implto-tos-axi 0.1.1

package/dist/src/mcp/client.js

@@ -0,0 +1,130 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { TosError, credentialRejected } from "../errors.js";
+import { VERSION } from "../version.js";
+/**
+ * Where the server publishes its domain catalog. A constant rather than a
+ * lookup through `resources/list`: one name, and a server that does not serve
+ * it answers with an error we turn into `null`.
+ */
+export const TOOL_DOMAINS_URI = "transformation-os://tool-domains";
+async function withClient(options, run) {
+    const client = new Client({ name: "implto-tos-axi", version: VERSION }, { capabilities: {} });
+    const transport = new StreamableHTTPClientTransport(new URL(options.mcpUrl), {
+        ...(options.authProvider ? { authProvider: options.authProvider } : {}),
+        ...(options.token
+            ? { requestInit: { headers: { Authorization: `Bearer ${options.token}` } } }
+            : {}),
+    });
+    try {
+        // The SDK's `Transport` declares `sessionId: string` while the streamable
+        // transport's is optional, which `exactOptionalPropertyTypes` will not
+        // reconcile. The cast is at the boundary and says why rather than turning
+        // the flag off for the whole package.
+        await client.connect(transport);
+        return await run(client);
+    }
+    catch (error) {
+        throw translate(error, options.profile);
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
+}
+export async function callTool(options, name, args = {}) {
+    return withClient(options, async (client) => {
+        const result = (await client.callTool({ name, arguments: args }));
+        const text = (result.content ?? [])
+            .filter((c) => c.type === "text")
+            .map((c) => c.text ?? "")
+            .join("\n");
+        if (result.isError)
+            throw toolFailure(name, text);
+        if (!text)
+            return null;
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            // Some tools answer with a sentence rather than a document.
+            return text;
+        }
+    });
+}
+/**
+ * The tools this credential may call.
+ *
+ * Already narrowed by the server to the domains the credential was granted, so
+ * what comes back is what will actually run - not a catalog with holes in it
+ * that only show up as a refusal.
+ */
+export async function listTools(options) {
+    return withClient(options, async (client) => {
+        const { tools } = (await client.listTools());
+        return tools;
+    });
+}
+/**
+ * The domain catalog, or null when this server does not group its tools.
+ *
+ * Unlike `tools/list` the catalog is not narrowed by the grant, which is what
+ * lets `tools domains` say "this exists and you do not have it" rather than
+ * leaving a credential's holder wondering where an area went.
+ */
+export async function readDomains(options) {
+    return withClient(options, async (client) => {
+        try {
+            const result = (await client.readResource({ uri: TOOL_DOMAINS_URI }));
+            const text = result.contents?.[0]?.text;
+            return text ? JSON.parse(text) : null;
+        }
+        catch {
+            return null;
+        }
+    });
+}
+/**
+ * A tool's own refusal, mapped to a code a script can branch on.
+ *
+ * The server says "forbidden", "not found" or nothing in particular; the
+ * difference matters because only one of them is worth retrying.
+ */
+function toolFailure(tool, text) {
+    const message = text.replace(/^Error(\s*\([a-z]+\))?:\s*/i, "").trim();
+    // A refusal for a missing scope and a refusal for a workspace are fixed in
+    // different places - signing in again versus asking somebody for access - so
+    // they do not get the same suggestion.
+    const scope = /does not carry the '([a-z_]+)' scope/i.exec(text);
+    if (scope) {
+        return new TosError(message, "FORBIDDEN", [
+            `implto-tos-axi login --scopes ${scope[1]}   # or add it to the ones you have`,
+            "implto-tos-axi tools domains   # which areas this credential holds",
+        ]);
+    }
+    if (/forbidden|access denied|not carry the/i.test(text)) {
+        return new TosError(message, "FORBIDDEN", [
+            "Ask for access to that workspace, or authorize again with the scope it needs.",
+            "implto-tos-axi tools domains   # which areas this credential holds",
+        ]);
+    }
+    if (/not found/i.test(text))
+        return new TosError(message, "NOT_FOUND");
+    if (/matches \d+ tasks/i.test(text)) {
+        return new TosError(message, "AMBIGUOUS", ["Pass --project to say which."]);
+    }
+    return new TosError(message || `${tool} failed.`, "API_ERROR");
+}
+function translate(error, profile) {
+    if (error instanceof TosError)
+        return error;
+    const message = error instanceof Error ? error.message : String(error);
+    if (/401|unauthor/i.test(message))
+        return credentialRejected(profile);
+    if (/fetch failed|ECONNREFUSED|ENOTFOUND|network/i.test(message)) {
+        return new TosError(`Could not reach the server: ${message}`, "NETWORK_ERROR", [
+            "Check the address with `implto-tos-axi whoami`, or pass --url.",
+        ]);
+    }
+    return new TosError(message, "API_ERROR");
+}
+//# sourceMappingURL=client.js.map

package/dist/src/mcp/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/mcp/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAiExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;AAEnE,KAAK,UAAU,UAAU,CACvB,OAAoB,EACpB,GAAmC;IAEnC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IAE9F,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QAC3E,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,OAAO,CAAC,KAAK;YACf,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC5E,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,sCAAsC;QACtC,MAAM,MAAM,CAAC,OAAO,CAAC,SAA4D,CAAC,CAAC;QACnF,OAAO,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAoB,EACpB,IAAY,EACZ,OAAgC,EAAE;IAElC,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAG/D,CAAC;QAEF,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;aAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;aACxB,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAoB;IAClD,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAyB,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAoB;IACpD,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAEnE,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YACxC,OAAO,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,2EAA2E;IAC3E,6EAA6E;IAC7E,uCAAuC;IACvC,MAAM,KAAK,GAAG,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE;YACxC,iCAAiC,KAAK,CAAC,CAAC,CAAC,qCAAqC;YAC9E,oEAAoE;SACrE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE;YACxC,+EAA+E;YAC/E,oEAAoE;SACrE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACvE,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,GAAG,IAAI,UAAU,EAAE,WAAW,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,OAAe;IAChD,IAAI,KAAK,YAAY,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,QAAQ,CAAC,+BAA+B,OAAO,EAAE,EAAE,eAAe,EAAE;YAC7E,gEAAgE;SACjE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AAC5C,CAAC"}

package/dist/src/output.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Structural mirror of the SDK's `AxiRenderable`.
+ *
+ * `axi-sdk-js` does not export its `output` module, so the renderable type is
+ * restated here rather than reached for through a deep import.
+ */
+export type AxiStructuredOutput = Record<string, unknown>;
+export type AxiRenderable = string | AxiStructuredOutput;

package/dist/src/output.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=output.js.map

package/dist/src/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/output.ts"],"names":[],"mappings":""}

package/dist/src/resolve.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Names in, ids out.
+ *
+ * Every command takes the names a person would use and resolves them against
+ * what the server just returned, so nothing has to carry a UUID around. The
+ * rules are the same everywhere, which is why they are here rather than in
+ * each command: an exact id or key wins outright, then a case-insensitive
+ * name, then a unique substring. Two matches is the caller's to fix, and the
+ * error names both rather than guessing.
+ */
+export declare function pick<T>(items: readonly T[], wanted: string, keysOf: (item: T) => (string | undefined | null)[], what?: string): T;
+/** A UUID, which the server hands out and a person never types. */
+export declare const looksLikeId: (value: string) => boolean;
+/** `none` and `null` both mean "clear this link", which is not the same as leaving it. */
+export declare const CLEARING: Set<string>;
+export declare const isClearing: (value: string) => boolean;

package/dist/src/resolve.js

@@ -0,0 +1,48 @@
+import { TosError, ambiguous } from "./errors.js";
+/**
+ * Names in, ids out.
+ *
+ * Every command takes the names a person would use and resolves them against
+ * what the server just returned, so nothing has to carry a UUID around. The
+ * rules are the same everywhere, which is why they are here rather than in
+ * each command: an exact id or key wins outright, then a case-insensitive
+ * name, then a unique substring. Two matches is the caller's to fix, and the
+ * error names both rather than guessing.
+ */
+export function pick(items, wanted, keysOf, what = "Nothing here") {
+    const needle = wanted.trim().toLowerCase();
+    const label = (item) => String(keysOf(item)[1] ?? keysOf(item)[0]);
+    /**
+     * The candidates, told apart.
+     *
+     * Two components may legitimately carry one name in different parts of the
+     * tree, and "matches more than one: Docs, Docs" tells the caller nothing it
+     * can act on. When the labels repeat, the id goes beside them - which is
+     * also what the suggestion tells them to pass.
+     */
+    const candidates = (matches) => {
+        const labels = matches.map(label);
+        if (new Set(labels).size === labels.length)
+            return labels;
+        return matches.map((item) => `${label(item)} (${String(keysOf(item)[0])})`);
+    };
+    const exact = items.filter((item) => keysOf(item).some((k) => k && k.toLowerCase() === needle));
+    if (exact.length === 1)
+        return exact[0];
+    if (exact.length > 1)
+        throw ambiguous(wanted, candidates(exact));
+    const partial = items.filter((item) => keysOf(item).some((k) => k && k.toLowerCase().includes(needle)));
+    if (partial.length === 1)
+        return partial[0];
+    if (partial.length > 1)
+        throw ambiguous(wanted, candidates(partial));
+    throw new TosError(`${what} is called "${wanted}".`, "NOT_FOUND", [
+        `Available: ${items.map(label).join(", ") || "(none)"}`,
+    ]);
+}
+/** A UUID, which the server hands out and a person never types. */
+export const looksLikeId = (value) => /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+/** `none` and `null` both mean "clear this link", which is not the same as leaving it. */
+export const CLEARING = new Set(["none", "null", ""]);
+export const isClearing = (value) => CLEARING.has(value.trim().toLowerCase());
+//# sourceMappingURL=resolve.js.map

package/dist/src/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;;;;GASG;AACH,MAAM,UAAU,IAAI,CAClB,KAAmB,EACnB,MAAc,EACd,MAAkD,EAClD,IAAI,GAAG,cAAc;IAErB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,IAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtE;;;;;;;OAOG;IACH,MAAM,UAAU,GAAG,CAAC,OAAY,EAAY,EAAE;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9E,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAM,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACpC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAChE,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAM,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAErE,MAAM,IAAI,QAAQ,CAAC,GAAG,IAAI,eAAe,MAAM,IAAI,EAAE,WAAW,EAAE;QAChE,cAAc,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE;KACxD,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAW,EAAE,CACpD,iEAAiE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAEhF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;AACtD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC"}

package/dist/src/scopes.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The tool domains a credential can be narrowed to.
+ *
+ * A copy of the server's list rather than an import: this package ships to npm
+ * on its own and cannot depend on the monorepo. The server is the authority -
+ * it refuses anything it does not recognise - so the cost of drift is a clear
+ * error at sign-in rather than a wrong grant.
+ */
+export declare const MCP_SCOPES: readonly ["tasks", "delivery_planning", "communications", "process_maps", "organization"];

package/dist/src/scopes.js

@@ -0,0 +1,16 @@
+/**
+ * The tool domains a credential can be narrowed to.
+ *
+ * A copy of the server's list rather than an import: this package ships to npm
+ * on its own and cannot depend on the monorepo. The server is the authority -
+ * it refuses anything it does not recognise - so the cost of drift is a clear
+ * error at sign-in rather than a wrong grant.
+ */
+export const MCP_SCOPES = [
+    "tasks",
+    "delivery_planning",
+    "communications",
+    "process_maps",
+    "organization",
+];
+//# sourceMappingURL=scopes.js.map

package/dist/src/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,OAAO;IACP,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,cAAc;CACN,CAAC"}

package/dist/src/session.d.ts

@@ -0,0 +1,40 @@
+import { type Binding } from "./config/binding.js";
+import { type Profile } from "./config/profiles.js";
+import { type DomainCatalog, type McpTool } from "./mcp/client.js";
+/**
+ * Everything a command needs to make one call: which deployment, which
+ * credential, and which project this directory belongs to.
+ *
+ * The order the credential is resolved in is the contract: `TOS_TOKEN` beats
+ * the file, an explicit `--profile` beats the binding, and the binding beats
+ * the default. A machine that sets the environment variable means it.
+ */
+export interface Session {
+    profile: Profile;
+    call(tool: string, args?: Record<string, unknown>): Promise<unknown>;
+    /** The tools this credential may call, already narrowed to its domains. */
+    tools(): Promise<McpTool[]>;
+    /** Every domain the server has, granted or not. Null if it groups nothing. */
+    domains(): Promise<DomainCatalog | null>;
+    /** Where the credential came from, which `whoami` reports. */
+    source: "env" | "file";
+    binding: Binding | null;
+    bindingPath: string | null;
+}
+export interface SessionFlags {
+    profile?: string | undefined;
+    url?: string | undefined;
+    mcpUrl?: string | undefined;
+}
+export declare function openSession(flags?: SessionFlags): Session;
+/** The binding, or the error that says how to make one. */
+export declare function requireBinding(session: Session): Binding;
+/**
+ * Which workspace a call acts in.
+ *
+ * A user credential reaches several workspaces, so unlike a workspace token it
+ * has to say which one every time. The binding answers for a repository that
+ * has one; `--workspace` answers anywhere else, by name or by id, so the tool
+ * is usable from a directory that is not a bound checkout at all.
+ */
+export declare function resolveWorkspaceId(session: Session, wanted?: string): Promise<string>;

package/dist/src/session.js

@@ -0,0 +1,75 @@
+import { envToken, readCredential } from "./config/credentials.js";
+import { findBinding } from "./config/binding.js";
+import { resolveProfile } from "./config/profiles.js";
+import { callTool, listTools, readDomains, } from "./mcp/client.js";
+import { FileAuthProvider } from "./auth/provider.js";
+import { TosError, noBinding, noWorkspace, notSignedIn } from "./errors.js";
+import { looksLikeId, pick } from "./resolve.js";
+export function openSession(flags = {}) {
+    const found = findBinding();
+    const profileName = flags.profile ?? found?.binding.profile;
+    const stored = profileName ? readCredential(profileName) : null;
+    const profile = resolveProfile({
+        profile: profileName,
+        url: flags.url,
+        mcpUrl: flags.mcpUrl ?? stored?.mcpUrl,
+    });
+    const credential = readCredential(profile.name);
+    const fromEnv = envToken();
+    let options;
+    if (fromEnv) {
+        options = { mcpUrl: profile.mcpUrl, token: fromEnv, profile: profile.name };
+    }
+    else if (credential?.staticToken) {
+        options = { mcpUrl: profile.mcpUrl, token: credential.staticToken, profile: profile.name };
+    }
+    else if (credential?.tokens?.access_token) {
+        // Through the provider rather than as a bare header, so a token whose hour
+        // is up is renewed against its refresh token without anybody present -
+        // which is the whole reason an OAuth grant is worth having over a key.
+        const provider = new FileAuthProvider(profile, "http://127.0.0.1:0/callback", "", "", () => {
+            throw new TosError("This credential needs a browser to be renewed.", "NEEDS_HUMAN", [
+                `implto-tos-axi login --profile ${profile.name}`,
+            ]);
+        });
+        options = { mcpUrl: profile.mcpUrl, authProvider: provider, profile: profile.name };
+    }
+    else {
+        throw notSignedIn(profile.name);
+    }
+    return {
+        profile,
+        source: fromEnv ? "env" : "file",
+        binding: found?.binding ?? null,
+        bindingPath: found?.path ?? null,
+        call: (tool, args) => callTool(options, tool, args),
+        tools: () => listTools(options),
+        domains: () => readDomains(options),
+    };
+}
+/** The binding, or the error that says how to make one. */
+export function requireBinding(session) {
+    if (!session.binding)
+        throw noBinding();
+    return session.binding;
+}
+/**
+ * Which workspace a call acts in.
+ *
+ * A user credential reaches several workspaces, so unlike a workspace token it
+ * has to say which one every time. The binding answers for a repository that
+ * has one; `--workspace` answers anywhere else, by name or by id, so the tool
+ * is usable from a directory that is not a bound checkout at all.
+ */
+export async function resolveWorkspaceId(session, wanted) {
+    if (!wanted) {
+        if (!session.binding)
+            throw noWorkspace();
+        return session.binding.workspaceId;
+    }
+    if (looksLikeId(wanted))
+        return wanted;
+    const me = (await session.call("get_current_user"));
+    return pick(me.workspaces ?? [], wanted, (w) => [w.id, w.name], "No workspace you can reach").id;
+}
+//# sourceMappingURL=session.js.map

package/dist/src/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAgB,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAgB,MAAM,sBAAsB,CAAC;AACpE,OAAO,EACL,QAAQ,EACR,SAAS,EACT,WAAW,GAIZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AA6BjD,MAAM,UAAU,WAAW,CAAC,QAAsB,EAAE;IAClD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC;IAC5D,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEhE,MAAM,OAAO,GAAG,cAAc,CAAC;QAC7B,OAAO,EAAE,WAAW;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM,EAAE,MAAM;KACvC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;IAE3B,IAAI,OAAoB,CAAC;IACzB,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9E,CAAC;SAAM,IAAI,UAAU,EAAE,WAAW,EAAE,CAAC;QACnC,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7F,CAAC;SAAM,IAAI,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAC5C,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,OAAO,EAAE,6BAA6B,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;YACzF,MAAM,IAAI,QAAQ,CAAC,gDAAgD,EAAE,aAAa,EAAE;gBAClF,kCAAkC,OAAO,CAAC,IAAI,EAAE;aACjD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACtF,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,OAAO;QACL,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;QAChC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI;QAC/B,WAAW,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI;QAChC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QACnD,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,SAAS,EAAE,CAAC;IACxC,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAgB,EAAE,MAAe;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,MAAM,WAAW,EAAE,CAAC;QAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;IACrC,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAEjD,CAAC;IACF,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC,EAAE,CAAC;AACnG,CAAC"}

package/dist/src/skill.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The stubs that ship with the package.
+ *
+ * Three rather than one, because a skill's description is loaded whether or
+ * not the task needs it while its body is loaded only when the description
+ * matched. One stub covering tasks, components and everything else would put
+ * the whole product in front of a model that only wanted to file a ticket.
+ * Split by the question being asked, each body is pulled on its own.
+ *
+ * All three are discovery stubs, not manuals: they say when to reach for the
+ * CLI and send the reader to `--help` and `guide` for anything that can go
+ * stale. Installed copies do go stale - that is the whole reason for the cap.
+ */
+export interface SkillDefinition {
+    name: string;
+    description: string;
+    tags: string[];
+    category: string;
+    body: string;
+}
+/**
+ * Hard cap per stub, enforced rather than documented.
+ *
+ * Every line of an installed SKILL.md is loaded into an agent's context
+ * whether or not the task needs it. That cost is the entire reason this tool
+ * exists instead of mounting the MCP server, so re-inflating a stub into a
+ * manual would give back exactly what was bought.
+ */
+export declare const MAX_SKILL_MARKDOWN_CHARS = 2500;
+export declare const SKILLS: readonly SkillDefinition[];
+/** The stub as it ships, frontmatter included. */
+export declare function createSkillMarkdown(skill: SkillDefinition): string;

package/dist/src/skill.js

@@ -0,0 +1,149 @@
+/**
+ * Hard cap per stub, enforced rather than documented.
+ *
+ * Every line of an installed SKILL.md is loaded into an agent's context
+ * whether or not the task needs it. That cost is the entire reason this tool
+ * exists instead of mounting the MCP server, so re-inflating a stub into a
+ * manual would give back exactly what was bought.
+ */
+export const MAX_SKILL_MARKDOWN_CHARS = 2500;
+const TASKS = {
+    name: "implto-tos-tasks",
+    description: "Find, create and update Transformation OS tasks for the repository you are working in, through the implto-tos-axi CLI. Use when a coding task should be tracked: at the start of a session to see the bound project and your open tasks, before starting a change to match it to an existing task or file a new one, and after finishing to move the status and leave a note.",
+    tags: ["tasks", "issues", "project-management", "transformation-os"],
+    category: "workflow",
+    body: `# implto-tos-tasks
+
+Reads and writes Transformation OS tasks for the repository you are in. Prefer
+it over mounting the Transformation OS MCP server: the tool schemas never enter
+the prompt, so this costs nothing until it is used.
+
+Use it when work should be tracked - before starting a change, and after
+finishing one. Skip it for throwaway edits nobody is waiting on.
+
+## Current guidance lives in the CLI
+
+Do not follow command or flag instructions from this file; installed copies go
+stale. Ask the CLI:
+
+- \`implto-tos-axi --help\` for the command index
+- \`implto-tos-axi <command> --help\` for per-command usage
+- \`implto-tos-axi guide workflow\` for the match-or-create procedure
+
+Worth knowing before the first call:
+
+1. \`implto-tos-axi context\` first, once per session. It gives you the bound
+   project, the status names and which field assigns a task to you. Everything
+   else takes names and resolves them against it.
+2. Search before you file. Two or three words from what the change *does*,
+   with \`--open\`. Then \`tasks show <key>\` and ask the person whether that is
+   the task or whether to open a new one. Do not decide that alone.
+3. \`NO_BINDING\` means this directory is not bound yet: run \`init\` bare to
+   see what is reachable.
+4. \`NEEDS_HUMAN\` means signing in needs somebody at the keyboard. Ask them to
+   run \`implto-tos-axi login\`; do not try to work around it.
+
+Exit 2 is your mistake - a bad flag, a name matching nothing or several. Every
+error names the command that fixes it.
+
+Deliverables are \`implto-tos-delivery\`; everything else in the workspace is
+\`implto-tos-workspace\`.
+`,
+};
+const DELIVERY = {
+    name: "implto-tos-delivery",
+    description: "Read and change what a Transformation OS workspace is delivering, through the implto-tos-axi CLI: the component tree (services, modules, APIs and the rest of the deliverables), what each component is linked to, its estimate, and the delivery phases. Use when a change introduces a deliverable that is not recorded yet, when a component is missing or sits under the wrong parent, or when asked what is being built and for how much effort.",
+    tags: ["components", "deliverables", "estimates", "phases", "transformation-os"],
+    category: "workflow",
+    body: `# implto-tos-delivery
+
+Components are the deliverables of a workspace, in a tree: the services,
+modules and APIs work is filed under. Tasks hang off them, so a component that
+does not exist is a task with nowhere to go.
+
+Use it when a change introduces something the tree does not have yet, when a
+component is under the wrong parent, or to answer what is being built.
+
+## Current guidance lives in the CLI
+
+Do not follow command or flag instructions from this file; installed copies go
+stale. Ask the CLI:
+
+- \`implto-tos-axi components --help\`
+- \`implto-tos-axi guide components\`
+
+Worth knowing before the first call:
+
+1. \`implto-tos-axi components list --tree\` first. It is the only way to see
+   where a new component belongs, and it is how you find out the one you were
+   about to create is already there under another name.
+2. Names, not ids, everywhere: \`--parent "Platform"\`. Two matches is an
+   error naming both rather than a guess.
+3. \`--parent none\` moves a component to the top level; omitting \`--parent\`
+   leaves it where it is. The same holds for \`--project\` and \`--system\`.
+4. A component created in a bound checkout is linked to that checkout's
+   project unless you pass \`--project none\`.
+5. Phases and per-phase estimates have no command of their own - reach them
+   with \`implto-tos-axi tools call list_phases\`.
+
+Ask before creating. A deliverable somebody else named is worse than one
+missing.
+`,
+};
+const WORKSPACE = {
+    name: "implto-tos-workspace",
+    description: "Reach the rest of a Transformation OS workspace from the command line through implto-tos-axi: process maps, the people, departments and organizational roles in it, the systems they use, and the client message threads. Discover what the server offers with `implto-tos-axi tools`, then call one tool directly. Use when a task needs workspace data that is not a task or a deliverable.",
+    tags: ["process-maps", "people", "systems", "communications", "transformation-os"],
+    category: "workflow",
+    body: `# implto-tos-workspace
+
+Everything in Transformation OS that is not a task or a component: process
+maps, people, departments, organizational roles, the systems a workspace uses,
+and the client conversation.
+
+There is no command per area. Instead the CLI asks the server what it offers
+and calls it, so one tool's schema is loaded when a task needs it rather than
+fifty of them in every request.
+
+## Current guidance lives in the CLI
+
+Do not follow tool names or argument lists from this file; the server adds
+tools without releasing this package. Ask it:
+
+- \`implto-tos-axi tools\` - the areas, and which ones this credential holds
+- \`implto-tos-axi tools domains <id>\` - what an area covers, and its rules
+- \`implto-tos-axi tools list --domain <id>\` - the tools in it
+- \`implto-tos-axi tools show <name>\` - one tool's arguments
+- \`implto-tos-axi tools call <name> key=value\`
+
+Worth knowing before the first call:
+
+1. Read the area's rules before writing. They say which lookup to run first,
+   and an id from one workspace is never valid in another.
+2. \`workspaceId\` is filled in from the repository binding, or from
+   \`--workspace <name>\`. You rarely pass it.
+3. \`key=@file\` reads a value from a file, \`key=@-\` from stdin, and
+   \`--json '{…}'\` passes a nested argument whole.
+4. A misspelled argument is refused here, naming the real ones - it is not
+   sent and quietly ignored.
+5. \`FORBIDDEN\` on a whole area means the credential was not granted it. Ask
+   the person to sign in again with that area.
+`,
+};
+export const SKILLS = [TASKS, DELIVERY, WORKSPACE];
+/** The stub as it ships, frontmatter included. */
+export function createSkillMarkdown(skill) {
+    const frontmatter = `---
+name: ${skill.name}
+description: "${skill.description}"
+user-invocable: false
+author: Valentyn Morenko
+license: MIT
+metadata:
+  hermes:
+    tags: [${skill.tags.join(", ")}]
+    category: ${skill.category}
+---`;
+    return `${frontmatter}\n\n${skill.body}`;
+}
+//# sourceMappingURL=skill.js.map

package/dist/src/skill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill.js","sourceRoot":"","sources":["../../src/skill.ts"],"names":[],"mappings":"AAqBA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,MAAM,KAAK,GAAoB;IAC7B,IAAI,EAAE,kBAAkB;IACxB,WAAW,EACT,+WAA+W;IACjX,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,mBAAmB,CAAC;IACpE,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCP;CACA,CAAC;AAEF,MAAM,QAAQ,GAAoB;IAChC,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACT,ubAAub;IACzb,IAAI,EAAE,CAAC,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,mBAAmB,CAAC;IAChF,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCP;CACA,CAAC;AAEF,MAAM,SAAS,GAAoB;IACjC,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACT,+XAA+X;IACjY,IAAI,EAAE,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,mBAAmB,CAAC;IAClF,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCP;CACA,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAA+B,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAE/E,kDAAkD;AAClD,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,MAAM,WAAW,GAAG;QACd,KAAK,CAAC,IAAI;gBACF,KAAK,CAAC,WAAW;;;;;;aAMpB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClB,KAAK,CAAC,QAAQ;IAC1B,CAAC;IACH,OAAO,GAAG,WAAW,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC"}

package/dist/src/version.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Kept in its own leaf module so `--version` costs no module graph: the binary
+ * answers it before importing anything else. release-please rewrites the line.
+ */
+export declare const VERSION = "0.1.1";

package/dist/src/version.js

@@ -0,0 +1,6 @@
+/**
+ * Kept in its own leaf module so `--version` costs no module graph: the binary
+ * answers it before importing anything else. release-please rewrites the line.
+ */
+export const VERSION = "0.1.1"; // x-release-please-version
+//# sourceMappingURL=version.js.map

package/dist/src/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,2BAA2B"}