@superblocksteam/mcp-server 2.0.0-SNAPSHOT.12e637302a23edc8

package/dist/auth/commands.js

@@ -0,0 +1,71 @@
+import { getLocalTokenWithUrlIfExists } from "@superblocksteam/util";
+import { normalizeBaseUrl } from "../urls.js";
+import { getFlagValue } from "../utils/args.js";
+import { getMcpAuthFilePath, listStoredOrigins, upsertAuthToken, } from "./store.js";
+function getUsageText() {
+    return [
+        "Usage:",
+        "  superblocks-mcp                                  Start the MCP server (stdio)",
+        "  superblocks-mcp login --token <token>             Authenticate with Superblocks",
+        "  superblocks-mcp setup --client cursor              Write MCP config for Cursor",
+        "  superblocks-mcp setup --client claude               Write MCP config for Claude Code",
+        "  superblocks-mcp setup --client cursor --dry-run    Preview without writing",
+    ].join("\n");
+}
+async function addAuth(args) {
+    const baseUrl = getFlagValue(args, "--base-url");
+    const token = getFlagValue(args, "--token") ??
+        process.env.SUPERBLOCKS_TOKEN ??
+        process.env.SUPERBLOCKS_API_TOKEN;
+    if (!baseUrl || !token) {
+        throw new Error("auth add requires --base-url and --token (or SUPERBLOCKS_TOKEN / SUPERBLOCKS_API_TOKEN).");
+    }
+    const normalizedBaseUrl = await upsertAuthToken(baseUrl, token);
+    console.log(`Stored API token for ${normalizedBaseUrl} in ${getMcpAuthFilePath()}`);
+}
+async function importCurrentAuth() {
+    const currentCliAuth = await getLocalTokenWithUrlIfExists();
+    if (!currentCliAuth || !("token" in currentCliAuth)) {
+        throw new Error("No logged-in Superblocks CLI session found to import. Run 'superblocks login' first.");
+    }
+    const normalizedBaseUrl = await upsertAuthToken(currentCliAuth.superblocksBaseUrl, currentCliAuth.token);
+    console.log(`Imported API token for ${normalizedBaseUrl} into ${getMcpAuthFilePath()}`);
+}
+async function listAuth() {
+    const origins = await listStoredOrigins();
+    if (origins.length === 0) {
+        console.log(`No stored origins in ${getMcpAuthFilePath()}`);
+        return;
+    }
+    console.log(`Stored origins in ${getMcpAuthFilePath()}:`);
+    for (const origin of origins) {
+        console.log(`- ${normalizeBaseUrl(origin)}`);
+    }
+}
+export async function maybeRunAuthCommand(args) {
+    if (args.length === 0 || args[0] !== "auth") {
+        return false;
+    }
+    const subcommand = args[1];
+    switch (subcommand) {
+        case "add": {
+            await addAuth(args.slice(2));
+            return true;
+        }
+        case "import-current": {
+            await importCurrentAuth();
+            return true;
+        }
+        case "list": {
+            await listAuth();
+            return true;
+        }
+        default: {
+            throw new Error(`Unknown auth subcommand '${subcommand ?? ""}'.\n\n${getUsageText()}`);
+        }
+    }
+}
+export function getMcpUsageText() {
+    return getUsageText();
+}
+//# sourceMappingURL=commands.js.map

package/dist/auth/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/auth/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,SAAS,YAAY;IACnB,OAAO;QACL,QAAQ;QACR,iFAAiF;QACjF,mFAAmF;QACnF,kFAAkF;QAClF,wFAAwF;QACxF,8EAA8E;KAC/E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAc;IACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,KAAK,GACT,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAEpC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CACT,wBAAwB,iBAAiB,OAAO,kBAAkB,EAAE,EAAE,CACvE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB;IAC9B,MAAM,cAAc,GAAG,MAAM,4BAA4B,EAAE,CAAC;IAC5D,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,OAAO,IAAI,cAAc,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,eAAe,CAC7C,cAAc,CAAC,kBAAkB,EACjC,cAAc,CAAC,KAAK,CACrB,CAAC;IACF,OAAO,CAAC,GAAG,CACT,0BAA0B,iBAAiB,SAAS,kBAAkB,EAAE,EAAE,CAC3E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ;IACrB,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,wBAAwB,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,qBAAqB,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAc;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,iBAAiB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,QAAQ,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,IAAI,KAAK,CACb,4BAA4B,UAAU,IAAI,EAAE,SAAS,YAAY,EAAE,EAAE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC"}

package/dist/auth/context.d.ts

@@ -0,0 +1,7 @@
+export type AuthContext = {
+    token: string;
+    baseUrl: string;
+};
+export declare function getAuthContext(): AuthContext | undefined;
+export declare function runWithAuthContext<T>(context: AuthContext, fn: () => T | Promise<T>): T | Promise<T>;
+//# sourceMappingURL=context.d.ts.map

package/dist/auth/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/auth/context.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,WAAW,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAI7D,wBAAgB,cAAc,IAAI,WAAW,GAAG,SAAS,CAExD;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,OAAO,EAAE,WAAW,EACpB,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACvB,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEhB"}

package/dist/auth/context.js

@@ -0,0 +1,9 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+const authStore = new AsyncLocalStorage();
+export function getAuthContext() {
+    return authStore.getStore();
+}
+export function runWithAuthContext(context, fn) {
+    return authStore.run(context, fn);
+}
+//# sourceMappingURL=context.js.map

package/dist/auth/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/auth/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAIrD,MAAM,SAAS,GAAG,IAAI,iBAAiB,EAAe,CAAC;AAEvD,MAAM,UAAU,cAAc;IAC5B,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAAoB,EACpB,EAAwB;IAExB,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC"}

package/dist/auth/login.d.ts

@@ -0,0 +1,10 @@
+type ValidateResult = {
+    name: string;
+};
+type LoginCommandOptions = {
+    authFilePath?: string;
+    validateToken?: (token: string, baseUrl: string) => Promise<ValidateResult>;
+};
+export declare function maybeRunLoginCommand(args: string[], options?: LoginCommandOptions): Promise<boolean>;
+export {};
+//# sourceMappingURL=login.d.ts.map

package/dist/auth/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAWA,KAAK,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,KAAK,mBAAmB,GAAG;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7E,CAAC;AAWF,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CA4ClB"}

package/dist/auth/login.js

@@ -0,0 +1,48 @@
+import { dirname } from "node:path";
+import fs from "fs-extra";
+import { resolveAuthFilePath } from "@superblocksteam/util";
+import { createSdk } from "../sdk/create-sdk.js";
+import { getFlagValue } from "../utils/args.js";
+const DEFAULT_BASE_URL = "https://app.superblocks.com";
+async function defaultValidateToken(token, baseUrl) {
+    const sdk = createSdk(token, baseUrl);
+    const response = await sdk.fetchCurrentUser();
+    return { name: response.user.name };
+}
+export async function maybeRunLoginCommand(args, options = {}) {
+    if (args.length === 0 || args[0] !== "login") {
+        return false;
+    }
+    const subArgs = args.slice(1);
+    const token = getFlagValue(subArgs, "--token") ??
+        process.env.SUPERBLOCKS_TOKEN ??
+        process.env.SUPERBLOCKS_API_TOKEN;
+    if (!token) {
+        throw new Error("A token is required. Pass --token <token>, or set SUPERBLOCKS_TOKEN.\n" +
+            "You can find your API key at https://app.superblocks.com/personal-settings#apiKey");
+    }
+    const baseUrl = getFlagValue(subArgs, "--base-url") ?? DEFAULT_BASE_URL;
+    const validate = options.validateToken ?? defaultValidateToken;
+    let user;
+    try {
+        user = await validate(token, baseUrl);
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new Error(`Login failed (${baseUrl}): ${detail}\n` +
+            "Verify your API key at " +
+            `${baseUrl.replace(/\/$/, "")}/personal-settings#apiKey`);
+    }
+    const authFile = options.authFilePath ?? resolveAuthFilePath();
+    await fs.ensureDir(dirname(authFile));
+    await fs.writeJson(authFile, { superblocksBaseUrl: baseUrl, token });
+    try {
+        await fs.chmod(authFile, 0o600);
+    }
+    catch {
+        // Non-POSIX systems (Windows) may not support chmod
+    }
+    console.log(`Logged in as ${user.name}. Token saved to ${authFile}`);
+    return true;
+}
+//# sourceMappingURL=login.js.map

package/dist/auth/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,MAAM,UAAU,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AASvD,KAAK,UAAU,oBAAoB,CACjC,KAAa,EACb,OAAe;IAEf,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9C,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAc,EACd,UAA+B,EAAE;IAEjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,KAAK,GACT,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAEpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,wEAAwE;YACtE,mFAAmF,CACtF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,gBAAgB,CAAC;IACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,IAAI,oBAAoB,CAAC;IAE/D,IAAI,IAAoB,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,iBAAiB,OAAO,MAAM,MAAM,IAAI;YACtC,yBAAyB;YACzB,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,IAAI,mBAAmB,EAAE,CAAC;IAC/D,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,IAAI,oBAAoB,QAAQ,EAAE,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/resolve-auth.d.ts

@@ -0,0 +1,15 @@
+type AuthSource = "cli-auth" | "mcp-auth-store" | "remote-context";
+type ResolvedAuth = {
+    token: string;
+    source: AuthSource;
+};
+type AuthStatus = {
+    authenticated: boolean;
+    source: AuthSource | null;
+    updatedAt: string | null;
+};
+export declare function getAuthSetupHint(baseUrl: string): string;
+export declare function getAuthStatusForOrigin(baseUrl: string): Promise<AuthStatus>;
+export declare function resolveAuthForOrigin(baseUrl: string): Promise<ResolvedAuth>;
+export {};
+//# sourceMappingURL=resolve-auth.d.ts.map

package/dist/auth/resolve-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-auth.d.ts","sourceRoot":"","sources":["../../src/auth/resolve-auth.ts"],"names":[],"mappings":"AAMA,KAAK,UAAU,GACX,UAAU,GACV,gBAAgB,GAChB,gBAAgB,CAAC;AAErB,KAAK,YAAY,GAAG;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,KAAK,UAAU,GAAG;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMxD;AA6BD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,CAAC,CA4BrB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,CA4BvB"}

package/dist/auth/resolve-auth.js

@@ -0,0 +1,75 @@
+import { getLocalTokenWithUrlIfExists } from "@superblocksteam/util";
+import { normalizeBaseUrl } from "../urls.js";
+import { getAuthContext } from "./context.js";
+import { getStoredAuthEntry, getStoredAuthToken } from "./store.js";
+export function getAuthSetupHint(baseUrl) {
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+    return (`Run 'superblocks login' to authenticate, ` +
+        `or 'superblocks-mcp auth add --base-url ${normalizedBaseUrl} --token <token>' for a specific environment.`);
+}
+async function tryCliAuth(normalizedBaseUrl) {
+    const currentCliAuth = await getLocalTokenWithUrlIfExists();
+    if (currentCliAuth &&
+        "token" in currentCliAuth &&
+        normalizeBaseUrl(currentCliAuth.superblocksBaseUrl) === normalizedBaseUrl) {
+        return { token: currentCliAuth.token, source: "cli-auth" };
+    }
+    return undefined;
+}
+async function tryMcpStoreAuth(normalizedBaseUrl) {
+    const storedEntry = await getStoredAuthEntry(normalizedBaseUrl);
+    if (storedEntry) {
+        return {
+            auth: { token: storedEntry.token, source: "mcp-auth-store" },
+            updatedAt: storedEntry.updatedAt,
+        };
+    }
+    return undefined;
+}
+export async function getAuthStatusForOrigin(baseUrl) {
+    const ctx = getAuthContext();
+    if (ctx) {
+        const normalizedRequested = normalizeBaseUrl(baseUrl);
+        const normalizedContext = normalizeBaseUrl(ctx.baseUrl);
+        if (normalizedRequested !== normalizedContext) {
+            return { authenticated: false, source: null, updatedAt: null };
+        }
+        return { authenticated: true, source: "remote-context", updatedAt: null };
+    }
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+    const cliAuth = await tryCliAuth(normalizedBaseUrl);
+    if (cliAuth) {
+        return { authenticated: true, source: "cli-auth", updatedAt: null };
+    }
+    const mcpAuth = await tryMcpStoreAuth(normalizedBaseUrl);
+    if (mcpAuth) {
+        return {
+            authenticated: true,
+            source: "mcp-auth-store",
+            updatedAt: mcpAuth.updatedAt,
+        };
+    }
+    return { authenticated: false, source: null, updatedAt: null };
+}
+export async function resolveAuthForOrigin(baseUrl) {
+    const ctx = getAuthContext();
+    if (ctx) {
+        const normalizedRequested = normalizeBaseUrl(baseUrl);
+        const normalizedContext = normalizeBaseUrl(ctx.baseUrl);
+        if (normalizedRequested !== normalizedContext) {
+            throw new Error(`Remote auth context is for ${normalizedContext}, but tool requested auth for ${normalizedRequested}`);
+        }
+        return { token: ctx.token, source: "remote-context" };
+    }
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+    const cliAuth = await tryCliAuth(normalizedBaseUrl);
+    if (cliAuth) {
+        return cliAuth;
+    }
+    const storedToken = await getStoredAuthToken(normalizedBaseUrl);
+    if (storedToken) {
+        return { token: storedToken, source: "mcp-auth-store" };
+    }
+    throw new Error(`No API token configured for ${normalizedBaseUrl}. ${getAuthSetupHint(normalizedBaseUrl)}`);
+}
+//# sourceMappingURL=resolve-auth.js.map

package/dist/auth/resolve-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-auth.js","sourceRoot":"","sources":["../../src/auth/resolve-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAkBpE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,CACL,2CAA2C;QAC3C,2CAA2C,iBAAiB,+CAA+C,CAC5G,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,iBAAyB;IAEzB,MAAM,cAAc,GAAG,MAAM,4BAA4B,EAAE,CAAC;IAC5D,IACE,cAAc;QACd,OAAO,IAAI,cAAc;QACzB,gBAAgB,CAAC,cAAc,CAAC,kBAAkB,CAAC,KAAK,iBAAiB,EACzE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,iBAAyB;IAEzB,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;IAChE,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE;YAC5D,SAAS,EAAE,WAAW,CAAC,SAAS;SACjC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe;IAEf,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,mBAAmB,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,CAAC;IACpD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC,CAAC;IACzD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,gBAAgB;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe;IAEf,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,mBAAmB,KAAK,iBAAiB,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,8BAA8B,iBAAiB,iCAAiC,mBAAmB,EAAE,CACtG,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,CAAC;IACpD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;IAChE,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,KAAK,CACb,+BAA+B,iBAAiB,KAAK,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,CAC3F,CAAC;AACJ,CAAC"}

package/dist/auth/resolve-current-organization.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Returns the authenticated user's current organization ID (from /api/v1/users/me).
+ * Used by MCP tools so callers do not need a separate get_current_user round trip.
+ */
+export declare function resolveCurrentOrganizationId(normalizedBaseUrl: string, token: string): Promise<string>;
+//# sourceMappingURL=resolve-current-organization.d.ts.map

package/dist/auth/resolve-current-organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-current-organization.d.ts","sourceRoot":"","sources":["../../src/auth/resolve-current-organization.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAUjB"}

package/dist/auth/resolve-current-organization.js

@@ -0,0 +1,15 @@
+import { createSdk } from "../sdk/create-sdk.js";
+/**
+ * Returns the authenticated user's current organization ID (from /api/v1/users/me).
+ * Used by MCP tools so callers do not need a separate get_current_user round trip.
+ */
+export async function resolveCurrentOrganizationId(normalizedBaseUrl, token) {
+    const sdk = createSdk(token, normalizedBaseUrl);
+    const me = await sdk.fetchCurrentUser();
+    const id = me.user?.currentOrganizationId;
+    if (!id) {
+        throw new Error("Could not resolve current organization: missing currentOrganizationId on user");
+    }
+    return id;
+}
+//# sourceMappingURL=resolve-current-organization.js.map

package/dist/auth/resolve-current-organization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-current-organization.js","sourceRoot":"","sources":["../../src/auth/resolve-current-organization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,iBAAyB,EACzB,KAAa;IAEb,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,qBAAqB,CAAC;IAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/auth/store.d.ts

@@ -0,0 +1,11 @@
+type AuthStoreEntry = {
+    token: string;
+    updatedAt: string;
+};
+export declare function getMcpAuthFilePath(): string;
+export declare function upsertAuthToken(baseUrl: string, token: string): Promise<string>;
+export declare function getStoredAuthToken(baseUrl: string): Promise<string | undefined>;
+export declare function getStoredAuthEntry(baseUrl: string): Promise<AuthStoreEntry | undefined>;
+export declare function listStoredOrigins(): Promise<string[]>;
+export {};
+//# sourceMappingURL=store.d.ts.map

package/dist/auth/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAOA,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAUF,wBAAgB,kBAAkB,IAAI,MAAM,CAK3C;AAuCD,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAIrC;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAG3D"}

package/dist/auth/store.js

@@ -0,0 +1,63 @@
+import { homedir } from "node:os";
+import path from "node:path";
+import fs from "fs-extra";
+import { normalizeBaseUrl } from "../urls.js";
+const EMPTY_AUTH_STORE = {
+    origins: {},
+};
+export function getMcpAuthFilePath() {
+    return (process.env.SUPERBLOCKS_MCP_AUTH_FILE ??
+        path.join(homedir(), ".superblocks/mcp-auth.json"));
+}
+async function ensureAuthDirectory() {
+    const authFilePath = getMcpAuthFilePath();
+    const authDirectoryPath = path.dirname(authFilePath);
+    await fs.ensureDir(authDirectoryPath);
+    await fs.chmod(authDirectoryPath, 0o700).catch(() => undefined);
+}
+async function readAuthStore() {
+    const authFilePath = getMcpAuthFilePath();
+    if (!(await fs.pathExists(authFilePath))) {
+        return {
+            origins: { ...EMPTY_AUTH_STORE.origins },
+        };
+    }
+    const authStore = await fs.readJSON(authFilePath);
+    if (!authStore ||
+        typeof authStore !== "object" ||
+        !("origins" in authStore)) {
+        throw new Error(`Invalid MCP auth store: ${authFilePath}`);
+    }
+    return {
+        origins: authStore.origins,
+    };
+}
+async function writeAuthStore(authStore) {
+    await ensureAuthDirectory();
+    const authFilePath = getMcpAuthFilePath();
+    await fs.writeJSON(authFilePath, authStore, { spaces: 2 });
+    await fs.chmod(authFilePath, 0o600).catch(() => undefined);
+}
+export async function upsertAuthToken(baseUrl, token) {
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+    const authStore = await readAuthStore();
+    authStore.origins[normalizedBaseUrl] = {
+        token,
+        updatedAt: new Date().toISOString(),
+    };
+    await writeAuthStore(authStore);
+    return normalizedBaseUrl;
+}
+export async function getStoredAuthToken(baseUrl) {
+    return (await getStoredAuthEntry(baseUrl))?.token;
+}
+export async function getStoredAuthEntry(baseUrl) {
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+    const authStore = await readAuthStore();
+    return authStore.origins[normalizedBaseUrl];
+}
+export async function listStoredOrigins() {
+    const authStore = await readAuthStore();
+    return Object.keys(authStore.origins).sort();
+}
+//# sourceMappingURL=store.js.map

package/dist/auth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,UAAU,CAAC;AAE1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAW9C,MAAM,gBAAgB,GAAc;IAClC,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,MAAM,UAAU,kBAAkB;IAChC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,4BAA4B,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAErD,MAAM,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,OAAO,EAAE,EAAE,GAAG,gBAAgB,CAAC,OAAO,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAClD,IACE,CAAC,SAAS;QACV,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,EACzB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,YAAY,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,OAAyC;KAC7D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,SAAoB;IAChD,MAAM,mBAAmB,EAAE,CAAC;IAC5B,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,KAAa;IAEb,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,aAAa,EAAE,CAAC;IACxC,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG;QACrC,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe;IAEf,OAAO,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe;IAEf,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,aAAa,EAAE,CAAC;IACxC,OAAO,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,SAAS,GAAG,MAAM,aAAa,EAAE,CAAC;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/C,CAAC"}

package/dist/entitlement-wrapper.d.ts

@@ -0,0 +1,3 @@
+export declare function extractBaseUrl(args: unknown): string | undefined;
+export declare function wrapHandlerWithEntitlement(handler: (args: unknown) => Promise<unknown>): (args: unknown) => Promise<unknown>;
+//# sourceMappingURL=entitlement-wrapper.d.ts.map

package/dist/entitlement-wrapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement-wrapper.d.ts","sourceRoot":"","sources":["../src/entitlement-wrapper.ts"],"names":[],"mappings":"AAIA,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAwBhE;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAC3C,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAsBrC"}

package/dist/entitlement-wrapper.js

@@ -0,0 +1,49 @@
+import { resolveAuthForOrigin } from "./auth/resolve-auth.js";
+import { EntitlementError, assertEnterprisePlan } from "./entitlement.js";
+import { normalizeBaseUrl } from "./urls.js";
+export function extractBaseUrl(args) {
+    if (!args || typeof args !== "object") {
+        return undefined;
+    }
+    const obj = args;
+    if (typeof obj.base_url === "string") {
+        try {
+            return normalizeBaseUrl(obj.base_url);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (typeof obj.app_url === "string") {
+        try {
+            return normalizeBaseUrl(obj.app_url);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+export function wrapHandlerWithEntitlement(handler) {
+    return async (args) => {
+        const baseUrl = extractBaseUrl(args);
+        if (baseUrl) {
+            let authResolved = false;
+            try {
+                const auth = await resolveAuthForOrigin(baseUrl);
+                authResolved = true;
+                await assertEnterprisePlan(baseUrl, auth.token);
+            }
+            catch (error) {
+                if (error instanceof EntitlementError) {
+                    throw error;
+                }
+                if (authResolved) {
+                    throw error;
+                }
+            }
+        }
+        return handler(args);
+    };
+}
+//# sourceMappingURL=entitlement-wrapper.js.map

package/dist/entitlement-wrapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement-wrapper.js","sourceRoot":"","sources":["../src/entitlement-wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAA4C;IAE5C,OAAO,KAAK,EAAE,IAAa,EAAoB,EAAE;QAC/C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAErC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBACjD,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;oBACtC,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC"}

package/dist/entitlement.d.ts

@@ -0,0 +1,55 @@
+export declare class EntitlementError extends Error {
+    readonly plan: string | undefined;
+    constructor(plan: string | undefined);
+}
+/**
+ * The plan could not be read, so nothing is known about the entitlement.
+ *
+ * Distinct from {@link EntitlementError}, which is a definite answer that the
+ * org is on the wrong plan. This one means try again; that one means upgrade.
+ */
+export declare class PlanCheckUnavailableError extends Error {
+    constructor(cause?: unknown);
+}
+export type PlanEntitlementOptions = {
+    cacheTtlMs?: number;
+    /** How long one caller waits for a read before giving up on this call. */
+    callerWaitMs?: number;
+    cooldownMs?: number;
+    now?: () => number;
+    /** Bounds the read itself, which outlives any one caller's wait. */
+    timeoutMs?: number;
+};
+export type PlanEntitlement = {
+    /** Resolves when the org behind this credential may use the Admin tools. */
+    assert(baseUrl: string, token: string): Promise<void>;
+};
+/**
+ * The plan check that gates every Admin tool call, made cheap and bounded.
+ *
+ * Read straight through it was one uncached, unbounded `GET /users/me` per tool
+ * call, failing closed. So when that route wedged, every Admin tool went with
+ * it -- including `list_integrations`, which needs nothing but plain REST --
+ * and each call waited on the socket rather than on any deadline of its own.
+ *
+ * Same four measures the Builder side needs, for the same reason:
+ *
+ * - **Cache** the verdict, refusals included, so a poll loop reads the plan
+ *   once per TTL instead of once per call.
+ * - **Collapse** concurrent callers onto one read, so a burst does not
+ *   multiply load on a route that is already struggling.
+ * - **Caller deadline**, so a wedged route cannot hold a tool call open. The
+ *   read keeps running past it, so a route that answers slowly rather than
+ *   never still fills the cache instead of being killed just short of
+ *   succeeding on every attempt.
+ * - **Break** after a failed read, so later calls fail fast instead of each
+ *   discovering the same outage the slow way.
+ *
+ * Only a failed *read of an unhealthy endpoint* opens the breaker, and only for
+ * the control plane it failed on. Being on the wrong plan, or presenting a
+ * credential the API rejects, is a definite answer about one caller and must
+ * not fail everyone else fast.
+ */
+export declare function createPlanEntitlement(options?: PlanEntitlementOptions): PlanEntitlement;
+export declare function assertEnterprisePlan(baseUrl: string, token: string): Promise<void>;
+//# sourceMappingURL=entitlement.d.ts.map

package/dist/entitlement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement.d.ts","sourceRoot":"","sources":["../src/entitlement.ts"],"names":[],"mappings":"AAqFA,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;gBAEtB,IAAI,EAAE,MAAM,GAAG,SAAS;CAUrC;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,KAAK,CAAC,EAAE,OAAO;CAU5B;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AA4BF,MAAM,MAAM,eAAe,GAAG;IAC5B,4EAA4E;IAC5E,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,GAAE,sBAA2B,GACnC,eAAe,CAmGjB;AAcD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAEf"}