@itm-platform/mcp-server 1.0.0

package/README.md

@@ -0,0 +1,193 @@
+# ITM.MCP
+
+> For cross-cutting documentation (debugging, database schema, environments, API versioning, build commands), see the [parent README](../README.md#documentation-index).
+
+MCP (Model Context Protocol) server for ITM Platform. Exposes project management data to AI assistants -- Claude, ChatGPT, VS Code Copilot, Cursor, JetBrains -- through a universal open protocol.
+
+**Status:** Phase 2 in progress -- 20 tools (15 read + 5 write), 6 resources, 4 prompts. OAuth scope enforcement, audit logging, and token exchange in place. 137 unit tests, 23 E2E tests.
+
+See [House Rules](../House-rules.md) for coding conventions.
+
+## How it works
+
+MCP is a JSON-RPC 2.0 protocol that lets AI assistants discover and call tools on external servers. The server supports two transports:
+
+- **HTTP + OAuth (recommended)** -- AI clients connect to a hosted URL and authenticate via OAuth 2.1 (PKCE). No local install needed.
+- **stdio** -- AI clients spawn the server as a local child process. Auth via API key.
+
+```
+AI Client (Claude, Cursor, VS Code, Codex...)
+  |
+  |  HTTP (remote) or stdio (local)
+  v
+ITM.MCP Server
+  |  authenticates as the user, calls ITM APIs
+  v
+ITM.API Gateway --> DataMart (GraphQL) + v2 REST (users, reference data)
+```
+
+**Key point:** The AI model never sees user credentials. Auth is handled by the MCP server. The model only sees tool names, descriptions, and results.
+
+### Three MCP primitives
+
+| Primitive | Who controls it | What it does | Example |
+|-----------|----------------|--------------|---------|
+| **Tools** | AI model decides when to call | Executable read/write operations | `search_projects`, `get_project_budget` |
+| **Resources** | Client app loads as context | Read-only reference data (schemas, docs) | `itm://schema/component` |
+| **Prompts** | User triggers a workflow template | Pre-composed multi-tool request | `/project_status` fetches project + tasks + risks + budget in one shot |
+
+## Quick start
+
+```bash
+npm install
+cp .env.sample .env   # edit with your credentials
+npm test              # unit tests (124 tests)
+npm run build         # compile TypeScript to dist/
+npm run dev           # HTTP dev server on port 6170 (for testing with curl)
+npm run test:e2e      # E2E tests (requires local ITM.API + DataMart)
+```
+
+## End-user setup
+
+For end-user setup instructions (OAuth, per-client configuration, npm package), see the [APIDocs site](APIDocs/).
+
+**Quick connect (OAuth):**
+
+```bash
+claude mcp add --scope user --transport http itm-platform https://api.itmplatform.com/v2/_/mcp/
+```
+
+**Quick connect (npm, local):**
+
+```bash
+claude mcp add --scope user itm-platform -- npx @itm-platform/mcp-server
+```
+
+## Server configuration (development / deployment)
+
+| Variable | Stdio | HTTP+OAuth | Description |
+|----------|-------|------------|-------------|
+| `ITM_API_URL` | Required | Required | ITM.API base URL |
+| `ITM_COMPANY` | Required | -- | Company/tenant slug |
+| `ITM_API_KEY` | Required* | -- | Per-user API key (generate from My Profile) |
+| `ITM_TOKEN` | Required* | -- | Session token (alternative to API key) |
+| `PORT` | -- | Required | HTTP listen port |
+| `ITM_AUTH_URL` | -- | Required | Internal OAuth authorization server URL (used for token exchange) |
+| `ITM_AUTH_PUBLIC_URL` | -- | Required* | Public OAuth URL advertised to AI clients. Falls back to `ITM_AUTH_URL` |
+| `MCP_SERVER_URL` | -- | Required | MCP server public URL (OAuth audience) |
+| `LOG_LEVEL` | Optional | Optional | Pino log level: `debug`, `info`, `warn`, `error` (default: `info`) |
+| `ITM_AUDIT_ENABLED` | Optional | Optional | Enable audit logging to ITM backend |
+
+\* One of `ITM_API_KEY` or `ITM_TOKEN` is required for stdio mode.
+
+In HTTP mode, if both `ITM_AUTH_URL` and `MCP_SERVER_URL` are set, OAuth is mandatory and every session must provide a Bearer token. If either is missing, the server runs in dev mode using the startup identity.
+
+On deployed environments, `ITM_AUTH_URL` points to `localhost` for internal server-to-server token exchange. `ITM_AUTH_PUBLIC_URL` must be set to the public URL so AI clients can discover the OAuth authorization server.
+
+## Tools (Phase 1 -- read-only)
+
+### DataMart-backed (fast, single-query reads)
+
+| Tool | Description |
+|------|-------------|
+| `search_projects` | Find projects by name, status, type, date range |
+| `search_services` | Find services by name, status, type, date range |
+| `get_project` | Full project details with optional subcomponents (tasks, risks, budget, etc.) |
+| `get_service` | Full service details with optional subcomponents |
+| `list_project_tasks` | Tasks for a project |
+| `get_project_risks` | Risks for a project |
+| `get_project_issues` | Issues for a project |
+| `get_project_budget` | Budget summary (top-down, bottom-up, actual, period-end close) |
+| `get_project_purchases` | Purchase orders for a project |
+| `get_project_revenues` | Revenue items for a project |
+| `aggregate_portfolio` | Portfolio analytics -- group, count, sum, avg across all projects |
+| `query_datamart` | Raw DataMart query for advanced analysis (validated, safe operators only) |
+
+### v2 REST-backed (users, reference data)
+
+| Tool | Description |
+|------|-------------|
+| `search_users` | Find team members |
+| `get_user` | User details |
+| `get_reference_data` | Status lists, types, priorities for any entity |
+
+### Write tools (Phase 2 -- v2 REST-backed)
+
+| Tool | Description |
+|------|-------------|
+| `create_task` | Create a new task in a project |
+| `update_task` | PATCH task fields (status, dates, assignee, progress) |
+| `create_risk` | Log a new risk in a project |
+| `create_issue` | Log a new issue in a project |
+| `update_project` | PATCH project fields (name, status, dates, priority) |
+
+Write tools return confirmed state from v2 REST (source of truth). Subsequent DataMart reads may lag 5-60 seconds due to eventual consistency -- this is noted in every write response.
+
+## Prompts
+
+Workflow templates the user can trigger. The MCP server returns a pre-composed message that instructs the AI to call the right tools.
+
+| Prompt | What it does |
+|--------|-------------|
+| `/project_status` | Fetches project + tasks + risks + budget, asks AI to summarize |
+| `/portfolio_overview` | Aggregates projects by status/methodology/budget, asks AI for health overview |
+| `/team_workload` | Fetches users + assignments, asks AI for workload analysis |
+| `/risk_analysis` | Fetches risks + issues + budget, asks AI for risk assessment |
+
+## Architecture
+
+```
+src/
+  server.ts                # MCP server bootstrap (stdio + HTTP, per-session auth)
+  instrument-server.ts     # Tool-call logging + audit wrapper (wraps registerTool)
+  logger.ts                # Pino logger factory (stderr + rotating file in logs/mcp.log)
+  auth/
+    effective-user-context.ts  # User identity type
+    api-key-auth.ts            # API key auth, calls /resolve/identity
+    license-resolver.ts        # License type -> access level
+    oauth-auth.ts              # Phase 2: OAuth token exchange
+    oauth-metadata.ts          # Phase 2: /.well-known/oauth-protected-resource
+    token-extraction.ts        # Bearer token extraction from headers
+  clients/
+    datamart-client.ts     # DataMart GraphQL through gateway
+    rest-client.ts         # v2 REST through gateway (GET, POST, PATCH)
+    audit-client.ts        # Phase 2: audit logging (fire-and-forget)
+  tools/                   # One file per tool group
+    write-tools.ts         # Phase 2: create/update tools (task, risk, issue, project)
+  resources/               # Schema + calendar resources
+  prompts/                 # Workflow templates
+  validation/
+    query-validator.ts     # Allowlist of safe MongoDB operators
+```
+
+## Access control
+
+| License type | Access |
+|-------------|--------|
+| CompanyAdmin | Full |
+| FullUser | Full |
+| ProjectManager | Blocked in Phase 1 (requires gateway PM-scope injection -- Phase 2) |
+| TeamMember | Blocked |
+
+**OAuth scope enforcement:** OAuth sessions respect granted scopes. Sessions with `mcp:read` only see 15 read tools; `mcp:write` is required to see and use write tools. API-key/stdio sessions get all tools unconditionally (backward compatible).
+
+## Logging
+
+Uses [Pino](https://getpino.io/) (same as DataMart and MSTeamsBot). Logs go to two destinations:
+
+- **stderr** -- pretty-printed, colorized (stdout is reserved for the MCP JSON-RPC protocol)
+- **`logs/mcp.log`** -- rotating file relative to the MCP application root, 10 MB max, keeps 5 old files (skipped in test)
+
+Set `LOG_LEVEL` in `.env` to control verbosity (`debug`, `info`, `warn`, `error`; default: `info`). All log entries include `{ service: 'mcp', app: 'ITM.MCP' }` base fields and ISO timestamps.
+
+HTTP clients (DataMart, REST) log at `debug` level on success (with duration in ms) and `error` on failure.
+
+**Tool-call logging:** Every MCP tool invocation is logged at `info` level with tool name, userId, and aiClientId. Completion is logged at `debug` with duration in ms. Failures are logged at `error`.
+
+**Audit:** When `ITM_AUDIT_ENABLED=true`, every tool call (read and write) sends an audit entry to the ITM backend (`/v2/{company}/mcp/audit`). Audit is fire-and-forget -- failures do not affect tool execution. Each entry includes: timestamp, userId, accountId, toolName, parametersHash (SHA-256), success, error (if any), aiClientId, durationMs.
+
+## Specification
+
+Full design, architecture decisions, phased rollout, and E2E test details:
+
+- [SPEC_MCP_SERVER.md](zz_Specifications/SPEC_MCP_SERVER.md)

package/bin/mcp-server.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import('../dist/server.js');

package/dist/audit-config.d.ts

@@ -0,0 +1,2 @@
+export declare function isAuditEnabled(value?: string | undefined): boolean;
+//# sourceMappingURL=audit-config.d.ts.map

package/dist/audit-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-config.d.ts","sourceRoot":"","sources":["../src/audit-config.ts"],"names":[],"mappings":"AAAA,wBAAgB,cAAc,CAAC,KAAK,qBAAgC,GAAG,OAAO,CAE7E"}

package/dist/audit-config.js

@@ -0,0 +1,4 @@
+export function isAuditEnabled(value = process.env.ITM_AUDIT_ENABLED) {
+    return value?.toLowerCase() !== 'false';
+}
+//# sourceMappingURL=audit-config.js.map

package/dist/audit-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-config.js","sourceRoot":"","sources":["../src/audit-config.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,cAAc,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAClE,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,OAAO,CAAC;AAC1C,CAAC"}

package/dist/auth/api-key-auth.d.ts

@@ -0,0 +1,3 @@
+import { EffectiveUserContext } from './effective-user-context.js';
+export declare function resolveIdentity(): Promise<EffectiveUserContext>;
+//# sourceMappingURL=api-key-auth.d.ts.map

package/dist/auth/api-key-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-auth.d.ts","sourceRoot":"","sources":["../../src/auth/api-key-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AA0BnE,wBAAsB,eAAe,IAAI,OAAO,CAAC,oBAAoB,CAAC,CA6CrE"}

package/dist/auth/api-key-auth.js

@@ -0,0 +1,53 @@
+import { resolveLicenseAccess } from './license-resolver.js';
+function resolveAuthHeaders() {
+    const apiKey = process.env.ITM_API_KEY;
+    const token = process.env.ITM_TOKEN;
+    if (apiKey) {
+        return { source: 'api-key', headers: { 'Authorization': `Bearer ${apiKey}` } };
+    }
+    if (token) {
+        return { source: 'token', headers: { 'Token': token } };
+    }
+    throw new Error('Missing required environment variable: ITM_API_KEY or ITM_TOKEN');
+}
+export async function resolveIdentity() {
+    const apiUrl = process.env.ITM_API_URL;
+    const company = process.env.ITM_COMPANY;
+    if (!apiUrl)
+        throw new Error('Missing required environment variable: ITM_API_URL');
+    if (!company)
+        throw new Error('Missing required environment variable: ITM_COMPANY');
+    const { source, headers: authHeaders } = resolveAuthHeaders();
+    const url = `${apiUrl}/v2/${company}/resolve/identity`;
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: {
+            ...authHeaders,
+            'Content-Type': 'application/json',
+        },
+    });
+    if (!response.ok) {
+        throw new Error(`Identity resolution failed: ${response.status} ${response.statusText}`);
+    }
+    const identity = await response.json();
+    const { dataMartAccess, pmScopeUserId } = resolveLicenseAccess(identity.licenseTypeIds, identity.userId);
+    if (dataMartAccess === 'pm-scoped') {
+        throw new Error('PM-only access is not yet available for MCP. It will arrive with hosted MCP (Phase 2) or gateway scope injection.');
+    }
+    if (dataMartAccess === 'none') {
+        throw new Error('Team Member access is not available for MCP.');
+    }
+    return {
+        source,
+        company,
+        accountId: identity.accountId,
+        userId: identity.userId,
+        languageId: identity.languageId,
+        email: identity.email,
+        licenseTypeIds: identity.licenseTypeIds,
+        dataMartAccess,
+        pmScopeUserId,
+        authHeaders,
+    };
+}
+//# sourceMappingURL=api-key-auth.js.map

package/dist/auth/api-key-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-auth.js","sourceRoot":"","sources":["../../src/auth/api-key-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAY7D,SAAS,kBAAkB;IACzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;IAEpC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACnF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAEpF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAE9D,MAAM,GAAG,GAAG,GAAG,MAAM,OAAO,OAAO,mBAAmB,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,GAAG,WAAW;YACd,cAAc,EAAE,kBAAkB;SACnC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,QAAQ,GAAqB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzG,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO;QACP,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,cAAc;QACd,aAAa;QACb,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/auth/effective-user-context.d.ts

@@ -0,0 +1,16 @@
+export interface EffectiveUserContext {
+    source: 'api-key' | 'token';
+    company: string;
+    accountId: number;
+    userId: number;
+    languageId: number;
+    email: string;
+    licenseTypeIds: number[];
+    dataMartAccess: 'full' | 'pm-scoped' | 'none';
+    pmScopeUserId?: number;
+    authHeaders: Record<string, string>;
+    grantedScopes?: string[];
+}
+export declare const WRITE_TOOL_NAMES: Set<string>;
+export declare function hasScope(ctx: EffectiveUserContext, scope: string): boolean;
+//# sourceMappingURL=effective-user-context.d.ts.map

package/dist/auth/effective-user-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-user-context.d.ts","sourceRoot":"","sources":["../../src/auth/effective-user-context.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,gBAAgB,aAE3B,CAAC;AAEH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAG1E"}

package/dist/auth/effective-user-context.js

@@ -0,0 +1,9 @@
+export const WRITE_TOOL_NAMES = new Set([
+    'create_task', 'update_task', 'create_risk', 'create_issue', 'update_project',
+]);
+export function hasScope(ctx, scope) {
+    if (!ctx.grantedScopes)
+        return true;
+    return ctx.grantedScopes.includes(scope);
+}
+//# sourceMappingURL=effective-user-context.js.map

package/dist/auth/effective-user-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-user-context.js","sourceRoot":"","sources":["../../src/auth/effective-user-context.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IACtC,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB;CAC9E,CAAC,CAAC;AAEH,MAAM,UAAU,QAAQ,CAAC,GAAyB,EAAE,KAAa;IAC/D,IAAI,CAAC,GAAG,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC"}

package/dist/auth/license-resolver.d.ts

@@ -0,0 +1,6 @@
+export interface LicenseAccessResult {
+    dataMartAccess: 'full' | 'pm-scoped' | 'none';
+    pmScopeUserId?: number;
+}
+export declare function resolveLicenseAccess(licenseTypeIds: number[], userId: number): LicenseAccessResult;
+//# sourceMappingURL=license-resolver.d.ts.map

package/dist/auth/license-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-resolver.d.ts","sourceRoot":"","sources":["../../src/auth/license-resolver.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAKD,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAQlG"}

package/dist/auth/license-resolver.js

@@ -0,0 +1,12 @@
+const FULL_ACCESS_TYPES = new Set([0, 1]);
+const PM_TYPE = 2;
+export function resolveLicenseAccess(licenseTypeIds, userId) {
+    if (licenseTypeIds.some(id => FULL_ACCESS_TYPES.has(id))) {
+        return { dataMartAccess: 'full' };
+    }
+    if (licenseTypeIds.includes(PM_TYPE)) {
+        return { dataMartAccess: 'pm-scoped', pmScopeUserId: userId };
+    }
+    return { dataMartAccess: 'none' };
+}
+//# sourceMappingURL=license-resolver.js.map

package/dist/auth/license-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-resolver.js","sourceRoot":"","sources":["../../src/auth/license-resolver.ts"],"names":[],"mappings":"AAKA,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1C,MAAM,OAAO,GAAG,CAAC,CAAC;AAElB,MAAM,UAAU,oBAAoB,CAAC,cAAwB,EAAE,MAAc;IAC3E,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC"}

package/dist/auth/oauth-auth.d.ts

@@ -0,0 +1,22 @@
+import type { Logger } from 'pino';
+import type { EffectiveUserContext } from './effective-user-context.js';
+export interface TokenExchangeResult {
+    sessionToken: string;
+    userId: number;
+    accountId: number;
+    company: string;
+    email: string;
+    languageId: number;
+    licenseTypeIds: number[];
+    dataMartAccess: 'full' | 'pm-scoped' | 'none';
+    pmScopeUserId?: number;
+    expiresAt: string;
+    scope: string;
+}
+export interface OAuthConfig {
+    tokenExchangeUrl: string;
+    audience: string;
+}
+export declare function exchangeToken(oauthToken: string, config: OAuthConfig, log?: Logger): Promise<TokenExchangeResult>;
+export declare function buildEffectiveUserContextFromExchange(result: TokenExchangeResult): EffectiveUserContext;
+//# sourceMappingURL=oauth-auth.d.ts.map

package/dist/auth/oauth-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-auth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,WAAW,EACnB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,mBAAmB,CAAC,CAoB9B;AAED,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,mBAAmB,GAAG,oBAAoB,CAcvG"}

package/dist/auth/oauth-auth.js

@@ -0,0 +1,34 @@
+export async function exchangeToken(oauthToken, config, log) {
+    log?.debug({ url: config.tokenExchangeUrl }, 'Token exchange request');
+    const response = await fetch(config.tokenExchangeUrl, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'Authorization': `Bearer ${oauthToken}`,
+        },
+        body: JSON.stringify({ audience: config.audience }),
+    });
+    if (!response.ok) {
+        log?.error({ status: response.status }, 'Token exchange failed');
+        throw new Error(`Token exchange failed: ${response.status} ${response.statusText}`);
+    }
+    const result = await response.json();
+    log?.info({ userId: result.userId, company: result.company }, 'Token exchange succeeded');
+    return result;
+}
+export function buildEffectiveUserContextFromExchange(result) {
+    return {
+        source: 'token',
+        company: result.company,
+        accountId: result.accountId,
+        userId: result.userId,
+        languageId: result.languageId,
+        email: result.email,
+        licenseTypeIds: result.licenseTypeIds,
+        dataMartAccess: result.dataMartAccess,
+        pmScopeUserId: result.pmScopeUserId,
+        grantedScopes: result.scope.split(' ').filter(Boolean),
+        authHeaders: { 'Token': result.sessionToken },
+    };
+}
+//# sourceMappingURL=oauth-auth.js.map

package/dist/auth/oauth-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-auth.js","sourceRoot":"","sources":["../../src/auth/oauth-auth.ts"],"names":[],"mappings":"AAsBA,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,MAAmB,EACnB,GAAY;IAEZ,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,wBAAwB,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU,UAAU,EAAE;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;KACpD,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAyB,CAAC;IAC5D,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qCAAqC,CAAC,MAA2B;IAC/E,OAAO;QACL,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACtD,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE;KAC9C,CAAC;AACJ,CAAC"}

package/dist/auth/oauth-metadata.d.ts

@@ -0,0 +1,11 @@
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+}
+export declare function buildResourceMetadataUrl(mcpServerUrl: string): string;
+export declare function buildProtectedResourceMetadata(config: {
+    mcpServerUrl: string;
+    authorizationServerUrl: string;
+}): ProtectedResourceMetadata;
+//# sourceMappingURL=oauth-metadata.d.ts.map

package/dist/auth/oauth-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-metadata.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-metadata.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAMD,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,EAAE,MAAM,CAAC;CAChC,GAAG,yBAAyB,CAM5B"}

package/dist/auth/oauth-metadata.js

@@ -0,0 +1,14 @@
+function stripTrailingSlashes(url) {
+    return url.replace(/\/+$/, '');
+}
+export function buildResourceMetadataUrl(mcpServerUrl) {
+    return `${stripTrailingSlashes(mcpServerUrl)}/.well-known/oauth-protected-resource`;
+}
+export function buildProtectedResourceMetadata(config) {
+    return {
+        resource: stripTrailingSlashes(config.mcpServerUrl),
+        authorization_servers: [config.authorizationServerUrl],
+        scopes_supported: ['mcp:read', 'mcp:write'],
+    };
+}
+//# sourceMappingURL=oauth-metadata.js.map

package/dist/auth/oauth-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-metadata.js","sourceRoot":"","sources":["../../src/auth/oauth-metadata.ts"],"names":[],"mappings":"AAMA,SAAS,oBAAoB,CAAC,GAAW;IACvC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,YAAoB;IAC3D,OAAO,GAAG,oBAAoB,CAAC,YAAY,CAAC,uCAAuC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,MAG9C;IACC,OAAO;QACL,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC;QACnD,qBAAqB,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC;QACtD,gBAAgB,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/auth/token-extraction.d.ts

@@ -0,0 +1,2 @@
+export declare function extractBearerToken(headers: Record<string, string | undefined>): string | undefined;
+//# sourceMappingURL=token-extraction.d.ts.map

package/dist/auth/token-extraction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-extraction.d.ts","sourceRoot":"","sources":["../../src/auth/token-extraction.ts"],"names":[],"mappings":"AAAA,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAIlG"}

package/dist/auth/token-extraction.js

@@ -0,0 +1,7 @@
+export function extractBearerToken(headers) {
+    const auth = headers.authorization;
+    if (auth?.startsWith('Bearer '))
+        return auth.slice(7);
+    return undefined;
+}
+//# sourceMappingURL=token-extraction.js.map

package/dist/auth/token-extraction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-extraction.js","sourceRoot":"","sources":["../../src/auth/token-extraction.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,kBAAkB,CAAC,OAA2C;IAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC;IACnC,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/clients/audit-client.d.ts

@@ -0,0 +1,25 @@
+import type { Logger } from 'pino';
+export interface AuditClientConfig {
+    apiUrl: string;
+    company: string;
+    authHeaders: Record<string, string>;
+    log?: Logger;
+}
+export interface AuditEntry {
+    timestamp: string;
+    userId: number;
+    accountId: number;
+    toolName: string;
+    parametersHash: string;
+    success: boolean;
+    error?: string;
+    aiClientId: string;
+    durationMs: number;
+}
+export interface AuditClient {
+    log(entry: AuditEntry): Promise<void>;
+}
+export declare function hashParameters(params: unknown): string;
+export declare function createAuditClient(config: AuditClientConfig): AuditClient;
+export declare function createNoOpAuditClient(): AuditClient;
+//# sourceMappingURL=audit-client.d.ts.map

package/dist/clients/audit-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-client.d.ts","sourceRoot":"","sources":["../../src/clients/audit-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAEtD;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CA0BxE;AAED,wBAAgB,qBAAqB,IAAI,WAAW,CAInD"}

package/dist/clients/audit-client.js

@@ -0,0 +1,37 @@
+import { createHash } from 'node:crypto';
+export function hashParameters(params) {
+    return createHash('sha256').update(JSON.stringify(params)).digest('hex');
+}
+export function createAuditClient(config) {
+    const url = `${config.apiUrl}/v2/${config.company}/mcp/audit`;
+    const headers = {
+        ...config.authHeaders,
+        'Content-Type': 'application/json',
+    };
+    const log = config.log;
+    return {
+        async log(entry) {
+            try {
+                const response = await fetch(url, {
+                    method: 'POST',
+                    headers,
+                    body: JSON.stringify(entry),
+                });
+                if (!response.ok) {
+                    log?.warn({ status: response.status, toolName: entry.toolName }, 'Audit POST failed');
+                    return;
+                }
+                log?.debug({ toolName: entry.toolName }, 'Audit entry logged');
+            }
+            catch (err) {
+                log?.warn({ err, toolName: entry.toolName }, 'Audit POST error');
+            }
+        },
+    };
+}
+export function createNoOpAuditClient() {
+    return {
+        async log() { },
+    };
+}
+//# sourceMappingURL=audit-client.js.map

package/dist/clients/audit-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-client.js","sourceRoot":"","sources":["../../src/clients/audit-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA0BzC,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,OAAO,MAAM,CAAC,OAAO,YAAY,CAAC;IAC9D,MAAM,OAAO,GAA2B;QACtC,GAAG,MAAM,CAAC,WAAW;QACrB,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IAEvB,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,KAAiB;YACzB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAChC,MAAM,EAAE,MAAM;oBACd,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;iBAC5B,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,mBAAmB,CAAC,CAAC;oBACtF,OAAO;gBACT,CAAC;gBACD,GAAG,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,oBAAoB,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,kBAAkB,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,KAAK,CAAC,GAAG,KAAmB,CAAC;KAC9B,CAAC;AACJ,CAAC"}

package/dist/clients/datamart-client.d.ts

@@ -0,0 +1,16 @@
+import type { Logger } from 'pino';
+export interface DataMartClientConfig {
+    apiUrl: string;
+    company: string;
+    authHeaders: Record<string, string>;
+    log?: Logger;
+}
+export interface DataMartQuery {
+    query: string;
+    variables: Record<string, unknown>;
+}
+export interface DataMartClient {
+    query(body: DataMartQuery): Promise<Record<string, unknown>>;
+}
+export declare function createDataMartClient(config: DataMartClientConfig): DataMartClient;
+//# sourceMappingURL=datamart-client.d.ts.map

package/dist/clients/datamart-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"datamart-client.d.ts","sourceRoot":"","sources":["../../src/clients/datamart-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9D;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAmCjF"}

package/dist/clients/datamart-client.js

@@ -0,0 +1,32 @@
+import { randomUUID } from 'node:crypto';
+export function createDataMartClient(config) {
+    const baseUrl = `${config.apiUrl}/v2/${config.company}/datamart/graphql`;
+    const log = config.log;
+    return {
+        async query(body) {
+            const requestId = randomUUID();
+            const start = Date.now();
+            const response = await fetch(baseUrl, {
+                method: 'POST',
+                headers: {
+                    ...config.authHeaders,
+                    'Content-Type': 'application/json',
+                    'X-Request-Id': requestId,
+                },
+                body: JSON.stringify(body),
+            });
+            if (!response.ok) {
+                log?.error({ requestId, status: response.status, ms: Date.now() - start }, 'DataMart request failed');
+                throw new Error(`DataMart request failed: ${response.status} ${response.statusText}`);
+            }
+            const json = await response.json();
+            if (json.errors?.length) {
+                log?.error({ requestId, graphqlError: json.errors[0].message, ms: Date.now() - start }, 'DataMart GraphQL error');
+                throw new Error(`DataMart GraphQL error: ${json.errors[0].message}`);
+            }
+            log?.debug({ requestId, ms: Date.now() - start }, 'DataMart request OK');
+            return json.data ?? {};
+        },
+    };
+}
+//# sourceMappingURL=datamart-client.js.map

package/dist/clients/datamart-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"datamart-client.js","sourceRoot":"","sources":["../../src/clients/datamart-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmBzC,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,OAAO,MAAM,CAAC,OAAO,mBAAmB,CAAC;IACzE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IAEvB,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,IAAmB;YAC7B,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEzB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;gBACpC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,GAAG,MAAM,CAAC,WAAW;oBACrB,cAAc,EAAE,kBAAkB;oBAClC,cAAc,EAAE,SAAS;iBAC1B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,GAAG,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,EAAE,yBAAyB,CAAC,CAAC;gBACtG,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YACxF,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6E,CAAC;YAE9G,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACxB,GAAG,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,EAAE,wBAAwB,CAAC,CAAC;gBAClH,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,GAAG,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,EAAE,qBAAqB,CAAC,CAAC;YACzE,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/clients/index.d.ts

@@ -0,0 +1,18 @@
+import type { Logger } from 'pino';
+import { type DataMartClient } from './datamart-client.js';
+import { type RestClient } from './rest-client.js';
+import { type AuditClient } from './audit-client.js';
+export interface ClientConfig {
+    apiUrl: string;
+    company: string;
+    authHeaders: Record<string, string>;
+    log?: Logger;
+}
+export interface Clients {
+    datamart: DataMartClient;
+    rest: RestClient;
+    audit: AuditClient;
+}
+export declare function createClients(config: ClientConfig, audit?: AuditClient): Clients;
+export type { DataMartClient, RestClient, AuditClient };
+//# sourceMappingURL=index.d.ts.map

package/dist/clients/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAyB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE5E,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,WAAW,CAAC;CACpB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAMhF;AAED,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC"}