@octopusdeploy/mcp-server 1.0.1 → 2.1.0

package/dist/helpers/getClientConfigurationFromEnvironment.js.map

@@ -1 +1 @@
-{"version":3,"file":"getClientConfigurationFromEnvironment.js","sourceRoot":"","sources":["../../src/helpers/getClientConfigurationFromEnvironment.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAO7C,SAAS,OAAO,CAAC,KAAyB;IACxC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,GAAG,eAAe,IAAI,cAAc,KAAK,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,GAAG,CAAC;IAEpG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAAC,UAAgC,EAAE;IAChE,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,6KAA6K,CAC9K,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;IAEvC,OAAO;QACL,YAAY,EAAE,SAAS;QACvB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC;IACnD,OAAO,sBAAsB,CAAC;QAC5B,WAAW,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,oBAAoB,CAAC;QAC/D,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC;KACrD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"getClientConfigurationFromEnvironment.js","sourceRoot":"","sources":["../../src/helpers/getClientConfigurationFromEnvironment.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAQ7C,SAAS,OAAO,CAAC,KAAyB;IACxC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,GAAG,eAAe,IAAI,cAAc,KAAK,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,GAAG,CAAC;IAEpG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAgC,EAAE;IACvE,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAErD,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,mIAAmI,CACpI,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,2GAA2G,CAC5G,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;IAEvC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACzD,OAAO;YACL,YAAY,EAAE,SAAS;YACvB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC3C,OAAO;QACL,YAAY,EAAE,SAAS;QACvB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC;IACnD,OAAO,sBAAsB,CAAC;QAC5B,WAAW,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,oBAAoB,CAAC;QAC/D,MAAM,EAAE,GAAG,CAAC,iBAAiB,CAAC;QAC9B,WAAW,EAAE,GAAG,CAAC,sBAAsB,CAAC;KACzC,CAAC,CAAC;AACL,CAAC"}

package/dist/helpers/grepLines.d.ts

@@ -0,0 +1,38 @@
+/**
+ * GNU-grep-shaped line search over a multi-line string. Pure function, used by
+ * grep_task_log (task activity logs) and grep_llms_txt (catalog markdown). Each
+ * line is tested independently; matching lines are emitted with optional
+ * symmetric context windows. Overlapping context between adjacent matches is
+ * NOT deduplicated — each match carries its own complete context window so the
+ * consumer can reason about each match in isolation. This is a deliberate
+ * departure from GNU grep's `--`-separated output but it is the right shape
+ * for a JSON tool response.
+ */
+export interface GrepLinesParams {
+    pattern: string;
+    caseInsensitive?: boolean;
+    invertMatch?: boolean;
+    fixedString?: boolean;
+    beforeContext?: number;
+    afterContext?: number;
+    maxCount?: number;
+}
+export interface ContextLine {
+    lineNumber: number;
+    line: string;
+}
+export interface GrepMatch {
+    lineNumber: number;
+    line: string;
+    before?: ContextLine[];
+    after?: ContextLine[];
+}
+export interface GrepLinesResult {
+    totalLines: number;
+    totalMatches: number;
+    matches: GrepMatch[];
+}
+export declare const MAX_CONTEXT = 50;
+export declare const MAX_COUNT_HARD_CAP = 500;
+export declare function grepLines(rawText: string, params: GrepLinesParams): GrepLinesResult;
+//# sourceMappingURL=grepLines.d.ts.map

package/dist/helpers/grepLines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grepLines.d.ts","sourceRoot":"","sources":["../../src/helpers/grepLines.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,SAAS,EAAE,CAAC;CACtB;AAED,eAAO,MAAM,WAAW,KAAK,CAAC;AAC9B,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAuBtC,wBAAgB,SAAS,CACvB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,eAAe,GACtB,eAAe,CAoDjB"}

package/dist/helpers/grepLines.js

@@ -0,0 +1,65 @@
+/**
+ * GNU-grep-shaped line search over a multi-line string. Pure function, used by
+ * grep_task_log (task activity logs) and grep_llms_txt (catalog markdown). Each
+ * line is tested independently; matching lines are emitted with optional
+ * symmetric context windows. Overlapping context between adjacent matches is
+ * NOT deduplicated — each match carries its own complete context window so the
+ * consumer can reason about each match in isolation. This is a deliberate
+ * departure from GNU grep's `--`-separated output but it is the right shape
+ * for a JSON tool response.
+ */
+export const MAX_CONTEXT = 50;
+export const MAX_COUNT_HARD_CAP = 500;
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function compilePattern(pattern, caseInsensitive, fixedString) {
+    const source = fixedString ? escapeRegExp(pattern) : pattern;
+    const flags = caseInsensitive ? "i" : "";
+    try {
+        return new RegExp(source, flags);
+    }
+    catch (error) {
+        throw new Error(`Invalid pattern: ${error instanceof Error ? error.message : String(error)}. ` +
+            "Set fixedString:true to treat the pattern as a literal substring instead of a regex.");
+    }
+}
+export function grepLines(rawText, params) {
+    const { pattern, caseInsensitive = false, invertMatch = false, fixedString = false, beforeContext = 0, afterContext = 0, maxCount = 100, } = params;
+    const lines = rawText.split("\n");
+    // Drop the trailing empty element produced by a final newline.
+    if (lines.length > 0 && lines[lines.length - 1] === "")
+        lines.pop();
+    const regex = compilePattern(pattern, caseInsensitive, fixedString);
+    const matches = [];
+    let totalMatches = 0;
+    for (let i = 0; i < lines.length; i++) {
+        const isMatch = regex.test(lines[i]) !== invertMatch;
+        if (!isMatch)
+            continue;
+        totalMatches++;
+        if (matches.length >= maxCount)
+            continue;
+        const match = {
+            lineNumber: i + 1,
+            line: lines[i],
+        };
+        if (beforeContext > 0) {
+            const start = Math.max(0, i - beforeContext);
+            match.before = lines.slice(start, i).map((line, idx) => ({
+                lineNumber: start + idx + 1,
+                line,
+            }));
+        }
+        if (afterContext > 0) {
+            const end = Math.min(lines.length, i + 1 + afterContext);
+            match.after = lines.slice(i + 1, end).map((line, idx) => ({
+                lineNumber: i + 2 + idx,
+                line,
+            }));
+        }
+        matches.push(match);
+    }
+    return { totalLines: lines.length, totalMatches, matches };
+}
+//# sourceMappingURL=grepLines.js.map

package/dist/helpers/grepLines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grepLines.js","sourceRoot":"","sources":["../../src/helpers/grepLines.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA8BH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC9B,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,cAAc,CACrB,OAAe,EACf,eAAwB,EACxB,WAAoB;IAEpB,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;YAC5E,sFAAsF,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,OAAe,EACf,MAAuB;IAEvB,MAAM,EACJ,OAAO,EACP,eAAe,GAAG,KAAK,EACvB,WAAW,GAAG,KAAK,EACnB,WAAW,GAAG,KAAK,EACnB,aAAa,GAAG,CAAC,EACjB,YAAY,GAAG,CAAC,EAChB,QAAQ,GAAG,GAAG,GACf,GAAG,MAAM,CAAC;IAEX,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,+DAA+D;IAC/D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAEpE,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IAEpE,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,YAAY,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ;YAAE,SAAS;QAEzC,MAAM,KAAK,GAAc;YACvB,UAAU,EAAE,CAAC,GAAG,CAAC;YACjB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;SACf,CAAC;QAEF,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC;YAC7C,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBACvD,UAAU,EAAE,KAAK,GAAG,GAAG,GAAG,CAAC;gBAC3B,IAAI;aACL,CAAC,CAAC,CAAC;QACN,CAAC;QAED,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;YACzD,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBACxD,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG;gBACvB,IAAI;aACL,CAAC,CAAC,CAAC;QACN,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC"}

package/dist/helpers/methodTier.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Hard-coded read/write/delete classification for HTTP methods used by the
+ * `execute` backstop tool. The HTTP method is the authoritative classifier —
+ * never something the LLM gets to set independently of the actual call.
+ *
+ * Tiers:
+ *   - read   → GET                       (always allowed, subject to allow/denylists)
+ *   - write  → POST, PUT, PATCH          (blocked when --read-only is set)
+ *   - delete → DELETE                    (blocked when --read-only is set; also requires --allow-deletes)
+ */
+export type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+export type MethodTier = "read" | "write" | "delete";
+export declare const HTTP_METHODS: readonly HttpMethod[];
+export declare function classifyMethod(method: HttpMethod): MethodTier;
+//# sourceMappingURL=methodTier.d.ts.map

package/dist/helpers/methodTier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"methodTier.d.ts","sourceRoot":"","sources":["../../src/helpers/methodTier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AACrE,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAErD,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAMpC,CAAC;AAEX,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAI7D"}

package/dist/helpers/methodTier.js

@@ -0,0 +1,25 @@
+/**
+ * Hard-coded read/write/delete classification for HTTP methods used by the
+ * `execute` backstop tool. The HTTP method is the authoritative classifier —
+ * never something the LLM gets to set independently of the actual call.
+ *
+ * Tiers:
+ *   - read   → GET                       (always allowed, subject to allow/denylists)
+ *   - write  → POST, PUT, PATCH          (blocked when --read-only is set)
+ *   - delete → DELETE                    (blocked when --read-only is set; also requires --allow-deletes)
+ */
+export const HTTP_METHODS = [
+    "GET",
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+];
+export function classifyMethod(method) {
+    if (method === "GET")
+        return "read";
+    if (method === "DELETE")
+        return "delete";
+    return "write";
+}
+//# sourceMappingURL=methodTier.js.map

package/dist/helpers/methodTier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"methodTier.js","sourceRoot":"","sources":["../../src/helpers/methodTier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,MAAM,CAAC,MAAM,YAAY,GAA0B;IACjD,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;CACA,CAAC;AAEX,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACzC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/helpers/pathAllowlist.d.ts

@@ -0,0 +1,27 @@
+import { type Toolset } from "../types/toolConfig.js";
+export interface AllowlistMatch {
+    matched: boolean;
+    toolset?: Toolset;
+}
+/**
+ * Find which toolset owns `path`. Most-specific-match-wins: if multiple
+ * toolsets have patterns matching the path, the toolset whose pattern has
+ * more literal segments wins ownership. Returns undefined if no toolset
+ * claims the path at all.
+ *
+ * This is the basis for both `matchPath` (allowlist enforcement) and the
+ * "which toolset do I need to enable?" error message in `execute`.
+ */
+export declare function findOwningToolset(path: string): Toolset | undefined;
+/**
+ * Check whether `path` falls under the allowlist given which toolsets are
+ * currently enabled. The `core` toolset is implicitly always enabled.
+ *
+ * The owning toolset (most-specific match) must be the one enabled — a
+ * less-specific toolset whose wildcard happens to also match cannot shadow
+ * a disabled, more-specific owner. So `featureToggles` paths require the
+ * `featureToggles` toolset, even when `projects` (whose `/projects/**`
+ * wildcard also matches) is enabled.
+ */
+export declare function matchPath(path: string, enabledToolsets: readonly Toolset[]): AllowlistMatch;
+//# sourceMappingURL=pathAllowlist.d.ts.map

package/dist/helpers/pathAllowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathAllowlist.d.ts","sourceRoot":"","sources":["../../src/helpers/pathAllowlist.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,wBAAwB,CAAC;AA4GtD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAYnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,SAAS,OAAO,EAAE,GAClC,cAAc,CAQhB"}

package/dist/helpers/pathAllowlist.js

@@ -0,0 +1,177 @@
+// Path allowlist for the `execute` backstop tool, scoped per toolset.
+//
+// The mapping says: "if toolset X is enabled, these path patterns are
+// reachable through execute". When a toolset is disabled, all of its patterns
+// disappear — turning off `releases` makes the release endpoints unreachable
+// regardless of HTTP method or read-only mode. This is the kill-switch model.
+//
+// **`core` is intentionally narrow.** It only covers space discovery,
+// server-level metadata, and the API catalog. It does NOT contain a wildcard
+// over space sub-paths — every per-resource path under a space must be
+// registered against its owning toolset. Anything else would let `core`
+// (which is always enabled and consulted first) defeat per-toolset filtering
+// for every space-scoped endpoint.
+//
+// **Each toolset registers BOTH space-prefix forms.** Octopus accepts
+// `/api/{spaceId}/X` and `/api/spaces/{spaceIdentifier}/X` interchangeably, so
+// each toolset declares both — `/api/<single>/projects` covers the
+// bare-space-ID form, and `/api/spaces/<single>/projects` covers the
+// `/spaces/{slug-or-id}` form. The shared glob engine treats `*` as a single
+// segment, so both patterns are needed.
+//
+// Pattern syntax is the shared `compilePathGlob` engine — `*` matches one
+// segment, `**` matches across segments. Patterns are anchored to the full
+// path: `/api/projects` does NOT match `/api/projects/Projects-1`; use
+// `/api/projects/**` for the latter.
+//
+// The allowlist is deliberately conservative at launch — it enumerates paths
+// the existing curated tools already cover plus the obvious neighbours.
+// Expand based on real usage; do not pre-emptively enumerate every Octopus
+// endpoint up front.
+import {} from "../types/toolConfig.js";
+import { pathMatchesGlob } from "./pathGlob.js";
+/**
+ * Helper: produce the two prefix forms for a space-scoped path suffix.
+ *   spacePrefixed("projects") → ["/api/* /projects", "/api/spaces/* /projects"]
+ * Returns the bare endpoint and the wildcard sub-path variants for both.
+ */
+function spaceScoped(suffix) {
+    return [
+        `/api/*/${suffix}`,
+        `/api/*/${suffix}/**`,
+        `/api/spaces/*/${suffix}`,
+        `/api/spaces/*/${suffix}/**`,
+    ];
+}
+const TOOLSET_PATH_PATTERNS = {
+    core: [
+        "/api",
+        "/api/users/me",
+        "/api/users/me/permissions/**",
+        "/api/spaces",
+        // Top-level Space metadata only — single segment after `/api/spaces`.
+        // Per-resource paths beneath a space (`/api/spaces/{id}/projects`, etc.)
+        // are NOT in core; they live under their owning toolset.
+        "/api/spaces/*",
+        "/api/serverstatus/**",
+        "/api/experimental/**",
+    ],
+    projects: [
+        ...spaceScoped("projects"),
+        ...spaceScoped("projectgroups"),
+        ...spaceScoped("lifecycles"),
+    ],
+    deployments: [
+        ...spaceScoped("deployments"),
+        ...spaceScoped("deploymentprocesses"),
+        ...spaceScoped("dashboard"),
+    ],
+    releases: [
+        ...spaceScoped("releases"),
+        ...spaceScoped("channels"),
+    ],
+    runbooks: [
+        ...spaceScoped("runbooks"),
+        ...spaceScoped("runbookruns"),
+        ...spaceScoped("runbookprocesses"),
+        ...spaceScoped("runbooksnapshots"),
+    ],
+    tasks: ["/api/tasks", "/api/tasks/**"],
+    tenants: [
+        ...spaceScoped("tenants"),
+        ...spaceScoped("tenantvariables"),
+    ],
+    kubernetes: [
+        "/api/*/machines/*/livestatus/**",
+        "/api/*/machines/*/connection/**",
+        "/api/spaces/*/machines/*/livestatus/**",
+        "/api/spaces/*/machines/*/connection/**",
+    ],
+    machines: [
+        ...spaceScoped("machines"),
+        ...spaceScoped("workers"),
+        ...spaceScoped("workerpools"),
+    ],
+    context: [
+        ...spaceScoped("environments"),
+        ...spaceScoped("variables"),
+    ],
+    certificates: [
+        ...spaceScoped("certificates"),
+    ],
+    accounts: [
+        ...spaceScoped("accounts"),
+    ],
+    interruptions: [
+        ...spaceScoped("interruptions"),
+    ],
+    featureToggles: [
+        // Customer feature toggles are project-scoped, so the paths nest under
+        // /projects/*/featuretoggles rather than directly under the space. The
+        // `projects` toolset's `/api/*/projects/**` wildcard ALSO matches these,
+        // but the most-specific-match-wins logic in matchPath/findOwningToolset
+        // (below) attributes them to `featureToggles` because these patterns
+        // have more literal segments. So disabling `featureToggles` is a real
+        // kill switch — the path becomes unreachable through `execute` even
+        // when `projects` is still enabled.
+        "/api/*/projects/*/featuretoggles",
+        "/api/*/projects/*/featuretoggles/**",
+        "/api/spaces/*/projects/*/featuretoggles",
+        "/api/spaces/*/projects/*/featuretoggles/**",
+    ],
+};
+// Specificity = count of literal (non-wildcard) segments in the pattern.
+// "/api/<wildcard>/projects/<doublewildcard>" has 2 literal segments
+// (api, projects). "/api/<wildcard>/projects/<wildcard>/featuretoggles"
+// has 3 (api, projects, featuretoggles). The more-literal pattern wins
+// ownership when multiple toolsets claim the same path. This makes nested
+// concerns (feature toggles under projects, kubernetes live-status under
+// machines) into real kill switches rather than honour-system overlays.
+function patternSpecificity(pattern) {
+    return pattern
+        .split("/")
+        .filter((seg) => seg.length > 0 && seg !== "*" && seg !== "**").length;
+}
+/**
+ * Find which toolset owns `path`. Most-specific-match-wins: if multiple
+ * toolsets have patterns matching the path, the toolset whose pattern has
+ * more literal segments wins ownership. Returns undefined if no toolset
+ * claims the path at all.
+ *
+ * This is the basis for both `matchPath` (allowlist enforcement) and the
+ * "which toolset do I need to enable?" error message in `execute`.
+ */
+export function findOwningToolset(path) {
+    let best = null;
+    for (const toolset of Object.keys(TOOLSET_PATH_PATTERNS)) {
+        for (const pattern of TOOLSET_PATH_PATTERNS[toolset]) {
+            if (!pathMatchesGlob(path, pattern))
+                continue;
+            const specificity = patternSpecificity(pattern);
+            if (!best || specificity > best.specificity) {
+                best = { toolset, specificity };
+            }
+        }
+    }
+    return best?.toolset;
+}
+/**
+ * Check whether `path` falls under the allowlist given which toolsets are
+ * currently enabled. The `core` toolset is implicitly always enabled.
+ *
+ * The owning toolset (most-specific match) must be the one enabled — a
+ * less-specific toolset whose wildcard happens to also match cannot shadow
+ * a disabled, more-specific owner. So `featureToggles` paths require the
+ * `featureToggles` toolset, even when `projects` (whose `/projects/**`
+ * wildcard also matches) is enabled.
+ */
+export function matchPath(path, enabledToolsets) {
+    const owner = findOwningToolset(path);
+    if (!owner)
+        return { matched: false };
+    const isEnabled = owner === "core" || enabledToolsets.includes(owner);
+    return isEnabled
+        ? { matched: true, toolset: owner }
+        : { matched: false, toolset: owner };
+}
+//# sourceMappingURL=pathAllowlist.js.map

package/dist/helpers/pathAllowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathAllowlist.js","sourceRoot":"","sources":["../../src/helpers/pathAllowlist.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,sEAAsE;AACtE,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,EAAE;AACF,sEAAsE;AACtE,6EAA6E;AAC7E,uEAAuE;AACvE,wEAAwE;AACxE,6EAA6E;AAC7E,mCAAmC;AACnC,EAAE;AACF,sEAAsE;AACtE,+EAA+E;AAC/E,mEAAmE;AACnE,qEAAqE;AACrE,6EAA6E;AAC7E,wCAAwC;AACxC,EAAE;AACF,0EAA0E;AAC1E,2EAA2E;AAC3E,uEAAuE;AACvE,qCAAqC;AACrC,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,2EAA2E;AAC3E,qBAAqB;AAErB,OAAO,EAAgB,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD;;;;GAIG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO;QACL,UAAU,MAAM,EAAE;QAClB,UAAU,MAAM,KAAK;QACrB,iBAAiB,MAAM,EAAE;QACzB,iBAAiB,MAAM,KAAK;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,qBAAqB,GAAuC;IAChE,IAAI,EAAE;QACJ,MAAM;QACN,eAAe;QACf,8BAA8B;QAC9B,aAAa;QACb,sEAAsE;QACtE,yEAAyE;QACzE,yDAAyD;QACzD,eAAe;QACf,sBAAsB;QACtB,sBAAsB;KACvB;IACD,QAAQ,EAAE;QACR,GAAG,WAAW,CAAC,UAAU,CAAC;QAC1B,GAAG,WAAW,CAAC,eAAe,CAAC;QAC/B,GAAG,WAAW,CAAC,YAAY,CAAC;KAC7B;IACD,WAAW,EAAE;QACX,GAAG,WAAW,CAAC,aAAa,CAAC;QAC7B,GAAG,WAAW,CAAC,qBAAqB,CAAC;QACrC,GAAG,WAAW,CAAC,WAAW,CAAC;KAC5B;IACD,QAAQ,EAAE;QACR,GAAG,WAAW,CAAC,UAAU,CAAC;QAC1B,GAAG,WAAW,CAAC,UAAU,CAAC;KAC3B;IACD,QAAQ,EAAE;QACR,GAAG,WAAW,CAAC,UAAU,CAAC;QAC1B,GAAG,WAAW,CAAC,aAAa,CAAC;QAC7B,GAAG,WAAW,CAAC,kBAAkB,CAAC;QAClC,GAAG,WAAW,CAAC,kBAAkB,CAAC;KACnC;IACD,KAAK,EAAE,CAAC,YAAY,EAAE,eAAe,CAAC;IACtC,OAAO,EAAE;QACP,GAAG,WAAW,CAAC,SAAS,CAAC;QACzB,GAAG,WAAW,CAAC,iBAAiB,CAAC;KAClC;IACD,UAAU,EAAE;QACV,iCAAiC;QACjC,iCAAiC;QACjC,wCAAwC;QACxC,wCAAwC;KACzC;IACD,QAAQ,EAAE;QACR,GAAG,WAAW,CAAC,UAAU,CAAC;QAC1B,GAAG,WAAW,CAAC,SAAS,CAAC;QACzB,GAAG,WAAW,CAAC,aAAa,CAAC;KAC9B;IACD,OAAO,EAAE;QACP,GAAG,WAAW,CAAC,cAAc,CAAC;QAC9B,GAAG,WAAW,CAAC,WAAW,CAAC;KAC5B;IACD,YAAY,EAAE;QACZ,GAAG,WAAW,CAAC,cAAc,CAAC;KAC/B;IACD,QAAQ,EAAE;QACR,GAAG,WAAW,CAAC,UAAU,CAAC;KAC3B;IACD,aAAa,EAAE;QACb,GAAG,WAAW,CAAC,eAAe,CAAC;KAChC;IACD,cAAc,EAAE;QACd,uEAAuE;QACvE,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,oCAAoC;QACpC,kCAAkC;QAClC,qCAAqC;QACrC,yCAAyC;QACzC,4CAA4C;KAC7C;CACF,CAAC;AAEF,yEAAyE;AACzE,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;AAC3E,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,IAAI,GAAqD,IAAI,CAAC;IAClE,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAc,EAAE,CAAC;QACtE,KAAK,MAAM,OAAO,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC;gBAAE,SAAS;YAC9C,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,IAAI,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC5C,IAAI,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,EAAE,OAAO,CAAC;AACvB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,eAAmC;IAEnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEtC,MAAM,SAAS,GAAG,KAAK,KAAK,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,SAAS;QACd,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;QACnC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC"}

package/dist/helpers/pathGlob.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Tiny safe glob engine for matching Octopus REST paths in the `execute`
+ * tool's allowlist and sensitive denylist. Two wildcard tokens:
+ *
+ *   - `*`  matches a single path segment (no `/` allowed)
+ *   - `**` matches any sequence of characters, including `/`
+ *
+ * Every other character is treated literally — regex metacharacters are
+ * escaped at compile time, so denylist and allowlist entries cannot be turned
+ * into regex injection by a clever path. Patterns are anchored to the full
+ * input via `^…$`, so `/api/projects` does NOT match `/api/projects/Projects-1`.
+ */
+export declare function compilePathGlob(pattern: string): RegExp;
+export declare function pathMatchesGlob(path: string, pattern: string): boolean;
+//# sourceMappingURL=pathGlob.d.ts.map

package/dist/helpers/pathGlob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathGlob.d.ts","sourceRoot":"","sources":["../../src/helpers/pathGlob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA6BvD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtE"}

package/dist/helpers/pathGlob.js

@@ -0,0 +1,47 @@
+/**
+ * Tiny safe glob engine for matching Octopus REST paths in the `execute`
+ * tool's allowlist and sensitive denylist. Two wildcard tokens:
+ *
+ *   - `*`  matches a single path segment (no `/` allowed)
+ *   - `**` matches any sequence of characters, including `/`
+ *
+ * Every other character is treated literally — regex metacharacters are
+ * escaped at compile time, so denylist and allowlist entries cannot be turned
+ * into regex injection by a clever path. Patterns are anchored to the full
+ * input via `^…$`, so `/api/projects` does NOT match `/api/projects/Projects-1`.
+ */
+const COMPILED = new Map();
+export function compilePathGlob(pattern) {
+    const cached = COMPILED.get(pattern);
+    if (cached)
+        return cached;
+    let regexSource = "";
+    let i = 0;
+    while (i < pattern.length) {
+        const ch = pattern[i];
+        if (ch === "*") {
+            if (pattern[i + 1] === "*") {
+                regexSource += ".*";
+                i += 2;
+                continue;
+            }
+            regexSource += "[^/]+";
+            i += 1;
+            continue;
+        }
+        if (/[.+?^${}()|[\]\\]/.test(ch)) {
+            regexSource += "\\" + ch;
+        }
+        else {
+            regexSource += ch;
+        }
+        i += 1;
+    }
+    const compiled = new RegExp("^" + regexSource + "$");
+    COMPILED.set(pattern, compiled);
+    return compiled;
+}
+export function pathMatchesGlob(path, pattern) {
+    return compilePathGlob(pattern).test(path);
+}
+//# sourceMappingURL=pathGlob.js.map

package/dist/helpers/pathGlob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathGlob.js","sourceRoot":"","sources":["../../src/helpers/pathGlob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE3C,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC3B,WAAW,IAAI,IAAI,CAAC;gBACpB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,WAAW,IAAI,OAAO,CAAC;YACvB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACjC,WAAW,IAAI,IAAI,GAAG,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,WAAW,IAAI,EAAE,CAAC;QACpB,CAAC;QACD,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,WAAW,GAAG,GAAG,CAAC,CAAC;IACrD,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAe;IAC3D,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC"}

package/dist/helpers/requireConfirmation.d.ts

@@ -0,0 +1,119 @@
+import { type McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export interface RequireConfirmationOptions {
+    /** Human-readable summary of what will happen, shown to the user. */
+    message: string;
+    /**
+     * Yes/no value from the calling tool's own args. Used only when the client
+     * does not advertise elicitation capability. Tool input schemas should add
+     * `confirm: z.boolean().optional()` and pass it through here.
+     *
+     * Resolution when the elicitation capability is absent:
+     *   - `true`     → confirmed (the LLM asserts the user approved out-of-band)
+     *   - `false`    → declined (the LLM asserts the user said no out-of-band)
+     *   - `undefined`→ confirmationRequired (the user hasn't been asked yet — the
+     *                  caller should report this back to the LLM as a hard error
+     *                  so it asks the user before retrying)
+     */
+    fallbackConfirm?: boolean;
+    /**
+     * Optional structured before/after view of the operation. Rendered as a
+     * key-level diff (with `+` / `-` markers) and appended to `message`, so the
+     * user sees exactly what's changing — including modifiers like scheduled
+     * run time, skipped steps, machine filters, prompted variables, and
+     * deployment-freeze overrides that don't fit the prose summary.
+     *
+     *   - Create operations: pass `{ source: {}, target: <command body> }`. Every
+     *     target field renders as a `+` line (everything is being added).
+     *   - Modify operations: `source` is the current state; `target` is the
+     *     proposed state. Only keys whose values differ appear in the output.
+     *
+     * Kept inside `message` rather than surfaced as a `requestedSchema` so the
+     * rendering is identical across clients regardless of which elicitation
+     * modes they support.
+     */
+    change?: {
+        source: Record<string, unknown>;
+        target: Record<string, unknown>;
+    };
+}
+/**
+ * Why the helper resolved the way it did. Tools branch on this so the LLM
+ * (and any humans reading logs) can tell an explicit user "no" apart from a
+ * confirmation that was never reachable in the first place.
+ */
+export type ConfirmationReason = 
+/** OCTOPUS_SKIP_ELICITATION=true bypass. */
+"envSkip"
+/** User clicked Accept on the elicitation prompt. */
+ | "accepted"
+/** Caller passed fallbackConfirm: true (no elicitation capability). */
+ | "fallbackConfirm"
+/** User clicked Decline on the elicitation prompt, or fallbackConfirm was explicitly false. */
+ | "declined"
+/** User dismissed the elicitation prompt without choosing. */
+ | "cancelled"
+/**
+ * Client does not advertise elicitation capability AND fallbackConfirm was
+ * not provided. The user has NOT been asked. Tools should surface this as a
+ * hard error and tell the LLM to ask the user before retrying.
+ */
+ | "confirmationRequired";
+export type ConfirmationResult = {
+    confirmed: true;
+    reason: "envSkip" | "accepted" | "fallbackConfirm";
+} | {
+    confirmed: false;
+    reason: "declined" | "cancelled" | "confirmationRequired";
+};
+/**
+ * Gate a write/destructive tool call on explicit user confirmation.
+ *
+ * Resolution order:
+ *   1. `OCTOPUS_SKIP_ELICITATION=true` env var → bypass (automation/CI).
+ *   2. Client advertises elicitation capability → SDK emits `elicitation/create`
+ *      and we map `result.action` to accepted/declined/cancelled.
+ *   3. Client does not advertise elicitation → fall back to the `confirm` arg
+ *      the tool surfaced in its own input schema. Distinguishes between
+ *      explicit `false` (declined) and missing (confirmationRequired) so the
+ *      caller can surface the latter as a hard error.
+ */
+export declare function requireConfirmation(server: McpServer, opts: RequireConfirmationOptions): Promise<ConfirmationResult>;
+export interface UnconfirmedResponseOptions {
+    /**
+     * Lowercase noun phrase describing the gated action — e.g. "release
+     * creation", "deployment", "runbook run". Embedded mid-sentence in the
+     * `confirmationRequired` message and capitalized for the cancelled message.
+     */
+    action: string;
+}
+/**
+ * Build the standard tool response for a non-confirmed gate result.
+ *
+ *   - `confirmationRequired` → `isError: true` with directive prose telling the
+ *     LLM to ask the user before retrying with `confirm: true`. This is the
+ *     "user was never asked" branch — distinct from a real cancellation, and
+ *     marked as an error so the LLM doesn't paper over it.
+ *   - `declined` / `cancelled` → soft cancellation shape with the original
+ *     reason preserved for telemetry.
+ *
+ * Centralized here so every gated tool produces identical responses; the only
+ * thing a caller varies is the `action` noun. Return type is inferred so it
+ * stays compatible with the SDK's tool-handler return shape (which carries an
+ * `[key: string]: unknown` index signature we don't want to redeclare).
+ */
+export declare function unconfirmedResponse(result: Extract<ConfirmationResult, {
+    confirmed: false;
+}>, opts: UnconfirmedResponseOptions): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: undefined;
+};
+//# sourceMappingURL=requireConfirmation.d.ts.map

package/dist/helpers/requireConfirmation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requireConfirmation.d.ts","sourceRoot":"","sources":["../../src/helpers/requireConfirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,MAAM,WAAW,0BAA0B;IACzC,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;CACH;AAqED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB;AAC5B,4CAA4C;AAC1C,SAAS;AACX,qDAAqD;GACnD,UAAU;AACZ,uEAAuE;GACrE,iBAAiB;AACnB,+FAA+F;GAC7F,UAAU;AACZ,8DAA8D;GAC5D,WAAW;AACb;;;;GAIG;GACD,sBAAsB,CAAC;AAE3B,MAAM,MAAM,kBAAkB,GAC1B;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,iBAAiB,CAAA;CAAE,GACvE;IACE,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,sBAAsB,CAAC;CAC3D,CAAC;AAEN;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA+B7B;AAED,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,OAAO,CAAC,kBAAkB,EAAE;IAAE,SAAS,EAAE,KAAK,CAAA;CAAE,CAAC,EACzD,IAAI,EAAE,0BAA0B;;;;;;;;;;;;EA4CjC"}