mandala-computer-mcp 0.4.0 → 0.6.0

package/dist/secret-store.d.ts

@@ -0,0 +1,115 @@
+/**
+ * The account's secret store, as the platform answers it (OPL-4984 part 2).
+ *
+ * A secret is a named value, encrypted when saved and never readable again: no
+ * route answers a value, so none of the shapes here has one. Computers are bound
+ * to secrets by id with `PUT computers/:id/secrets`; this is where those ids,
+ * and the revision a replace or delete needs, come from.
+ *
+ * Decoded strictly. Every field the published schema marks required is checked,
+ * and a decoded secret carries exactly those fields — so an answer that somehow
+ * held a `value` could not carry it any further than the decoder.
+ */
+/** One secret, without its value. */
+export type Secret = {
+    /** `csec-` and sixteen hex characters: what a binding names as `secret_id`. */
+    id: string;
+    /** Unique within its scope. */
+    name: string;
+    /** The workspace it belongs to, or `null` for one available account-wide. */
+    workspace_id: string | null;
+    /** Moves every time the value is replaced; a replace or delete sends back the one it read. */
+    revision_id: string;
+    created_at: string;
+    /** The last replace, or the create. */
+    updated_at: string;
+    /** When it was last delivered to a computer; `null` until it has been. */
+    last_used_at: string | null;
+};
+/** The store's limits, as `GET secrets` reports them. */
+export type SecretLimits = {
+    name_max_chars: number;
+    value_max_bytes: number;
+    /** How many the account may hold at once, across every workspace. Deleting frees a place. */
+    active_per_account: number;
+    /** How many the account may ever create, deleted ones included. Deleting does not free one. */
+    created_per_account: number;
+};
+/** One scope's secrets, whether they can be bound here, and the limits. */
+export type SecretList = {
+    secrets: Secret[];
+    /** Whether a secret can be bound to a computer on this platform; stored either way. */
+    delivery: boolean;
+    limits: SecretLimits;
+};
+/**
+ * The store's five calls, as `Api.secrets` offers them.
+ *
+ * `workspaceId` names the scope: left out, the account-wide secrets; a key
+ * confined to a workspace works in that workspace, and naming another is a 403.
+ */
+export interface SecretStore {
+    /** `GET secrets`: one scope's secrets, whether binding is on, and the limits. Never a value. */
+    list(opts?: {
+        workspaceId?: string;
+    }): Promise<SecretList>;
+    /**
+     * `POST secrets`: store a value under a name. Owners only; a taken name is a
+     * 409 and the store's two limits are 400s. `workspaceId: null` or left out is
+     * account-wide. NOT safe to repeat blind: a lost answer may be a secret that
+     * now exists — list before creating again.
+     */
+    create(args: {
+        name: string;
+        value: string;
+        workspaceId?: string | null;
+    }): Promise<Secret>;
+    /** `GET secrets/:id`: one secret's name, scope and current revision, without its value. */
+    get(id: string, opts?: {
+        workspaceId?: string;
+    }): Promise<Secret>;
+    /**
+     * `PUT secrets/:id`: replace the value, conditional on `revisionId` — a stale
+     * one is a 409 and nothing changed. Answers the secret at its new revision.
+     * Owners only.
+     */
+    replace(id: string, args: {
+        value: string;
+        revisionId: string;
+        workspaceId?: string | null;
+    }): Promise<Secret>;
+    /**
+     * `DELETE secrets/:id`: delete it, conditional on `revisionId` (required; a
+     * stale one is a 409 and nothing is deleted). Owners only. A computer still
+     * bound to it cannot be given its secrets again: its next start is refused.
+     */
+    delete(id: string, args: {
+        revisionId: string;
+        workspaceId?: string;
+    }): Promise<void>;
+}
+/**
+ * The refusal words the platform documents, and the only ones a secret-store
+ * refusal is allowed to carry through this package. Taken from the published
+ * `Error.reason` (contention, starting, unavailable, unsupported, exists,
+ * revoked) and the API-key ingress words beside it (missing, invalid).
+ *
+ * An allow-list rather than a shape check, because a shape check is exactly
+ * what a secret prefix passes: `sk-proj-abc…` cut to thirty-two characters is a
+ * perfectly word-like string (OPL-5026 review). Any other word is dropped, not
+ * shown — the status still says what kind of failure it was.
+ */
+export declare const DOCUMENTED_REASONS: ReadonlySet<string>;
+/** Whether a string is a request id the platform could have minted. */
+export declare const isRequestId: (v: unknown) => v is string;
+/**
+ * Whether two strings share any run of four or more characters — the test for
+ * "this metadata may be a piece of that value". Used to drop even a documented
+ * word or a well-formed id that happens to overlap the value sent.
+ */
+export declare function overlaps(a: string, b: string, run?: number): boolean;
+/** A secret, checked field by field, or `undefined`. Only the documented fields survive. */
+export declare function secretOf(body: unknown): Secret | undefined;
+/** A listing, checked: every secret in it, the delivery flag and all four limits, or `undefined`. */
+export declare function secretListOf(body: unknown): SecretList | undefined;
+//# sourceMappingURL=secret-store.d.ts.map

package/dist/secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.d.ts","sourceRoot":"","sources":["../src/secret-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,qCAAqC;AACrC,MAAM,MAAM,MAAM,GAAG;IACnB,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAC;IACX,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,8FAA8F;IAC9F,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,yDAAyD;AACzD,MAAM,MAAM,YAAY,GAAG;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,6FAA6F;IAC7F,kBAAkB,EAAE,MAAM,CAAC;IAC3B,+FAA+F;IAC/F,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,2EAA2E;AAC3E,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uFAAuF;IACvF,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,gGAAgG;IAChG,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3D;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5F,2FAA2F;IAC3F,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE;;;;OAIG;IACH,OAAO,CACL,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACvE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvF;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CASjD,CAAC;AAQH,uEAAuE;AACvE,eAAO,MAAM,WAAW,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,MAAqD,CAAC;AAEpG;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,SAAI,GAAG,OAAO,CAQ/D;AAWD,4FAA4F;AAC5F,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAS1D;AAED,qGAAqG;AACrG,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAwBlE"}

package/dist/secret-store.js

@@ -0,0 +1,105 @@
+/**
+ * The account's secret store, as the platform answers it (OPL-4984 part 2).
+ *
+ * A secret is a named value, encrypted when saved and never readable again: no
+ * route answers a value, so none of the shapes here has one. Computers are bound
+ * to secrets by id with `PUT computers/:id/secrets`; this is where those ids,
+ * and the revision a replace or delete needs, come from.
+ *
+ * Decoded strictly. Every field the published schema marks required is checked,
+ * and a decoded secret carries exactly those fields — so an answer that somehow
+ * held a `value` could not carry it any further than the decoder.
+ */
+/**
+ * The refusal words the platform documents, and the only ones a secret-store
+ * refusal is allowed to carry through this package. Taken from the published
+ * `Error.reason` (contention, starting, unavailable, unsupported, exists,
+ * revoked) and the API-key ingress words beside it (missing, invalid).
+ *
+ * An allow-list rather than a shape check, because a shape check is exactly
+ * what a secret prefix passes: `sk-proj-abc…` cut to thirty-two characters is a
+ * perfectly word-like string (OPL-5026 review). Any other word is dropped, not
+ * shown — the status still says what kind of failure it was.
+ */
+export const DOCUMENTED_REASONS = new Set([
+    'contention',
+    'starting',
+    'unavailable',
+    'unsupported',
+    'exists',
+    'revoked',
+    'missing',
+    'invalid',
+]);
+/**
+ * A request id in the platform's own format: a random UUID, which is all it
+ * mints (callers' ids are ignored). Anything else is not repeated.
+ */
+const REQUEST_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+/** Whether a string is a request id the platform could have minted. */
+export const isRequestId = (v) => typeof v === 'string' && REQUEST_ID.test(v);
+/**
+ * Whether two strings share any run of four or more characters — the test for
+ * "this metadata may be a piece of that value". Used to drop even a documented
+ * word or a well-formed id that happens to overlap the value sent.
+ */
+export function overlaps(a, b, run = 4) {
+    if (!a || !b)
+        return false;
+    const [short, long] = a.length <= b.length ? [a, b] : [b, a];
+    if (short.length < run)
+        return long.includes(short);
+    for (let i = 0; i + run <= short.length; i++) {
+        if (long.includes(short.slice(i, i + run)))
+            return true;
+    }
+    return false;
+}
+const isRecord = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+/** An id or timestamp as the platform spells one: not empty, nothing around it. */
+const isToken = (v) => typeof v === 'string' && v !== '' && v.trim() === v;
+const isCount = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0;
+/** A secret, checked field by field, or `undefined`. Only the documented fields survive. */
+export function secretOf(body) {
+    if (!isRecord(body))
+        return undefined;
+    const { id, name, workspace_id, revision_id, created_at, updated_at, last_used_at } = body;
+    if (!isToken(id) || !isToken(revision_id))
+        return undefined;
+    if (typeof name !== 'string' || name === '')
+        return undefined;
+    if (workspace_id !== null && !isToken(workspace_id))
+        return undefined;
+    if (!isToken(created_at) || !isToken(updated_at))
+        return undefined;
+    if (last_used_at !== null && !isToken(last_used_at))
+        return undefined;
+    return { id, name, workspace_id, revision_id, created_at, updated_at, last_used_at };
+}
+/** A listing, checked: every secret in it, the delivery flag and all four limits, or `undefined`. */
+export function secretListOf(body) {
+    if (!isRecord(body))
+        return undefined;
+    const { secrets, delivery, limits } = body;
+    if (!Array.isArray(secrets) || typeof delivery !== 'boolean' || !isRecord(limits))
+        return undefined;
+    const { name_max_chars, value_max_bytes, active_per_account, created_per_account } = limits;
+    if (!isCount(name_max_chars) ||
+        !isCount(value_max_bytes) ||
+        !isCount(active_per_account) ||
+        !isCount(created_per_account))
+        return undefined;
+    const out = [];
+    for (const row of secrets) {
+        const secret = secretOf(row);
+        if (!secret)
+            return undefined;
+        out.push(secret);
+    }
+    return {
+        secrets: out,
+        delivery,
+        limits: { name_max_chars, value_max_bytes, active_per_account, created_per_account },
+    };
+}
+//# sourceMappingURL=secret-store.js.map

package/dist/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../src/secret-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IAC7D,YAAY;IACZ,UAAU;IACV,aAAa;IACb,aAAa;IACb,QAAQ;IACR,SAAS;IACT,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,GAAG,4EAA4E,CAAC;AAEhG,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEpG;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAS,EAAE,CAAS,EAAE,GAAG,GAAG,CAAC;IACpD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC5D,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAE3D,mFAAmF;AACnF,MAAM,OAAO,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAEjG,MAAM,OAAO,GAAG,CAAC,CAAU,EAAe,EAAE,CAC1C,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE7D,4FAA4F;AAC5F,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAC3F,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9D,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AACvF,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC/E,OAAO,SAAS,CAAC;IACnB,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAAC;IAC5F,IACE,CAAC,OAAO,CAAC,cAAc,CAAC;QACxB,CAAC,OAAO,CAAC,eAAe,CAAC;QACzB,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAC5B,CAAC,OAAO,CAAC,mBAAmB,CAAC;QAE7B,OAAO,SAAS,CAAC;IACnB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG;QACZ,QAAQ;QACR,MAAM,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE;KACrF,CAAC;AACJ,CAAC"}

package/dist/server.d.ts

@@ -1,9 +1,10 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { type SessionConfig } from './session.js';
+import { type ToolFilters } from './tool-filters.js';
 import type { ToolOptions } from './tools/types.js';
 export declare const SERVER_NAME = "mandala-computer";
-export declare const SERVER_VERSION = "0.4.0";
-export type ServerConfig = SessionConfig & Partial<ToolOptions> & {
+export declare const SERVER_VERSION = "0.6.0";
+export type ServerConfig = SessionConfig & ToolFilters & Partial<ToolOptions> & {
     /** Internal HTTP hook: hold a session active for the real tool callback lifetime. */
     activity?: () => () => void;
 };

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAW,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAQ3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGpD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAC9C,eAAO,MAAM,cAAc,UAAU,CAAC;AAqCtC,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,OAAO,CAAC,WAAW,CAAC,GAAG;IACrB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,MAAM,IAAI,CAAC;CAC7B,CAAC;AAEJ;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAmDzD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAQpE,OAAO,EAAW,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,KAAK,WAAW,EAAc,MAAM,mBAAmB,CAAC;AAkBjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGpD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAC9C,eAAO,MAAM,cAAc,UAAU,CAAC;AA6CtC,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,WAAW,GACX,OAAO,CAAC,WAAW,CAAC,GAAG;IACrB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,MAAM,IAAI,CAAC;CAC7B,CAAC;AAEJ;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAmFzD"}

package/dist/server.js

@@ -1,15 +1,27 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, McpError, } from '@modelcontextprotocol/sdk/types.js';
 import { Session } from './session.js';
+import { toolFilter } from './tool-filters.js';
+import { registerAccount } from './tools/account.js';
+import { registerActivities } from './tools/activities.js';
 import { registerAgent } from './tools/agent.js';
+import { registerArtifacts } from './tools/artifacts.js';
+import { registerChat } from './tools/chat.js';
 import { registerComputers } from './tools/computers.js';
+import { registerDirectory } from './tools/directory.js';
 import { registerEvents } from './tools/events.js';
+import { registerExecutions } from './tools/executions.js';
 import { registerGuest } from './tools/guest.js';
 import { registerInput } from './tools/input.js';
+import { registerResults } from './tools/results.js';
+import { registerSecrets } from './tools/secrets.js';
+import { registerSignals } from './tools/signals.js';
 import { registerSnapshots } from './tools/snapshots.js';
+import { registerSSH } from './tools/ssh.js';
 import { registerTemplates } from './tools/templates.js';
 import { registerWebhooks } from './tools/webhooks.js';
 export const SERVER_NAME = 'mandala-computer';
-export const SERVER_VERSION = '0.4.0';
+export const SERVER_VERSION = '0.6.0';
 /**
  * Told to the client on connect, and shown to the model before any tool is
  * called. It is the only place to say the things that are true of the whole
@@ -43,6 +55,13 @@ Things that are true here and are not obvious:
 - Who you are is checked again while a call is in flight, not only when it starts, so a long call can be refused after part of its work is already done. A 401 or a 403 means the credential or the role behind it stopped being accepted: re-authenticate, or say what was refused. Do not resend it, and never resend one that creates, starts, moves, writes or deletes without first checking what took effect. A 402 is the plan as it stands now rather than a fault on the computer, and waiting does not change it. Any of the three can arrive with completed work attached — read that before deciding what is left to do.
 - A 409 is not one thing, and retrying blindly is how a turn gets burned. Most describe a passing state and clear on their own: a guest still booting, a guest agent busy with another call. Some describe a DECISION about what you asked for — a size the host cannot run, a computer that has to be stopped first — and those answer the same way forever; the message says which, and usually says what to do instead. A 400 never clears.
 - Growing a computer past what its host can run is the refusal worth knowing by name: update_computer says a move is possible, and move_computer is how you take that up. It moves the machine to different hardware and copies its disk, so say what it costs before you call it.`;
+const filteredInstructions = `Mandala Computer gives you access to a Linux desktop in the cloud.
+
+This session exposes a filtered set of tools. Use only the tools in its tool list; some desktop workflows may be unavailable. Pass computer_id explicitly on computer-specific calls unless a computer was already bound to this session. A running VM does not imply that its guest desktop is ready.
+
+Read each available tool's description before calling it. Read-only access follows the tool's readOnlyHint annotation: a read that can resume or bill a computer is not read-only. A running computer still costs money, and passive observation does not prevent idle suspension.
+
+Who you are is checked again while a call is in flight. A 401 or 403 means the credential or role stopped being accepted; a 402 means the current plan refuses the work. Do not resend these calls. Inspect any completed work attached before deciding what remains. A 409 may describe either a temporary condition or a decision that will not change on retry; read its message. A 400 never clears.`;
 /**
  * One MCP server over one account's API key.
  *
@@ -51,16 +70,24 @@ Things that are true here and are not obvious:
  * transport builds exactly one and that is the same thing with n=1.
  */
 export function createServer(cfg) {
+    const filter = toolFilter(cfg);
     const session = new Session(cfg);
     const opts = { lifecycle: cfg.lifecycle ?? true };
-    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, { capabilities: { logging: {} }, instructions: instructions(opts.lifecycle) });
+    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, {
+        capabilities: { logging: {}, tools: {} },
+        instructions: filter.filtered ? filteredInstructions : instructions(opts.lifecycle),
+    });
     // A cancelled Streamable HTTP response can let transport.handleRequest()
     // settle while the tool callback is still awaiting platform work. Wrap tool
     // registration once so the HTTP session lease follows that real lifetime.
-    // Stdio has no hook and pays no cost beyond this branch.
-    if (cfg.activity) {
-        const register = server.registerTool.bind(server);
-        server.registerTool = ((...args) => {
+    // Withheld tools never reach the SDK registry or acquire an activity lease.
+    const register = server.registerTool.bind(server);
+    let registered = false;
+    server.registerTool = ((...args) => {
+        const [name, config] = args;
+        if (!filter.allows(name, config.annotations))
+            return;
+        if (cfg.activity) {
             const handlerIndex = args.length - 1;
             const handler = args[handlerIndex];
             args[handlerIndex] = async (...handlerArgs) => {
@@ -72,17 +99,41 @@ export function createServer(cfg) {
                     release?.();
                 }
             };
-            return register(...args);
-        });
-    }
+        }
+        if (!registered) {
+            server.server.removeRequestHandler('tools/list');
+            server.server.removeRequestHandler('tools/call');
+        }
+        const tool = register(...args);
+        registered = true;
+        return tool;
+    });
+    registerAccount(server, session, opts);
     registerComputers(server, session, opts);
     registerInput(server, session, opts);
     registerGuest(server, session, opts);
+    registerExecutions(server, session, opts);
+    registerResults(server, session, opts);
+    registerArtifacts(server, session, opts);
     registerSnapshots(server, session, opts);
     registerTemplates(server, session, opts);
     registerEvents(server, session, opts);
     registerWebhooks(server, session, opts);
+    registerSSH(server, session, opts);
+    registerSecrets(server, session, opts);
     registerAgent(server, session, opts);
+    registerDirectory(server, session, opts);
+    registerActivities(server, session, opts);
+    registerSignals(server, session, opts);
+    registerChat(server, session, opts);
+    // The SDK installs tool handlers on the first registration. An empty
+    // selection still needs a valid tools/list response and must refuse calls.
+    if (!registered) {
+        server.server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: [] }));
+        server.server.setRequestHandler(CallToolRequestSchema, () => {
+            throw new McpError(ErrorCode.InvalidParams, 'No tools are available in this session');
+        });
+    }
     // The event sockets outlive every tool call by design (OPL-3926), so nothing
     // in a tool can be the thing that closes them. This is the end of the
     // session, which is the lifetime they actually have — without it an HTTP

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,OAAO,EAAsB,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,CAAC,SAAkB,EAAE,EAAE,CAC1C;;;;KAIG,SAAS,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,oBAAoB;;;;;;;;;;;;;;;mRAekM,CAAC;AAQpR;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAiB;IAC5C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAgB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;IAE/D,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAC9E,CAAC;IAEF,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAoC,CAAC;QACrF,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE;YAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAA2C,CAAC;YAC7E,IAAI,CAAC,YAAY,CAAC,GAAG,KAAK,EAAE,GAAG,WAAsB,EAAE,EAAE;gBACvD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,OAAO,MAAM,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC;gBACvC,CAAC;wBAAS,CAAC;oBACT,OAAO,EAAE,EAAE,CAAC;gBACd,CAAC;YACH,CAAC,CAAC;YACF,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3B,CAAC,CAA+B,CAAC;IACnC,CAAC;IAED,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACtC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAErC,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IACrC,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;QAC3B,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,EAAE,EAAE,CAAC;IACb,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,sBAAsB,EACtB,QAAQ,GAET,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAsB,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAoB,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,CAAC,SAAkB,EAAE,EAAE,CAC1C;;;;KAIG,SAAS,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,oBAAoB;;;;;;;;;;;;;;;mRAekM,CAAC;AAEpR,MAAM,oBAAoB,GAAG;;;;;;yYAM4W,CAAC;AAS1Y;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAiB;IAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAgB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;IAE/D,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C;QACE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QACxC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;KACpF,CACF,CAAC;IAEF,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAoC,CAAC;IACrF,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE;QAC5C,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAmD,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC;YAAE,OAAO;QACrD,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAA2C,CAAC;YAC7E,IAAI,CAAC,YAAY,CAAC,GAAG,KAAK,EAAE,GAAG,WAAsB,EAAE,EAAE;gBACvD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,OAAO,MAAM,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC;gBACvC,CAAC;wBAAS,CAAC;oBACT,OAAO,EAAE,EAAE,CAAC;gBACd,CAAC;YACH,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;YACjD,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/B,UAAU,GAAG,IAAI,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC,CAA+B,CAAC;IAEjC,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1C,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACtC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1C,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAEpC,qEAAqE;IACrE,2EAA2E;IAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,GAAG,EAAE;YAC1D,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IACrC,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;QAC3B,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,EAAE,EAAE,CAAC;IACb,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/session.d.ts

@@ -1,4 +1,4 @@
-import { Api } from './api.js';
+import { Api, type ApiOptions } from './api.js';
 import { EventHub, type EventSocketFactory } from './events.js';
 export type SessionConfig = {
     apiKey: string;
@@ -21,6 +21,11 @@ export type SessionConfig = {
      * in for by replacing the global.
      */
     webSocket?: EventSocketFactory;
+    /**
+     * What the hosted transport adds to this session's platform requests: the
+     * service header, and the hook that hears a refused bearer. See ApiOptions.
+     */
+    platform?: ApiOptions;
 };
 /**
  * One MCP session's state: whose account, and which computer.

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAoB,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,QAAQ,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhE,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC,CAAC;AAEF;;;;;;;GAOG;AACH,qBAAa,OAAO;;IAClB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAWf,GAAG,EAAE,aAAa;IAO9B,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAEhC;IAED,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;IAED,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAKnD,qFAAqF;IACrF,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAI5C;;;;;;OAMG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAQ1C,oDAAoD;IACpD,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAQtC,kFAAkF;IAClF,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;IAO3F,oFAAoF;IACpF,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IA8BhC,oEAAoE;IACpE,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAI7D;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;CAUnC"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,KAAK,UAAU,EAAoB,MAAM,UAAU,CAAC;AAElE,OAAO,EAAE,QAAQ,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhE,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;;;GAOG;AACH,qBAAa,OAAO;;IAClB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAWf,GAAG,EAAE,aAAa;IAO9B,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAEhC;IAED,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;IAED,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAKnD,qFAAqF;IACrF,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAI5C;;;;;;OAMG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAQ1C,oDAAoD;IACpD,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAQtC,kFAAkF;IAClF,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;IAO3F,oFAAoF;IACpF,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IA8BhC,oEAAoE;IACpE,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAI7D;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;CAUnC"}

package/dist/session.js

@@ -30,7 +30,7 @@ export class Session {
     /** Bound so a long-lived stdio session cannot grow one entry per deleted id. */
     static #MAX_SELECTION_VERSIONS = 256;
     constructor(cfg) {
-        this.api = new Api(cfg.apiKey, cfg.baseUrl ?? DEFAULT_BASE_URL);
+        this.api = new Api(cfg.apiKey, cfg.baseUrl ?? DEFAULT_BASE_URL, undefined, cfg.platform);
         this.events = new EventHub(this.api, cfg.webSocket);
         this.modelKey = cfg.modelKey;
         this.#current = id(cfg.computerId);

package/dist/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAA2B,MAAM,aAAa,CAAC;AAyBhE;;;;;;;GAOG;AACH,MAAM,OAAO,OAAO;IACT,GAAG,CAAM;IAClB;;;;;;OAMG;IACM,MAAM,CAAW;IACjB,QAAQ,CAAU;IAC3B,QAAQ,CAAU;IAClB,+EAA+E;IAC/E,OAAO,CAAU;IACjB,iFAAiF;IACxE,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxD,6EAA6E;IACpE,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,gFAAgF;IAChF,MAAM,CAAU,uBAAuB,GAAG,GAAG,CAAC;IAE9C,YAAY,GAAkB;QAC5B,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,UAAkB,EAAE,UAAmB;QAC1C,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC;IAC5B,CAAC;IAED,qFAAqF;IACrF,gBAAgB,CAAC,UAAkB;QACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,UAAkB;QAC/B,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,oDAAoD;IACpD,YAAY,CAAC,UAAkB;QAC7B,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,IAAI,IAAI,CAAC;YAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;;YACjD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,kFAAkF;IAClF,aAAa,CAAC,UAAkB,EAAE,UAA8B,EAAE,OAAe;QAC/E,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oFAAoF;IACpF,MAAM,CAAC,UAAkB;QACvB,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,UAAU,cAAc,CAAC,CAAC;QAC1D,+DAA+D;QAC/D,qEAAqE;QACrE,yEAAyE;QACzE,4EAA4E;QAC5E,0EAA0E;QAC1E,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACnE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC1F,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,IAAI,OAAO,CAAC,uBAAuB;oBAAE,MAAM;YAC7E,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAChE,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC1B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,cAAc,CAAC,UAAkB,EAAE,UAAmB;QACpD,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,UAAU;YAAE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC;IAChF,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAiB;QACvB,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,YAAY,CACpB,4EAA4E;gBAC1E,mEAAmE,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;;AAGH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,EAAE,CAAC,KAAyB;IACnC,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAmB,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAA2B,MAAM,aAAa,CAAC;AA8BhE;;;;;;;GAOG;AACH,MAAM,OAAO,OAAO;IACT,GAAG,CAAM;IAClB;;;;;;OAMG;IACM,MAAM,CAAW;IACjB,QAAQ,CAAU;IAC3B,QAAQ,CAAU;IAClB,+EAA+E;IAC/E,OAAO,CAAU;IACjB,iFAAiF;IACxE,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxD,6EAA6E;IACpE,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,gFAAgF;IAChF,MAAM,CAAU,uBAAuB,GAAG,GAAG,CAAC;IAE9C,YAAY,GAAkB;QAC5B,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,UAAkB,EAAE,UAAmB;QAC1C,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC;IAC5B,CAAC;IAED,qFAAqF;IACrF,gBAAgB,CAAC,UAAkB;QACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,UAAkB;QAC/B,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,oDAAoD;IACpD,YAAY,CAAC,UAAkB;QAC7B,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,IAAI,IAAI,CAAC;YAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;;YACjD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,kFAAkF;IAClF,aAAa,CAAC,UAAkB,EAAE,UAA8B,EAAE,OAAe;QAC/E,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oFAAoF;IACpF,MAAM,CAAC,UAAkB;QACvB,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,UAAU,cAAc,CAAC,CAAC;QAC1D,+DAA+D;QAC/D,qEAAqE;QACrE,yEAAyE;QACzE,4EAA4E;QAC5E,0EAA0E;QAC1E,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACnE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC1F,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,IAAI,OAAO,CAAC,uBAAuB;oBAAE,MAAM;YAC7E,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAChE,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC1B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,cAAc,CAAC,UAAkB,EAAE,UAAmB;QACpD,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,UAAU;YAAE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC;IAChF,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAiB;QACvB,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,YAAY,CACpB,4EAA4E;gBAC1E,mEAAmE,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;;AAGH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,EAAE,CAAC,KAAyB;IACnC,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3B,CAAC"}

package/dist/stdio.d.ts

@@ -1,4 +1,8 @@
 import { type ServerConfig } from './server.js';
+export type StdioConfig = Omit<ServerConfig, 'apiKey'> & {
+    apiKey?: string;
+    profile?: string;
+};
 /**
  * The local install: one process, one key, spawned by the MCP client.
  *
@@ -7,5 +11,5 @@ import { type ServerConfig } from './server.js';
  * here may ever write to stdout: that stream is the protocol, and one stray
  * console.log is a parse error at the other end. Diagnostics go to stderr.
  */
-export declare function runStdio(cfg: ServerConfig): Promise<void>;
+export declare function runStdio(cfg?: StdioConfig): Promise<void>;
 //# sourceMappingURL=stdio.d.ts.map

package/dist/stdio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC/D"}
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/F;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,GAAG,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCnE"}

package/dist/stdio.js

@@ -1,5 +1,5 @@
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { DEFAULT_BASE_URL } from './api.js';
+import { resolveCredentials } from './credentials.js';
 import { createServer } from './server.js';
 /**
  * The local install: one process, one key, spawned by the MCP client.
@@ -9,8 +9,14 @@ import { createServer } from './server.js';
  * here may ever write to stdout: that stream is the protocol, and one stray
  * console.log is a parse error at the other end. Diagnostics go to stderr.
  */
-export async function runStdio(cfg) {
-    const server = createServer(cfg);
+export async function runStdio(cfg = {}) {
+    const credentials = resolveCredentials(cfg);
+    const resolved = {
+        ...cfg,
+        apiKey: credentials.apiKey,
+        baseUrl: credentials.baseUrl,
+    };
+    const server = createServer(resolved);
     const transport = new StdioServerTransport();
     await server.connect(transport);
     // The end of the client, and therefore the end of this process.
@@ -38,6 +44,6 @@ export async function runStdio(cfg) {
     const shutdown = () => void server.close().catch(() => { });
     process.stdin.once('end', shutdown);
     process.stdin.once('close', shutdown);
-    console.error(`mandala-computer-mcp on stdio → ${new URL(cfg.baseUrl ?? DEFAULT_BASE_URL).origin}`);
+    console.error(`mandala-computer-mcp on stdio → ${new URL(credentials.baseUrl).origin}`);
 }
 //# sourceMappingURL=stdio.js.map

package/dist/stdio.js.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAqB,MAAM,aAAa,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAiB;IAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,gEAAgE;IAChE,EAAE;IACF,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,oEAAoE;IACpE,+EAA+E;IAC/E,iCAAiC;IACjC,EAAE;IACF,yEAAyE;IACzE,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,+DAA+D;IAC/D,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,qBAAqB;IACrB,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CACX,mCAAmC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,CACrF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAqB,MAAM,aAAa,CAAC;AAI9D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAmB,EAAE;IAClD,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAiB;QAC7B,GAAG,GAAG;QACN,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;KAC7B,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,gEAAgE;IAChE,EAAE;IACF,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,oEAAoE;IACpE,+EAA+E;IAC/E,iCAAiC;IACjC,EAAE;IACF,yEAAyE;IACzE,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,+DAA+D;IAC/D,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,qBAAqB;IACrB,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,mCAAmC,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1F,CAAC"}

package/dist/tool-filters.d.ts

@@ -0,0 +1,38 @@
+import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';
+/** Tags describe capabilities, not whether calling a tool is safe. */
+export declare const TOOL_TAGS: {
+    readonly account: readonly ["get_account"];
+    readonly agent: readonly ["run_agent", "run_agent_chat"];
+    readonly activities: readonly ["list_activities", "get_activity", "get_activity_results"];
+    readonly signals: readonly ["read_signals"];
+    readonly artifacts: readonly ["publish_artifact", "get_artifact", "read_artifact", "delete_artifact"];
+    readonly computers: readonly ["list_computers", "get_computer", "use_computer", "wait_for_computer", "get_desktop_url", "list_sizes"];
+    readonly events: readonly ["wait_for_event", "poll_events", "wait_for_file_change"];
+    readonly executions: readonly ["get_execution", "read_execution_output"];
+    readonly files: readonly ["list_directory", "read_file", "write_file", "wait_for_file_change"];
+    readonly guest: readonly ["exec", "exec_poll", "exec_kill", "open_url", "list_windows", "window_action", "read_clipboard", "write_clipboard"];
+    readonly input: readonly ["screenshot", "click", "type_text", "press_key", "scroll", "drag", "move_mouse", "mouse_button", "cursor_position", "wait"];
+    readonly lifecycle: readonly ["create_computer", "start_computer", "stop_computer", "suspend_computer", "restart_computer", "update_computer", "clone_computer", "delete_computer", "move_computer", "list_moves"];
+    readonly results: readonly ["get_activity_results", "retain_execution_output", "get_result", "read_result_output", "delete_result"];
+    readonly snapshots: readonly ["list_snapshots", "snapshot_holdings", "create_snapshot", "restore_snapshot", "clone_snapshot", "snapshot_schedule", "get_retention", "delete_snapshot"];
+    readonly templates: readonly ["list_templates", "get_template_schema", "check_template", "publish_template", "get_template", "retire_template", "build_template", "list_builds", "get_build", "watch_build"];
+    readonly secrets: readonly ["get_computer_secrets", "set_computer_secrets", "list_secrets", "get_secret", "create_secret", "replace_secret", "delete_secret"];
+    readonly ssh: readonly ["list_ssh_keys", "add_ssh_key", "remove_ssh_key", "get_computer_ssh", "set_computer_ssh"];
+    readonly usage: readonly ["get_usage"];
+    readonly webhooks: readonly ["list_webhooks", "create_webhook", "get_webhook", "update_webhook", "rotate_webhook_secret", "test_webhook", "list_webhook_deliveries", "delete_webhook"];
+};
+export type ToolTag = keyof typeof TOOL_TAGS;
+export type ToolFilters = {
+    /** Keep only tools whose existing readOnlyHint is exactly true. */
+    readOnly?: boolean;
+    /** Union of these tags; absent or empty means all tags. Names are lowercase. */
+    tags?: readonly string[];
+};
+export declare const VALID_TAGS: ToolTag[];
+export declare function parseToolTags(raw: string | undefined): ToolTag[];
+/** Validate before constructing the session; never infer read-only from a name or verb. */
+export declare function toolFilter(cfg: ToolFilters): {
+    filtered: boolean;
+    allows: (name: string, annotations?: ToolAnnotations) => boolean;
+};
+//# sourceMappingURL=tool-filters.d.ts.map

package/dist/tool-filters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-filters.d.ts","sourceRoot":"","sources":["../src/tool-filters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E,sEAAsE;AACtE,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;CAqGZ,CAAC;AAEX,MAAM,MAAM,OAAO,GAAG,MAAM,OAAO,SAAS,CAAC;AAC7C,MAAM,MAAM,WAAW,GAAG;IACxB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gFAAgF;IAChF,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,eAAO,MAAM,UAAU,EAAoC,OAAO,EAAE,CAAC;AAcrE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,EAAE,CAEhE;AAED,2FAA2F;AAC3F,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG;IAC5C,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,eAAe,KAAK,OAAO,CAAC;CAClE,CAmBA"}