fridayy 1.2.1 → 1.3.1

package/dist/mcp/server/fridayy-server.d.ts

@@ -14,12 +14,27 @@ export interface FridayyServerOptions {
 export declare class FridayyMcpServer {
     private server;
     private config;
+    private serverName;
+    private serverVersion;
     private toolRegistry;
     private toolHandler;
     private resourceRegistry;
     private promptRegistry;
     private sseTransports;
+    private sseServers;
     constructor(options: FridayyServerOptions);
+    /**
+     * Builds a fresh MCP `Server` instance with the standard tool/resource/
+     * prompt handlers registered on it.
+     *
+     * The MCP SDK's `Server.connect()` only supports one connected transport
+     * at a time — calling it a second time on the same instance throws
+     * "Already connected to a transport." A single shared `Server` therefore
+     * cannot serve more than one SSE client concurrently, so `startSse()`
+     * calls this once per incoming `/sse` connection rather than reusing one
+     * instance across sessions.
+     */
+    private createMcpServer;
     private registerHandlers;
     /**
      * Starts the server on Stdio transport (default for Claude Desktop, Cursor, local tools).
@@ -27,8 +42,15 @@ export declare class FridayyMcpServer {
     startStdio(): Promise<void>;
     /**
      * Starts the server on HTTP / SSE transport (for remote or network clients).
+     *
+     * If `apiKey` is provided, every request except `/health` must present it via
+     * an `Authorization: Bearer <key>` header, an `x-api-key` header, or (for the
+     * EventSource-based `/sse` GET request, which cannot always set headers) an
+     * `?apiKey=` query parameter. Without an apiKey, the transport has no
+     * authentication at all — callers exposing this beyond localhost are
+     * responsible for restricting network access themselves.
      */
-    startSse(port?: number, host?: string): Promise<{
+    startSse(port?: number, host?: string, apiKey?: string): Promise<{
         app: any;
         close: () => Promise<void>;
     }>;

package/dist/mcp/server/fridayy-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fridayy-server.d.ts","sourceRoot":"","sources":["../../../src/mcp/server/fridayy-server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAYnE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAIzD,OAAO,EAAE,eAAe,EAA0B,MAAM,4BAA4B,CAAC;AAErF,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,aAAa,CAA8C;gBAEvD,OAAO,EAAE,oBAAoB;IA8BzC,OAAO,CAAC,gBAAgB;IA4CxB;;OAEG;IACU,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKxC;;OAEG;IACU,QAAQ,CAAC,IAAI,SAAO,EAAE,IAAI,SAAc,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAmDlG,eAAe,IAAI,YAAY;IAI/B,mBAAmB,IAAI,MAAM;CAGrC"}
+{"version":3,"file":"fridayy-server.d.ts","sourceRoot":"","sources":["../../../src/mcp/server/fridayy-server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAYnE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD,OAAO,EAAE,eAAe,EAA0B,MAAM,4BAA4B,CAAC;AAErF,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,aAAa,CAA8C;IACnE,OAAO,CAAC,UAAU,CAAkC;gBAExC,OAAO,EAAE,oBAAoB;IAmBzC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,gBAAgB;IA6CxB;;OAEG;IACU,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKxC;;;;;;;;;OASG;IACU,QAAQ,CACnB,IAAI,SAAO,EACX,IAAI,SAAc,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,GAAG,EAAE,GAAG,CAAC;QAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAyF7C,eAAe,IAAI,YAAY;IAI/B,mBAAmB,IAAI,MAAM;CAGrC"}

package/dist/mcp/server/fridayy-server.js

@@ -9,31 +9,25 @@ import { ListToolsRequestSchema, CallToolRequestSchema, ListResourcesRequestSche
 import express from 'express';
 import { ToolRegistry } from '../tools/tool-registry.js';
 import { ToolHandler } from '../tools/tool-handler.js';
+import { buildToolAnnotations } from '../tools/tool-annotations.js';
 import { ResourceRegistry } from '../resources/resource-registry.js';
 import { PromptRegistry } from '../prompts/prompt-registry.js';
 import { defaultAdapterRegistry } from '../../adapters/registry.js';
 export class FridayyMcpServer {
     server;
     config;
+    serverName;
+    serverVersion;
     toolRegistry;
     toolHandler;
     resourceRegistry;
     promptRegistry;
     sseTransports = new Map();
+    sseServers = new Map();
     constructor(options) {
         this.config = options.config;
-        const serverName = options.config.server?.name || options.config.name || 'fridayy-mcp-server';
-        const serverVersion = options.config.server?.version || options.config.version || '1.0.0';
-        this.server = new Server({
-            name: serverName,
-            version: serverVersion
-        }, {
-            capabilities: {
-                tools: {},
-                resources: {},
-                prompts: {}
-            }
-        });
+        this.serverName = options.config.server?.name || options.config.name || 'fridayy-mcp-server';
+        this.serverVersion = options.config.server?.version || options.config.version || '1.0.0';
         this.toolRegistry = new ToolRegistry(options.tools, options.config);
         this.toolHandler = new ToolHandler({
             config: options.config,
@@ -41,43 +35,72 @@ export class FridayyMcpServer {
         });
         this.resourceRegistry = new ResourceRegistry(this.toolRegistry, options.config);
         this.promptRegistry = new PromptRegistry();
-        this.registerHandlers();
+        // A single default Server instance, used by startStdio() (exactly one
+        // client ever connects over stdio) and returned by getUnderlyingServer()
+        // for direct in-process connections (e.g. tests using InMemoryTransport).
+        this.server = this.createMcpServer();
+    }
+    /**
+     * Builds a fresh MCP `Server` instance with the standard tool/resource/
+     * prompt handlers registered on it.
+     *
+     * The MCP SDK's `Server.connect()` only supports one connected transport
+     * at a time — calling it a second time on the same instance throws
+     * "Already connected to a transport." A single shared `Server` therefore
+     * cannot serve more than one SSE client concurrently, so `startSse()`
+     * calls this once per incoming `/sse` connection rather than reusing one
+     * instance across sessions.
+     */
+    createMcpServer() {
+        const server = new Server({
+            name: this.serverName,
+            version: this.serverVersion
+        }, {
+            capabilities: {
+                tools: {},
+                resources: {},
+                prompts: {}
+            }
+        });
+        this.registerHandlers(server);
+        return server;
     }
-    registerHandlers() {
+    registerHandlers(server) {
         // 1. List Tools Handler
-        this.server.setRequestHandler(ListToolsRequestSchema, async () => {
+        server.setRequestHandler(ListToolsRequestSchema, async () => {
             const exposedTools = this.toolRegistry.getExposedTools();
             return {
                 tools: exposedTools.map(tool => ({
                     name: tool.name,
                     description: tool.description,
-                    inputSchema: tool.inputSchema
+                    inputSchema: tool.inputSchema,
+                    annotations: buildToolAnnotations(tool)
                 }))
             };
         });
         // 2. Call Tool Handler
-        this.server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        server.setRequestHandler(CallToolRequestSchema, async (request) => {
             const { name, arguments: args } = request.params;
             return await this.toolHandler.handleCall(name, args || {}, this.toolRegistry);
         });
         // 3. List Resources Handler
-        this.server.setRequestHandler(ListResourcesRequestSchema, async () => {
+        server.setRequestHandler(ListResourcesRequestSchema, async () => {
             return {
                 resources: this.resourceRegistry.listResources()
             };
         });
         // 4. Read Resource Handler
-        this.server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
+        server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
             return this.resourceRegistry.readResource(request.params.uri);
         });
         // 5. List Prompts Handler
-        this.server.setRequestHandler(ListPromptsRequestSchema, async () => {
+        server.setRequestHandler(ListPromptsRequestSchema, async () => {
             return {
                 prompts: this.promptRegistry.listPrompts()
             };
         });
         // 6. Get Prompt Handler
-        this.server.setRequestHandler(GetPromptRequestSchema, async (request) => {
+        server.setRequestHandler(GetPromptRequestSchema, async (request) => {
             return this.promptRegistry.getPrompt(request.params.name, request.params.arguments);
         });
     }
@@ -90,21 +113,59 @@ export class FridayyMcpServer {
     }
     /**
      * Starts the server on HTTP / SSE transport (for remote or network clients).
+     *
+     * If `apiKey` is provided, every request except `/health` must present it via
+     * an `Authorization: Bearer <key>` header, an `x-api-key` header, or (for the
+     * EventSource-based `/sse` GET request, which cannot always set headers) an
+     * `?apiKey=` query parameter. Without an apiKey, the transport has no
+     * authentication at all — callers exposing this beyond localhost are
+     * responsible for restricting network access themselves.
      */
-    async startSse(port = 3000, host = 'localhost') {
+    async startSse(port = 3000, host = 'localhost', apiKey) {
         const app = express();
         app.use(express.json());
-        // SSE endpoint
+        if (apiKey) {
+            app.use((req, res, next) => {
+                if (req.path === '/health') {
+                    next();
+                    return;
+                }
+                const authHeader = req.headers['authorization'];
+                const bearerToken = typeof authHeader === 'string' && authHeader.startsWith('Bearer ')
+                    ? authHeader.slice(7)
+                    : undefined;
+                const provided = bearerToken || req.headers['x-api-key'] || req.query.apiKey;
+                if (provided !== apiKey) {
+                    res.status(401).json({
+                        error: 'UNAUTHORIZED',
+                        message: 'Missing or invalid API key. Provide it via Authorization: Bearer <key>, x-api-key header, or ?apiKey= query parameter.'
+                    });
+                    return;
+                }
+                next();
+            });
+        }
+        // SSE endpoint. Each connection gets its own Server instance (see
+        // createMcpServer()) so concurrent clients don't fight over one
+        // single-transport-at-a-time Server.
         app.get('/sse', async (req, res) => {
             const transport = new SSEServerTransport('/messages', res);
             const sessionId = transport.sessionId;
+            const sessionServer = this.createMcpServer();
             this.sseTransports.set(sessionId, transport);
+            this.sseServers.set(sessionId, sessionServer);
             req.on('close', () => {
                 this.sseTransports.delete(sessionId);
+                this.sseServers.delete(sessionId);
             });
-            await this.server.connect(transport);
+            await sessionServer.connect(transport);
         });
-        // Message receiver endpoint
+        // Message receiver endpoint. express.json() above has already consumed
+        // and parsed the request body, so the underlying stream is no longer
+        // readable — the SDK's handlePostMessage() must be given that parsed
+        // body directly (its optional third argument) rather than re-reading
+        // req itself, or every POST here fails with "stream is not readable"
+        // and the SSE handshake can never complete.
         app.post('/messages', async (req, res) => {
             const sessionId = req.query.sessionId;
             const transport = this.sseTransports.get(sessionId);
@@ -112,7 +173,7 @@ export class FridayyMcpServer {
                 res.status(404).json({ error: 'Session not found' });
                 return;
             }
-            await transport.handlePostMessage(req, res);
+            await transport.handlePostMessage(req, res, req.body);
         });
         // Health endpoint
         app.get('/health', (req, res) => {

package/dist/mcp/server/fridayy-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"fridayy-server.js","sourceRoot":"","sources":["../../../src/mcp/server/fridayy-server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAmB,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAQrF,MAAM,OAAO,gBAAgB;IACnB,MAAM,CAAS;IACf,MAAM,CAAgB;IACtB,YAAY,CAAe;IAC3B,WAAW,CAAc;IACzB,gBAAgB,CAAmB;IACnC,cAAc,CAAiB;IAC/B,aAAa,GAAoC,IAAI,GAAG,EAAE,CAAC;IAEnE,YAAY,OAA6B;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,oBAAoB,CAAC;QAC9F,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC;QAE1F,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CACtB;YACE,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,aAAa;SACvB,EACD;YACE,YAAY,EAAE;gBACZ,KAAK,EAAE,EAAE;gBACT,SAAS,EAAE,EAAE;gBACb,OAAO,EAAE,EAAE;aACZ;SACF,CACF,CAAC;QAEF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC;YACjC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,sBAAsB;SACnE,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAChF,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;QAE3C,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC1B,CAAC;IAEO,gBAAgB;QACtB,wBAAwB;QACxB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;YACzD,OAAO;gBACL,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,uBAAuB;QACvB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACnE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YACjD,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;QAEH,4BAA4B;QAC5B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YACnE,OAAO;gBACL,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;aACjD,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,2BAA2B;QAC3B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACvE,OAAO,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,0BAA0B;QAC1B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;YACjE,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE;aAC3C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,wBAAwB;QACxB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpE,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,UAAU;QACrB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,GAAG,WAAW;QACnD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAExB,eAAe;QACf,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACjC,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC3D,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;YACtC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAE7C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,4BAA4B;QAC5B,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAmB,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAEpD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YAED,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,kBAAkB;QAClB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9B,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI;gBACpD,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC,MAAM;aAC9D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;gBACjD,OAAO,CAAC;oBACN,GAAG;oBACH,KAAK,EAAE,KAAK,IAAI,EAAE;wBAChB,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAClE,CAAC;iBACF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,eAAe;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEM,mBAAmB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"fridayy-server.js","sourceRoot":"","sources":["../../../src/mcp/server/fridayy-server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAmB,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAQrF,MAAM,OAAO,gBAAgB;IACnB,MAAM,CAAS;IACf,MAAM,CAAgB;IACtB,UAAU,CAAS;IACnB,aAAa,CAAS;IACtB,YAAY,CAAe;IAC3B,WAAW,CAAc;IACzB,gBAAgB,CAAmB;IACnC,cAAc,CAAiB;IAC/B,aAAa,GAAoC,IAAI,GAAG,EAAE,CAAC;IAC3D,UAAU,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEpD,YAAY,OAA6B;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,oBAAoB,CAAC;QAC7F,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC;QAEzF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC;YACjC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,sBAAsB;SACnE,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAChF,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;QAE3C,sEAAsE;QACtE,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;;;;;OAUG;IACK,eAAe;QACrB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;YACE,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,OAAO,EAAE,IAAI,CAAC,aAAa;SAC5B,EACD;YACE,YAAY,EAAE;gBACZ,KAAK,EAAE,EAAE;gBACT,SAAS,EAAE,EAAE;gBACb,OAAO,EAAE,EAAE;aACZ;SACF,CACF,CAAC;QAEF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,gBAAgB,CAAC,MAAc;QACrC,wBAAwB;QACxB,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;YACzD,OAAO;gBACL,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,WAAW,EAAE,oBAAoB,CAAC,IAAI,CAAC;iBACxC,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,uBAAuB;QACvB,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YAC9D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YACjD,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;QAEH,4BAA4B;QAC5B,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YAC9D,OAAO;gBACL,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;aACjD,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,2BAA2B;QAC3B,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YAClE,OAAO,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,0BAA0B;QAC1B,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;YAC5D,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE;aAC3C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,wBAAwB;QACxB,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YAC/D,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,UAAU;QACrB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,QAAQ,CACnB,IAAI,GAAG,IAAI,EACX,IAAI,GAAG,WAAW,EAClB,MAAe;QAEf,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAExB,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBACzB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC3B,IAAI,EAAE,CAAC;oBACP,OAAO;gBACT,CAAC;gBAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBAChD,MAAM,WAAW,GACf,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;oBAChE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;oBACrB,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,QAAQ,GACZ,WAAW,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAK,GAAG,CAAC,KAAK,CAAC,MAA6B,CAAC;gBAEtF,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;oBACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,wHAAwH;qBAClI,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,CAAC;QACL,CAAC;QAED,kEAAkE;QAClE,gEAAgE;QAChE,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACjC,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC3D,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;YACtC,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAE7C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAE9C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACrC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC;YAEH,MAAM,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,4CAA4C;QAC5C,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAmB,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAEpD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YAED,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,kBAAkB;QAClB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9B,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI;gBACpD,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC,MAAM;aAC9D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;gBACjD,OAAO,CAAC;oBACN,GAAG;oBACH,KAAK,EAAE,KAAK,IAAI,EAAE;wBAChB,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAClE,CAAC;iBACF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,eAAe;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEM,mBAAmB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}

package/dist/mcp/tools/tool-annotations.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Fridayy - MCP Tool Annotations Builder
+ * Maps fridayy's own READ/WRITE/DESTRUCTIVE permission classification onto the
+ * standard MCP tool annotation hints (readOnlyHint, destructiveHint,
+ * idempotentHint, openWorldHint) that clients like Claude Desktop and Cursor
+ * use to decide what to auto-approve versus confirm with the user.
+ *
+ * fridayy already computes exactly this classification for every tool (see
+ * core/permissions/classifier.ts) — without this, that work stays invisible
+ * to the MCP client, which has no signal beyond the tool's name/description
+ * for whether a call is safe to run without asking.
+ */
+import { FridayyToolDefinition } from '../../core/schema/types.js';
+export interface ToolAnnotations {
+    readOnlyHint: boolean;
+    destructiveHint: boolean;
+    idempotentHint: boolean;
+    openWorldHint: boolean;
+}
+export declare function buildToolAnnotations(tool: FridayyToolDefinition): ToolAnnotations;
+//# sourceMappingURL=tool-annotations.d.ts.map

package/dist/mcp/tools/tool-annotations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-annotations.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/tool-annotations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;CACxB;AAOD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,eAAe,CAYjF"}

package/dist/mcp/tools/tool-annotations.js

@@ -0,0 +1,29 @@
+/**
+ * Fridayy - MCP Tool Annotations Builder
+ * Maps fridayy's own READ/WRITE/DESTRUCTIVE permission classification onto the
+ * standard MCP tool annotation hints (readOnlyHint, destructiveHint,
+ * idempotentHint, openWorldHint) that clients like Claude Desktop and Cursor
+ * use to decide what to auto-approve versus confirm with the user.
+ *
+ * fridayy already computes exactly this classification for every tool (see
+ * core/permissions/classifier.ts) — without this, that work stays invisible
+ * to the MCP client, which has no signal beyond the tool's name/description
+ * for whether a call is safe to run without asking.
+ */
+// PUT and DELETE are conventionally idempotent (repeating the same request
+// has the same effect as doing it once); POST and PATCH conventionally are
+// not. GET/HEAD/OPTIONS are read-only, which already implies idempotent.
+const IDEMPOTENT_METHODS = new Set(['GET', 'HEAD', 'OPTIONS', 'PUT', 'DELETE']);
+export function buildToolAnnotations(tool) {
+    const method = (tool.source.method || 'GET').toUpperCase();
+    return {
+        readOnlyHint: tool.permissions.type === 'READ',
+        destructiveHint: tool.permissions.type === 'DESTRUCTIVE',
+        idempotentHint: IDEMPOTENT_METHODS.has(method),
+        // Every fridayy tool calls out to an external HTTP API rather than
+        // operating over a fixed, enumerable set of entities the client already
+        // knows about, so this is true for the whole tool surface.
+        openWorldHint: true
+    };
+}
+//# sourceMappingURL=tool-annotations.js.map

package/dist/mcp/tools/tool-annotations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-annotations.js","sourceRoot":"","sources":["../../../src/mcp/tools/tool-annotations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,2EAA2E;AAC3E,2EAA2E;AAC3E,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhF,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAE3D,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,MAAM;QAC9C,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa;QACxD,cAAc,EAAE,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC;QAC9C,mEAAmE;QACnE,wEAAwE;QACxE,2DAA2D;QAC3D,aAAa,EAAE,IAAI;KACpB,CAAC;AACJ,CAAC"}

package/dist/mcp/tools/tool-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-handler.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/tool-handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAEL,aAAa,EAEd,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,eAAe,EAA0B,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAC,CAAgB;IAC/B,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,WAAW,CAAc;gBAErB,OAAO,GAAE,kBAAuB;IAe5C;;OAEG;IACU,UAAU,CACrB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,YAAK,EAC9B,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,cAAc,CAAC;CAsL3B"}
+{"version":3,"file":"tool-handler.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/tool-handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAEL,aAAa,EAEd,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,eAAe,EAA0B,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAC,CAAgB;IAC/B,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,WAAW,CAAc;gBAErB,OAAO,GAAE,kBAAuB;IAe5C;;OAEG;IACU,UAAU,CACrB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,YAAK,EAC9B,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,cAAc,CAAC;CAyN3B"}

package/dist/mcp/tools/tool-handler.js

@@ -81,6 +81,41 @@ export class ToolHandler {
                 ]
             };
         }
+        // 2b. Dynamic Operation Re-classification
+        // Some tools (e.g. a generic REST "call_api_endpoint") accept the HTTP method
+        // and path as call-time arguments rather than fixing them at generation time.
+        // Their static classification (computed with a placeholder method) must not be
+        // trusted for the actual call — re-classify using the real method/path so a
+        // destructive request (e.g. method: "DELETE") is still blocked/pending review.
+        if (tool.metadata?.dynamicExecution) {
+            try {
+                this.enforcer.validateDynamicOperation(tool, {
+                    method: args.method,
+                    path: args.path
+                });
+            }
+            catch (permErr) {
+                this.auditLogger.log({
+                    timestamp: new Date().toISOString(),
+                    toolName,
+                    input: args,
+                    result: { success: false, durationMs: Date.now() - startTime, error: permErr.code || permErr.message }
+                });
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: 'text',
+                            text: JSON.stringify({
+                                error: permErr.code || 'PERMISSION_DENIED',
+                                message: permErr.message,
+                                details: permErr.details
+                            }, null, 2)
+                        }
+                    ]
+                };
+            }
+        }
         // 3. Rate Limit Check
         const rateLimitCheck = this.rateLimiter.checkLimit(toolName, tool.rateLimit);
         if (!rateLimitCheck.allowed) {

package/dist/mcp/tools/tool-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-handler.js","sourceRoot":"","sources":["../../../src/mcp/tools/tool-handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAmB,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAUrF,MAAM,OAAO,WAAW;IACd,MAAM,CAAiB;IACvB,QAAQ,CAAqB;IAC7B,eAAe,CAAkB;IACjC,WAAW,CAAc;IACzB,WAAW,CAAc;IAEjC,YAAY,UAA8B,EAAE;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,sBAAsB,CAAC;QACzE,IAAI,CAAC,WAAW;YACd,OAAO,CAAC,WAAW;gBACnB,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,WAAW;YACd,OAAO,CAAC,WAAW;gBACnB,IAAI,WAAW,CAAC;oBACd,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY;oBAClD,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI;iBAC1D,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,UAAU,CACrB,QAAgB,EAChB,OAA4B,EAAE,EAC9B,YAA0B;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAExC,0BAA0B;QAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE;aACxF,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,gBAAgB;4BACvB,OAAO,EAAE,SAAS,QAAQ,iCAAiC;yBAC5D,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ;iBACF;aACF,CAAC;QACJ,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,OAAY,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE;aACvG,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,mBAAmB;4BAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,UAAU,EAAE,IAAI,CAAC,MAAM;4BACvB,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,WAAW,EAAE,IAAI,CAAC,WAAW;yBAC9B,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ;iBACF;aACF,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE;aAC7F,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,qBAAqB;4BAC5B,OAAO,EAAE,iCAAiC,QAAQ,eAAe,cAAc,CAAC,iBAAiB,IAAI;yBACtG,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ;iBACF;aACF,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE;aACvF,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,eAAe;4BACtB,OAAO,EAAE,yCAAyC,QAAQ,GAAG;4BAC7D,OAAO,EAAE,UAAU,CAAC,MAAM;yBAC3B,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ;iBACF;aACF,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAErD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,mBAAmB;4BAC1B,OAAO,EAAE,0CAA0C,UAAU,GAAG;yBACjE,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ;iBACF;aACF,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAwB,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE;gBACxE,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE1C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE;oBACN,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU;oBACvC,UAAU;oBACV,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO;iBAC7B;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;yBAC/E;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;qBAC3F;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,OAAY,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE;aAC/D,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,iBAAiB;4BACxB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,+CAA+C;yBAC5E,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ;iBACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"tool-handler.js","sourceRoot":"","sources":["../../../src/mcp/tools/tool-handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAmB,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAUrF,MAAM,OAAO,WAAW;IACd,MAAM,CAAiB;IACvB,QAAQ,CAAqB;IAC7B,eAAe,CAAkB;IACjC,WAAW,CAAc;IACzB,WAAW,CAAc;IAEjC,YAAY,UAA8B,EAAE;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,sBAAsB,CAAC;QACzE,IAAI,CAAC,WAAW;YACd,OAAO,CAAC,WAAW;gBACnB,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,WAAW;YACd,OAAO,CAAC,WAAW;gBACnB,IAAI,WAAW,CAAC;oBACd,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY;oBAClD,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI;iBAC1D,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,UAAU,CACrB,QAAgB,EAChB,OAA4B,EAAE,EAC9B,YAA0B;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAExC,0BAA0B;QAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE;aACxF,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,gBAAgB;4BACvB,OAAO,EAAE,SAAS,QAAQ,iCAAiC;yBAC5D,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ;iBACF;aACF,CAAC;QACJ,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,OAAY,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE;aACvG,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,mBAAmB;4BAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,UAAU,EAAE,IAAI,CAAC,MAAM;4BACvB,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,WAAW,EAAE,IAAI,CAAC,WAAW;yBAC9B,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ;iBACF;aACF,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,8EAA8E;QAC9E,8EAA8E;QAC9E,+EAA+E;QAC/E,4EAA4E;QAC5E,+EAA+E;QAC/E,IAAI,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,EAAE;oBAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,OAAY,EAAE,CAAC;gBACtB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;oBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,QAAQ;oBACR,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE;iBACvG,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,mBAAmB;gCAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;gCACxB,OAAO,EAAE,OAAO,CAAC,OAAO;6BACzB,EAAE,IAAI,EAAE,CAAC,CAAC;yBACZ;qBACF;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE;aAC7F,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,qBAAqB;4BAC5B,OAAO,EAAE,iCAAiC,QAAQ,eAAe,cAAc,CAAC,iBAAiB,IAAI;yBACtG,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ;iBACF;aACF,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE;aACvF,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,eAAe;4BACtB,OAAO,EAAE,yCAAyC,QAAQ,GAAG;4BAC7D,OAAO,EAAE,UAAU,CAAC,MAAM;yBAC3B,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ;iBACF;aACF,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAErD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,mBAAmB;4BAC1B,OAAO,EAAE,0CAA0C,UAAU,GAAG;yBACjE,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ;iBACF;aACF,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAwB,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE;gBACxE,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE1C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE;oBACN,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU;oBACvC,UAAU;oBACV,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO;iBAC7B;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;yBAC/E;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;qBAC3F;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,OAAY,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE;aAC/D,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,iBAAiB;4BACxB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,+CAA+C;yBAC5E,EAAE,IAAI,EAAE,CAAC,CAAC;qBACZ;iBACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/security/audit-logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../../src/security/audit-logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,GAAG,CAAC;IACX,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,cAAc,CAAU;gBAEpB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAO;IAanG;;OAEG;IACI,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI;CA6BvC"}
+{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../../src/security/audit-logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,GAAG,CAAC;IACX,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,cAAc,CAAU;gBAEpB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAO;IAanG;;OAEG;IACI,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI;CAkCvC"}

package/dist/security/audit-logger.js

@@ -36,7 +36,10 @@ export class AuditLogger {
                 fs.appendFileSync(this.logFilePath, jsonString + '\n', 'utf-8');
             }
             catch (err) {
-                // Fail silently on logging error to avoid breaking server
+                // Don't throw (a broken audit log must never break tool execution), but
+                // surface the failure once per occurrence so a full disk / bad permissions
+                // doesn't silently disable the audit trail without anyone noticing.
+                console.error(chalk.red(`[fridayy] Failed to write audit log entry to ${this.logFilePath}: ${err.message}`));
             }
         }
         // Console log (if enabled or debug mode)

package/dist/security/audit-logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/security/audit-logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAmB9C,MAAM,OAAO,WAAW;IACd,WAAW,CAAU;IACrB,WAAW,CAAU;IACrB,cAAc,CAAU;IAEhC,YAAY,UAAqF,EAAE;QACjG,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;QAC/C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;QAEtD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACI,GAAG,CAAC,KAAoB;QAC7B,MAAM,cAAc,GAAkB;YACpC,GAAG,KAAK;YACR,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK;SAClE,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAElD,WAAW;QACX,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0DAA0D;YAC5D,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO;gBACtC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;gBACxB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,eAAe,GAAG,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAE5F,OAAO,CAAC,KAAK,CACX,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,UAAU,IAAI,QAAQ,EAAE,CACpH,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/security/audit-logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAmB9C,MAAM,OAAO,WAAW;IACd,WAAW,CAAU;IACrB,WAAW,CAAU;IACrB,cAAc,CAAU;IAEhC,YAAY,UAAqF,EAAE;QACjG,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;QAC/C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;QAEtD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACI,GAAG,CAAC,KAAoB;QAC7B,MAAM,cAAc,GAAkB;YACpC,GAAG,KAAK;YACR,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK;SAClE,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAElD,WAAW;QACX,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,wEAAwE;gBACxE,2EAA2E;gBAC3E,oEAAoE;gBACpE,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CAAC,gDAAgD,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAC9F,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO;gBACtC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;gBACxB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,eAAe,GAAG,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAE5F,OAAO,CAAC,KAAK,CACX,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,UAAU,IAAI,QAAQ,EAAE,CACpH,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/security/sanitizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizer.d.ts","sourceRoot":"","sources":["../../src/security/sanitizer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG,CA8B3C;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWvF"}
+{"version":3,"file":"sanitizer.d.ts","sourceRoot":"","sources":["../../src/security/sanitizer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA8BH;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD;AAiBD;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG,CA0B3C;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWvF"}

package/dist/security/sanitizer.js

@@ -14,12 +14,37 @@ const SENSITIVE_KEY_PATTERNS = [
     /cookie/i,
     /session/i
 ];
+// Matches JWTs (three dot-separated base64url segments) anywhere in a string.
+const JWT_PATTERN = /\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
+// Matches long hex-only tokens (session ids, hashes, many API secrets). Requiring
+// pure hex (no separators, no other letters) keeps the false-positive rate on
+// ordinary human-readable identifiers ("order-20250904-checkout") very low.
+const HEX_TOKEN_PATTERN = /\b[0-9a-fA-F]{32,}\b/g;
+// Common vendor API-key prefixes (Stripe, GitHub, Slack, Google, GitLab, npm,
+// Shopify, AWS, ...). Deliberately prefix-anchored rather than a generic
+// "long alphanumeric string" heuristic, which would also redact harmless
+// identifiers, slugs, and order numbers that happen to be long.
+const VENDOR_KEY_PATTERN = /\b(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{10,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{12,}|ASIA[0-9A-Z]{12,}|AIza[0-9A-Za-z_-]{20,}|glpat-[A-Za-z0-9_-]{15,}|npm_[A-Za-z0-9]{20,}|shpat_[A-Za-z0-9]{20,}/g;
 /**
  * Checks if a key name matches common sensitive parameter naming patterns.
  */
 export function isSensitiveKey(key) {
     return SENSITIVE_KEY_PATTERNS.some(pattern => pattern.test(key));
 }
+/**
+ * Redacts secret-shaped substrings (JWTs, bearer tokens, long API-key-like
+ * tokens) from a string, independent of the field name it came from.
+ */
+function redactSecretShapes(value) {
+    let result = value;
+    if (/bearer\s+/i.test(result)) {
+        result = result.replace(/bearer\s+\S+/gi, 'Bearer [REDACTED]');
+    }
+    result = result.replace(JWT_PATTERN, '[REDACTED]');
+    result = result.replace(VENDOR_KEY_PATTERN, '[REDACTED]');
+    result = result.replace(HEX_TOKEN_PATTERN, '[REDACTED]');
+    return result;
+}
 /**
  * Deeply sanitizes an object, replacing sensitive values with '[REDACTED]'.
  */
@@ -28,11 +53,7 @@ export function sanitizeData(data) {
         return data;
     }
     if (typeof data === 'string') {
-        // Check if looks like a JWT or Bearer token
-        if (data.startsWith('Bearer ') || data.startsWith('bearer ')) {
-            return 'Bearer [REDACTED]';
-        }
-        return data;
+        return redactSecretShapes(data);
     }
     if (Array.isArray(data)) {
         return data.map(item => sanitizeData(item));

package/dist/security/sanitizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizer.js","sourceRoot":"","sources":["../../src/security/sanitizer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,sBAAsB,GAAG;IAC7B,WAAW;IACX,SAAS;IACT,QAAQ;IACR,cAAc;IACd,OAAO;IACP,aAAa;IACb,kBAAkB;IAClB,SAAS;IACT,SAAS;IACT,UAAU;CACX,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAS;IACpC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,4CAA4C;QAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAwB,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACpG,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"sanitizer.js","sourceRoot":"","sources":["../../src/security/sanitizer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,sBAAsB,GAAG;IAC7B,WAAW;IACX,SAAS;IACT,QAAQ;IACR,cAAc;IACd,OAAO;IACP,aAAa;IACb,kBAAkB;IAClB,SAAS;IACT,SAAS;IACT,UAAU;CACX,CAAC;AAEF,8EAA8E;AAC9E,MAAM,WAAW,GAAG,iEAAiE,CAAC;AAEtF,kFAAkF;AAClF,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAElD,8EAA8E;AAC9E,yEAAyE;AACzE,yEAAyE;AACzE,gEAAgE;AAChE,MAAM,kBAAkB,GACtB,wOAAwO,CAAC;AAE3O;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAS;IACpC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAwB,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACpG,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,10 +1,13 @@
 {
   "name": "fridayy",
-  "version": "1.2.1",
+  "version": "1.3.1",
   "description": "Universal Application-to-MCP Platform — Turn existing applications and APIs into AI-ready MCP tools",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",
+  "engines": {
+    "node": ">=18.0.0"
+  },
   "bin": {
     "fridayy": "bin/fridayy.js"
   },
@@ -63,7 +66,6 @@
     "dotenv": "^16.4.7",
     "express": "^4.21.2",
     "ora": "^8.2.0",
-    "undici": "^7.4.0",
     "yaml": "^2.7.0",
     "zod": "^3.24.2",
     "zod-to-json-schema": "^3.24.3"