@sonisoft/now-sdk-ext-mcp 4.4.0 → 4.6.0

package/README.md

@@ -398,7 +398,15 @@ Since stdout is reserved for JSON-RPC, **never use `console.log()` in server cod
 
 - **`console.error()`** — writes to stderr, which is safe and visible in the MCP Inspector's Notifications pane and in Claude Desktop's log files (`~/Library/Logs/Claude/mcp*.log`).
 - **MCP Inspector** — run the server under the inspector to see all JSON-RPC messages and stderr output in real time.
-- **File logging** — for persistent debug logs, the core library's `Logger` class writes to `logs/` with Winston. Set the log level via the tool's logic as needed.
+- **File logging** — off by default. This server's working directory is chosen by whoever launched it, so it writes no files unless asked. Configure with environment variables:
+
+  | Variable | Effect |
+  | --- | --- |
+  | `NEX_LOG_FILE` | `1`/`true` writes a log file to `$XDG_STATE_HOME/now-sdk-ext/logs` (`~/.local/state/...`) |
+  | `NEX_LOG_DIR` | Write log files to this directory instead. Implies `NEX_LOG_FILE` |
+  | `NEX_LOG_LEVEL` | `error`, `warn`, `info` (default), `http`, `verbose`, `debug`, `silly` |
+
+  Diagnostics always go to **stderr**, never stdout — stdout carries JSON-RPC. Credential material is stripped from both metadata and message text before anything is written.
 
 ### Code Conventions
 

package/dist/common/annotations.d.ts

@@ -27,8 +27,14 @@
  * - `idempotentHint` — repeating the call with identical arguments leaves the
  *   same end state. True for "set this field to X"; false for "append a comment"
  *   or "create a record", which accumulate.
- * - `openWorldHint` — reserved here for arbitrary code execution, where the
- *   effect is genuinely unbounded and cannot be inferred from the arguments.
+ * - `openWorldHint` — TRUE FOR EVERY TOOL HERE, and set explicitly rather than
+ *   left to the spec's default. All of them talk to a live ServiceNow instance,
+ *   which is exactly what the spec means by an open world. It was tempting to use
+ *   it to single out arbitrary code execution, but that would have been wrong in
+ *   both directions: the spec default is already `true`, so the marking would
+ *   have been a no-op, and leaving it off the other 80-odd would have implied
+ *   they were closed-world when they are not. MCP has no hint for "runs
+ *   caller-supplied logic" — the tool description carries that.
  */
 export interface ToolAnnotations {
     readOnlyHint?: boolean;

package/dist/common/annotations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"annotations.d.ts","sourceRoot":"","sources":["../../src/common/annotations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,WAAW,eAAe;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B;AAyBD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAmJ5D,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAShE"}
+{"version":3,"file":"annotations.d.ts","sourceRoot":"","sources":["../../src/common/annotations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,MAAM,WAAW,eAAe;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B;AA2BD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAwJ5D,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAchE"}

package/dist/common/annotations.js

@@ -27,27 +27,39 @@
  * - `idempotentHint` — repeating the call with identical arguments leaves the
  *   same end state. True for "set this field to X"; false for "append a comment"
  *   or "create a record", which accumulate.
- * - `openWorldHint` — reserved here for arbitrary code execution, where the
- *   effect is genuinely unbounded and cannot be inferred from the arguments.
+ * - `openWorldHint` — TRUE FOR EVERY TOOL HERE, and set explicitly rather than
+ *   left to the spec's default. All of them talk to a live ServiceNow instance,
+ *   which is exactly what the spec means by an open world. It was tempting to use
+ *   it to single out arbitrary code execution, but that would have been wrong in
+ *   both directions: the spec default is already `true`, so the marking would
+ *   have been a no-op, and leaving it off the other 80-odd would have implied
+ *   they were closed-world when they are not. MCP has no hint for "runs
+ *   caller-supplied logic" — the tool description carries that.
  */
 /** Cannot modify anything. */
-const READ = { readOnlyHint: true };
+const READ = { readOnlyHint: true, openWorldHint: true };
 /** Adds something new; nothing pre-existing is lost. Repeating accumulates. */
-const CREATE = { readOnlyHint: false, destructiveHint: false, idempotentHint: false };
+const CREATE = { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true };
 /** Sets state to a given value. Nothing is destroyed; repeating is a no-op. */
-const SET = { readOnlyHint: false, destructiveHint: false, idempotentHint: true };
+const SET = { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true };
 /** Overwrites or removes data that already existed. Repeating settles. */
-const OVERWRITE = { readOnlyHint: false, destructiveHint: true, idempotentHint: true };
+const OVERWRITE = { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true };
 /** Overwrites or removes, and repeating does NOT settle. */
-const OVERWRITE_ONCE = { readOnlyHint: false, destructiveHint: true, idempotentHint: false };
-/** Runs caller-supplied logic. Effect is unbounded and not inferable from args. */
-const ARBITRARY = {
-    readOnlyHint: false,
-    destructiveHint: true,
-    idempotentHint: false,
-    openWorldHint: true,
-};
+const OVERWRITE_ONCE = { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true };
+/**
+ * Runs caller-supplied logic — a script or a flow someone else authored.
+ *
+ * Structurally identical to OVERWRITE_ONCE, because MCP has no hint that means
+ * "unbounded effect". Kept as a separate name purely so this table records which
+ * tools are in that category; the warning that actually reaches the model is in
+ * the tool description.
+ */
+const ARBITRARY = OVERWRITE_ONCE;
 export const TOOL_ANNOTATIONS = {
+    // ---- meta: reports this server's own configuration, touches no instance.
+    // Registered outside TOOL_REGISTRY because it is always available regardless
+    // of the active package.
+    list_tool_packages: READ,
     // ---- aggregate: server-side counts, no writes
     count_records: READ,
     aggregate_query: READ,
@@ -183,7 +195,12 @@ export const TOOL_ANNOTATIONS = {
  * Failing at registration makes that impossible.
  */
 export function annotationsFor(toolName) {
-    const annotations = TOOL_ANNOTATIONS[toolName];
+    // hasOwnProperty, not bracket access: TOOL_ANNOTATIONS["constructor"] would
+    // otherwise return the Object constructor — truthy — and this would hand back
+    // a function instead of throwing.
+    const annotations = Object.prototype.hasOwnProperty.call(TOOL_ANNOTATIONS, toolName)
+        ? TOOL_ANNOTATIONS[toolName]
+        : undefined;
     if (!annotations) {
         throw new Error(`No annotations defined for tool "${toolName}". Add it to TOOL_ANNOTATIONS ` +
             `in src/common/annotations.ts — every tool must declare whether it is read-only.`);

package/dist/common/annotations.js.map

@@ -1 +1 @@
-{"version":3,"file":"annotations.js","sourceRoot":"","sources":["../../src/common/annotations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AASH,8BAA8B;AAC9B,MAAM,IAAI,GAAoB,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAErD,+EAA+E;AAC/E,MAAM,MAAM,GAAoB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAEvG,+EAA+E;AAC/E,MAAM,GAAG,GAAoB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AAEnG,0EAA0E;AAC1E,MAAM,SAAS,GAAoB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AAExG,4DAA4D;AAC5D,MAAM,cAAc,GAAoB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAE9G,mFAAmF;AACnF,MAAM,SAAS,GAAoB;IAC/B,YAAY,EAAE,KAAK;IACnB,eAAe,EAAE,IAAI;IACrB,cAAc,EAAE,KAAK;IACrB,aAAa,EAAE,IAAI;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAoC;IAC7D,gDAAgD;IAChD,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,IAAI;IACrB,iBAAiB,EAAE,IAAI;IAEvB,qBAAqB;IACrB,eAAe,EAAE,IAAI;IACrB,iBAAiB,EAAE,IAAI;IACvB,iBAAiB,EAAE,IAAI;IACvB,oEAAoE;IACpE,oBAAoB,EAAE,IAAI;IAC1B,6EAA6E;IAC7E,6EAA6E;IAC7E,iBAAiB,EAAE,cAAc;IACjC,gBAAgB,EAAE,cAAc;IAChC,qBAAqB,EAAE,cAAc;IACrC,mBAAmB,EAAE,cAAc;IAEnC,wEAAwE;IACxE,gDAAgD;IAChD,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,cAAc;IAC5B,kBAAkB,EAAE,cAAc;IAElC,mBAAmB;IACnB,gBAAgB,EAAE,IAAI;IACtB,mBAAmB,EAAE,IAAI;IACzB,iBAAiB,EAAE,MAAM;IAEzB,aAAa;IACb,oBAAoB,EAAE,MAAM;IAC5B,oBAAoB,EAAE,SAAS;IAE/B,eAAe;IACf,kBAAkB,EAAE,IAAI;IACxB,gBAAgB,EAAE,IAAI;IACtB,uBAAuB,EAAE,IAAI;IAC7B,oBAAoB,EAAE,IAAI;IAC1B,2BAA2B,EAAE,IAAI;IACjC,sBAAsB,EAAE,MAAM;IAE9B,YAAY;IACZ,sBAAsB,EAAE,IAAI;IAC5B,mBAAmB,EAAE,IAAI;IAEzB,mBAAmB;IACnB,WAAW,EAAE,IAAI;IACjB,uBAAuB,EAAE,IAAI;IAC7B,uBAAuB,EAAE,IAAI;IAC7B,kEAAkE;IAClE,qBAAqB,EAAE,GAAG;IAE1B,iBAAiB;IACjB,oBAAoB,EAAE,IAAI;IAC1B,YAAY,EAAE,IAAI;IAElB,6EAA6E;IAC7E,cAAc,EAAE,SAAS;IAEzB,mEAAmE;IACnE,YAAY,EAAE,SAAS;IACvB,eAAe,EAAE,SAAS;IAC1B,cAAc,EAAE,SAAS;IACzB,SAAS,EAAE,SAAS;IACpB,uBAAuB,EAAE,IAAI;IAC7B,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,0BAA0B,EAAE,IAAI;IAChC,aAAa,EAAE,IAAI;IACnB,wEAAwE;IACxE,WAAW,EAAE,SAAS;IACtB,SAAS,EAAE,MAAM;IAEjB,cAAc;IACd,qBAAqB,EAAE,IAAI;IAE3B,iBAAiB;IACjB,oBAAoB,EAAE,IAAI;IAC1B,kBAAkB,EAAE,IAAI;IACxB,kBAAkB,EAAE,IAAI;IACxB,kBAAkB,EAAE,MAAM;IAC1B,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,iBAAiB,EAAE,MAAM;IACzB,iBAAiB,EAAE,SAAS;IAC5B,kEAAkE;IAClE,kBAAkB,EAAE,GAAG;IAEvB,eAAe;IACf,UAAU,EAAE,IAAI;IAChB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAElB,0EAA0E;IAC1E,8DAA8D;IAC9D,oBAAoB,EAAE,SAAS;IAC/B,oBAAoB,EAAE,SAAS;IAE/B,qBAAqB;IACrB,YAAY,EAAE,IAAI;IAClB,WAAW,EAAE,IAAI;IAEjB,cAAc;IACd,qBAAqB,EAAE,IAAI;IAC3B,aAAa,EAAE,IAAI;IACnB,gBAAgB,EAAE,IAAI;IAEtB,aAAa;IACb,iBAAiB,EAAE,IAAI;IACvB,gBAAgB,EAAE,IAAI;IACtB,iBAAiB,EAAE,GAAG;IAEtB,mBAAmB;IACnB,gFAAgF;IAChF,6EAA6E;IAC7E,YAAY;IACZ,WAAW,EAAE,SAAS;IACtB,gDAAgD;IAChD,WAAW,EAAE,SAAS;IAEtB,wCAAwC;IACxC,SAAS,EAAE,IAAI;IACf,8CAA8C;IAC9C,gBAAgB,EAAE,MAAM;IACxB,WAAW,EAAE,GAAG;IAChB,gBAAgB,EAAE,GAAG;IACrB,cAAc,EAAE,GAAG;IACnB,cAAc,EAAE,GAAG;IAEnB,mBAAmB;IACnB,sBAAsB,EAAE,IAAI;IAC5B,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,IAAI;IACxB,iBAAiB,EAAE,MAAM;IACzB,sBAAsB,EAAE,GAAG;IAC3B,gBAAgB,EAAE,MAAM;IACxB,+DAA+D;IAC/D,uBAAuB,EAAE,SAAS;IAElC,gBAAgB;IAChB,eAAe,EAAE,MAAM;IAEvB,WAAW;IACX,iBAAiB,EAAE,IAAI;IACvB,0DAA0D;IAC1D,kBAAkB,EAAE,cAAc;CACrC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC3C,MAAM,WAAW,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,WAAW,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACX,oCAAoC,QAAQ,gCAAgC;YACxE,iFAAiF,CACxF,CAAC;IACN,CAAC;IACD,OAAO,WAAW,CAAC;AACvB,CAAC"}
+{"version":3,"file":"annotations.js","sourceRoot":"","sources":["../../src/common/annotations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AASH,8BAA8B;AAC9B,MAAM,IAAI,GAAoB,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AAE1E,+EAA+E;AAC/E,MAAM,MAAM,GAAoB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AAE5H,+EAA+E;AAC/E,MAAM,GAAG,GAAoB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AAExH,0EAA0E;AAC1E,MAAM,SAAS,GAAoB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AAE7H,4DAA4D;AAC5D,MAAM,cAAc,GAAoB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AAEnI;;;;;;;GAOG;AACH,MAAM,SAAS,GAAoB,cAAc,CAAC;AAElD,MAAM,CAAC,MAAM,gBAAgB,GAAoC;IAC7D,2EAA2E;IAC3E,6EAA6E;IAC7E,yBAAyB;IACzB,kBAAkB,EAAE,IAAI;IAExB,gDAAgD;IAChD,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,IAAI;IACrB,iBAAiB,EAAE,IAAI;IAEvB,qBAAqB;IACrB,eAAe,EAAE,IAAI;IACrB,iBAAiB,EAAE,IAAI;IACvB,iBAAiB,EAAE,IAAI;IACvB,oEAAoE;IACpE,oBAAoB,EAAE,IAAI;IAC1B,6EAA6E;IAC7E,6EAA6E;IAC7E,iBAAiB,EAAE,cAAc;IACjC,gBAAgB,EAAE,cAAc;IAChC,qBAAqB,EAAE,cAAc;IACrC,mBAAmB,EAAE,cAAc;IAEnC,wEAAwE;IACxE,gDAAgD;IAChD,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,cAAc;IAC5B,kBAAkB,EAAE,cAAc;IAElC,mBAAmB;IACnB,gBAAgB,EAAE,IAAI;IACtB,mBAAmB,EAAE,IAAI;IACzB,iBAAiB,EAAE,MAAM;IAEzB,aAAa;IACb,oBAAoB,EAAE,MAAM;IAC5B,oBAAoB,EAAE,SAAS;IAE/B,eAAe;IACf,kBAAkB,EAAE,IAAI;IACxB,gBAAgB,EAAE,IAAI;IACtB,uBAAuB,EAAE,IAAI;IAC7B,oBAAoB,EAAE,IAAI;IAC1B,2BAA2B,EAAE,IAAI;IACjC,sBAAsB,EAAE,MAAM;IAE9B,YAAY;IACZ,sBAAsB,EAAE,IAAI;IAC5B,mBAAmB,EAAE,IAAI;IAEzB,mBAAmB;IACnB,WAAW,EAAE,IAAI;IACjB,uBAAuB,EAAE,IAAI;IAC7B,uBAAuB,EAAE,IAAI;IAC7B,kEAAkE;IAClE,qBAAqB,EAAE,GAAG;IAE1B,iBAAiB;IACjB,oBAAoB,EAAE,IAAI;IAC1B,YAAY,EAAE,IAAI;IAElB,6EAA6E;IAC7E,cAAc,EAAE,SAAS;IAEzB,mEAAmE;IACnE,YAAY,EAAE,SAAS;IACvB,eAAe,EAAE,SAAS;IAC1B,cAAc,EAAE,SAAS;IACzB,SAAS,EAAE,SAAS;IACpB,uBAAuB,EAAE,IAAI;IAC7B,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,0BAA0B,EAAE,IAAI;IAChC,aAAa,EAAE,IAAI;IACnB,wEAAwE;IACxE,WAAW,EAAE,SAAS;IACtB,SAAS,EAAE,MAAM;IAEjB,cAAc;IACd,qBAAqB,EAAE,IAAI;IAE3B,iBAAiB;IACjB,oBAAoB,EAAE,IAAI;IAC1B,kBAAkB,EAAE,IAAI;IACxB,kBAAkB,EAAE,IAAI;IACxB,kBAAkB,EAAE,MAAM;IAC1B,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,iBAAiB,EAAE,MAAM;IACzB,iBAAiB,EAAE,SAAS;IAC5B,kEAAkE;IAClE,kBAAkB,EAAE,GAAG;IAEvB,eAAe;IACf,UAAU,EAAE,IAAI;IAChB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAElB,0EAA0E;IAC1E,8DAA8D;IAC9D,oBAAoB,EAAE,SAAS;IAC/B,oBAAoB,EAAE,SAAS;IAE/B,qBAAqB;IACrB,YAAY,EAAE,IAAI;IAClB,WAAW,EAAE,IAAI;IAEjB,cAAc;IACd,qBAAqB,EAAE,IAAI;IAC3B,aAAa,EAAE,IAAI;IACnB,gBAAgB,EAAE,IAAI;IAEtB,aAAa;IACb,iBAAiB,EAAE,IAAI;IACvB,gBAAgB,EAAE,IAAI;IACtB,iBAAiB,EAAE,GAAG;IAEtB,mBAAmB;IACnB,gFAAgF;IAChF,6EAA6E;IAC7E,YAAY;IACZ,WAAW,EAAE,SAAS;IACtB,gDAAgD;IAChD,WAAW,EAAE,SAAS;IAEtB,wCAAwC;IACxC,SAAS,EAAE,IAAI;IACf,8CAA8C;IAC9C,gBAAgB,EAAE,MAAM;IACxB,WAAW,EAAE,GAAG;IAChB,gBAAgB,EAAE,GAAG;IACrB,cAAc,EAAE,GAAG;IACnB,cAAc,EAAE,GAAG;IAEnB,mBAAmB;IACnB,sBAAsB,EAAE,IAAI;IAC5B,gBAAgB,EAAE,IAAI;IACtB,kBAAkB,EAAE,IAAI;IACxB,iBAAiB,EAAE,MAAM;IACzB,sBAAsB,EAAE,GAAG;IAC3B,gBAAgB,EAAE,MAAM;IACxB,+DAA+D;IAC/D,uBAAuB,EAAE,SAAS;IAElC,gBAAgB;IAChB,eAAe,EAAE,MAAM;IAEvB,WAAW;IACX,iBAAiB,EAAE,IAAI;IACvB,0DAA0D;IAC1D,kBAAkB,EAAE,cAAc;CACrC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC3C,4EAA4E;IAC5E,8EAA8E;IAC9E,kCAAkC;IAClC,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC;QAChF,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC;QAC5B,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,WAAW,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACX,oCAAoC,QAAQ,gCAAgC;YACxE,iFAAiF,CACxF,CAAC;IACN,CAAC;IACD,OAAO,WAAW,CAAC;AACvB,CAAC"}

package/dist/common/connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/common/connection.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAEnB,MAAM,4BAA4B,CAAC;AA4BpC;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,kBAAkB,CAAC,CAkD7B;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAKtD;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAeD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GACpE,OAAO,CAIT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,CAAC,CAAC,CAAC,GACtD,OAAO,CAAC,CAAC,CAAC,CAeZ"}
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/common/connection.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAEnB,MAAM,4BAA4B,CAAC;AA+BpC;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,kBAAkB,CAAC,CAgD7B;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAKtD;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAeD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GACpE,OAAO,CAIT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,CAAC,CAAC,CAAC,GACtD,OAAO,CAAC,CAAC,CAAC,CAeZ"}

package/dist/common/connection.js

@@ -1,5 +1,7 @@
 import { getCredentials } from "@servicenow/sdk-cli/dist/auth/index.js";
 import { ServiceNowInstance, } from "@sonisoft/now-sdk-ext-core";
+import { getLogger } from "./logging.js";
+const log = getLogger("connection");
 /** Cache TTL — 30 minutes. ServiceNow sessions typically expire after idle time. */
 const CACHE_TTL_MS = 30 * 60 * 1000;
 const instanceCache = new Map();
@@ -36,7 +38,7 @@ export async function getServiceNowInstance(authAlias) {
             return cached.instance;
         }
         // TTL expired — evict and create fresh
-        console.error(`[connection] Cache TTL expired for "${resolvedAlias}", refreshing session`);
+        log.debug("Cache TTL expired, refreshing session", { alias: resolvedAlias });
         instanceCache.delete(resolvedAlias);
     }
     const credential = await getCredentials(resolvedAlias);
@@ -134,7 +136,9 @@ export async function withConnectionRetry(authAlias, operation) {
     }
     catch (error) {
         if (isRetryableError(error)) {
-            console.error(`[connection] Retryable error detected, refreshing session and retrying: ${error}`);
+            // The error went into the message before, unredacted — an auth or HTTP failure
+            // here carries a live session. As metadata it goes through redaction.
+            log.warn("Retryable error, refreshing session and retrying", { error });
             clearInstance(authAlias);
             const freshInstance = await getServiceNowInstance(authAlias);
             return await operation(freshInstance);

package/dist/common/connection.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/common/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EACL,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AAQpC,oFAAoF;AACpF,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsB,CAAC;AAEpD;;;GAGG;AACH,SAAS,YAAY,CAAC,SAAkB;IACtC,MAAM,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,uDAAuD;YACrD,oFAAoF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAkB;IAElB,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;QAC1C,IAAI,GAAG,GAAG,YAAY,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,uCAAuC;QACvC,OAAO,CAAC,KAAK,CACX,uCAAuC,aAAa,uBAAuB,CAC5E,CAAC;QACF,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,sEAAsE;QACtE,wEAAwE;QACxE,2BAA2B;QAC3B,EAAE;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,wCAAwC,aAAa,KAAK;YACxD,CAAC,UAAU;gBACT,CAAC,CAAC,gDAAgD;oBAChD,+CAA+C;gBACjD,CAAC,CAAC,qEAAqE;oBACrE,+DAA+D;oBAC/D,6DAA6D,CAAC,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAA+B;QAC7C,KAAK,EAAE,aAAa;QACpB,UAAU;KACX,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACpD,aAAa,CAAC,GAAG,CAAC,aAAa,EAAE;QAC/B,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,SAAkB;IAC9C,MAAM,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACxD,IAAI,QAAQ,EAAE,CAAC;QACb,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,KAAK,GAAG,CAAC;AACrD,CAAC;AAED,MAAM,kBAAkB,GACtB,+FAA+F,CAAC;AAElG;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAqE;IAErE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;IAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAA6B,EAC7B,SAAuD;IAEvD,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CACX,2EAA2E,KAAK,EAAE,CACnF,CAAC;YACF,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;YAC7D,OAAO,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/common/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EACL,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;AAQpC,oFAAoF;AACpF,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsB,CAAC;AAEpD;;;GAGG;AACH,SAAS,YAAY,CAAC,SAAkB;IACtC,MAAM,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,uDAAuD;YACrD,oFAAoF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAkB;IAElB,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;QAC1C,IAAI,GAAG,GAAG,YAAY,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,uCAAuC;QACvC,GAAG,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7E,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,sEAAsE;QACtE,wEAAwE;QACxE,2BAA2B;QAC3B,EAAE;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,wCAAwC,aAAa,KAAK;YACxD,CAAC,UAAU;gBACT,CAAC,CAAC,gDAAgD;oBAChD,+CAA+C;gBACjD,CAAC,CAAC,qEAAqE;oBACrE,+DAA+D;oBAC/D,6DAA6D,CAAC,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAA+B;QAC7C,KAAK,EAAE,aAAa;QACpB,UAAU;KACX,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACpD,aAAa,CAAC,GAAG,CAAC,aAAa,EAAE;QAC/B,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,SAAkB;IAC9C,MAAM,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACxD,IAAI,QAAQ,EAAE,CAAC;QACb,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,KAAK,GAAG,CAAC;AACrD,CAAC;AAED,MAAM,kBAAkB,GACtB,+FAA+F,CAAC;AAElG;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAqE;IAErE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;IAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAA6B,EAC7B,SAAuD;IAEvD,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,+EAA+E;YAC/E,sEAAsE;YACtE,GAAG,CAAC,IAAI,CAAC,kDAAkD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACxE,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;YAC7D,OAAO,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/common/logging.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Logging setup for the MCP server.
+ *
+ * Two things make this different from the CLI.
+ *
+ * First, there are no flags — an MCP server is launched by a client with an argv it
+ * does not control — so configuration is environment only: NEX_LOG_FILE, NEX_LOG_DIR,
+ * NEX_LOG_LEVEL, read by core itself.
+ *
+ * Second, this process is the reason file logging had to become opt-in at all. The
+ * server's working directory is chosen by whoever launched it, and core used to create
+ * ./logs/ there on import, unconditionally, without this server ever asking to log
+ * anything (NEX-3).
+ *
+ * stdout is the JSON-RPC transport. Everything here goes to stderr, and nothing in this
+ * process may ever write to fd 1.
+ */
+import { Logger } from "@sonisoft/now-sdk-ext-core";
+/**
+ * Configures process-wide logging. Call once, before anything constructs a manager.
+ *
+ * Explicit rather than relying on core reading the environment on its own: the
+ * stderr-only guarantee is this server's to make, so it should be stated here where it
+ * can be read and tested, not inherited by accident.
+ */
+export declare function initLogging(): void;
+/**
+ * Returns a named logger.
+ *
+ * Safe to call before `initLogging()`, and several modules do: ES modules evaluate
+ * every import before the importing module's own top-level statements, so the
+ * `const log = getLogger(...)` in connection.ts, progress.ts and tool-packages.ts all
+ * run BEFORE the `initLogging()` call in index.ts, even though it sits above them in
+ * source order.
+ *
+ * That is fine because nothing is decided at construction time. `Logger` only stores a
+ * label; core builds the underlying winston logger on the first WRITE, resolves config
+ * lazily at that point, and rebuilds when configuration changes. So a logger built
+ * during import picks up whatever `initLogging()` sets, provided nothing logs during
+ * module evaluation — and nothing does.
+ *
+ * This is not left to inspection: the "still reports startup breadcrumbs on stderr"
+ * case in test/unit/common/logging.test.ts only passes if `consoleLevel: info` from
+ * `initLogging()` reached a logger that was constructed before it ran. Core's default
+ * is `warn`, which would suppress those lines.
+ */
+export declare function getLogger(name: string): Logger;
+//# sourceMappingURL=logging.d.ts.map

package/dist/common/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../src/common/logging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,EAAoB,MAAM,4BAA4B,CAAC;AAItE;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,IAAI,CAelC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C"}

package/dist/common/logging.js

@@ -0,0 +1,65 @@
+/**
+ * Logging setup for the MCP server.
+ *
+ * Two things make this different from the CLI.
+ *
+ * First, there are no flags — an MCP server is launched by a client with an argv it
+ * does not control — so configuration is environment only: NEX_LOG_FILE, NEX_LOG_DIR,
+ * NEX_LOG_LEVEL, read by core itself.
+ *
+ * Second, this process is the reason file logging had to become opt-in at all. The
+ * server's working directory is chosen by whoever launched it, and core used to create
+ * ./logs/ there on import, unconditionally, without this server ever asking to log
+ * anything (NEX-3).
+ *
+ * stdout is the JSON-RPC transport. Everything here goes to stderr, and nothing in this
+ * process may ever write to fd 1.
+ */
+import { Logger, configureLogging } from "@sonisoft/now-sdk-ext-core";
+let configured = false;
+/**
+ * Configures process-wide logging. Call once, before anything constructs a manager.
+ *
+ * Explicit rather than relying on core reading the environment on its own: the
+ * stderr-only guarantee is this server's to make, so it should be stated here where it
+ * can be read and tested, not inherited by accident.
+ */
+export function initLogging() {
+    if (configured) {
+        return;
+    }
+    configured = true;
+    configureLogging({
+        // stderr IS this server's log channel — an operator reading `docker logs` or a
+        // client's server pane sees only this. `warn` (core's default, right for a CLI
+        // where the terminal is the user's) would silence the startup breadcrumbs that
+        // say which tool package loaded and whether credentials resolved.
+        consoleLevel: process.env.NEX_LOG_LEVEL?.trim() || "info",
+        // File logging stays off unless NEX_LOG_FILE/NEX_LOG_DIR asks for it. Core
+        // resolves those; naming them here would override an operator's NEX_LOG_FILE=0.
+    });
+}
+/**
+ * Returns a named logger.
+ *
+ * Safe to call before `initLogging()`, and several modules do: ES modules evaluate
+ * every import before the importing module's own top-level statements, so the
+ * `const log = getLogger(...)` in connection.ts, progress.ts and tool-packages.ts all
+ * run BEFORE the `initLogging()` call in index.ts, even though it sits above them in
+ * source order.
+ *
+ * That is fine because nothing is decided at construction time. `Logger` only stores a
+ * label; core builds the underlying winston logger on the first WRITE, resolves config
+ * lazily at that point, and rebuilds when configuration changes. So a logger built
+ * during import picks up whatever `initLogging()` sets, provided nothing logs during
+ * module evaluation — and nothing does.
+ *
+ * This is not left to inspection: the "still reports startup breadcrumbs on stderr"
+ * case in test/unit/common/logging.test.ts only passes if `consoleLevel: info` from
+ * `initLogging()` reached a logger that was constructed before it ran. Core's default
+ * is `warn`, which would suppress those lines.
+ */
+export function getLogger(name) {
+    return new Logger(name);
+}
+//# sourceMappingURL=logging.js.map

package/dist/common/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../../src/common/logging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,IAAI,UAAU,GAAG,KAAK,CAAC;AAEvB;;;;;;GAMG;AACH,MAAM,UAAU,WAAW;IACvB,IAAI,UAAU,EAAE,CAAC;QACb,OAAO;IACX,CAAC;IACD,UAAU,GAAG,IAAI,CAAC;IAElB,gBAAgB,CAAC;QACb,+EAA+E;QAC/E,+EAA+E;QAC/E,+EAA+E;QAC/E,kEAAkE;QAClE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM;QACzD,2EAA2E;QAC3E,gFAAgF;KACnF,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IAClC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/common/progress.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"progress.d.ts","sourceRoot":"","sources":["../../src/common/progress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAE5F,MAAM,MAAM,SAAS,GAAG,mBAAmB,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAE/E,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;AAEzD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,gBAAgB,GAAG,SAAS,CA8B3F"}
+{"version":3,"file":"progress.d.ts","sourceRoot":"","sources":["../../src/common/progress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAM5F,MAAM,MAAM,SAAS,GAAG,mBAAmB,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAE/E,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;AAEzD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,gBAAgB,GAAG,SAAS,CA8B3F"}

package/dist/common/progress.js

@@ -16,6 +16,8 @@
  * left undefined. Inventing a percentage from a message count would be a lie that
  * gets less accurate the longer an operation runs.
  */
+import { getLogger } from "./logging.js";
+const log = getLogger("progress");
 /**
  * Returns an `onProgress` callback to hand to core, or `undefined` when the client
  * did not request progress.
@@ -48,9 +50,9 @@ export function progressReporter(extra) {
                 message,
             },
         }).catch((error) => {
-            const detail = error instanceof Error ? error.message : String(error);
-            // stderr, never stdout: stdout is the JSON-RPC transport.
-            console.error(`[progress] failed to send notification: ${detail}`);
+            // stderr, never stdout: stdout is the JSON-RPC transport. Via the logger
+            // so the error is redacted rather than stringified into the message.
+            log.debug("Failed to send progress notification", { error });
         });
     };
 }

package/dist/common/progress.js.map

@@ -1 +1 @@
-{"version":3,"file":"progress.js","sourceRoot":"","sources":["../../src/common/progress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAUH;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IACzD,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC;IAC1C,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QACvC,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,uBAAuB;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC;IACnB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,CAAC,OAAe,EAAE,EAAE;QACvB,IAAI,IAAI,CAAC,CAAC;QACV,4EAA4E;QAC5E,yEAAyE;QACzE,KAAK,IAAI,CAAC,gBAAgB,CAAC;YACvB,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE;gBACJ,aAAa,EAAE,KAAK;gBACpB,QAAQ,EAAE,IAAI;gBACd,OAAO;aACV;SACJ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,0DAA0D;YAC1D,OAAO,CAAC,KAAK,CAAC,2CAA2C,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"progress.js","sourceRoot":"","sources":["../../src/common/progress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;AAOlC;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IACzD,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC;IAC1C,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QACvC,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,uBAAuB;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC;IACnB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,CAAC,OAAe,EAAE,EAAE;QACvB,IAAI,IAAI,CAAC,CAAC;QACV,4EAA4E;QAC5E,yEAAyE;QACzE,KAAK,IAAI,CAAC,gBAAgB,CAAC;YACvB,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE;gBACJ,aAAa,EAAE,KAAK;gBACpB,QAAQ,EAAE,IAAI;gBACd,OAAO;aACV;SACJ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,yEAAyE;YACzE,qEAAqE;YACrE,GAAG,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;AACN,CAAC"}

package/dist/common/tool-packages.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Resolves MCP_TOOL_PACKAGE into the set of tools to register.
+ *
+ * Every failure mode here degrades toward MORE tools, never fewer. A typo in the
+ * env var that silently exposed a smaller surface would look like the server was
+ * broken — tools simply missing, with no error to search for. Falling back to
+ * `full` and saying so on stderr is the recoverable direction.
+ */
+export interface ResolvedPackage {
+    /** Package names that were actually applied. */
+    names: string[];
+    /** Tool names to register, already filtered to ones that exist. */
+    tools: string[];
+    /** Requested names that matched no package. */
+    unknownPackages: string[];
+    /** Tools named by a package that this server does not have. */
+    unknownTools: string[];
+    /** True when the requested selection could not be used and `full` was substituted. */
+    fellBack: boolean;
+}
+/**
+ * Resolves a selection into a concrete tool set.
+ *
+ * `selection` is the raw env value: one package name, or several comma-separated,
+ * in which case the result is their UNION. Union rather than intersection because
+ * combining packages is how someone expresses "I do service desk work AND change
+ * approvals" — an intersection of two role packages is almost always empty.
+ */
+export declare function resolveToolPackage(selection: string | undefined): ResolvedPackage;
+/**
+ * Reports the resolution on stderr.
+ *
+ * stderr, never stdout — stdout is the JSON-RPC transport, and a stray byte
+ * there breaks the client's parser. Goes through the logger so it obeys
+ * NEX_LOG_LEVEL and reaches the log file when one is configured; these are the
+ * breadcrumbs that explain why a client sees the tools it sees.
+ */
+export declare function reportResolution(resolved: ResolvedPackage): void;
+//# sourceMappingURL=tool-packages.d.ts.map

package/dist/common/tool-packages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-packages.d.ts","sourceRoot":"","sources":["../../src/common/tool-packages.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgBH,MAAM,WAAW,eAAe;IAC5B,gDAAgD;IAChD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mEAAmE;IACnE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,+CAA+C;IAC/C,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,+DAA+D;IAC/D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sFAAsF;IACtF,QAAQ,EAAE,OAAO,CAAC;CACrB;AAgBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,eAAe,CAuEjF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAuBhE"}

package/dist/common/tool-packages.js

@@ -0,0 +1,132 @@
+/**
+ * Resolves MCP_TOOL_PACKAGE into the set of tools to register.
+ *
+ * Every failure mode here degrades toward MORE tools, never fewer. A typo in the
+ * env var that silently exposed a smaller surface would look like the server was
+ * broken — tools simply missing, with no error to search for. Falling back to
+ * `full` and saying so on stderr is the recoverable direction.
+ */
+import { TOOL_PACKAGES, DEFAULT_PACKAGE } from "../config/tool-packages.js";
+import { TOOL_ANNOTATIONS } from "./annotations.js";
+import { allToolNames } from "../tools/registry.js";
+import { getLogger } from "./logging.js";
+const log = getLogger("tool-packages");
+/** Sentinel in a package's `tools` meaning "everything". */
+const ALL = "*";
+/** Sentinel meaning "every tool annotated readOnlyHint: true". */
+const READONLY = "@readonly";
+/**
+ * Tools annotated as read-only. Derived, so it cannot drift from the annotations.
+ *
+ * Filtered to the registry deliberately. TOOL_ANNOTATIONS covers one tool the
+ * registry does not — `list_tool_packages`, which is registered unconditionally —
+ * and returning it here would put a name in the resolved set that has no
+ * registrar, crashing startup on `TOOL_REGISTRY[name](server)`.
+ */
+function readonlyTools(known) {
+    return Object.entries(TOOL_ANNOTATIONS)
+        .filter(([name, a]) => a.readOnlyHint === true && known.has(name))
+        .map(([name]) => name);
+}
+/**
+ * Resolves a selection into a concrete tool set.
+ *
+ * `selection` is the raw env value: one package name, or several comma-separated,
+ * in which case the result is their UNION. Union rather than intersection because
+ * combining packages is how someone expresses "I do service desk work AND change
+ * approvals" — an intersection of two role packages is almost always empty.
+ */
+export function resolveToolPackage(selection) {
+    const known = new Set(allToolNames());
+    const requested = (selection ?? "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+    if (requested.length === 0) {
+        return {
+            names: [DEFAULT_PACKAGE],
+            tools: allToolNames(),
+            unknownPackages: [],
+            unknownTools: [],
+            fellBack: false,
+        };
+    }
+    const names = [];
+    const unknownPackages = [];
+    const selected = new Set();
+    const namedButMissing = new Set();
+    for (const name of requested) {
+        // hasOwnProperty, not bracket access. TOOL_PACKAGES is an object literal,
+        // so TOOL_PACKAGES["constructor"] returns the Object constructor — truthy,
+        // with no `.tools` — and `for (const t of pkg.tools)` then throws at module
+        // load, before the uncaughtException handler exists. MCP_TOOL_PACKAGE=
+        // constructor would crash the server rather than falling back, which is the
+        // exact opposite of this file's stated invariant.
+        const pkg = Object.prototype.hasOwnProperty.call(TOOL_PACKAGES, name)
+            ? TOOL_PACKAGES[name]
+            : undefined;
+        if (!pkg) {
+            unknownPackages.push(name);
+            continue;
+        }
+        names.push(name);
+        for (const tool of pkg.tools) {
+            if (tool === ALL) {
+                allToolNames().forEach((t) => selected.add(t));
+            }
+            else if (tool === READONLY) {
+                readonlyTools(known).forEach((t) => selected.add(t));
+            }
+            else if (known.has(tool)) {
+                selected.add(tool);
+            }
+            else {
+                // Expected for packages naming tools from open tickets; still
+                // reported, because the same path catches a genuine typo.
+                namedButMissing.add(tool);
+            }
+        }
+    }
+    // Nothing usable was requested. Fall back rather than register an empty
+    // server: a server with no tools is indistinguishable from a broken one.
+    if (names.length === 0) {
+        return {
+            names: [DEFAULT_PACKAGE],
+            tools: allToolNames(),
+            unknownPackages,
+            unknownTools: [],
+            fellBack: true,
+        };
+    }
+    return {
+        names,
+        tools: [...selected].sort(),
+        unknownPackages,
+        unknownTools: [...namedButMissing].sort(),
+        fellBack: false,
+    };
+}
+/**
+ * Reports the resolution on stderr.
+ *
+ * stderr, never stdout — stdout is the JSON-RPC transport, and a stray byte
+ * there breaks the client's parser. Goes through the logger so it obeys
+ * NEX_LOG_LEVEL and reaches the log file when one is configured; these are the
+ * breadcrumbs that explain why a client sees the tools it sees.
+ */
+export function reportResolution(resolved) {
+    const { names, tools, unknownPackages, unknownTools, fellBack } = resolved;
+    if (unknownPackages.length > 0) {
+        const available = Object.keys(TOOL_PACKAGES).sort().join(", ");
+        log.warn(`Unknown tool package(s): ${unknownPackages.join(", ")}. ` +
+            `Available: ${available}.` +
+            (fellBack ? ` Falling back to "${DEFAULT_PACKAGE}".` : ""));
+    }
+    if (unknownTools.length > 0) {
+        log.warn(`${unknownTools.length} tool(s) named by a package do not exist ` +
+            `on this server and were skipped: ${unknownTools.join(", ")}. ` +
+            `This is expected for tools from work that has not landed yet.`);
+    }
+    log.info(`Active tool package(s): ${names.join(", ")} — ${tools.length} of ${allToolNames().length} tools registered`);
+}
+//# sourceMappingURL=tool-packages.js.map

package/dist/common/tool-packages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-packages.js","sourceRoot":"","sources":["../../src/common/tool-packages.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,GAAG,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;AAEvC,4DAA4D;AAC5D,MAAM,GAAG,GAAG,GAAG,CAAC;AAEhB,kEAAkE;AAClE,MAAM,QAAQ,GAAG,WAAW,CAAC;AAe7B;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,KAAkB;IACrC,OAAO,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACjE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAA6B;IAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;SAC9B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEjC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACH,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,KAAK,EAAE,YAAY,EAAE;YACrB,eAAe,EAAE,EAAE;YACnB,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,KAAK;SAClB,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC3B,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,4EAA4E;QAC5E,kDAAkD;QAClD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC;YACjE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS;QACb,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACf,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,aAAa,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,CAAC;iBAAM,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACJ,8DAA8D;gBAC9D,0DAA0D;gBAC1D,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;QACL,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACH,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,KAAK,EAAE,YAAY,EAAE;YACrB,eAAe;YACf,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,IAAI;SACjB,CAAC;IACN,CAAC;IAED,OAAO;QACH,KAAK;QACL,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;QAC3B,eAAe;QACf,YAAY,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,EAAE;QACzC,QAAQ,EAAE,KAAK;KAClB,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAyB;IACtD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAE3E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,CACJ,4BAA4B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACtD,cAAc,SAAS,GAAG;YAC1B,CAAC,QAAQ,CAAC,CAAC,CAAC,qBAAqB,eAAe,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CACjE,CAAC;IACN,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CACJ,GAAG,YAAY,CAAC,MAAM,2CAA2C;YAC7D,oCAAoC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC/D,+DAA+D,CACtE,CAAC;IACN,CAAC;IAED,GAAG,CAAC,IAAI,CACJ,2BAA2B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,MAAM,mBAAmB,CAC/G,CAAC;AACN,CAAC"}

package/dist/config/tool-packages.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Tool packages — named subsets of the tool surface.
+ *
+ * All 86 tools are registered by default, and their descriptions are long by
+ * design (`execute_script`'s runs to about thirteen lines, because it has to
+ * teach scoped-vs-global name qualification). That is a fixed cost paid on every
+ * session, and model tool-selection accuracy degrades as the option count grows.
+ * A user doing service-desk work does not need Flow Designer, ATF, or app
+ * publishing in front of them.
+ *
+ * Selected with MCP_TOOL_PACKAGE. Unset means "full", so the default behaviour
+ * is unchanged.
+ *
+ * ---
+ *
+ * ON NAMING TOOLS THAT DO NOT EXIST YET
+ *
+ * Packages may reference tools this server does not have. That is deliberate,
+ * not sloppiness: NEX-38 (user and group tools), NEX-39 (incident and change
+ * tools) and NEX-46 (workflow execution) are all open, and their tools belong in
+ * these packages the day they land. Naming them now means the package is already
+ * right rather than something someone has to remember to revisit.
+ *
+ * Unknown names are reported once at startup and skipped. They are a warning
+ * rather than an error precisely because forward references are expected — but
+ * they are still surfaced, because the same warning catches a genuine typo.
+ */
+export interface ToolPackage {
+    /** Shown by list_tool_packages, so write it for whoever picks a package. */
+    description: string;
+    /** Tool names, or ["*"] for everything. May name tools that do not exist yet. */
+    tools: string[];
+}
+export declare const TOOL_PACKAGES: Record<string, ToolPackage>;
+/** The package used when MCP_TOOL_PACKAGE is unset or unusable. */
+export declare const DEFAULT_PACKAGE = "full";
+//# sourceMappingURL=tool-packages.d.ts.map

package/dist/config/tool-packages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-packages.d.ts","sourceRoot":"","sources":["../../src/config/tool-packages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,WAAW;IACxB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,KAAK,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAkLrD,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,eAAe,SAAS,CAAC"}