@raytio/mcp-server 9.2.1 → 9.4.0

package/README.md

@@ -43,15 +43,12 @@ RAYTIO_COGNITO_CLIENT_ID=xxxxxxxxxxxxxxxxxxxxxxxxxx
 RAYTIO_COGNITO_REGION=us-east-1
 RAYTIO_AGENT_USERNAME=agent@example.com
 RAYTIO_AGENT_PASSWORD=...
-RAYTIO_AGENT_ENCRYPTION_PASSWORD=...
-RAYTIO_AGENT_CUSTOMER_ID=00000000-0000-0000-0000-000000000000
-RAYTIO_TARGET_USER_EMAIL=user@example.com
-# Optional: static override for tool domains (see "Tool domain selection" below).
-# If unset, domains are resolved dynamically from the user's backend roles.
-# RAYTIO_TOOL_DOMAINS=ppm-readonly
+RAYTIO_TOOL_DOMAINS=ppm,wrm
 EOF
 ```
 
+This is a minimal PPM/WRM-only configuration; the account must still have the corresponding backend permissions. To enable DSM, include `dsm` in the domain selection and supply both `RAYTIO_AGENT_CUSTOMER_ID` (UUID) and `RAYTIO_AGENT_ENCRYPTION_PASSWORD`. After role/domain resolution, startup fails if a selected DSM tool needs either missing variable, naming only the missing env vars. This also applies when domains are resolved dynamically. `RAYTIO_TARGET_USER_EMAIL` is optional and retained for compatibility; no tool uses it.
+
 Then register the MCP server, passing only the pointer:
 
 ```bash
@@ -181,6 +178,14 @@ Set `RAYTIO_TOOL_DOMAINS` (comma-separated) to bypass dynamic resolution entirel
 - **Restrict** an agent below its actual role (e.g. force `ppm-readonly` even though the account has `PROJECT_USER`).
 - **Lock in** a known domain set regardless of backend role changes.
 
+#### Tool allow-list with `RAYTIO_ENABLED_TOOLS`
+
+Domains are the narrowest built-in filter, and `ppm` and `wrm` each hold many write tools. To expose specific tools, set `RAYTIO_ENABLED_TOOLS` to a comma-separated list of tool names, for example `RAYTIO_ENABLED_TOOLS=ppm_work_item_get,wrm_role_memory_list`.
+
+The list is applied after the role-domain and capability filters, so it can only narrow what the user may access. A tool outside it is neither listed nor callable. If the variable is unset, there is no extra restriction. If it is set but blank, the server exposes no tools. Names the user can't access are skipped and logged to stderr.
+
+raytio-auto sets this for each run from the agent's WRM tool bindings, which enforces them even when the MCP client runs with its own permission checks bypassed.
+
 **Available domains** (source: `src/tools/domains.ts`, also listed at the top of `docs/tools.md`):
 
 | Domain ID | Notes |
@@ -258,7 +263,7 @@ RAYTIO_AGENT_PASSWORD=your-agent-password
 RAYTIO_AGENT_ENCRYPTION_PASSWORD=your-encryption-password
 RAYTIO_AGENT_CUSTOMER_ID=00000000-0000-0000-0000-000000000000
 
-# Target User
+# Optional legacy target user (unused by tools)
 RAYTIO_TARGET_USER_EMAIL=user@example.com
 
 # Optional: Embedding Settings for semantic memory tools. The API URL accepts

package/config.env.example

@@ -7,20 +7,27 @@ RAYTIO_COGNITO_REGION=us-east-1
 # Agent User Credentials
 RAYTIO_AGENT_USERNAME=agent-assistant@example.com
 RAYTIO_AGENT_PASSWORD=your-agent-password-here
+# DSM only: required when the resolved DSM tools need them; otherwise omit.
 RAYTIO_AGENT_ENCRYPTION_PASSWORD=your-encryption-password-here
 RAYTIO_AGENT_CUSTOMER_ID=00000000-0000-0000-0000-000000000000
 
-# Target User
+# Optional legacy target user (unused by tools; may be omitted)
 RAYTIO_TARGET_USER_EMAIL=user@example.com
 
 # Optional: static override for which tool domains are exposed (comma-separated).
-# If set, bypasses dynamic role-based resolution entirely.
+# If set, restricts the domains allowed by the user's backend roles.
 # If unset, the server queries the user's backend roles at startup and exposes
 # only the domains the user has permissions for.
 # Run `npm run docs:tools` to see available domain IDs.
-# Example: RAYTIO_TOOL_DOMAINS=ppm-readonly
+# Minimal PPM/WRM setup: omit both DSM-only variables and target email.
+# RAYTIO_TOOL_DOMAINS=ppm,wrm
 # RAYTIO_TOOL_DOMAINS=dsm,ppm
 
+# Optional: expose only these tools (comma-separated tool names). Applied after
+# the domain and capability filters, so it can only narrow access. Unset means
+# no extra restriction; set but blank exposes no tools.
+# RAYTIO_ENABLED_TOOLS=ppm_work_item_get,wrm_role_memory_list
+
 # Optional: Embedding Settings for semantic memory tools. The URL may be an
 # API base (with or without /v1) or the full /v1/embeddings endpoint.
 RAYTIO_EMBEDDING_API_KEY=your-embedding-api-key-here

package/dist/authorization.d.ts

@@ -50,5 +50,17 @@ export declare function resolveToolDomains(apiClient: RaytioApiClient, envSpec:
  * explicit affirmation, not a fallthrough.
  */
 export declare function filterToolsByCapabilities(tools: readonly Tool[], capabilities: EffectiveCapabilityIndex, logger?: StderrLogger): Tool[];
+/**
+ * Restrict the tool surface to an explicit allow-list (`RAYTIO_ENABLED_TOOLS`,
+ * comma-separated wire tool names). Runners pass a role's WRM tool bindings
+ * here so the limit holds even for clients that bypass their own permission
+ * checks.
+ *
+ * Applied after the role-domain and capability filters, so it can only narrow
+ * the surface: a named tool those filters removed stays hidden. Unset means no
+ * restriction. Set but blank exposes nothing, because a caller that asked for
+ * a limit must not silently receive every tool.
+ */
+export declare function filterToolsByAllowlist(tools: readonly Tool[], spec: string | undefined, logger?: StderrLogger): Tool[];
 export {};
 //# sourceMappingURL=authorization.d.ts.map

package/dist/authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EAEzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAG3C;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,mHAAmH;IACnH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,wBAAwB,CAAC;CACzC;AAED,KAAK,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAoD3C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,GAAE,YAAsB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAqE9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,SAAS,IAAI,EAAE,EACtB,YAAY,EAAE,wBAAwB,EACtC,MAAM,GAAE,YAAsB,GAC7B,IAAI,EAAE,CA8BR"}
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EAEzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAG3C;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,mHAAmH;IACnH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,wBAAwB,CAAC;CACzC;AAED,KAAK,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAsD3C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,GAAE,YAAsB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAqE9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,SAAS,IAAI,EAAE,EACtB,YAAY,EAAE,wBAAwB,EACtC,MAAM,GAAE,YAAsB,GAC7B,IAAI,EAAE,CA8BR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,IAAI,EAAE,EACtB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,MAAM,GAAE,YAAsB,GAC7B,IAAI,EAAE,CAkBR"}

package/dist/authorization.js

@@ -14,6 +14,8 @@ const READONLY_PARENTS = {
     'fnd-readonly': 'fnd',
     'fxm-readonly': 'fxm',
     'cmm-readonly': 'cmm',
+    'far-readonly': 'far',
+    'fap-readonly': 'fap',
 };
 function parseSpec(spec) {
     if (!spec)
@@ -151,4 +153,32 @@ export function filterToolsByCapabilities(tools, capabilities, logger = console)
     }
     return allowed;
 }
+/**
+ * Restrict the tool surface to an explicit allow-list (`RAYTIO_ENABLED_TOOLS`,
+ * comma-separated wire tool names). Runners pass a role's WRM tool bindings
+ * here so the limit holds even for clients that bypass their own permission
+ * checks.
+ *
+ * Applied after the role-domain and capability filters, so it can only narrow
+ * the surface: a named tool those filters removed stays hidden. Unset means no
+ * restriction. Set but blank exposes nothing, because a caller that asked for
+ * a limit must not silently receive every tool.
+ */
+export function filterToolsByAllowlist(tools, spec, logger = console) {
+    if (spec === undefined) {
+        return [...tools];
+    }
+    const names = new Set(spec.split(',').map((s) => s.trim()).filter(Boolean));
+    if (names.size === 0) {
+        logger.error('Raytio MCP: RAYTIO_ENABLED_TOOLS is set but empty — exposing no tools');
+        return [];
+    }
+    const allowed = tools.filter((tool) => names.has(tool.name));
+    const exposed = new Set(allowed.map((tool) => tool.name));
+    const unavailable = [...names].filter((name) => !exposed.has(name));
+    if (unavailable.length > 0) {
+        logger.error(`Raytio MCP: RAYTIO_ENABLED_TOOLS names ${unavailable.length} tool(s) not available to this user: ${unavailable.join(', ')}`);
+    }
+    return allowed;
+}
 //# sourceMappingURL=authorization.js.map

package/dist/authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAExB,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAwB7D;;;;;GAKG;AACH,MAAM,gBAAgB,GAA2B;IAC/C,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;CACtB,CAAC;AAEF,SAAS,SAAS,CAAC,IAA+B;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,aAAuB,EACvB,WAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAA0B,EAC1B,OAA2B,EAC3B,SAAuB,OAAO;IAE9B,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,sBAAsB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC3D,MAAM,CAAC,KAAK,CACV,gDAAgD,MAAM,qCAAqC,CAC5F,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAE3C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,8BAA8B,CAAC;QAC9C,MAAM,CAAC,KAAK,CACV,eAAe,MAAM,oCAAoC,CAC1D,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,YAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GACV,GAAG,YAAY,wBAAwB;YACrC,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,qBAAsB,GAAa,CAAC,OAAO,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,4CAA4C,MAAM,EAAE,CAAC;QACpE,MAAM,CAAC,KAAK,CACV,eAAe,MAAM,oCAAoC,CAC1D,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,CAAC,KAAK,CACV,uBAAuB,YAAY,CAAC,IAAI,mDAAmD,CAC5F,CAAC;IAEF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,0BAA0B;YAClC,UAAU,EAAE,IAAI;YAChB,YAAY;SACb,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,+BAA+B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,oCAAoC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAClI,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,oCAAoC,CAAC,CAAC;QACxE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CACV,iEAAiE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CACrG,CAAC;IACF,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,+BAA+B;QACvC,UAAU,EAAE,IAAI;QAChB,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAsB,EACtB,YAAsC,EACtC,SAAuB,OAAO;IAE9B,MAAM,OAAO,GAAW,EAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,CAAC,CAAC;QACZ,MAAM,MAAM,GAAG,OAAO;aACnB,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,EAAE,CACpF;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,CAAC,KAAK,CACV,4BAA4B,IAAI,CAAC,IAAI,2BAA2B,MAAM,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,qCAAqC,MAAM,IAAI,KAAK,CAAC,MAAM,QAAQ,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAExB,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAwB7D;;;;;GAKG;AACH,MAAM,gBAAgB,GAA2B;IAC/C,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;CACtB,CAAC;AAEF,SAAS,SAAS,CAAC,IAA+B;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,aAAuB,EACvB,WAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAA0B,EAC1B,OAA2B,EAC3B,SAAuB,OAAO;IAE9B,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,sBAAsB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC3D,MAAM,CAAC,KAAK,CACV,gDAAgD,MAAM,qCAAqC,CAC5F,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAE3C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,8BAA8B,CAAC;QAC9C,MAAM,CAAC,KAAK,CACV,eAAe,MAAM,oCAAoC,CAC1D,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,YAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GACV,GAAG,YAAY,wBAAwB;YACrC,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,qBAAsB,GAAa,CAAC,OAAO,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,4CAA4C,MAAM,EAAE,CAAC;QACpE,MAAM,CAAC,KAAK,CACV,eAAe,MAAM,oCAAoC,CAC1D,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,CAAC,KAAK,CACV,uBAAuB,YAAY,CAAC,IAAI,mDAAmD,CAC5F,CAAC;IAEF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,0BAA0B;YAClC,UAAU,EAAE,IAAI;YAChB,YAAY;SACb,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,+BAA+B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,oCAAoC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAClI,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,oCAAoC,CAAC,CAAC;QACxE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CACV,iEAAiE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CACrG,CAAC;IACF,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,+BAA+B;QACvC,UAAU,EAAE,IAAI;QAChB,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAsB,EACtB,YAAsC,EACtC,SAAuB,OAAO;IAE9B,MAAM,OAAO,GAAW,EAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,CAAC,CAAC;QACZ,MAAM,MAAM,GAAG,OAAO;aACnB,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,EAAE,CACpF;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,CAAC,KAAK,CACV,4BAA4B,IAAI,CAAC,IAAI,2BAA2B,MAAM,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,qCAAqC,MAAM,IAAI,KAAK,CAAC,MAAM,QAAQ,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAsB,EACtB,IAAwB,EACxB,SAAuB,OAAO;IAE9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;QACtF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CACV,0CAA0C,WAAW,CAAC,MAAM,wCAAwC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7H,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/config.d.ts

@@ -33,26 +33,26 @@ declare const ConfigSchema: z.ZodObject<{
     agentUser: z.ZodObject<{
         username: z.ZodString;
         password: z.ZodString;
-        encryptionPassword: z.ZodString;
-        customerId: z.ZodString;
+        encryptionPassword: z.ZodOptional<z.ZodString>;
+        customerId: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         username: string;
         password: string;
-        encryptionPassword: string;
-        customerId: string;
+        encryptionPassword?: string | undefined;
+        customerId?: string | undefined;
     }, {
         username: string;
         password: string;
-        encryptionPassword: string;
-        customerId: string;
+        encryptionPassword?: string | undefined;
+        customerId?: string | undefined;
     }>;
-    targetUser: z.ZodObject<{
+    targetUser: z.ZodOptional<z.ZodObject<{
         email: z.ZodString;
     }, "strip", z.ZodTypeAny, {
         email: string;
     }, {
         email: string;
-    }>;
+    }>>;
     defaults: z.ZodDefault<z.ZodObject<{
         requestTimeoutSeconds: z.ZodDefault<z.ZodNumber>;
         pollIntervalSeconds: z.ZodDefault<z.ZodNumber>;
@@ -91,17 +91,17 @@ declare const ConfigSchema: z.ZodObject<{
     agentUser: {
         username: string;
         password: string;
-        encryptionPassword: string;
-        customerId: string;
-    };
-    targetUser: {
-        email: string;
+        encryptionPassword?: string | undefined;
+        customerId?: string | undefined;
     };
     defaults: {
         requestTimeoutSeconds: number;
         pollIntervalSeconds: number;
         requestExpiryMinutes: number;
     };
+    targetUser?: {
+        email: string;
+    } | undefined;
     embedding?: {
         apiKey: string;
         apiUrl: string;
@@ -119,12 +119,12 @@ declare const ConfigSchema: z.ZodObject<{
     agentUser: {
         username: string;
         password: string;
-        encryptionPassword: string;
-        customerId: string;
+        encryptionPassword?: string | undefined;
+        customerId?: string | undefined;
     };
-    targetUser: {
+    targetUser?: {
         email: string;
-    };
+    } | undefined;
     defaults?: {
         requestTimeoutSeconds?: number | undefined;
         pollIntervalSeconds?: number | undefined;
@@ -138,5 +138,9 @@ declare const ConfigSchema: z.ZodObject<{
 }>;
 export type Config = z.infer<typeof ConfigSchema>;
 export declare function loadConfig(): Config;
+/** Fail before advertising DSM tools that cannot run with this configuration. */
+export declare function validateToolConfiguration(config: Config, tools: readonly {
+    name: string;
+}[]): void;
 export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BhB,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,wBAAgB,UAAU,IAAI,MAAM,CA2CnC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BhB,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,wBAAgB,UAAU,IAAI,MAAM,CA2CnC;AAED,iFAAiF;AACjF,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GACjC,IAAI,CAYN"}

package/dist/config.js

@@ -22,12 +22,13 @@ const ConfigSchema = z.object({
     agentUser: z.object({
         username: z.string().email(),
         password: z.string().min(1),
-        encryptionPassword: z.string().min(1),
-        customerId: z.string().uuid(),
+        encryptionPassword: z.string().min(1).optional(),
+        customerId: z.string().uuid().optional(),
     }),
+    // Retained for compatibility with existing config files; no tool uses it.
     targetUser: z.object({
         email: z.string().email(),
-    }),
+    }).optional(),
     defaults: z.object({
         requestTimeoutSeconds: z.number().default(600),
         pollIntervalSeconds: z.number().default(5),
@@ -56,9 +57,9 @@ export function loadConfig() {
             encryptionPassword: process.env.RAYTIO_AGENT_ENCRYPTION_PASSWORD,
             customerId: process.env.RAYTIO_AGENT_CUSTOMER_ID,
         },
-        targetUser: {
-            email: process.env.RAYTIO_TARGET_USER_EMAIL,
-        },
+        targetUser: process.env.RAYTIO_TARGET_USER_EMAIL !== undefined
+            ? { email: process.env.RAYTIO_TARGET_USER_EMAIL }
+            : undefined,
         defaults: {
             requestTimeoutSeconds: parseInt(process.env.RAYTIO_REQUEST_TIMEOUT_SECONDS || '600'),
             pollIntervalSeconds: parseInt(process.env.RAYTIO_POLL_INTERVAL_SECONDS || '5'),
@@ -83,4 +84,18 @@ export function loadConfig() {
         throw error;
     }
 }
+/** Fail before advertising DSM tools that cannot run with this configuration. */
+export function validateToolConfiguration(config, tools) {
+    const names = new Set(tools.map(tool => tool.name));
+    const missing = [];
+    if (names.has('create_access_application') && !config.agentUser.customerId) {
+        missing.push('RAYTIO_AGENT_CUSTOMER_ID');
+    }
+    if (names.has('poll_and_retrieve') && !config.agentUser.encryptionPassword) {
+        missing.push('RAYTIO_AGENT_ENCRYPTION_PASSWORD');
+    }
+    if (missing.length) {
+        throw new Error(`DSM tools require missing configuration: ${missing.join(', ')}`);
+    }
+}
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,8EAA8E;AAC9E,6EAA6E;AAC7E,sEAAsE;AACtE,yDAAyD;AACzD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB;OAC5C,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;AAC5C,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAE7B,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;SACnB,CAAC;KACH,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;KAC9B,CAAC;IACF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;KAC1B,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QAC9C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1C,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACd,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACzB,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,UAAU,UAAU;IACxB,kCAAkC;IAClC,MAAM,MAAM,GAAG;QACb,MAAM,EAAE;YACN,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC3C,OAAO,EAAE;gBACP,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;gBACnD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBAC9C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;aAC1C;SACF;QACD,SAAS,EAAE;YACT,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;YAC3C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;YAC3C,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC;YAChE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;SACjD;QACD,UAAU,EAAE;YACV,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;SAC5C;QACD,QAAQ,EAAE;YACR,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,KAAK,CAAC;YACpF,mBAAmB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,GAAG,CAAC;YAC9E,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,IAAI,CAAC;SAClF;QACD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;YAC7C,CAAC,CAAC;gBACE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBAC5C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,sCAAsC;gBACtF,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,wBAAwB;aACtE;YACH,CAAC,CAAC,SAAS;KACd,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,8EAA8E;AAC9E,6EAA6E;AAC7E,sEAAsE;AACtE,yDAAyD;AACzD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB;OAC5C,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;AAC5C,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAE7B,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;SACnB,CAAC;KACH,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;IACF,0EAA0E;IAC1E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;KAC1B,CAAC,CAAC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QAC9C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1C,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACd,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACzB,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,UAAU,UAAU;IACxB,kCAAkC;IAClC,MAAM,MAAM,GAAG;QACb,MAAM,EAAE;YACN,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC3C,OAAO,EAAE;gBACP,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;gBACnD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBAC9C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;aAC1C;SACF;QACD,SAAS,EAAE;YACT,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;YAC3C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;YAC3C,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC;YAChE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;SACjD;QACD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,SAAS;YAC5D,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE;YACjD,CAAC,CAAC,SAAS;QACb,QAAQ,EAAE;YACR,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,KAAK,CAAC;YACpF,mBAAmB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,GAAG,CAAC;YAC9E,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,IAAI,CAAC;SAClF;QACD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;YAC7C,CAAC,CAAC;gBACE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBAC5C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,sCAAsC;gBACtF,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,wBAAwB;aACtE;YACH,CAAC,CAAC,SAAS;KACd,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,KAAkC;IAElC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,4CAA4C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC"}

package/dist/index.js

@@ -3,12 +3,12 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
 import { zodToJsonSchema } from 'zod-to-json-schema';
-import { loadConfig } from './config.js';
+import { loadConfig, validateToolConfiguration } from './config.js';
 import { PersistContractError, loadPersistResourceContract, } from './contracts/persist-resource-contract.js';
 import { CognitoAuth } from './raytio/auth.js';
 import { RaytioApiClient } from './raytio/api-client.js';
 import { resolveDomains } from './tools/domains.js';
-import { filterToolsByCapabilities, resolveToolDomains } from './authorization.js';
+import { filterToolsByAllowlist, filterToolsByCapabilities, resolveToolDomains, } from './authorization.js';
 import { dispatchToolCall } from './tools/dispatch.js';
 import { PACKAGE_VERSION } from './version.js';
 // Load configuration
@@ -52,13 +52,19 @@ const authorization = await resolveToolDomains(apiClient, process.env.RAYTIO_TOO
 const domainTools = authorization.authorized
     ? resolveDomains(authorization.domainSpec)
     : [];
+// Fail fast after domain resolution, before advertising any DSM tools.
+validateToolConfiguration(config, domainTools);
 // Layer the effective-capability filter on top of the role-domain filter.
 // Tools without a declared `capabilities` field pass through unchanged —
 // they remain gated by the role-domain filter until they are migrated
 // onto the pinned Persist resource contract (WI-0003500 onward).
-const allTools = authorization.authorized && authorization.capabilities
+const capabilityTools = authorization.authorized && authorization.capabilities
     ? filterToolsByCapabilities(domainTools, authorization.capabilities)
     : domainTools;
+// Optional per-process allow-list, applied last so it can only narrow the
+// surface. ListTools and CallTool both use allTools, so a tool outside the
+// list can be neither discovered nor called.
+const allTools = filterToolsByAllowlist(capabilityTools, process.env.RAYTIO_ENABLED_TOOLS);
 console.error(`Raytio MCP: exposing ${allTools.length} tools` +
     (authorization.domainSpec
         ? ` (domains: ${authorization.domainSpec})`

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,qBAAqB;AACrB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,IAAI,eAAe,CAAC;AACpB,IAAI,CAAC;IACH,eAAe,GAAG,2BAA2B,EAAE,CAAC;AAClD,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,MAAM,MAAM,GAAG,KAAK,YAAY,oBAAoB;QAClD,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAE,KAAe,CAAC,OAAO,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,gDAAgD,MAAM,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,CACX,6EAA6E;QAC3E,2DAA2D,CAC9D,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,OAAO,CAAC,KAAK,CACX,uCAAuC,eAAe,CAAC,gBAAgB,GAAG;IACxE,MAAM,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;IAClD,IAAI,eAAe,CAAC,cAAc,eAAe,eAAe,CAAC,cAAc,YAAY,CAC9F,CAAC;AAEF,2CAA2C;AAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU;IAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ;IACxC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;IACpC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;IACnC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;CACpC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAEtE,MAAM,GAAG,GAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAErD,wEAAwE;AACxE,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,sEAAsE;AACtE,WAAW;AACX,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAC5C,SAAS,EACT,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAChC,CAAC;AAEF,MAAM,WAAW,GAAW,aAAa,CAAC,UAAU;IAClD,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC;IAC1C,CAAC,CAAC,EAAE,CAAC;AAEP,0EAA0E;AAC1E,yEAAyE;AACzE,sEAAsE;AACtE,iEAAiE;AACjE,MAAM,QAAQ,GACZ,aAAa,CAAC,UAAU,IAAI,aAAa,CAAC,YAAY;IACpD,CAAC,CAAC,yBAAyB,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC;IACpE,CAAC,CAAC,WAAW,CAAC;AAElB,OAAO,CAAC,KAAK,CACX,wBAAwB,QAAQ,CAAC,MAAM,QAAQ;IAC7C,CAAC,aAAa,CAAC,UAAU;QACvB,CAAC,CAAC,cAAc,aAAa,CAAC,UAAU,GAAG;QAC3C,CAAC,CAAC,6BAA6B,CAAC,CACrC,CAAC;AAEF,oBAAoB;AACpB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;IACE,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,eAAe;CACzB,EACD;IACE,YAAY,EAAE;QACZ,KAAK,EAAE,EAAE;KACV;CACF,CACF,CAAC;AAEF,uBAAuB;AACvB,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;IAC1D,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,WAAkB,CAAC;SACtD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,0EAA0E;AAC1E,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,4BAA4B;AAC5B,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,GAAG,EACH,aAAa,CAAC,YAAY,CAC3B,CAAC;IACF,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,eAAe;AACf,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAC7C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,qBAAqB;AACrB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,IAAI,eAAe,CAAC;AACpB,IAAI,CAAC;IACH,eAAe,GAAG,2BAA2B,EAAE,CAAC;AAClD,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,MAAM,MAAM,GAAG,KAAK,YAAY,oBAAoB;QAClD,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAE,KAAe,CAAC,OAAO,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,gDAAgD,MAAM,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,CACX,6EAA6E;QAC3E,2DAA2D,CAC9D,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,OAAO,CAAC,KAAK,CACX,uCAAuC,eAAe,CAAC,gBAAgB,GAAG;IACxE,MAAM,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;IAClD,IAAI,eAAe,CAAC,cAAc,eAAe,eAAe,CAAC,cAAc,YAAY,CAC9F,CAAC;AAEF,2CAA2C;AAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU;IAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ;IACxC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;IACpC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;IACnC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;CACpC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAEtE,MAAM,GAAG,GAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAErD,wEAAwE;AACxE,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,sEAAsE;AACtE,WAAW;AACX,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAC5C,SAAS,EACT,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAChC,CAAC;AAEF,MAAM,WAAW,GAAW,aAAa,CAAC,UAAU;IAClD,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC;IAC1C,CAAC,CAAC,EAAE,CAAC;AAEP,uEAAuE;AACvE,yBAAyB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAE/C,0EAA0E;AAC1E,yEAAyE;AACzE,sEAAsE;AACtE,iEAAiE;AACjE,MAAM,eAAe,GACnB,aAAa,CAAC,UAAU,IAAI,aAAa,CAAC,YAAY;IACpD,CAAC,CAAC,yBAAyB,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC;IACpE,CAAC,CAAC,WAAW,CAAC;AAElB,0EAA0E;AAC1E,2EAA2E;AAC3E,6CAA6C;AAC7C,MAAM,QAAQ,GAAW,sBAAsB,CAC7C,eAAe,EACf,OAAO,CAAC,GAAG,CAAC,oBAAoB,CACjC,CAAC;AAEF,OAAO,CAAC,KAAK,CACX,wBAAwB,QAAQ,CAAC,MAAM,QAAQ;IAC7C,CAAC,aAAa,CAAC,UAAU;QACvB,CAAC,CAAC,cAAc,aAAa,CAAC,UAAU,GAAG;QAC3C,CAAC,CAAC,6BAA6B,CAAC,CACrC,CAAC;AAEF,oBAAoB;AACpB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;IACE,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,eAAe;CACzB,EACD;IACE,YAAY,EAAE;QACZ,KAAK,EAAE,EAAE;KACV;CACF,CACF,CAAC;AAEF,uBAAuB;AACvB,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;IAC1D,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,WAAkB,CAAC;SACtD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,0EAA0E;AAC1E,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,4BAA4B;AAC5B,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,GAAG,EACH,aAAa,CAAC,YAAY,CAC3B,CAAC;IACF,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,eAAe;AACf,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAC7C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/tools/_shared/finance-idempotency.d.ts

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+/**
+ * Shared idempotency plumbing for financial (FAR/FAP) mutation tools
+ * (WI-0003504).
+ *
+ * Financial mutations (invoice creation, receipt recording, hold
+ * placement) MUST be safe to retry — model callers routinely re-send
+ * on transient network errors, and a duplicated receipt is a
+ * production incident. We express this two ways:
+ *
+ *  - Tools that have a natural key (a unique index such as
+ *    organisation + transaction_code, organisation + receipt_number,
+ *    open hold per bill + hold_code) require it, document it in the
+ *    tool description, and inherit `idempotency: 'natural_key'`. A
+ *    retry then fails with a duplicate-key error instead of creating
+ *    a second row.
+ *  - Every side-effecting tool also accepts an OPTIONAL
+ *    `idempotency_key`, forwarded as an `Idempotency-Key` header.
+ *    Persist (PostgREST) ignores that header today (WI-0008817), so
+ *    the key does not make a retry safe on its own.
+ *
+ * The MCP server does not maintain its own dedupe cache — the
+ * canonical answer lives in Persist. This module keeps the input
+ * schema and header-injection logic in one place so every FAR/FAP
+ * mutation surfaces the same contract.
+ */
+/**
+ * Zod schema for the optional idempotency key input. Keeps the shape
+ * consistent so callers passing the same key across tools do not need
+ * to remember tool-specific spellings.
+ */
+export declare const idempotencyKeySchema: z.ZodOptional<z.ZodString>;
+/**
+ * Build the request headers for a financial mutation. Passes through
+ * `Prefer: return=representation` (needed for PostgREST to echo the
+ * created/updated row) and adds `Idempotency-Key` when supplied.
+ */
+export declare function financeWriteHeaders(idempotencyKey: string | undefined): Record<string, string>;
+/**
+ * Zod schema for a caller-supplied confirmation flag. Used on
+ * consequential actions (cash receipt, hold release) where an
+ * explicit `confirm: true` is required in addition to the required
+ * business inputs.
+ */
+export declare const confirmFlagSchema: z.ZodLiteral<true>;
+/**
+ * Zod schema for a caller-supplied reason string. Used on lifecycle
+ * transitions (invoice status change, hold release) so the audit log
+ * carries a human-readable justification.
+ */
+export declare const reasonSchema: z.ZodString;
+//# sourceMappingURL=finance-idempotency.d.ts.map

package/dist/tools/_shared/finance-idempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finance-idempotency.d.ts","sourceRoot":"","sources":["../../../src/tools/_shared/finance-idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,4BAa9B,CAAC;AAEJ;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,oBAW3B,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,YAAY,aAG2B,CAAC"}

package/dist/tools/_shared/finance-idempotency.js

@@ -0,0 +1,79 @@
+import { z } from 'zod';
+/**
+ * Shared idempotency plumbing for financial (FAR/FAP) mutation tools
+ * (WI-0003504).
+ *
+ * Financial mutations (invoice creation, receipt recording, hold
+ * placement) MUST be safe to retry — model callers routinely re-send
+ * on transient network errors, and a duplicated receipt is a
+ * production incident. We express this two ways:
+ *
+ *  - Tools that have a natural key (a unique index such as
+ *    organisation + transaction_code, organisation + receipt_number,
+ *    open hold per bill + hold_code) require it, document it in the
+ *    tool description, and inherit `idempotency: 'natural_key'`. A
+ *    retry then fails with a duplicate-key error instead of creating
+ *    a second row.
+ *  - Every side-effecting tool also accepts an OPTIONAL
+ *    `idempotency_key`, forwarded as an `Idempotency-Key` header.
+ *    Persist (PostgREST) ignores that header today (WI-0008817), so
+ *    the key does not make a retry safe on its own.
+ *
+ * The MCP server does not maintain its own dedupe cache — the
+ * canonical answer lives in Persist. This module keeps the input
+ * schema and header-injection logic in one place so every FAR/FAP
+ * mutation surfaces the same contract.
+ */
+/**
+ * Zod schema for the optional idempotency key input. Keeps the shape
+ * consistent so callers passing the same key across tools do not need
+ * to remember tool-specific spellings.
+ */
+export const idempotencyKeySchema = z
+    .string()
+    .min(8)
+    .max(128)
+    .regex(/^[A-Za-z0-9._~:-]+$/, 'idempotency_key must be a URL-safe token (letters, digits, `.`, `_`, `~`, `:`, `-`)')
+    .optional()
+    .describe('Optional idempotency key, forwarded as an Idempotency-Key header. Persist does not ' +
+    'deduplicate on it yet, so it does not make a retry safe on its own; the unique key ' +
+    'named in the tool description does. Must be a URL-safe token of 8–128 characters.');
+/**
+ * Build the request headers for a financial mutation. Passes through
+ * `Prefer: return=representation` (needed for PostgREST to echo the
+ * created/updated row) and adds `Idempotency-Key` when supplied.
+ */
+export function financeWriteHeaders(idempotencyKey) {
+    const headers = {
+        Prefer: 'return=representation',
+    };
+    if (idempotencyKey) {
+        headers['Idempotency-Key'] = idempotencyKey;
+    }
+    return headers;
+}
+/**
+ * Zod schema for a caller-supplied confirmation flag. Used on
+ * consequential actions (cash receipt, hold release) where an
+ * explicit `confirm: true` is required in addition to the required
+ * business inputs.
+ */
+export const confirmFlagSchema = z
+    .literal(true, {
+    errorMap: () => ({
+        message: 'confirm must be set to `true` to acknowledge that this is a financial action ' +
+            'affecting real balances.',
+    }),
+})
+    .describe('Must be `true` to execute. Present so a model cannot accidentally record a receipt, ' +
+    'release a hold, or move money without an explicit confirmation step.');
+/**
+ * Zod schema for a caller-supplied reason string. Used on lifecycle
+ * transitions (invoice status change, hold release) so the audit log
+ * carries a human-readable justification.
+ */
+export const reasonSchema = z
+    .string()
+    .min(4, 'reason must be at least 4 characters')
+    .max(500, 'reason must be at most 500 characters');
+//# sourceMappingURL=finance-idempotency.js.map

package/dist/tools/_shared/finance-idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finance-idempotency.js","sourceRoot":"","sources":["../../../src/tools/_shared/finance-idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,qBAAqB,EACrB,qFAAqF,CACtF;KACA,QAAQ,EAAE;KACV,QAAQ,CACP,qFAAqF;IACnF,qFAAqF;IACrF,mFAAmF,CACtF,CAAC;AAEJ;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,cAAkC;IAElC,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,uBAAuB;KAChC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,iBAAiB,CAAC,GAAG,cAAc,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,OAAO,CAAC,IAAI,EAAE;IACb,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACf,OAAO,EACL,+EAA+E;YAC7E,0BAA0B;KAC/B,CAAC;CACH,CAAC;KACD,QAAQ,CACP,sFAAsF;IACpF,sEAAsE,CACzE,CAAC;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,sCAAsC,CAAC;KAC9C,GAAG,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC"}

package/dist/tools/_shared/money.d.ts

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+/** ISO 4217 alphabetic currency code, uppercase — validated at the MCP boundary. */
+export declare const currencyCodeSchema: z.ZodString;
+/** Positive money amount (> 0, ≤ 4 dp, bounded magnitude). */
+export declare const positiveMoneySchema: z.ZodEffects<z.ZodNumber, number, number>;
+/** Non-negative money amount (≥ 0, ≤ 4 dp, bounded magnitude). */
+export declare const nonNegativeMoneySchema: z.ZodEffects<z.ZodNumber, number, number>;
+/** Signed money amount (any sign, ≤ 4 dp, bounded magnitude) — for adjustments. */
+export declare const signedMoneySchema: z.ZodEffects<z.ZodNumber, number, number>;
+//# sourceMappingURL=money.d.ts.map

package/dist/tools/_shared/money.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"money.d.ts","sourceRoot":"","sources":["../../../src/tools/_shared/money.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqBxB,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,aAK5B,CAAC;AAuCJ,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,2CAW5B,CAAC;AAEL,kEAAkE;AAClE,eAAO,MAAM,sBAAsB,2CAW/B,CAAC;AAEL,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,2CAEoC,CAAC"}

package/dist/tools/_shared/money.js

@@ -0,0 +1,90 @@
+import { z } from 'zod';
+/**
+ * Shared money and currency validators for financial (FAR/FAP) tools
+ * (WI-0003504). Kept in one place so amount/currency semantics stay
+ * consistent across every AR/AP mutation surface.
+ *
+ * Money validation rules:
+ *  - Currency codes must be a 3-letter ISO 4217 alphabetic code
+ *    (uppercase). We do not validate against a live currency list —
+ *    Persist owns that lookup — but reject the obviously malformed
+ *    (empty string, wrong length, non-alphabetic) at the MCP boundary.
+ *  - Amounts must be finite JSON numbers with at most 4 decimal
+ *    fractional places (banker precision limit) and a magnitude that
+ *    fits inside PostgREST's numeric range without silent truncation.
+ *  - `nonNegativeMoney` allows zero (e.g. an adjustment line); use
+ *    `positiveMoney` for a receipt/payment amount that must move value.
+ */
+const ISO_CURRENCY_RE = /^[A-Z]{3}$/;
+/** ISO 4217 alphabetic currency code, uppercase — validated at the MCP boundary. */
+export const currencyCodeSchema = z
+    .string()
+    .regex(ISO_CURRENCY_RE, 'currency_code must be a 3-letter uppercase ISO 4217 code (e.g. USD, EUR, AUD)');
+// Max 4 decimal places, magnitude below 1e14 to stay well within Postgres
+// numeric(20,4). Any amount larger is almost certainly a caller mistake.
+const MAX_MAGNITUDE = 1e14;
+const MAX_FRACTIONAL_DIGITS = 4;
+function fractionalDigits(value) {
+    if (!Number.isFinite(value))
+        return Infinity;
+    const s = String(value);
+    const dot = s.indexOf('.');
+    if (dot < 0)
+        return 0;
+    const exp = s.toLowerCase().indexOf('e');
+    if (exp >= 0)
+        return Infinity;
+    return s.length - dot - 1;
+}
+function validateMoneyMagnitude(value, ctx) {
+    if (!Number.isFinite(value)) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'amount must be a finite number',
+        });
+        return;
+    }
+    if (Math.abs(value) >= MAX_MAGNITUDE) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `amount magnitude must be less than ${MAX_MAGNITUDE}`,
+        });
+    }
+    if (fractionalDigits(value) > MAX_FRACTIONAL_DIGITS) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `amount must have at most ${MAX_FRACTIONAL_DIGITS} decimal places`,
+        });
+    }
+}
+/** Positive money amount (> 0, ≤ 4 dp, bounded magnitude). */
+export const positiveMoneySchema = z
+    .number()
+    .superRefine((value, ctx) => {
+    if (value <= 0) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'amount must be greater than 0',
+        });
+        return;
+    }
+    validateMoneyMagnitude(value, ctx);
+});
+/** Non-negative money amount (≥ 0, ≤ 4 dp, bounded magnitude). */
+export const nonNegativeMoneySchema = z
+    .number()
+    .superRefine((value, ctx) => {
+    if (value < 0) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'amount must be greater than or equal to 0',
+        });
+        return;
+    }
+    validateMoneyMagnitude(value, ctx);
+});
+/** Signed money amount (any sign, ≤ 4 dp, bounded magnitude) — for adjustments. */
+export const signedMoneySchema = z
+    .number()
+    .superRefine((value, ctx) => validateMoneyMagnitude(value, ctx));
+//# sourceMappingURL=money.js.map

package/dist/tools/_shared/money.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"money.js","sourceRoot":"","sources":["../../../src/tools/_shared/money.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,KAAK,CACJ,eAAe,EACf,+EAA+E,CAChF,CAAC;AAEJ,0EAA0E;AAC1E,yEAAyE;AACzE,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,GAAoB;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;QACrC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,sCAAsC,aAAa,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,qBAAqB,EAAE,CAAC;QACpD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,4BAA4B,qBAAqB,iBAAiB;SAC5E,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,+BAA+B;SACzC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEL,kEAAkE;AAClE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,2CAA2C;SACrD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEL,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC"}