@1claw/mcp 0.61.0 → 0.63.1

package/dist/core/session.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Per-session state for the MCP server: one cached `OneClawClient` per
+ * session (so the ocv_ → JWT exchange happens once, not once per tool
+ * call), plus the entitlement snapshot that decides which toolsets the
+ * session is offered.
+ *
+ * Hosted sessions can outlive the flags they were admitted with, so the
+ * snapshot carries `resolvedAt` and is refreshed on a TTL and on any 403
+ * from the vault (see `refreshEntitlementsIfStale`).
+ */
+import type { ClientConfig, AgentCredentials, AgentProfileResponse, AgentEntitlementsResponse } from "../client/core.js";
+import type { OneClawClient } from "../client/index.js";
+import { type Entitlements, type ToolsetId } from "../toolsets.js";
+export type SessionCredential = {
+    token: string;
+    vaultId: string;
+    runtimeId?: string;
+} | {
+    agentApiKey: string;
+    agentId?: string;
+    vaultId?: string;
+    runtimeId?: string;
+};
+export type SessionAuth = SessionCredential & {
+    entitlements: Entitlements;
+    toolsets: Set<ToolsetId>;
+    /** Raw `X-1Claw-Toolsets` / `ONECLAW_MCP_TOOLSETS` value, if any. */
+    toolsetOverride?: string;
+    /** When `entitlements` was last resolved (ms since epoch). */
+    resolvedAt: number;
+};
+export declare const ENTITLEMENT_TTL_MS: number;
+/** Constructs the vault client for a credential. Installed by the entrypoint. */
+export type ClientFactory = (config: ClientConfig | AgentCredentials) => OneClawClient;
+/**
+ * The entrypoint says which client class sessions get: the full facade for
+ * the umbrella server, a narrower one for a split package. This module
+ * deliberately does not import a facade so it pulls no domain code in.
+ */
+export declare function installClientFactory(factory: ClientFactory): void;
+/** Build (once) and return the client for a session. */
+export declare function clientForSession(session: SessionCredential, baseUrl: string): OneClawClient;
+/** Test hook: drop the cached client for a session. */
+export declare function forgetSessionClient(session: object): void;
+/** Fold a `/v1/agents/{id}` profile into an entitlement snapshot. */
+export declare function entitlementsFromProfile(p: AgentProfileResponse, base?: Partial<Entitlements>): Entitlements;
+/** Fold the token exchange's `entitlements` (vault ≥ 0.61.17) into a snapshot. */
+export declare function entitlementsFromExchange(r: AgentEntitlementsResponse, base?: Partial<Entitlements>): Entitlements;
+/** Fold signed JWT claims into a snapshot. Flags the JWT does not carry stay off. */
+export declare function entitlementsFromClaims(claims: Record<string, unknown>): Entitlements;
+export interface ResolveOptions {
+    /** Called with a human-readable reason whenever the lookup is less than "full". */
+    warn?: (msg: string) => void;
+    /** Test seam: override the profile fetch. */
+    fetchProfile?: (client: OneClawClient, agentId: string) => Promise<AgentProfileResponse>;
+}
+/**
+ * Resolve what this session is entitled to. Order of trust:
+ *   1. the signed JWT (always available once the client can authenticate)
+ *   2. the agent profile (`GET /v1/agents/{id}`) for flags the JWT omits
+ * Anything that cannot be confirmed is left off — a degraded lookup only
+ * ever *narrows* the toolset.
+ */
+export declare function resolveEntitlements(client: OneClawClient, opts?: ResolveOptions): Promise<Entitlements>;
+/** Attach a freshly resolved snapshot + toolset selection to a credential. */
+export declare function attachEntitlements(credential: SessionCredential, entitlements: Entitlements, toolsetOverride?: string, now?: number): SessionAuth;
+/**
+ * Re-resolve the session's entitlements when the snapshot is older than the
+ * TTL (or `force`), mutating the session in place. Returns true when the
+ * visible toolset changed — the caller then tells the client via
+ * `notifications/tools/list_changed`.
+ */
+export declare function refreshEntitlementsIfStale(session: SessionAuth, client: OneClawClient, opts?: ResolveOptions & {
+    force?: boolean;
+    now?: number;
+}): Promise<boolean>;
+/** One-line summary for logs: what the session was offered and why. */
+export declare function describeSession(session: SessionAuth): string;
+//# sourceMappingURL=session.d.ts.map

package/dist/core/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/core/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EACR,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACH,KAAK,YAAY,EACjB,KAAK,SAAS,EAMjB,MAAM,gBAAgB,CAAC;AAExB,MAAM,MAAM,iBAAiB,GACvB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG;IAC1C,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AAIjD,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,KAAK,aAAa,CAAC;AAIvF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAEjE;AAED,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAuB3F;AAED,uDAAuD;AACvD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEzD;AAgBD,qEAAqE;AACrE,wBAAgB,uBAAuB,CACnC,CAAC,EAAE,oBAAoB,EACvB,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GACjC,YAAY,CAad;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CACpC,CAAC,EAAE,yBAAyB,EAC5B,IAAI,GAAE,OAAO,CAAC,YAAY,CAAM,GACjC,YAAY,CAed;AAED,qFAAqF;AACrF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,CAapF;AAED,MAAM,WAAW,cAAc;IAC3B,mFAAmF;IACnF,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC5F;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACrC,MAAM,EAAE,aAAa,EACrB,IAAI,GAAE,cAAmB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAyCvB;AAMD,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAC9B,UAAU,EAAE,iBAAiB,EAC7B,YAAY,EAAE,YAAY,EAC1B,eAAe,CAAC,EAAE,MAAM,EACxB,GAAG,SAAa,GACjB,WAAW,CAOb;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,aAAa,EACrB,IAAI,GAAE,cAAc,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9D,OAAO,CAAC,OAAO,CAAC,CAelB;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAQ5D"}

package/dist/core/session.js

@@ -0,0 +1,205 @@
+/**
+ * Per-session state for the MCP server: one cached `OneClawClient` per
+ * session (so the ocv_ → JWT exchange happens once, not once per tool
+ * call), plus the entitlement snapshot that decides which toolsets the
+ * session is offered.
+ *
+ * Hosted sessions can outlive the flags they were admitted with, so the
+ * snapshot carries `resolvedAt` and is refreshed on a TTL and on any 403
+ * from the vault (see `refreshEntitlementsIfStale`).
+ */
+import { OneClawApiError } from "../client/error.js";
+import { resolveToolsets, unknownEntitlements, describeToolsets, visibleToolNames, } from "../toolsets.js";
+export const ENTITLEMENT_TTL_MS = 15 * 60 * 1000;
+const clients = new WeakMap();
+let createClient;
+/**
+ * The entrypoint says which client class sessions get: the full facade for
+ * the umbrella server, a narrower one for a split package. This module
+ * deliberately does not import a facade so it pulls no domain code in.
+ */
+export function installClientFactory(factory) {
+    createClient = factory;
+}
+/** Build (once) and return the client for a session. */
+export function clientForSession(session, baseUrl) {
+    const cached = clients.get(session);
+    if (cached)
+        return cached;
+    if (!createClient) {
+        throw new Error("installClientFactory() must run before any session is admitted");
+    }
+    const client = "agentApiKey" in session
+        ? createClient({
+            baseUrl,
+            agentId: session.agentId,
+            apiKey: session.agentApiKey,
+            vaultId: session.vaultId,
+            runtimeId: session.runtimeId,
+        })
+        : createClient({
+            baseUrl,
+            token: session.token,
+            vaultId: session.vaultId,
+            runtimeId: session.runtimeId,
+        });
+    clients.set(session, client);
+    return client;
+}
+/** Test hook: drop the cached client for a session. */
+export function forgetSessionClient(session) {
+    clients.delete(session);
+}
+function principalOf(sub) {
+    if (typeof sub !== "string")
+        return "unknown";
+    if (sub.startsWith("agent:"))
+        return "agent";
+    if (sub.startsWith("user:"))
+        return "user";
+    if (sub.startsWith("platform:"))
+        return "platform";
+    return "unknown";
+}
+function agentIdOf(sub) {
+    return typeof sub === "string" && sub.startsWith("agent:") ? sub.slice("agent:".length) : undefined;
+}
+const flag = (v) => v === true;
+/** Fold a `/v1/agents/{id}` profile into an entitlement snapshot. */
+export function entitlementsFromProfile(p, base = {}) {
+    return {
+        lookup: "full",
+        principal: "agent",
+        agentId: p.id ?? base.agentId,
+        intentsApi: flag(p.intents_api_enabled),
+        executionIntents: flag(p.execution_intents_enabled),
+        executionRequireTee: flag(p.execution_require_tee),
+        cards: flag(p.cards_enabled),
+        memory: flag(p.memory_enabled),
+        shroud: flag(p.shroud_enabled),
+        discoverable: flag(p.discoverable),
+    };
+}
+/** Fold the token exchange's `entitlements` (vault ≥ 0.61.17) into a snapshot. */
+export function entitlementsFromExchange(r, base = {}) {
+    return {
+        lookup: "full",
+        principal: "agent",
+        agentId: base.agentId,
+        intentsApi: flag(r.intents_api),
+        executionIntents: flag(r.execution_intents),
+        executionRequireTee: flag(r.execution_require_tee),
+        cards: flag(r.cards),
+        memory: flag(r.memory),
+        shroud: flag(r.shroud),
+        discoverable: flag(r.discoverable),
+        treasurySigner: flag(r.treasury_signer),
+        hasDelegations: flag(r.has_delegations),
+    };
+}
+/** Fold signed JWT claims into a snapshot. Flags the JWT does not carry stay off. */
+export function entitlementsFromClaims(claims) {
+    return {
+        lookup: "jwt_only",
+        principal: principalOf(claims.sub),
+        agentId: agentIdOf(claims.sub),
+        intentsApi: flag(claims.intents_api_enabled),
+        executionIntents: flag(claims.execution_intents_enabled),
+        executionRequireTee: flag(claims.execution_require_tee),
+        cards: false,
+        memory: false,
+        shroud: flag(claims.shroud_enabled),
+        discoverable: false,
+    };
+}
+/**
+ * Resolve what this session is entitled to. Order of trust:
+ *   1. the signed JWT (always available once the client can authenticate)
+ *   2. the agent profile (`GET /v1/agents/{id}`) for flags the JWT omits
+ * Anything that cannot be confirmed is left off — a degraded lookup only
+ * ever *narrows* the toolset.
+ */
+export async function resolveEntitlements(client, opts = {}) {
+    const warn = opts.warn ?? (() => { });
+    let claims;
+    try {
+        claims = await client.tokenClaims();
+    }
+    catch (err) {
+        warn(`entitlement lookup failed: could not obtain a token (${errMessage(err)})`);
+        return unknownEntitlements("failed");
+    }
+    if (!claims) {
+        warn("entitlement lookup failed: token has no readable claims");
+        return unknownEntitlements("failed");
+    }
+    const fromJwt = entitlementsFromClaims(claims);
+    if (fromJwt.principal !== "agent" || !fromJwt.agentId) {
+        // Users and platforms have no agent profile; the JWT is all there is.
+        return fromJwt;
+    }
+    // Newer vaults answer everything on the exchange itself — no extra call.
+    try {
+        const fromExchange = await client.tokenEntitlements();
+        if (fromExchange)
+            return entitlementsFromExchange(fromExchange, fromJwt);
+    }
+    catch {
+        /* fall through to the profile GET */
+    }
+    const fetchProfile = opts.fetchProfile ?? ((c, id) => c.getAgent(id));
+    try {
+        const profile = await fetchProfile(client, fromJwt.agentId);
+        return entitlementsFromProfile(profile, fromJwt);
+    }
+    catch (err) {
+        const status = err instanceof OneClawApiError ? err.status : undefined;
+        warn(`entitlement lookup degraded to jwt_only: GET /v1/agents/${fromJwt.agentId} ` +
+            `${status ? `→ HTTP ${status}` : `failed (${errMessage(err)})`}; ` +
+            `cards/memory/directory toolsets withheld`);
+        return fromJwt;
+    }
+}
+function errMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/** Attach a freshly resolved snapshot + toolset selection to a credential. */
+export function attachEntitlements(credential, entitlements, toolsetOverride, now = Date.now()) {
+    const session = credential;
+    session.entitlements = entitlements;
+    session.toolsetOverride = toolsetOverride;
+    session.toolsets = resolveToolsets(entitlements, toolsetOverride);
+    session.resolvedAt = now;
+    return session;
+}
+/**
+ * Re-resolve the session's entitlements when the snapshot is older than the
+ * TTL (or `force`), mutating the session in place. Returns true when the
+ * visible toolset changed — the caller then tells the client via
+ * `notifications/tools/list_changed`.
+ */
+export async function refreshEntitlementsIfStale(session, client, opts = {}) {
+    const now = opts.now ?? Date.now();
+    if (!opts.force && now - session.resolvedAt < ENTITLEMENT_TTL_MS)
+        return false;
+    const fresh = await resolveEntitlements(client, opts);
+    // Never let a transient failure downgrade a snapshot we already trust
+    // more than the failure tells us — a "failed" refresh keeps the old
+    // flags but still counts as resolved so we don't hammer the vault.
+    const next = fresh.lookup === "failed" && session.entitlements.lookup !== "failed"
+        ? session.entitlements
+        : fresh;
+    const before = visibleToolNames(session.toolsets, session.entitlements);
+    attachEntitlements(session, next, session.toolsetOverride, now);
+    const after = visibleToolNames(session.toolsets, session.entitlements);
+    return before.length !== after.length || before.some((n, i) => n !== after[i]);
+}
+/** One-line summary for logs: what the session was offered and why. */
+export function describeSession(session) {
+    const e = session.entitlements;
+    return (`toolsets=${describeToolsets(session.toolsets)} lookup=${e.lookup} principal=${e.principal}` +
+        (e.agentId ? ` agent=${e.agentId}` : "") +
+        (e.executionRequireTee ? " execution_require_tee" : "") +
+        (session.toolsetOverride ? ` override=${session.toolsetOverride}` : ""));
+}
+//# sourceMappingURL=session.js.map

package/dist/core/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/core/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAQrD,OAAO,EAIH,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACnB,MAAM,gBAAgB,CAAC;AAexB,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAyB,CAAC;AAKrD,IAAI,YAAuC,CAAC;AAE5C;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACvD,YAAY,GAAG,OAAO,CAAC;AAC3B,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,OAA0B,EAAE,OAAe;IACxE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC,YAAY,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,MAAM,GACR,aAAa,IAAI,OAAO;QACpB,CAAC,CAAC,YAAY,CAAC;YACT,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,WAAW;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC/B,CAAC;QACJ,CAAC,CAAC,YAAY,CAAC;YACT,OAAO;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC/B,CAAC,CAAC;IACb,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,mBAAmB,CAAC,OAAe;IAC/C,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3C,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,UAAU,CAAC;IACnD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC3B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxG,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;AAEjD,qEAAqE;AACrE,MAAM,UAAU,uBAAuB,CACnC,CAAuB,EACvB,OAA8B,EAAE;IAEhC,OAAO;QACH,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO;QAC7B,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC;QACvC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACnD,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAClD,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;QAC5B,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;QAC9B,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;QAC9B,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;KACrC,CAAC;AACN,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CACpC,CAA4B,EAC5B,OAA8B,EAAE;IAEhC,OAAO;QACH,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,OAAO;QAClB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/B,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC3C,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAClD,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACtB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;QAClC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;QACvC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;KAC1C,CAAC;AACN,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,sBAAsB,CAAC,MAA+B;IAClE,OAAO;QACH,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC;QAClC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;QAC9B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAC5C,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC;QACxD,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;QACvD,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QACnC,YAAY,EAAE,KAAK;KACtB,CAAC;AACN,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,MAAqB,EACrB,OAAuB,EAAE;IAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,IAAI,MAA2C,CAAC;IAChD,IAAI,CAAC;QACD,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,CAAC,wDAAwD,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjF,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,IAAI,CAAC,yDAAyD,CAAC,CAAC;QAChE,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACpD,sEAAsE;QACtE,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,IAAI,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACtD,IAAI,YAAY;YAAE,OAAO,wBAAwB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACL,qCAAqC;IACzC,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,GAAG,YAAY,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,CACA,2DAA2D,OAAO,CAAC,OAAO,GAAG;YACzE,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI;YAClE,0CAA0C,CACjD,CAAC;QACF,OAAO,OAAO,CAAC;IACnB,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC5B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAC9B,UAA6B,EAC7B,YAA0B,EAC1B,eAAwB,EACxB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,OAAO,GAAG,UAAyB,CAAC;IAC1C,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC;IACpC,OAAO,CAAC,eAAe,GAAG,eAAe,CAAC;IAC1C,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAClE,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC;IACzB,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC5C,OAAoB,EACpB,MAAqB,EACrB,OAA2D,EAAE;IAE7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,OAAO,CAAC,UAAU,GAAG,kBAAkB;QAAE,OAAO,KAAK,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtD,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,IAAI,GACN,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,QAAQ;QACjE,CAAC,CAAC,OAAO,CAAC,YAAY;QACtB,CAAC,CAAC,KAAK,CAAC;IAChB,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACxE,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,eAAe,CAAC,OAAoB;IAChD,MAAM,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;IAC/B,OAAO,CACH,YAAY,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,MAAM,cAAc,CAAC,CAAC,SAAS,EAAE;QAC5F,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1E,CAAC;AACN,CAAC"}

package/dist/index.d.ts

@@ -1,3 +1,7 @@
 #!/usr/bin/env node
-export {};
+/** Resolves once the server is listening. Also the handle the in-process test harness uses. */
+export declare const running: Promise<{
+    server: import("fastmcp").FastMCP<import("./core/session.js").SessionAuth>;
+}>;
+export declare const started: Promise<void>;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAaA,+FAA+F;AAC/F,eAAO,MAAM,OAAO;;EAKlB,CAAC;AACH,eAAO,MAAM,OAAO,EAAE,OAAO,CAAC,IAAI,CAAiC,CAAC"}