cedar-mcp-server 1.0.0

package/dist/resources/ref-resolver.js

@@ -0,0 +1,128 @@
+/**
+ * Resolves cedar:// resource references to their content.
+ * Allows tools to accept policy_ref / schema_ref as alternatives to inline text.
+ *
+ * URI patterns:
+ *   cedar://policies/{store}                → all policies in store concatenated
+ *   cedar://policies/{store}/{id}           → single policy content
+ *   cedar://schema/{store}                  → schema content
+ *   cedar://templates/{store}               → template ID list as JSON array
+ *   cedar://templates/{store}/{template_id} → single template content
+ *   cedar://template-links/{store}          → link ID list as JSON array
+ *   cedar://template-links/{store}/{link_id}→ single template-link JSON content
+ *   cedar://entities/{store}                → merged entity arrays as JSON
+ *   cedar://entities/{store}/{file_id}      → single entity file content
+ */
+import { storeManager } from "./store-manager.js";
+export function resolveRef(ref) {
+    const match = ref.match(/^cedar:\/\/(.+)$/);
+    if (!match)
+        return { error: `Invalid cedar:// reference: "${ref}"` };
+    const path = match[1];
+    // cedar://schema/{store}
+    const schemaMatch = path.match(/^schema\/([^/]+)$/);
+    if (schemaMatch) {
+        const storeName = schemaMatch[1];
+        try {
+            return { content: storeManager.readSchema(storeName), resolved_from: ref };
+        }
+        catch (e) {
+            return { error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    // cedar://policies/{store}/{policy_id}
+    const singlePolicyMatch = path.match(/^policies\/([^/]+)\/([^/]+)$/);
+    if (singlePolicyMatch) {
+        const storeName = singlePolicyMatch[1];
+        const policyId = singlePolicyMatch[2];
+        try {
+            return { content: storeManager.readPolicy(storeName, policyId), resolved_from: ref };
+        }
+        catch (e) {
+            return { error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    // cedar://policies/{store}  — all policies concatenated
+    const allPoliciesMatch = path.match(/^policies\/([^/]+)$/);
+    if (allPoliciesMatch) {
+        const storeName = allPoliciesMatch[1];
+        try {
+            return { content: storeManager.readAllPolicies(storeName), resolved_from: ref };
+        }
+        catch (e) {
+            return { error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    // cedar://templates/{store}/{template_id}
+    const singleTemplateMatch = path.match(/^templates\/([^/]+)\/([^/]+)$/);
+    if (singleTemplateMatch) {
+        const storeName = singleTemplateMatch[1];
+        const templateId = singleTemplateMatch[2];
+        try {
+            return { content: storeManager.readTemplate(storeName, templateId), resolved_from: ref };
+        }
+        catch (e) {
+            return { error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    // cedar://templates/{store}  — template ID list as JSON
+    const allTemplatesMatch = path.match(/^templates\/([^/]+)$/);
+    if (allTemplatesMatch) {
+        const storeName = allTemplatesMatch[1];
+        try {
+            return { content: JSON.stringify(storeManager.listTemplates(storeName)), resolved_from: ref };
+        }
+        catch (e) {
+            return { error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    // cedar://template-links/{store}/{link_id}
+    const singleLinkMatch = path.match(/^template-links\/([^/]+)\/([^/]+)$/);
+    if (singleLinkMatch) {
+        const storeName = singleLinkMatch[1];
+        const linkId = singleLinkMatch[2];
+        try {
+            const link = storeManager.readTemplateLink(storeName, linkId);
+            return { content: JSON.stringify(link), resolved_from: ref };
+        }
+        catch (e) {
+            return { error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    // cedar://template-links/{store}  — link ID list as JSON
+    const allLinksMatch = path.match(/^template-links\/([^/]+)$/);
+    if (allLinksMatch) {
+        const storeName = allLinksMatch[1];
+        try {
+            return { content: JSON.stringify(storeManager.listTemplateLinks(storeName)), resolved_from: ref };
+        }
+        catch (e) {
+            return { error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    // cedar://entities/{store}/{file_id}
+    const singleEntityMatch = path.match(/^entities\/([^/]+)\/([^/]+)$/);
+    if (singleEntityMatch) {
+        const storeName = singleEntityMatch[1];
+        const fileId = singleEntityMatch[2];
+        try {
+            return { content: storeManager.readEntities(storeName, fileId), resolved_from: ref };
+        }
+        catch (e) {
+            return { error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    // cedar://entities/{store}  — merged entity arrays as JSON
+    const allEntitiesMatch = path.match(/^entities\/([^/]+)$/);
+    if (allEntitiesMatch) {
+        const storeName = allEntitiesMatch[1];
+        try {
+            return { content: storeManager.readAllEntities(storeName), resolved_from: ref };
+        }
+        catch (e) {
+            return { error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    return { error: `Unrecognized cedar:// URI pattern: "${ref}". Supported: cedar://policies/{store}[/{id}], cedar://schema/{store}, cedar://templates/{store}[/{id}], cedar://template-links/{store}[/{id}], cedar://entities/{store}[/{id}]` };
+}
+//# sourceMappingURL=ref-resolver.js.map

package/dist/resources/ref-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref-resolver.js","sourceRoot":"","sources":["../../src/resources/ref-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAMlD,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,gCAAgC,GAAG,GAAG,EAAE,CAAC;IAErE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAEvB,yBAAyB;IACzB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACpD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QAC7E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACrE,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,iBAAiB,CAAC,CAAC,CAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAE,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QACvF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC3D,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAE,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QAClF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACxE,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,mBAAmB,CAAC,CAAC,CAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,mBAAmB,CAAC,CAAC,CAAE,CAAC;QAC3C,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QAC3F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC7D,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,iBAAiB,CAAC,CAAC,CAAE,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QAChG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACzE,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,eAAe,CAAC,CAAC,CAAE,CAAC;QACtC,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QAC/D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC9D,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAE,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QACpG,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACrE,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,iBAAiB,CAAC,CAAC,CAAE,CAAC;QACxC,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAE,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QACvF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC3D,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAE,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QAClF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,uCAAuC,GAAG,iLAAiL,EAAE,CAAC;AAChP,CAAC"}

package/dist/resources/store-manager.d.ts

@@ -0,0 +1,64 @@
+/**
+ * StoreManager maps MCP root URIs to named Cedar policy stores.
+ *
+ * Convention for a policy store directory:
+ *   <root>/
+ *     policies/        ← .cedar files, one per policy
+ *     schema.cedarschema  ← Cedar schema text (preferred)
+ *     schema.json         ← Cedar JSON schema (fallback)
+ *
+ * Security: isPathAllowed() checks that any file access stays within a loaded root.
+ * The SDK does not enforce roots automatically — every file operation calls this check.
+ */
+export interface PolicyStore {
+    name: string;
+    uri: string;
+    path: string;
+}
+export declare class StoreManager {
+    private stores;
+    loadFromRoots(roots: Array<{
+        uri: string;
+        name?: string;
+    }>): void;
+    listStoreNames(): string[];
+    getStore(name: string): PolicyStore | undefined;
+    /**
+     * Workspace auto-discovery (10d) helper. Returns:
+     *   - { kind: "none" }       when no stores are loaded.
+     *   - { kind: "single", ... } when exactly one store is loaded.
+     *   - { kind: "ambiguous", names } when multiple stores are loaded and the
+     *     caller did not pass an explicit `store` name to disambiguate.
+     *
+     * Tools call this when a required input ref is missing. Single-store
+     * deployments resolve cleanly; multi-store deployments surface an
+     * actionable error listing the candidates rather than guessing.
+     */
+    getDefaultStore(): {
+        kind: "none";
+    } | {
+        kind: "single";
+        store: PolicyStore;
+    } | {
+        kind: "ambiguous";
+        names: string[];
+    };
+    listPolicies(storeName: string): string[];
+    readPolicy(storeName: string, policyId: string): string;
+    readAllPolicies(storeName: string): string;
+    listTemplates(storeName: string): string[];
+    readTemplate(storeName: string, templateId: string): string;
+    listTemplateLinks(storeName: string): string[];
+    readTemplateLink(storeName: string, linkId: string): {
+        template_id: string;
+        slot_values: Record<string, string>;
+    };
+    listEntities(storeName: string): string[];
+    readEntities(storeName: string, entityFileId: string): string;
+    readAllEntities(storeName: string): string;
+    readSchema(storeName: string): string;
+    isPathAllowed(filePath: string): boolean;
+    requireStore(name: string): PolicyStore;
+}
+export declare const storeManager: StoreManager;
+//# sourceMappingURL=store-manager.d.ts.map

package/dist/resources/store-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-manager.d.ts","sourceRoot":"","sources":["../../src/resources/store-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAkC;IAIhD,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI;IAoCjE,cAAc,IAAI,MAAM,EAAE;IAI1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAI/C;;;;;;;;;;OAUG;IACH,eAAe,IAAI;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,KAAK,EAAE,WAAW,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE;IASrH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAavD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAO1C,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAU1C,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAc3D,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAU9C,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;IAejH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAUzC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAY7D,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAqB1C,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAWrC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAUxC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW;CAWxC;AAED,eAAO,MAAM,YAAY,cAAqB,CAAC"}

package/dist/resources/store-manager.js

@@ -0,0 +1,221 @@
+/**
+ * StoreManager maps MCP root URIs to named Cedar policy stores.
+ *
+ * Convention for a policy store directory:
+ *   <root>/
+ *     policies/        ← .cedar files, one per policy
+ *     schema.cedarschema  ← Cedar schema text (preferred)
+ *     schema.json         ← Cedar JSON schema (fallback)
+ *
+ * Security: isPathAllowed() checks that any file access stays within a loaded root.
+ * The SDK does not enforce roots automatically — every file operation calls this check.
+ */
+import { readdirSync, readFileSync, existsSync } from "node:fs";
+import { join, basename } from "node:path";
+export class StoreManager {
+    stores = new Map();
+    // ─── Store lifecycle ────────────────────────────────────────────────────────
+    loadFromRoots(roots) {
+        this.stores.clear();
+        const usedNames = new Map(); // tracks how many times each base name is used
+        for (const root of roots) {
+            if (!root.uri.startsWith("file://")) {
+                console.error(`[cedar-mcp-server] Skipping unsupported root URI scheme: ${root.uri} (only file:// is supported)`);
+                continue;
+            }
+            const rawPath = root.uri.replace(/^file:\/\//, "").replace(/\/$/, "");
+            // Security: refuse to load a root that resolves to an empty filesystem
+            // path (uri === "file:///" or similar). isPathAllowed below uses
+            // `startsWith(store.path)`, and `<anything>.startsWith("")` is true,
+            // so an empty-path store would silently let every Cedar file operation
+            // touch any path on the filesystem. The fix is defense-in-depth: this
+            // skips at the StoreManager boundary regardless of which caller
+            // (cwd-fallback, --root flag, or client listRoots) produced the URI.
+            if (rawPath.length === 0) {
+                console.error(`[cedar-mcp-server] Refusing to load root with empty path after URI normalization (uri: "${root.uri}"). Filesystem-root URIs (file:///) are unsafe — they would bypass the per-store path sandbox.`);
+                continue;
+            }
+            const baseName = root.name ?? basename(rawPath) ?? "default";
+            // Disambiguate collisions with a numeric suffix
+            const count = usedNames.get(baseName) ?? 0;
+            usedNames.set(baseName, count + 1);
+            const name = count === 0 ? baseName : `${baseName}-${count + 1}`;
+            if (count > 0) {
+                console.error(`[cedar-mcp-server] Store name collision: "${baseName}" is used by multiple roots. Renamed to "${name}". Consider giving roots explicit names.`);
+            }
+            this.stores.set(name, { name, uri: root.uri, path: rawPath });
+        }
+    }
+    listStoreNames() {
+        return [...this.stores.keys()];
+    }
+    getStore(name) {
+        return this.stores.get(name);
+    }
+    /**
+     * Workspace auto-discovery (10d) helper. Returns:
+     *   - { kind: "none" }       when no stores are loaded.
+     *   - { kind: "single", ... } when exactly one store is loaded.
+     *   - { kind: "ambiguous", names } when multiple stores are loaded and the
+     *     caller did not pass an explicit `store` name to disambiguate.
+     *
+     * Tools call this when a required input ref is missing. Single-store
+     * deployments resolve cleanly; multi-store deployments surface an
+     * actionable error listing the candidates rather than guessing.
+     */
+    getDefaultStore() {
+        const names = this.listStoreNames();
+        if (names.length === 0)
+            return { kind: "none" };
+        if (names.length === 1)
+            return { kind: "single", store: this.stores.get(names[0]) };
+        return { kind: "ambiguous", names };
+    }
+    // ─── Policy access ──────────────────────────────────────────────────────────
+    listPolicies(storeName) {
+        const store = this.requireStore(storeName);
+        const policiesDir = join(store.path, "policies");
+        if (!existsSync(policiesDir))
+            return [];
+        return readdirSync(policiesDir)
+            .filter((f) => f.endsWith(".cedar"))
+            .map((f) => f.replace(/\.cedar$/, ""))
+            .sort();
+    }
+    readPolicy(storeName, policyId) {
+        const store = this.requireStore(storeName);
+        // Prevent path traversal — policy IDs must be simple filenames with no slashes or dots
+        if (!/^[a-zA-Z0-9_-]+$/.test(policyId)) {
+            throw new Error(`Invalid policy ID: "${policyId}". Policy IDs must contain only letters, digits, hyphens, and underscores.`);
+        }
+        const filePath = join(store.path, "policies", `${policyId}.cedar`);
+        if (!existsSync(filePath)) {
+            throw new Error(`Policy not found: "${policyId}" in store "${storeName}"`);
+        }
+        return readFileSync(filePath, "utf8");
+    }
+    readAllPolicies(storeName) {
+        const ids = this.listPolicies(storeName);
+        return ids.map((id) => this.readPolicy(storeName, id)).join("\n\n");
+    }
+    // ─── Template access ────────────────────────────────────────────────────────
+    listTemplates(storeName) {
+        const store = this.requireStore(storeName);
+        const templatesDir = join(store.path, "templates");
+        if (!existsSync(templatesDir))
+            return [];
+        return readdirSync(templatesDir)
+            .filter((f) => f.endsWith(".cedar"))
+            .map((f) => f.replace(/\.cedar$/, ""))
+            .sort();
+    }
+    readTemplate(storeName, templateId) {
+        const store = this.requireStore(storeName);
+        if (!/^[a-zA-Z0-9_-]+$/.test(templateId)) {
+            throw new Error(`Invalid template ID: "${templateId}". Template IDs must contain only letters, digits, hyphens, and underscores.`);
+        }
+        const filePath = join(store.path, "templates", `${templateId}.cedar`);
+        if (!existsSync(filePath)) {
+            throw new Error(`Template not found: "${templateId}" in store "${storeName}"`);
+        }
+        return readFileSync(filePath, "utf8");
+    }
+    // ─── Template link access ────────────────────────────────────────────────────
+    listTemplateLinks(storeName) {
+        const store = this.requireStore(storeName);
+        const linksDir = join(store.path, "template-links");
+        if (!existsSync(linksDir))
+            return [];
+        return readdirSync(linksDir)
+            .filter((f) => f.endsWith(".json"))
+            .map((f) => f.replace(/\.json$/, ""))
+            .sort();
+    }
+    readTemplateLink(storeName, linkId) {
+        const store = this.requireStore(storeName);
+        if (!/^[a-zA-Z0-9_-]+$/.test(linkId)) {
+            throw new Error(`Invalid link ID: "${linkId}". Link IDs must contain only letters, digits, hyphens, and underscores.`);
+        }
+        const filePath = join(store.path, "template-links", `${linkId}.json`);
+        if (!existsSync(filePath)) {
+            throw new Error(`Template link not found: "${linkId}" in store "${storeName}"`);
+        }
+        const raw = readFileSync(filePath, "utf8");
+        return JSON.parse(raw);
+    }
+    // ─── Entities access ────────────────────────────────────────────────────────
+    listEntities(storeName) {
+        const store = this.requireStore(storeName);
+        const entitiesDir = join(store.path, "entities");
+        if (!existsSync(entitiesDir))
+            return [];
+        return readdirSync(entitiesDir)
+            .filter((f) => f.endsWith(".json"))
+            .map((f) => f.replace(/\.json$/, ""))
+            .sort();
+    }
+    readEntities(storeName, entityFileId) {
+        const store = this.requireStore(storeName);
+        if (!/^[a-zA-Z0-9_-]+$/.test(entityFileId)) {
+            throw new Error(`Invalid entity file ID: "${entityFileId}". Entity file IDs must contain only letters, digits, hyphens, and underscores.`);
+        }
+        const filePath = join(store.path, "entities", `${entityFileId}.json`);
+        if (!existsSync(filePath)) {
+            throw new Error(`Entity file not found: "${entityFileId}" in store "${storeName}"`);
+        }
+        return readFileSync(filePath, "utf8");
+    }
+    readAllEntities(storeName) {
+        const ids = this.listEntities(storeName);
+        const merged = [];
+        for (const id of ids) {
+            const raw = this.readEntities(storeName, id);
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            }
+            catch {
+                throw new Error(`Entity file "${id}" in store "${storeName}" contains invalid JSON.`);
+            }
+            if (!Array.isArray(parsed)) {
+                throw new Error(`Entity file "${id}" in store "${storeName}" must contain a JSON array at the top level, got ${typeof parsed}.`);
+            }
+            merged.push(...parsed);
+        }
+        return JSON.stringify(merged);
+    }
+    // ─── Schema access ──────────────────────────────────────────────────────────
+    readSchema(storeName) {
+        const store = this.requireStore(storeName);
+        const cedarSchema = join(store.path, "schema.cedarschema");
+        if (existsSync(cedarSchema))
+            return readFileSync(cedarSchema, "utf8");
+        const jsonSchema = join(store.path, "schema.json");
+        if (existsSync(jsonSchema))
+            return readFileSync(jsonSchema, "utf8");
+        throw new Error(`Schema not found in store "${storeName}". Expected schema.cedarschema or schema.json at ${store.path}`);
+    }
+    // ─── Security ───────────────────────────────────────────────────────────────
+    isPathAllowed(filePath) {
+        const normalizedRequest = filePath.replace(/\/$/, "");
+        for (const store of this.stores.values()) {
+            if (normalizedRequest.startsWith(store.path))
+                return true;
+        }
+        return false;
+    }
+    // ─── Private ────────────────────────────────────────────────────────────────
+    requireStore(name) {
+        const store = this.stores.get(name);
+        if (!store) {
+            const available = [...this.stores.keys()].join(", ") || "none";
+            const hint = this.stores.size === 0
+                ? " No roots are configured. Add MCP roots in your client settings, each pointing at a directory with a policies/ subdirectory and a schema.cedarschema or schema.json file."
+                : ` Available stores: ${available}.`;
+            throw new Error(`Store not found: "${name}".${hint}`);
+        }
+        return store;
+    }
+}
+export const storeManager = new StoreManager();
+//# sourceMappingURL=store-manager.js.map

package/dist/resources/store-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-manager.js","sourceRoot":"","sources":["../../src/resources/store-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAQ3C,MAAM,OAAO,YAAY;IACf,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEhD,+EAA+E;IAE/E,aAAa,CAAC,KAA4C;QACxD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,+CAA+C;QAE5F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,4DAA4D,IAAI,CAAC,GAAG,8BAA8B,CAAC,CAAC;gBAClH,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtE,uEAAuE;YACvE,iEAAiE;YACjE,qEAAqE;YACrE,uEAAuE;YACvE,sEAAsE;YACtE,gEAAgE;YAChE,qEAAqE;YACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,2FAA2F,IAAI,CAAC,GAAG,gGAAgG,CAAC,CAAC;gBACnN,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;YAE7D,gDAAgD;YAChD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3C,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAEjE,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,6CAA6C,QAAQ,4CAA4C,IAAI,0CAA0C,CAAC,CAAC;YACjK,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;OAUG;IACH,eAAe;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAE,EAAE,CAAC;QACtF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACtC,CAAC;IAED,+EAA+E;IAE/E,YAAY,CAAC,SAAiB;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,OAAO,WAAW,CAAC,WAAW,CAAC;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;aACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;aACrC,IAAI,EAAE,CAAC;IACZ,CAAC;IAED,UAAU,CAAC,SAAiB,EAAE,QAAgB;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC3C,uFAAuF;QACvF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,4EAA4E,CAAC,CAAC;QAC/H,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,QAAQ,QAAQ,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,eAAe,SAAS,GAAG,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,+EAA+E;IAE/E,aAAa,CAAC,SAAiB;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,EAAE,CAAC;QACzC,OAAO,WAAW,CAAC,YAAY,CAAC;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;aACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;aACrC,IAAI,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,SAAiB,EAAE,UAAkB;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,8EAA8E,CAAC,CAAC;QACrI,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,UAAU,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,eAAe,SAAS,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,gFAAgF;IAEhF,iBAAiB,CAAC,SAAiB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,OAAO,WAAW,CAAC,QAAQ,CAAC;aACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;aACpC,IAAI,EAAE,CAAC;IACZ,CAAC;IAED,gBAAgB,CAAC,SAAiB,EAAE,MAAc;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,0EAA0E,CAAC,CAAC;QACzH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,eAAe,SAAS,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiE,CAAC;IACzF,CAAC;IAED,+EAA+E;IAE/E,YAAY,CAAC,SAAiB;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,OAAO,WAAW,CAAC,WAAW,CAAC;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;aACpC,IAAI,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,SAAiB,EAAE,YAAoB;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,4BAA4B,YAAY,iFAAiF,CAAC,CAAC;QAC7I,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,YAAY,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,YAAY,eAAe,SAAS,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC7C,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,eAAe,SAAS,0BAA0B,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,eAAe,SAAS,qDAAqD,OAAO,MAAM,GAAG,CAAC,CAAC;YACnI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,+EAA+E;IAE/E,UAAU,CAAC,SAAiB;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAC3D,IAAI,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACnD,IAAI,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,oDAAoD,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3H,CAAC;IAED,+EAA+E;IAE/E,aAAa,CAAC,QAAgB;QAC5B,MAAM,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+EAA+E;IAE/E,YAAY,CAAC,IAAY;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;YAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;gBACjC,CAAC,CAAC,2KAA2K;gBAC7K,CAAC,CAAC,sBAAsB,SAAS,GAAG,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,18 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare const SERVER_NAME = "cedar-mcp-server";
+export declare const SERVER_VERSION = "0.0.1";
+/**
+ * Server-level instructions returned in the MCP `initialize` response. Surfaced
+ * by the client (Claude Code, Claude Desktop, Cursor) as a system-prompt hint
+ * for when to reach for this server's tools. Truncated at 2KB in Claude Code,
+ * so critical routing guidance is front-loaded.
+ *
+ * Added in response to the 2026-05-21 falsification test result: tool-level
+ * descriptions alone (kickoff-08 sub-phase 8b) did not stop Claude from
+ * bypassing the cedar_* tools via Read + Bash. See
+ * projects/cedar-mcp-server/research-mcp-discoverability-patterns.md
+ * "Path 0" for the rationale.
+ */
+export declare const SERVER_INSTRUCTIONS = "cedar-mcp-server provides Cedar policy language and AWS Verified Permissions tooling.\n\nFor ANY question about Cedar policies, schemas, entities, or authorization decisions, you MUST call the appropriate cedar_* tool rather than reading files and reasoning natively. The Cedar engine, AST parser, and AVP rules encoded in this server are the authoritative source; reading .cedar files alone is insufficient because pattern classification, policy evaluation, AVP UpdatePolicy mutability, and gotchas catalog cannot be reconstructed from file text.\n\nTool routing:\n- \"Plan a Cedar change\" / \"how do I add X rule\" / \"help me restrict Y\" -> cedar_advise FIRST. Returns structured context bundle (gotchas, AVP rules, Cedar patterns, current policy classification). Reason from the bundle.\n- \"What does this policy do?\" / \"explain this Cedar\" -> cedar_explain\n- \"Is this policy valid?\" / \"check my Cedar syntax\" -> cedar_validate\n- \"Would X be allowed to do Y on Z?\" / \"test this authorization\" -> cedar_authorize\n- \"Compare two policy stores\" / \"is it safe to deploy\" -> cedar_diff_policy_stores\n- \"Why was X denied?\" -> cedar_authorize then cedar_explain (positional policy IDs need explanation lookup)\n- \"Generate a test payload\" -> cedar_generate_sample_request\n- \"Migrating from AVP\" / \"is my schema AVP-compatible\" -> cedar_project_intelligence (when shipped) or cedar_validate_schema\n- \"Modify an existing policy\" -> cedar_check_policy_change FIRST (returns AVP UpdatePolicy classification)\n\nWorkspace auto-discovery: if cedar_validate / cedar_authorize / cedar_explain reports missing schema, policies, or entities, retry with the field omitted; the tool auto-discovers from the loaded workspace store (schema.cedarschema, policies/, entities/). Pass store: \"<name>\" for multi-store deployments. Ask the user for inline input only as a last resort.\n\nDo NOT use Read or Bash to inspect Cedar policy semantics. The server tools encode Cedar/AVP knowledge that does not live in the files.";
+export declare function createServer(): McpServer;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAmGpE,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAC9C,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,y/DAiBwG,CAAC;AAEzI,wBAAgB,YAAY,IAAI,SAAS,CAikBxC"}