@raytio/mcp-server 2.0.0 → 2.1.0

package/dist/authorization.d.ts

@@ -0,0 +1,29 @@
+import { RaytioApiClient } from './raytio/api-client.js';
+/**
+ * Result of resolving the effective tool domain set for the authenticated
+ * user. When `authorized` is `false`, the caller MUST expose no tools.
+ */
+export interface AuthorizationResult {
+    /** Comma-separated domain spec suitable for `resolveDomains()`, or `undefined` when no tools should be exposed. */
+    domainSpec: string | undefined;
+    /** Human-readable reason for the decision. Emitted to stderr for operator visibility. */
+    reason: string;
+    /** `true` when the caller should expose tools. `false` means fail closed — expose nothing. */
+    authorized: boolean;
+}
+type StderrLogger = Pick<Console, 'error'>;
+/**
+ * Resolve the tool domain surface for the authenticated user.
+ *
+ * Behaviour:
+ *  - Always queries the backend for the user's resolved roles. On any
+ *    failure, fails closed and exposes no tools.
+ *  - The static `RAYTIO_TOOL_DOMAINS` override may only *restrict* the
+ *    user's resolved domain set. It never grants access to domains the
+ *    user does not have.
+ *  - If the intersection is empty (or the user has no recognised roles),
+ *    fails closed.
+ */
+export declare function resolveToolDomains(apiClient: RaytioApiClient, envSpec: string | undefined, logger?: StderrLogger): Promise<AuthorizationResult>;
+export {};
+//# sourceMappingURL=authorization.d.ts.map

package/dist/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,mHAAmH;IACnH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,KAAK,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAgD3C;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,GAAE,YAAsB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAyC9B"}

package/dist/authorization.js

@@ -0,0 +1,87 @@
+import { resolveUserDomains } from './tools/role-mapping.js';
+/**
+ * Domains that a static override may resolve to when the user only holds
+ * the full-access parent. This preserves the useful "further restrict a
+ * privileged user to read-only tools" case without ever letting a static
+ * override grant access the user does not already have.
+ */
+const READONLY_PARENTS = {
+    'ppm-readonly': 'ppm',
+    'wrm-readonly': 'wrm',
+    'sfa-readonly': 'sfa',
+};
+function parseSpec(spec) {
+    if (!spec)
+        return [];
+    return spec
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+/**
+ * Intersect a static domain list with the user's resolved domain list.
+ * Static entries that ask for a read-only sub-domain of a full-access
+ * domain the user already holds are permitted (a further restriction).
+ * Anything else the user does not have is silently dropped — a static
+ * override is a restriction, never a grant.
+ */
+function restrictToUserDomains(staticDomains, userDomains) {
+    const userSet = new Set(userDomains);
+    const allowed = [];
+    for (const d of staticDomains) {
+        if (userSet.has(d)) {
+            allowed.push(d);
+            continue;
+        }
+        const parent = READONLY_PARENTS[d];
+        if (parent && userSet.has(parent)) {
+            allowed.push(d);
+        }
+    }
+    return allowed;
+}
+/**
+ * Resolve the tool domain surface for the authenticated user.
+ *
+ * Behaviour:
+ *  - Always queries the backend for the user's resolved roles. On any
+ *    failure, fails closed and exposes no tools.
+ *  - The static `RAYTIO_TOOL_DOMAINS` override may only *restrict* the
+ *    user's resolved domain set. It never grants access to domains the
+ *    user does not have.
+ *  - If the intersection is empty (or the user has no recognised roles),
+ *    fails closed.
+ */
+export async function resolveToolDomains(apiClient, envSpec, logger = console) {
+    const staticDomains = parseSpec(envSpec);
+    let dynamicSpec;
+    try {
+        dynamicSpec = await resolveUserDomains(apiClient);
+    }
+    catch (err) {
+        const reason = `role query failed: ${err?.message ?? err}`;
+        logger.error(`Raytio MCP: authorization resolution failed (${reason}) — exposing no tools (fail closed)`);
+        return { domainSpec: undefined, reason, authorized: false };
+    }
+    const userDomains = parseSpec(dynamicSpec);
+    if (userDomains.length === 0) {
+        const reason = 'user has no recognised roles';
+        logger.error(`Raytio MCP: ${reason} — exposing no tools (fail closed)`);
+        return { domainSpec: undefined, reason, authorized: false };
+    }
+    if (staticDomains.length === 0) {
+        const spec = userDomains.join(',');
+        logger.error(`Raytio MCP: resolved domains from user roles: ${spec}`);
+        return { domainSpec: spec, reason: 'resolved from user roles', authorized: true };
+    }
+    const allowed = restrictToUserDomains(staticDomains, userDomains);
+    if (allowed.length === 0) {
+        const reason = `static RAYTIO_TOOL_DOMAINS "${staticDomains.join(',')}" does not intersect user roles "${userDomains.join(',')}"`;
+        logger.error(`Raytio MCP: ${reason} — exposing no tools (fail closed)`);
+        return { domainSpec: undefined, reason, authorized: false };
+    }
+    const spec = allowed.join(',');
+    logger.error(`Raytio MCP: static RAYTIO_TOOL_DOMAINS restricted user roles (${userDomains.join(',')}) to ${spec}`);
+    return { domainSpec: spec, reason: 'restricted by static override', authorized: true };
+}
+//# sourceMappingURL=authorization.js.map

package/dist/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAiB7D;;;;;GAKG;AACH,MAAM,gBAAgB,GAA2B;IAC/C,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;CACtB,CAAC;AAEF,SAAS,SAAS,CAAC,IAA+B;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,aAAuB,EACvB,WAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAA0B,EAC1B,OAA2B,EAC3B,SAAuB,OAAO;IAE9B,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,sBAAsB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC3D,MAAM,CAAC,KAAK,CACV,gDAAgD,MAAM,qCAAqC,CAC5F,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAE3C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,8BAA8B,CAAC;QAC9C,MAAM,CAAC,KAAK,CACV,eAAe,MAAM,oCAAoC,CAC1D,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,+BAA+B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,oCAAoC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAClI,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,oCAAoC,CAAC,CAAC;QACxE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CACV,iEAAiE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CACrG,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACzF,CAAC"}

package/dist/index.js

@@ -7,7 +7,9 @@ import { loadConfig } from './config.js';
 import { CognitoAuth } from './raytio/auth.js';
 import { RaytioApiClient } from './raytio/api-client.js';
 import { resolveDomains } from './tools/domains.js';
-import { resolveUserDomains } from './tools/role-mapping.js';
+import { resolveToolDomains } from './authorization.js';
+import { dispatchToolCall } from './tools/dispatch.js';
+import { PACKAGE_VERSION } from './version.js';
 // Load configuration
 const config = loadConfig();
 // Initialize authentication and API client
@@ -20,37 +22,22 @@ const auth = new CognitoAuth({
 });
 const apiClient = new RaytioApiClient(config.raytio.apiBaseUrl, auth);
 const ctx = { apiClient, auth, config };
-// Resolve tool domains: if RAYTIO_TOOL_DOMAINS is explicitly set, use it as a
-// static override. Otherwise, query the authenticated user's roles dynamically
-// and derive the domain list from their permissions.
-async function resolveToolDomains() {
-    const envDomains = process.env.RAYTIO_TOOL_DOMAINS;
-    if (envDomains && envDomains.trim()) {
-        console.error(`Raytio MCP: using static RAYTIO_TOOL_DOMAINS override: ${envDomains}`);
-        return envDomains;
-    }
-    try {
-        const dynamicDomains = await resolveUserDomains(apiClient);
-        if (dynamicDomains) {
-            console.error(`Raytio MCP: resolved domains from user roles: ${dynamicDomains}`);
-            return dynamicDomains;
-        }
-        console.error('Raytio MCP: user has no recognised roles, exposing all domains as fallback');
-        return undefined;
-    }
-    catch (err) {
-        console.error(`Raytio MCP: role query failed (${err.message}), falling back to all domains`);
-        return undefined;
-    }
-}
-const domainSpec = await resolveToolDomains();
-const allTools = resolveDomains(domainSpec);
+// Resolve tool domains. The static RAYTIO_TOOL_DOMAINS override may only
+// restrict the user's resolved roles — it never grants access to a domain
+// the user does not already hold. Any failure to resolve roles fails closed
+// (expose no tools) rather than falling back to the full surface.
+const authorization = await resolveToolDomains(apiClient, process.env.RAYTIO_TOOL_DOMAINS);
+const allTools = authorization.authorized
+    ? resolveDomains(authorization.domainSpec)
+    : [];
 console.error(`Raytio MCP: exposing ${allTools.length} tools` +
-    (domainSpec ? ` (domains: ${domainSpec})` : ' (all domains)'));
+    (authorization.domainSpec
+        ? ` (domains: ${authorization.domainSpec})`
+        : ' (no domains — fail closed)'));
 // Create MCP server
 const server = new Server({
     name: '@raytio/mcp-server',
-    version: '1.0.0',
+    version: PACKAGE_VERSION,
 }, {
     capabilities: {
         tools: {},
@@ -66,38 +53,15 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
         })),
     };
 });
-// Handle tool calls
+// Handle tool calls — dispatch centrally so every input is parsed through
+// its Zod schema before the tool handler is invoked.
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args = {} } = request.params;
-    const tool = allTools.find((t) => t.name === name);
-    if (!tool) {
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: JSON.stringify({ success: false, error: { code: 'TOOL_ERROR', message: `Unknown tool: ${name}` } }, null, 2),
-                },
-            ],
-            isError: true,
-        };
-    }
-    try {
-        const result = await tool.handler(args, ctx);
-        return {
-            content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
-        };
-    }
-    catch (error) {
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: JSON.stringify({ success: false, error: { code: 'TOOL_ERROR', message: error.message } }, null, 2),
-                },
-            ],
-            isError: true,
-        };
-    }
+    const response = await dispatchToolCall(allTools, name, args, ctx);
+    return {
+        content: [{ type: 'text', text: JSON.stringify(response, null, 2) }],
+        ...(response.success ? {} : { isError: true }),
+    };
 });
 // Start server
 async function main() {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,qBAAqB;AACrB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B,2CAA2C;AAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU;IAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ;IACxC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;IACpC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;IACnC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;CACpC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAEtE,MAAM,GAAG,GAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAErD,8EAA8E;AAC9E,+EAA+E;AAC/E,qDAAqD;AACrD,KAAK,UAAU,kBAAkB;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACnD,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,0DAA0D,UAAU,EAAE,CAAC,CAAC;QACtF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,KAAK,CAAC,iDAAiD,cAAc,EAAE,CAAC,CAAC;YACjF,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,kCAAkC,GAAG,CAAC,OAAO,gCAAgC,CAAC,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,MAAM,kBAAkB,EAAE,CAAC;AAC9C,MAAM,QAAQ,GAAW,cAAc,CAAC,UAAU,CAAC,CAAC;AACpD,OAAO,CAAC,KAAK,CACX,wBAAwB,QAAQ,CAAC,MAAM,QAAQ;IAC7C,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,UAAU,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAChE,CAAC;AAEF,oBAAoB;AACpB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;IACE,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,OAAO;CACjB,EACD;IACE,YAAY,EAAE;QACZ,KAAK,EAAE,EAAE;KACV;CACF,CACF,CAAC;AAEF,uBAAuB;AACvB,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;IAC1D,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,WAAkB,CAAC;SACtD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,oBAAoB;AACpB,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAEtD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,EACnF,IAAI,EACJ,CAAC,CACF;iBACF;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EACzE,IAAI,EACJ,CAAC,CACF;iBACF;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,eAAe;AACf,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAC7C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,qBAAqB;AACrB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B,2CAA2C;AAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU;IAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ;IACxC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;IACpC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;IACnC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;CACpC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAEtE,MAAM,GAAG,GAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAErD,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,kEAAkE;AAClE,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAC5C,SAAS,EACT,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAChC,CAAC;AAEF,MAAM,QAAQ,GAAW,aAAa,CAAC,UAAU;IAC/C,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC;IAC1C,CAAC,CAAC,EAAE,CAAC;AAEP,OAAO,CAAC,KAAK,CACX,wBAAwB,QAAQ,CAAC,MAAM,QAAQ;IAC7C,CAAC,aAAa,CAAC,UAAU;QACvB,CAAC,CAAC,cAAc,aAAa,CAAC,UAAU,GAAG;QAC3C,CAAC,CAAC,6BAA6B,CAAC,CACrC,CAAC;AAEF,oBAAoB;AACpB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;IACE,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,eAAe;CACzB,EACD;IACE,YAAY,EAAE;QACZ,KAAK,EAAE,EAAE;KACV;CACF,CACF,CAAC;AAEF,uBAAuB;AACvB,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;IAC1D,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,WAAkB,CAAC;SACtD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,0EAA0E;AAC1E,qDAAqD;AACrD,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACnE,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,eAAe;AACf,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAC7C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/tools/dispatch.d.ts

@@ -0,0 +1,18 @@
+import { Tool, ToolContext } from './registry.js';
+import { ToolResponse } from './types.js';
+export declare const INPUT_VALIDATION_ERROR = "INPUT_VALIDATION_ERROR";
+export declare const UNKNOWN_TOOL = "UNKNOWN_TOOL";
+export declare const TOOL_ERROR = "TOOL_ERROR";
+/**
+ * Central dispatch entry point for every MCP `tools/call` request.
+ *
+ * Guarantees:
+ *  - The advertised Zod schema is parsed before the tool handler runs,
+ *    so handlers only ever see structurally valid input.
+ *  - Unknown tool names return a stable `UNKNOWN_TOOL` error rather than
+ *    passing an arbitrary name deeper into the stack.
+ *  - Handler exceptions are converted to structured `TOOL_ERROR`
+ *    responses so the MCP transport always sees a well-formed reply.
+ */
+export declare function dispatchToolCall(tools: Tool[], name: string, args: unknown, ctx: ToolContext): Promise<ToolResponse<unknown>>;
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/tools/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../src/tools/dispatch.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAiB,YAAY,EAAE,MAAM,YAAY,CAAC;AAEzD,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAC/D,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,UAAU,eAAe,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,IAAI,EAAE,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,WAAW,GACf,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAqBhC"}

package/dist/tools/dispatch.js

@@ -0,0 +1,41 @@
+import { errorResponse } from './types.js';
+export const INPUT_VALIDATION_ERROR = 'INPUT_VALIDATION_ERROR';
+export const UNKNOWN_TOOL = 'UNKNOWN_TOOL';
+export const TOOL_ERROR = 'TOOL_ERROR';
+/**
+ * Central dispatch entry point for every MCP `tools/call` request.
+ *
+ * Guarantees:
+ *  - The advertised Zod schema is parsed before the tool handler runs,
+ *    so handlers only ever see structurally valid input.
+ *  - Unknown tool names return a stable `UNKNOWN_TOOL` error rather than
+ *    passing an arbitrary name deeper into the stack.
+ *  - Handler exceptions are converted to structured `TOOL_ERROR`
+ *    responses so the MCP transport always sees a well-formed reply.
+ */
+export async function dispatchToolCall(tools, name, args, ctx) {
+    const tool = tools.find((t) => t.name === name);
+    if (!tool) {
+        return errorResponse(UNKNOWN_TOOL, `Unknown tool: ${name}`);
+    }
+    const rawInput = args ?? {};
+    const parsed = tool.inputSchema.safeParse(rawInput);
+    if (!parsed.success) {
+        return errorResponse(INPUT_VALIDATION_ERROR, `Invalid arguments for tool "${name}": ${formatZodError(parsed.error)}`, { issues: parsed.error.issues });
+    }
+    try {
+        return await tool.handler(parsed.data, ctx);
+    }
+    catch (error) {
+        return errorResponse(TOOL_ERROR, error?.message ?? String(error));
+    }
+}
+function formatZodError(error) {
+    return error.issues
+        .map((issue) => {
+        const path = issue.path.length ? issue.path.join('.') : '(root)';
+        return `${path}: ${issue.message}`;
+    })
+        .join('; ');
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/tools/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../src/tools/dispatch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAgB,MAAM,YAAY,CAAC;AAEzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAC/D,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,IAAY,EACZ,IAAa,EACb,GAAgB;IAEhB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,aAAa,CAAC,YAAY,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,aAAa,CAClB,sBAAsB,EACtB,+BAA+B,IAAI,MAAM,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACvE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB;IACvC,OAAO,KAAK,CAAC,MAAM;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjE,OAAO,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACrC,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/tools/role-mapping.d.ts

@@ -1,19 +1,25 @@
 import { RaytioApiClient } from '../raytio/api-client.js';
 /**
- * Shape returned by `fnd_authz_user_groups()` PostgREST RPC.
- * Each row represents one resolved role (direct or inherited).
+ * Shape returned by `fnd_authz_user_groups()` PostgREST RPC. Each row
+ * represents one resolved role (direct or inherited via group membership).
+ *
+ * The Persist function returns a single column named `group_name` — the
+ * MCP server previously read `group_code`, which meant no user role ever
+ * mapped to a domain. This alignment is an interim compatibility fix
+ * pending the versioned Persist contract (see epic WI-0003496).
  */
 export interface UserGroup {
-    group_code: string;
+    group_name: string;
     [key: string]: unknown;
 }
 /**
- * Given a list of user group codes, resolve the set of tool domain IDs
+ * Given a list of user group names, resolve the set of tool domain IDs
  * the user should have access to.
  *
- * When both `ppm` and `ppm-readonly` are present, `ppm` wins (superset).
+ * When both a full-access and readonly domain are present (e.g. `ppm`
+ * and `ppm-readonly`), the full-access variant wins.
  */
-export declare function mapRolesToDomains(groupCodes: string[]): string[];
+export declare function mapRolesToDomains(groupNames: string[]): string[];
 /**
  * Fetch the authenticated user's resolved role groups from the backend.
  * Calls the `fnd_authz_user_groups()` PostgREST RPC endpoint.
@@ -24,8 +30,9 @@ export declare function fetchUserGroups(apiClient: RaytioApiClient): Promise<Use
  * backend roles. Returns a comma-separated domain spec string compatible
  * with `resolveDomains()`.
  *
- * Returns `undefined` when the user has no recognised roles (the caller
- * should decide how to handle this — e.g. expose no tools or fall back).
+ * Returns `undefined` when the user has no recognised roles — the caller
+ * (see `src/index.ts`) MUST fail closed in that case rather than fall
+ * back to the full tool surface.
  */
 export declare function resolveUserDomains(apiClient: RaytioApiClient): Promise<string | undefined>;
 //# sourceMappingURL=role-mapping.d.ts.map

package/dist/tools/role-mapping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-mapping.d.ts","sourceRoot":"","sources":["../../src/tools/role-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AA2BD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAqBhE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,eAAe,GACzB,OAAO,CAAC,SAAS,EAAE,CAAC,CAEtB;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,eAAe,GACzB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAK7B"}
+{"version":3,"file":"role-mapping.d.ts","sourceRoot":"","sources":["../../src/tools/role-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAsBD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAqBhE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,eAAe,GACzB,OAAO,CAAC,SAAS,EAAE,CAAC,CAEtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,eAAe,GACzB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAO7B"}

package/dist/tools/role-mapping.js

@@ -1,37 +1,33 @@
 /**
- * Map role group codes to the tool domain IDs they unlock.
- *
- * Role codes that grant full PPM access (SELECT + INSERT + UPDATE):
- *   - PROJECT_USER, PROJECT_ADMINISTRATOR
- *
- * Role codes that grant read-only PPM access (SELECT only):
- *   - PROJECT_VIEWER
- *
- * Role codes that grant full DSM access:
- *   - DATA_SHARING_USER, DATA_SHARING_ADMINISTRATOR
+ * Map role group names (as returned by `fnd_authz_user_groups()`) to the
+ * tool domain IDs they unlock. Keys are the exact Persist seed values
+ * from `02435-seed-hrm-role-group-inheritance.sql`.
  */
 const ROLE_TO_DOMAINS = {
-    PROJECT_USER: ['ppm', 'prm'],
-    PROJECT_ADMINISTRATOR: ['ppm', 'prm', 'wrm'],
-    PROJECT_VIEWER: ['ppm-readonly', 'wrm-readonly'],
-    DATA_SHARING_USER: ['dsm'],
-    DATA_SHARING_ADMINISTRATOR: ['dsm'],
-    WORKER_ADMINISTRATOR: ['wrm', 'prm'],
-    WORKER_VIEWER: ['wrm-readonly'],
-    SALES_USER: ['sfa', 'prm'],
-    SALES_ADMINISTRATOR: ['sfa', 'prm'],
-    SALES_VIEWER: ['sfa-readonly'],
+    'Project administrator': ['ppm', 'prm', 'wrm'],
+    'Project user': ['ppm', 'prm'],
+    'Project viewer': ['ppm-readonly', 'wrm-readonly'],
+    'Data sharing administrator': ['dsm'],
+    'Data sharing user': ['dsm'],
+    'Data sharing viewer': ['dsm'],
+    'Worker administrator': ['wrm', 'prm'],
+    'Worker user': ['wrm', 'prm'],
+    'Worker viewer': ['wrm-readonly'],
+    'Sales administrator': ['sfa', 'prm'],
+    'Sales user': ['sfa', 'prm'],
+    'Sales viewer': ['sfa-readonly'],
 };
 /**
- * Given a list of user group codes, resolve the set of tool domain IDs
+ * Given a list of user group names, resolve the set of tool domain IDs
  * the user should have access to.
  *
- * When both `ppm` and `ppm-readonly` are present, `ppm` wins (superset).
+ * When both a full-access and readonly domain are present (e.g. `ppm`
+ * and `ppm-readonly`), the full-access variant wins.
  */
-export function mapRolesToDomains(groupCodes) {
+export function mapRolesToDomains(groupNames) {
     const domains = new Set();
-    for (const code of groupCodes) {
-        const mapped = ROLE_TO_DOMAINS[code];
+    for (const name of groupNames) {
+        const mapped = ROLE_TO_DOMAINS[name];
         if (mapped) {
             for (const d of mapped)
                 domains.add(d);
@@ -61,13 +57,16 @@ export async function fetchUserGroups(apiClient) {
  * backend roles. Returns a comma-separated domain spec string compatible
  * with `resolveDomains()`.
  *
- * Returns `undefined` when the user has no recognised roles (the caller
- * should decide how to handle this — e.g. expose no tools or fall back).
+ * Returns `undefined` when the user has no recognised roles — the caller
+ * (see `src/index.ts`) MUST fail closed in that case rather than fall
+ * back to the full tool surface.
  */
 export async function resolveUserDomains(apiClient) {
     const groups = await fetchUserGroups(apiClient);
-    const codes = groups.map((g) => g.group_code);
-    const domains = mapRolesToDomains(codes);
+    const names = groups
+        .map((g) => g.group_name)
+        .filter((n) => typeof n === 'string' && n.length > 0);
+    const domains = mapRolesToDomains(names);
     return domains.length > 0 ? domains.join(',') : undefined;
 }
 //# sourceMappingURL=role-mapping.js.map

package/dist/tools/role-mapping.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-mapping.js","sourceRoot":"","sources":["../../src/tools/role-mapping.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;GAWG;AACH,MAAM,eAAe,GAA6B;IAChD,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IAC5B,qBAAqB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;IAC5C,cAAc,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC;IAChD,iBAAiB,EAAE,CAAC,KAAK,CAAC;IAC1B,0BAA0B,EAAE,CAAC,KAAK,CAAC;IACnC,oBAAoB,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IACpC,aAAa,EAAE,CAAC,cAAc,CAAC;IAC/B,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IAC1B,mBAAmB,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IACnC,YAAY,EAAE,CAAC,cAAc,CAAC;CAC/B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAoB;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAA0B;IAE1B,OAAO,SAAS,CAAC,IAAI,CAAc,kCAAkC,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAA0B;IAE1B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"role-mapping.js","sourceRoot":"","sources":["../../src/tools/role-mapping.ts"],"names":[],"mappings":"AAgBA;;;;GAIG;AACH,MAAM,eAAe,GAA6B;IAChD,uBAAuB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;IAC9C,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IAC9B,gBAAgB,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC;IAClD,4BAA4B,EAAE,CAAC,KAAK,CAAC;IACrC,mBAAmB,EAAE,CAAC,KAAK,CAAC;IAC5B,qBAAqB,EAAE,CAAC,KAAK,CAAC;IAC9B,sBAAsB,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IACtC,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IAC7B,eAAe,EAAE,CAAC,cAAc,CAAC;IACjC,qBAAqB,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IACrC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IAC5B,cAAc,EAAE,CAAC,cAAc,CAAC;CACjC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAoB;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAA0B;IAE1B,OAAO,SAAS,CAAC,IAAI,CAAc,kCAAkC,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAA0B;IAE1B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,2 @@
+export declare const PACKAGE_VERSION: string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AA6BA,eAAO,MAAM,eAAe,EAAE,MAA6B,CAAC"}

package/dist/version.js

@@ -0,0 +1,25 @@
+import { readFileSync } from 'fs';
+import { dirname, resolve } from 'path';
+import { fileURLToPath } from 'url';
+/**
+ * Resolve the running package version from `package.json` at load time.
+ *
+ * The MCP server previously reported a hard-coded `1.0.0`, which desynced
+ * from the value clients had installed and made version-based bug reports
+ * impossible to triage. Reading `package.json` keeps the reported version
+ * in step with the shipped artifact.
+ *
+ * `package.json` lives one directory above both `src/` (dev via tsx) and
+ * `dist/` (built), so the relative path is identical in both layouts.
+ */
+function readPackageVersion() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const packageJsonPath = resolve(here, '..', 'package.json');
+    const parsed = JSON.parse(readFileSync(packageJsonPath, 'utf8'));
+    if (typeof parsed.version !== 'string' || parsed.version.length === 0) {
+        throw new Error(`Unable to read package version from ${packageJsonPath}: missing "version"`);
+    }
+    return parsed.version;
+}
+export const PACKAGE_VERSION = readPackageVersion();
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAE9D,CAAC;IACF,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,uCAAuC,eAAe,qBAAqB,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAW,kBAAkB,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raytio/mcp-server",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "MCP server for secure AI agent access to Raytio user data",
   "type": "module",
   "main": "dist/index.js",