@raytio/mcp-server 2.0.0 → 2.2.0

package/dist/contracts/persist-resource-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persist-resource-contract.d.ts","sourceRoot":"","sources":["../../src/contracts/persist-resource-contract.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,yDAAyD;AACzD,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAwB1C,QAAA,MAAM,gBAAgB;;;;;;;;;;;;EAIpB,CAAC;AAEH,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;gCAUD,CAAC;AAEjB,QAAA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA8BJ,CAAC;AAEjB,QAAA,MAAM,eAAe;;;;;;;;;;;;;;;gCAOL,CAAC;AAkBjB,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAc1B,CAAC;AAEjB,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAC7D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAC/D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACzE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE/D,qBAAa,oBAAqB,SAAQ,KAAK;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBAAzC,OAAO,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,OAAO,YAAA;CAItD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CA6BpD;AASD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,MAAM,CAM5E;AAED,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,WAAgB,GACxB,uBAAuB,CA2EzB;AAED,uEAAuE;AACvE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,WAAW,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC;IAC5C,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,UAAU,EAAE,yBAAyB,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,uBAAuB,GAChC,uBAAuB,EAAE,CAe3B;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,uBAAuB,GAChC,MAAM,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAM3C"}

package/dist/contracts/persist-resource-contract.js

@@ -0,0 +1,261 @@
+import { createHash } from 'crypto';
+import { readFileSync } from 'fs';
+import { dirname, resolve } from 'path';
+import { fileURLToPath } from 'url';
+import { z } from 'zod';
+/**
+ * Loader and validator for the Persist "MCP resource contract" artifact
+ * produced by `persist/export_mcp_contract.py` in raytio/common/persist.
+ *
+ * The contract pins the set of PostgREST resources — with fields, operations,
+ * permission tuples, filter/order capabilities, sensitivity, side effects, and
+ * relationships — that MCP downstream tooling may safely surface as tools.
+ *
+ * MCP consumes the artifact through this module so that:
+ *
+ * - the file's shape is validated against a Zod schema (fail closed on any
+ *   structural drift);
+ * - the artifact's declared `content_hash` is recomputed from a deterministic
+ *   canonicalisation and compared (fail closed on any tampering, truncation,
+ *   or upstream serialiser divergence);
+ * - the artifact's `contract_version` major is checked against the range this
+ *   MCP build understands (fail closed on incompatible upgrades).
+ *
+ * The runtime never reaches across to the Persist repository — the artifact is
+ * vendored under `contracts/persist/mcp_resource_contract.json` at build time
+ * and scheduled CI syncs it (see `docs/persist-contract-sync.md`).
+ */
+/** Contract major version this MCP build understands. */
+export const SUPPORTED_CONTRACT_MAJOR = 2;
+const contractPath = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', 'contracts', 'persist', 'mcp_resource_contract.json');
+// A JSON scalar/array/object graph. Loose enough to survive contract growth,
+// strict enough that the loader catches malformed values before hashing.
+const jsonValueSchema = z.lazy(() => z.union([
+    z.null(),
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.array(jsonValueSchema),
+    z.record(jsonValueSchema),
+]));
+const permissionSchema = z.object({
+    resource_group: z.string().min(1),
+    resource_name: z.string().min(1),
+    operations: z.array(z.string()),
+});
+const fieldSchema = z
+    .object({
+    name: z.string().min(1),
+    type: z.union([z.string(), z.array(z.string())]),
+    required: z.boolean(),
+    read_only: z.boolean().optional(),
+    description: z.string().nullable().optional(),
+    format: z.string().optional(),
+    maxLength: z.number().int().nonnegative().optional(),
+})
+    .passthrough();
+const resourceSchema = z
+    .object({
+    resource_id: z.string().min(1),
+    module: z.string().min(1),
+    table: z.string().min(1),
+    schema_name: z.string().nullable(),
+    schema_version: z.string().nullable(),
+    public_endpoint: z.string().min(1),
+    primary_key: z.union([z.string(), z.array(z.string()), z.null()]),
+    title: z.string().nullable(),
+    title_plural: z.string().nullable(),
+    description: z.string().nullable(),
+    fields: z.array(fieldSchema).min(1),
+    operations: z.array(z.string()).min(1),
+    permission: permissionSchema,
+    filter_capabilities: z
+        .object({
+        filterable_fields: z.array(z.string()),
+        supported_operators: z.array(z.string()),
+    })
+        .passthrough(),
+    order_capabilities: z
+        .object({
+        orderable_fields: z.array(z.string()),
+    })
+        .passthrough(),
+    sensitivity: z.enum(['normal', 'sensitive', 'restricted']),
+    side_effects: z.array(z.string()),
+    relationships: z.array(jsonValueSchema),
+})
+    .passthrough();
+const exclusionSchema = z
+    .object({
+    reason: z.string().min(1),
+    detail: z.string().min(1),
+    table: z.string().min(1),
+    schema_name: z.string().nullable().optional(),
+})
+    .passthrough();
+const exclusionRuleSchema = z
+    .object({
+    reason: z.string().min(1),
+    description: z.string().min(1),
+    match_substrings: z.array(z.string()),
+})
+    .passthrough();
+const provenanceSchema = z
+    .object({
+    source_commit: z.string().min(7),
+    introspection_timestamp: z.string().min(1),
+    latest_repo_migration: z.string().nullable(),
+})
+    .passthrough();
+export const persistResourceContractSchema = z
+    .object({
+    contract_version: z.string().regex(/^\d+\.\d+\.\d+$/),
+    content_hash: z.string().regex(/^[0-9a-f]{64}$/),
+    source_commit: z.string().min(7),
+    source_version: z.string().min(1),
+    resource_count: z.number().int().nonnegative(),
+    excluded_count: z.number().int().nonnegative(),
+    resources: z.array(resourceSchema),
+    excluded: z.array(exclusionSchema),
+    exclusion_rules: z.array(exclusionRuleSchema).min(1),
+    modules: z.array(z.string().min(1)),
+    provenance: provenanceSchema.optional(),
+})
+    .passthrough();
+export class PersistContractError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = 'PersistContractError';
+    }
+}
+/**
+ * Canonicalise a JSON value in the exact byte-form the Persist exporter uses
+ * for `content_hash` — deep-sorted object keys, ", " / ": " separators, and
+ * UTF-8 characters kept literal (ensure_ascii=False in Python).
+ */
+export function canonicalJson(value) {
+    if (value === null)
+        return 'null';
+    if (typeof value === 'boolean')
+        return value ? 'true' : 'false';
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value)) {
+            throw new PersistContractError(`Non-finite number in contract body: ${String(value)}`);
+        }
+        return JSON.stringify(value);
+    }
+    if (typeof value === 'string')
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return '[' + value.map(canonicalJson).join(', ') + ']';
+    }
+    if (typeof value === 'object') {
+        const record = value;
+        const keys = Object.keys(record).sort();
+        return ('{' +
+            keys
+                .map((k) => `${JSON.stringify(k)}: ${canonicalJson(record[k])}`)
+                .join(', ') +
+            '}');
+    }
+    throw new PersistContractError(`Unsupported value in contract body: ${typeof value}`);
+}
+const UNSTABLE_TOP_LEVEL_KEYS = new Set([
+    'content_hash',
+    'source_commit',
+    'source_version',
+    'provenance',
+]);
+export function computeContentHash(contract) {
+    const body = {};
+    for (const [key, value] of Object.entries(contract)) {
+        if (!UNSTABLE_TOP_LEVEL_KEYS.has(key))
+            body[key] = value;
+    }
+    return createHash('sha256').update(canonicalJson(body), 'utf8').digest('hex');
+}
+/**
+ * Read, structurally validate, hash-check, and version-check the pinned
+ * Persist contract. Throws {@link PersistContractError} on any failure — the
+ * caller is expected to fail closed (do not expose tools built on a bad
+ * artifact).
+ */
+export function loadPersistResourceContract(options = {}) {
+    const path = options.path ?? contractPath;
+    const supportedMajor = options.supportedMajor ?? SUPPORTED_CONTRACT_MAJOR;
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch (error) {
+        throw new PersistContractError(`Cannot read Persist contract at ${path}`, error);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new PersistContractError(`Persist contract at ${path} is not valid JSON`, error);
+    }
+    const result = persistResourceContractSchema.safeParse(parsed);
+    if (!result.success) {
+        throw new PersistContractError(`Persist contract at ${path} failed schema validation: ${result.error.message}`);
+    }
+    const contract = result.data;
+    const [majorText] = contract.contract_version.split('.');
+    const major = Number(majorText);
+    if (major !== supportedMajor) {
+        throw new PersistContractError(`Persist contract_version ${contract.contract_version} is not supported ` +
+            `by this MCP build (expects major ${supportedMajor}). Refresh Persist ` +
+            'or upgrade MCP.');
+    }
+    if (contract.resources.length !== contract.resource_count) {
+        throw new PersistContractError(`resource_count (${contract.resource_count}) disagrees with ` +
+            `resources.length (${contract.resources.length}).`);
+    }
+    if (contract.excluded.length !== contract.excluded_count) {
+        throw new PersistContractError(`excluded_count (${contract.excluded_count}) disagrees with ` +
+            `excluded.length (${contract.excluded.length}).`);
+    }
+    const seen = new Set();
+    for (const resource of contract.resources) {
+        if (seen.has(resource.resource_id)) {
+            throw new PersistContractError(`Duplicate resource_id in Persist contract: ${resource.resource_id}`);
+        }
+        seen.add(resource.resource_id);
+    }
+    const expectedHash = computeContentHash(contract);
+    if (expectedHash !== contract.content_hash) {
+        throw new PersistContractError(`Persist contract content_hash mismatch: file claims ${contract.content_hash} ` +
+            `but body hashes to ${expectedHash}. The artifact has been edited by hand or ` +
+            'the exporter is out of sync.');
+    }
+    return contract;
+}
+export function summariseResources(contract) {
+    return [...contract.resources]
+        .sort((a, b) => a.resource_id.localeCompare(b.resource_id))
+        .map((resource) => ({
+        resourceId: resource.resource_id,
+        module: resource.module,
+        table: resource.table,
+        publicEndpoint: resource.public_endpoint,
+        operations: resource.operations,
+        sensitivity: resource.sensitivity,
+        sideEffects: resource.side_effects,
+        permission: resource.permission,
+        fieldCount: resource.fields.length,
+        filterableFieldCount: resource.filter_capabilities.filterable_fields.length,
+    }));
+}
+/** Group the resource metadata by module for cataloguing tools. */
+export function summariseModules(contract) {
+    const grouped = {};
+    for (const resource of summariseResources(contract)) {
+        (grouped[resource.module] ??= []).push(resource);
+    }
+    return grouped;
+}
+//# sourceMappingURL=persist-resource-contract.js.map

package/dist/contracts/persist-resource-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persist-resource-contract.js","sourceRoot":"","sources":["../../src/contracts/persist-resource-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C,MAAM,YAAY,GAAG,OAAO,CAC1B,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,IAAI,EACJ,IAAI,EACJ,WAAW,EACX,SAAS,EACT,4BAA4B,CAC7B,CAAC;AAEF,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,eAAe,GAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACtD,CAAC,CAAC,KAAK,CAAC;IACN,CAAC,CAAC,IAAI,EAAE;IACR,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,OAAO,EAAE;IACX,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACxB,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;CAC1B,CAAC,CACH,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,UAAU,EAAE,gBAAgB;IAC5B,mBAAmB,EAAE,CAAC;SACnB,MAAM,CAAC;QACN,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACtC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACzC,CAAC;SACD,WAAW,EAAE;IAChB,kBAAkB,EAAE,CAAC;SAClB,MAAM,CAAC;QACN,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACtC,CAAC;SACD,WAAW,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAC1D,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;CACxC,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACtC,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAChD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnC,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,WAAW,EAAE,CAAC;AAQjB,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACP;IAAtC,YAAY,OAAe,EAAW,KAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,UAAK,GAAL,KAAK,CAAU;QAEnD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,oBAAoB,CAC5B,uCAAuC,MAAM,CAAC,KAAK,CAAC,EAAE,CACvD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,CACL,GAAG;YACH,IAAI;iBACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/D,IAAI,CAAC,IAAI,CAAC;YACb,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,oBAAoB,CAC5B,uCAAuC,OAAO,KAAK,EAAE,CACtD,CAAC;AACJ,CAAC;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,cAAc;IACd,eAAe;IACf,gBAAgB;IAChB,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB,CAAC,QAAiC;IAClE,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC3D,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAuB,EAAE;IAEzB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC;IAC1C,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAE1E,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAC5B,mCAAmC,IAAI,EAAE,EACzC,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAC5B,uBAAuB,IAAI,oBAAoB,EAC/C,KAAK,CACN,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,oBAAoB,CAC5B,uBAAuB,IAAI,8BAA8B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;IAE7B,MAAM,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;QAC7B,MAAM,IAAI,oBAAoB,CAC5B,4BAA4B,QAAQ,CAAC,gBAAgB,oBAAoB;YACvE,oCAAoC,cAAc,qBAAqB;YACvE,iBAAiB,CACpB,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC1D,MAAM,IAAI,oBAAoB,CAC5B,mBAAmB,QAAQ,CAAC,cAAc,mBAAmB;YAC3D,qBAAqB,QAAQ,CAAC,SAAS,CAAC,MAAM,IAAI,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,cAAc,EAAE,CAAC;QACzD,MAAM,IAAI,oBAAoB,CAC5B,mBAAmB,QAAQ,CAAC,cAAc,mBAAmB;YAC3D,oBAAoB,QAAQ,CAAC,QAAQ,CAAC,MAAM,IAAI,CACnD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,oBAAoB,CAC5B,8CAA8C,QAAQ,CAAC,WAAW,EAAE,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,IAAI,oBAAoB,CAC5B,uDAAuD,QAAQ,CAAC,YAAY,GAAG;YAC7E,sBAAsB,YAAY,4CAA4C;YAC9E,8BAA8B,CACjC,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAgBD,MAAM,UAAU,kBAAkB,CAChC,QAAiC;IAEjC,OAAO,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC;SAC3B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClB,UAAU,EAAE,QAAQ,CAAC,WAAW;QAChC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,cAAc,EAAE,QAAQ,CAAC,eAAe;QACxC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,WAAW,EAAE,QAAQ,CAAC,YAAY;QAClC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;QAClC,oBAAoB,EAAE,QAAQ,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,MAAM;KAC5E,CAAC,CAAC,CAAC;AACR,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAC9B,QAAiC;IAEjC,MAAM,OAAO,GAA8C,EAAE,CAAC;IAC9D,KAAK,MAAM,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/index.js

@@ -4,12 +4,34 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
 import { zodToJsonSchema } from 'zod-to-json-schema';
 import { loadConfig } from './config.js';
+import { PersistContractError, loadPersistResourceContract, } from './contracts/persist-resource-contract.js';
 import { CognitoAuth } from './raytio/auth.js';
 import { RaytioApiClient } from './raytio/api-client.js';
 import { resolveDomains } from './tools/domains.js';
-import { resolveUserDomains } from './tools/role-mapping.js';
+import { resolveToolDomains } from './authorization.js';
+import { dispatchToolCall } from './tools/dispatch.js';
+import { PACKAGE_VERSION } from './version.js';
 // Load configuration
 const config = loadConfig();
+// Validate the pinned Persist resource contract before touching Cognito or
+// PostgREST. Any structural, hash, or version mismatch is fatal — MCP must
+// never advertise tools built on a malformed or incompatible artifact.
+let persistContract;
+try {
+    persistContract = loadPersistResourceContract();
+}
+catch (error) {
+    const detail = error instanceof PersistContractError
+        ? error.message
+        : error.message;
+    console.error(`Persist resource contract failed validation: ${detail}`);
+    console.error('Refusing to start — run `npm run contract:check-resource` to reproduce, or ' +
+        '`npm run contract:sync-resource` to refresh from Persist.');
+    process.exit(1);
+}
+console.error(`Raytio MCP: pinned Persist contract ${persistContract.contract_version} ` +
+    `at ${persistContract.source_commit.slice(0, 8)} ` +
+    `(${persistContract.resource_count} resources, ${persistContract.excluded_count} excluded)`);
 // Initialize authentication and API client
 const auth = new CognitoAuth({
     userPoolId: config.raytio.cognito.userPoolId,
@@ -20,37 +42,22 @@ const auth = new CognitoAuth({
 });
 const apiClient = new RaytioApiClient(config.raytio.apiBaseUrl, auth);
 const ctx = { apiClient, auth, config };
-// Resolve tool domains: if RAYTIO_TOOL_DOMAINS is explicitly set, use it as a
-// static override. Otherwise, query the authenticated user's roles dynamically
-// and derive the domain list from their permissions.
-async function resolveToolDomains() {
-    const envDomains = process.env.RAYTIO_TOOL_DOMAINS;
-    if (envDomains && envDomains.trim()) {
-        console.error(`Raytio MCP: using static RAYTIO_TOOL_DOMAINS override: ${envDomains}`);
-        return envDomains;
-    }
-    try {
-        const dynamicDomains = await resolveUserDomains(apiClient);
-        if (dynamicDomains) {
-            console.error(`Raytio MCP: resolved domains from user roles: ${dynamicDomains}`);
-            return dynamicDomains;
-        }
-        console.error('Raytio MCP: user has no recognised roles, exposing all domains as fallback');
-        return undefined;
-    }
-    catch (err) {
-        console.error(`Raytio MCP: role query failed (${err.message}), falling back to all domains`);
-        return undefined;
-    }
-}
-const domainSpec = await resolveToolDomains();
-const allTools = resolveDomains(domainSpec);
+// Resolve tool domains. The static RAYTIO_TOOL_DOMAINS override may only
+// restrict the user's resolved roles — it never grants access to a domain
+// the user does not already hold. Any failure to resolve roles fails closed
+// (expose no tools) rather than falling back to the full surface.
+const authorization = await resolveToolDomains(apiClient, process.env.RAYTIO_TOOL_DOMAINS);
+const allTools = authorization.authorized
+    ? resolveDomains(authorization.domainSpec)
+    : [];
 console.error(`Raytio MCP: exposing ${allTools.length} tools` +
-    (domainSpec ? ` (domains: ${domainSpec})` : ' (all domains)'));
+    (authorization.domainSpec
+        ? ` (domains: ${authorization.domainSpec})`
+        : ' (no domains — fail closed)'));
 // Create MCP server
 const server = new Server({
     name: '@raytio/mcp-server',
-    version: '1.0.0',
+    version: PACKAGE_VERSION,
 }, {
     capabilities: {
         tools: {},
@@ -66,38 +73,15 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
         })),
     };
 });
-// Handle tool calls
+// Handle tool calls — dispatch centrally so every input is parsed through
+// its Zod schema before the tool handler is invoked.
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args = {} } = request.params;
-    const tool = allTools.find((t) => t.name === name);
-    if (!tool) {
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: JSON.stringify({ success: false, error: { code: 'TOOL_ERROR', message: `Unknown tool: ${name}` } }, null, 2),
-                },
-            ],
-            isError: true,
-        };
-    }
-    try {
-        const result = await tool.handler(args, ctx);
-        return {
-            content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
-        };
-    }
-    catch (error) {
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: JSON.stringify({ success: false, error: { code: 'TOOL_ERROR', message: error.message } }, null, 2),
-                },
-            ],
-            isError: true,
-        };
-    }
+    const response = await dispatchToolCall(allTools, name, args, ctx);
+    return {
+        content: [{ type: 'text', text: JSON.stringify(response, null, 2) }],
+        ...(response.success ? {} : { isError: true }),
+    };
 });
 // Start server
 async function main() {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,qBAAqB;AACrB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B,2CAA2C;AAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU;IAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ;IACxC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;IACpC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;IACnC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;CACpC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAEtE,MAAM,GAAG,GAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAErD,8EAA8E;AAC9E,+EAA+E;AAC/E,qDAAqD;AACrD,KAAK,UAAU,kBAAkB;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACnD,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,0DAA0D,UAAU,EAAE,CAAC,CAAC;QACtF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,KAAK,CAAC,iDAAiD,cAAc,EAAE,CAAC,CAAC;YACjF,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,kCAAkC,GAAG,CAAC,OAAO,gCAAgC,CAAC,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,MAAM,kBAAkB,EAAE,CAAC;AAC9C,MAAM,QAAQ,GAAW,cAAc,CAAC,UAAU,CAAC,CAAC;AACpD,OAAO,CAAC,KAAK,CACX,wBAAwB,QAAQ,CAAC,MAAM,QAAQ;IAC7C,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,UAAU,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAChE,CAAC;AAEF,oBAAoB;AACpB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;IACE,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,OAAO;CACjB,EACD;IACE,YAAY,EAAE;QACZ,KAAK,EAAE,EAAE;KACV;CACF,CACF,CAAC;AAEF,uBAAuB;AACvB,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;IAC1D,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,WAAkB,CAAC;SACtD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,oBAAoB;AACpB,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAEtD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,EACnF,IAAI,EACJ,CAAC,CACF;iBACF;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EACzE,IAAI,EACJ,CAAC,CACF;iBACF;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,eAAe;AACf,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAC7C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,qBAAqB;AACrB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,IAAI,eAAe,CAAC;AACpB,IAAI,CAAC;IACH,eAAe,GAAG,2BAA2B,EAAE,CAAC;AAClD,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,MAAM,MAAM,GAAG,KAAK,YAAY,oBAAoB;QAClD,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAE,KAAe,CAAC,OAAO,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,gDAAgD,MAAM,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,CACX,6EAA6E;QAC3E,2DAA2D,CAC9D,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,OAAO,CAAC,KAAK,CACX,uCAAuC,eAAe,CAAC,gBAAgB,GAAG;IACxE,MAAM,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;IAClD,IAAI,eAAe,CAAC,cAAc,eAAe,eAAe,CAAC,cAAc,YAAY,CAC9F,CAAC;AAEF,2CAA2C;AAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU;IAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ;IACxC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;IACpC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;IACnC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;CACpC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAEtE,MAAM,GAAG,GAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAErD,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,kEAAkE;AAClE,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAC5C,SAAS,EACT,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAChC,CAAC;AAEF,MAAM,QAAQ,GAAW,aAAa,CAAC,UAAU;IAC/C,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC;IAC1C,CAAC,CAAC,EAAE,CAAC;AAEP,OAAO,CAAC,KAAK,CACX,wBAAwB,QAAQ,CAAC,MAAM,QAAQ;IAC7C,CAAC,aAAa,CAAC,UAAU;QACvB,CAAC,CAAC,cAAc,aAAa,CAAC,UAAU,GAAG;QAC3C,CAAC,CAAC,6BAA6B,CAAC,CACrC,CAAC;AAEF,oBAAoB;AACpB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;IACE,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,eAAe;CACzB,EACD;IACE,YAAY,EAAE;QACZ,KAAK,EAAE,EAAE;KACV;CACF,CACF,CAAC;AAEF,uBAAuB;AACvB,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;IAC1D,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,WAAkB,CAAC;SACtD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,0EAA0E;AAC1E,qDAAqD;AACrD,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACnE,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,eAAe;AACf,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAC7C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/tools/dispatch.d.ts

@@ -0,0 +1,18 @@
+import { Tool, ToolContext } from './registry.js';
+import { ToolResponse } from './types.js';
+export declare const INPUT_VALIDATION_ERROR = "INPUT_VALIDATION_ERROR";
+export declare const UNKNOWN_TOOL = "UNKNOWN_TOOL";
+export declare const TOOL_ERROR = "TOOL_ERROR";
+/**
+ * Central dispatch entry point for every MCP `tools/call` request.
+ *
+ * Guarantees:
+ *  - The advertised Zod schema is parsed before the tool handler runs,
+ *    so handlers only ever see structurally valid input.
+ *  - Unknown tool names return a stable `UNKNOWN_TOOL` error rather than
+ *    passing an arbitrary name deeper into the stack.
+ *  - Handler exceptions are converted to structured `TOOL_ERROR`
+ *    responses so the MCP transport always sees a well-formed reply.
+ */
+export declare function dispatchToolCall(tools: Tool[], name: string, args: unknown, ctx: ToolContext): Promise<ToolResponse<unknown>>;
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/tools/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../src/tools/dispatch.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAiB,YAAY,EAAE,MAAM,YAAY,CAAC;AAEzD,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAC/D,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,UAAU,eAAe,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,IAAI,EAAE,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,WAAW,GACf,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAqBhC"}

package/dist/tools/dispatch.js

@@ -0,0 +1,41 @@
+import { errorResponse } from './types.js';
+export const INPUT_VALIDATION_ERROR = 'INPUT_VALIDATION_ERROR';
+export const UNKNOWN_TOOL = 'UNKNOWN_TOOL';
+export const TOOL_ERROR = 'TOOL_ERROR';
+/**
+ * Central dispatch entry point for every MCP `tools/call` request.
+ *
+ * Guarantees:
+ *  - The advertised Zod schema is parsed before the tool handler runs,
+ *    so handlers only ever see structurally valid input.
+ *  - Unknown tool names return a stable `UNKNOWN_TOOL` error rather than
+ *    passing an arbitrary name deeper into the stack.
+ *  - Handler exceptions are converted to structured `TOOL_ERROR`
+ *    responses so the MCP transport always sees a well-formed reply.
+ */
+export async function dispatchToolCall(tools, name, args, ctx) {
+    const tool = tools.find((t) => t.name === name);
+    if (!tool) {
+        return errorResponse(UNKNOWN_TOOL, `Unknown tool: ${name}`);
+    }
+    const rawInput = args ?? {};
+    const parsed = tool.inputSchema.safeParse(rawInput);
+    if (!parsed.success) {
+        return errorResponse(INPUT_VALIDATION_ERROR, `Invalid arguments for tool "${name}": ${formatZodError(parsed.error)}`, { issues: parsed.error.issues });
+    }
+    try {
+        return await tool.handler(parsed.data, ctx);
+    }
+    catch (error) {
+        return errorResponse(TOOL_ERROR, error?.message ?? String(error));
+    }
+}
+function formatZodError(error) {
+    return error.issues
+        .map((issue) => {
+        const path = issue.path.length ? issue.path.join('.') : '(root)';
+        return `${path}: ${issue.message}`;
+    })
+        .join('; ');
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/tools/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../src/tools/dispatch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAgB,MAAM,YAAY,CAAC;AAEzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAC/D,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,IAAY,EACZ,IAAa,EACb,GAAgB;IAEhB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,aAAa,CAAC,YAAY,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,aAAa,CAClB,sBAAsB,EACtB,+BAA+B,IAAI,MAAM,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACvE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB;IACvC,OAAO,KAAK,CAAC,MAAM;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjE,OAAO,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACrC,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/tools/role-mapping.d.ts

@@ -1,19 +1,25 @@
 import { RaytioApiClient } from '../raytio/api-client.js';
 /**
- * Shape returned by `fnd_authz_user_groups()` PostgREST RPC.
- * Each row represents one resolved role (direct or inherited).
+ * Shape returned by `fnd_authz_user_groups()` PostgREST RPC. Each row
+ * represents one resolved role (direct or inherited via group membership).
+ *
+ * The Persist function returns a single column named `group_name` — the
+ * MCP server previously read `group_code`, which meant no user role ever
+ * mapped to a domain. This alignment is an interim compatibility fix
+ * pending the versioned Persist contract (see epic WI-0003496).
  */
 export interface UserGroup {
-    group_code: string;
+    group_name: string;
     [key: string]: unknown;
 }
 /**
- * Given a list of user group codes, resolve the set of tool domain IDs
+ * Given a list of user group names, resolve the set of tool domain IDs
  * the user should have access to.
  *
- * When both `ppm` and `ppm-readonly` are present, `ppm` wins (superset).
+ * When both a full-access and readonly domain are present (e.g. `ppm`
+ * and `ppm-readonly`), the full-access variant wins.
  */
-export declare function mapRolesToDomains(groupCodes: string[]): string[];
+export declare function mapRolesToDomains(groupNames: string[]): string[];
 /**
  * Fetch the authenticated user's resolved role groups from the backend.
  * Calls the `fnd_authz_user_groups()` PostgREST RPC endpoint.
@@ -24,8 +30,9 @@ export declare function fetchUserGroups(apiClient: RaytioApiClient): Promise<Use
  * backend roles. Returns a comma-separated domain spec string compatible
  * with `resolveDomains()`.
  *
- * Returns `undefined` when the user has no recognised roles (the caller
- * should decide how to handle this — e.g. expose no tools or fall back).
+ * Returns `undefined` when the user has no recognised roles — the caller
+ * (see `src/index.ts`) MUST fail closed in that case rather than fall
+ * back to the full tool surface.
  */
 export declare function resolveUserDomains(apiClient: RaytioApiClient): Promise<string | undefined>;
 //# sourceMappingURL=role-mapping.d.ts.map

package/dist/tools/role-mapping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-mapping.d.ts","sourceRoot":"","sources":["../../src/tools/role-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AA2BD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAqBhE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,eAAe,GACzB,OAAO,CAAC,SAAS,EAAE,CAAC,CAEtB;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,eAAe,GACzB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAK7B"}
+{"version":3,"file":"role-mapping.d.ts","sourceRoot":"","sources":["../../src/tools/role-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAsBD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAqBhE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,eAAe,GACzB,OAAO,CAAC,SAAS,EAAE,CAAC,CAEtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,eAAe,GACzB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAO7B"}

package/dist/tools/role-mapping.js

@@ -1,37 +1,33 @@
 /**
- * Map role group codes to the tool domain IDs they unlock.
- *
- * Role codes that grant full PPM access (SELECT + INSERT + UPDATE):
- *   - PROJECT_USER, PROJECT_ADMINISTRATOR
- *
- * Role codes that grant read-only PPM access (SELECT only):
- *   - PROJECT_VIEWER
- *
- * Role codes that grant full DSM access:
- *   - DATA_SHARING_USER, DATA_SHARING_ADMINISTRATOR
+ * Map role group names (as returned by `fnd_authz_user_groups()`) to the
+ * tool domain IDs they unlock. Keys are the exact Persist seed values
+ * from `02435-seed-hrm-role-group-inheritance.sql`.
  */
 const ROLE_TO_DOMAINS = {
-    PROJECT_USER: ['ppm', 'prm'],
-    PROJECT_ADMINISTRATOR: ['ppm', 'prm', 'wrm'],
-    PROJECT_VIEWER: ['ppm-readonly', 'wrm-readonly'],
-    DATA_SHARING_USER: ['dsm'],
-    DATA_SHARING_ADMINISTRATOR: ['dsm'],
-    WORKER_ADMINISTRATOR: ['wrm', 'prm'],
-    WORKER_VIEWER: ['wrm-readonly'],
-    SALES_USER: ['sfa', 'prm'],
-    SALES_ADMINISTRATOR: ['sfa', 'prm'],
-    SALES_VIEWER: ['sfa-readonly'],
+    'Project administrator': ['ppm', 'prm', 'wrm'],
+    'Project user': ['ppm', 'prm'],
+    'Project viewer': ['ppm-readonly', 'wrm-readonly'],
+    'Data sharing administrator': ['dsm'],
+    'Data sharing user': ['dsm'],
+    'Data sharing viewer': ['dsm'],
+    'Worker administrator': ['wrm', 'prm'],
+    'Worker user': ['wrm', 'prm'],
+    'Worker viewer': ['wrm-readonly'],
+    'Sales administrator': ['sfa', 'prm'],
+    'Sales user': ['sfa', 'prm'],
+    'Sales viewer': ['sfa-readonly'],
 };
 /**
- * Given a list of user group codes, resolve the set of tool domain IDs
+ * Given a list of user group names, resolve the set of tool domain IDs
  * the user should have access to.
  *
- * When both `ppm` and `ppm-readonly` are present, `ppm` wins (superset).
+ * When both a full-access and readonly domain are present (e.g. `ppm`
+ * and `ppm-readonly`), the full-access variant wins.
  */
-export function mapRolesToDomains(groupCodes) {
+export function mapRolesToDomains(groupNames) {
     const domains = new Set();
-    for (const code of groupCodes) {
-        const mapped = ROLE_TO_DOMAINS[code];
+    for (const name of groupNames) {
+        const mapped = ROLE_TO_DOMAINS[name];
         if (mapped) {
             for (const d of mapped)
                 domains.add(d);
@@ -61,13 +57,16 @@ export async function fetchUserGroups(apiClient) {
  * backend roles. Returns a comma-separated domain spec string compatible
  * with `resolveDomains()`.
  *
- * Returns `undefined` when the user has no recognised roles (the caller
- * should decide how to handle this — e.g. expose no tools or fall back).
+ * Returns `undefined` when the user has no recognised roles — the caller
+ * (see `src/index.ts`) MUST fail closed in that case rather than fall
+ * back to the full tool surface.
  */
 export async function resolveUserDomains(apiClient) {
     const groups = await fetchUserGroups(apiClient);
-    const codes = groups.map((g) => g.group_code);
-    const domains = mapRolesToDomains(codes);
+    const names = groups
+        .map((g) => g.group_name)
+        .filter((n) => typeof n === 'string' && n.length > 0);
+    const domains = mapRolesToDomains(names);
     return domains.length > 0 ? domains.join(',') : undefined;
 }
 //# sourceMappingURL=role-mapping.js.map