@taxdao/fintax-mcp 0.2.0

package/dist/auth/auth-session.d.ts

@@ -0,0 +1,63 @@
+import { z } from 'zod/v4';
+import type { HttpClient } from '../clients/http-client.js';
+import type { RuntimeConfig } from '../config/schema.js';
+import type { LockManager } from '../concurrency/lock-manager.js';
+declare const identitySchema: z.ZodPipe<z.ZodObject<{
+    id: z.ZodUUID;
+    tenant_id: z.ZodOptional<z.ZodUUID>;
+    tenantId: z.ZodOptional<z.ZodUUID>;
+    org_id: z.ZodOptional<z.ZodNullable<z.ZodUUID>>;
+    orgId: z.ZodOptional<z.ZodNullable<z.ZodUUID>>;
+    orgs: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>>;
+    roles: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    permissions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>, z.ZodTransform<{
+    userId: string;
+    tenantId: string;
+    orgId: string | undefined;
+    orgs: {
+        [x: string]: unknown;
+        id: string;
+        name?: string | undefined;
+    }[];
+    roles: string[];
+    permissions: string[];
+}, {
+    [x: string]: unknown;
+    id: string;
+    orgs: {
+        [x: string]: unknown;
+        id: string;
+        name?: string | undefined;
+    }[];
+    roles: string[];
+    permissions: string[];
+    tenant_id?: string | undefined;
+    tenantId?: string | undefined;
+    org_id?: string | null | undefined;
+    orgId?: string | null | undefined;
+}>>;
+export type AuthIdentity = z.infer<typeof identitySchema>;
+export interface AccessTokenState {
+    readonly token: string;
+    readonly expiresAt: number;
+    readonly generation: number;
+}
+export interface AuthenticatedTokenState extends AccessTokenState {
+    readonly identity: AuthIdentity;
+}
+export declare class AuthSession {
+    #private;
+    constructor(client: HttpClient, config: RuntimeConfig, locks: LockManager);
+    getAccessToken(): Promise<string>;
+    getAccessTokenState(): Promise<AccessTokenState>;
+    getBaseContext(): Promise<AuthenticatedTokenState>;
+    forceRefresh(): Promise<AccessTokenState>;
+    getIdentity(): Promise<AuthIdentity>;
+    switchOrg(orgId: string): Promise<AuthenticatedTokenState>;
+    close(): Promise<void>;
+}
+export {};

package/dist/auth/auth-session.js

@@ -0,0 +1,226 @@
+import { z } from 'zod/v4';
+import { FinTaxError } from '../errors/fintax-error.js';
+import { credentialsFromConfig } from './credentials.js';
+const tokenDataSchema = z
+    .object({
+    access_token: z.string().optional(),
+    accessToken: z.string().optional(),
+    token_type: z.string().optional(),
+    tokenType: z.string().optional(),
+    expires_in: z.number().int().positive().optional(),
+    expiresIn: z.number().int().positive().optional(),
+})
+    .passthrough()
+    .transform((value, context) => {
+    const accessToken = value.access_token ?? value.accessToken;
+    const expiresIn = value.expires_in ?? value.expiresIn;
+    if (accessToken === undefined || expiresIn === undefined) {
+        context.addIssue({
+            code: 'custom',
+            message: 'Missing access token data',
+        });
+        return z.NEVER;
+    }
+    return { accessToken, expiresIn };
+});
+const orgSchema = z
+    .object({ id: z.uuid(), name: z.string().optional() })
+    .passthrough();
+const identitySchema = z
+    .object({
+    id: z.uuid(),
+    tenant_id: z.uuid().optional(),
+    tenantId: z.uuid().optional(),
+    org_id: z.uuid().nullable().optional(),
+    orgId: z.uuid().nullable().optional(),
+    orgs: z.array(orgSchema).default([]),
+    roles: z.array(z.string()).default([]),
+    permissions: z.array(z.string()).default([]),
+})
+    .passthrough()
+    .transform((value, context) => {
+    const tenantId = value.tenant_id ?? value.tenantId;
+    if (tenantId === undefined) {
+        context.addIssue({ code: 'custom', message: 'Missing tenant id' });
+        return z.NEVER;
+    }
+    return {
+        userId: value.id,
+        tenantId,
+        orgId: value.org_id ?? value.orgId ?? undefined,
+        orgs: value.orgs,
+        roles: value.roles,
+        permissions: value.permissions,
+    };
+});
+export class AuthSession {
+    #client;
+    #config;
+    #locks;
+    #access;
+    #identity;
+    #generation = 0;
+    #canonicalOrgId;
+    #canonicalOrgInitialized = false;
+    #serverOrgId;
+    constructor(client, config, locks) {
+        this.#client = client;
+        this.#config = config;
+        this.#locks = locks;
+    }
+    async getAccessToken() {
+        return (await this.getAccessTokenState()).token;
+    }
+    getAccessTokenState() {
+        return this.#locks.withLock('auth:session', async () => {
+            await this.#ensureAccess();
+            return this.#requireAccess();
+        });
+    }
+    getBaseContext() {
+        return this.#locks.withLock('auth:session', async () => {
+            await this.#ensureAccess();
+            const access = this.#requireAccess();
+            if (this.#identity === undefined) {
+                this.#identity = await this.#loadIdentity(access.token);
+            }
+            if (!this.#canonicalOrgInitialized) {
+                this.#canonicalOrgId = this.#identity.orgId;
+                this.#serverOrgId = this.#identity.orgId;
+                this.#canonicalOrgInitialized = true;
+            }
+            return { ...access, identity: this.#identity };
+        });
+    }
+    forceRefresh() {
+        return this.#locks.withLock('auth:session', async () => {
+            if (this.#access === undefined)
+                await this.#login();
+            else
+                await this.#refresh();
+            return this.#requireAccess();
+        });
+    }
+    async getIdentity() {
+        return (await this.getBaseContext()).identity;
+    }
+    switchOrg(orgId) {
+        return this.#locks.withLock('auth:session', async () => {
+            await this.#ensureAccess();
+            const access = this.#requireAccess();
+            const switched = await this.#requestOrgToken(orgId, access.token, access.generation);
+            const identity = await this.#loadIdentity(switched.token);
+            return { ...switched, identity };
+        });
+    }
+    close() {
+        return this.#locks.withLock('auth:session', async () => {
+            if (this.#access === undefined)
+                return;
+            try {
+                await this.#client.requestData({
+                    method: 'POST',
+                    path: '/api/v1/auth/logout',
+                    token: this.#access.token,
+                    retryPolicy: 'none',
+                });
+            }
+            catch {
+                // Logout is best effort during process shutdown.
+            }
+            finally {
+                this.#clearSession();
+            }
+        });
+    }
+    async #ensureAccess() {
+        if (this.#access === undefined)
+            await this.#login();
+        else if (this.#isExpiring(this.#access))
+            await this.#refresh();
+    }
+    async #login() {
+        const credentials = credentialsFromConfig(this.#config);
+        const data = tokenDataSchema.parse(await this.#client.requestData({
+            method: 'POST',
+            path: '/api/v1/auth/login',
+            body: credentials,
+            retryPolicy: 'none',
+        }));
+        this.#generation += 1;
+        this.#access = this.#tokenState(data.accessToken, data.expiresIn, this.#generation);
+        this.#identity = undefined;
+        this.#canonicalOrgId = undefined;
+        this.#canonicalOrgInitialized = false;
+        this.#serverOrgId = undefined;
+    }
+    async #refresh() {
+        try {
+            const data = tokenDataSchema.parse(await this.#client.requestData({
+                method: 'POST',
+                path: '/api/v1/auth/refresh',
+                retryPolicy: 'none',
+            }));
+            this.#generation += 1;
+            const refreshed = this.#tokenState(data.accessToken, data.expiresIn, this.#generation);
+            this.#access = refreshed;
+            this.#identity = undefined;
+            if (this.#canonicalOrgInitialized &&
+                this.#canonicalOrgId !== undefined &&
+                this.#serverOrgId !== this.#canonicalOrgId) {
+                this.#access = await this.#requestOrgToken(this.#canonicalOrgId, refreshed.token, refreshed.generation);
+            }
+        }
+        catch (error) {
+            this.#clearSession();
+            throw new FinTaxError('AUTH_REQUIRED', 'FinTax login session has expired', {
+                cause: error,
+            });
+        }
+    }
+    async #requestOrgToken(orgId, token, generation) {
+        // A failed response may still have changed the server-side organization.
+        this.#serverOrgId = undefined;
+        const data = tokenDataSchema.parse(await this.#client.requestData({
+            method: 'POST',
+            path: '/api/v1/auth/switch-org',
+            token,
+            body: { org_id: orgId },
+            retryPolicy: 'none',
+        }));
+        this.#serverOrgId = orgId;
+        return this.#tokenState(data.accessToken, data.expiresIn, generation);
+    }
+    #tokenState(token, expiresIn, generation) {
+        return {
+            token,
+            expiresAt: Date.now() + expiresIn * 1000,
+            generation,
+        };
+    }
+    #clearSession() {
+        this.#access = undefined;
+        this.#identity = undefined;
+        this.#canonicalOrgId = undefined;
+        this.#canonicalOrgInitialized = false;
+        this.#serverOrgId = undefined;
+    }
+    async #loadIdentity(token) {
+        return identitySchema.parse(await this.#client.requestData({
+            method: 'GET',
+            path: '/api/v1/auth/me',
+            token,
+            retryPolicy: 'read-bounded',
+        }));
+    }
+    #isExpiring(access) {
+        return access.expiresAt <= Date.now() + 30_000;
+    }
+    #requireAccess() {
+        if (this.#access === undefined) {
+            throw new FinTaxError('AUTH_REQUIRED', 'FinTax login session is unavailable');
+        }
+        return this.#access;
+    }
+}
+//# sourceMappingURL=auth-session.js.map

package/dist/auth/auth-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-session.js","sourceRoot":"","sources":["../../src/auth/auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAK3B,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,WAAW,EAAE;KACb,SAAS,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC5B,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,WAAW,CAAC;IAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC;IACtD,IAAI,WAAW,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACzD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,2BAA2B;SACrC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC,CAAC,CAAC;AAEL,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;KACrD,WAAW,EAAE,CAAC;AAEjB,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC7C,CAAC;KACD,WAAW,EAAE;KACb,SAAS,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC;IACnD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;IACD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,EAAE;QAChB,QAAQ;QACR,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,SAAS;QAC/C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;AACJ,CAAC,CAAC,CAAC;AAcL,MAAM,OAAO,WAAW;IACb,OAAO,CAAa;IACpB,OAAO,CAAgB;IACvB,MAAM,CAAc;IAC7B,OAAO,CAA+B;IACtC,SAAS,CAA2B;IACpC,WAAW,GAAG,CAAC,CAAC;IAChB,eAAe,CAAqB;IACpC,wBAAwB,GAAG,KAAK,CAAC;IACjC,YAAY,CAAqB;IAEjC,YAAY,MAAkB,EAAE,MAAqB,EAAE,KAAkB;QACvE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO,CAAC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC;IAClD,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC;gBACnC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBACzC,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC;YACvC,CAAC;YACD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YACrD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;;gBAC/C,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC;IAChD,CAAC;IAED,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC1C,KAAK,EACL,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,UAAU,CAClB,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC1D,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YACrD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO;YACvC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC7B,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB;oBAC3B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;oBACzB,WAAW,EAAE,MAAM;iBACpB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,iDAAiD;YACnD,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;aAC/C,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAChC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC7B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,MAAM;SACpB,CAAC,CACH,CAAC;QACF,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,WAAW,CAC7B,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACjC,IAAI,CAAC,wBAAwB,GAAG,KAAK,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAChC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;gBAC7B,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,sBAAsB;gBAC5B,WAAW,EAAE,MAAM;aACpB,CAAC,CACH,CAAC;YACF,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAChC,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,WAAW,CACjB,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;YACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC3B,IACE,IAAI,CAAC,wBAAwB;gBAC7B,IAAI,CAAC,eAAe,KAAK,SAAS;gBAClC,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,eAAe,EAC1C,CAAC;gBACD,IAAI,CAAC,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CACxC,IAAI,CAAC,eAAe,EACpB,SAAS,CAAC,KAAK,EACf,SAAS,CAAC,UAAU,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CACnB,eAAe,EACf,kCAAkC,EAClC;gBACE,KAAK,EAAE,KAAK;aACb,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,KAAa,EACb,KAAa,EACb,UAAkB;QAElB,yEAAyE;QACzE,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAC9B,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAChC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC7B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,yBAAyB;YAC/B,KAAK;YACL,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;YACvB,WAAW,EAAE,MAAM;SACpB,CAAC,CACH,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QAC1B,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACxE,CAAC;IAED,WAAW,CACT,KAAa,EACb,SAAiB,EACjB,UAAkB;QAElB,OAAO;YACL,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI;YACxC,UAAU;SACX,CAAC;IACJ,CAAC;IAED,aAAa;QACX,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACjC,IAAI,CAAC,wBAAwB,GAAG,KAAK,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,OAAO,cAAc,CAAC,KAAK,CACzB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC7B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,iBAAiB;YACvB,KAAK;YACL,WAAW,EAAE,cAAc;SAC5B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,MAAwB;QAClC,OAAO,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACjD,CAAC;IAED,cAAc;QACZ,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CACnB,eAAe,EACf,qCAAqC,CACtC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF"}

package/dist/auth/credentials.d.ts

@@ -0,0 +1,6 @@
+import type { RuntimeConfig } from '../config/schema.js';
+export interface Credentials {
+    readonly username: string;
+    readonly password: string;
+}
+export declare function credentialsFromConfig(config: RuntimeConfig): Credentials;

package/dist/auth/credentials.js

@@ -0,0 +1,12 @@
+import { FinTaxError } from '../errors/fintax-error.js';
+export function credentialsFromConfig(config) {
+    if (config.FINTAX_USERNAME === undefined ||
+        config.FINTAX_PASSWORD === undefined) {
+        throw new FinTaxError('AUTH_REQUIRED', 'Configure FINTAX_USERNAME and FINTAX_PASSWORD before calling business Tools');
+    }
+    return {
+        username: config.FINTAX_USERNAME,
+        password: config.FINTAX_PASSWORD,
+    };
+}
+//# sourceMappingURL=credentials.js.map

package/dist/auth/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/auth/credentials.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAOxD,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IACzD,IACE,MAAM,CAAC,eAAe,KAAK,SAAS;QACpC,MAAM,CAAC,eAAe,KAAK,SAAS,EACpC,CAAC;QACD,MAAM,IAAI,WAAW,CACnB,eAAe,EACf,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,eAAe;QAChC,QAAQ,EAAE,MAAM,CAAC,eAAe;KACjC,CAAC;AACJ,CAAC"}

package/dist/auth/org-token-provider.d.ts

@@ -0,0 +1,15 @@
+import type { AuthIdentity, AuthSession } from './auth-session.js';
+import type { LockManager } from '../concurrency/lock-manager.js';
+interface OrgContext {
+    readonly token: string;
+    readonly identity: AuthIdentity;
+    readonly expiresAt: number;
+    readonly generation: number;
+}
+export declare class OrgTokenProvider {
+    #private;
+    constructor(session: AuthSession, locks: LockManager);
+    getContext(requestedOrgId: string | undefined, requireExplicitOrg: boolean): Promise<OrgContext>;
+    refreshContext(orgId: string | undefined, failedGeneration: number): Promise<OrgContext>;
+}
+export {};

package/dist/auth/org-token-provider.js

@@ -0,0 +1,62 @@
+import { FinTaxError } from '../errors/fintax-error.js';
+const EXPIRY_SKEW_MS = 30_000;
+export class OrgTokenProvider {
+    #session;
+    #locks;
+    #cache = new Map();
+    constructor(session, locks) {
+        this.#session = session;
+        this.#locks = locks;
+    }
+    async getContext(requestedOrgId, requireExplicitOrg) {
+        const base = await this.#session.getBaseContext();
+        const targetOrgId = requestedOrgId ?? base.identity.orgId;
+        if (requireExplicitOrg &&
+            base.identity.orgs.length > 1 &&
+            requestedOrgId === undefined) {
+            throw new FinTaxError('VALIDATION_FAILED', 'Multi-organization write operations require an explicit context.org_id');
+        }
+        if (targetOrgId === undefined) {
+            return base;
+        }
+        if (!base.identity.orgs.some((org) => org.id === targetOrgId)) {
+            throw new FinTaxError('PERMISSION_DENIED', 'The current user cannot access the specified organization');
+        }
+        if (targetOrgId === base.identity.orgId) {
+            return base;
+        }
+        const cached = this.#readCached(targetOrgId, base.generation);
+        if (cached !== undefined)
+            return cached;
+        return this.#locks.withLock(`auth:org:${targetOrgId}`, async () => {
+            const latestBase = await this.#session.getAccessTokenState();
+            const existing = this.#readCached(targetOrgId, latestBase.generation);
+            if (existing !== undefined)
+                return existing;
+            const context = await this.#session.switchOrg(targetOrgId);
+            this.#cache.set(targetOrgId, context);
+            return context;
+        });
+    }
+    refreshContext(orgId, failedGeneration) {
+        return this.#locks.withLock('auth:recovery', async () => {
+            const current = await this.#session.getAccessTokenState();
+            if (current.generation === failedGeneration) {
+                await this.#session.forceRefresh();
+                this.#cache.clear();
+            }
+            return this.getContext(orgId, false);
+        });
+    }
+    #readCached(orgId, generation) {
+        const context = this.#cache.get(orgId);
+        if (context === undefined ||
+            context.generation !== generation ||
+            context.expiresAt <= Date.now() + EXPIRY_SKEW_MS) {
+            this.#cache.delete(orgId);
+            return undefined;
+        }
+        return context;
+    }
+}
+//# sourceMappingURL=org-token-provider.js.map

package/dist/auth/org-token-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-token-provider.js","sourceRoot":"","sources":["../../src/auth/org-token-provider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AASxD,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,MAAM,OAAO,gBAAgB;IAClB,QAAQ,CAAc;IACtB,MAAM,CAAc;IACpB,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEhD,YAAY,OAAoB,EAAE,KAAkB;QAClD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,UAAU,CACd,cAAkC,EAClC,kBAA2B;QAE3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAClD,MAAM,WAAW,GAAG,cAAc,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAE1D,IACE,kBAAkB;YAClB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAC7B,cAAc,KAAK,SAAS,EAC5B,CAAC;YACD,MAAM,IAAI,WAAW,CACnB,mBAAmB,EACnB,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,WAAW,CACnB,mBAAmB,EACnB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QAExC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,WAAW,EAAE,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;YACtE,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CACZ,KAAyB,EACzB,gBAAwB;QAExB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YAC1D,IAAI,OAAO,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;gBAC5C,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;YACD,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,UAAkB;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IACE,OAAO,KAAK,SAAS;YACrB,OAAO,CAAC,UAAU,KAAK,UAAU;YACjC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,EAChD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/capabilities/capability.d.ts

@@ -0,0 +1,100 @@
+import { z } from 'zod/v4';
+import { type ExposurePack, type RiskLevel } from '../tools/tool-definition.js';
+export type ServiceName = 'base' | 'suite';
+export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+export type RetryPolicy = 'none' | 'read-bounded';
+export interface CapabilityRequest {
+    readonly pathParams?: Readonly<Record<string, string>>;
+    readonly query?: Readonly<Record<string, string | number | boolean | undefined>>;
+    readonly body?: unknown;
+    readonly headers?: Readonly<Record<string, string>>;
+}
+export interface CapabilityDefinition {
+    readonly capabilityId: string;
+    readonly service: ServiceName;
+    readonly module: string;
+    readonly object: string;
+    readonly operation: string;
+    readonly method: HttpMethod;
+    readonly path: string;
+    readonly auth: 'none' | 'required';
+    readonly permissionAny: readonly string[];
+    readonly permissionAll: readonly string[];
+    readonly risk: RiskLevel;
+    readonly sideEffect: 'none' | 'draft' | 'state_change' | 'destructive';
+    readonly idempotency: 'none' | 'http' | 'key' | 'upstream-state';
+    readonly retryPolicy: RetryPolicy;
+    readonly responseMode: 'json' | 'bytes';
+    readonly timeoutMs: number;
+    readonly requestSchema: z.ZodType;
+    readonly responseSchema: z.ZodType;
+    readonly requestAdapter: (input: unknown) => CapabilityRequest;
+    readonly resultAdapter: (response: unknown) => unknown;
+    readonly auditEvent: string;
+    readonly enabled: boolean;
+    readonly exposurePack: ExposurePack;
+}
+export declare const capabilityMetadataSchema: z.ZodObject<{
+    capabilityId: z.ZodString;
+    service: z.ZodEnum<{
+        base: "base";
+        suite: "suite";
+    }>;
+    module: z.ZodString;
+    object: z.ZodString;
+    operation: z.ZodString;
+    method: z.ZodEnum<{
+        GET: "GET";
+        POST: "POST";
+        PUT: "PUT";
+        DELETE: "DELETE";
+        PATCH: "PATCH";
+    }>;
+    path: z.ZodString;
+    auth: z.ZodEnum<{
+        required: "required";
+        none: "none";
+    }>;
+    permissionAny: z.ZodArray<z.ZodString>;
+    permissionAll: z.ZodArray<z.ZodString>;
+    risk: z.ZodEnum<{
+        R0: "R0";
+        R1: "R1";
+        R2: "R2";
+        R3: "R3";
+        R4: "R4";
+    }>;
+    sideEffect: z.ZodEnum<{
+        none: "none";
+        draft: "draft";
+        state_change: "state_change";
+        destructive: "destructive";
+    }>;
+    idempotency: z.ZodEnum<{
+        none: "none";
+        key: "key";
+        http: "http";
+        "upstream-state": "upstream-state";
+    }>;
+    retryPolicy: z.ZodEnum<{
+        none: "none";
+        "read-bounded": "read-bounded";
+    }>;
+    responseMode: z.ZodEnum<{
+        bytes: "bytes";
+        json: "json";
+    }>;
+    timeoutMs: z.ZodNumber;
+    auditEvent: z.ZodString;
+    enabled: z.ZodBoolean;
+    exposurePack: z.ZodEnum<{
+        "core-read": "core-read";
+        "fnd-import": "fnd-import";
+        "core-edit": "core-edit";
+        workflow: "workflow";
+        "period-end": "period-end";
+        "asset-ops": "asset-ops";
+        automation: "automation";
+        configuration: "configuration";
+    }>;
+}, z.core.$strict>;

package/dist/capabilities/capability.js

@@ -0,0 +1,26 @@
+import { z } from 'zod/v4';
+import { EXPOSURE_PACKS, } from '../tools/tool-definition.js';
+export const capabilityMetadataSchema = z
+    .object({
+    capabilityId: z.string().min(1),
+    service: z.enum(['base', 'suite']),
+    module: z.string().min(1),
+    object: z.string().min(1),
+    operation: z.string().min(1),
+    method: z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE']),
+    path: z.string().startsWith('/api/v1/'),
+    auth: z.enum(['none', 'required']),
+    permissionAny: z.array(z.string()),
+    permissionAll: z.array(z.string()),
+    risk: z.enum(['R0', 'R1', 'R2', 'R3', 'R4']),
+    sideEffect: z.enum(['none', 'draft', 'state_change', 'destructive']),
+    idempotency: z.enum(['none', 'http', 'key', 'upstream-state']),
+    retryPolicy: z.enum(['none', 'read-bounded']),
+    responseMode: z.enum(['json', 'bytes']),
+    timeoutMs: z.number().int().positive(),
+    auditEvent: z.string().min(1),
+    enabled: z.boolean(),
+    exposurePack: z.enum(EXPOSURE_PACKS),
+})
+    .strict();
+//# sourceMappingURL=capability.js.map

package/dist/capabilities/capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.js","sourceRoot":"","sources":["../../src/capabilities/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,OAAO,EACL,cAAc,GAGf,MAAM,6BAA6B,CAAC;AAyCrC,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;IACpE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC9D,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC7C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;CACrC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/capabilities/create-capabilities.d.ts

@@ -0,0 +1,2 @@
+import type { CapabilityDefinition } from './capability.js';
+export declare function createCapabilities(): readonly CapabilityDefinition[];

package/dist/capabilities/create-capabilities.js

@@ -0,0 +1,37 @@
+import { dashboardCapabilities } from './definitions/dashboard.js';
+import { accountingContextCapabilities } from './definitions/accounting-context.js';
+import { accountingBalanceCapabilities } from './definitions/accounting-balances.js';
+import { assetCapabilities } from './definitions/assets.js';
+import { businessDocumentCapabilities } from './definitions/business-documents.js';
+import { fundAccountCapabilities } from './definitions/fund-accounts.js';
+import { fundBalanceCapabilities } from './definitions/fund-balances.js';
+import { fndImportCapabilities } from './definitions/fnd-import.js';
+import { financialReportCapabilities } from './definitions/financial-reports.js';
+import { journalCapabilities } from './definitions/journals.js';
+import { masterDataCapabilities } from './definitions/master-data.js';
+import { pnlCapabilities } from './definitions/pnl.js';
+import { transactionCapabilities } from './definitions/transactions.js';
+import { transactionDraftCapabilities } from './definitions/transaction-drafts.js';
+import { extendedOperationCapabilities } from './definitions/extended-operations.js';
+import { referenceDataCapabilities } from './definitions/reference-data.js';
+export function createCapabilities() {
+    return [
+        ...accountingContextCapabilities,
+        ...referenceDataCapabilities,
+        ...dashboardCapabilities,
+        ...transactionCapabilities,
+        ...transactionDraftCapabilities,
+        ...fundAccountCapabilities,
+        ...fundBalanceCapabilities,
+        ...masterDataCapabilities,
+        ...journalCapabilities,
+        ...accountingBalanceCapabilities,
+        ...financialReportCapabilities,
+        ...businessDocumentCapabilities,
+        ...assetCapabilities,
+        ...pnlCapabilities,
+        ...fndImportCapabilities,
+        ...extendedOperationCapabilities,
+    ];
+}
+//# sourceMappingURL=create-capabilities.js.map

package/dist/capabilities/create-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-capabilities.js","sourceRoot":"","sources":["../../src/capabilities/create-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAG5E,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,GAAG,6BAA6B;QAChC,GAAG,yBAAyB;QAC5B,GAAG,qBAAqB;QACxB,GAAG,uBAAuB;QAC1B,GAAG,4BAA4B;QAC/B,GAAG,uBAAuB;QAC1B,GAAG,uBAAuB;QAC1B,GAAG,sBAAsB;QACzB,GAAG,mBAAmB;QACtB,GAAG,6BAA6B;QAChC,GAAG,2BAA2B;QAC9B,GAAG,4BAA4B;QAC/B,GAAG,iBAAiB;QACpB,GAAG,eAAe;QAClB,GAAG,qBAAqB;QACxB,GAAG,6BAA6B;KACjC,CAAC;AACJ,CAAC"}

package/dist/capabilities/define-capability.d.ts

@@ -0,0 +1,39 @@
+import type { z } from 'zod/v4';
+import type { CapabilityDefinition, CapabilityRequest } from './capability.js';
+interface ReadCapabilityOptions {
+    readonly capabilityId: string;
+    readonly module: string;
+    readonly object: string;
+    readonly operation: string;
+    readonly path: string;
+    readonly permissionAny: readonly string[];
+    readonly requestSchema: z.ZodType;
+    readonly responseSchema: z.ZodType;
+    readonly requestAdapter: (input: unknown) => CapabilityRequest;
+    readonly resultAdapter?: (response: unknown) => unknown;
+    readonly responseMode?: 'json' | 'bytes';
+    readonly timeoutMs?: number;
+    readonly exposurePack?: CapabilityDefinition['exposurePack'];
+}
+interface WriteCapabilityOptions {
+    readonly capabilityId: string;
+    readonly module: string;
+    readonly object: string;
+    readonly operation: string;
+    readonly method: 'POST' | 'PUT' | 'PATCH';
+    readonly path: string;
+    readonly permissionAny: readonly string[];
+    readonly requestSchema: z.ZodType;
+    readonly responseSchema: z.ZodType;
+    readonly requestAdapter: (input: unknown) => CapabilityRequest;
+    readonly resultAdapter?: (response: unknown) => unknown;
+    readonly timeoutMs?: number;
+    readonly risk?: CapabilityDefinition['risk'];
+    readonly sideEffect?: CapabilityDefinition['sideEffect'];
+    readonly idempotency?: CapabilityDefinition['idempotency'];
+    readonly exposurePack?: CapabilityDefinition['exposurePack'];
+}
+export declare function defineSuiteReadCapability(options: ReadCapabilityOptions): CapabilityDefinition;
+export declare function defineSuiteDraftCapability(options: WriteCapabilityOptions): CapabilityDefinition;
+export declare function defineSuiteWriteCapability(options: WriteCapabilityOptions): CapabilityDefinition;
+export {};