `find_*` tools that duplicated the dataset-handle render block now share one helper, so `truncated` / `maxRows` lines surface consistently.
+- **Test fixtures aligned with new routing** — `brapi_get_study`, `brapi_get_germplasm`, and `brapi_submit_observations` test mocks now advertise the capabilities the production code consults and respond on the top-level routes the tools actually call.

package/changelog/0.3.x/0.3.5.md

@@ -0,0 +1,24 @@
+---
+summary: "Cassavabase null-tolerance pass — schemas accept upstream nulls without dropping rows, walk-pedigree no longer false-flags inverse-edge backtracks as cycles, get-image flags broken upstream URLs. Plus npm scope rename to @cyanheads/brapi-mcp-server."
+breaking: false
+---
+
+# 0.3.5 — 2026-04-30
+
+A robustness pass driven by exercising the read tools against Cassavabase, which returns explicit `null` on most optional fields rather than omitting them. The headline change is that every read-tool schema now uses `nullish()` for nullable fields so sparse upstream payloads validate cleanly. Two real bugs surfaced along the way — `brapi_walk_pedigree` was double-counting inverse-edge backtracks as cycles in `direction='both'`, and `brapi_get_image` had no signal when the `imageURL` fallback returned an HTML error page instead of bytes.
+
+## Added
+
+- **`brapi_get_image` per-image suspect-content warnings** — when the `imageURL` fallback returns content with a non-`image/*` MIME type (typically an HTML error page from a broken CDN URL), the tool now emits a per-image `warnings[]` entry advising that the bytes were loaded but may not render. The payload is still returned so the caller can inspect it; the warning just flags that something is wrong upstream.
+- **`brapi_connect` configured-alias hint in tool description** — the connect tool now scans `BRAPI_<ALIAS>_BASE_URL` env vars at module load and appends a sentence listing the pre-configured aliases to its description, so agents see the alias inventory on `tools/list` without anyone enumerating them in the prompt. The phrasing emphasizes that any other BrAPI v2 server is still reachable by passing `baseUrl` directly. Restart the server to refresh.
+- **`brapi_manage_dataset` truncation column** — list-mode table now includes a `truncated` column (`yes (cap=N)` or `no`); summary mode adds a `truncated: true (cap=N rows)` line when applicable. Surfaces the producer-side cap state through both `structuredContent` and `content[]`.
+
+## Changed
+
+- **Optional schema fields use `nullish()` instead of `optional()`** — `brapi_find_germplasm`, `brapi_get_germplasm`, `brapi_find_studies`, `brapi_get_study`, `brapi_find_locations`, `brapi_find_variables` now accept upstream `null` on every optional field. Cassavabase serializes `subtaxa: null`, `studyCode: null`, nested `trait.traitClass: null`, etc. instead of omitting the keys; `nullish()` is `optional + nullable` so both shapes validate. Format functions correctly skip null-valued fields rather than rendering `lat=null` or `active=null`.
+- **Package renamed to `@cyanheads/brapi-mcp-server`** — scoped under the `@cyanheads` npm org. README install instructions, package.json, and server.json identifiers all updated. Existing tag history retained.
+- **Framework bump to `@cyanheads/mcp-ts-core ^0.8.7`** — picks up the latest framework patch.
+
+## Fixed
+
+- **`brapi_walk_pedigree` no longer double-counts inverse-edge backtracks as cycles in `direction='both'`** — when walking ancestors and descendants concurrently, BFS naturally re-encounters nodes via the inverse relationship as the two expansion fronts meet (e.g. expanding `g-3`'s parents then re-finding `g-3` via the parent's progeny lookup). Previous logic counted these structural symmetries as cycles, inflating `cycleCount` for every multi-root walk. The walk now checks for the inverse edge before incrementing and only counts genuine re-discoveries via a non-symmetric path.

package/changelog/template.md

@@ -0,0 +1,51 @@
+---
+# FORMAT REFERENCE — this file is never edited, never moved, never renamed.
+#
+# At release time, author a new per-version file at:
+#   changelog/<major.minor>.x/<version>.md   (e.g. changelog/0.1.x/0.1.0.md)
+# using this file's frontmatter and section layout as the starting point.
+# Set that new file's H1 to `# <version> — YYYY-MM-DD` with a concrete date.
+
+# Required. One-line headline describing the release. Max 250 chars. No markdown.
+# This line is what the CHANGELOG.md rollup shows — write it like a GitHub Release title.
+summary: ""
+
+# Set to `true` only if this release has breaking changes (API removals, signature
+# changes, config renames, anything that requires consumer code changes on update).
+# Flagged as ⚠️ Breaking in the rollup.
+breaking: false
+---
+
+# <version> — YYYY-MM-DD
+
+<!--
+  FORMAT REFERENCE — do not edit this file. It exists so the per-version file
+  structure has a single copy-source. Create new release notes at
+  `changelog/<major.minor>.x/<version>.md` using this layout.
+
+  Optional narrative intro — 1-3 sentences framing the release theme. Delete if not needed.
+
+  Linking issues/PRs: use full URLs so the link works everywhere (GitHub web UI,
+  npm/node_modules reads, local editors). GitHub's bare `#NN` auto-link only
+  resolves inside its own UI.
+
+    [#12](https://github.com/<owner>/<repo>/issues/12)   ← issue
+    [#17](https://github.com/<owner>/<repo>/pull/17)     ← PR
+
+  Only link numbers you've verified exist (via `gh issue view NN` or
+  `gh pr view NN`). Never speculate on a future number — `#17` for "my
+  upcoming PR" will quietly resolve to whatever real item already owns 17,
+  and GitHub timeline previews will pull in that unrelated item's title.
+-->
+
+## Added
+
+-
+
+## Changed
+
+-
+
+## Fixed
+
+-

package/dist/config/alias-credentials.d.ts

@@ -0,0 +1,82 @@
+/**
+ * @fileoverview Per-alias env-var resolution for `brapi_connect`.
+ *
+ * Aliases map to env-var prefixes via `BRAPI_<ALIAS>_*` (uppercased, hyphens →
+ * underscores). Each alias can carry baseUrl + one credential family; the
+ * connect handler layers agent input over alias env over default env over the
+ * no-auth fallback. Credentials live in env, never in the LLM context.
+ *
+ * @module config/alias-credentials
+ */
+import type { AuthMode, ConnectAuth } from '../services/server-registry/index.js';
+/**
+ * Per-alias credential bundle read from env vars. All fields optional —
+ * presence is what determines which auth mode is derived.
+ */
+export interface AliasCredentials {
+    apiKey?: string;
+    apiKeyHeader?: string;
+    baseUrl?: string;
+    bearerToken?: string;
+    oauthClientId?: string;
+    oauthClientSecret?: string;
+    oauthTokenUrl?: string;
+    password?: string;
+    username?: string;
+}
+/** Compute the env-var prefix for an alias. `my-server` → `BRAPI_MY_SERVER_`. */
+export declare function aliasEnvPrefix(alias: string): string;
+/** Read all `BRAPI_<ALIAS>_*` vars for an alias. Empty strings treated as unset. */
+export declare function readAliasCredentials(alias: string, env?: NodeJS.ProcessEnv): AliasCredentials;
+/**
+ * Pick a `ConnectAuth` from the credential bundle. Returns `undefined` when no
+ * credentials are present so callers can fall through to the next layer.
+ * Throws on intra-alias ambiguity (multiple credential families set).
+ */
+export declare function deriveAuthFromCredentials(creds: AliasCredentials, alias: string): ConnectAuth | undefined;
+export interface ResolvedConnectInput {
+    auth: ConnectAuth;
+    baseUrl: string;
+}
+/**
+ * Layer agent input over alias env over default env. Returns the resolved
+ * baseUrl + auth. Throws when no baseUrl is resolvable from any layer.
+ *
+ * Precedence:
+ *   1. Explicit agent input (`baseUrl`, `auth`) wins.
+ *   2. Per-alias env vars (`BRAPI_<ALIAS>_*`).
+ *   3. Default env vars (`BRAPI_DEFAULT_*`) — only when alias differs.
+ *   4. `auth` falls through to `{ mode: 'none' }`; `baseUrl` has no fallback.
+ */
+export declare function resolveConnectInput(alias: string, agent: {
+    baseUrl?: string | undefined;
+    auth?: ConnectAuth | undefined;
+}, env?: NodeJS.ProcessEnv): ResolvedConnectInput;
+/**
+ * Summary of an alias discovered from env vars — what the operator pre-wired
+ * for this deployment. Surfaced to the LLM via the connect tool description so
+ * agents can pick a shortcut without the human having to enumerate them.
+ */
+export interface DiscoveredAlias {
+    alias: string;
+    authMode: AuthMode;
+    baseUrl: string;
+}
+/**
+ * Scan env for `BRAPI_<X>_BASE_URL` keys and derive the alias inventory the
+ * operator has pre-configured. Each alias resolves its credential family via
+ * the same logic `resolveConnectInput` uses; ambiguous families fall back to
+ * `none` so the alias is still surfaced (the connect call will then raise the
+ * same `ValidationError` the agent would have hit anyway).
+ *
+ * Default-alias entries land first; the rest are alphabetical.
+ */
+export declare function discoverConfiguredAliases(env?: NodeJS.ProcessEnv): DiscoveredAlias[];
+/**
+ * Render the discovered alias list as a sentence appended to the connect
+ * tool's description. Empty when nothing is pre-configured — the original
+ * description stands alone in that case. Phrased so that absent aliases are
+ * never read as restricted servers: any BrAPI v2 URL stays connectable.
+ */
+export declare function formatConfiguredAliasesHint(aliases: DiscoveredAlias[]): string;
+//# sourceMappingURL=alias-credentials.d.ts.map

package/dist/config/alias-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias-credentials.d.ts","sourceRoot":"","sources":["../../src/config/alias-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAEjF;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAgBD,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,gBAAgB,CAQlB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,MAAM,GACZ,WAAW,GAAG,SAAS,CAwCzB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;CAAE,EACvE,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,oBAAoB,CAsBtB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAID;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,eAAe,EAAE,CAuBjG;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,CAI9E"}

package/dist/config/alias-credentials.js

@@ -0,0 +1,159 @@
+/**
+ * @fileoverview Per-alias env-var resolution for `brapi_connect`.
+ *
+ * Aliases map to env-var prefixes via `BRAPI_<ALIAS>_*` (uppercased, hyphens →
+ * underscores). Each alias can carry baseUrl + one credential family; the
+ * connect handler layers agent input over alias env over default env over the
+ * no-auth fallback. Credentials live in env, never in the LLM context.
+ *
+ * @module config/alias-credentials
+ */
+import { validationError } from '@cyanheads/mcp-ts-core/errors';
+const FIELD_SUFFIXES = [
+    ['baseUrl', 'BASE_URL'],
+    ['username', 'USERNAME'],
+    ['password', 'PASSWORD'],
+    ['apiKey', 'API_KEY'],
+    ['apiKeyHeader', 'API_KEY_HEADER'],
+    ['bearerToken', 'BEARER_TOKEN'],
+    ['oauthClientId', 'OAUTH_CLIENT_ID'],
+    ['oauthClientSecret', 'OAUTH_CLIENT_SECRET'],
+    ['oauthTokenUrl', 'OAUTH_TOKEN_URL'],
+];
+const DEFAULT_ALIAS = 'default';
+/** Compute the env-var prefix for an alias. `my-server` → `BRAPI_MY_SERVER_`. */
+export function aliasEnvPrefix(alias) {
+    return `BRAPI_${alias.replace(/-/g, '_').toUpperCase()}_`;
+}
+/** Read all `BRAPI_<ALIAS>_*` vars for an alias. Empty strings treated as unset. */
+export function readAliasCredentials(alias, env = process.env) {
+    const prefix = aliasEnvPrefix(alias);
+    const result = {};
+    for (const [field, suffix] of FIELD_SUFFIXES) {
+        const value = env[`${prefix}${suffix}`];
+        if (value !== undefined && value !== '')
+            result[field] = value;
+    }
+    return result;
+}
+/**
+ * Pick a `ConnectAuth` from the credential bundle. Returns `undefined` when no
+ * credentials are present so callers can fall through to the next layer.
+ * Throws on intra-alias ambiguity (multiple credential families set).
+ */
+export function deriveAuthFromCredentials(creds, alias) {
+    const families = [
+        { name: 'sgn (username+password)', present: !!(creds.username && creds.password) },
+        { name: 'bearer (bearerToken)', present: !!creds.bearerToken },
+        { name: 'api_key (apiKey)', present: !!creds.apiKey },
+        {
+            name: 'oauth2 (oauthClientId+oauthClientSecret)',
+            present: !!(creds.oauthClientId && creds.oauthClientSecret),
+        },
+    ];
+    const present = families.filter((f) => f.present).map((f) => f.name);
+    if (present.length === 0)
+        return;
+    if (present.length > 1) {
+        throw validationError(`Ambiguous auth config for alias '${alias}': multiple credential families set (${present.join(', ')}). Pick one — clear the env vars for the others.`, { alias, present });
+    }
+    if (creds.username && creds.password) {
+        return { mode: 'sgn', username: creds.username, password: creds.password };
+    }
+    if (creds.bearerToken) {
+        return { mode: 'bearer', token: creds.bearerToken };
+    }
+    if (creds.apiKey) {
+        return creds.apiKeyHeader
+            ? { mode: 'api_key', apiKey: creds.apiKey, headerName: creds.apiKeyHeader }
+            : { mode: 'api_key', apiKey: creds.apiKey };
+    }
+    if (creds.oauthClientId && creds.oauthClientSecret) {
+        return creds.oauthTokenUrl
+            ? {
+                mode: 'oauth2',
+                clientId: creds.oauthClientId,
+                clientSecret: creds.oauthClientSecret,
+                tokenUrl: creds.oauthTokenUrl,
+            }
+            : { mode: 'oauth2', clientId: creds.oauthClientId, clientSecret: creds.oauthClientSecret };
+    }
+    return;
+}
+/**
+ * Layer agent input over alias env over default env. Returns the resolved
+ * baseUrl + auth. Throws when no baseUrl is resolvable from any layer.
+ *
+ * Precedence:
+ *   1. Explicit agent input (`baseUrl`, `auth`) wins.
+ *   2. Per-alias env vars (`BRAPI_<ALIAS>_*`).
+ *   3. Default env vars (`BRAPI_DEFAULT_*`) — only when alias differs.
+ *   4. `auth` falls through to `{ mode: 'none' }`; `baseUrl` has no fallback.
+ */
+export function resolveConnectInput(alias, agent, env = process.env) {
+    const aliasCreds = readAliasCredentials(alias, env);
+    const defaultCreds = alias === DEFAULT_ALIAS ? aliasCreds : readAliasCredentials(DEFAULT_ALIAS, env);
+    const baseUrl = agent.baseUrl ?? aliasCreds.baseUrl ?? defaultCreds.baseUrl;
+    if (!baseUrl) {
+        throw validationError(`No baseUrl provided. Pass \`baseUrl\` explicitly, or set ${aliasEnvPrefix(alias)}BASE_URL${alias === DEFAULT_ALIAS ? '' : ` or ${aliasEnvPrefix(DEFAULT_ALIAS)}BASE_URL`}.`, { alias });
+    }
+    const auth = agent.auth ??
+        deriveAuthFromCredentials(aliasCreds, alias) ??
+        (alias === DEFAULT_ALIAS
+            ? undefined
+            : deriveAuthFromCredentials(defaultCreds, DEFAULT_ALIAS)) ??
+        { mode: 'none' };
+    return { baseUrl, auth };
+}
+const ALIAS_BASE_URL_PATTERN = /^BRAPI_([A-Z0-9_]+)_BASE_URL$/;
+/**
+ * Scan env for `BRAPI_<X>_BASE_URL` keys and derive the alias inventory the
+ * operator has pre-configured. Each alias resolves its credential family via
+ * the same logic `resolveConnectInput` uses; ambiguous families fall back to
+ * `none` so the alias is still surfaced (the connect call will then raise the
+ * same `ValidationError` the agent would have hit anyway).
+ *
+ * Default-alias entries land first; the rest are alphabetical.
+ */
+export function discoverConfiguredAliases(env = process.env) {
+    const result = [];
+    for (const [key, value] of Object.entries(env)) {
+        const match = key.match(ALIAS_BASE_URL_PATTERN);
+        const captured = match?.[1];
+        if (!captured || !value)
+            continue;
+        const alias = captured.toLowerCase();
+        const creds = readAliasCredentials(alias, env);
+        let authMode = 'none';
+        try {
+            const auth = deriveAuthFromCredentials(creds, alias);
+            if (auth)
+                authMode = auth.mode;
+        }
+        catch {
+            // Ambiguous credential family — surface the alias anyway.
+        }
+        result.push({ alias, authMode, baseUrl: value });
+    }
+    result.sort((a, b) => {
+        if (a.alias === DEFAULT_ALIAS)
+            return -1;
+        if (b.alias === DEFAULT_ALIAS)
+            return 1;
+        return a.alias.localeCompare(b.alias);
+    });
+    return result;
+}
+/**
+ * Render the discovered alias list as a sentence appended to the connect
+ * tool's description. Empty when nothing is pre-configured — the original
+ * description stands alone in that case. Phrased so that absent aliases are
+ * never read as restricted servers: any BrAPI v2 URL stays connectable.
+ */
+export function formatConfiguredAliasesHint(aliases) {
+    if (aliases.length === 0)
+        return '';
+    const names = aliases.map((a) => `\`${a.alias}\``).join(', ');
+    return `Pre-configured aliases on this deployment (callable without \`baseUrl\` or \`auth\` — credentials are read from server env vars): ${names}. Aliases are shortcuts only; any other BrAPI v2 server is reachable by passing \`baseUrl\` directly.`;
+}
+//# sourceMappingURL=alias-credentials.js.map

package/dist/config/alias-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias-credentials.js","sourceRoot":"","sources":["../../src/config/alias-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAmBhE,MAAM,cAAc,GAA6D;IAC/E,CAAC,SAAS,EAAE,UAAU,CAAC;IACvB,CAAC,UAAU,EAAE,UAAU,CAAC;IACxB,CAAC,UAAU,EAAE,UAAU,CAAC;IACxB,CAAC,QAAQ,EAAE,SAAS,CAAC;IACrB,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAClC,CAAC,aAAa,EAAE,cAAc,CAAC;IAC/B,CAAC,eAAe,EAAE,iBAAiB,CAAC;IACpC,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;IAC5C,CAAC,eAAe,EAAE,iBAAiB,CAAC;CACrC,CAAC;AAEF,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,SAAS,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC;AAC5D,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAuB,EACvB,KAAa;IAEb,MAAM,QAAQ,GAA8C;QAC1D,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE;QAClF,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE;QAC9D,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE;QACrD;YACE,IAAI,EAAE,0CAA0C;YAChD,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,iBAAiB,CAAC;SAC5D;KACF,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,eAAe,CACnB,oCAAoC,KAAK,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD,EACrJ,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,YAAY;YACvB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,YAAY,EAAE;YAC3E,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,aAAa;YACxB,CAAC,CAAC;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK,CAAC,aAAa;gBAC7B,YAAY,EAAE,KAAK,CAAC,iBAAiB;gBACrC,QAAQ,EAAE,KAAK,CAAC,aAAa;aAC9B;YACH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO;AACT,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,KAAuE,EACvE,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,YAAY,GAChB,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAElF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC;IAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,eAAe,CACnB,4DAA4D,cAAc,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,cAAc,CAAC,aAAa,CAAC,UAAU,GAAG,EAC5K,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GACR,KAAK,CAAC,IAAI;QACV,yBAAyB,CAAC,UAAU,EAAE,KAAK,CAAC;QAC5C,CAAC,KAAK,KAAK,aAAa;YACtB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,yBAAyB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAC1D,EAAE,IAAI,EAAE,MAAM,EAAkB,CAAC;IAEpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAaD,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5E,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK;YAAE,SAAS;QAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/C,IAAI,QAAQ,GAAa,MAAM,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,IAAI;gBAAE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnB,IAAI,CAAC,CAAC,KAAK,KAAK,aAAa;YAAE,OAAO,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,KAAK,KAAK,aAAa;YAAE,OAAO,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAA0B;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,qIAAqI,KAAK,uGAAuG,CAAC;AAC3P,CAAC"}