@maadb/core 0.0.1 → 0.7.10-rc.3

package/dist/mcp/tools/auth.js

@@ -0,0 +1,181 @@
+// ============================================================================
+// Admin MCP auth tools — 0.7.0 Scoped Auth & Identity (P3c)
+//
+//   maad_issue_token    — issue a new token; returns plaintext ONCE + record
+//   maad_revoke_token   — mark a token revoked; returns record
+//   maad_rotate_token   — revoke + reissue with preserved caps; returns plaintext + record
+//   maad_list_tokens    — list registry entries (no hash)
+//   maad_show_token     — fetch one record by id (no hash)
+//
+// All admin-only and engine-less (same pattern as maad_instance_reload and
+// maad_subscriptions). Refuse if the instance has no token registry (stdio
+// / synthetic). Role gate: admin on every project in the session binding.
+// ============================================================================
+import { z } from 'zod';
+import { successResponse, errorResponse } from '../response.js';
+import { resolveSessionId } from '../../instance/session.js';
+import { roleSatisfies } from '../roles.js';
+import { maadError } from '../../errors.js';
+import { tokenId as toTokenId } from '../../auth/types.js';
+const ROLE_ENUM = z.enum(['reader', 'writer', 'admin']);
+/**
+ * Inline admin role check — same pattern as maad_instance_reload. Engine-less
+ * tools bypass withEngine's role gate, so we enforce here. Requires admin
+ * effective role on EVERY project in the session's binding (least privilege,
+ * since token ops affect the instance-wide registry).
+ */
+function requireAdminEverywhere(ctx, sessionId) {
+    const state = ctx.sessions.get(sessionId);
+    if (!state || state.mode === null) {
+        return errorResponse([maadError('SESSION_UNBOUND', 'Session is not bound. Call maad_use_project(s) before admin auth tools.')]);
+    }
+    for (const [projectName, role] of state.effectiveRoles) {
+        if (!roleSatisfies(role, 'admin')) {
+            return errorResponse([maadError('INSUFFICIENT_ROLE', `admin auth tools require admin on every project in the session binding; session has "${role}" on "${projectName}".`)]);
+        }
+    }
+    return null;
+}
+function requireTokenStore(ctx) {
+    if (ctx.tokens === null) {
+        return errorResponse([maadError('TOKENS_FILE_MISSING', 'Token registry is not available — this MCP instance runs in stdio/synthetic mode with no tokens.yaml. Admin auth tools require --instance with a file-mode registry.')]);
+    }
+    return null;
+}
+/** Scrub `hash` from a record before returning to clients — they never need it. */
+function sanitize(record) {
+    const { hash, ...rest } = record;
+    void hash;
+    return rest;
+}
+export function register(server, ctx) {
+    server.registerTool('maad_issue_token', {
+        description: 'Issue a new auth token. Returns plaintext ONCE plus record metadata — plaintext is never recoverable after. Admin on every bound project required.',
+        inputSchema: z.object({
+            role: ROLE_ENUM.describe('Token\'s global role (capped by per-project overrides and instance project ceiling)'),
+            projects: z.array(z.object({
+                name: z.string().describe('Project name or "*" wildcard'),
+                role: ROLE_ENUM.optional().describe('Optional per-project role downgrade (never exceeds global)'),
+            })).describe('Allowlist. Wildcard `*` matches every project at the token\'s global role.'),
+            name: z.string().optional().describe('Human label (e.g. "brain-app-gateway")'),
+            agentId: z.string().optional().describe('Ref -> agent for identity attribution'),
+            userId: z.string().optional().describe('Ref -> user when token represents a human'),
+            expiresAt: z.string().optional().describe('ISO 8601 expiry timestamp'),
+        }),
+    }, async (args, extra) => {
+        const storeErr = requireTokenStore(ctx);
+        if (storeErr)
+            return storeErr;
+        const sid = resolveSessionId(extra);
+        const roleErr = requireAdminEverywhere(ctx, sid);
+        if (roleErr)
+            return roleErr;
+        const spec = {
+            role: args.role,
+            projects: args.projects.map(p => {
+                const cap = { name: p.name };
+                if (p.role !== undefined)
+                    cap.role = p.role;
+                return cap;
+            }),
+        };
+        if (args.name !== undefined)
+            spec.name = args.name;
+        if (args.agentId !== undefined)
+            spec.agentId = args.agentId;
+        if (args.userId !== undefined)
+            spec.userId = args.userId;
+        if (args.expiresAt !== undefined)
+            spec.expiresAt = args.expiresAt;
+        const result = await ctx.tokens.issue(spec);
+        if (!result.ok)
+            return errorResponse(result.errors);
+        return successResponse({
+            plaintext: result.value.plaintext,
+            record: sanitize(result.value.record),
+            warning: 'Store the plaintext now — it will not be returned again.',
+        }, 'maad_issue_token');
+    });
+    server.registerTool('maad_revoke_token', {
+        description: 'Revoke a token by its id. Idempotent. Admin on every bound project required.',
+        inputSchema: z.object({
+            id: z.string().describe('Token id (tok-xxx)'),
+        }),
+    }, async (args, extra) => {
+        const storeErr = requireTokenStore(ctx);
+        if (storeErr)
+            return storeErr;
+        const sid = resolveSessionId(extra);
+        const roleErr = requireAdminEverywhere(ctx, sid);
+        if (roleErr)
+            return roleErr;
+        const result = await ctx.tokens.revoke(toTokenId(args.id));
+        if (!result.ok)
+            return errorResponse(result.errors);
+        return successResponse({ record: sanitize(result.value) }, 'maad_revoke_token');
+    });
+    server.registerTool('maad_rotate_token', {
+        description: 'Revoke an existing token and issue a new one with the same capabilities. Returns new plaintext ONCE. Admin on every bound project required.',
+        inputSchema: z.object({
+            id: z.string().describe('Token id to rotate (tok-xxx)'),
+        }),
+    }, async (args, extra) => {
+        const storeErr = requireTokenStore(ctx);
+        if (storeErr)
+            return storeErr;
+        const sid = resolveSessionId(extra);
+        const roleErr = requireAdminEverywhere(ctx, sid);
+        if (roleErr)
+            return roleErr;
+        const result = await ctx.tokens.rotate(toTokenId(args.id));
+        if (!result.ok)
+            return errorResponse(result.errors);
+        return successResponse({
+            plaintext: result.value.plaintext,
+            record: sanitize(result.value.record),
+            warning: 'Store the new plaintext now — old token revoked, new plaintext will not be returned again.',
+        }, 'maad_rotate_token');
+    });
+    server.registerTool('maad_list_tokens', {
+        description: 'List all tokens in the registry. Active tokens by default; pass includeRevoked:true for full history. Admin on every bound project required.',
+        inputSchema: z.object({
+            includeRevoked: z.boolean().optional().describe('Include revoked tokens in the response'),
+        }),
+    }, async (args, extra) => {
+        const storeErr = requireTokenStore(ctx);
+        if (storeErr)
+            return storeErr;
+        const sid = resolveSessionId(extra);
+        const roleErr = requireAdminEverywhere(ctx, sid);
+        if (roleErr)
+            return roleErr;
+        const all = ctx.tokens.list();
+        const filtered = args.includeRevoked === true ? all : all.filter(r => r.revokedAt === undefined);
+        return successResponse({
+            tokens: filtered.map(sanitize),
+            total: filtered.length,
+            activeCount: ctx.tokens.activeCount(),
+        }, 'maad_list_tokens');
+    });
+    server.registerTool('maad_show_token', {
+        description: 'Fetch a single token record by id. Hash is never returned. Admin on every bound project required.',
+        inputSchema: z.object({
+            id: z.string().describe('Token id (tok-xxx)'),
+        }),
+    }, async (args, extra) => {
+        const storeErr = requireTokenStore(ctx);
+        if (storeErr)
+            return storeErr;
+        const sid = resolveSessionId(extra);
+        const roleErr = requireAdminEverywhere(ctx, sid);
+        if (roleErr)
+            return roleErr;
+        const record = ctx.tokens.lookupById(toTokenId(args.id));
+        if (!record) {
+            return errorResponse([maadError('TOKEN_NOT_FOUND', `No token with id ${args.id}`)]);
+        }
+        return successResponse({ record: sanitize(record) }, 'maad_show_token');
+    });
+    return 5;
+}
+//# sourceMappingURL=auth.js.map

package/dist/mcp/tools/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/mcp/tools/auth.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,4DAA4D;AAC5D,EAAE;AACF,6EAA6E;AAC7E,+DAA+D;AAC/D,2FAA2F;AAC3F,0DAA0D;AAC1D,2DAA2D;AAC3D,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,+EAA+E;AAE/E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAa,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAExD;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,GAAgB,EAAE,SAAiB;IACjE,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,aAAa,CAAC,CAAC,SAAS,CAAC,iBAAiB,EAC/C,yEAAyE,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,KAAK,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO,aAAa,CAAC,CAAC,SAAS,CAAC,mBAAmB,EACjD,wFAAwF,IAAI,SAAS,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAgB;IACzC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,aAAa,CAAC,CAAC,SAAS,CAAC,qBAAqB,EACnD,sKAAsK,CAAC,CAAC,CAAC,CAAC;IAC9K,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CAAC,MAAmB;IACnC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IACjC,KAAK,IAAI,CAAC;IACV,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAiB,EAAE,GAAgB;IAC1D,MAAM,CAAC,YAAY,CAAC,kBAAkB,EAAE;QACtC,WAAW,EAAE,oJAAoJ;QACjK,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,qFAAqF,CAAC;YAC/G,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;gBACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;gBACzD,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;aAClG,CAAC,CAAC,CAAC,QAAQ,CAAC,4EAA4E,CAAC;YAC1F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAC9E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;YAChF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;YACnF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;SACvE,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,IAAI,GAAc;YACtB,IAAI,EAAE,IAAI,CAAC,IAAY;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;gBAC9B,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;oBAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,IAAY,CAAC;gBACpD,OAAO,GAAG,CAAC;YACb,CAAC,CAAC;SACH,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QACzD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,eAAe,CAAC;YACrB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YACrC,OAAO,EAAE,0DAA0D;SACpE,EAAE,kBAAkB,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,mBAAmB,EAAE;QACvC,WAAW,EAAE,8EAA8E;QAC3F,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;SAC9C,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,mBAAmB,EAAE;QACvC,WAAW,EAAE,6IAA6I;QAC1J,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;SACxD,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,eAAe,CAAC;YACrB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YACrC,OAAO,EAAE,4FAA4F;SACtG,EAAE,mBAAmB,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,kBAAkB,EAAE;QACtC,WAAW,EAAE,8IAA8I;QAC3J,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SAC1F,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACjG,OAAO,eAAe,CAAC;YACrB,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC9B,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,WAAW,EAAE,GAAG,CAAC,MAAO,CAAC,WAAW,EAAE;SACvC,EAAE,kBAAkB,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,iBAAiB,EAAE;QACrC,WAAW,EAAE,mGAAmG;QAChH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;SAC9C,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,aAAa,CAAC,CAAC,SAAS,CAAC,iBAAiB,EAAE,oBAAoB,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/mcp/tools/backup.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { InstanceCtx } from '../ctx.js';
+export declare function register(server: McpServer, ctx: InstanceCtx): number;
+//# sourceMappingURL=backup.d.ts.map

package/dist/mcp/tools/backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/backup.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,CA4CpE"}

package/dist/mcp/tools/backup.js

@@ -0,0 +1,52 @@
+// ============================================================================
+// 0.7.10 — maad_backup MCP tool. Admin-tier, write-kind (mutates git refs).
+//
+// Three modes in one tool (per spec lock):
+//   create  — annotated tag on HEAD, returns { tag, sha, message, createdAt }
+//   list    — every maad-snapshot-* tag, optional since: ISO8601 filter
+//   delete  — drop a maad-snapshot-* tag (refuses other tags)
+//
+// No confirm contract — tag operations don't destroy underlying commits. The
+// explicit mode arg + named tag is the intent gate.
+// ============================================================================
+import { z } from 'zod';
+import { resultToResponse } from '../response.js';
+import { withEngine } from '../with-session.js';
+export function register(server, ctx) {
+    server.registerTool('maad_backup', {
+        description: 'Create / list / delete named recovery anchors via annotated git tags. Tag format: maad-snapshot-YYYY-MM-DD-HHMM[-label] (UTC). Defaults to mode: "create" so the common case is a one-arg call. delete only operates on maad-snapshot-* tags; non-snapshot tags are refused. Underlying commits are never touched — deleting a tag just drops the label.',
+        inputSchema: z.object({
+            mode: z.enum(['create', 'list', 'delete']).optional().describe('Operation mode (default: "create")'),
+            label: z.string().optional().describe('create only — operator-supplied suffix, sanitized to [a-z0-9-] capped at 32 chars'),
+            message: z.string().optional().describe('create only — annotated tag message (defaults to "MAADB snapshot at <sha> (\'<branch>\')")'),
+            tag: z.string().optional().describe('delete only — exact tag name to remove'),
+            since: z.string().optional().describe('list only — ISO8601 timestamp; return only tags created at or after this point'),
+            project: z.string().optional().describe('Project name (multi-project mode only)'),
+        }),
+    }, async (args, extra) => withEngine(ctx, extra, 'maad_backup', args, async ({ engine }) => {
+        const mode = args.mode ?? 'create';
+        if (mode === 'create') {
+            const opts = {};
+            if (args.label !== undefined)
+                opts.label = args.label;
+            if (args.message !== undefined)
+                opts.message = args.message;
+            return resultToResponse(await engine.backupCreate(opts), 'maad_backup');
+        }
+        if (mode === 'list') {
+            const opts = {};
+            if (args.since !== undefined)
+                opts.since = args.since;
+            return resultToResponse(await engine.backupList(opts), 'maad_backup');
+        }
+        if (mode === 'delete') {
+            if (!args.tag) {
+                return resultToResponse({ ok: false, errors: [{ code: 'INVALID_ARGS', message: 'delete mode requires tag' }] }, 'maad_backup');
+            }
+            return resultToResponse(await engine.backupDelete(args.tag), 'maad_backup');
+        }
+        return resultToResponse({ ok: false, errors: [{ code: 'INVALID_ARGS', message: 'mode must be "create", "list", or "delete"' }] }, 'maad_backup');
+    }));
+    return 1;
+}
+//# sourceMappingURL=backup.js.map

package/dist/mcp/tools/backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../../src/mcp/tools/backup.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,4EAA4E;AAC5E,EAAE;AACF,2CAA2C;AAC3C,8EAA8E;AAC9E,wEAAwE;AACxE,8DAA8D;AAC9D,EAAE;AACF,6EAA6E;AAC7E,oDAAoD;AACpD,+EAA+E;AAE/E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,MAAM,UAAU,QAAQ,CAAC,MAAiB,EAAE,GAAgB;IAC1D,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE;QACjC,WAAW,EAAE,0VAA0V;QACvW,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;YACpG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mFAAmF,CAAC;YAC1H,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4FAA4F,CAAC;YACrI,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAC7E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;YACvH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SAClF,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACzF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;QAEnC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,GAAwD,EAAE,CAAC;YACrE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACtD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC5D,OAAO,gBAAgB,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,GAAuD,EAAE,CAAC;YACpE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACtD,OAAO,gBAAgB,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACd,OAAO,gBAAgB,CACrB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,EAAW,EAC/F,aAAa,CACd,CAAC;YACJ,CAAC;YACD,OAAO,gBAAgB,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,gBAAgB,CACrB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,EAAW,EACjH,aAAa,CACd,CAAC;IACJ,CAAC,CAAC,CAAC,CAAC;IAEJ,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/mcp/tools/discover.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { InstanceCtx } from '../ctx.js';
+export declare function register(server: McpServer, ctx: InstanceCtx): number;
+//# sourceMappingURL=discover.d.ts.map

package/dist/mcp/tools/discover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/discover.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,CA8EpE"}

package/dist/mcp/tools/discover.js

@@ -0,0 +1,83 @@
+// ============================================================================
+// Discover tools — maad_scan, maad_summary, maad_describe
+// ============================================================================
+import { z } from 'zod';
+import path from 'node:path';
+import { scanFile, scanDirectory } from '../../scanner.js';
+import { successResponse, errorResponse, getProvenanceMode } from '../response.js';
+import { isContainedIn } from '../../engine/pathguard.js';
+import { withEngine } from '../with-session.js';
+export function register(server, ctx) {
+    server.registerTool('maad_scan', {
+        description: 'Analyze raw markdown structure. Works without registry. Use for onboarding new files. Pass a file path for detailed analysis or a directory for corpus-level patterns.',
+        inputSchema: z.object({
+            path: z.string().describe('File or directory path to scan (relative to project root)'),
+            project: z.string().optional().describe('Project name (multi-project mode only)'),
+        }),
+    }, async (args, extra) => withEngine(ctx, extra, 'maad_scan', args, async ({ projectRoot }) => {
+        const absTarget = path.resolve(projectRoot, args.path);
+        if (!isContainedIn(absTarget, projectRoot)) {
+            return errorResponse([{ code: 'PATH_OUTSIDE_PROJECT', message: `Scan path must be within the project root: ${args.path}` }]);
+        }
+        const { statSync } = await import('node:fs');
+        let stat;
+        try {
+            stat = statSync(absTarget);
+        }
+        catch {
+            return errorResponse([{ code: 'PATH_NOT_FOUND', message: `Not found: ${args.path}` }]);
+        }
+        if (stat.isFile()) {
+            return successResponse(await scanFile(absTarget));
+        }
+        else {
+            return successResponse(await scanDirectory(absTarget));
+        }
+    }));
+    server.registerTool('maad_summary', {
+        description: 'Lean project snapshot for session bootstrapping. Returns types, counts, sample IDs, totals, warnings. Call maad_describe for subtype inventory detail.',
+        inputSchema: z.object({
+            project: z.string().optional().describe('Project name (multi-project mode only)'),
+        }),
+    }, async (args, extra) => withEngine(ctx, extra, 'maad_summary', args, ({ engine }) => {
+        const summary = engine.summary();
+        const provMode = getProvenanceMode();
+        if (provMode === 'off') {
+            return successResponse(summary, 'maad_summary');
+        }
+        const provenanceInstructions = provMode === 'detail'
+            ? {
+                mode: 'detail',
+                instructions: [
+                    'Tag every data value in your responses with its source:',
+                    '[T:<tool_name>] = from a specific MAAD tool (e.g. [T:maad_get])',
+                    '[R] = from memory/recall (unverified)',
+                    '[R*] = inferred/derived — not directly stated in any source',
+                    'When mixing sources in a table, add a source column.',
+                    'If joins require N+1 calls and you skip them, disclose which values were recalled.',
+                    'Never present recalled data with the same confidence as tool-verified data.',
+                ],
+            }
+            : {
+                mode: 'on',
+                instructions: [
+                    'Tag data sources in responses:',
+                    '[T] = from a MAAD tool call (verified)',
+                    '[R] = from memory/recall (unverified)',
+                    'When mixing sources in a table, add a source column or footnote.',
+                    'Never present recalled data with the same confidence as tool-verified data.',
+                ],
+            };
+        return successResponse({ ...summary, provenance: provenanceInstructions }, 'maad_summary');
+    }));
+    server.registerTool('maad_describe', {
+        description: 'Returns registry types, extraction primitives, document counts, and subtype inventory (deep detail; maad_summary is the lean orientation call).',
+        inputSchema: z.object({
+            project: z.string().optional().describe('Project name (multi-project mode only)'),
+        }),
+    }, async (args, extra) => withEngine(ctx, extra, 'maad_describe', args, ({ engine }) => {
+        return successResponse(engine.describe());
+    }));
+    return 3;
+}
+//# sourceMappingURL=discover.js.map

package/dist/mcp/tools/discover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../../src/mcp/tools/discover.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,0DAA0D;AAC1D,+EAA+E;AAE/E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,MAAM,UAAU,QAAQ,CAAC,MAAiB,EAAE,GAAgB;IAC1D,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;QAC/B,WAAW,EAAE,wKAAwK;QACrL,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;YACtF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SAClF,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;QAC5F,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,8CAA8C,IAAI,CAAC,IAAI,EAAE,EAAS,CAAC,CAAC,CAAC;QACtI,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,IAAI,CAAC,IAAI,EAAE,EAAS,CAAC,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAClB,OAAO,eAAe,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO,eAAe,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,YAAY,CAAC,cAAc,EAAE;QAClC,WAAW,EAAE,wJAAwJ;QACrK,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SAClF,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACpF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QAErC,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,OAAO,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,sBAAsB,GAAG,QAAQ,KAAK,QAAQ;YAClD,CAAC,CAAC;gBACE,IAAI,EAAE,QAAQ;gBACd,YAAY,EAAE;oBACZ,yDAAyD;oBACzD,iEAAiE;oBACjE,uCAAuC;oBACvC,6DAA6D;oBAC7D,sDAAsD;oBACtD,oFAAoF;oBACpF,6EAA6E;iBAC9E;aACF;YACH,CAAC,CAAC;gBACE,IAAI,EAAE,IAAI;gBACV,YAAY,EAAE;oBACZ,gCAAgC;oBAChC,wCAAwC;oBACxC,uCAAuC;oBACvC,kEAAkE;oBAClE,6EAA6E;iBAC9E;aACF,CAAC;QAEN,OAAO,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,EAAE,cAAc,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE;QACnC,WAAW,EAAE,iJAAiJ;QAC9J,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SAClF,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACrF,OAAO,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC,CAAC;IAEJ,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/mcp/tools/instance.d.ts

@@ -0,0 +1,15 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { InstanceCtx } from '../ctx.js';
+export declare function register(server: McpServer, ctx: InstanceCtx): number;
+/**
+ * Registers the admin-only `maad_instance_reload` tool separately from the
+ * base instance tools. Called regardless of instance source so synthetic
+ * instances can surface a clear INSTANCE_RELOAD_SYNTHETIC error rather than
+ * an opaque "unknown tool" response.
+ *
+ * Role gate lives inside the handler (engine-less tools bypass the `withEngine`
+ * role check). Requires admin effective role on EVERY project in the session's
+ * binding — least privilege, since reload is instance-wide.
+ */
+export declare function registerReload(server: McpServer, ctx: InstanceCtx): number;
+//# sourceMappingURL=instance.d.ts.map

package/dist/mcp/tools/instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/instance.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAQ7C,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,CA2IpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,CA6D1E"}

package/dist/mcp/tools/instance.js

@@ -0,0 +1,207 @@
+// ============================================================================
+// Instance tools — maad_projects, maad_use_project, maad_use_projects,
+//                  maad_current_session
+//
+// These four tools operate at the instance level (no project binding required).
+// They let clients discover and bind to projects served by this MCP instance.
+// ============================================================================
+import { z } from 'zod';
+import { successResponse, errorResponse } from '../response.js';
+import { resolveSessionId } from '../../instance/session.js';
+import { performInstanceReload } from '../instance-reload.js';
+import { roleSatisfies } from '../roles.js';
+import { maadError } from '../../errors.js';
+import { collectSubscriptions } from '../notifications.js';
+const ROLE_ENUM = z.enum(['reader', 'writer', 'admin']);
+export function register(server, ctx) {
+    server.registerTool('maad_projects', {
+        description: 'Lists projects declared in this MCP instance. Returns name, description, configured role, and whether the current session has access. Call this before maad_use_project.',
+        inputSchema: z.object({}),
+    }, async (_args, extra) => {
+        const sessionId = resolveSessionId(extra);
+        const state = ctx.sessions.get(sessionId);
+        const projects = ctx.instance.projects.map((p) => ({
+            name: p.name,
+            description: p.description ?? null,
+            role: p.role,
+            accessible: state?.mode === null || !state
+                ? null
+                : state.mode === 'single'
+                    ? state.activeProject === p.name
+                    : (state.whitelist ?? []).includes(p.name),
+        }));
+        return successResponse({
+            instance: ctx.instance.name,
+            source: ctx.instance.source,
+            projects,
+            sessionBound: state?.mode !== null && state !== undefined,
+        }, 'maad_projects');
+    });
+    server.registerTool('maad_use_project', {
+        description: 'Binds the current session to a single project. Every subsequent tool call routes to this project. Optional `as` downgrades the session role below the project\'s configured role (e.g. bind an admin project in reader mode for safety). Once bound, a session cannot rebind — disconnect and reconnect instead.',
+        inputSchema: z.object({
+            name: z.string().describe('Project name (from maad_projects)'),
+            as: ROLE_ENUM.optional().describe('Optional role downgrade. Cannot exceed the project\'s configured role.'),
+        }),
+    }, async (args, extra) => {
+        const sessionId = resolveSessionId(extra);
+        if (!ctx.sessions.get(sessionId))
+            ctx.sessions.create(sessionId);
+        const opts = args.as ? { as: args.as } : {};
+        const result = ctx.sessions.bindSingle(sessionId, args.name, opts);
+        if (!result.ok)
+            return errorResponse(result.errors);
+        const state = result.value;
+        return successResponse({
+            mode: state.mode,
+            activeProject: state.activeProject,
+            effectiveRole: state.effectiveRoles.get(args.name),
+        }, 'maad_use_project');
+    });
+    server.registerTool('maad_use_projects', {
+        description: 'Binds the current session to a whitelist of projects (multi-project mode). Every subsequent tool call must pass `project=<name>` to pick one. Optional `as` downgrades the role uniformly across all listed projects. Once bound, a session cannot rebind.',
+        inputSchema: z.object({
+            names: z.array(z.string()).min(1).describe('Project names from maad_projects'),
+            as: ROLE_ENUM.optional().describe('Optional role downgrade. Cannot exceed any project\'s configured role.'),
+        }),
+    }, async (args, extra) => {
+        const sessionId = resolveSessionId(extra);
+        if (!ctx.sessions.get(sessionId))
+            ctx.sessions.create(sessionId);
+        const opts = args.as ? { as: args.as } : {};
+        const result = ctx.sessions.bindMulti(sessionId, args.names, opts);
+        if (!result.ok)
+            return errorResponse(result.errors);
+        const state = result.value;
+        const effectiveRoles = {};
+        for (const [name, role] of state.effectiveRoles)
+            effectiveRoles[name] = role;
+        return successResponse({
+            mode: state.mode,
+            whitelist: state.whitelist,
+            effectiveRoles,
+        }, 'maad_use_projects');
+    });
+    server.registerTool('maad_current_session', {
+        description: 'Returns the current session state: mode, bound project(s), effective role per project, and binding_source (how the session was bound — client_tool or gateway_pin). Useful for debugging routing issues and detecting pinned sessions.',
+        inputSchema: z.object({}),
+    }, async (_args, extra) => {
+        const sessionId = resolveSessionId(extra);
+        const state = ctx.sessions.get(sessionId);
+        if (!state) {
+            return successResponse({ sessionId, mode: null, binding_source: null, note: 'no session registered yet' }, 'maad_current_session');
+        }
+        const effectiveRoles = {};
+        for (const [name, role] of state.effectiveRoles)
+            effectiveRoles[name] = role;
+        return successResponse({
+            sessionId: state.sessionId,
+            mode: state.mode,
+            activeProject: state.activeProject ?? null,
+            whitelist: state.whitelist ?? null,
+            effectiveRoles,
+            binding_source: state.bindingSource,
+            createdAt: state.createdAt.toISOString(),
+            lastActivityAt: state.lastActivityAt.toISOString(),
+            subscription: state.subscription
+                ? { docTypes: state.subscription.docTypes, project: state.subscription.project, createdAt: state.subscription.createdAt.toISOString() }
+                : null,
+        }, 'maad_current_session');
+    });
+    server.registerTool('maad_subscribe', {
+        description: 'Subscribe the current session to live notifications on durable writes. Optional filters: docTypes (array), project (string). Emits notifications/resources/updated with uri=maad://records/<docId> + extra params. One subscription per session; re-subscribe to replace filter.',
+        inputSchema: z.object({
+            docTypes: z.array(z.string()).optional().describe('Allowlist of doc types; omit for all types'),
+            project: z.string().optional().describe('Restrict to one project; defaults to session\'s bound scope'),
+        }),
+    }, async (args, extra) => {
+        const sessionId = resolveSessionId(extra);
+        if (!ctx.sessions.get(sessionId))
+            ctx.sessions.create(sessionId);
+        const state = ctx.sessions.get(sessionId);
+        const docTypes = (args.docTypes && args.docTypes.length > 0) ? args.docTypes : null;
+        const project = args.project ?? null;
+        state.subscription = { docTypes, project, createdAt: new Date() };
+        return successResponse({
+            subscribed: true,
+            filter: { docTypes, project },
+            note: 'Notifications fire only on durable commits. Use maad_changes_since for historical catch-up on reconnect.',
+        }, 'maad_subscribe');
+    });
+    server.registerTool('maad_unsubscribe', {
+        description: 'Releases the current session\'s live-update subscription. No-op if not subscribed.',
+        inputSchema: z.object({}),
+    }, async (_args, extra) => {
+        const sessionId = resolveSessionId(extra);
+        const state = ctx.sessions.get(sessionId);
+        const wasSubscribed = state?.subscription !== undefined;
+        if (state)
+            delete state.subscription;
+        return successResponse({ subscribed: false, wasSubscribed }, 'maad_unsubscribe');
+    });
+    return 6;
+}
+/**
+ * Registers the admin-only `maad_instance_reload` tool separately from the
+ * base instance tools. Called regardless of instance source so synthetic
+ * instances can surface a clear INSTANCE_RELOAD_SYNTHETIC error rather than
+ * an opaque "unknown tool" response.
+ *
+ * Role gate lives inside the handler (engine-less tools bypass the `withEngine`
+ * role check). Requires admin effective role on EVERY project in the session's
+ * binding — least privilege, since reload is instance-wide.
+ */
+export function registerReload(server, ctx) {
+    server.registerTool('maad_instance_reload', {
+        description: 'Reloads instance.yaml from disk. Picks up added projects, evicts removed, cancels bound sessions. Admin on every bound project required. Path/role mutations rejected until 0.9.0.',
+        inputSchema: z.object({}),
+    }, async (_args, extra) => {
+        const sessionId = resolveSessionId(extra);
+        const state = ctx.sessions.get(sessionId);
+        // Session must be bound before an admin check makes sense.
+        if (!state || state.mode === null) {
+            return errorResponse([maadError('SESSION_UNBOUND', 'Session is not bound to any project. Call maad_use_project(s) before maad_instance_reload.')]);
+        }
+        // Admin on EVERY project in the binding. In single mode that's one project;
+        // in multi mode it's the whole whitelist. Prevents an operator who only
+        // has admin on one subproject from reloading the whole instance and
+        // affecting other tenants.
+        for (const [projectName, role] of state.effectiveRoles) {
+            if (!roleSatisfies(role, 'admin')) {
+                return errorResponse([maadError('INSUFFICIENT_ROLE', `maad_instance_reload requires admin on every project in the session binding; session has "${role}" on "${projectName}".`)]);
+            }
+        }
+        const result = await performInstanceReload(ctx, 'tool');
+        if (!result.ok)
+            return errorResponse(result.errors);
+        return successResponse({
+            source: result.value.source,
+            projectsAdded: result.value.projectsAdded,
+            projectsRemoved: result.value.projectsRemoved,
+            sessionsCancelled: result.value.sessionsCancelled.length,
+            sessionsPruned: result.value.sessionsPruned.length,
+            durationMs: result.value.durationMs,
+        }, 'maad_instance_reload');
+    });
+    server.registerTool('maad_subscriptions', {
+        description: 'Admin tool: returns live-subscription inventory across all sessions as { totalSubscriptions, subscriptions[], byProject, byDocType }. Requires admin on every project in the session binding.',
+        inputSchema: z.object({}),
+    }, async (_args, extra) => {
+        const sessionId = resolveSessionId(extra);
+        const callerState = ctx.sessions.get(sessionId);
+        if (!callerState || callerState.mode === null) {
+            return errorResponse([maadError('SESSION_UNBOUND', 'Session is not bound to any project. Call maad_use_project(s) before maad_subscriptions.')]);
+        }
+        // Admin on EVERY project in the binding — same model as maad_instance_reload.
+        // The tool leaks instance-wide state, so require admin across the caller's full scope.
+        for (const [projectName, role] of callerState.effectiveRoles) {
+            if (!roleSatisfies(role, 'admin')) {
+                return errorResponse([maadError('INSUFFICIENT_ROLE', `maad_subscriptions requires admin on every project in the session binding; session has "${role}" on "${projectName}".`)]);
+            }
+        }
+        const inventory = collectSubscriptions(ctx.sessions);
+        return successResponse(inventory, 'maad_subscriptions');
+    });
+    return 2;
+}
+//# sourceMappingURL=instance.js.map

package/dist/mcp/tools/instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../../src/mcp/tools/instance.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,uEAAuE;AACvE,wCAAwC;AACxC,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAE/E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAExD,MAAM,UAAU,QAAQ,CAAC,MAAiB,EAAE,GAAgB;IAC1D,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE;QACnC,WAAW,EAAE,0KAA0K;QACvL,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;KAC1B,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACxB,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;YAClC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,UAAU,EAAE,KAAK,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK;gBACxC,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ;oBACvB,CAAC,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC,IAAI;oBAChC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;SAC/C,CAAC,CAAC,CAAC;QAEJ,OAAO,eAAe,CAAC;YACrB,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;YAC3B,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;YAC3B,QAAQ;YACR,YAAY,EAAE,KAAK,EAAE,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;SAC1D,EAAE,eAAe,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,kBAAkB,EAAE;QACtC,WAAW,EAAE,kTAAkT;QAC/T,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;YAC9D,EAAE,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;SAC5G,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,OAAO,eAAe,CAAC;YACrB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,aAAa,EAAE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;SACnD,EAAE,kBAAkB,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,mBAAmB,EAAE;QACvC,WAAW,EAAE,4PAA4P;QACzQ,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;YAC9E,EAAE,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;SAC5G,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,MAAM,cAAc,GAA2B,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc;YAAE,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAE7E,OAAO,eAAe,CAAC;YACrB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc;SACf,EAAE,mBAAmB,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,sBAAsB,EAAE;QAC1C,WAAW,EAAE,wOAAwO;QACrP,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;KAC1B,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACxB,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACrI,CAAC;QAED,MAAM,cAAc,GAA2B,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc;YAAE,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAE7E,OAAO,eAAe,CAAC;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,cAAc;YACd,cAAc,EAAE,KAAK,CAAC,aAAa;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACxC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE;YAClD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAC9B,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE;gBACvI,CAAC,CAAC,IAAI;SACT,EAAE,sBAAsB,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE;QACpC,WAAW,EAAE,kRAAkR;QAC/R,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;YAC/F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;SACvG,CAAC;KACH,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;QAE3C,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;QAErC,KAAK,CAAC,YAAY,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;QAElE,OAAO,eAAe,CAAC;YACrB,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC7B,IAAI,EAAE,0GAA0G;SACjH,EAAE,gBAAgB,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,kBAAkB,EAAE;QACtC,WAAW,EAAE,oFAAoF;QACjG,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;KAC1B,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACxB,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,aAAa,GAAG,KAAK,EAAE,YAAY,KAAK,SAAS,CAAC;QACxD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,YAAY,CAAC;QAErC,OAAO,eAAe,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,MAAiB,EAAE,GAAgB;IAChE,MAAM,CAAC,YAAY,CAAC,sBAAsB,EAAE;QAC1C,WAAW,EAAE,oLAAoL;QACjM,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;KAC1B,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACxB,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE1C,2DAA2D;QAC3D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAClC,OAAO,aAAa,CAAC,CAAC,SAAS,CAAC,iBAAiB,EAC/C,4FAA4F,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC;QACD,4EAA4E;QAC5E,wEAAwE;QACxE,oEAAoE;QACpE,2BAA2B;QAC3B,KAAK,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACvD,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAClC,OAAO,aAAa,CAAC,CAAC,SAAS,CAAC,mBAAmB,EACjD,6FAA6F,IAAI,SAAS,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC;YACjI,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEpD,OAAO,eAAe,CAAC;YACrB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;YAC3B,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;YACzC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe;YAC7C,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM;YACxD,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM;YAClD,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;SACpC,EAAE,sBAAsB,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,oBAAoB,EAAE;QACxC,WAAW,EAAE,+LAA+L;QAC5M,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;KAC1B,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACxB,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO,aAAa,CAAC,CAAC,SAAS,CAAC,iBAAiB,EAC/C,0FAA0F,CAAC,CAAC,CAAC,CAAC;QAClG,CAAC;QACD,8EAA8E;QAC9E,uFAAuF;QACvF,KAAK,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;YAC7D,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAClC,OAAO,aAAa,CAAC,CAAC,SAAS,CAAC,mBAAmB,EACjD,2FAA2F,IAAI,SAAS,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/H,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,OAAO,eAAe,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/mcp/tools/maintain.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { InstanceCtx } from '../ctx.js';
+export declare function register(server: McpServer, ctx: InstanceCtx): number;
+//# sourceMappingURL=maintain.d.ts.map

package/dist/mcp/tools/maintain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintain.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/maintain.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAK7C,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,CAoHpE"}