sipgate-mcp 0.1.0 → 0.3.0

package/dist/config.js

@@ -1,9 +1,23 @@
-export function loadConfig(env = process.env) {
-    const tokenId = env.SIPGATE_TOKEN_ID;
-    const token = env.SIPGATE_TOKEN;
+import { loadStoredCredentials, } from "./credentials.js";
+export function loadConfig(env = process.env, storedCredentialLoader = loadStoredCredentials) {
+    const hasEnvironmentCredential = Boolean(env.SIPGATE_TOKEN_ID || env.SIPGATE_TOKEN);
+    const storedCredentials = hasEnvironmentCredential
+        ? undefined
+        : storedCredentialLoader();
+    const tokenId = env.SIPGATE_TOKEN_ID ?? storedCredentials?.tokenId;
+    const token = env.SIPGATE_TOKEN ?? storedCredentials?.token;
     if (!tokenId || !token) {
-        throw new Error("Both SIPGATE_TOKEN_ID and SIPGATE_TOKEN must be set.");
+        throw new Error("Credentials are missing. Run 'sipgate-mcp setup' or set both SIPGATE_TOKEN_ID and SIPGATE_TOKEN.");
     }
-    return { tokenId, token, readonly: env.SIPGATE_MCP_READONLY === "1" };
+    const accessScope = env.SIPGATE_MCP_SCOPE ?? "user";
+    if (accessScope !== "user" && accessScope !== "account") {
+        throw new Error("SIPGATE_MCP_SCOPE must be either 'user' or 'account'.");
+    }
+    return {
+        accessScope,
+        tokenId,
+        token,
+        readonly: env.SIPGATE_MCP_READONLY === "1",
+    };
 }
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,UAAU,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC;IAChC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,oBAAoB,KAAK,GAAG,EAAE,CAAC;AACxE,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EACL,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAS1B,MAAM,UAAU,UAAU,CACxB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,sBAAsB,GAAyC,qBAAqB;IAEpF,MAAM,wBAAwB,GAAG,OAAO,CACtC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,aAAa,CAC1C,CAAC;IACF,MAAM,iBAAiB,GAAG,wBAAwB;QAChD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,sBAAsB,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,gBAAgB,IAAI,iBAAiB,EAAE,OAAO,CAAC;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,IAAI,iBAAiB,EAAE,KAAK,CAAC;IAC5D,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,kGAAkG,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC;IACpD,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO;QACL,WAAW;QACX,OAAO;QACP,KAAK;QACL,QAAQ,EAAE,GAAG,CAAC,oBAAoB,KAAK,GAAG;KAC3C,CAAC;AACJ,CAAC"}

package/dist/credentials.d.ts

@@ -0,0 +1,13 @@
+export interface SipgateCredentials {
+    tokenId: string;
+    token: string;
+}
+export declare const MACOS_KEYCHAIN_SERVICE = "sipgate-mcp";
+export declare const MACOS_KEYCHAIN_TOKEN_ID_ACCOUNT = "pat-token-id";
+export declare const MACOS_KEYCHAIN_TOKEN_ACCOUNT = "pat-token";
+type KeychainReader = (account: string) => string;
+type KeychainWriter = (account: string) => void;
+export declare function loadStoredCredentials(platform?: NodeJS.Platform, readKeychain?: KeychainReader): SipgateCredentials | undefined;
+export declare function storeCredentialsInteractively(platform?: NodeJS.Platform, writeKeychain?: KeychainWriter, output?: Pick<NodeJS.WriteStream, "write">): void;
+export {};
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AACpD,eAAO,MAAM,+BAA+B,iBAAiB,CAAC;AAC9D,eAAO,MAAM,4BAA4B,cAAc,CAAC;AAExD,KAAK,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;AAClD,KAAK,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;AAwChD,wBAAgB,qBAAqB,CACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,YAAY,GAAE,cAAsC,GACnD,kBAAkB,GAAG,SAAS,CAehC;AAED,wBAAgB,6BAA6B,CAC3C,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,aAAa,GAAE,cAAsC,EACrD,MAAM,GAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAkB,GACzD,IAAI,CAWN"}

package/dist/credentials.js

@@ -0,0 +1,57 @@
+import { execFileSync, spawnSync } from "node:child_process";
+export const MACOS_KEYCHAIN_SERVICE = "sipgate-mcp";
+export const MACOS_KEYCHAIN_TOKEN_ID_ACCOUNT = "pat-token-id";
+export const MACOS_KEYCHAIN_TOKEN_ACCOUNT = "pat-token";
+function defaultKeychainReader(account) {
+    return execFileSync("/usr/bin/security", [
+        "find-generic-password",
+        "-s",
+        MACOS_KEYCHAIN_SERVICE,
+        "-a",
+        account,
+        "-w",
+    ], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+}
+function defaultKeychainWriter(account) {
+    const result = spawnSync("/usr/bin/security", [
+        "add-generic-password",
+        "-a",
+        account,
+        "-s",
+        MACOS_KEYCHAIN_SERVICE,
+        "-U",
+        "-w",
+    ], { stdio: "inherit" });
+    if (result.error || result.status !== 0) {
+        throw new Error("macOS Keychain did not store the credential.");
+    }
+}
+export function loadStoredCredentials(platform = process.platform, readKeychain = defaultKeychainReader) {
+    if (platform !== "darwin") {
+        return undefined;
+    }
+    try {
+        const tokenId = readKeychain(MACOS_KEYCHAIN_TOKEN_ID_ACCOUNT).trim();
+        const token = readKeychain(MACOS_KEYCHAIN_TOKEN_ACCOUNT).trim();
+        if (!tokenId || !token) {
+            return undefined;
+        }
+        return { tokenId, token };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function storeCredentialsInteractively(platform = process.platform, writeKeychain = defaultKeychainWriter, output = process.stderr) {
+    if (platform !== "darwin") {
+        throw new Error("Secure interactive setup currently supports macOS Keychain only. Use SIPGATE_TOKEN_ID and SIPGATE_TOKEN on this platform.");
+    }
+    output.write("Enter the sipgate PAT token ID in the macOS Keychain prompt.\n");
+    writeKeychain(MACOS_KEYCHAIN_TOKEN_ID_ACCOUNT);
+    output.write("Enter the sipgate PAT token in the macOS Keychain prompt.\n");
+    writeKeychain(MACOS_KEYCHAIN_TOKEN_ACCOUNT);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAO7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,aAAa,CAAC;AACpD,MAAM,CAAC,MAAM,+BAA+B,GAAG,cAAc,CAAC;AAC9D,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AAKxD,SAAS,qBAAqB,CAAC,OAAe;IAC5C,OAAO,YAAY,CACjB,mBAAmB,EACnB;QACE,uBAAuB;QACvB,IAAI;QACJ,sBAAsB;QACtB,IAAI;QACJ,OAAO;QACP,IAAI;KACL,EACD;QACE,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;KACpC,CACF,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,MAAM,GAAG,SAAS,CACtB,mBAAmB,EACnB;QACE,sBAAsB;QACtB,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,sBAAsB;QACtB,IAAI;QACJ,IAAI;KACL,EACD,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAC5C,YAAY,GAAmB,qBAAqB;IAEpD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,MAAM,KAAK,GAAG,YAAY,CAAC,4BAA4B,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAC5C,aAAa,GAAmB,qBAAqB,EACrD,MAAM,GAAsC,OAAO,CAAC,MAAM;IAE1D,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC/E,aAAa,CAAC,+BAA+B,CAAC,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC5E,aAAa,CAAC,4BAA4B,CAAC,CAAC;AAC9C,CAAC"}

package/dist/index.d.ts

@@ -1,9 +1,14 @@
 #!/usr/bin/env node
 export declare function main(): Promise<void>;
+export declare function runCli(args?: string[]): Promise<void>;
 export declare function isMainModule(moduleUrl: string, entrypoint: string | undefined): boolean;
 export { SipgateBackend } from "./backend/sipgate-backend.js";
+export { AccessPolicyError, createAccessControlledBackend, } from "./backend/access-controlled-backend.js";
 export { SipgateApiError, SipgateClient } from "./backend/sipgate-client.js";
-export type { TelephonyBackend } from "./backend/telephony-backend.js";
+export type { AccessScope, AuthenticatedUserContext, TelephonyBackend, } from "./backend/telephony-backend.js";
 export { createServer } from "./server.js";
+export { loadStoredCredentials, storeCredentialsInteractively, } from "./credentials.js";
+export { buildRegistrationCommand, parseSetupArgs, runSetup } from "./setup.js";
 export { createToolDefinitions } from "./tools/definitions.js";
+export { VERSION } from "./version.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AASA,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1C;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUvF;AASD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC7E,YAAY,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAeA,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAO1C;AAED,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBlF;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUvF;AAaD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC7E,YAAY,EACV,WAAW,EACX,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -2,17 +2,44 @@
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { AccessPolicyError, createAccessControlledBackend, } from "./backend/access-controlled-backend.js";
 import { SipgateBackend } from "./backend/sipgate-backend.js";
 import { SipgateClient } from "./backend/sipgate-client.js";
 import { loadConfig } from "./config.js";
 import { createServer } from "./server.js";
+import { runSetup, SETUP_HELP, SetupError } from "./setup.js";
+import { VERSION } from "./version.js";
 export async function main() {
     const config = loadConfig();
     const client = new SipgateClient({ tokenId: config.tokenId, token: config.token });
-    const backend = new SipgateBackend(client);
-    const server = createServer(backend, config.readonly);
+    const sipgateBackend = new SipgateBackend(client);
+    const backend = await createAccessControlledBackend(sipgateBackend, config.accessScope);
+    const server = createServer(backend, config.readonly, config.accessScope);
     await server.connect(new StdioServerTransport());
 }
+export async function runCli(args = process.argv.slice(2)) {
+    const command = args[0];
+    if (command === "setup") {
+        if (args[1] === "--help" || args[1] === "-h") {
+            process.stdout.write(SETUP_HELP);
+            return;
+        }
+        runSetup(args.slice(1));
+        return;
+    }
+    if (command === "--help" || command === "-h" || command === "help") {
+        process.stdout.write(SETUP_HELP);
+        return;
+    }
+    if (command === "--version" || command === "-V" || command === "version") {
+        process.stdout.write(`${VERSION}\n`);
+        return;
+    }
+    if (command) {
+        throw new SetupError(`Unknown command: ${command}`);
+    }
+    await main();
+}
 export function isMainModule(moduleUrl, entrypoint) {
     if (!entrypoint) {
         return false;
@@ -25,13 +52,20 @@ export function isMainModule(moduleUrl, entrypoint) {
     }
 }
 if (isMainModule(import.meta.url, process.argv[1])) {
-    main().catch(() => {
-        console.error("sipgate-mcp failed to start. Check the required environment variables and MCP client configuration.");
+    runCli().catch((error) => {
+        const detail = error instanceof AccessPolicyError || error instanceof SetupError
+            ? ` ${error.message}`
+            : "";
+        console.error(`sipgate-mcp failed.${detail} Check credentials and MCP client configuration.`);
         process.exitCode = 1;
     });
 }
 export { SipgateBackend } from "./backend/sipgate-backend.js";
+export { AccessPolicyError, createAccessControlledBackend, } from "./backend/access-controlled-backend.js";
 export { SipgateApiError, SipgateClient } from "./backend/sipgate-client.js";
 export { createServer } from "./server.js";
+export { loadStoredCredentials, storeCredentialsInteractively, } from "./credentials.js";
+export { buildRegistrationCommand, parseSetupArgs, runSetup } from "./setup.js";
 export { createToolDefinitions } from "./tools/definitions.js";
+export { VERSION } from "./version.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,UAA8B;IAC5E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,KAAK,YAAY,CAAC,UAAU,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QAChB,OAAO,CAAC,KAAK,CAAC,qGAAqG,CAAC,CAAC;QACrH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE7E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACnF,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAI,GAAa,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,UAA8B;IAC5E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,KAAK,YAAY,CAAC,UAAU,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAChC,MAAM,MAAM,GACV,KAAK,YAAY,iBAAiB,IAAI,KAAK,YAAY,UAAU;YAC/D,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE;YACrB,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,sBAAsB,MAAM,kDAAkD,CAAC,CAAC;QAC9F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAM7E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC"}

package/dist/server.d.ts

@@ -1,4 +1,4 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import type { TelephonyBackend } from "./backend/telephony-backend.js";
-export declare function createServer(backend: TelephonyBackend, readonly?: boolean): Server;
+import type { AccessScope, TelephonyBackend } from "./backend/telephony-backend.js";
+export declare function createServer(backend: TelephonyBackend, readonly?: boolean, accessScope?: AccessScope): Server;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAOnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAuBvE,wBAAgB,YAAY,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,UAAQ,GAAG,MAAM,CAuChF"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAOnE,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAuBpF,wBAAgB,YAAY,CAC1B,OAAO,EAAE,gBAAgB,EACzB,QAAQ,UAAQ,EAChB,WAAW,GAAE,WAAoB,GAChC,MAAM,CA4CR"}

package/dist/server.js

@@ -20,10 +20,15 @@ function jsonSchemaFor(schema) {
     const { $schema: _ignored, ...inputSchema } = generated;
     return inputSchema;
 }
-export function createServer(backend, readonly = false) {
-    const definitions = createToolDefinitions(backend, readonly);
+export function createServer(backend, readonly = false, accessScope = "user") {
+    const definitions = createToolDefinitions(backend, readonly, accessScope);
     const byName = new Map(definitions.map((definition) => [definition.name, definition]));
-    const server = new Server({ name: "sipgate-mcp", version: "0.1.0" }, { capabilities: { tools: {} } });
+    const server = new Server({ name: "sipgate-mcp", version: "0.2.0" }, {
+        capabilities: { tools: {} },
+        instructions: accessScope === "user"
+            ? `This sipgate MCP is restricted to the authenticated user's resources. ${readonly ? "It is read-only and cannot change the account." : "It may change that user's telephony settings or initiate chargeable actions when explicitly requested."} Never request or infer another user's ID.`
+            : `This sipgate MCP has account scope and the authenticated sipgate user was verified as an administrator. ${readonly ? "It is read-only and cannot change the account." : "It may change account-wide telephony settings or initiate chargeable actions when explicitly requested."}`,
+    });
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
         tools: definitions.map((definition) => ({
             name: definition.name,

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,OAAO,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,4CAA4C,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,MAA0C;IAC/D,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,GAAG,SAAS,CAAC;IACxD,OAAO,WAAkC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAyB,EAAE,QAAQ,GAAG,KAAK;IACtE,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EACzC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,WAAW,EAAE,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC;YAClD,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;aAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACxE,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;aACtD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,OAAO,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,4CAA4C,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,MAA0C;IAC/D,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,GAAG,SAAS,CAAC;IACxD,OAAO,WAAkC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,OAAyB,EACzB,QAAQ,GAAG,KAAK,EAChB,WAAW,GAAgB,MAAM;IAEjC,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EACzC;QACE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3B,YAAY,EAAE,WAAW,KAAK,MAAM;YAClC,CAAC,CAAC,yEAAyE,QAAQ,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,wGAAwG,4CAA4C;YAC7R,CAAC,CAAC,2GAA2G,QAAQ,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,yGAAyG,EAAE;KACzR,CACF,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,WAAW,EAAE,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC;YAClD,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;aAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACxE,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;aACtD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/setup.d.ts

@@ -0,0 +1,17 @@
+export type SetupClient = "codex" | "claude";
+export interface SetupOptions {
+    allowWrites: boolean;
+    clients: SetupClient[];
+    dryRun: boolean;
+}
+export interface ClientCommand {
+    command: string;
+    args: string[];
+}
+export declare class SetupError extends Error {
+}
+export declare function parseSetupArgs(args: string[]): SetupOptions;
+export declare function buildRegistrationCommand(client: SetupClient, nodeExecutable: string, entrypoint: string, allowWrites: boolean): ClientCommand;
+export declare function runSetup(args: string[], entrypointArgument?: string | undefined): void;
+export declare const SETUP_HELP = "Usage:\n  sipgate-mcp                    Start the MCP stdio server\n  sipgate-mcp setup [options]    Store credentials and register MCP clients\n  sipgate-mcp --version          Print the installed version\n\nSetup options:\n  --client codex|claude          Register only this client (repeatable)\n  --allow-writes                 Register write tools; default is read-only\n  --dry-run                      Print registration commands without changing anything\n";
+//# sourceMappingURL=setup.d.ts.map

package/dist/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE7C,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAExC,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,CAkC3D;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,OAAO,GACnB,aAAa,CA2Cf;AAoBD,wBAAgB,QAAQ,CACtB,IAAI,EAAE,MAAM,EAAE,EACd,kBAAkB,GAAE,MAAM,GAAG,SAA2B,GACvD,IAAI,CA+DN;AAED,eAAO,MAAM,UAAU,qdAStB,CAAC"}

package/dist/setup.js

@@ -0,0 +1,152 @@
+import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+import { storeCredentialsInteractively } from "./credentials.js";
+export class SetupError extends Error {
+}
+export function parseSetupArgs(args) {
+    const clients = [];
+    let allowWrites = false;
+    let dryRun = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        if (argument === "--allow-writes") {
+            allowWrites = true;
+            continue;
+        }
+        if (argument === "--dry-run") {
+            dryRun = true;
+            continue;
+        }
+        if (argument === "--client") {
+            const client = args[index + 1];
+            if (client !== "codex" && client !== "claude") {
+                throw new SetupError("--client must be either 'codex' or 'claude'.");
+            }
+            if (!clients.includes(client)) {
+                clients.push(client);
+            }
+            index += 1;
+            continue;
+        }
+        throw new SetupError(`Unknown setup option: ${argument ?? ""}`);
+    }
+    return {
+        allowWrites,
+        clients: clients.length > 0 ? clients : ["codex", "claude"],
+        dryRun,
+    };
+}
+export function buildRegistrationCommand(client, nodeExecutable, entrypoint, allowWrites) {
+    const modeEnvironment = [
+        "SIPGATE_MCP_SCOPE=user",
+        `SIPGATE_MCP_READONLY=${allowWrites ? "0" : "1"}`,
+    ];
+    if (client === "codex") {
+        return {
+            command: "codex",
+            args: [
+                "mcp",
+                "add",
+                "sipgate",
+                "--env",
+                modeEnvironment[0],
+                "--env",
+                modeEnvironment[1],
+                "--",
+                nodeExecutable,
+                entrypoint,
+            ],
+        };
+    }
+    return {
+        command: "claude",
+        args: [
+            "mcp",
+            "add",
+            "--transport",
+            "stdio",
+            "--scope",
+            "user",
+            "--env",
+            modeEnvironment[0],
+            "--env",
+            modeEnvironment[1],
+            "sipgate",
+            "--",
+            nodeExecutable,
+            entrypoint,
+        ],
+    };
+}
+function isCommandAvailable(command) {
+    const result = spawnSync(command, ["--version"], { stdio: "ignore" });
+    return !result.error && result.status === 0;
+}
+function isAlreadyConfigured(client) {
+    const result = spawnSync(client, ["mcp", "get", "sipgate"], {
+        stdio: "ignore",
+    });
+    return !result.error && result.status === 0;
+}
+function shellDisplay(command) {
+    return [command.command, ...command.args]
+        .map((part) => (/^[A-Za-z0-9_./:=+-]+$/.test(part) ? part : JSON.stringify(part)))
+        .join(" ");
+}
+export function runSetup(args, entrypointArgument = process.argv[1]) {
+    const options = parseSetupArgs(args);
+    if (!entrypointArgument) {
+        throw new SetupError("Could not determine the sipgate-mcp entrypoint.");
+    }
+    const entrypoint = resolve(entrypointArgument);
+    const commands = options.clients.map((client) => ({
+        client,
+        registration: buildRegistrationCommand(client, process.execPath, entrypoint, options.allowWrites),
+    }));
+    if (options.dryRun) {
+        process.stdout.write("Dry run: no credentials or MCP configurations were changed.\n");
+        for (const { registration } of commands) {
+            process.stdout.write(`${shellDisplay(registration)}\n`);
+        }
+        return;
+    }
+    process.stderr.write("sipgate-mcp will store the PAT in macOS Keychain. Secret values are not written to MCP configuration or shell history.\n");
+    try {
+        storeCredentialsInteractively();
+    }
+    catch (error) {
+        const message = error instanceof Error
+            ? error.message
+            : "Secure credential storage failed.";
+        throw new SetupError(message);
+    }
+    for (const { client, registration } of commands) {
+        if (!isCommandAvailable(client)) {
+            process.stderr.write(`Skipping ${client}: command not found.\n`);
+            continue;
+        }
+        if (isAlreadyConfigured(client)) {
+            process.stderr.write(`Skipping ${client}: an MCP server named 'sipgate' is already configured. Remove it first to replace its launch command.\n`);
+            continue;
+        }
+        const result = spawnSync(registration.command, registration.args, {
+            stdio: "inherit",
+        });
+        if (result.error || result.status !== 0) {
+            throw new SetupError(`Could not register sipgate-mcp with ${client}.`);
+        }
+        process.stderr.write(`Registered sipgate-mcp with ${client} in user scope (${options.allowWrites ? "writes enabled" : "read-only"}).\n`);
+    }
+    process.stderr.write("Setup complete. Restart Codex or Claude, open /mcp, and ask it to list your sipgate numbers.\n");
+}
+export const SETUP_HELP = `Usage:
+  sipgate-mcp                    Start the MCP stdio server
+  sipgate-mcp setup [options]    Store credentials and register MCP clients
+  sipgate-mcp --version          Print the installed version
+
+Setup options:
+  --client codex|claude          Register only this client (repeatable)
+  --allow-writes                 Register write tools; default is read-only
+  --dry-run                      Print registration commands without changing anything
+`;
+//# sourceMappingURL=setup.js.map

package/dist/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAejE,MAAM,OAAO,UAAW,SAAQ,KAAK;CAAG;AAExC,MAAM,UAAU,cAAc,CAAC,IAAc;IAC3C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAClC,WAAW,GAAG,IAAI,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,UAAU,CAAC,8CAA8C,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,yBAAyB,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,WAAW;QACX,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC3D,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAmB,EACnB,cAAsB,EACtB,UAAkB,EAClB,WAAoB;IAEpB,MAAM,eAAe,GAAG;QACtB,wBAAwB;QACxB,wBAAwB,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;KAClD,CAAC;IAEF,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE;gBACJ,KAAK;gBACL,KAAK;gBACL,SAAS;gBACT,OAAO;gBACP,eAAe,CAAC,CAAC,CAAE;gBACnB,OAAO;gBACP,eAAe,CAAC,CAAC,CAAE;gBACnB,IAAI;gBACJ,cAAc;gBACd,UAAU;aACX;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE;YACJ,KAAK;YACL,KAAK;YACL,aAAa;YACb,OAAO;YACP,SAAS;YACT,MAAM;YACN,OAAO;YACP,eAAe,CAAC,CAAC,CAAE;YACnB,OAAO;YACP,eAAe,CAAC,CAAC,CAAE;YACnB,SAAS;YACT,IAAI;YACJ,cAAc;YACd,UAAU;SACX;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtE,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAmB;IAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE;QAC1D,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,OAAsB;IAC1C,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;SACtC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;SACjF,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,IAAc,EACd,kBAAkB,GAAuB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAExD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAAC,iDAAiD,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM;QACN,YAAY,EAAE,wBAAwB,CACpC,MAAM,EACN,OAAO,CAAC,QAAQ,EAChB,UAAU,EACV,OAAO,CAAC,WAAW,CACpB;KACF,CAAC,CAAC,CAAC;IAEJ,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACtF,KAAK,MAAM,EAAE,YAAY,EAAE,IAAI,QAAQ,EAAE,CAAC;YACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0HAA0H,CAC3H,CAAC;IACF,IAAI,CAAC;QACH,6BAA6B,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK;YACpC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,mCAAmC,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,QAAQ,EAAE,CAAC;QAChD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,wBAAwB,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,MAAM,yGAAyG,CAC5H,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE;YAChE,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,UAAU,CAAC,uCAAuC,MAAM,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,MAAM,mBAAmB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,MAAM,CACnH,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gGAAgG,CACjG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;CASzB,CAAC"}

package/dist/tools/definitions.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import type { JsonValue, TelephonyBackend } from "../backend/telephony-backend.js";
+import type { AccessScope, JsonValue, TelephonyBackend } from "../backend/telephony-backend.js";
 export interface ToolAnnotations {
     readOnlyHint: boolean;
     destructiveHint: boolean;
@@ -13,5 +13,5 @@ export interface ToolDefinition {
     annotations: ToolAnnotations;
     execute(input: unknown): Promise<JsonValue>;
 }
-export declare function createToolDefinitions(backend: TelephonyBackend, readonly?: boolean): ToolDefinition[];
+export declare function createToolDefinitions(backend: TelephonyBackend, readonly?: boolean, accessScope?: AccessScope): ToolDefinition[];
 //# sourceMappingURL=definitions.d.ts.map

package/dist/tools/definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/tools/definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnF,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,WAAW,EAAE,eAAe,CAAC;IAC7B,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC7C;AA2CD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,UAAQ,GACf,cAAc,EAAE,CAmKlB"}
+{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/tools/definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEhG,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,WAAW,EAAE,eAAe,CAAC;IAC7B,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC7C;AA2CD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,gBAAgB,EACzB,QAAQ,UAAQ,EAChB,WAAW,GAAE,WAAoB,GAChC,cAAc,EAAE,CAsMlB"}