@ni-c/imap-mcp 0.2.0 → 0.3.0

package/dist/approval.js

@@ -1,69 +0,0 @@
-import { confirmationPrompt, renderDetails, } from './confirm.js';
-import { ToolInputError } from './errors.js';
-import { textResult } from './result.js';
-/** How long the server waits for the human to answer the dialog. */
-const ELICITATION_TIMEOUT_MS = 5 * 60 * 1000;
-/**
- * Asks a human before an irreversible operation.
- *
- * Why this exists next to {@link ConfirmationStore}: the confirmation token is
- * not a human-in-the-loop gate and never was. It is returned inside a tool
- * result, which means the model reads it and can call again in the same turn
- * without anyone seeing the dialog. That still catches a model that widens the
- * target set by accident, but a model which has been talked into deleting the
- * mailbox will happily call twice.
- *
- * MCP elicitation closes that hole: the request goes to the client, which shows
- * it to the person sitting there, and the model cannot answer on their behalf.
- * Clients that do not support it fall back to the token, because refusing to
- * work at all would push people towards turning the guard off entirely.
- */
-export async function requestApproval(server, confirmations, request) {
-    if (server.server.getClientCapabilities()?.elicitation !== undefined) {
-        return elicit(server, request);
-    }
-    if (confirmations.consume(request.resourceKey, request.token)) {
-        return { approved: true };
-    }
-    return {
-        approved: false,
-        result: textResult(`${confirmationPrompt(request.what, confirmations.issue(request.resourceKey), confirmations.ttlMinutes, request.consequence, request.details ?? [])}\n\nNote: this client cannot ask the user directly, so this check only ` +
-            'proves the call was made twice with the same arguments. A human should ' +
-            'read the line above before you continue.'),
-    };
-}
-async function elicit(server, request) {
-    let response;
-    try {
-        response = await server.server.elicitInput({
-            // Server-side facts only: no subject, sender or body reaches this
-            // string. It is rendered to a human, but it is composed by us — and
-            // the caller-chosen names go through renderDetails rather than into
-            // the sentence, so none of it is a place to hide an instruction.
-            message: `${request.what}\n\n${request.consequence}` +
-                renderDetails(request.details ?? []),
-            requestedSchema: {
-                type: 'object',
-                properties: {
-                    confirm: {
-                        type: 'boolean',
-                        title: 'Proceed?',
-                        description: 'Tick to allow this operation, leave it to cancel.',
-                    },
-                },
-                required: ['confirm'],
-            },
-        }, { timeout: ELICITATION_TIMEOUT_MS });
-    }
-    catch (error) {
-        // A timeout, a client that advertised the capability but cannot deliver, a
-        // dropped connection: all of them mean nobody said yes.
-        const reason = error instanceof Error ? error.message : String(error);
-        throw new ToolInputError(`imap-mcp: could not obtain confirmation from the user (${reason}). Nothing was changed.`);
-    }
-    if (response.action !== 'accept' || response.content?.confirm !== true) {
-        throw new ToolInputError('imap-mcp: the user declined. Nothing was changed.');
-    }
-    return { approved: true };
-}
-//# sourceMappingURL=approval.js.map

package/dist/approval.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"approval.js","sourceRoot":"","sources":["../src/approval.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,kBAAkB,EAClB,aAAa,GAGd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,oEAAoE;AACpE,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AA0B7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,aAAgC,EAChC,OAAwB;IAExB,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACrE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,UAAU,CAChB,GAAG,kBAAkB,CACnB,OAAO,CAAC,IAAI,EACZ,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EACxC,aAAa,CAAC,UAAU,EACxB,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,OAAO,IAAI,EAAE,CACtB,yEAAyE;YACxE,yEAAyE;YACzE,0CAA0C,CAC7C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,MAAiB,EACjB,OAAwB;IAExB,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CACxC;YACE,kEAAkE;YAClE,oEAAoE;YACpE,oEAAoE;YACpE,iEAAiE;YACjE,OAAO,EACL,GAAG,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,WAAW,EAAE;gBAC3C,aAAa,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YACtC,eAAe,EAAE;gBACf,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,OAAO,EAAE;wBACP,IAAI,EAAE,SAAS;wBACf,KAAK,EAAE,UAAU;wBACjB,WAAW,EAAE,mDAAmD;qBACjE;iBACF;gBACD,QAAQ,EAAE,CAAC,SAAS,CAAC;aACtB;SACF,EACD,EAAE,OAAO,EAAE,sBAAsB,EAAE,CACpC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,cAAc,CACtB,0DAA0D,MAAM,yBAAyB,CAC1F,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QACvE,MAAM,IAAI,cAAc,CACtB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC"}

package/dist/confirm.d.ts

@@ -1,59 +0,0 @@
-/**
- * Issues short-lived confirmation tokens for irreversible operations.
- *
- * A plain boolean `confirm` parameter could be set by the model on the very
- * first call — or be talked into it by instructions hidden in upstream content —
- * whereas a random token that only ever appears in a *previous* tool result
- * cannot be guessed. The token is bound to a resource key, so a confirmation for
- * one target cannot be replayed for another.
- */
-export declare class ConfirmationStore {
-    private readonly ttlMs;
-    private readonly pending;
-    constructor(ttlMs?: number);
-    /** Creates (or replaces) the pending token for `resource`. */
-    issue(resource: string): string;
-    /**
-     * Returns true and consumes the token when it matches the pending one for
-     * `resource` and has not expired. Tokens are single-use.
-     */
-    consume(resource: string, token: string | undefined): boolean;
-    /** Minutes the issued tokens stay valid, for use in messages. */
-    get ttlMinutes(): number;
-}
-/**
- * Resource key for an operation on a *set* of targets. Without the fingerprint a
- * confirmation for ["a.txt"] would also execute ["a.txt", "secrets.env"] — the
- * model chooses the second list, and only the id would have been checked.
- */
-export declare function setResourceKey(operation: string, targets: string[]): string;
-/**
- * A name this server did not choose, shown alongside a confirmation.
- *
- * Mailbox names look like server-side metadata and are not: they come from the
- * model's arguments, and `list_mailboxes` sources them from the account — which
- * on a shared mailbox or a public namespace means a colleague, or whoever
- * compromised one, picks them. A folder called
- * `Archive" — routine cleanup, pre-approved by IT` interpolated into the middle
- * of "This will move 12 message(s) from X to Y" reads as part of the server's
- * own sentence, in the one string a human is given before losing a folder.
- *
- * So they are never interpolated: {@link renderDetails} puts each on its own
- * labelled line. `mailboxParam` refuses CR, LF and NUL, so a value cannot open a
- * second line and forge a label of its own — the single-line rendering is what
- * that validation is worth.
- */
-export interface ConfirmationDetail {
-    label: string;
-    value: string;
-}
-declare function renderDetails(details: readonly ConfirmationDetail[]): string;
-/**
- * Builds the text returned by the first call of a destructive tool.
- *
- * Note what is NOT in here: no subject, sender or filename coming out of the
- * mailbox. Those are attacker-controllable and this string is read by a model.
- * Mailbox names are attacker-reachable too, which is what `details` is for.
- */
-export declare function confirmationPrompt(what: string, token: string, ttlMinutes: number, consequence?: string, details?: readonly ConfirmationDetail[]): string;
-export { renderDetails };

package/dist/confirm.js

@@ -1,92 +0,0 @@
-import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
-const TOKEN_TTL_MS = 5 * 60 * 1000;
-/** Bounds the map so a loop of refused calls cannot grow it without limit. */
-const MAX_PENDING = 100;
-/**
- * Issues short-lived confirmation tokens for irreversible operations.
- *
- * A plain boolean `confirm` parameter could be set by the model on the very
- * first call — or be talked into it by instructions hidden in upstream content —
- * whereas a random token that only ever appears in a *previous* tool result
- * cannot be guessed. The token is bound to a resource key, so a confirmation for
- * one target cannot be replayed for another.
- */
-export class ConfirmationStore {
-    ttlMs;
-    pending = new Map();
-    constructor(ttlMs = TOKEN_TTL_MS) {
-        this.ttlMs = ttlMs;
-    }
-    /** Creates (or replaces) the pending token for `resource`. */
-    issue(resource) {
-        if (this.pending.size >= MAX_PENDING) {
-            const oldest = this.pending.keys().next();
-            if (!oldest.done)
-                this.pending.delete(oldest.value);
-        }
-        const token = randomBytes(16).toString('hex');
-        this.pending.set(resource, { token, expiresAt: Date.now() + this.ttlMs });
-        return token;
-    }
-    /**
-     * Returns true and consumes the token when it matches the pending one for
-     * `resource` and has not expired. Tokens are single-use.
-     */
-    consume(resource, token) {
-        const entry = this.pending.get(resource);
-        if (entry === undefined || token === undefined)
-            return false;
-        const supplied = Buffer.from(token);
-        const expected = Buffer.from(entry.token);
-        // Constant-time comparison. Guessing 128 random bits through a timing
-        // side channel is not a realistic attack on a local tool, but the safe
-        // comparison costs one line and removes the question.
-        const matches = supplied.length === expected.length &&
-            timingSafeEqual(supplied, expected);
-        if (!matches)
-            return false;
-        // Delete on any match, expired or not. Leaving a matched-but-dead entry
-        // behind kept it competing for space with live ones, and the eviction in
-        // issue() is insertion-order rather than LRU, so a long-lived key could be
-        // dropped ahead of a token that was already spent.
-        this.pending.delete(resource);
-        return Date.now() < entry.expiresAt;
-    }
-    /** Minutes the issued tokens stay valid, for use in messages. */
-    get ttlMinutes() {
-        return Math.round(this.ttlMs / 60_000);
-    }
-}
-/**
- * Resource key for an operation on a *set* of targets. Without the fingerprint a
- * confirmation for ["a.txt"] would also execute ["a.txt", "secrets.env"] — the
- * model chooses the second list, and only the id would have been checked.
- */
-export function setResourceKey(operation, targets) {
-    const fingerprint = createHash('sha256')
-        .update(JSON.stringify([...targets].sort()))
-        .digest('hex')
-        .slice(0, 16);
-    return `${operation}:${fingerprint}`;
-}
-function renderDetails(details) {
-    if (details.length === 0)
-        return '';
-    return ('\n\nNames below are supplied by the caller, not by this server:\n' +
-        details.map((d) => `  ${d.label}: ${d.value}`).join('\n'));
-}
-/**
- * Builds the text returned by the first call of a destructive tool.
- *
- * Note what is NOT in here: no subject, sender or filename coming out of the
- * mailbox. Those are attacker-controllable and this string is read by a model.
- * Mailbox names are attacker-reachable too, which is what `details` is for.
- */
-export function confirmationPrompt(what, token, ttlMinutes, consequence = 'The operation is irreversible.', details = []) {
-    return (`This will ${what}. ${consequence}` +
-        `${renderDetails(details)}\n\n` +
-        `To proceed, call this tool again with confirm_token="${token}".\n` +
-        `The token is valid for ${ttlMinutes} minutes and can be used once.`);
-}
-export { renderDetails };
-//# sourceMappingURL=confirm.js.map

package/dist/confirm.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"confirm.js","sourceRoot":"","sources":["../src/confirm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,8EAA8E;AAC9E,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAiB;IAMC;IALZ,OAAO,GAAG,IAAI,GAAG,EAG/B,CAAC;IAEJ,YAA6B,QAAgB,YAAY;QAA5B,UAAK,GAAL,KAAK,CAAuB;IAAG,CAAC;IAE7D,8DAA8D;IAC9D,KAAK,CAAC,QAAgB;QACpB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,QAAgB,EAAE,KAAyB;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sEAAsE;QACtE,uEAAuE;QACvE,sDAAsD;QACtD,MAAM,OAAO,GACX,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YACnC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;IACtC,CAAC;IAED,iEAAiE;IACjE,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;IACzC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,OAAiB;IACjE,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC;SACrC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SAC3C,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,GAAG,SAAS,IAAI,WAAW,EAAE,CAAC;AACvC,CAAC;AAuBD,SAAS,aAAa,CAAC,OAAsC;IAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,CACL,mEAAmE;QACnE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,KAAa,EACb,UAAkB,EAClB,WAAW,GAAG,gCAAgC,EAC9C,UAAyC,EAAE;IAE3C,OAAO,CACL,aAAa,IAAI,KAAK,WAAW,EAAE;QACnC,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM;QAC/B,wDAAwD,KAAK,MAAM;QACnE,0BAA0B,UAAU,gCAAgC,CACrE,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/tool-filter.d.ts

@@ -1,45 +0,0 @@
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-/**
- * A tool list that names something this server does not have.
- *
- * Thrown rather than `process.exit(1)`: `createServer` is called in-process by
- * the tests, and an exiting constructor cannot be tested. `src/index.ts` turns
- * it back into an exit code.
- */
-export declare class ToolFilterError extends Error {
-    constructor(message: string);
-}
-export interface ToolFilter {
-    /** False when neither variable was set — then nothing is wrapped at all. */
-    readonly active: boolean;
-    /** The tools that survive. Only meaningful while `active`. */
-    readonly selected: ReadonlySet<string>;
-}
-/**
- * Reads `<PREFIX>_ALLOW_TOOLS` / `<PREFIX>_DENY_TOOLS` and works out which
- * tools survive.
- *
- * Every entry has to match at least one tool in the catalogue. An entry that
- * matches nothing is fatal rather than ignored, because the failure it produces
- * otherwise — a tool quietly missing from `tools/list` — is invisible: nobody
- * looks for the cause of an absence in an environment variable.
- */
-export declare function buildToolFilter(config: {
-    allowTools: string | undefined;
-    denyTools: string | undefined;
-    readOnly: boolean;
-}): ToolFilter;
-/**
- * Makes `server` register only the tools the filter selected.
- *
- * The tool is registered and then removed again rather than skipped. Skipping
- * looks cheaper and breaks one case: the SDK installs its `tools/list` handler
- * from inside the registration path, so a server whose every tool was skipped
- * would answer `tools/list` with "method not found" instead of an empty list.
- * `remove()` deletes the entry from the SDK's tool map outright, which makes a
- * filtered tool answer `Tool X not found` — exactly what a tool the read-only
- * mode never registered already does. `disable()` would be wrong: it hides the
- * tool from `tools/list` but still answers a call with "disabled", which is the
- * advertising-a-refusal this server avoids everywhere else.
- */
-export declare function installToolFilter(server: McpServer, filter: ToolFilter): void;

package/dist/tool-filter.js

@@ -1,171 +0,0 @@
-import { ALL_TOOLS, ESSENTIAL_TOOLS, READ_TOOLS } from './tools/catalogue.js';
-/**
- * A tool list that names something this server does not have.
- *
- * Thrown rather than `process.exit(1)`: `createServer` is called in-process by
- * the tests, and an exiting constructor cannot be tested. `src/index.ts` turns
- * it back into an exit code.
- */
-export class ToolFilterError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'ToolFilterError';
-    }
-}
-/** The `essential` preset is spelled out here so it cannot collide with a tool name. */
-const PRESET = 'essential';
-/**
- * Splits a comma-separated value into entries.
- *
- * Empty entries are dropped, so `a,,b` and a trailing comma are both fine, and
- * a value that is empty or only whitespace counts as *unset* — `X_ALLOW_TOOLS=`
- * in a compose file must not mean "allow nothing". Entries are lowercased: the
- * catalogue is entirely lowercase, so this is lossless, and a shell that
- * upper-cased a name should not take the server down.
- */
-function entriesOf(raw) {
-    if (raw === undefined)
-        return undefined;
-    const entries = raw
-        .split(',')
-        .map((entry) => entry.trim().toLowerCase())
-        .filter((entry) => entry.length > 0);
-    return entries.length > 0 ? entries : undefined;
-}
-/**
- * Expands one entry to the catalogue tools it names.
- *
- * A pattern is a literal prefix plus exactly one trailing `*`. Anything else is
- * rejected outright: `*_zone` and `list_*_x` look plausible, match nothing, and
- * would otherwise be silent forever.
- */
-function expand(entry, variable) {
-    const star = entry.indexOf('*');
-    if (star !== -1) {
-        if (star !== entry.length - 1) {
-            throw new ToolFilterError(`${variable}: "${entry}" is not a valid entry — a pattern is a prefix ` +
-                'followed by a single trailing "*", for example "list_*". Everything ' +
-                'else is an exact tool name.');
-        }
-        const prefix = entry.slice(0, -1);
-        return ALL_TOOLS.filter((tool) => tool.startsWith(prefix));
-    }
-    return ALL_TOOLS.filter((tool) => tool === entry);
-}
-/** The full catalogue, for the "these are the names that exist" half of an error. */
-function catalogueList() {
-    return [...ALL_TOOLS].sort().join(', ');
-}
-/**
- * Reads `<PREFIX>_ALLOW_TOOLS` / `<PREFIX>_DENY_TOOLS` and works out which
- * tools survive.
- *
- * Every entry has to match at least one tool in the catalogue. An entry that
- * matches nothing is fatal rather than ignored, because the failure it produces
- * otherwise — a tool quietly missing from `tools/list` — is invisible: nobody
- * looks for the cause of an absence in an environment variable.
- */
-export function buildToolFilter(config) {
-    const allow = entriesOf(config.allowTools);
-    const deny = entriesOf(config.denyTools);
-    if (allow === undefined && deny === undefined) {
-        return { active: false, selected: new Set() };
-    }
-    // What would be registered without any filter. In read-only mode the write
-    // tools never reach `registerTool`, but they stay in the catalogue so that a
-    // name from that half is answered with "read-only suppresses it", never with
-    // "no such tool".
-    const registered = new Set(config.readOnly ? READ_TOOLS : ALL_TOOLS);
-    // Set when an allow entry named real tools and read-only suppressed all of
-    // them, so that "nothing is left" can name the reason rather than shrugging.
-    let suppressedByReadOnly = false;
-    let selected;
-    if (allow === undefined) {
-        selected = new Set(registered);
-    }
-    else {
-        selected = new Set();
-        for (const entry of allow) {
-            if (entry === PRESET) {
-                // Preset members are not names the operator typed, so a member that
-                // read-only suppresses is dropped silently rather than being an error.
-                for (const tool of ESSENTIAL_TOOLS) {
-                    if (registered.has(tool))
-                        selected.add(tool);
-                }
-                continue;
-            }
-            const matches = expand(entry, 'IMAP_ALLOW_TOOLS');
-            if (matches.length === 0) {
-                throw new ToolFilterError(`IMAP_ALLOW_TOOLS: no tool matches "${entry}". ` +
-                    `Valid tools: ${catalogueList()}. "${PRESET}" selects the curated preset.`);
-            }
-            const survivors = matches.filter((tool) => registered.has(tool));
-            if (survivors.length === 0) {
-                if (entry.endsWith('*')) {
-                    // A pattern is a template, not a claim about one tool: warn, continue.
-                    console.error(`imap-mcp: IMAP_ALLOW_TOOLS: "${entry}" matches only write ` +
-                        'tools, which IMAP_READ_ONLY suppresses — it contributes nothing.');
-                    suppressedByReadOnly = true;
-                    continue;
-                }
-                // An exact name, though, was typed by someone who believes it is exposed.
-                throw new ToolFilterError(`IMAP_ALLOW_TOOLS: "${entry}" is a write tool, but IMAP_READ_ONLY ` +
-                    'is set — it is never registered. Remove it from IMAP_ALLOW_TOOLS, ' +
-                    `or unset IMAP_READ_ONLY. Available in read-only mode: ${[...READ_TOOLS].sort().join(', ')}.`);
-            }
-            for (const tool of survivors)
-                selected.add(tool);
-        }
-    }
-    for (const entry of deny ?? []) {
-        // Deny lists are written defensively — "never expose delete_*, whatever
-        // else is on" — so matching nothing that survives is fine. Matching nothing
-        // in the catalogue is still a typo.
-        const matches = expand(entry, 'IMAP_DENY_TOOLS');
-        if (matches.length === 0) {
-            throw new ToolFilterError(`IMAP_DENY_TOOLS: no tool matches "${entry}". Valid tools: ${catalogueList()}.`);
-        }
-        for (const tool of matches)
-            selected.delete(tool);
-    }
-    if (selected.size === 0) {
-        throw new ToolFilterError(suppressedByReadOnly
-            ? 'IMAP_ALLOW_TOOLS selects only write tools, but IMAP_READ_ONLY is ' +
-                'set — the server would start with an empty tool list.'
-            : 'IMAP_ALLOW_TOOLS/IMAP_DENY_TOOLS leave no tools registered — the ' +
-                'server would start with an empty tool list.');
-    }
-    return { active: true, selected };
-}
-/**
- * Makes `server` register only the tools the filter selected.
- *
- * The tool is registered and then removed again rather than skipped. Skipping
- * looks cheaper and breaks one case: the SDK installs its `tools/list` handler
- * from inside the registration path, so a server whose every tool was skipped
- * would answer `tools/list` with "method not found" instead of an empty list.
- * `remove()` deletes the entry from the SDK's tool map outright, which makes a
- * filtered tool answer `Tool X not found` — exactly what a tool the read-only
- * mode never registered already does. `disable()` would be wrong: it hides the
- * tool from `tools/list` but still answers a call with "disabled", which is the
- * advertising-a-refusal this server avoids everywhere else.
- */
-export function installToolFilter(server, filter) {
-    if (!filter.active)
-        return;
-    const register = server.registerTool.bind(server);
-    // An object literal rather than a plain function so the method picks up the
-    // SDK's generic signature by contextual typing — the call sites keep their
-    // typed handler arguments and nothing needs a cast.
-    const wrapper = {
-        registerTool(name, config, cb) {
-            const tool = register(name, config, cb);
-            if (!filter.selected.has(name))
-                tool.remove();
-            return tool;
-        },
-    };
-    server.registerTool = wrapper.registerTool;
-}
-//# sourceMappingURL=tool-filter.js.map

package/dist/tool-filter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tool-filter.js","sourceRoot":"","sources":["../src/tool-filter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AASD,wFAAwF;AACxF,MAAM,MAAM,GAAG,WAAW,CAAC;AAE3B;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,MAAM,CAAC,KAAa,EAAE,QAAgB;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,IAAI,IAAI,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CACvB,GAAG,QAAQ,MAAM,KAAK,iDAAiD;gBACrE,sEAAsE;gBACtE,6BAA6B,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,qFAAqF;AACrF,SAAS,aAAa;IACpB,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,MAI/B;IACC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,kBAAkB;IAClB,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAE,SAA+B,CAChE,CAAC;IAEF,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,oBAAoB,GAAG,KAAK,CAAC;IAEjC,IAAI,QAAqB,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,oEAAoE;gBACpE,uEAAuE;gBACvE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;oBACnC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC/C,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,eAAe,CACvB,sCAAsC,KAAK,KAAK;oBAC9C,gBAAgB,aAAa,EAAE,MAAM,MAAM,+BAA+B,CAC7E,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,uEAAuE;oBACvE,OAAO,CAAC,KAAK,CACX,gCAAgC,KAAK,uBAAuB;wBAC1D,kEAAkE,CACrE,CAAC;oBACF,oBAAoB,GAAG,IAAI,CAAC;oBAC5B,SAAS;gBACX,CAAC;gBACD,0EAA0E;gBAC1E,MAAM,IAAI,eAAe,CACvB,sBAAsB,KAAK,wCAAwC;oBACjE,oEAAoE;oBACpE,yDAAyD,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChG,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;QAC/B,wEAAwE;QACxE,4EAA4E;QAC5E,oCAAoC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CACvB,qCAAqC,KAAK,mBAAmB,aAAa,EAAE,GAAG,CAChF,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO;YAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,oBAAoB;YAClB,CAAC,CAAC,mEAAmE;gBACjE,uDAAuD;YAC3D,CAAC,CAAC,mEAAmE;gBACjE,6CAA6C,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,MAAkB;IACrE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,OAAO,GAAoC;QAC/C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IACF,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAC7C,CAAC"}