boondmanager-mcp-server 2.9.0 → 2.11.0

package/README.md

@@ -206,7 +206,7 @@ Exemples d'invocation des prompts ressources / competences / CV :
 
 ## Prerequis
 
-- Node.js >= 20
+- Node.js >= 22
 - Un compte BoondManager avec acces API active
 - L'option "Allow API Rest calls using BasicAuth authentication" activee dans la configuration BoondManager (si BasicAuth)
 
@@ -216,7 +216,52 @@ Exemples d'invocation des prompts ressources / competences / CV :
 
 Telechargez le fichier `.mcpb` depuis la [derniere release GitHub](https://github.com/fauguste/boondmanager-mcp-server/releases/latest), puis dans Claude Desktop : **Fichier > Installer une extension...** et selectionnez le fichier. Les identifiants sont demandes a l'installation et stockes de maniere chiffree (Keychain macOS / Credential Manager Windows).
 
-### Claude Code
+### Claude Code (plugin, recommande)
+
+Meme confort que le one-click Desktop : un formulaire de configuration, aucune
+variable d'environnement a poser soi-meme.
+
+```
+/plugin marketplace add fauguste/boondmanager-mcp-server
+/plugin install boondmanager-mcp@boondmanager
+```
+
+Claude Code affiche alors le formulaire des 14 options (identifiants, URL de
+base, restrictions d'acces). Tout est optionnel a l'ecran, mais il faut
+renseigner **un** des trois modes d'authentification : le trio `User Token` +
+`Client Token` + `Client Key` (JWT genere automatiquement, recommande), ou le
+`Token JWT` pre-construit, ou le couple `Utilisateur` + `Mot de passe`
+(BasicAuth). Les champs laisses vides retombent sur les valeurs par defaut.
+
+Si le serveur n'apparait pas immediatement dans `/mcp`, un `/reload-plugins`
+suffit — inutile de relancer Claude Code.
+
+Details utiles :
+
+- **Ou vont les secrets** : les 5 champs sensibles (`User Token`, `Client
+  Token`, `Client Key`, `Token JWT`, `Mot de passe`) vont dans le Keychain macOS
+  (ou `~/.claude/.credentials.json` a defaut), **pas** dans `settings.json`. Les
+  options non sensibles (URL, restrictions) sont stockees en clair dans
+  `pluginConfigs` de votre `~/.claude/settings.json`.
+- **Nommage des outils** : cote client les outils sont prefixes
+  `mcp__boondmanager__`, par exemple `mcp__boondmanager__boond_candidates_search`.
+  C'est ce nom qu'il faut utiliser dans une allow-list de permissions.
+- **Version** : le plugin lance la version npm epinglee dans son manifeste. Pour
+  passer a une nouvelle release : `/plugin marketplace update boondmanager` puis
+  reinstaller le plugin.
+- **Restreindre la surface** : les champs *Restriction* du formulaire mappent sur
+  les variables `BOOND_MCP_*` (profil metier, domaines, operations, lecture
+  seule). Voir [docs/access-control.md](./docs/access-control.md).
+- **Suppressions** : Claude Code supporte l'elicitation MCP, donc chaque
+  `boond_*_delete` demande une confirmation avant d'agir (option *Confirmer les
+  suppressions*, activee par defaut).
+
+Pour desinstaller : `/plugin uninstall boondmanager-mcp@boondmanager`.
+
+### Claude Code (manuel, `claude mcp add`)
+
+A privilegier si vous voulez piloter vous-meme les variables d'environnement,
+ou epingler une version differente de celle du plugin.
 
 ```bash
 # Avec un token API (recommande)
@@ -523,7 +568,7 @@ L'API BoondManager n'expose qu'un seul endpoint `/application/dictionary` qui re
 |----------|--------|-------------|
 | `BOOND_DICTIONARY_TTL_MS` | `3600000` (1 h) | Durée de vie du cache du dictionnaire, en millisecondes. Une valeur non numérique ou ≤ 0 retombe sur le défaut. |
 
-### Restriction d'accès (domaines / lecture seule)
+### Restriction d'accès (profils / domaines / lecture seule)
 
 Vous pouvez restreindre **ce que l'IA voit et peut faire**, entièrement par
 variables d'environnement : exposer seulement certains domaines (ex. la
@@ -531,6 +576,7 @@ comptabilité), et/ou bloquer les écritures et suppressions.
 
 | Variable | Effet |
 |----------|-------|
+| `BOOND_MCP_PROFILE` | Profil préconfiguré : `recruiting`, `sales`, `finance`, `delivery`, `admin` (CSV = union). Raccourci pour ne pas lister les domaines à la main. Ignoré si `BOOND_MCP_DOMAINS` est défini. |
 | `BOOND_MCP_DOMAINS` | Liste blanche de domaines (CSV). Absente = tous. Ex. `invoices,payments,application` |
 | `BOOND_MCP_EXCLUDE_DOMAINS` | Liste noire de domaines (CSV), appliquée après la liste blanche. Ex. `candidates,resources` |
 | `BOOND_MCP_OPERATIONS` | Opérations autorisées (CSV) parmi `read,create,update,delete`. Absente = toutes. |
@@ -542,7 +588,26 @@ comptabilité), et/ou bloquer les écritures et suppressions.
 > BoondManager (lecture seule, périmètre comptable…) ; ce filtre vient en
 > complément (économie de tokens, garde-fou anti-action accidentelle).
 
-Guide complet, règles de résolution et exemples : [docs/access-control.md](docs/access-control.md).
+Exemple — tout le périmètre gestion, en lecture seule :
+
+```bash
+export BOOND_MCP_PROFILE=finance
+export BOOND_MCP_READ_ONLY=true
+```
+
+Guide complet, règles de résolution, contenu de chaque profil (et le nombre
+d'outils qui en résulte) : [docs/access-control.md](docs/access-control.md).
+
+### Icônes (SEP-973)
+
+Les outils, prompts et ressources portent une icône par domaine (SVG inline en
+`data:` URI, aucun asset à héberger). Coût mesuré : **~40 Kio, soit ~14 % du
+payload `tools/list`**. Les déploiements qui ne les affichent pas (passerelles,
+clients texte) peuvent les supprimer :
+
+| Variable | Defaut | Description |
+|----------|--------|-------------|
+| `BOOND_MCP_ICONS` | activé | `0`/`false`/`no`/`off` : n'annonce aucune icône (outils, prompts, ressources). |
 
 ### Libellés personnalisés du dictionnaire
 
@@ -574,7 +639,7 @@ Le serveur supporte deux transports MCP, selectionnables via la variable d'envir
 
 ### Streamable HTTP (pour les gateways MCP)
 
-Depuis la v1.4.0, le serveur peut etre expose en HTTP (specification MCP Streamable HTTP 2025-03-26) afin d'etre branche derriere une passerelle MCP ou deploye comme service.
+Depuis la v1.4.0, le serveur peut etre expose en HTTP (transport MCP Streamable HTTP) afin d'etre branche derriere une passerelle MCP ou deploye comme service. La revision de protocole negociee est celle du SDK installe (`2025-11-25`).
 
 > **Authentification BoondManager : OAuth2 protected resource.** Le serveur HTTP **ne detient aucun secret** (ni `client_secret`, ni refresh token, ni stockage utilisateur). Chaque requete MCP doit porter `Authorization: Bearer <boond_access_token>` ; le serveur transmet le token tel quel a BoondManager. C'est le **client MCP** (Claude Desktop, Claude Code, gateway…) qui fait la danse OAuth contre BoondManager et qui gere le refresh. Procedure complete : [docs/oauth.md](docs/oauth.md).
 
@@ -608,6 +673,7 @@ npx boondmanager-mcp-server
 | `MCP_HTTP_SESSION_TTL_MS` | `1800000` (30 min) | En mode stateful, duree d'inactivite au-dela de laquelle une session est fermee. |
 | `MCP_HTTP_SESSION_SWEEP_INTERVAL_MS` | `300000` (5 min) | Frequence de balayage des sessions inactives. |
 | `MCP_HTTP_ALLOWED_HOSTS` | _(auto)_ | Liste blanche du header `Host` (anti DNS rebinding, CVE-2025-66414). `*` pour desactiver explicitement. |
+| `MCP_HTTP_ALLOWED_ORIGINS` | _(auto)_ | Liste blanche du header `Origin` (scheme + host + port) pour les clients navigateur ; un `Origin` hors liste recoit un `403` (exigence spec 2025-11-25). Defaut quand le serveur ecoute en loopback = **toute origine loopback, quel que soit le port** (`http`/`https` sur `localhost` / `127.0.0.1` / `[::1]`) plus l'origine de `MCP_HTTP_PUBLIC_URL` si elle est definie — MCP Inspector (`:6274`) ou un serveur de dev (`:5173`) fonctionnent sans configuration, et une origine distante recoit toujours un `403`. Validation desactivee sinon. Une liste explicite est en revanche comparee a l'identique (port compris). **Une requete sans `Origin` est toujours acceptee** (curl, gateways, clients MCP non-navigateur), et le document de decouverte `/.well-known/oauth-protected-resource` est exempte. `*` pour desactiver explicitement ; une valeur vide n'est pas une desactivation. |
 
 **Variables OAuth2 — discovery (toutes optionnelles)**
 
@@ -841,13 +907,13 @@ npm run typecheck
 
 ### Stack technique
 
-- **Runtime** : Node.js >= 20 (ES2022)
+- **Runtime** : Node.js >= 22 (ES2022)
 - **Langage** : TypeScript 5.8+ (mode strict)
 - **MCP SDK** : @modelcontextprotocol/sdk 1.12+
 - **Validation** : Zod 4
 - **Tests** : Vitest 4 + couverture V8
 - **Lint** : ESLint 10 + typescript-eslint
-- **Transports** : stdio (defaut) + Streamable HTTP (MCP 2025-03-26)
+- **Transports** : stdio (defaut) + Streamable HTTP (spec MCP 2025-11-25)
 
 ## Ressources
 

package/dist/config/access-policy.d.ts

@@ -17,9 +17,14 @@ import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
  *
  * Env vars (all optional; absent = no restriction = current behaviour):
  *  - `BOOND_MCP_DOMAINS`         CSV allow-list of domains. Absent = all.
+ *  - `BOOND_MCP_PROFILE`         CSV of pre-composed profiles (union). Ignored if DOMAINS is set.
  *  - `BOOND_MCP_EXCLUDE_DOMAINS` CSV deny-list. Applied AFTER the allow-list.
  *  - `BOOND_MCP_OPERATIONS`      CSV of `read,create,update,delete`. Absent = all.
  *  - `BOOND_MCP_READ_ONLY`       Boolean shortcut, equivalent to OPERATIONS=read.
+ *
+ * Precedence on the domain axis: `DOMAINS` (explicit) > `PROFILE` (bundle) >
+ * everything allowed; `EXCLUDE_DOMAINS` then applies in all three cases (deny
+ * always wins). The operation axis is orthogonal to all of this.
  */
 export type Operation = "read" | "create" | "update" | "delete";
 export declare const ALL_OPERATIONS: readonly Operation[];

package/dist/config/access-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-policy.d.ts","sourceRoot":"","sources":["../../src/config/access-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIzE;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,eAAO,MAAM,cAAc,EAAE,SAAS,SAAS,EAA2C,CAAC;AAE3F,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,gHAAgH;IAChH,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACnC,qFAAqF;IACrF,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,kDAAkD;IAClD,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;CAC5B;AA2ED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAiDtF;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAK7E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,eAAe,GAAG,SAAS,GAAG,SAAS,CAK/E;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAE1G;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,SAAS,CAwB7E"}
+{"version":3,"file":"access-policy.d.ts","sourceRoot":"","sources":["../../src/config/access-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKzE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,eAAO,MAAM,cAAc,EAAE,SAAS,SAAS,EAA2C,CAAC;AAE3F,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,gHAAgH;IAChH,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACnC,qFAAqF;IACrF,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,kDAAkD;IAClD,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;CAC5B;AAuGD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAyDtF;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAK7E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,eAAe,GAAG,SAAS,GAAG,SAAS,CAK/E;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAE1G;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,SAAS,CAwB7E"}

package/dist/config/access-policy.js

@@ -1,5 +1,6 @@
 import { REGISTERED_DOMAINS } from "../constants.js";
 import { logger } from "../services/logger.js";
+import { PROFILE_NAMES, resolveProfile } from "./profiles.js";
 export const ALL_OPERATIONS = ["read", "create", "update", "delete"];
 // --- Env parsing helpers (mirroring the patterns already used across the
 // codebase: see transports/http.ts, services/oauth.ts, services/update-checker.ts) ---
@@ -42,6 +43,32 @@ function normalizeAndValidateDomains(items, known, varName, log) {
     }
     return out;
 }
+/**
+ * Union of the domains of every valid profile named in `BOOND_MCP_PROFILE`.
+ * Returns `null` when nothing usable was configured, so the caller can tell
+ * "no profile" from "a profile that resolved to nothing" — an unknown profile
+ * is warned-and-ignored (same resilience rule as unknown domains), never fatal
+ * and never a silently empty surface.
+ */
+function resolveProfileDomains(items, log) {
+    if (items.length === 0)
+        return null;
+    const out = new Set();
+    for (const raw of items) {
+        const domains = resolveProfile(raw);
+        if (domains === undefined) {
+            log.warn({ value: raw, known: PROFILE_NAMES }, `BOOND_MCP_PROFILE: unknown profile "${raw}" ignored (expected one of ${PROFILE_NAMES.join(", ")})`);
+            continue;
+        }
+        for (const d of domains)
+            out.add(d);
+    }
+    if (out.size === 0) {
+        log.warn("BOOND_MCP_PROFILE contained no valid profile; falling back to the full domain surface");
+        return null;
+    }
+    return out;
+}
 function validateOperations(items, log) {
     const out = new Set();
     for (const raw of items) {
@@ -70,8 +97,15 @@ export function resolveAccessPolicy(env = process.env) {
     const known = new Set(REGISTERED_DOMAINS);
     // --- Domains ---
     const allowItems = parseList(readEnv(env, "BOOND_MCP_DOMAINS"));
+    const profileItems = parseList(readEnv(env, "BOOND_MCP_PROFILE"));
     const excludeItems = parseList(readEnv(env, "BOOND_MCP_EXCLUDE_DOMAINS"));
-    const allowedDomains = allowItems.length > 0 ? normalizeAndValidateDomains(allowItems, known, "BOOND_MCP_DOMAINS", log) : null;
+    // Explicit domains win over a profile bundle: the operator who listed
+    // domains by hand is the one who knows exactly what they want exposed.
+    const profileDomains = resolveProfileDomains(profileItems, log);
+    if (allowItems.length > 0 && profileDomains !== null) {
+        log.warn("Both BOOND_MCP_DOMAINS and BOOND_MCP_PROFILE are set; BOOND_MCP_DOMAINS takes precedence");
+    }
+    const allowedDomains = allowItems.length > 0 ? normalizeAndValidateDomains(allowItems, known, "BOOND_MCP_DOMAINS", log) : profileDomains;
     const excludedDomains = normalizeAndValidateDomains(excludeItems, known, "BOOND_MCP_EXCLUDE_DOMAINS", log);
     // --- Operations ---
     const opItems = parseList(readEnv(env, "BOOND_MCP_OPERATIONS"));
@@ -97,6 +131,7 @@ export function resolveAccessPolicy(env = process.env) {
             log.warn("Domain `application` is filtered out; dictionary lookups (state/type labels) and current-user resolution will be unavailable, degrading many tools/resources");
         }
         log.info({
+            ...(profileItems.length > 0 ? { profiles: profileItems } : {}),
             allowedDomains: allowedDomains ? [...allowedDomains] : "all",
             excludedDomains: [...excludedDomains],
             operations: [...operations],

package/dist/config/access-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-policy.js","sourceRoot":"","sources":["../../src/config/access-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AA2B/C,MAAM,CAAC,MAAM,cAAc,GAAyB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAmB3F,0EAA0E;AAC1E,uFAAuF;AAEvF,SAAS,OAAO,CAAC,GAAsB,EAAE,GAAW;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,8EAA8E;IAC9E,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB;IAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,CAAC;AAClD,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,2BAA2B,CAClC,KAAe,EACf,KAA0B,EAC1B,OAAe,EACf,GAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAC9C,GAAG,OAAO,qBAAqB,GAAG,6BAA6B,KAAK,CAAC,IAAI,iBAAiB,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe,EAAE,GAAkB;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAe,CAAC;QAC1C,IAAK,cAAoC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,EACd,4CAA4C,GAAG,gDAAgD,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;QAC5F,OAAO,IAAI,GAAG,CAAY,cAAc,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;IAElD,kBAAkB;IAClB,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAE1E,MAAM,cAAc,GAClB,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1G,MAAM,eAAe,GAAG,2BAA2B,CAAC,YAAY,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAE3G,qBAAqB;IACrB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAE3E,IAAI,UAA0B,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,UAAU,GAAG,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;SAAM,IAAI,gBAAgB,EAAE,CAAC;QAC5B,UAAU,GAAG,IAAI,GAAG,CAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,IAAI,GAAG,CAAY,cAAc,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAE7E,gFAAgF;IAChF,MAAM,UAAU,GAAG,cAAc,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,CAAC;IACpH,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CACN,8JAA8J,CAC/J,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CACN;YACE,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK;YAC5D,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC;YACrC,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;SAC5B,EACD,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,MAAoB,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,WAAwC;IAClE,IAAI,WAAW,EAAE,YAAY,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,WAAW,EAAE,eAAe,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3D,IAAI,WAAW,EAAE,cAAc,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,WAAwC;IAC/F,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,MAAiB,EAAE,MAAoB;IAChE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEpE,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,qFAAqF;YACrF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAY,CAAC;YAC3D,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAE9C,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAkD,CAAC;oBACxE,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;wBACrD,OAAO,SAAS,CAAC,CAAC,qDAAqD;oBACzE,CAAC;oBACD,OAAQ,KAAsC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrE,CAAC,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,+DAA+D;YAC/D,OAAQ,KAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"access-policy.js","sourceRoot":"","sources":["../../src/config/access-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgC9D,MAAM,CAAC,MAAM,cAAc,GAAyB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAmB3F,0EAA0E;AAC1E,uFAAuF;AAEvF,SAAS,OAAO,CAAC,GAAsB,EAAE,GAAW;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,8EAA8E;IAC9E,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB;IAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,CAAC;AAClD,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,2BAA2B,CAClC,KAAe,EACf,KAA0B,EAC1B,OAAe,EACf,GAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAC9C,GAAG,OAAO,qBAAqB,GAAG,6BAA6B,KAAK,CAAC,IAAI,iBAAiB,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,KAAe,EAAE,GAAkB;IAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,EACpC,uCAAuC,GAAG,8BAA8B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpG,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe,EAAE,GAAkB;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAe,CAAC;QAC1C,IAAK,cAAoC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,EAAE,KAAK,EAAE,GAAG,EAAE,EACd,4CAA4C,GAAG,gDAAgD,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;QAC5F,OAAO,IAAI,GAAG,CAAY,cAAc,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;IAElD,kBAAkB;IAClB,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAE1E,sEAAsE;IACtE,uEAAuE;IACvE,MAAM,cAAc,GAAG,qBAAqB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,cAAc,GAClB,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IACpH,MAAM,eAAe,GAAG,2BAA2B,CAAC,YAAY,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAE3G,qBAAqB;IACrB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAE3E,IAAI,UAA0B,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,UAAU,GAAG,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;SAAM,IAAI,gBAAgB,EAAE,CAAC;QAC5B,UAAU,GAAG,IAAI,GAAG,CAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,IAAI,GAAG,CAAY,cAAc,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAE7E,gFAAgF;IAChF,MAAM,UAAU,GAAG,cAAc,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,CAAC;IACpH,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CACN,8JAA8J,CAC/J,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CACN;YACE,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK;YAC5D,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC;YACrC,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;SAC5B,EACD,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,MAAoB,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,WAAwC;IAClE,IAAI,WAAW,EAAE,YAAY,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,WAAW,EAAE,eAAe,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3D,IAAI,WAAW,EAAE,cAAc,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,WAAwC;IAC/F,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,MAAiB,EAAE,MAAoB;IAChE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEpE,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,qFAAqF;YACrF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAY,CAAC;YAC3D,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAE9C,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAkD,CAAC;oBACxE,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;wBACrD,OAAO,SAAS,CAAC,CAAC,qDAAqD;oBACzE,CAAC;oBACD,OAAQ,KAAsC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrE,CAAC,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,+DAA+D;YAC/D,OAAQ,KAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/config/env-flags.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Shared parsing for the `BOOND_MCP_*` opt-out switches.
+ *
+ * Both toggles (`BOOND_MCP_ICONS`, `BOOND_MCP_CONFIRM_DELETE`) are
+ * "on unless explicitly turned off", and both accepted the same four spellings
+ * through two identical copies of this function. One copy means the accepted
+ * vocabulary can't drift between switches.
+ */
+/** Is this env var explicitly set to an "off" value? Absent/empty = not disabled. */
+export declare function isFeatureDisabled(raw: string | undefined): boolean;
+//# sourceMappingURL=env-flags.d.ts.map

package/dist/config/env-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-flags.d.ts","sourceRoot":"","sources":["../../src/config/env-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGlE"}

package/dist/config/env-flags.js

@@ -0,0 +1,16 @@
+/**
+ * Shared parsing for the `BOOND_MCP_*` opt-out switches.
+ *
+ * Both toggles (`BOOND_MCP_ICONS`, `BOOND_MCP_CONFIRM_DELETE`) are
+ * "on unless explicitly turned off", and both accepted the same four spellings
+ * through two identical copies of this function. One copy means the accepted
+ * vocabulary can't drift between switches.
+ */
+const OFF_VALUES = ["0", "false", "no", "off"];
+/** Is this env var explicitly set to an "off" value? Absent/empty = not disabled. */
+export function isFeatureDisabled(raw) {
+    if (!raw)
+        return false;
+    return OFF_VALUES.includes(raw.trim().toLowerCase());
+}
+//# sourceMappingURL=env-flags.js.map

package/dist/config/env-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-flags.js","sourceRoot":"","sources":["../../src/config/env-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAE/C,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACvD,CAAC"}

package/dist/config/profiles.d.ts

@@ -0,0 +1,71 @@
+import type { DomainName } from "../constants.js";
+/**
+ * Pre-composed domain sets ("profiles") for `BOOND_MCP_PROFILE`.
+ *
+ * Why: `BOOND_MCP_DOMAINS` is the precise tool, but composing it means knowing
+ * all 38 domain names *and* which ones a job actually needs (a recruiter needs
+ * `positionings` and `actions`, not just `candidates`). With on-demand tool
+ * discovery in clients, narrowing the surface is still the highest-leverage
+ * knob — so it has to be usable in one env var, without a trip to TOOLS.md.
+ *
+ * Each profile is a job-shaped bundle, not a security tier: see
+ * `docs/access-control.md`, this layer hides tools from the model, it does not
+ * revoke BoondManager rights. Combine with `BOOND_MCP_READ_ONLY` /
+ * `BOOND_MCP_OPERATIONS` (orthogonal axis) to bound what can be written.
+ *
+ * `application` is in every profile on purpose: it backs dictionary resolution
+ * (state/type labels) and `current-user`, which many tools and prompts depend
+ * on. `workflows` is listed wherever prompt mirrors make sense; it is not
+ * strictly required (workflow tools follow their source prompt's domains, not
+ * the allow-list), but keeping it explicit documents the intent and survives a
+ * future change of that rule.
+ *
+ * There is no blanket "`resources` everywhere" rule — the rule is **per
+ * profile, check the prompt count**. 8 of the 11 prompts orchestrate
+ * `resources` (`synthese_equipe`, `staffing_disponible`, `fiche_consultant`,
+ * `recherche_profil_competences`, …) and a prompt is cut as soon as ONE of its
+ * domains is filtered out, so leaving `resources` out of `recruiting` / `sales`
+ * bought ~10 fewer tools and cost most of their runbooks — the wrong trade for a
+ * layer whose whole point is ergonomics. It is also what those jobs actually
+ * need: a recruiter matches candidates against internal staff, a salesperson
+ * staffs a deal. `finance` and `admin` deliberately do NOT include it: neither
+ * has a runbook that touches `resources` (`finance`'s only prompt,
+ * `factures_a_relancer`, spans `invoices` + `application`), so it would add
+ * tools and no capability. When adding a profile, count the prompts it keeps —
+ * not just the tools.
+ */
+declare const PROFILE_TABLE: {
+    /** Recrutement / sourcing : viviers, positionnements, suivi d'activité. */
+    readonly recruiting: readonly ["candidates", "positionings", "opportunities", "contacts", "companies", "documents", "actions", "resources", "application", "workflows"];
+    /** Avant-vente / commerce : pipeline, comptes, commandes. */
+    readonly sales: readonly ["opportunities", "companies", "contacts", "actions", "projects", "orders", "products", "reporting", "resources", "application", "workflows"];
+    /** Gestion / compta : facturation client et fournisseur, encaissements. */
+    readonly finance: readonly ["invoices", "payments", "orders", "purchases", "provider-invoices", "expenses", "projects", "companies", "reporting", "application", "workflows"];
+    /** Delivery / staffing : missions, CRA, absences, validations. */
+    readonly delivery: readonly ["projects", "deliveries", "resources", "timesheets", "absences", "planning-absences", "validations", "application", "workflows"];
+    /** Administration de l'outil : référentiels d'organisation et journaux. */
+    readonly admin: readonly ["accounts", "agencies", "business-units", "poles", "roles", "logs", "webhooks", "flags", "application"];
+};
+/** Profile name literals (`"recruiting" | "sales" | …`). */
+export type ProfileName = keyof typeof PROFILE_TABLE;
+/**
+ * The profile bundles. Keyed by `string` for iteration/lookup convenience;
+ * `ProfileName` above keeps the literal union available for typed callers (an
+ * index signature on the exported value would erase it).
+ */
+export declare const PROFILES: Readonly<Record<string, readonly DomainName[]>>;
+/** Canonical list of profile names, for error messages and docs. */
+export declare const PROFILE_NAMES: readonly ProfileName[];
+/**
+ * Case-insensitive profile lookup (`Finance`, `FINANCE` → `finance`).
+ *
+ * `Object.hasOwn` is what makes this safe: a plain `PROFILES[name]` returns
+ * `Object.prototype`'s own properties for `BOOND_MCP_PROFILE=constructor`
+ * (`toString`, `valueOf`, `hasOwnProperty`, `__proto__`…) — a truthy non-array
+ * that skips the caller's warn-and-ignore branch and then throws
+ * `TypeError: … is not iterable` at startup, i.e. a dead server instead of the
+ * documented warning.
+ */
+export declare function resolveProfile(name: string): readonly DomainName[] | undefined;
+export {};
+//# sourceMappingURL=profiles.d.ts.map

package/dist/config/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/config/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,QAAA,MAAM,aAAa;IACjB,2EAA2E;;IAa3E,6DAA6D;;IAc7D,2EAA2E;;IAc3E,kEAAkE;;IAYlE,2EAA2E;;CAEnB,CAAC;AAE3D,4DAA4D;AAC5D,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,aAAa,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC,CAAiB,CAAC;AAEvF,oEAAoE;AACpE,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAAgD,CAAC;AAEjG;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,UAAU,EAAE,GAAG,SAAS,CAG9E"}

package/dist/config/profiles.js

@@ -0,0 +1,115 @@
+/**
+ * Pre-composed domain sets ("profiles") for `BOOND_MCP_PROFILE`.
+ *
+ * Why: `BOOND_MCP_DOMAINS` is the precise tool, but composing it means knowing
+ * all 38 domain names *and* which ones a job actually needs (a recruiter needs
+ * `positionings` and `actions`, not just `candidates`). With on-demand tool
+ * discovery in clients, narrowing the surface is still the highest-leverage
+ * knob — so it has to be usable in one env var, without a trip to TOOLS.md.
+ *
+ * Each profile is a job-shaped bundle, not a security tier: see
+ * `docs/access-control.md`, this layer hides tools from the model, it does not
+ * revoke BoondManager rights. Combine with `BOOND_MCP_READ_ONLY` /
+ * `BOOND_MCP_OPERATIONS` (orthogonal axis) to bound what can be written.
+ *
+ * `application` is in every profile on purpose: it backs dictionary resolution
+ * (state/type labels) and `current-user`, which many tools and prompts depend
+ * on. `workflows` is listed wherever prompt mirrors make sense; it is not
+ * strictly required (workflow tools follow their source prompt's domains, not
+ * the allow-list), but keeping it explicit documents the intent and survives a
+ * future change of that rule.
+ *
+ * There is no blanket "`resources` everywhere" rule — the rule is **per
+ * profile, check the prompt count**. 8 of the 11 prompts orchestrate
+ * `resources` (`synthese_equipe`, `staffing_disponible`, `fiche_consultant`,
+ * `recherche_profil_competences`, …) and a prompt is cut as soon as ONE of its
+ * domains is filtered out, so leaving `resources` out of `recruiting` / `sales`
+ * bought ~10 fewer tools and cost most of their runbooks — the wrong trade for a
+ * layer whose whole point is ergonomics. It is also what those jobs actually
+ * need: a recruiter matches candidates against internal staff, a salesperson
+ * staffs a deal. `finance` and `admin` deliberately do NOT include it: neither
+ * has a runbook that touches `resources` (`finance`'s only prompt,
+ * `factures_a_relancer`, spans `invoices` + `application`), so it would add
+ * tools and no capability. When adding a profile, count the prompts it keeps —
+ * not just the tools.
+ */
+const PROFILE_TABLE = {
+    /** Recrutement / sourcing : viviers, positionnements, suivi d'activité. */
+    recruiting: [
+        "candidates",
+        "positionings",
+        "opportunities",
+        "contacts",
+        "companies",
+        "documents",
+        "actions",
+        "resources",
+        "application",
+        "workflows",
+    ],
+    /** Avant-vente / commerce : pipeline, comptes, commandes. */
+    sales: [
+        "opportunities",
+        "companies",
+        "contacts",
+        "actions",
+        "projects",
+        "orders",
+        "products",
+        "reporting",
+        "resources",
+        "application",
+        "workflows",
+    ],
+    /** Gestion / compta : facturation client et fournisseur, encaissements. */
+    finance: [
+        "invoices",
+        "payments",
+        "orders",
+        "purchases",
+        "provider-invoices",
+        "expenses",
+        "projects",
+        "companies",
+        "reporting",
+        "application",
+        "workflows",
+    ],
+    /** Delivery / staffing : missions, CRA, absences, validations. */
+    delivery: [
+        "projects",
+        "deliveries",
+        "resources",
+        "timesheets",
+        "absences",
+        "planning-absences",
+        "validations",
+        "application",
+        "workflows",
+    ],
+    /** Administration de l'outil : référentiels d'organisation et journaux. */
+    admin: ["accounts", "agencies", "business-units", "poles", "roles", "logs", "webhooks", "flags", "application"],
+};
+/**
+ * The profile bundles. Keyed by `string` for iteration/lookup convenience;
+ * `ProfileName` above keeps the literal union available for typed callers (an
+ * index signature on the exported value would erase it).
+ */
+export const PROFILES = PROFILE_TABLE;
+/** Canonical list of profile names, for error messages and docs. */
+export const PROFILE_NAMES = Object.keys(PROFILE_TABLE);
+/**
+ * Case-insensitive profile lookup (`Finance`, `FINANCE` → `finance`).
+ *
+ * `Object.hasOwn` is what makes this safe: a plain `PROFILES[name]` returns
+ * `Object.prototype`'s own properties for `BOOND_MCP_PROFILE=constructor`
+ * (`toString`, `valueOf`, `hasOwnProperty`, `__proto__`…) — a truthy non-array
+ * that skips the caller's warn-and-ignore branch and then throws
+ * `TypeError: … is not iterable` at startup, i.e. a dead server instead of the
+ * documented warning.
+ */
+export function resolveProfile(name) {
+    const key = name.toLowerCase().trim();
+    return Object.hasOwn(PROFILES, key) ? PROFILES[key] : undefined;
+}
+//# sourceMappingURL=profiles.js.map

package/dist/config/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/config/profiles.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,aAAa,GAAG;IACpB,2EAA2E;IAC3E,UAAU,EAAE;QACV,YAAY;QACZ,cAAc;QACd,eAAe;QACf,UAAU;QACV,WAAW;QACX,WAAW;QACX,SAAS;QACT,WAAW;QACX,aAAa;QACb,WAAW;KACZ;IACD,6DAA6D;IAC7D,KAAK,EAAE;QACL,eAAe;QACf,WAAW;QACX,UAAU;QACV,SAAS;QACT,UAAU;QACV,QAAQ;QACR,UAAU;QACV,WAAW;QACX,WAAW;QACX,aAAa;QACb,WAAW;KACZ;IACD,2EAA2E;IAC3E,OAAO,EAAE;QACP,UAAU;QACV,UAAU;QACV,QAAQ;QACR,WAAW;QACX,mBAAmB;QACnB,UAAU;QACV,UAAU;QACV,WAAW;QACX,WAAW;QACX,aAAa;QACb,WAAW;KACZ;IACD,kEAAkE;IAClE,QAAQ,EAAE;QACR,UAAU;QACV,YAAY;QACZ,WAAW;QACX,YAAY;QACZ,UAAU;QACV,mBAAmB;QACnB,aAAa;QACb,aAAa;QACb,WAAW;KACZ;IACD,2EAA2E;IAC3E,KAAK,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC;CACvD,CAAC;AAK3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAoD,aAAa,CAAC;AAEvF,oEAAoE;AACpE,MAAM,CAAC,MAAM,aAAa,GAA2B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAkB,CAAC;AAEjG;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC"}

package/dist/icons.d.ts

@@ -0,0 +1,79 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { DomainName } from "./constants.js";
+import type { RegistrationIndex } from "./tools/registration-decorators.js";
+/**
+ * Protocol-level icons (SEP-973, spec 2025-11-25) for tools, prompts and
+ * resources.
+ *
+ * ## Scope: one icon per *domain*, not per tool
+ *
+ * 180 hand-picked icons would be unmaintainable and would triple the byte cost
+ * below. Every tool of a domain shares that domain's glyph, which is also what
+ * a client UI wants: the icon groups the catalogue, the name distinguishes
+ * inside the group.
+ *
+ * ## Byte cost
+ *
+ * `icons` rides on every entry of `tools/list`, so it competes with the tool
+ * catalogue itself. Two consequences baked into the format below:
+ *
+ * - inline `data:` SVG only (no network fetch from the client, no asset to
+ *   host, no CSP question);
+ * - a deliberately spartan glyph vocabulary — 16×16 viewBox, single `<path>`,
+ *   no `mimeType`/`sizes` fields (the data URI already carries the type, and an
+ *   SVG is scalable by definition). `descriptions.test.ts` caps both the
+ *   per-icon size and the total added to `tools/list`.
+ *
+ * ## Why a response decorator and not a `registerTool` option
+ *
+ * `@modelcontextprotocol/sdk@1.30` types `icons` on `Tool`/`Prompt`/`Resource`
+ * but its `McpServer` never emits them: the `tools/list` and `prompts/list`
+ * handlers build their entries field by field and drop anything else
+ * (`server/mcp.js`). Resources are the exception — their listing spreads the
+ * whole registration config, so `registerResource` can carry `icons` natively
+ * (see `resources/index.ts`).
+ *
+ * So for tools and prompts we decorate the *responses*: `installProtocolIcons`
+ * wraps the handlers the SDK installs, using only the public
+ * `Server.setRequestHandler` API plus schema identity. When the SDK gains
+ * first-class support, this whole shim can be deleted in favour of passing
+ * `icons` in the registration config — `src/icons.test.ts` fails loudly if the
+ * shim ever stops producing icons.
+ */
+export interface Icon {
+    src: string;
+    mimeType?: string;
+    sizes?: string[];
+}
+/**
+ * Domain → icons. Every entry of `REGISTERED_DOMAINS` must be present
+ * (asserted in `icons.test.ts`), so adding a domain without an icon fails CI
+ * rather than shipping a half-iconified catalogue.
+ */
+export declare const DOMAIN_ICONS: Readonly<Record<DomainName, Icon[]>>;
+/**
+ * Icons for the dictionary / reference resources (`boond://…`). Resolved
+ * through a function, not a constant, because `registerAllResources` runs at
+ * startup and must honour `BOOND_MCP_ICONS` too.
+ */
+export declare function referenceIcons(): Icon[] | undefined;
+/** Icons for the `current-user` resource. */
+export declare function identityIcons(): Icon[] | undefined;
+export declare function iconsForDomain(domain: DomainName | undefined): Icon[] | undefined;
+/**
+ * Prompt → icons, from the first domain the prompt orchestrates (its subject:
+ * `factures_a_relancer` → invoices, `synthese_equipe` → resources).
+ */
+export declare function iconsForPrompt(name: string): Icon[] | undefined;
+/** Total byte cost of an icon payload, for the cap test and the docs. */
+export declare function iconsByteSize(icons: readonly Icon[] | undefined): number;
+/**
+ * Attach domain icons to `tools/list` and `prompts/list` responses.
+ *
+ * MUST be called before the first `registerTool` / `registerPrompt` on this
+ * server: it works by intercepting the `setRequestHandler` calls the SDK makes
+ * when it lazily installs those handlers. `index` is read at request time, so
+ * it can still be empty at install time.
+ */
+export declare function installProtocolIcons(server: McpServer, index: RegistrationIndex): void;
+//# sourceMappingURL=icons.d.ts.map

package/dist/icons.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"icons.d.ts","sourceRoot":"","sources":["../src/icons.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,MAAM,WAAW,IAAI;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAmED;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAuC7D,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,IAAI,EAAE,GAAG,SAAS,CAEnD;AAED,6CAA6C;AAC7C,wBAAgB,aAAa,IAAI,IAAI,EAAE,GAAG,SAAS,CAElD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,IAAI,EAAE,GAAG,SAAS,CAGjF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,SAAS,CAG/D;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,GAAG,SAAS,GAAG,MAAM,CAExE;AAQD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,GAAG,IAAI,CA4BtF"}