@jbctechsolutions/mcp-office365 2.5.1 → 4.0.0

package/dist/registry/context.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * Runtime-context helpers for registry tool handlers.
+ */
+import type { GraphToolsets, ToolContext } from './types.js';
+/**
+ * Resolves an initialized Graph-backend toolset from the runtime context, or
+ * throws a clear error when the Graph backend is unavailable.
+ *
+ * Centralizes the per-domain "resolve toolset or throw" boilerplate so every
+ * migrated domain shares one implementation instead of hand-rolling a null
+ * check. The `key` is type-checked against the augmented `GraphToolsets`, and
+ * the return type is the exact toolset class for that key.
+ */
+export declare function requireGraphToolset<K extends keyof GraphToolsets>(ctx: ToolContext, key: K): GraphToolsets[K];
+//# sourceMappingURL=context.d.ts.map

package/dist/registry/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/registry/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,aAAa,EAC/D,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,CAAC,GACL,aAAa,CAAC,CAAC,CAAC,CAKlB"}

package/dist/registry/context.js

@@ -0,0 +1,20 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * Resolves an initialized Graph-backend toolset from the runtime context, or
+ * throws a clear error when the Graph backend is unavailable.
+ *
+ * Centralizes the per-domain "resolve toolset or throw" boilerplate so every
+ * migrated domain shares one implementation instead of hand-rolling a null
+ * check. The `key` is type-checked against the augmented `GraphToolsets`, and
+ * the return type is the exact toolset class for that key.
+ */
+export function requireGraphToolset(ctx, key) {
+    if (ctx.graph == null) {
+        throw new Error('This tool requires the Microsoft Graph API backend.');
+    }
+    return ctx.graph[key];
+}
+//# sourceMappingURL=context.js.map

package/dist/registry/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/registry/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAgB,EAChB,GAAM;IAEN,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC"}

package/dist/registry/define-tool.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * `defineTool` — typed helper for authoring a tool definition.
+ *
+ * Preserves the inference link between the Zod input schema and the handler's
+ * `params` argument, so a domain module declares its schema once and the
+ * handler is type-checked against it.
+ */
+import type { z } from 'zod';
+import type { ToolDefinition } from './types.js';
+export declare function defineTool<S extends z.ZodType>(def: ToolDefinition<S>): ToolDefinition<S>;
+//# sourceMappingURL=define-tool.d.ts.map

package/dist/registry/define-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-tool.d.ts","sourceRoot":"","sources":["../../src/registry/define-tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,wBAAgB,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAEzF"}

package/dist/registry/define-tool.js

@@ -0,0 +1,8 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+export function defineTool(def) {
+    return def;
+}
+//# sourceMappingURL=define-tool.js.map

package/dist/registry/define-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-tool.js","sourceRoot":"","sources":["../../src/registry/define-tool.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,MAAM,UAAU,UAAU,CAAsB,GAAsB;IACpE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/registry/elicit-links.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * Factory helpers for the declarative `onElicit` links (U11).
+ *
+ * A `prepare_*` tool opts into inline elicitation by pointing at its `confirm_*`
+ * counterpart and describing how to build that confirm's params from the prepare
+ * params + the minted token(s). The three confirm shapes in the codebase each
+ * get a one-line factory so the ~35 tool defs stay declarative:
+ *
+ * - {@link approvalTokenLink} — confirm takes `{ approval_token }`.
+ * - {@link tokenIdLink}       — confirm takes `{ token_id, ...copied ids }`.
+ * - {@link batchLink}         — confirm takes `{ tokens: [{token_id, email_id}] }`.
+ */
+import type { ElicitLink } from './types.js';
+/** Shape A: confirm tool takes a single `{ approval_token }`. */
+export declare function approvalTokenLink(confirmTool: string): ElicitLink;
+/**
+ * Shape B: confirm tool takes `{ token_id, ...copyFields }`, where each copied
+ * field is carried over verbatim from the prepare params (same field name).
+ */
+export declare function tokenIdLink(confirmTool: string, copyFields?: readonly string[]): ElicitLink;
+/**
+ * Shape C: the batch confirm takes `{ tokens: [{ token_id, email_id }, …] }`,
+ * one pair per email. The batch prepare returns `{ tokens: [{ token_id, email:
+ * { id, … } }] }` where the token's target is `email.id`, so `email_id` is read
+ * from `email.id` (with a direct `email_id` fallback for robustness).
+ *
+ * `collectTokenIds` gathers EVERY minted `token_id` independently of the id
+ * mapping, so a decline invalidates all of them even if a pair is malformed.
+ */
+export declare function batchLink(confirmTool: string): ElicitLink;
+//# sourceMappingURL=elicit-links.d.ts.map

package/dist/registry/elicit-links.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elicit-links.d.ts","sourceRoot":"","sources":["../../src/registry/elicit-links.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,YAAY,CAAC;AAmCzD,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,CAMjE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,GAAE,SAAS,MAAM,EAAO,GAAG,UAAU,CAS/F;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,CAMzD"}

package/dist/registry/elicit-links.js

@@ -0,0 +1,102 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/** Parses a prepare tool's single-text-block JSON result, or {} on any failure. */
+function parseResult(result) {
+    const text = result.content[0]?.text;
+    if (text == null)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return {};
+    }
+}
+/** The lone token a single-target prepare minted (`approval_token`/`token_id`). */
+function singleToken(result) {
+    const parsed = parseResult(result);
+    const token = parsed['approval_token'] ?? parsed['token_id'];
+    return typeof token === 'string' && token.length > 0 ? token : null;
+}
+function singleTokenIds(result) {
+    const token = singleToken(result);
+    return token != null ? [token] : [];
+}
+/** Copies the named keys from prepare params into the confirm params. */
+function pick(params, keys) {
+    const src = (params ?? {});
+    const out = {};
+    for (const key of keys) {
+        if (src[key] !== undefined)
+            out[key] = src[key];
+    }
+    return out;
+}
+/** Shape A: confirm tool takes a single `{ approval_token }`. */
+export function approvalTokenLink(confirmTool) {
+    return {
+        confirmTool,
+        collectTokenIds: singleTokenIds,
+        buildParams: (_prepareParams, result) => ({ approval_token: singleToken(result) }),
+    };
+}
+/**
+ * Shape B: confirm tool takes `{ token_id, ...copyFields }`, where each copied
+ * field is carried over verbatim from the prepare params (same field name).
+ */
+export function tokenIdLink(confirmTool, copyFields = []) {
+    return {
+        confirmTool,
+        collectTokenIds: singleTokenIds,
+        buildParams: (prepareParams, result) => ({
+            token_id: singleToken(result),
+            ...pick(prepareParams, copyFields),
+        }),
+    };
+}
+/**
+ * Shape C: the batch confirm takes `{ tokens: [{ token_id, email_id }, …] }`,
+ * one pair per email. The batch prepare returns `{ tokens: [{ token_id, email:
+ * { id, … } }] }` where the token's target is `email.id`, so `email_id` is read
+ * from `email.id` (with a direct `email_id` fallback for robustness).
+ *
+ * `collectTokenIds` gathers EVERY minted `token_id` independently of the id
+ * mapping, so a decline invalidates all of them even if a pair is malformed.
+ */
+export function batchLink(confirmTool) {
+    return {
+        confirmTool,
+        collectTokenIds: (result) => batchTokenIds(result),
+        buildParams: (_prepareParams, result) => ({ tokens: batchPairs(result) }),
+    };
+}
+/** Raw `tokens` array from a batch prepare result, or []. */
+function batchEntries(result) {
+    const tokens = parseResult(result)['tokens'];
+    return Array.isArray(tokens) ? tokens : [];
+}
+/** Every minted token id in the batch result (authoritative for invalidation). */
+function batchTokenIds(result) {
+    const ids = [];
+    for (const entry of batchEntries(result)) {
+        if (typeof entry['token_id'] === 'string')
+            ids.push(entry['token_id']);
+    }
+    return ids;
+}
+/** The `{ token_id, email_id }` pairs the batch confirm expects. */
+function batchPairs(result) {
+    const pairs = [];
+    for (const entry of batchEntries(result)) {
+        const tokenId = entry['token_id'];
+        const email = entry['email'];
+        const emailId = email?.['id'] ?? entry['email_id'];
+        if (typeof tokenId === 'string' && typeof emailId === 'string') {
+            pairs.push({ token_id: tokenId, email_id: emailId });
+        }
+    }
+    return pairs;
+}
+//# sourceMappingURL=elicit-links.js.map

package/dist/registry/elicit-links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elicit-links.js","sourceRoot":"","sources":["../../src/registry/elicit-links.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiBH,mFAAmF;AACnF,SAAS,WAAW,CAAC,MAAkB;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IACrC,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,MAAkB;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,cAAc,CAAC,MAAkB;IACxC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,yEAAyE;AACzE,SAAS,IAAI,CAAC,MAAe,EAAE,IAAuB;IACpD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IACtD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO;QACL,WAAW;QACX,eAAe,EAAE,cAAc;QAC/B,WAAW,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;KACnF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB,EAAE,aAAgC,EAAE;IACjF,OAAO;QACL,WAAW;QACX,eAAe,EAAE,cAAc;QAC/B,WAAW,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACvC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC;YAC7B,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC;SACnC,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,WAAmB;IAC3C,OAAO;QACL,WAAW;QACX,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;QAClD,WAAW,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,SAAS,YAAY,CAAC,MAAkB;IACtC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAyC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,kFAAkF;AAClF,SAAS,aAAa,CAAC,MAAkB;IACvC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAOD,oEAAoE;AACpE,SAAS,UAAU,CAAC,MAAkB;IACpC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAwC,CAAC;QACpE,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/registry/elicitor.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * Inline confirmation via MCP elicitation (U11).
+ *
+ * Bridges the MCP `Server.elicitInput` request to the registry's backend-neutral
+ * {@link Elicitor} contract. Capability-gated and fail-open-to-degrade: if the
+ * client can't elicit, or the request times out or errors, the caller falls back
+ * to the durable two-phase token flow — an inline confirmation never blocks or
+ * fails a tool call.
+ */
+import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import type { Elicitor } from './types.js';
+/** How long to wait for the user's inline yes/no before degrading (U11). */
+export declare const ELICIT_TIMEOUT_MS = 60000;
+/**
+ * Builds an {@link Elicitor} bound to a live MCP server. Returns 'degrade' —
+ * never throws — when the client lacks the capability, cancels, or times out, so
+ * the dispatch interceptor can hand back the durable token unchanged.
+ */
+export declare function createServerElicitor(server: Server): Elicitor;
+//# sourceMappingURL=elicitor.d.ts.map

package/dist/registry/elicitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elicitor.d.ts","sourceRoot":"","sources":["../../src/registry/elicitor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAiB,MAAM,YAAY,CAAC;AAE1D,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,QAAS,CAAC;AAmBxC;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAwB7D"}

package/dist/registry/elicitor.js

@@ -0,0 +1,51 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/** How long to wait for the user's inline yes/no before degrading (U11). */
+export const ELICIT_TIMEOUT_MS = 60_000;
+/**
+ * A minimal confirmation form. We key the decision off the elicitation `action`
+ * ('accept' = yes), so the schema is a formality some clients render; a single
+ * optional boolean keeps it valid and unobtrusive.
+ */
+const CONFIRM_SCHEMA = {
+    type: 'object',
+    properties: {
+        confirm: {
+            type: 'boolean',
+            title: 'Confirm',
+            description: 'Approve this destructive action.',
+        },
+    },
+    required: [],
+};
+/**
+ * Builds an {@link Elicitor} bound to a live MCP server. Returns 'degrade' —
+ * never throws — when the client lacks the capability, cancels, or times out, so
+ * the dispatch interceptor can hand back the durable token unchanged.
+ */
+export function createServerElicitor(server) {
+    return async ({ message }) => {
+        if (server.getClientCapabilities()?.elicitation == null) {
+            return 'degrade';
+        }
+        try {
+            const result = await server.elicitInput({ message, requestedSchema: CONFIRM_SCHEMA }, { timeout: ELICIT_TIMEOUT_MS });
+            switch (result.action) {
+                case 'accept':
+                    return 'accept';
+                case 'decline':
+                    return 'decline';
+                default:
+                    // 'cancel' — the user dismissed without deciding; leave the token.
+                    return 'degrade';
+            }
+        }
+        catch {
+            // Timeout or transport error → degrade (fail-open to the token flow).
+            return 'degrade';
+        }
+    };
+}
+//# sourceMappingURL=elicitor.js.map

package/dist/registry/elicitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elicitor.js","sourceRoot":"","sources":["../../src/registry/elicitor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC;;;;GAIG;AACH,MAAM,cAAc,GAAG;IACrB,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,OAAO,EAAE;YACP,IAAI,EAAE,SAAkB;YACxB,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,kCAAkC;SAChD;KACF;IACD,QAAQ,EAAE,EAAc;CACzB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAA0B,EAAE;QACnD,IAAI,MAAM,CAAC,qBAAqB,EAAE,EAAE,WAAW,IAAI,IAAI,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CACrC,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,EAC5C,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAC/B,CAAC;YACF,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,KAAK,QAAQ;oBACX,OAAO,QAAQ,CAAC;gBAClB,KAAK,SAAS;oBACZ,OAAO,SAAS,CAAC;gBACnB;oBACE,mEAAmE;oBACnE,OAAO,SAAS,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/registry/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * Tool registry barrel.
+ */
+export type { Backend, Preset, ToolAnnotations, ToolResult, ToolContext, ToolDefinition, GraphToolsets, ConfirmMode, ElicitOutcome, ElicitRequest, Elicitor, ElicitLink, } from './types.js';
+export { ToolRegistry, toInputSchema } from './registry.js';
+export type { SurfaceOptions } from './registry.js';
+export { defineTool } from './define-tool.js';
+export { requireGraphToolset } from './context.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/registry/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/registry/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AAEH,YAAY,EACV,OAAO,EACP,MAAM,EACN,eAAe,EACf,UAAU,EACV,WAAW,EACX,cAAc,EACd,aAAa,EACb,WAAW,EACX,aAAa,EACb,aAAa,EACb,QAAQ,EACR,UAAU,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC5D,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC"}

package/dist/registry/index.js

@@ -0,0 +1,8 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+export { ToolRegistry, toInputSchema } from './registry.js';
+export { defineTool } from './define-tool.js';
+export { requireGraphToolset } from './context.js';
+//# sourceMappingURL=index.js.map

package/dist/registry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/registry/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoBH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC"}

package/dist/registry/registry.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * ToolRegistry — single source of truth for the MCP tool surface (U1).
+ *
+ * Holds tool definitions, derives the advertised JSON Schema from each Zod
+ * schema, filters the surface by backend / preset / read-only, and dispatches
+ * a call to the matching handler after validating its arguments.
+ */
+import { z } from 'zod';
+import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { Backend, Preset, ToolContext, ToolDefinition, ToolResult } from './types.js';
+/** Options controlling which tools are exposed to a client. */
+export interface SurfaceOptions {
+    readonly backend: Backend;
+    /** Presets to include. Undefined/empty means the full surface. */
+    readonly presets?: readonly Preset[];
+    /** When true, only non-destructive tools are exposed. */
+    readonly readOnly?: boolean;
+}
+/**
+ * Converts a Zod schema to an MCP-compatible `inputSchema`.
+ *
+ * Uses zod 4's native `z.toJSONSchema` (draft-07 target) and strips the
+ * `$schema` key, which MCP's `Tool.inputSchema` does not carry. Transitional
+ * alias keys (U6/D11) are handled by the input pipeline, not here; when a
+ * schema opts into aliases it should expose them as optional properties so the
+ * advertised schema stays validation-safe.
+ */
+export declare function toInputSchema(schema: z.ZodType): Tool['inputSchema'];
+/**
+ * In-memory registry of tool definitions.
+ */
+export declare class ToolRegistry {
+    private readonly definitions;
+    /** Registers a batch of tool definitions. Throws on a duplicate name. */
+    register(defs: readonly ToolDefinition[]): void;
+    /** True when a tool with this name is registered. */
+    has(name: string): boolean;
+    /** All registered names, insertion order preserved. */
+    names(): string[];
+    /** Returns a single definition, or undefined. */
+    get(name: string): ToolDefinition | undefined;
+    /**
+     * Returns the MCP tool list for a given surface, filtered by backend,
+     * preset membership, and read-only mode.
+     */
+    listTools(options: SurfaceOptions): Tool[];
+    /** True when a tool is exposed under the given surface. */
+    isExposed(name: string, options: SurfaceOptions): boolean;
+    /**
+     * Validates arguments against the tool's schema and invokes its handler.
+     * Returns undefined when no tool with this name is registered, so the caller
+     * can fall back to the legacy dispatch during the U2 migration window.
+     */
+    dispatch(name: string, args: unknown, ctx: ToolContext, options: SurfaceOptions): Promise<ToolResult | undefined>;
+    /**
+     * Runs a prepare tool, asks the user inline, and resolves the outcome (U11):
+     * - accept  → execute now via the linked confirm tool (its exact validation +
+     *             execution is reused; the just-minted token is consumed there).
+     * - decline → invalidate the token (consume-without-execute) and report abort.
+     * - degrade → return the prepare token response unchanged (cancel / timeout /
+     *             no capability / unparseable token) — the normal two-phase flow.
+     *
+     * Fail-closed: the destructive action runs only on an explicit accept.
+     */
+    private dispatchWithElicitation;
+    private filtered;
+    private matches;
+}
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/registry/registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAE/D,OAAO,KAAK,EACV,OAAO,EACP,MAAM,EACN,WAAW,EACX,cAAc,EACd,UAAU,EAGX,MAAM,YAAY,CAAC;AAEpB,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,CAWpE;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqC;IAEjE,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI;IAS/C,qDAAqD;IACrD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B,uDAAuD;IACvD,KAAK,IAAI,MAAM,EAAE;IAIjB,iDAAiD;IACjD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C;;;OAGG;IACH,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,EAAE;IAc1C,2DAA2D;IAC3D,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO;IAKzD;;;;OAIG;IACG,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IA6BlC;;;;;;;;;OASG;YACW,uBAAuB;IAkDrC,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,OAAO;CAahB"}

package/dist/registry/registry.js

@@ -0,0 +1,221 @@
+/**
+ * Copyright (c) 2026 JBC Tech Solutions, LLC
+ * Licensed under the MIT License. See LICENSE file in the project root.
+ */
+/**
+ * ToolRegistry — single source of truth for the MCP tool surface (U1).
+ *
+ * Holds tool definitions, derives the advertised JSON Schema from each Zod
+ * schema, filters the surface by backend / preset / read-only, and dispatches
+ * a call to the matching handler after validating its arguments.
+ */
+import { z } from 'zod';
+import { ReadOnlyModeError } from '../utils/errors.js';
+/**
+ * Converts a Zod schema to an MCP-compatible `inputSchema`.
+ *
+ * Uses zod 4's native `z.toJSONSchema` (draft-07 target) and strips the
+ * `$schema` key, which MCP's `Tool.inputSchema` does not carry. Transitional
+ * alias keys (U6/D11) are handled by the input pipeline, not here; when a
+ * schema opts into aliases it should expose them as optional properties so the
+ * advertised schema stays validation-safe.
+ */
+export function toInputSchema(schema) {
+    // `io: 'input'` — the advertised schema describes what a CLIENT sends, so a
+    // field with a `.default()` is optional (the server fills the default at
+    // parse time). Zod 4's default `io: 'output'` would mark defaulted fields as
+    // required, misleading agents into always supplying them.
+    const json = z.toJSONSchema(schema, { target: 'draft-7', io: 'input' });
+    delete json['$schema'];
+    if (json['type'] == null) {
+        json['type'] = 'object';
+    }
+    return json;
+}
+/**
+ * In-memory registry of tool definitions.
+ */
+export class ToolRegistry {
+    definitions = new Map();
+    /** Registers a batch of tool definitions. Throws on a duplicate name. */
+    register(defs) {
+        for (const def of defs) {
+            if (this.definitions.has(def.name)) {
+                throw new Error(`Duplicate tool registration: "${def.name}"`);
+            }
+            this.definitions.set(def.name, def);
+        }
+    }
+    /** True when a tool with this name is registered. */
+    has(name) {
+        return this.definitions.has(name);
+    }
+    /** All registered names, insertion order preserved. */
+    names() {
+        return [...this.definitions.keys()];
+    }
+    /** Returns a single definition, or undefined. */
+    get(name) {
+        return this.definitions.get(name);
+    }
+    /**
+     * Returns the MCP tool list for a given surface, filtered by backend,
+     * preset membership, and read-only mode.
+     */
+    listTools(options) {
+        return this.filtered(options).map((def) => {
+            const tool = {
+                name: def.name,
+                description: def.description,
+                inputSchema: toInputSchema(def.input),
+            };
+            if (Object.keys(def.annotations).length > 0) {
+                return { ...tool, annotations: def.annotations };
+            }
+            return tool;
+        });
+    }
+    /** True when a tool is exposed under the given surface. */
+    isExposed(name, options) {
+        const def = this.definitions.get(name);
+        return def != null && this.matches(def, options);
+    }
+    /**
+     * Validates arguments against the tool's schema and invokes its handler.
+     * Returns undefined when no tool with this name is registered, so the caller
+     * can fall back to the legacy dispatch during the U2 migration window.
+     */
+    async dispatch(name, args, ctx, options) {
+        const def = this.definitions.get(name);
+        if (def == null) {
+            return undefined;
+        }
+        if (!this.matches(def, options)) {
+            // Distinguish the read-only rejection so it surfaces a stable
+            // READ_ONLY_MODE envelope (D13) — but only when read-only is the *sole*
+            // reason (the tool would otherwise be exposed). A tool also filtered by
+            // backend/preset gets the generic error, avoiding misattribution.
+            if (options.readOnly === true && this.matches(def, { ...options, readOnly: false })) {
+                throw new ReadOnlyModeError(name);
+            }
+            throw new Error(`Tool "${name}" is not available in the current mode.`);
+        }
+        // MCP marks `arguments` optional; default to {} so no-input tools
+        // (e.g. list_mail_rules) parse cleanly, matching the codebase-wide
+        // `parse(args ?? {})` convention.
+        const params = def.input.parse(args ?? {});
+        // Inline-elicitation interceptor (U11): only for a prepare tool that opted in
+        // (onElicit), when the server is in elicit mode and the client can elicit.
+        // Everything else runs the handler directly — an unchanged fast path.
+        if (def.onElicit != null && ctx.confirmMode === 'elicit' && ctx.elicit != null) {
+            return this.dispatchWithElicitation(def, params, ctx, def.onElicit, ctx.elicit);
+        }
+        return def.handler(ctx, params);
+    }
+    /**
+     * Runs a prepare tool, asks the user inline, and resolves the outcome (U11):
+     * - accept  → execute now via the linked confirm tool (its exact validation +
+     *             execution is reused; the just-minted token is consumed there).
+     * - decline → invalidate the token (consume-without-execute) and report abort.
+     * - degrade → return the prepare token response unchanged (cancel / timeout /
+     *             no capability / unparseable token) — the normal two-phase flow.
+     *
+     * Fail-closed: the destructive action runs only on an explicit accept.
+     */
+    async dispatchWithElicitation(def, prepareParams, ctx, link, elicit) {
+        const prepareResult = await def.handler(ctx, prepareParams);
+        const tokenIds = link.collectTokenIds(prepareResult);
+        // No token in the prepare output → nothing to gate/execute; degrade.
+        if (tokenIds.length === 0) {
+            return prepareResult;
+        }
+        const message = link.message?.(prepareParams) ?? defaultConfirmMessage(ctx, tokenIds[0]);
+        const outcome = await elicit({ message });
+        if (outcome === 'accept') {
+            const confirmDef = this.definitions.get(link.confirmTool);
+            // A misconfigured link must not silently execute nor lose the approval —
+            // degrade to the token response so the two-phase path still works.
+            if (confirmDef == null) {
+                return prepareResult;
+            }
+            // Only the param mapping/validation is guarded: a bad buildParams must
+            // degrade (return the still-live token) rather than error out an accepted
+            // action. The confirm handler runs OUTSIDE the guard so a genuine
+            // execution error (e.g. a Graph failure) surfaces normally, not masked.
+            let confirmParams;
+            try {
+                confirmParams = confirmDef.input.parse(link.buildParams(prepareParams, prepareResult));
+            }
+            catch {
+                return prepareResult;
+            }
+            return confirmDef.handler(ctx, confirmParams);
+        }
+        if (outcome === 'decline') {
+            // Burn every token this prepare minted (batch mints one per item), so a
+            // declined action can't be redeemed via the confirm flow afterward.
+            for (const tokenId of tokenIds) {
+                invalidateToken(ctx, tokenId);
+            }
+            return declinedResult(def.name);
+        }
+        // 'degrade' — hand back the durable token exactly as the token flow would.
+        return prepareResult;
+    }
+    filtered(options) {
+        return [...this.definitions.values()].filter((def) => this.matches(def, options));
+    }
+    matches(def, options) {
+        if (!def.backends.includes(options.backend)) {
+            return false;
+        }
+        if (options.readOnly === true && !isReadOnly(def)) {
+            return false;
+        }
+        const presets = options.presets;
+        if (presets != null && presets.length > 0 && def.presets.length > 0) {
+            return def.presets.some((p) => presets.includes(p));
+        }
+        return true;
+    }
+}
+/**
+ * A tool is read-only iff it explicitly advertises `readOnlyHint: true`. This is
+ * stricter than `!destructive` — a non-destructive write (e.g. create_draft,
+ * mark_email_read) still mutates state and must be excluded from `--read-only`.
+ */
+function isReadOnly(def) {
+    return def.annotations.readOnlyHint === true;
+}
+/**
+ * Burns a token without executing its action, so a declined destructive request
+ * can't be redeemed via the confirm flow afterward. Uses the token's own
+ * operation/targetId (it was just minted, so this always validates), reusing the
+ * store's atomic single-use consume — no new persistence machinery.
+ */
+function invalidateToken(ctx, tokenId) {
+    const token = ctx.tokenManager.lookupToken(tokenId);
+    if (token != null) {
+        ctx.tokenManager.consumeToken(tokenId, token.operation, token.targetId);
+    }
+}
+/** A generic confirmation prompt derived from the token's operation. */
+function defaultConfirmMessage(ctx, tokenId) {
+    const op = tokenId != null ? ctx.tokenManager.lookupToken(tokenId)?.operation : undefined;
+    const action = op != null ? op.replace(/_/g, ' ') : 'this action';
+    return `Confirm: ${action}? This cannot be undone.`;
+}
+/** The result returned when a user declines an inline confirmation. */
+function declinedResult(toolName) {
+    return {
+        content: [{
+                type: 'text',
+                text: JSON.stringify({
+                    success: false,
+                    declined: true,
+                    message: `Action cancelled: you declined the confirmation for ${toolName}. The approval token has been invalidated.`,
+                }, null, 2),
+            }],
+    };
+}
+//# sourceMappingURL=registry.js.map