boondmanager-mcp-server 2.15.2 → 2.17.0

package/LICENSE

@@ -185,7 +185,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2025 Frédéric Auguste
+   Copyright 2025-2026 Silamir
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/NOTICE

@@ -1,11 +1,25 @@
 BoondManager MCP Server
-Copyright 2025 Frédéric Auguste
+Copyright 2025-2026 Silamir
 
-This product includes software developed by Frédéric Auguste
+This product includes software developed by Silamir
 and contributors to the BoondManager MCP Server project.
 
+Originally created by Frédéric Auguste.
+
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+---
+
+BoondManager is a trademark of BoondManager SAS. This project is an
+independent, unofficial client for the BoondManager public API and is
+not affiliated with, endorsed by, or sponsored by BoondManager SAS.

package/README.md

@@ -1,14 +1,22 @@
+<p align="center">
+  <a href="https://www.silamir.com">
+    <img src="https://raw.githubusercontent.com/silamir/boondmanager-mcp-server/main/assets/silamir-logo.png" alt="Silamir" height="56" />
+  </a>
+</p>
+
 # BoondManager MCP Server
 
-[![CI](https://github.com/fauguste/boondmanager-mcp-server/actions/workflows/ci.yml/badge.svg)](https://github.com/fauguste/boondmanager-mcp-server/actions/workflows/ci.yml)
-[![CodeQL](https://github.com/fauguste/boondmanager-mcp-server/actions/workflows/codeql.yml/badge.svg)](https://github.com/fauguste/boondmanager-mcp-server/actions/workflows/codeql.yml)
+<p align="center"><em>Un projet open source <a href="https://www.silamir.com">Silamir</a>.</em></p>
+
+[![CI](https://github.com/silamir/boondmanager-mcp-server/actions/workflows/ci.yml/badge.svg)](https://github.com/silamir/boondmanager-mcp-server/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/silamir/boondmanager-mcp-server/actions/workflows/codeql.yml/badge.svg)](https://github.com/silamir/boondmanager-mcp-server/actions/workflows/codeql.yml)
 [![npm version](https://img.shields.io/npm/v/boondmanager-mcp-server.svg)](https://www.npmjs.com/package/boondmanager-mcp-server)
 [![npm downloads](https://img.shields.io/npm/dm/boondmanager-mcp-server.svg)](https://www.npmjs.com/package/boondmanager-mcp-server)
 [![Node.js](https://img.shields.io/node/v/boondmanager-mcp-server.svg)](https://nodejs.org/)
 [![TypeScript](https://img.shields.io/badge/TypeScript-strict-blue.svg)](https://www.typescriptlang.org/)
 [![MCP Registry](https://img.shields.io/badge/MCP-Registry-blue)](https://registry.modelcontextprotocol.io/)
 [![Docker Hub](https://img.shields.io/docker/v/fauguste/boondmanager-mcp-server?label=Docker%20Hub&logo=docker&color=2496ED)](https://hub.docker.com/r/fauguste/boondmanager-mcp-server)
-[![GHCR](https://img.shields.io/badge/GHCR-fauguste%2Fboondmanager--mcp--server-181717?logo=github)](https://github.com/fauguste/boondmanager-mcp-server/pkgs/container/boondmanager-mcp-server)
+[![GHCR](https://img.shields.io/badge/GHCR-silamir%2Fboondmanager--mcp--server-181717?logo=github)](https://github.com/silamir/boondmanager-mcp-server/pkgs/container/boondmanager-mcp-server)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 
 **Installation 1-clic :**
@@ -23,7 +31,7 @@
 
 Serveur MCP (Model Context Protocol) pour l'API BoondManager, permettant a Claude (Desktop, Cowork, Code) de rechercher, consulter, creer et modifier des enregistrements dans votre instance BoondManager.
 
-**182 outils** couvrant **38 domaines** de l'API BoondManager. Voir [TOOLS.md](./TOOLS.md) pour le catalogue auto-généré (outils + prompts + ressources).
+**235 outils** couvrant **42 domaines** de l'API BoondManager. Voir [TOOLS.md](./TOOLS.md) pour le catalogue auto-généré (outils + prompts + ressources).
 
 > **Sorties structurées.** En plus du texte lisible, les outils `search`, `create`, `update` et `delete` renvoient un `structuredContent` conforme à un `outputSchema` MCP : `search` → `{ total?, count, items[] }` (résumés compacts, pas les ressources JSON:API complètes), `create`/`update` → `{ id?, type? }`, `delete` → `{ id, deleted, reason? }`. Les clients MCP qui exploitent les sorties structurées obtiennent une référence d'entité fiable pour chaîner les appels. Les outils `get` restent en texte seul (leur texte est déjà du JSON exploitable).
 
@@ -125,8 +133,12 @@ Le serveur expose les dictionnaires de reference Boond comme **ressources MCP**
 | URI | Contenu |
 |-----|---------|
 | `boond://application/current-user` | Profil de l'utilisateur courant (id, agence, permissions) |
-| `boond://dictionary/states/{entity}` | Etats par entite : `resources`, `candidates`, `contacts`, `companies`, `opportunities`, `projects`, `invoices`, `orders`, `positionings`, `absences` |
-| `boond://dictionary/typeOf/{entity}` | Types par entite : `resources`, `candidates`, `contacts`, `projects`, `actions`, `absences` |
+| `boond://dictionary/states/{entity}` | Etats par entite : `resources`, `candidates`, `contacts`, `companies`, `opportunities`, `projects`, `invoices`, `orders`, `positionings`, `deliveries`, `payments`, `purchases`, `provider-invoices`, `products`, `quotations`, `probations` |
+| `boond://dictionary/typeOf/{entity}` | Types par entite : `resources`, `contacts`, `projects`, `contracts`, `deliveries`, `purchases`, `activities` |
+| `boond://dictionary/actions/{entity}` | Types d'action par entite de rattachement : `candidates`, `contacts`, `resources`, `opportunities`, `projects`, `invoices`, `orders` (le `typeOf` de `boond_actions_create`) |
+| `boond://dictionary/{sources,origins}` | Sources de candidature, origines d'opportunite |
+| `boond://dictionary/{paymentMethods,paymentTerms,taxRates,contractEndReasons}` | Parametres finance / RH utilises par les ecritures |
+| `boond://application/current-user/rights` | Niveau, agences / poles / BU, apps et droits par entite de l'utilisateur (vue condensee de `current-user`) |
 | `boond://dictionary/countries` | Liste des pays |
 | `boond://dictionary/currencies` | Liste des devises |
 | `boond://dictionary/languages` | Liste des langues |
@@ -215,7 +227,7 @@ Exemples d'invocation des prompts ressources / competences / CV :
 
 ### Claude Desktop (one-click)
 
-Telechargez le fichier `.mcpb` depuis la [derniere release GitHub](https://github.com/fauguste/boondmanager-mcp-server/releases/latest), puis dans Claude Desktop : **Fichier > Installer une extension...** et selectionnez le fichier. Les identifiants sont demandes a l'installation et stockes de maniere chiffree (Keychain macOS / Credential Manager Windows).
+Telechargez le fichier `.mcpb` depuis la [derniere release GitHub](https://github.com/silamir/boondmanager-mcp-server/releases/latest), puis dans Claude Desktop : **Fichier > Installer une extension...** et selectionnez le fichier. Les identifiants sont demandes a l'installation et stockes de maniere chiffree (Keychain macOS / Credential Manager Windows).
 
 ### Claude Code (plugin, recommande)
 
@@ -223,7 +235,7 @@ Meme confort que le one-click Desktop : un formulaire de configuration, aucune
 variable d'environnement a poser soi-meme.
 
 ```
-/plugin marketplace add fauguste/boondmanager-mcp-server
+/plugin marketplace add silamir/boondmanager-mcp-server
 /plugin install boondmanager-mcp@boondmanager
 ```
 
@@ -386,7 +398,7 @@ boondmanager-mcp-server
 ### Depuis les sources
 
 ```bash
-git clone https://github.com/fauguste/boondmanager-mcp-server.git
+git clone https://github.com/silamir/boondmanager-mcp-server.git
 cd boondmanager-mcp-server
 npm install
 npm run build
@@ -483,7 +495,7 @@ goose session --with-extension "npx -y boondmanager-mcp-server"
 Le depot embarque un manifeste d'extension Gemini CLI (`gemini-extension.json`). Installez l'extension directement depuis GitHub :
 
 ```bash
-gemini extensions install https://github.com/fauguste/boondmanager-mcp-server
+gemini extensions install https://github.com/silamir/boondmanager-mcp-server
 ```
 
 Definissez ensuite l'authentification dans votre environnement (Gemini interpole `${VAR}` au demarrage) :
@@ -507,6 +519,8 @@ Le serveur utilise [pino](https://getpino.io/) pour des logs structures JSON (ag
 
 En production (`NODE_ENV=production`), les logs sont en JSON par défaut. En dev, le format pretty (colorisé) est actif sauf si `LOG_FORMAT=json`. Chaque requête HTTP reçoit un `corrId` (8 hex) pour tracer la requête dans les logs.
 
+Les logs sont **toujours écrits sur stderr**, quel que soit le transport : en mode stdio, stdout est réservé au flux JSON-RPC et toute autre écriture corrompt la connexion côté client. Claude Desktop capture stderr dans son visualiseur de logs (Developer → Logs), c'est donc là que les avertissements (politique d'accès, mise à jour disponible, dictionnaires) sont visibles.
+
 ### Authentification
 
 **Option 1 : Token API JWT (recommande)**
@@ -520,6 +534,29 @@ export BOOND_USER="votre_login"
 export BOOND_PASSWORD="votre_mot_de_passe"
 ```
 
+### Transport HTTP en authentification statique (`BOOND_HTTP_STATIC_AUTH`)
+
+Par défaut, le transport HTTP (`MCP_TRANSPORT=http`) est une *ressource protégée OAuth2* : chaque requête MCP porte le token BoondManager de **son** utilisateur (voir [`docs/oauth.md`](docs/oauth.md)). `BOOND_HTTP_STATIC_AUTH=true` remplace ce modèle par les credentials d'environnement ci-dessus, partagés par toutes les requêtes — pour un déploiement mono-locataire auto-hébergé, un pipeline CI ou une passerelle interne sans flux OAuth.
+
+Dans ce mode, **plus rien n'authentifie le client MCP** : quiconque atteint le port agit avec les droits BoondManager de l'opérateur (lecture *et* écriture selon la politique d'accès). D'où :
+
+| Variable | Rôle |
+|----------|------|
+| `MCP_HTTP_API_KEY` | Secret partagé que le client doit présenter, en `Authorization: Bearer <clé>` ou `X-Api-Key: <clé>`. Comparaison en temps constant ; absente ou fausse → `401`. **Obligatoire** dès que le serveur n'écoute pas sur loopback (`0.0.0.0`, image Docker) : sinon il **refuse de démarrer**. |
+| `MCP_HTTP_INSECURE_STATIC_AUTH` | `1` pour accepter explicitement de démarrer sans clé hors loopback (réseau privé faisant office de frontière). Le nom dit ce qu'il fait. |
+
+```bash
+export MCP_TRANSPORT=http
+export MCP_HTTP_HOST=0.0.0.0
+export BOOND_HTTP_STATIC_AUTH=true
+export MCP_HTTP_API_KEY="$(openssl rand -hex 32)"
+export BOOND_USER_TOKEN=… BOOND_CLIENT_TOKEN=… BOOND_CLIENT_KEY=…
+npx boondmanager-mcp-server
+# côté client : Authorization: Bearer <MCP_HTTP_API_KEY>
+```
+
+`/healthz` reste accessible sans clé. En mode OAuth (défaut), `MCP_HTTP_API_KEY` est ignorée avec un avertissement : le Bearer y est le token BoondManager.
+
 ### URL personnalisee (si instance dediee)
 
 ```bash
@@ -561,6 +598,8 @@ Pour eviter qu'une boucle d'outils emballee n'inonde l'API (et n'enchaine les `4
 | `BOOND_HTTP_RATE_LIMIT_RPS` | `10` | Debit soutenu (requetes/seconde). `0` desactive completement. |
 | `BOOND_HTTP_RATE_LIMIT_BURST` | `20` | Capacite du bucket = taille maximale de rafale immediate. |
 
+En transport HTTP OAuth, le bucket est **par utilisateur** (identite derivee du Bearer) : la rafale d'un utilisateur ne ralentit pas les autres. En stdio et en static auth, une seule identite, donc un seul bucket — la limite est par identite, pas par processus.
+
 ### Cache du dictionnaire
 
 L'API BoondManager n'expose qu'un seul endpoint `/application/dictionary` qui renvoie l'intégralité des libellés (états, types, pays…). Le serveur le met en cache en mémoire pour éviter de le re-télécharger à chaque résolution état/type → libellé.
@@ -675,6 +714,7 @@ npx boondmanager-mcp-server
 | `MCP_HTTP_SESSION_SWEEP_INTERVAL_MS` | `300000` (5 min) | Frequence de balayage des sessions inactives. |
 | `MCP_HTTP_ALLOWED_HOSTS` | _(auto)_ | Liste blanche du header `Host` (anti DNS rebinding, CVE-2025-66414). `*` pour desactiver explicitement. |
 | `MCP_HTTP_ALLOWED_ORIGINS` | _(auto)_ | Liste blanche du header `Origin` (scheme + host + port) pour les clients navigateur ; un `Origin` hors liste recoit un `403` (exigence spec 2025-11-25). Defaut quand le serveur ecoute en loopback = **toute origine loopback, quel que soit le port** (`http`/`https` sur `localhost` / `127.0.0.1` / `[::1]`) plus l'origine de `MCP_HTTP_PUBLIC_URL` si elle est definie — MCP Inspector (`:6274`) ou un serveur de dev (`:5173`) fonctionnent sans configuration, et une origine distante recoit toujours un `403`. Validation desactivee sinon. Une liste explicite est en revanche comparee a l'identique (port compris). **Une requete sans `Origin` est toujours acceptee** (curl, gateways, clients MCP non-navigateur), et le document de decouverte `/.well-known/oauth-protected-resource` est exempte. `*` pour desactiver explicitement ; une valeur vide n'est pas une desactivation. |
+| `MCP_HTTP_VALIDATE_TOKEN` | `false` | Mode OAuth : valide chaque Bearer aupres de BoondManager (`GET /application/current-user`, mis en cache par token pendant `MCP_HTTP_TOKEN_VALIDATION_TTL_MS`, 60 s par defaut) **avant** de traiter la requete. Un token expire ou revoque recoit un `401` + `WWW-Authenticate: … error="invalid_token"`, ce que les clients MCP conformes transforment en nouvelle autorisation — sans l'option, le 401 n'apparait que dans le resultat d'un appel d'outil, d'ou aucun client ne relance l'OAuth. BoondManager injoignable → la requete passe (fail open). |
 
 **Variables OAuth2 — discovery (toutes optionnelles)**
 
@@ -722,7 +762,7 @@ Une image Docker prete a l'emploi est publiee a chaque release sur deux registre
 
 | Registre | Image | Page |
 |---|---|---|
-| GitHub Container Registry | `ghcr.io/fauguste/boondmanager-mcp-server` | [github.com/fauguste/boondmanager-mcp-server/pkgs/container/boondmanager-mcp-server](https://github.com/fauguste/boondmanager-mcp-server/pkgs/container/boondmanager-mcp-server) |
+| GitHub Container Registry | `ghcr.io/silamir/boondmanager-mcp-server` | [github.com/silamir/boondmanager-mcp-server/pkgs/container/boondmanager-mcp-server](https://github.com/silamir/boondmanager-mcp-server/pkgs/container/boondmanager-mcp-server) |
 | Docker Hub | `docker.io/fauguste/boondmanager-mcp-server` | [hub.docker.com/r/fauguste/boondmanager-mcp-server](https://hub.docker.com/r/fauguste/boondmanager-mcp-server) |
 
 Memes digests, memes tags — choisissez celui qui s'aligne avec votre tooling. L'image demarre par defaut en transport HTTP, sur le port 3000, sur l'interface `0.0.0.0`. **Aucun volume, aucun secret a stocker** — le serveur est stateless par construction.
@@ -733,7 +773,7 @@ docker run -d --restart unless-stopped \
   -p 127.0.0.1:3000:3000 \
   -e MCP_HTTP_PUBLIC_URL=https://mcp.votre-domaine.com/mcp \
   --name boondmanager-mcp \
-  ghcr.io/fauguste/boondmanager-mcp-server:latest
+  ghcr.io/silamir/boondmanager-mcp-server:latest
 
 # Ou via Docker Hub (anonyme)
 docker run -d --restart unless-stopped \
@@ -892,7 +932,7 @@ sur leurs schemas (le SDK MCP convertit les schemas Zod avec `target: 'draft-7'`
 qui valide avec un validateur **2020-12 uniquement** refuse de compiler un tel schema.
 
 **Correctif : mettre a jour vers >= 2.12.2.** Depuis cette version le serveur n'annonce plus
-aucun dialecte (`src/schema-dialect.ts`), ce que la suite de tests verifie sur les 182 outils
+aucun dialecte (`src/schema-dialect.ts`), ce que la suite de tests verifie sur les 185 outils
 a travers un vrai client, sous validateur 2020-12 **et** draft-07.
 
 **Redemarrer le connecteur ne suffit pas** : un redemarrage relance le binaire installe, il ne le
@@ -914,7 +954,7 @@ Selon le canal d'installation :
 | Extension Claude Desktop (`.mcpb`) | Telecharger le `.mcpb` de la derniere release et le reinstaller -- les extensions tierces ne s'auto-mettent pas a jour |
 | Plugin Claude Code | `/plugin marketplace update boondmanager` puis reinstaller le plugin (le lancement est epingle sur `boondmanager-mcp-server@X.Y.Z`) |
 | `claude mcp add` / config manuelle | Epingler `boondmanager-mcp-server@latest` (ou une version >= 2.12.2) dans la commande `npx` |
-| Docker / GHCR | `docker pull ghcr.io/fauguste/boondmanager-mcp-server:latest` |
+| Docker / GHCR | `docker pull ghcr.io/silamir/boondmanager-mcp-server:latest` |
 
 > Verifiez aussi la version de Node : le serveur requiert **Node.js >= 22**. Un poste encore en
 > Node 20 est en general un poste dont l'installation n'a pas ete rafraichie depuis longtemps.
@@ -970,6 +1010,11 @@ npm run typecheck
 
 ## Licence
 
-Apache License 2.0 - Copyright (c) 2025 Frédéric Auguste
+Apache License 2.0 — Copyright (c) 2025-2026 [Silamir](https://www.silamir.com).
+Créé à l'origine par Frédéric Auguste.
 
 Voir [LICENSE](./LICENSE) et [NOTICE](./NOTICE) pour les détails.
+
+BoondManager est une marque de BoondManager SAS. Ce projet est un client
+indépendant et non officiel de l'API publique BoondManager, sans affiliation
+avec BoondManager SAS.

package/dist/config/access-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-policy.d.ts","sourceRoot":"","sources":["../../src/config/access-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKzE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,eAAO,MAAM,cAAc,EAAE,SAAS,SAAS,EAA2C,CAAC;AAE3F,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,gHAAgH;IAChH,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACnC,qFAAqF;IACrF,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,kDAAkD;IAClD,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;CAC5B;AAuGD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAyDtF;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAK7E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,eAAe,GAAG,SAAS,GAAG,SAAS,CAK/E;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAE1G;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,SAAS,CAwB7E"}
+{"version":3,"file":"access-policy.d.ts","sourceRoot":"","sources":["../../src/config/access-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMzE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,eAAO,MAAM,cAAc,EAAE,SAAS,SAAS,EAA2C,CAAC;AAE3F,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,gHAAgH;IAChH,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACnC,qFAAqF;IACrF,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,kDAAkD;IAClD,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;CAC5B;AA0FD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAyDtF;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAK7E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,eAAe,GAAG,SAAS,GAAG,SAAS,CAK/E;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAE1G;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,SAAS,CAwB7E"}

package/dist/config/access-policy.js

@@ -1,18 +1,10 @@
+import { readBool, readString } from "./env.js";
 import { REGISTERED_DOMAINS } from "../constants.js";
 import { logger } from "../services/logger.js";
 import { PROFILE_NAMES, resolveProfile } from "./profiles.js";
 export const ALL_OPERATIONS = ["read", "create", "update", "delete"];
 // --- Env parsing helpers (mirroring the patterns already used across the
 // codebase: see transports/http.ts, services/oauth.ts, services/update-checker.ts) ---
-function readEnv(env, key) {
-    const raw = env[key];
-    if (raw === undefined)
-        return undefined;
-    // Ignore unresolved placeholders like "${SOMETHING}" (same guard as http.ts).
-    if (raw.startsWith("${"))
-        return undefined;
-    return raw;
-}
 /** Split a CSV / whitespace-separated env value into trimmed, non-empty tokens. */
 function parseList(raw) {
     if (!raw)
@@ -22,10 +14,6 @@ function parseList(raw) {
         .map((s) => s.trim())
         .filter((s) => s.length > 0);
 }
-function parseBoolean(raw) {
-    const v = (raw ?? "").toLowerCase().trim();
-    return v === "1" || v === "true" || v === "yes";
-}
 /** Normalise a user-supplied domain to the canonical (dash, lowercase) form. */
 function normalizeDomain(domain) {
     return domain.toLowerCase().trim().replace(/_/g, "-");
@@ -96,9 +84,9 @@ export function resolveAccessPolicy(env = process.env) {
     const log = logger.child({ component: "access-policy" });
     const known = new Set(REGISTERED_DOMAINS);
     // --- Domains ---
-    const allowItems = parseList(readEnv(env, "BOOND_MCP_DOMAINS"));
-    const profileItems = parseList(readEnv(env, "BOOND_MCP_PROFILE"));
-    const excludeItems = parseList(readEnv(env, "BOOND_MCP_EXCLUDE_DOMAINS"));
+    const allowItems = parseList(readString("BOOND_MCP_DOMAINS", env));
+    const profileItems = parseList(readString("BOOND_MCP_PROFILE", env));
+    const excludeItems = parseList(readString("BOOND_MCP_EXCLUDE_DOMAINS", env));
     // Explicit domains win over a profile bundle: the operator who listed
     // domains by hand is the one who knows exactly what they want exposed.
     const profileDomains = resolveProfileDomains(profileItems, log);
@@ -108,8 +96,8 @@ export function resolveAccessPolicy(env = process.env) {
     const allowedDomains = allowItems.length > 0 ? normalizeAndValidateDomains(allowItems, known, "BOOND_MCP_DOMAINS", log) : profileDomains;
     const excludedDomains = normalizeAndValidateDomains(excludeItems, known, "BOOND_MCP_EXCLUDE_DOMAINS", log);
     // --- Operations ---
-    const opItems = parseList(readEnv(env, "BOOND_MCP_OPERATIONS"));
-    const readOnlyShortcut = parseBoolean(readEnv(env, "BOOND_MCP_READ_ONLY"));
+    const opItems = parseList(readString("BOOND_MCP_OPERATIONS", env));
+    const readOnlyShortcut = readBool("BOOND_MCP_READ_ONLY", false, env);
     let operations;
     if (opItems.length > 0) {
         operations = validateOperations(opItems, log);

package/dist/config/access-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-policy.js","sourceRoot":"","sources":["../../src/config/access-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgC9D,MAAM,CAAC,MAAM,cAAc,GAAyB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAmB3F,0EAA0E;AAC1E,uFAAuF;AAEvF,SAAS,OAAO,CAAC,GAAsB,EAAE,GAAW;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,8EAA8E;IAC9E,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB;IAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,CAAC;AAClD,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,2BAA2B,CAClC,KAAe,EACf,KAA0B,EAC1B,OAAe,EACf,GAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAC9C,GAAG,OAAO,qBAAqB,GAAG,6BAA6B,KAAK,CAAC,IAAI,iBAAiB,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,KAAe,EAAE,GAAkB;IAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,EACpC,uCAAuC,GAAG,8BAA8B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpG,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe,EAAE,GAAkB;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAe,CAAC;QAC1C,IAAK,cAAoC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,EACd,4CAA4C,GAAG,gDAAgD,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;QAC5F,OAAO,IAAI,GAAG,CAAY,cAAc,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;IAElD,kBAAkB;IAClB,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAE1E,sEAAsE;IACtE,uEAAuE;IACvE,MAAM,cAAc,GAAG,qBAAqB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,cAAc,GAClB,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IACpH,MAAM,eAAe,GAAG,2BAA2B,CAAC,YAAY,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAE3G,qBAAqB;IACrB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAE3E,IAAI,UAA0B,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,UAAU,GAAG,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;SAAM,IAAI,gBAAgB,EAAE,CAAC;QAC5B,UAAU,GAAG,IAAI,GAAG,CAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,IAAI,GAAG,CAAY,cAAc,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAE7E,gFAAgF;IAChF,MAAM,UAAU,GAAG,cAAc,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,CAAC;IACpH,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CACN,8JAA8J,CAC/J,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CACN;YACE,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK;YAC5D,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC;YACrC,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;SAC5B,EACD,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,MAAoB,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,WAAwC;IAClE,IAAI,WAAW,EAAE,YAAY,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,WAAW,EAAE,eAAe,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3D,IAAI,WAAW,EAAE,cAAc,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,WAAwC;IAC/F,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,MAAiB,EAAE,MAAoB;IAChE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEpE,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,qFAAqF;YACrF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAY,CAAC;YAC3D,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAE9C,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAkD,CAAC;oBACxE,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;wBACrD,OAAO,SAAS,CAAC,CAAC,qDAAqD;oBACzE,CAAC;oBACD,OAAQ,KAAsC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrE,CAAC,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,+DAA+D;YAC/D,OAAQ,KAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"access-policy.js","sourceRoot":"","sources":["../../src/config/access-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgC9D,MAAM,CAAC,MAAM,cAAc,GAAyB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAmB3F,0EAA0E;AAC1E,uFAAuF;AAEvF,mFAAmF;AACnF,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,2BAA2B,CAClC,KAAe,EACf,KAA0B,EAC1B,OAAe,EACf,GAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAC9C,GAAG,OAAO,qBAAqB,GAAG,6BAA6B,KAAK,CAAC,IAAI,iBAAiB,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,KAAe,EAAE,GAAkB;IAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,EACpC,uCAAuC,GAAG,8BAA8B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpG,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe,EAAE,GAAkB;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAe,CAAC;QAC1C,IAAK,cAAoC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,EACd,4CAA4C,GAAG,gDAAgD,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;QAC5F,OAAO,IAAI,GAAG,CAAY,cAAc,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;IAElD,kBAAkB;IAClB,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC,CAAC;IAE7E,sEAAsE;IACtE,uEAAuE;IACvE,MAAM,cAAc,GAAG,qBAAqB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,cAAc,GAClB,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IACpH,MAAM,eAAe,GAAG,2BAA2B,CAAC,YAAY,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAE3G,qBAAqB;IACrB,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAErE,IAAI,UAA0B,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,UAAU,GAAG,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;SAAM,IAAI,gBAAgB,EAAE,CAAC;QAC5B,UAAU,GAAG,IAAI,GAAG,CAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,IAAI,GAAG,CAAY,cAAc,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAE7E,gFAAgF;IAChF,MAAM,UAAU,GAAG,cAAc,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,CAAC;IACpH,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CACN,8JAA8J,CAC/J,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CACN;YACE,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK;YAC5D,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC;YACrC,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;SAC5B,EACD,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,MAAoB,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,WAAwC;IAClE,IAAI,WAAW,EAAE,YAAY,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,WAAW,EAAE,eAAe,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3D,IAAI,WAAW,EAAE,cAAc,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,WAAwC;IAC/F,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,MAAiB,EAAE,MAAoB;IAChE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEpE,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,qFAAqF;YACrF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAY,CAAC;YAC3D,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAE9C,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAkD,CAAC;oBACxE,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;wBACrD,OAAO,SAAS,CAAC,CAAC,qDAAqD;oBACzE,CAAC;oBACD,OAAQ,KAAsC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrE,CAAC,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,+DAA+D;YAC/D,OAAQ,KAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/config/dictionary-overrides.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dictionary-overrides.d.ts","sourceRoot":"","sources":["../../src/config/dictionary-overrides.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,eAAe,yEAA0E,CAAC;AAEvG,uEAAuE;AACvE,eAAO,MAAM,cAAc,0JAajB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEjD,4CAA4C;AAC5C,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1C,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;CAC1C;AA8CD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,mBAAmB,GAAG,IAAI,CAuDxG;AASD,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,IAAI,CAMnE;AAED,wCAAwC;AACxC,wBAAgB,gCAAgC,IAAI,IAAI,CAGvD;AAaD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQxG;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAGlF;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9F;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAI3G"}
+{"version":3,"file":"dictionary-overrides.d.ts","sourceRoot":"","sources":["../../src/config/dictionary-overrides.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,eAAe,yEAA0E,CAAC;AAEvG,uEAAuE;AACvE,eAAO,MAAM,cAAc,0JAajB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEjD,4CAA4C;AAC5C,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1C,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;CAC1C;AAqCD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,mBAAmB,GAAG,IAAI,CAuDxG;AASD,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,IAAI,CAMnE;AAED,wCAAwC;AACxC,wBAAgB,gCAAgC,IAAI,IAAI,CAGvD;AAaD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQxG;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAGlF;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9F;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAI3G"}

package/dist/config/dictionary-overrides.js

@@ -1,4 +1,5 @@
 import { readFileSync } from "node:fs";
+import { readString } from "./env.js";
 import { z } from "zod";
 import { logger } from "../services/logger.js";
 /**
@@ -51,17 +52,6 @@ const OverridesFileSchema = z
 })
     .strict();
 // --- Env parsing helper (mirroring config/access-policy.ts) ---
-function readEnv(env, key) {
-    const raw = env[key];
-    if (raw === undefined)
-        return undefined;
-    // Ignore unresolved placeholders like "${SOMETHING}" (same guard as http.ts).
-    if (raw.startsWith("${"))
-        return undefined;
-    if (raw.trim().length === 0)
-        return undefined;
-    return raw;
-}
 /** Keep only known entity keys; warn-and-ignore the rest (never fatal). */
 function filterKnownEntities(section, raw, known, log) {
     const out = {};
@@ -82,7 +72,7 @@ function filterKnownEntities(section, raw, known, log) {
  */
 export function loadDictionaryOverrides(env = process.env) {
     const log = logger.child({ component: "dictionary-overrides" });
-    const raw = readEnv(env, "BOOND_DICTIONARY_OVERRIDES");
+    const raw = readString("BOOND_DICTIONARY_OVERRIDES", env);
     if (raw === undefined)
         return null;
     // Inline JSON if the value starts with "{", otherwise a file path.

package/dist/config/dictionary-overrides.js.map

@@ -1 +1 @@
-{"version":3,"file":"dictionary-overrides.js","sourceRoot":"","sources":["../../src/config/dictionary-overrides.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,CAAU,CAAC;AAEvG,uEAAuE;AACvE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,WAAW;IACX,UAAU;IACV,SAAS;IACT,SAAS;IACT,aAAa;IACb,SAAS;IACT,aAAa;IACb,WAAW;IACX,SAAS;IACT,SAAS;IACT,OAAO;IACP,SAAS;CACD,CAAC;AAYX,gDAAgD;AAChD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5E,6EAA6E;AAC7E,+CAA+C;AAC/C,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE;IACvD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iEAAiE;AAEjE,SAAS,OAAO,CAAC,GAAsB,EAAE,GAAW;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,8EAA8E;IAC9E,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,SAAS,mBAAmB,CAC1B,OAAwB,EACxB,GAA6B,EAC7B,KAAwB,EACxB,GAAkB;IAElB,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,EACtC,uCAAuC,OAAO,YAAY,MAAM,WAAW,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IACvD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEnC,mEAAmE;IACnE,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACxE,gFAAgF,CACjF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzD,kEAAkE,CACnE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,uEAAuE,CAAC,CAAC;QACnH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAwB;QACrC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC;QACrF,KAAK,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC;KAClF,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,IAAI,CACN;QACE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAC7C,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5C,EACD,4EAA4E,CAC7E,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0CAA0C;AAC1C,8EAA8E;AAC9E,6CAA6C;AAE7C,IAAI,MAAM,GAA+B,IAAI,CAAC;AAC9C,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,MAAM,UAAU,sBAAsB;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,gCAAgC;IAC9C,MAAM,GAAG,IAAI,CAAC;IACd,MAAM,GAAG,KAAK,CAAC;AACjB,CAAC;AAED,6BAA6B;AAE7B,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,OAAwB,EAAE,MAAc;IAC3D,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,OAAO,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAwB,EAAE,MAAc,EAAE,KAAa;IAClF,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,MAAM;YAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,OAAwB,EAAE,MAAc;IACtE,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,OAAwB,EAAE,MAAc;IAC7E,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY,EAAE,OAAwB,EAAE,MAAc;IACjG,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,GAAG,IAAI,iEAAiE,OAAO,EAAE,CAAC;AAC3F,CAAC"}
+{"version":3,"file":"dictionary-overrides.js","sourceRoot":"","sources":["../../src/config/dictionary-overrides.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,CAAU,CAAC;AAEvG,uEAAuE;AACvE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,WAAW;IACX,UAAU;IACV,SAAS;IACT,SAAS;IACT,aAAa;IACb,SAAS;IACT,aAAa;IACb,WAAW;IACX,SAAS;IACT,SAAS;IACT,OAAO;IACP,SAAS;CACD,CAAC;AAYX,gDAAgD;AAChD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5E,6EAA6E;AAC7E,+CAA+C;AAC/C,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE;IACvD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iEAAiE;AAEjE,2EAA2E;AAC3E,SAAS,mBAAmB,CAC1B,OAAwB,EACxB,GAA6B,EAC7B,KAAwB,EACxB,GAAkB;IAElB,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,EACtC,uCAAuC,OAAO,YAAY,MAAM,WAAW,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,UAAU,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEnC,mEAAmE;IACnE,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACxE,gFAAgF,CACjF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzD,kEAAkE,CACnE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,uEAAuE,CAAC,CAAC;QACnH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAwB;QACrC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC;QACrF,KAAK,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC;KAClF,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,IAAI,CACN;QACE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAC7C,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5C,EACD,4EAA4E,CAC7E,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0CAA0C;AAC1C,8EAA8E;AAC9E,6CAA6C;AAE7C,IAAI,MAAM,GAA+B,IAAI,CAAC;AAC9C,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,MAAM,UAAU,sBAAsB;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,gCAAgC;IAC9C,MAAM,GAAG,IAAI,CAAC;IACd,MAAM,GAAG,KAAK,CAAC;AACjB,CAAC;AAED,6BAA6B;AAE7B,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,OAAwB,EAAE,MAAc;IAC3D,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,OAAO,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAwB,EAAE,MAAc,EAAE,KAAa;IAClF,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,MAAM;YAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,OAAwB,EAAE,MAAc;IACtE,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,OAAwB,EAAE,MAAc;IAC7E,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY,EAAE,OAAwB,EAAE,MAAc;IACjG,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,GAAG,IAAI,iEAAiE,OAAO,EAAE,CAAC;AAC3F,CAAC"}

package/dist/config/env.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The one place configuration is read from the environment.
+ *
+ * Six readers used to coexist (`index.ts`, `transports/http.ts`,
+ * `services/oauth.ts`, `services/boond-client.ts`, `config/access-policy.ts`,
+ * `config/dictionary-overrides.ts`) and they disagreed on the one rule that
+ * matters for the packaged channels (issue #242): the MCPB manifest and the
+ * Claude Code plugin substitute `${user_config.KEY}` into **every** `BOOND_*`
+ * variable, so an option the user never filled arrives as `""`, as whitespace,
+ * or as the unsubstituted `"${…}"` — and only one of the six rejected the
+ * whitespace form. `MCP_HTTP_PATH=" "` became the endpoint path,
+ * `BOOND_OAUTH_AUTHORIZATION_SERVER=" "` broke the discovery document.
+ *
+ * Rule, applied by every reader here: `""`, whitespace-only and an
+ * unresolved `${…}` placeholder all mean *not configured*. A blank value must
+ * never switch a security control off (`MCP_HTTP_ALLOWED_HOSTS`) nor a
+ * restriction on (`BOOND_MCP_DOMAINS`); it falls through to the default.
+ *
+ * Every reader takes the environment as its last argument so the config
+ * modules that already accept an `env` for testing keep doing so.
+ */
+/** True when the raw value is one of the three "not configured" shapes. */
+export declare function isUnset(raw: string | undefined): boolean;
+/**
+ * The variable's value, or `undefined` when it is absent / blank / an
+ * unresolved placeholder. The value is returned as-is (not trimmed): a
+ * password may legitimately end with a space. Callers that want a token
+ * trim it themselves.
+ */
+export declare function readString(name: string, env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * A boolean switch. `1/true/yes/on` → `true`, `0/false/no/off` → `false`,
+ * anything else (unset, blank, placeholder, garbage) → `fallback`. Both
+ * spellings are accepted because the packaged channels send booleans as
+ * strings with an explicit `default` — `"false"` must not read as "set,
+ * therefore on".
+ */
+export declare function readBool(name: string, fallback?: boolean, env?: NodeJS.ProcessEnv): boolean;
+/**
+ * A positive integer (floored), or `fallback` for unset, non-numeric, negative
+ * or — unless `allowZero` — zero values.
+ */
+export declare function readPositiveInt(name: string, fallback: number, env?: NodeJS.ProcessEnv, options?: {
+    allowZero?: boolean;
+}): number;
+/**
+ * A list: comma and/or whitespace separated, trimmed, empties dropped.
+ * `undefined` when the variable is not configured **or** yields no token
+ * (`" , "`): a list with nothing in it is "unconfigured", never "allow
+ * nothing" — the `MCP_HTTP_ALLOWED_HOSTS` rule, applied to every list.
+ */
+export declare function readCsv(name: string, env?: NodeJS.ProcessEnv): string[] | undefined;
+/**
+ * An absolute URL, trimmed. Unset / blank / placeholder → `undefined`. A
+ * value that is present but not a URL **throws**, naming the variable: the
+ * URLs read here (`BOOND_BASE_URL`, `MCP_HTTP_PUBLIC_URL`,
+ * `BOOND_OAUTH_AUTHORIZATION_SERVER`) all decide where credentials are sent
+ * or where clients are told to go, so a typo must stop the start-up with a
+ * readable message rather than surface later as an opaque fetch error or a
+ * broken discovery document.
+ */
+export declare function readUrl(name: string, env?: NodeJS.ProcessEnv): string | undefined;
+//# sourceMappingURL=env.d.ts.map

package/dist/config/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,2EAA2E;AAC3E,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAIxD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAGjG;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,UAAQ,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAMtG;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,MAAM,CAQR;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,GAAG,SAAS,CAQhG;AAED;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAa9F"}

package/dist/config/env.js

@@ -0,0 +1,116 @@
+/**
+ * The one place configuration is read from the environment.
+ *
+ * Six readers used to coexist (`index.ts`, `transports/http.ts`,
+ * `services/oauth.ts`, `services/boond-client.ts`, `config/access-policy.ts`,
+ * `config/dictionary-overrides.ts`) and they disagreed on the one rule that
+ * matters for the packaged channels (issue #242): the MCPB manifest and the
+ * Claude Code plugin substitute `${user_config.KEY}` into **every** `BOOND_*`
+ * variable, so an option the user never filled arrives as `""`, as whitespace,
+ * or as the unsubstituted `"${…}"` — and only one of the six rejected the
+ * whitespace form. `MCP_HTTP_PATH=" "` became the endpoint path,
+ * `BOOND_OAUTH_AUTHORIZATION_SERVER=" "` broke the discovery document.
+ *
+ * Rule, applied by every reader here: `""`, whitespace-only and an
+ * unresolved `${…}` placeholder all mean *not configured*. A blank value must
+ * never switch a security control off (`MCP_HTTP_ALLOWED_HOSTS`) nor a
+ * restriction on (`BOOND_MCP_DOMAINS`); it falls through to the default.
+ *
+ * Every reader takes the environment as its last argument so the config
+ * modules that already accept an `env` for testing keep doing so.
+ */
+const TRUE_VALUES = new Set(["1", "true", "yes", "on"]);
+const FALSE_VALUES = new Set(["0", "false", "no", "off"]);
+/** True when the raw value is one of the three "not configured" shapes. */
+export function isUnset(raw) {
+    if (raw === undefined)
+        return true;
+    const trimmed = raw.trim();
+    return trimmed.length === 0 || trimmed.startsWith("${");
+}
+/**
+ * The variable's value, or `undefined` when it is absent / blank / an
+ * unresolved placeholder. The value is returned as-is (not trimmed): a
+ * password may legitimately end with a space. Callers that want a token
+ * trim it themselves.
+ */
+export function readString(name, env = process.env) {
+    const raw = env[name];
+    return isUnset(raw) ? undefined : raw;
+}
+/**
+ * A boolean switch. `1/true/yes/on` → `true`, `0/false/no/off` → `false`,
+ * anything else (unset, blank, placeholder, garbage) → `fallback`. Both
+ * spellings are accepted because the packaged channels send booleans as
+ * strings with an explicit `default` — `"false"` must not read as "set,
+ * therefore on".
+ */
+export function readBool(name, fallback = false, env = process.env) {
+    const raw = readString(name, env)?.trim().toLowerCase();
+    if (raw === undefined)
+        return fallback;
+    if (TRUE_VALUES.has(raw))
+        return true;
+    if (FALSE_VALUES.has(raw))
+        return false;
+    return fallback;
+}
+/**
+ * A positive integer (floored), or `fallback` for unset, non-numeric, negative
+ * or — unless `allowZero` — zero values.
+ */
+export function readPositiveInt(name, fallback, env = process.env, options = {}) {
+    const raw = readString(name, env);
+    if (raw === undefined)
+        return fallback;
+    const parsed = Number(raw.trim());
+    if (!Number.isFinite(parsed))
+        return fallback;
+    if (parsed < 0)
+        return fallback;
+    if (parsed === 0 && !options.allowZero)
+        return fallback;
+    return Math.floor(parsed);
+}
+/**
+ * A list: comma and/or whitespace separated, trimmed, empties dropped.
+ * `undefined` when the variable is not configured **or** yields no token
+ * (`" , "`): a list with nothing in it is "unconfigured", never "allow
+ * nothing" — the `MCP_HTTP_ALLOWED_HOSTS` rule, applied to every list.
+ */
+export function readCsv(name, env = process.env) {
+    const raw = readString(name, env);
+    if (raw === undefined)
+        return undefined;
+    const items = raw
+        .split(/[\s,]+/)
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+    return items.length > 0 ? items : undefined;
+}
+/**
+ * An absolute URL, trimmed. Unset / blank / placeholder → `undefined`. A
+ * value that is present but not a URL **throws**, naming the variable: the
+ * URLs read here (`BOOND_BASE_URL`, `MCP_HTTP_PUBLIC_URL`,
+ * `BOOND_OAUTH_AUTHORIZATION_SERVER`) all decide where credentials are sent
+ * or where clients are told to go, so a typo must stop the start-up with a
+ * readable message rather than surface later as an opaque fetch error or a
+ * broken discovery document.
+ */
+export function readUrl(name, env = process.env) {
+    const raw = readString(name, env)?.trim();
+    if (raw === undefined)
+        return undefined;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error(`Invalid ${name}: "${raw}" is not an absolute URL (expected e.g. https://host/path)`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error(`Invalid ${name}: "${raw}" must use http:// or https://`);
+    }
+    return raw;
+}
+//# sourceMappingURL=env.js.map

package/dist/config/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AACxD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAE1D,2EAA2E;AAC3E,MAAM,UAAU,OAAO,CAAC,GAAuB;IAC7C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC3E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,QAAQ,GAAG,KAAK,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC3F,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,QAAgB,EAChB,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IACxE,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IACxE,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,MAAM,GAAG,4DAA4D,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,MAAM,GAAG,gCAAgC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}