rappi-mcp-unofficial 0.1.0

package/AGENTS.md

@@ -0,0 +1,17 @@
+# Agent notes
+
+Unofficial local-first Rappi MCP. Personal grocery cart for David / Life / Grok Bot.
+
+## Commands
+
+- `npm ci`
+- `npm test` (typecheck, build, smoke, mutation gate, redaction, handlers, secret-scan)
+- `npx rappi-mcp-unofficial doctor`
+
+## Rules
+
+- Never commit tokens or `~/.rappi-mcp/`.
+- Never enable `RAPPI_ALLOW_MUTATIONS` in default examples.
+- `rappi_place_order` must stay fail-closed in tests without both gates.
+- Do not add this connector to the Delx Wellness registry (grocery, not wellness).
+- Live Rappi login is not required for CI.

package/CHANGELOG.md

@@ -0,0 +1,10 @@
+## 0.1.0 - 2026-08-26
+
+### Added
+
+- Unofficial local-first Rappi MCP (stdio, optional loopback HTTP).
+- Read tools: store/product search, cart, addresses, orders (identity redacted by default).
+- Cart writes and place-order / payment writes fail-closed unless `RAPPI_ALLOW_MUTATIONS` and `explicit_user_intent` are both true.
+- Logout and address selection require `explicit_user_intent`.
+- Guest tokens cannot charge.
+- Token file `~/.rappi-mcp/tokens.json` mode 0600.

package/CONTRIBUTING.md

@@ -0,0 +1,6 @@
+# Contributing
+
+1. Keep the default read-only. Money tools stay behind `RAPPI_ALLOW_MUTATIONS` **and** `explicit_user_intent`.
+2. Tests must import shipped handlers from `dist/services/handlers.js`, not a reimplementation.
+3. Do not add live Rappi credentials to fixtures.
+4. Run `npm test` before opening a PR.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 David Mosiah
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,72 @@
+# Rappi MCP (unofficial)
+
+Local-first MCP for **your** Rappi cart: search nearby stores and products, inspect the cart, list saved addresses, list and track orders.
+
+**This is unofficial.** Not affiliated with, endorsed by, or supported by Rappi. Rappi does not publish a stable consumer cart API. This server talks to the same undocumented web/app endpoints (`services.rappi.com.br` by default). They can change without notice.
+
+This is **not** the Rappi Partners / restaurant-integrations OAuth API.
+
+## Never pays by default
+
+Checkout, place-order, and payment-method writes **do not run** unless **both** are true:
+
+1. `RAPPI_ALLOW_MUTATIONS=true`
+2. the tool argument `explicit_user_intent: true`
+
+Logout and address selection require `explicit_user_intent` only. Guest tokens cannot charge.
+
+Default privacy mode (`structured`) redacts **street, phone, email, last-four**. Tokens live in `~/.rappi-mcp/tokens.json` (mode 0600). They are not in the npm tarball.
+
+## Install (stdio)
+
+```bash
+npx -y rappi-mcp-unofficial setup
+npx -y rappi-mcp-unofficial auth --token <personal-access-token>
+npx -y rappi-mcp-unofficial doctor
+```
+
+Local agent / Claude Desktop / Cursor / Grok Bot:
+
+```json
+{
+  "mcpServers": {
+    "rappi": {
+      "command": "npx",
+      "args": ["-y", "rappi-mcp-unofficial"]
+    }
+  }
+}
+```
+
+See [examples/grok-bot.md](examples/grok-bot.md). Do **not** put `RAPPI_ALLOW_MUTATIONS` in that snippet.
+
+Optional loopback HTTP: `npx -y rappi-mcp-unofficial --http` → `POST http://127.0.0.1:3000/mcp`.
+
+## Tools
+
+Read: `rappi_search_stores`, `rappi_search_products`, `rappi_get_cart`, `rappi_list_addresses`, `rappi_list_orders`, `rappi_get_order`, `rappi_connection_status`, `rappi_capabilities`, `rappi_privacy_audit`.
+
+Gated cart: `rappi_add_to_cart`, `rappi_update_cart_item`, `rappi_clear_cart`.
+
+Gated pay: `rappi_place_order`, `rappi_set_payment_method`.
+
+Intent-only: `rappi_logout`, `rappi_set_active_address`.
+
+## Tests
+
+```bash
+npm test
+```
+
+No live Rappi session is required. Gates and redaction run against shipped handlers and stdio smoke.
+
+## Env
+
+| Name | Default |
+| --- | --- |
+| `RAPPI_COUNTRY` | `BR` |
+| `RAPPI_API_BASE` | `https://services.rappi.com.br` |
+| `RAPPI_TOKEN_PATH` | `~/.rappi-mcp/tokens.json` |
+| `RAPPI_PRIVACY_MODE` | `structured` |
+| `RAPPI_ALLOW_MUTATIONS` | unset / false |
+| `RAPPI_LAT` / `RAPPI_LNG` | optional nearby search |

package/SECURITY.md

@@ -0,0 +1,30 @@
+# Security Policy
+
+## Reporting
+
+Report vulnerabilities privately. Never paste Rappi tokens, addresses, phone numbers, card last-four, or order dumps in public issues.
+
+## Data this server may touch
+
+- Personal Rappi access token in `RAPPI_ACCESS_TOKEN` or `~/.rappi-mcp/tokens.json` (0600).
+- Cart, saved addresses, payment-method metadata, and order history from the unofficial consumer surface.
+
+## Fail-closed money rules
+
+- Default is read-only. Checkout does **not** run.
+- `rappi_place_order` and `rappi_set_payment_method` require **both** `RAPPI_ALLOW_MUTATIONS=true` and `explicit_user_intent=true`.
+- Cart writes require the same two gates.
+- Logout and address selection require `explicit_user_intent` only.
+- Guest tokens cannot place orders or change payment methods.
+- Default privacy mode redacts street, phone, email, and last-four.
+
+## Local hardening
+
+- Store tokens on a trusted machine only, outside iCloud/Dropbox.
+- Do not put `RAPPI_ACCESS_TOKEN` in a committed MCP config; prefer `rappi-mcp-unofficial auth --token`.
+- Keep `RAPPI_ALLOW_MUTATIONS` unset unless you intentionally want an agent to be able to charge you.
+- The npm tarball does not include `~/.rappi-mcp`, `.env`, or fixtures with live credentials.
+
+## Unofficial surface
+
+Rappi does not publish a consumer cart API. This package talks to the same undocumented web/app endpoints (`services.rappi.com.br` by default). They can change without notice. This is **not** the Rappi Partners restaurant OAuth API.

package/dist/cli/commands.d.ts

@@ -0,0 +1 @@
+export declare function runCliCommand(args: string[]): Promise<number | undefined>;

package/dist/cli/commands.js

@@ -0,0 +1,88 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { SERVER_VERSION } from "../constants.js";
+import { peekConfig } from "../services/config.js";
+import { buildConnectionStatus } from "../services/connection-status.js";
+import { TokenStore } from "../services/token-store.js";
+export async function runCliCommand(args) {
+    const [command, ...rest] = args;
+    if (!command || command === "--http")
+        return undefined;
+    if (command === "setup")
+        return runSetup(rest);
+    if (command === "auth" || command === "login")
+        return runAuth(rest);
+    if (command === "doctor" || command === "status")
+        return runDoctor(rest);
+    if (command === "version" || command === "--version" || command === "-v") {
+        console.log(SERVER_VERSION);
+        return 0;
+    }
+    if (command === "help" || command === "--help" || command === "-h") {
+        printHelp();
+        return 0;
+    }
+    if (!command.startsWith("--")) {
+        console.error(`Unknown command: ${command}`);
+        printHelp();
+        return 1;
+    }
+    return undefined;
+}
+async function runSetup(args) {
+    const allow = args.includes("--allow-mutations");
+    const config = peekConfig();
+    mkdirSync(dirname(config.configPath), { recursive: true, mode: 0o700 });
+    writeFileSync(config.configPath, JSON.stringify({
+        unofficial: true,
+        country: config.country,
+        api_base: config.apiBase,
+        allow_mutations: allow,
+        never_pays_by_default: !allow
+    }, null, 2), { mode: 0o600 });
+    console.log(`Wrote ${config.configPath} (0600). Mutations ${allow ? "ENABLED — you can be charged" : "disabled (default)"}.`);
+    console.log("Next: rappi-mcp-unofficial auth --token <personal-access-token>");
+    return 0;
+}
+async function runAuth(args) {
+    const idx = args.indexOf("--token");
+    const token = idx >= 0 ? args[idx + 1] : process.env.RAPPI_ACCESS_TOKEN;
+    if (!token || token.startsWith("--")) {
+        console.error("Pass --token <access_token> or set RAPPI_ACCESS_TOKEN. Do not paste tokens into git.");
+        return 1;
+    }
+    const config = peekConfig();
+    const store = new TokenStore(config.tokenPath);
+    await store.write({ access_token: token, source: "user", token_type: "Bearer" });
+    console.log(`Stored personal token at ${config.tokenPath} (0600).`);
+    return 0;
+}
+async function runDoctor(args) {
+    const status = await buildConnectionStatus();
+    if (args.includes("--json")) {
+        console.log(JSON.stringify(status, null, 2));
+    }
+    else {
+        console.log(`Rappi MCP · Doctor  ${status.ok ? "READY" : "NEEDS AUTH"}`);
+        console.log(`Unofficial: yes   Mutations: ${status.mutations_enabled}   Privacy: ${status.privacy_mode}`);
+        console.log(`Token file: ${status.token.path} exists=${status.token.exists}`);
+        if (status.missing_env.length)
+            console.log(`Missing: ${status.missing_env.join(", ")}`);
+        for (const step of status.next_steps)
+            console.log(`- ${step}`);
+    }
+    return args.includes("--strict") && !status.ok ? 1 : 0;
+}
+function printHelp() {
+    console.log(`rappi-mcp-unofficial ${SERVER_VERSION}
+Unofficial local-first Rappi MCP. Never pays unless RAPPI_ALLOW_MUTATIONS and explicit_user_intent.
+
+Commands:
+  setup [--allow-mutations]   write ~/.rappi-mcp/config.json (0600)
+  auth --token <token>        store personal access token (0600)
+  doctor [--json] [--strict]
+  version
+
+Default transport: stdio. Optional: --http (loopback only).`);
+}
+//# sourceMappingURL=commands.js.map

package/dist/cli/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/cli/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc;IAChD,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACvD,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACnE,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QAC7C,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAc;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,aAAa,CACX,MAAM,CAAC,UAAU,EACjB,IAAI,CAAC,SAAS,CACZ;QACE,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,eAAe,EAAE,KAAK;QACtB,qBAAqB,EAAE,CAAC,KAAK;KAC9B,EACD,IAAI,EACJ,CAAC,CACF,EACD,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,UAAU,sBAAsB,KAAK,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,oBAAoB,GAAG,CAAC,CAAC;IAC9H,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAc;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACxE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,sFAAsF,CAAC,CAAC;QACtG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,CAAC,SAAS,UAAU,CAAC,CAAC;IACpE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAc;IACrC,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,gCAAgC,MAAM,CAAC,iBAAiB,eAAe,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1G,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,KAAK,CAAC,IAAI,WAAW,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC,wBAAwB,cAAc;;;;;;;;;4DASQ,CAAC,CAAC;AAC9D,CAAC"}

package/dist/constants.d.ts

@@ -0,0 +1,23 @@
+export declare const SERVER_NAME = "rappi-mcp-server";
+export declare const SERVER_VERSION = "0.1.0";
+export declare const NPM_PACKAGE_NAME = "rappi-mcp-unofficial";
+export declare const PINNED_NPM_PACKAGE = "rappi-mcp-unofficial@0.1.0";
+/** Default Brazil consumer surface. Override with RAPPI_API_BASE. Unofficial / unstable. */
+export declare const DEFAULT_API_BASE = "https://services.rappi.com.br";
+export declare const COUNTRY_BASES: Record<string, string>;
+/** Unofficial consumer paths (web/app). Not Rappi Partners restaurant OAuth. */
+export declare const PATHS: {
+    readonly guest: "/api/rocket/v2/guest";
+    readonly search: "/api/ms/web-proxy/dynamic-list/cpgs/";
+    readonly stores: "/api/ms/web-home/v1/home";
+    readonly products: "/api/ms/search-proxy/search";
+    readonly cart: "/api/ms/cart/v1/carts/current";
+    readonly cartProducts: "/api/ms/cart/v1/carts/current/products";
+    readonly addresses: "/api/ms/user-addresses";
+    readonly orders: "/api/ms/user-orders";
+    readonly checkout: "/api/ms/checkout/v1/orders";
+    readonly paymentMethods: "/api/ms/payments/v1/payment-methods";
+};
+export declare const DEFAULT_USER_AGENT = "rappi-mcp-server/0.1.0";
+export declare const REQUEST_TIMEOUT_MS = 20000;
+export declare const TOKEN_DIR_NAME = ".rappi-mcp";

package/dist/constants.js

@@ -0,0 +1,34 @@
+export const SERVER_NAME = "rappi-mcp-server";
+export const SERVER_VERSION = "0.1.0";
+export const NPM_PACKAGE_NAME = "rappi-mcp-unofficial";
+export const PINNED_NPM_PACKAGE = `${NPM_PACKAGE_NAME}@${SERVER_VERSION}`;
+/** Default Brazil consumer surface. Override with RAPPI_API_BASE. Unofficial / unstable. */
+export const DEFAULT_API_BASE = "https://services.rappi.com.br";
+export const COUNTRY_BASES = {
+    BR: "https://services.rappi.com.br",
+    CO: "https://services.rappi.com",
+    MX: "https://services.mxgrability.rappi.com",
+    AR: "https://services.rappi.com.ar",
+    CL: "https://services.rappi.cl",
+    PE: "https://services.rappi.pe",
+    UY: "https://services.rappi.com.uy",
+    EC: "https://services.rappi.com.ec",
+    CR: "https://services.rappi.co.cr"
+};
+/** Unofficial consumer paths (web/app). Not Rappi Partners restaurant OAuth. */
+export const PATHS = {
+    guest: "/api/rocket/v2/guest",
+    search: "/api/ms/web-proxy/dynamic-list/cpgs/",
+    stores: "/api/ms/web-home/v1/home",
+    products: "/api/ms/search-proxy/search",
+    cart: "/api/ms/cart/v1/carts/current",
+    cartProducts: "/api/ms/cart/v1/carts/current/products",
+    addresses: "/api/ms/user-addresses",
+    orders: "/api/ms/user-orders",
+    checkout: "/api/ms/checkout/v1/orders",
+    paymentMethods: "/api/ms/payments/v1/payment-methods"
+};
+export const DEFAULT_USER_AGENT = `${SERVER_NAME}/${SERVER_VERSION}`;
+export const REQUEST_TIMEOUT_MS = 20_000;
+export const TOKEN_DIR_NAME = ".rappi-mcp";
+//# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,gBAAgB,IAAI,cAAc,EAAE,CAAC;AAE1E,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAEhE,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,EAAE,EAAE,+BAA+B;IACnC,EAAE,EAAE,4BAA4B;IAChC,EAAE,EAAE,wCAAwC;IAC5C,EAAE,EAAE,+BAA+B;IACnC,EAAE,EAAE,2BAA2B;IAC/B,EAAE,EAAE,2BAA2B;IAC/B,EAAE,EAAE,+BAA+B;IACnC,EAAE,EAAE,+BAA+B;IACnC,EAAE,EAAE,8BAA8B;CACnC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,KAAK,EAAE,sBAAsB;IAC7B,MAAM,EAAE,sCAAsC;IAC9C,MAAM,EAAE,0BAA0B;IAClC,QAAQ,EAAE,6BAA6B;IACvC,IAAI,EAAE,+BAA+B;IACrC,YAAY,EAAE,wCAAwC;IACtD,SAAS,EAAE,wBAAwB;IACnC,MAAM,EAAE,qBAAqB;IAC7B,QAAQ,EAAE,4BAA4B;IACtC,cAAc,EAAE,qCAAqC;CAC7C,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,WAAW,IAAI,cAAc,EAAE,CAAC;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function createServer(): McpServer;

package/dist/index.js

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+import { createServer as createHttpServer } from "node:http";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { SERVER_NAME, SERVER_VERSION } from "./constants.js";
+import { runCliCommand } from "./cli/commands.js";
+import { registerRappiTools } from "./tools/rappi-tools.js";
+export function createServer() {
+    const server = new McpServer({
+        name: SERVER_NAME,
+        version: SERVER_VERSION
+    });
+    registerRappiTools(server);
+    return server;
+}
+async function runStdio() {
+    const server = createServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+async function runHttp() {
+    const host = process.env.RAPPI_MCP_HOST ?? "127.0.0.1";
+    const port = Number(process.env.RAPPI_MCP_PORT ?? 3000);
+    const http = createHttpServer(async (req, res) => {
+        if (req.method === "GET" && req.url === "/health") {
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ ok: true, name: SERVER_NAME, version: SERVER_VERSION }));
+            return;
+        }
+        if (req.method !== "POST" || req.url !== "/mcp") {
+            res.writeHead(404);
+            res.end();
+            return;
+        }
+        const chunks = [];
+        for await (const chunk of req)
+            chunks.push(chunk);
+        const body = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+        const server = createServer();
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: undefined,
+            enableJsonResponse: true
+        });
+        res.on("close", () => {
+            transport.close().catch(() => undefined);
+            server.close().catch(() => undefined);
+        });
+        try {
+            await server.connect(transport);
+            await transport.handleRequest(req, res, body);
+        }
+        catch {
+            if (!res.headersSent) {
+                res.writeHead(500, { "content-type": "application/json" });
+                res.end(JSON.stringify({ jsonrpc: "2.0", error: { code: -32603, message: "Internal server error" }, id: null }));
+            }
+        }
+    });
+    http.listen(port, host, () => {
+        console.error(`${SERVER_NAME} HTTP transport listening on http://${host}:${port}/mcp`);
+    });
+}
+const args = new Set(process.argv.slice(2));
+let cliResult;
+try {
+    cliResult = await runCliCommand(process.argv.slice(2));
+}
+catch (error) {
+    console.error(`Error: ${error.message}`);
+    process.exitCode = 1;
+}
+if (cliResult !== undefined) {
+    process.exitCode = cliResult;
+}
+else if (process.exitCode === undefined) {
+    const transport = process.env.RAPPI_MCP_TRANSPORT ?? (args.has("--http") ? "http" : "stdio");
+    if (transport === "http") {
+        await runHttp();
+    }
+    else {
+        await runStdio();
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IACH,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,QAAQ;IACrB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,OAAO;IACpB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,WAAW,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;IAExD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;YAChD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QAC3B,OAAO,CAAC,KAAK,CAAC,GAAG,WAAW,uCAAuC,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,IAAI,SAA6B,CAAC;AAElC,IAAI,CAAC;IACH,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAC,UAAW,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;IAC5B,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;AAC/B,CAAC;KAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7F,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/schemas/common.d.ts

@@ -0,0 +1,105 @@
+import { z } from "zod";
+export declare const ResponseFormatSchema: z.ZodDefault<z.ZodEnum<{
+    markdown: "markdown";
+    json: "json";
+}>>;
+export declare const PrivacyModeSchema: z.ZodOptional<z.ZodEnum<{
+    summary: "summary";
+    structured: "structured";
+    raw: "raw";
+}>>;
+export declare const ResponseOnlyInputSchema: z.ZodObject<{
+    response_format: z.ZodDefault<z.ZodEnum<{
+        markdown: "markdown";
+        json: "json";
+    }>>;
+}, z.core.$strict>;
+export declare const ReadInputSchema: z.ZodObject<{
+    privacy_mode: z.ZodOptional<z.ZodEnum<{
+        summary: "summary";
+        structured: "structured";
+        raw: "raw";
+    }>>;
+    response_format: z.ZodDefault<z.ZodEnum<{
+        markdown: "markdown";
+        json: "json";
+    }>>;
+}, z.core.$strict>;
+export declare const SearchInputSchema: z.ZodObject<{
+    query: z.ZodOptional<z.ZodString>;
+    latitude: z.ZodOptional<z.ZodNumber>;
+    longitude: z.ZodOptional<z.ZodNumber>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    privacy_mode: z.ZodOptional<z.ZodEnum<{
+        summary: "summary";
+        structured: "structured";
+        raw: "raw";
+    }>>;
+    response_format: z.ZodDefault<z.ZodEnum<{
+        markdown: "markdown";
+        json: "json";
+    }>>;
+}, z.core.$strict>;
+export declare const OrderIdInputSchema: z.ZodObject<{
+    order_id: z.ZodString;
+    privacy_mode: z.ZodOptional<z.ZodEnum<{
+        summary: "summary";
+        structured: "structured";
+        raw: "raw";
+    }>>;
+    response_format: z.ZodDefault<z.ZodEnum<{
+        markdown: "markdown";
+        json: "json";
+    }>>;
+}, z.core.$strict>;
+export declare const LogoutInputSchema: z.ZodObject<{
+    explicit_user_intent: z.ZodDefault<z.ZodBoolean>;
+    response_format: z.ZodDefault<z.ZodEnum<{
+        markdown: "markdown";
+        json: "json";
+    }>>;
+}, z.core.$strict>;
+export declare const CartWriteInputSchema: z.ZodObject<{
+    product_id: z.ZodString;
+    store_id: z.ZodOptional<z.ZodString>;
+    quantity: z.ZodDefault<z.ZodNumber>;
+    explicit_user_intent: z.ZodDefault<z.ZodBoolean>;
+    response_format: z.ZodDefault<z.ZodEnum<{
+        markdown: "markdown";
+        json: "json";
+    }>>;
+}, z.core.$strict>;
+export declare const ClearCartInputSchema: z.ZodObject<{
+    explicit_user_intent: z.ZodDefault<z.ZodBoolean>;
+    response_format: z.ZodDefault<z.ZodEnum<{
+        markdown: "markdown";
+        json: "json";
+    }>>;
+}, z.core.$strict>;
+export declare const AddressWriteInputSchema: z.ZodObject<{
+    address_id: z.ZodString;
+    explicit_user_intent: z.ZodDefault<z.ZodBoolean>;
+    response_format: z.ZodDefault<z.ZodEnum<{
+        markdown: "markdown";
+        json: "json";
+    }>>;
+}, z.core.$strict>;
+export declare const PaymentWriteInputSchema: z.ZodObject<{
+    payment_method_id: z.ZodString;
+    explicit_user_intent: z.ZodDefault<z.ZodBoolean>;
+    response_format: z.ZodDefault<z.ZodEnum<{
+        markdown: "markdown";
+        json: "json";
+    }>>;
+}, z.core.$strict>;
+export declare const PlaceOrderInputSchema: z.ZodObject<{
+    address_id: z.ZodString;
+    payment_method_id: z.ZodString;
+    store_id: z.ZodOptional<z.ZodString>;
+    notes: z.ZodOptional<z.ZodString>;
+    explicit_user_intent: z.ZodDefault<z.ZodBoolean>;
+    response_format: z.ZodDefault<z.ZodEnum<{
+        markdown: "markdown";
+        json: "json";
+    }>>;
+}, z.core.$strict>;

package/dist/schemas/common.js

@@ -0,0 +1,61 @@
+import { z } from "zod";
+export const ResponseFormatSchema = z.enum(["markdown", "json"]).default("markdown");
+export const PrivacyModeSchema = z.enum(["summary", "structured", "raw"]).optional();
+const Intent = z
+    .boolean()
+    .default(false)
+    .describe("Must be true after the user explicitly asked for this write.");
+export const ResponseOnlyInputSchema = z.object({
+    response_format: ResponseFormatSchema
+}).strict();
+export const ReadInputSchema = z.object({
+    privacy_mode: PrivacyModeSchema,
+    response_format: ResponseFormatSchema
+}).strict();
+export const SearchInputSchema = z.object({
+    query: z.string().max(200).optional(),
+    latitude: z.number().optional(),
+    longitude: z.number().optional(),
+    limit: z.number().int().min(1).max(50).optional(),
+    privacy_mode: PrivacyModeSchema,
+    response_format: ResponseFormatSchema
+}).strict();
+export const OrderIdInputSchema = z.object({
+    order_id: z.string().min(1),
+    privacy_mode: PrivacyModeSchema,
+    response_format: ResponseFormatSchema
+}).strict();
+export const LogoutInputSchema = z.object({
+    explicit_user_intent: Intent,
+    response_format: ResponseFormatSchema
+}).strict();
+export const CartWriteInputSchema = z.object({
+    product_id: z.string().min(1),
+    store_id: z.string().min(1).optional(),
+    quantity: z.number().int().min(1).max(99).default(1),
+    explicit_user_intent: Intent,
+    response_format: ResponseFormatSchema
+}).strict();
+export const ClearCartInputSchema = z.object({
+    explicit_user_intent: Intent,
+    response_format: ResponseFormatSchema
+}).strict();
+export const AddressWriteInputSchema = z.object({
+    address_id: z.string().min(1),
+    explicit_user_intent: Intent,
+    response_format: ResponseFormatSchema
+}).strict();
+export const PaymentWriteInputSchema = z.object({
+    payment_method_id: z.string().min(1),
+    explicit_user_intent: Intent,
+    response_format: ResponseFormatSchema
+}).strict();
+export const PlaceOrderInputSchema = z.object({
+    address_id: z.string().min(1),
+    payment_method_id: z.string().min(1),
+    store_id: z.string().min(1).optional(),
+    notes: z.string().max(280).optional(),
+    explicit_user_intent: Intent,
+    response_format: ResponseFormatSchema
+}).strict();
+//# sourceMappingURL=common.js.map

package/dist/schemas/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../src/schemas/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAErF,MAAM,MAAM,GAAG,CAAC;KACb,OAAO,EAAE;KACT,OAAO,CAAC,KAAK,CAAC;KACd,QAAQ,CAAC,8DAA8D,CAAC,CAAC;AAE5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,iBAAiB;IAC/B,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD,YAAY,EAAE,iBAAiB;IAC/B,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,iBAAiB;IAC/B,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,oBAAoB,EAAE,MAAM;IAC5B,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,oBAAoB,EAAE,MAAM;IAC5B,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,oBAAoB,EAAE,MAAM;IAC5B,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,oBAAoB,EAAE,MAAM;IAC5B,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,oBAAoB,EAAE,MAAM;IAC5B,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrC,oBAAoB,EAAE,MAAM;IAC5B,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/dist/services/audit.d.ts

@@ -0,0 +1,10 @@
+export declare function buildPrivacyAudit(): {
+    unofficial: true;
+    privacy_mode: import("../types.js").PrivacyMode;
+    mutations_enabled: boolean;
+    secret_env_vars: string[];
+    token_path: string;
+    redacts_by_default: string[];
+    tarball_excludes: string[];
+    never_pays_by_default: boolean;
+};

package/dist/services/audit.js

@@ -0,0 +1,15 @@
+import { peekConfig } from "./config.js";
+export function buildPrivacyAudit() {
+    const config = peekConfig();
+    return {
+        unofficial: true,
+        privacy_mode: config.privacyMode,
+        mutations_enabled: config.allowMutations,
+        secret_env_vars: ["RAPPI_ACCESS_TOKEN"],
+        token_path: config.tokenPath,
+        redacts_by_default: ["street", "address", "phone", "email", "last_four"],
+        tarball_excludes: [".rappi-mcp/", ".env", "tokens.json"],
+        never_pays_by_default: true
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/services/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/services/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO;QACL,UAAU,EAAE,IAAa;QACzB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,iBAAiB,EAAE,MAAM,CAAC,cAAc;QACxC,eAAe,EAAE,CAAC,oBAAoB,CAAC;QACvC,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,kBAAkB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC;QACxE,gBAAgB,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,CAAC;QACxD,qBAAqB,EAAE,IAAI;KAC5B,CAAC;AACJ,CAAC"}