@miragon/mcp-toolkit-core 2.4.1 → 2.6.0

package/dist/middleware/role-filter.js

@@ -11,6 +11,10 @@
  *   `ctx.params.name`. When no name is present it fails *open* by default
  *   (allow) — pass `failClosed: true` to deny instead.
  *
+ * The caller's roles come from {@link resolveCaller}, which reads both mcp-use 2
+ * shapes — middleware receives the SDK `AuthInfo` with the provider-mapped user
+ * under `ctx.auth.extra.user`, never `ctx.auth.user`.
+ *
  * Batches need no special handling: mcp-use invokes `mcp:tools/call`
  * middleware once per call, so each entry of a JSON-RPC batch is guarded
  * individually (verified against 2.0.4 — a two-entry batch fires the guard
@@ -26,41 +30,31 @@
  * *unrestricted* access — this is deliberately opt-in so that adding a new
  * role doesn't silently revoke anyone's tools.
  */
+import { resolveCaller } from "../auth/caller.js";
+const modulePrefixOf = (toolName) => toolName.split("_")[0] ?? "";
 export function createRoleFilterMiddleware(roleToModules, opts = {}) {
     const failClosed = opts.failClosed ?? false;
     const hasRules = Object.keys(roleToModules).length > 0;
     // Returns `null` = unrestricted (full access), array = restricted.
-    const allowedModulesFor = (user) => {
-        if (!hasRules)
-            return null;
-        const roles = Array.isArray(user?.roles) ? user.roles : [];
-        const restrictedRoles = roles.filter((r) => r in roleToModules);
+    const allowedModulesFor = (caller) => {
+        const restrictedRoles = (caller?.roles ?? []).filter((r) => r in roleToModules);
         if (restrictedRoles.length === 0)
             return null;
         return [...new Set(restrictedRoles.flatMap((r) => roleToModules[r] ?? []))];
     };
+    // Tools without an underscore are framework/app-level and always allowed.
+    const isAllowed = (toolName, allowed) => !toolName.includes("_") || allowed.includes(modulePrefixOf(toolName));
     const toolsList = async (ctx, next) => {
-        const tools = (await next());
-        if (!hasRules || !Array.isArray(tools))
-            return tools;
-        const allowed = allowedModulesFor(ctx.auth?.user);
+        const result = await next();
+        if (!hasRules || !Array.isArray(result))
+            return result;
+        const allowed = allowedModulesFor(resolveCaller(ctx));
         if (allowed === null)
-            return tools;
-        return tools.filter((t) => {
-            if (!t.name.includes("_"))
-                return true;
-            return allowed.includes(t.name.split("_")[0] ?? "");
-        });
-    };
-    // Tools without an underscore are framework/app-level and always allowed.
-    const assertModuleAllowed = (toolName, allowed, user) => {
-        if (!toolName.includes("_"))
-            return;
-        const modulePrefix = toolName.split("_")[0] ?? "";
-        if (!allowed.includes(modulePrefix)) {
-            const userRoles = user?.roles ?? [];
-            throw new Error(`Access denied: role(s) "${userRoles.join(", ")}" have no access to module "${modulePrefix}".`);
-        }
+            return result;
+        // Filtering keeps the element type, so the narrowed array is still the
+        // chain's `TResult` — TypeScript just cannot carry that through
+        // `Array.isArray`.
+        return result.filter((tool) => typeof tool.name === "string" && isAllowed(tool.name, allowed));
     };
     const toolsCall = async (ctx, next) => {
         if (!hasRules)
@@ -72,9 +66,11 @@ export function createRoleFilterMiddleware(roleToModules, opts = {}) {
             }
             return next();
         }
-        const allowed = allowedModulesFor(ctx.auth?.user);
-        if (allowed !== null)
-            assertModuleAllowed(name, allowed, ctx.auth?.user);
+        const caller = resolveCaller(ctx);
+        const allowed = allowedModulesFor(caller);
+        if (allowed !== null && !isAllowed(name, allowed)) {
+            throw new Error(`Access denied: role(s) "${(caller?.roles ?? []).join(", ")}" have no access to module "${modulePrefixOf(name)}".`);
+        }
         return next();
     };
     return { toolsList, toolsCall };

package/dist/middleware/role-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-filter.js","sourceRoot":"","sources":["../../src/middleware/role-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AA+BH,MAAM,UAAU,0BAA0B,CACxC,aAAuC,EACvC,OAA0B,EAAE;IAE5B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAA;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IAEtD,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,CAAC,IAAqC,EAAmB,EAAE;QACnF,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAkB,CAAC,CAAC,CAAC,EAAE,CAAA;QACxE,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,aAAa,CAAC,CAAA;QAC/D,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7E,CAAC,CAAA;IAED,MAAM,SAAS,GAAyB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC1D,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,EAAE,CAAuB,CAAA;QAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACjD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;QAClC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACxB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACtC,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,0EAA0E;IAC1E,MAAM,mBAAmB,GAAG,CAC1B,QAAgB,EAChB,OAAiB,EACjB,IAAqC,EAC/B,EAAE;QACR,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAM;QACnC,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACjD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACpC,MAAM,SAAS,GAAI,IAAyC,EAAE,KAAK,IAAI,EAAE,CAAA;YACzE,MAAM,IAAI,KAAK,CACb,2BAA2B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,YAAY,IAAI,CAC/F,CAAA;QACH,CAAC;IACH,CAAC,CAAA;IAED,MAAM,SAAS,GAAyB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC1D,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,EAAE,CAAA;QAC5B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAA;YACH,CAAC;YACD,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACjD,IAAI,OAAO,KAAK,IAAI;YAAE,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACxE,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;IAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AACjC,CAAC"}
+{"version":3,"file":"role-filter.js","sourceRoot":"","sources":["../../src/middleware/role-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,aAAa,EAAe,MAAM,mBAAmB,CAAA;AAqE9D,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AAEjF,MAAM,UAAU,0BAA0B,CACxC,aAAuC,EACvC,OAA0B,EAAE;IAE5B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAA;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IAEtD,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,CAAC,MAA0B,EAAmB,EAAE;QACxE,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,aAAa,CAAC,CAAA;QAC/E,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7E,CAAC,CAAA;IAED,0EAA0E;IAC1E,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,OAAiB,EAAW,EAAE,CACjE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEvE,MAAM,SAAS,GAAG,KAAK,EACrB,GAAsB,EACtB,IAA4B,EACV,EAAE;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;QACtD,MAAM,OAAO,GAAG,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAA;QACrD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,MAAM,CAAA;QACnC,uEAAuE;QACvE,gEAAgE;QAChE,mBAAmB;QACnB,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,IAAwB,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAClF,CAAA;IACd,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,KAAK,EACrB,GAAsB,EACtB,IAA4B,EACV,EAAE;QACpB,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,EAAE,CAAA;QAC5B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAA;YACH,CAAC;YACD,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;QACzC,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,2BAA2B,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,cAAc,CAAC,IAAI,CAAC,IAAI,CACnH,CAAA;QACH,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;IAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AACjC,CAAC"}

package/dist/tools/create-framework-app.d.ts

@@ -3,6 +3,7 @@ import type { OAuthProvider } from "mcp-use/oauth";
 import type { DashboardStore } from "./dashboard-store.js";
 import type { AppConfig, AppPlugin } from "../types/index.js";
 import type { AppResourceCsp } from "../types/meta.js";
+import type { DuplicateToolNamePolicy } from "./tool-name-guard.js";
 export interface CreateFrameworkAppOptionsBase {
     name: string;
     version?: string;
@@ -26,7 +27,11 @@ export interface CreateFrameworkAppOptionsBase {
     serverOptions?: Omit<ServerConfig, "name" | "version" | "description" | "host" | "oauth">;
     plugins: AppPlugin[];
     middleware?: {
-        /** When set, every RPC must come from a token with this organization_id. */
+        /**
+         * When set, every RPC must come from a caller whose provider-mapped user
+         * carries this organization (`organizationId`, or the 1.x-era
+         * `organization_id`).
+         */
         orgGate?: string;
         /** role → allowed module prefixes. Empty / missing → no restriction. */
         roleFilter?: Record<string, string[]>;
@@ -103,6 +108,12 @@ export interface CreateFrameworkAppOptionsBase {
          * this option has no effect.
          */
         dashboardStore?: DashboardStore;
+        /**
+         * Duplicate tool names across plugins, the framework tools, and later
+         * registrations: `"warn"` (default in 2.x) or `"throw"` (fail the boot).
+         * See `InstallToolkitOptions.duplicateToolNames`.
+         */
+        duplicateToolNames?: DuplicateToolNamePolicy;
     };
     /** Supplies the non-empty set of apps each plugin represents. */
     appConfig?: AppConfig;

package/dist/tools/create-framework-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-framework-app.d.ts","sourceRoot":"","sources":["../../src/tools/create-framework-app.ts"],"names":[],"mappings":"AACA,OAAO,EACL,SAAS,EAET,KAAK,YAAY,EAGlB,MAAM,SAAS,CAAA;AAChB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAGlD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGtD,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;IACzF,OAAO,EAAE,SAAS,EAAE,CAAA;IACpB,UAAU,CAAC,EAAE;QACX,4EAA4E;QAC5E,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,wEAAwE;QACxE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QACrC;;;;;;;WAOG;QACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;KAC/B,CAAA;IACD,GAAG,EAAE;QACH;;;;;;WAMG;QACH,MAAM,EAAE;YACN,wEAAwE;YACxE,MAAM,EAAE,MAAM,CAAA;YACd,0EAA0E;YAC1E,OAAO,CAAC,EAAE,MAAM,CAAA;SACjB,CAAA;QACD,gEAAgE;QAChE,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB;;;;;;WAMG;QACH,GAAG,CAAC,EAAE,cAAc,CAAA;QACpB;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB;;;;;WAKG;QACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B;;;;;;;WAOG;QACH,cAAc,CAAC,EAAE,cAAc,CAAA;KAChC,CAAA;IACD,iEAAiE;IACjE,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,kCAAkC,CACjD,KAAK,GAAG,OAAO,CACf,SAAQ,6BAA6B;IACrC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,qCAAsC,SAAQ,6BAA6B;IAC1F,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,MAAM,yBAAyB,CAAC,KAAK,GAAG,OAAO,IACnD,kCAAkC,CAAC,KAAK,CAAC,GAAG,qCAAqC,CAAA;AAoBnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EACtC,OAAO,EAAE,kCAAkC,CAAC,KAAK,CAAC,GACjD,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AAC5B,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,SAAS,CAAC,CAAA"}
+{"version":3,"file":"create-framework-app.d.ts","sourceRoot":"","sources":["../../src/tools/create-framework-app.ts"],"names":[],"mappings":"AACA,OAAO,EACL,SAAS,EAET,KAAK,YAAY,EAGlB,MAAM,SAAS,CAAA;AAChB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAGlD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAEnE,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;IACzF,OAAO,EAAE,SAAS,EAAE,CAAA;IACpB,UAAU,CAAC,EAAE;QACX;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,wEAAwE;QACxE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QACrC;;;;;;;WAOG;QACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;KAC/B,CAAA;IACD,GAAG,EAAE;QACH;;;;;;WAMG;QACH,MAAM,EAAE;YACN,wEAAwE;YACxE,MAAM,EAAE,MAAM,CAAA;YACd,0EAA0E;YAC1E,OAAO,CAAC,EAAE,MAAM,CAAA;SACjB,CAAA;QACD,gEAAgE;QAChE,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB;;;;;;WAMG;QACH,GAAG,CAAC,EAAE,cAAc,CAAA;QACpB;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB;;;;;WAKG;QACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B;;;;;;;WAOG;QACH,cAAc,CAAC,EAAE,cAAc,CAAA;QAC/B;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,uBAAuB,CAAA;KAC7C,CAAA;IACD,iEAAiE;IACjE,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,kCAAkC,CACjD,KAAK,GAAG,OAAO,CACf,SAAQ,6BAA6B;IACrC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,qCAAsC,SAAQ,6BAA6B;IAC1F,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,MAAM,yBAAyB,CAAC,KAAK,GAAG,OAAO,IACnD,kCAAkC,CAAC,KAAK,CAAC,GAAG,qCAAqC,CAAA;AAoBnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EACtC,OAAO,EAAE,kCAAkC,CAAC,KAAK,CAAC,GACjD,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AAC5B,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,SAAS,CAAC,CAAA"}

package/dist/tools/create-framework-app.js

@@ -47,7 +47,8 @@ export async function createFrameworkApp(options) {
         : new MCPServer({ ...options.serverOptions, ...baseConfig });
     // The registrars are typed against the OAuth-less `MCPServer`; a
     // `MCPServer<TUser>` differs only in the `ctx.auth` its callbacks receive,
-    // which none of them read.
+    // which they read structurally through `resolveCaller` (never via the
+    // `TUser` type).
     const serverForRegistrars = server;
     // Collect every view name bound during boot so the registry can be primed
     // once at the end (mcp-use accepts `view` bindings before priming — they
@@ -65,11 +66,12 @@ export async function createFrameworkApp(options) {
         return originalTool(definition, callback);
     };
     serverForRegistrars.tool = wrappedTool;
+    // Both middlewares are typed structurally (host-agnostic, no mcp-use import
+    // in the root barrel) yet shaped so mcp-use 2's `MiddlewareContext` — SDK
+    // `AuthInfo` with the mapped user under `auth.extra.user` — is assignable to
+    // them; registering them needs no cast.
     const orgGateId = options.middleware?.orgGate;
     if (orgGateId) {
-        // The middleware is typed structurally on purpose so it stays host-
-        // agnostic; mcp-use 2.x types `ctx.auth` as its own `AuthInfo`, which is
-        // not mutually assignable with that shape. Only `auth.user` is read.
         server.use("mcp:*", createOrgGateMiddleware(orgGateId));
     }
     const roleFilter = options.middleware?.roleFilter;
@@ -77,7 +79,6 @@ export async function createFrameworkApp(options) {
         const { toolsList, toolsCall } = createRoleFilterMiddleware(roleFilter, {
             failClosed: options.middleware?.roleFilterFailClosed ?? false,
         });
-        // Cast for the same reason as the org gate above.
         server.use("mcp:tools/list", toolsList);
         server.use("mcp:tools/call", toolsCall);
     }
@@ -92,7 +93,11 @@ export async function createFrameworkApp(options) {
         builder: options.app.builder,
         catalogueToolName: options.app.catalogueToolName,
         dashboardStore: options.app.dashboardStore,
+        // Under OAuth a dashboard call without a resolvable caller id is refused,
+        // never widened to global (owner-less) scope.
+        requireCallerIdentity: Boolean(options.oauth),
         appConfig: options.appConfig,
+        duplicateToolNames: options.app.duplicateToolNames,
     });
     // Prime the view registry LAST, once every registrar and plugin has bound
     // its views. One inline entry per bound name, all sharing the same bundle

package/dist/tools/create-framework-app.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-framework-app.js","sourceRoot":"","sources":["../../src/tools/create-framework-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,EACL,SAAS,EACT,aAAa,GAId,MAAM,SAAS,CAAA;AAEhB,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AAIzE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAkIrD;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAa;IAC3D,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CACV,sDAAsD,KAAK,OAAO,QAAQ,IAAI;YAC5E,4EAA4E,CAC/E,CAAA;QACD,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAuCD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAyC;IAEzC,4EAA4E;IAC5E,yEAAyE;IACzE,uBAAuB;IACvB,MAAM,UAAU,GAAG;QACjB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO;QACnC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,WAAW;KAClC,CAAA;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,uDAAuD;IACvD,2EAA2E;IAC3E,0EAA0E;IAC1E,iEAAiE;IACjE,yEAAyE;IACzE,uEAAuE;IACvE,aAAa;IACb,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK;QAC1B,CAAC,CAAC,IAAI,SAAS,CAAC;YACZ,GAAG,OAAO,CAAC,aAAa;YACxB,GAAG,UAAU;YACb,KAAK,EAAE,OAAO,CAAC,KAAK;SACa,CAAC;QACtC,CAAC,CAAC,IAAI,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,GAAG,UAAU,EAAE,CAAC,CAAA;IAE9D,iEAAiE;IACjE,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,mBAAmB,GAAG,MAA8B,CAAA;IAE1D,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,MAAM,YAAY,GAChB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IACpD,MAAM,WAAW,GAAG,CAAC,UAA0B,EAAE,QAAe,EAAW,EAAE;QAC3E,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/D,OAAO,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAC3C,CAAC,CAAA;IACD,mBAAmB,CAAC,IAAI,GAAG,WAA8C,CAAA;IAEzE,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,OAAO,CAAA;IAC7C,IAAI,SAAS,EAAE,CAAC;QACd,oEAAoE;QACpE,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,SAAS,CAAU,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,UAAU,CAAA;IACjD,IAAI,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,0BAA0B,CAAC,UAAU,EAAE;YACtE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,oBAAoB,IAAI,KAAK;SAC9D,CAAC,CAAA;QACF,kDAAkD;QAClD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAkB,CAAC,CAAA;QAChD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAkB,CAAC,CAAA;IAClD,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,iEAAiE;IACjE,cAAc,CAAC,mBAAmB,EAAE;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;QAC5C,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG;QACpB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;QAC5B,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAChD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAA;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO;YACpC,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC;YAChE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAW,CAAA;QAClD,MAAM,QAAQ,GAAkB,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;QAChG,mBAAmB,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC9C,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"create-framework-app.js","sourceRoot":"","sources":["../../src/tools/create-framework-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,EACL,SAAS,EACT,aAAa,GAId,MAAM,SAAS,CAAA;AAEhB,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AAIzE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AA6IrD;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAa;IAC3D,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CACV,sDAAsD,KAAK,OAAO,QAAQ,IAAI;YAC5E,4EAA4E,CAC/E,CAAA;QACD,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAuCD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAyC;IAEzC,4EAA4E;IAC5E,yEAAyE;IACzE,uBAAuB;IACvB,MAAM,UAAU,GAAG;QACjB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO;QACnC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,WAAW;KAClC,CAAA;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,uDAAuD;IACvD,2EAA2E;IAC3E,0EAA0E;IAC1E,iEAAiE;IACjE,yEAAyE;IACzE,uEAAuE;IACvE,aAAa;IACb,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK;QAC1B,CAAC,CAAC,IAAI,SAAS,CAAC;YACZ,GAAG,OAAO,CAAC,aAAa;YACxB,GAAG,UAAU;YACb,KAAK,EAAE,OAAO,CAAC,KAAK;SACa,CAAC;QACtC,CAAC,CAAC,IAAI,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,GAAG,UAAU,EAAE,CAAC,CAAA;IAE9D,iEAAiE;IACjE,2EAA2E;IAC3E,sEAAsE;IACtE,iBAAiB;IACjB,MAAM,mBAAmB,GAAG,MAA8B,CAAA;IAE1D,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,MAAM,YAAY,GAChB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IACpD,MAAM,WAAW,GAAG,CAAC,UAA0B,EAAE,QAAe,EAAW,EAAE;QAC3E,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/D,OAAO,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAC3C,CAAC,CAAA;IACD,mBAAmB,CAAC,IAAI,GAAG,WAA8C,CAAA;IAEzE,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,wCAAwC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,OAAO,CAAA;IAC7C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAA;IACzD,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,UAAU,CAAA;IACjD,IAAI,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,0BAA0B,CAAC,UAAU,EAAE;YACtE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,oBAAoB,IAAI,KAAK;SAC9D,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAA;QACvC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAA;IACzC,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,iEAAiE;IACjE,cAAc,CAAC,mBAAmB,EAAE;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;QAC5C,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG;QACpB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;QAC5B,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAChD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1C,0EAA0E;QAC1E,8CAA8C;QAC9C,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;KACnD,CAAC,CAAA;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO;YACpC,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC;YAChE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAW,CAAA;QAClD,MAAM,QAAQ,GAAkB,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;QAChG,mBAAmB,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC9C,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/tools/dashboard-store.d.ts

@@ -10,13 +10,17 @@ export declare const DASHBOARD_SCHEMA_VERSION = 1;
 /**
  * Persisted dashboard = full `render-view` input plus identity and
  * ownership metadata. The server generates `id`, `createdAt`, `updatedAt`;
- * `userId` is copied from `ctx.auth.user.userId` on save when present.
+ * `userId` is the caller id `resolveCallerId(ctx)` resolves on save.
  */
 export interface DashboardRecord {
     id: string;
     name: string;
     description?: string;
-    /** Owner; omitted when the host boots without OAuth (global scope). */
+    /**
+     * Owner; omitted only when the host boots without OAuth (global scope). An
+     * owner-less record is invisible to — and never writable by — an
+     * identified caller.
+     */
     userId?: string;
     keys?: Record<string, unknown>;
     steps?: PipelineStepRef[];
@@ -51,6 +55,22 @@ export interface DashboardSummary {
     description?: string;
     title?: string;
     updatedAt: string;
+    /**
+     * The record's owner, as in {@link DashboardRecord.userId}. The built-in
+     * stores report it, and a custom store should: the dashboard tools hold an
+     * identified caller to its own summaries with it. A summary without one is
+     * verified through `get` instead (one read per entry).
+     */
+    userId?: string;
+    /**
+     * Set (to the reason) when the record exists but this build cannot read it
+     * — a newer `schemaVersion`, corrupt JSON, a failed schema check, or (in a
+     * listing) an entry the filesystem refuses to read. `name` then repeats the
+     * id and `updatedAt` is best-effort (empty when unknown).
+     * Reported instead of skipped so it can't silently vanish, and refused by
+     * `get` / `save` / `delete` with {@link DashboardUnreadableError}.
+     */
+    unreadable?: string;
 }
 /**
  * Persistence backing for dashboards. The framework is indifferent to how
@@ -59,14 +79,34 @@ export interface DashboardSummary {
  * backed one for production).
  *
  * All methods accept an optional `userId` filter so implementations can
- * enforce ownership. Implementations that don't need ownership (global
- * scope) should simply ignore the filter.
+ * enforce ownership:
+ *
+ * - **No `userId`** — global scope, the no-OAuth boot: every record is
+ *   visible and writable.
+ * - **A `userId`** — the caller sees and touches only records whose
+ *   `userId` equals it. An owner-less record is NOT the caller's: it stays
+ *   invisible to `list`/`get`/`delete`, and `save` refuses to update it.
+ *   (The dashboard tools never reach a store without a `userId` once the
+ *   request is authenticated — they refuse the call instead.)
+ *
+ * {@link isDashboardOwnedBy} is that rule; a custom store should apply it
+ * rather than re-derive it, and report each summary's owner
+ * ({@link DashboardSummary.userId}). The dashboard tools re-check every
+ * answer for an identified caller anyway — `get`, `list`, and the record a
+ * `save` or `delete` would touch — so a store on the laxer 2.5 rule (an
+ * owner-less record counted as everyone's) cannot leak or hand out such a
+ * record; it only costs extra reads.
  *
  * `save` carries the acting user as `input.userId`: updating an existing
- * record owned by a different user is rejected with
+ * record the caller doesn't own is rejected with
  * {@link DashboardOwnershipError}, and `input.userId` can never reassign an
- * existing record's owner. Records persisted without a `userId` (global
- * scope) stay writable by anyone, matching the read/delete convention.
+ * existing record's owner.
+ *
+ * A record that exists but cannot be read (newer `schemaVersion`, corrupt
+ * JSON, failed schema) is a conflict, never "absent": `get`, `save` and
+ * `delete` reject with {@link DashboardUnreadableError}, and `list` reports it
+ * with {@link DashboardSummary.unreadable} — so a save can never overwrite it
+ * and hand it a new owner.
  */
 export interface DashboardStore {
     save(input: DashboardSaveInput): Promise<DashboardRecord>;
@@ -88,6 +128,16 @@ export interface DashboardStore {
  * Exported for unit testing.
  */
 export declare function parseDashboardRecord(raw: unknown): DashboardRecord | undefined;
+/**
+ * The ownership rule of the {@link DashboardStore} contract, shared by every
+ * built-in store and by the dashboard tools: no caller id = global scope
+ * (no-OAuth boot, everything visible); an identified caller owns exactly the
+ * records stamped with its id — an owner-less record is not one of them.
+ *
+ * Exported so a custom store applies the same rule instead of re-deriving it
+ * (the 2.5 rule also granted owner-less records to every identified caller).
+ */
+export declare function isDashboardOwnedBy(ownerId: string | undefined, userId: string | undefined): boolean;
 /**
  * Error thrown by `save()` when an update would touch a record the caller
  * doesn't own, or would change a record's owner. Distinct from the
@@ -98,6 +148,24 @@ export declare function parseDashboardRecord(raw: unknown): DashboardRecord | un
 export declare class DashboardOwnershipError extends Error {
     constructor(message: string);
 }
+/**
+ * Error thrown by `get`, `save` and `delete` when the addressed record exists
+ * but this build cannot read it (newer `schemaVersion`, corrupt JSON, failed
+ * schema). Treating such a record as absent would let `save` overwrite it —
+ * stamping a fresh owner onto someone else's data — so it is a conflict the
+ * caller has to see.
+ */
+export declare class DashboardUnreadableError extends Error {
+    readonly dashboardId: string;
+    readonly reason: string;
+    constructor(dashboardId: string, reason: string);
+}
+/**
+ * Throw {@link DashboardOwnershipError} unless `userId` may update `existing`
+ * ({@link isDashboardOwnedBy}). Shared by {@link resolveSavedRecord} and the
+ * dashboard tools, which re-check a custom store's answer before a save.
+ */
+export declare function assertDashboardWritable(existing: DashboardRecord, userId: string | undefined): void;
 /**
  * Resolve the record to persist for a `save`, enforcing ownership on updates.
  *
@@ -108,9 +176,10 @@ export declare class DashboardOwnershipError extends Error {
  *   record with `id`, `createdAt`, and — critically — `existing.userId`
  *   preserved so `input.userId` can never reassign the owner.
  *
- * Records without a `userId` (global scope, e.g. a host booted without OAuth)
- * are deliberately writable by anyone — same convention `ownedBy` uses for
- * read/delete — so single-user and OAuth-less deployments keep working.
+ * Without an `input.userId` (global scope: a host booted without OAuth) every
+ * record is writable, so single-user deployments keep working. An identified
+ * actor owns only records stamped with its id — an owner-less record is
+ * refused, never silently claimed.
  *
  * Exported for unit testing; the store factories below are the public API.
  */
@@ -127,9 +196,10 @@ export interface FileSystemDashboardStoreOptions {
 }
 /**
  * Dashboards stored as one JSON file per record under `dir`. Suitable for
- * single-node deployments that need survival across restarts. Locking is
- * advisory: concurrent writes of the same id can race — fine for the v1
- * "single user clicking Save" workflow, not fine for multi-writer
+ * single-node deployments that need survival across restarts. Writes are
+ * atomic (temp file + rename), so a crash never leaves a torn record.
+ * Locking is advisory: concurrent writes of the same id can race — fine for
+ * the v1 "single user clicking Save" workflow, not fine for multi-writer
  * production.
  */
 export declare function createFileSystemDashboardStore(options: FileSystemDashboardStoreOptions): DashboardStore;

package/dist/tools/dashboard-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard-store.d.ts","sourceRoot":"","sources":["../../src/tools/dashboard-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAEzC;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,KAAK,CAAC,EAAE,eAAe,EAAE,CAAA;IACzB,MAAM,EAAE,YAAY,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,KAAK,CAAC,EAAE,eAAe,EAAE,CAAA;IACzB,MAAM,EAAE,YAAY,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAA;IAClF,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAClE;AA2BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAO9E;AAYD;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,MAAM,GACV,eAAe,GAAG,IAAI,CAgBxB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,IAAI,cAAc,CAuD7D;AAED,MAAM,WAAW,+BAA+B;IAC9C,4EAA4E;IAC5E,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,+BAA+B,GACvC,cAAc,CA0GhB"}
+{"version":3,"file":"dashboard-store.d.ts","sourceRoot":"","sources":["../../src/tools/dashboard-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAEzC;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,KAAK,CAAC,EAAE,eAAe,EAAE,CAAA;IACzB,MAAM,EAAE,YAAY,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,KAAK,CAAC,EAAE,eAAe,EAAE,CAAA;IACzB,MAAM,EAAE,YAAY,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAA;IAClF,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAClE;AA2BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAO9E;AAMD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,OAAO,CAGT;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IAE/C,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM;CAO1B;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,IAAI,CAON;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,MAAM,GACV,eAAe,GAAG,IAAI,CAYxB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,IAAI,cAAc,CA+C7D;AAED,MAAM,WAAW,+BAA+B;IAC9C,4EAA4E;IAC5E,GAAG,EAAE,MAAM,CAAA;CACZ;AA4CD;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,+BAA+B,GACvC,cAAc,CA2IhB"}