@2kw/ai 7.3.0-dev.1 → 7.3.0-dev.10

package/dist/commands/extractions.js

@@ -131,13 +131,32 @@ export function makeExtractionsCommand() {
     });
     cmd
         .command("rerun")
-        .description("Re-run an extraction")
-        .argument("<id>", "Extraction ID to rerun")
-        .action(async (id, _opts, command) => {
+        .description("Re-run one extraction, or queue a batch (several IDs, or a filter) of up to 100")
+        .argument("[ids...]", "Extraction IDs to rerun")
+        .option("--status <status>", "Rerun extractions with this status (e.g. FAILED)")
+        .option("--schema-version <id>", "Rerun extractions of this schema version")
+        .option("-s, --search <term>", "Rerun extractions whose model contains this text")
+        .action(async (ids, opts, command) => {
         await runAction(command, async () => {
             const client = getClient(command);
-            const { data } = await withSpinner("Re-running extraction...", () => client.POST("/v1/extractions/{id}/rerun", {
-                params: { path: { id } },
+            const filtered = Boolean(opts.status || opts.schemaVersion || opts.search);
+            if (ids.length === 1 && !filtered) {
+                const { data } = await withSpinner("Re-running extraction...", () => client.POST("/v1/extractions/{id}/rerun", {
+                    params: { path: { id: ids[0] } },
+                }));
+                formatDetail(data, command);
+                return;
+            }
+            if (ids.length === 0 && !filtered) {
+                throw new Error("Pass an extraction ID, several IDs, or a filter (--status, --schema-version, --search).");
+            }
+            if (ids.length > 0 && filtered) {
+                throw new Error("Pass extraction IDs or a filter, not both.");
+            }
+            const { data } = await withSpinner("Queueing re-runs...", () => client.POST("/v1/extractions/rerun", {
+                body: filtered
+                    ? { status: opts.status, schemaVersionId: opts.schemaVersion, search: opts.search }
+                    : { ids },
             }));
             formatDetail(data, command);
         });

package/dist/index.js

@@ -34,6 +34,7 @@ import { makeFilesCommand } from "./commands/files.js";
 import { makeInstallationsCommand } from "./commands/installations.js";
 import { makeConnectorsCommand } from "./commands/connectors.js";
 import { makeRelaysCommand } from "./commands/relays.js";
+import { makeBridgeCommand } from "./commands/bridge.js";
 import { checkForUpdates } from "./lib/update-notifier.js";
 const updater = checkForUpdates(pkg.version);
 const program = new Command();
@@ -75,6 +76,7 @@ program.addCommand(makeFilesCommand());
 program.addCommand(makeInstallationsCommand());
 program.addCommand(makeConnectorsCommand());
 program.addCommand(makeRelaysCommand());
+program.addCommand(makeBridgeCommand());
 program.addCommand(makeDocsCommand());
 program.parseAsync().then(() => updater.notify());
 //# sourceMappingURL=index.js.map

package/dist/lib/agent-run.js

@@ -174,7 +174,7 @@ function connectorApproval(i) {
 /**
  * Output item types the envelope decodes, or that never hold a run: text, reasoning and finished
  * connector calls. A pause on anything else is named.
- * `backbone:tool_image` is an image a finished `ViewImage` call attached (#1244): it never holds a run.
+ * `backbone:tool_image` is an image a finished `ViewImage` call or a connector call attached (#1244, #844): it never holds a run.
  */
 const DECODED_ITEM_TYPES = new Set([
     "message",

package/dist/relay-protocol/b64.d.ts

@@ -0,0 +1,13 @@
+/** base64url without padding (RFC 4648 §5), contract C1. */
+export declare function b64url(bytes: Uint8Array): string;
+/**
+ * Decodes the canonical unpadded base64url of contract C1 and nothing else. Node's decoder is
+ * lenient: it drops a dangling character that carries no whole byte ("A" gives no bytes) and
+ * ignores non-canonical trailing bits ("-_8", "-_9" and "-__" all give 0xfb 0xff). Re-encoding
+ * the result is what rejects those, so one byte string has exactly one accepted spelling.
+ */
+export declare function fromB64url(value: string): Buffer;
+export declare function sha256(data: Uint8Array | string): Buffer;
+export declare function sha256b64url(data: Uint8Array | string): string;
+export declare function randomHex(bytes: number): string;
+//# sourceMappingURL=b64.d.ts.map

package/dist/relay-protocol/b64.js

@@ -0,0 +1,34 @@
+// GENERATED COPY of relay/src/protocol/b64.ts (#1377). Do not edit here: edit the relay's file,
+// then run `npm run sync:relay-protocol` in cli/. `npm run check:relay-protocol` fails on any drift.
+import { createHash, randomBytes } from "node:crypto";
+const BASE64URL = /^[A-Za-z0-9_-]*$/;
+/** base64url without padding (RFC 4648 §5), contract C1. */
+export function b64url(bytes) {
+    return Buffer.from(bytes).toString("base64url");
+}
+/**
+ * Decodes the canonical unpadded base64url of contract C1 and nothing else. Node's decoder is
+ * lenient: it drops a dangling character that carries no whole byte ("A" gives no bytes) and
+ * ignores non-canonical trailing bits ("-_8", "-_9" and "-__" all give 0xfb 0xff). Re-encoding
+ * the result is what rejects those, so one byte string has exactly one accepted spelling.
+ */
+export function fromB64url(value) {
+    if (!BASE64URL.test(value)) {
+        throw new Error("invalid base64url");
+    }
+    const decoded = Buffer.from(value, "base64url");
+    if (b64url(decoded) !== value) {
+        throw new Error("invalid base64url");
+    }
+    return decoded;
+}
+export function sha256(data) {
+    return createHash("sha256").update(data).digest();
+}
+export function sha256b64url(data) {
+    return b64url(sha256(data));
+}
+export function randomHex(bytes) {
+    return randomBytes(bytes).toString("hex");
+}
+//# sourceMappingURL=b64.js.map

package/dist/relay-protocol/canonical-json.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Contract C10: keys sorted by code unit, arrays in order, no whitespace.
+ *
+ * The Java twin is CanonicalJson.java, and the two must agree byte for byte — `configHash` is
+ * computed on both sides, so a value the two platforms serialize differently would change the
+ * hash silently and every request assertion would then fail with no clue why. Where the
+ * platforms differ by default, the vectors in test/vectors/inventory.json pin this side's
+ * behaviour and test/vectors/README.md restates it: non-ASCII characters stay raw (never
+ * `\uXXXX`), control characters escape to lower-case `\u00xx` with the short forms for
+ * \b \f \n \r \t, `/` and DEL stay unescaped, and key order is UTF-16 code unit order
+ * (JavaScript `<`, Java `String.compareTo`), not UTF-8 byte order.
+ *
+ * Ruling C10-strict: everything outside that agreement is REFUSED rather than serialized.
+ * Fail closed — a `CanonicalJsonError` at the call site is a bug report; a hash that differs
+ * by platform is a support case nobody can diagnose.
+ */
+export declare class CanonicalJsonError extends Error {
+    readonly code = "unsupported_value";
+    constructor(message: string);
+}
+export declare function canonicalJson(value: unknown): string;
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/relay-protocol/canonical-json.js

@@ -0,0 +1,101 @@
+// GENERATED COPY of relay/src/protocol/canonical-json.ts (#1377). Do not edit here: edit the relay's file,
+// then run `npm run sync:relay-protocol` in cli/. `npm run check:relay-protocol` fails on any drift.
+/**
+ * Contract C10: keys sorted by code unit, arrays in order, no whitespace.
+ *
+ * The Java twin is CanonicalJson.java, and the two must agree byte for byte — `configHash` is
+ * computed on both sides, so a value the two platforms serialize differently would change the
+ * hash silently and every request assertion would then fail with no clue why. Where the
+ * platforms differ by default, the vectors in test/vectors/inventory.json pin this side's
+ * behaviour and test/vectors/README.md restates it: non-ASCII characters stay raw (never
+ * `\uXXXX`), control characters escape to lower-case `\u00xx` with the short forms for
+ * \b \f \n \r \t, `/` and DEL stay unescaped, and key order is UTF-16 code unit order
+ * (JavaScript `<`, Java `String.compareTo`), not UTF-8 byte order.
+ *
+ * Ruling C10-strict: everything outside that agreement is REFUSED rather than serialized.
+ * Fail closed — a `CanonicalJsonError` at the call site is a bug report; a hash that differs
+ * by platform is a support case nobody can diagnose.
+ */
+export class CanonicalJsonError extends Error {
+    code = "unsupported_value";
+    constructor(message) {
+        super(message);
+        this.name = "CanonicalJsonError";
+    }
+}
+/**
+ * A lone surrogate — a UTF-16 code unit with no partner. It is legal in a JavaScript string
+ * and reachable from legal JSON text (`"\ud800"`), but it has no UTF-8 encoding: JavaScript
+ * escapes it back, Java writes a replacement character or raises, and the two digests part
+ * company. Written as an explicit scan rather than a lookbehind regex so the Java twin can
+ * restate it line for line.
+ */
+function hasLoneSurrogate(text) {
+    for (let i = 0; i < text.length; i += 1) {
+        const unit = text.charCodeAt(i);
+        if (unit >= 0xd800 && unit <= 0xdbff) {
+            const next = i + 1 < text.length ? text.charCodeAt(i + 1) : 0;
+            if (next < 0xdc00 || next > 0xdfff) {
+                return true;
+            }
+            i += 1;
+        }
+        else if (unit >= 0xdc00 && unit <= 0xdfff) {
+            return true;
+        }
+    }
+    return false;
+}
+/** Only a plain object carries its data in its own enumerable properties; a Date or a Map does not. */
+function isPlainObject(value) {
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+function refuse(what) {
+    throw new CanonicalJsonError(`canonical JSON does not support ${what}`);
+}
+function encodeString(value, what) {
+    if (hasLoneSurrogate(value)) {
+        refuse(`a lone surrogate in ${what}`);
+    }
+    return JSON.stringify(value);
+}
+export function canonicalJson(value) {
+    if (Array.isArray(value)) {
+        // An array element has no "drop it" option the way a property does: dropping one would
+        // change the array's length, so an unrepresentable element is refused.
+        return `[${value.map((element) => canonicalJson(element)).join(",")}]`;
+    }
+    switch (typeof value) {
+        case "string":
+            return encodeString(value, "a string");
+        case "boolean":
+            return value ? "true" : "false";
+        case "number":
+            if (!Number.isSafeInteger(value) || Object.is(value, -0)) {
+                // JavaScript prints 1.0 as "1" and 1e21 as "1e+21"; Java's Double.toString gives
+                // "1.0" and "1.0E21". Only safe integers spell the same on both sides.
+                refuse(`the number ${String(value)}; only safe integers are portable`);
+            }
+            return String(value);
+        case "object": {
+            if (value === null) {
+                return "null";
+            }
+            if (!isPlainObject(value)) {
+                refuse(`${value.constructor?.name ?? "a non-plain object"}; use a plain object or an array`);
+            }
+            const entries = Object.entries(value)
+                // The brief drops an undefined property: an absent key and an undefined one mean the
+                // same thing in JSON, and dropping it changes nothing either side can observe.
+                .filter(([, v]) => v !== undefined)
+                .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+            return `{${entries.map(([k, v]) => `${encodeString(k, "a key")}:${canonicalJson(v)}`).join(",")}}`;
+        }
+        case "undefined":
+            return refuse("undefined outside an object property");
+        default:
+            return refuse(`a ${typeof value} value`);
+    }
+}
+//# sourceMappingURL=canonical-json.js.map

package/dist/relay-protocol/frames.d.ts

@@ -0,0 +1,75 @@
+import type { KeyObject } from "node:crypto";
+import type { HeaderPair } from "./wire.js";
+export type FrameType = "accepted" | "head" | "data" | "end" | "error";
+export type UnsignedFrame = {
+    seq: number;
+    type: "accepted";
+} | {
+    seq: number;
+    type: "head";
+    status: number;
+    headers: HeaderPair[];
+} | {
+    seq: number;
+    type: "data";
+    bytes: string;
+} | {
+    seq: number;
+    type: "end";
+} | {
+    seq: number;
+    type: "error";
+    code: string;
+    message: string;
+};
+export type Frame = UnsignedFrame & {
+    sig: string;
+};
+type Without<T, K extends keyof never> = T extends unknown ? Omit<T, K> : never;
+export type FrameFields = Without<UnsignedFrame, "seq">;
+export declare class FrameError extends Error {
+    readonly code = "response_invalid";
+    constructor(message: string);
+}
+/** UTF-16 code units, so `String.length` says the same thing on both sides of the wire. */
+export declare const MAX_FRAME_MESSAGE_LENGTH = 1024;
+export declare function isErrorFrameCode(code: string): boolean;
+export declare function isErrorFrameMessage(message: string): boolean;
+/**
+ * Makes a message built from untrusted text signable: control characters become spaces and the
+ * result is truncated. Every caller that interpolates something the hub or an upstream chose —
+ * a `srv` claim, a method, an upstream error string — runs it through this, because
+ * `FrameSigner.next` refuses the frame otherwise and the relay would answer nothing at all.
+ */
+export declare function sanitizeFrameMessage(message: string): string;
+/** Contract C7. */
+export declare function fieldsDigest(frame: UnsignedFrame): string;
+export declare function frameSigningInput(requestId: string, frame: UnsignedFrame, prev: string): string;
+export declare class FrameSigner {
+    private readonly key;
+    private readonly requestId;
+    private prev;
+    private seq;
+    constructor(key: KeyObject, requestId: string, jti: string);
+    get nextSeq(): number;
+    /**
+     * A `head`'s headers are signed as given: pass `filterHeaders(pairs, isReturnedResponseHeader)`
+     * output. An `error`'s code and message must already satisfy the injectivity rule — build the
+     * message with `sanitizeFrameMessage` when any part of it came from outside the relay — because
+     * the relay must never put a signature on a frame a hub could restate.
+     */
+    next(fields: FrameFields): Frame;
+}
+export declare function isFrameShape(raw: unknown): raw is Frame;
+export declare class FrameChainVerifier {
+    private readonly publicKey;
+    private readonly requestId;
+    private expectedSeq;
+    private prev;
+    private last;
+    private done;
+    constructor(publicKey: KeyObject, requestId: string, jti: string);
+    verify(raw: unknown): Frame;
+}
+export {};
+//# sourceMappingURL=frames.d.ts.map

package/dist/relay-protocol/frames.js

@@ -0,0 +1,224 @@
+import { b64url, fromB64url, sha256b64url } from "./b64.js";
+import { HeaderError, canonicalHeaders, filterHeaders, isReturnedResponseHeader } from "./headers.js";
+import { signBytes, verifyBytes } from "./keys.js";
+export class FrameError extends Error {
+    code = "response_invalid";
+    constructor(message) {
+        super(message);
+        this.name = "FrameError";
+    }
+}
+/**
+ * An `error` frame's digest is `code + "\n" + message`, so without a rule on the two fields the
+ * pair is not injective: `("upstream_incomplete", "a\nb")` and `("upstream_incomplete\na", "b")`
+ * hash the same and share one signature, which lets the untrusted hub (spec D14) restate either
+ * as the other. This is the rule C6 already applies to header values, in the one place C7 left
+ * open. The code is additionally constrained to a wire-code spelling because it ends up as a
+ * metric label and as a `McpRelayErrorCode` on the Java side; the message is bounded so a frame
+ * cannot carry a payload in a field nothing reads as one. `fieldsDigest` is unchanged: the rule
+ * lives in the shape gate, on the signer's side and the verifier's alike.
+ */
+const ERROR_CODE_SHAPE = /^[a-z][a-z0-9_]{0,63}$/;
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+/** UTF-16 code units, so `String.length` says the same thing on both sides of the wire. */
+export const MAX_FRAME_MESSAGE_LENGTH = 1024;
+export function isErrorFrameCode(code) {
+    return ERROR_CODE_SHAPE.test(code);
+}
+export function isErrorFrameMessage(message) {
+    return message.length <= MAX_FRAME_MESSAGE_LENGTH && !CONTROL_CHARACTERS.test(message);
+}
+/**
+ * Makes a message built from untrusted text signable: control characters become spaces and the
+ * result is truncated. Every caller that interpolates something the hub or an upstream chose —
+ * a `srv` claim, a method, an upstream error string — runs it through this, because
+ * `FrameSigner.next` refuses the frame otherwise and the relay would answer nothing at all.
+ */
+export function sanitizeFrameMessage(message) {
+    return message.replace(/[\u0000-\u001f\u007f]/g, " ").slice(0, MAX_FRAME_MESSAGE_LENGTH);
+}
+/** Contract C7. */
+export function fieldsDigest(frame) {
+    switch (frame.type) {
+        case "accepted":
+        case "end":
+            return sha256b64url(Buffer.alloc(0));
+        case "head":
+            return sha256b64url(`${frame.status}\n${canonicalHeaders(frame.headers, isReturnedResponseHeader)}`);
+        case "data":
+            return sha256b64url(fromB64url(frame.bytes));
+        case "error":
+            return sha256b64url(`${frame.code}\n${frame.message}`);
+    }
+}
+export function frameSigningInput(requestId, frame, prev) {
+    return `mcprelay-frame-v1\n${requestId}\n${frame.seq}\n${frame.type}\n${fieldsDigest(frame)}\n${prev}`;
+}
+export class FrameSigner {
+    key;
+    requestId;
+    prev;
+    seq = 0;
+    constructor(key, requestId, jti) {
+        this.key = key;
+        this.requestId = requestId;
+        this.prev = jti;
+    }
+    get nextSeq() {
+        return this.seq;
+    }
+    /**
+     * A `head`'s headers are signed as given: pass `filterHeaders(pairs, isReturnedResponseHeader)`
+     * output. An `error`'s code and message must already satisfy the injectivity rule — build the
+     * message with `sanitizeFrameMessage` when any part of it came from outside the relay — because
+     * the relay must never put a signature on a frame a hub could restate.
+     */
+    next(fields) {
+        const frame = { ...fields, seq: this.seq };
+        if (frame.type === "error") {
+            if (!isErrorFrameCode(frame.code)) {
+                throw new FrameError(`error frame code ${JSON.stringify(frame.code)} is not a wire code`);
+            }
+            if (!isErrorFrameMessage(frame.message)) {
+                throw new FrameError("error frame message carries a control character or exceeds 1024 characters");
+            }
+        }
+        const sig = b64url(signBytes(this.key, frameSigningInput(this.requestId, frame, this.prev)));
+        this.prev = sig;
+        this.seq += 1;
+        return { ...frame, sig };
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isHeaderPairs(value) {
+    return (Array.isArray(value) &&
+        value.every((pair) => Array.isArray(pair) && pair.length === 2 && typeof pair[0] === "string" && typeof pair[1] === "string"));
+}
+export function isFrameShape(raw) {
+    if (!isRecord(raw) || typeof raw.sig !== "string" || !Number.isInteger(raw.seq) || raw.seq < 0) {
+        return false;
+    }
+    switch (raw.type) {
+        case "accepted":
+        case "end":
+            return true;
+        case "head":
+            return Number.isInteger(raw.status) && isHeaderPairs(raw.headers);
+        case "data":
+            return typeof raw.bytes === "string";
+        case "error":
+            return (typeof raw.code === "string" &&
+                isErrorFrameCode(raw.code) &&
+                typeof raw.message === "string" &&
+                isErrorFrameMessage(raw.message));
+        default:
+            return false;
+    }
+}
+/**
+ * The signed fields of a frame and nothing else. `isFrameShape` tolerates extra properties — the
+ * hub is untrusted (spec D14) and may add any — and the digest covers only the enumerated ones,
+ * so a verified object must be rebuilt before it reaches a caller. Otherwise unsigned,
+ * attacker-chosen data rides inside an object the backend has just proved authentic. The header
+ * pairs are copied for the same reason: the arrays themselves are the hub's.
+ */
+function signedFieldsOnly(frame) {
+    switch (frame.type) {
+        case "accepted":
+            return { seq: frame.seq, type: "accepted", sig: frame.sig };
+        case "end":
+            return { seq: frame.seq, type: "end", sig: frame.sig };
+        case "head":
+            return {
+                seq: frame.seq,
+                type: "head",
+                status: frame.status,
+                headers: frame.headers.map(([name, value]) => [name, value]),
+                sig: frame.sig,
+            };
+        case "data":
+            return { seq: frame.seq, type: "data", bytes: frame.bytes, sig: frame.sig };
+        case "error":
+            return { seq: frame.seq, type: "error", code: frame.code, message: frame.message, sig: frame.sig };
+    }
+}
+/**
+ * A `head` carries the canonical returned headers of contract C6 as sorted pairs. The digest
+ * covers that canonical form, so a frame whose pairs are spelled differently would let the hub
+ * restate a signed head; a HeaderError (duplicate name, control character in a value) says the
+ * same thing — these pairs are not the canonical form — and is therefore a rejection here, not
+ * an exception out of the verifier.
+ */
+function isCanonicalHead(headers) {
+    try {
+        return JSON.stringify(filterHeaders(headers, isReturnedResponseHeader)) === JSON.stringify(headers);
+    }
+    catch (error) {
+        if (error instanceof HeaderError) {
+            return false;
+        }
+        throw error;
+    }
+}
+export class FrameChainVerifier {
+    publicKey;
+    requestId;
+    expectedSeq = 0;
+    prev;
+    last = null;
+    done = false;
+    constructor(publicKey, requestId, jti) {
+        this.publicKey = publicKey;
+        this.requestId = requestId;
+        this.prev = jti;
+    }
+    verify(raw) {
+        if (!isFrameShape(raw)) {
+            throw new FrameError("malformed frame");
+        }
+        if (raw.seq !== this.expectedSeq) {
+            throw new FrameError(`expected frame ${this.expectedSeq}, got ${raw.seq}`);
+        }
+        if (this.done) {
+            throw new FrameError("frame after a terminal frame");
+        }
+        const allowed = raw.seq === 0
+            ? raw.type === "accepted" || raw.type === "error"
+            : this.last === "accepted"
+                ? raw.type === "head" || raw.type === "error"
+                : raw.type === "data" || raw.type === "end" || raw.type === "error";
+        if (!allowed) {
+            throw new FrameError(`${raw.type} is not allowed at this point of the chain`);
+        }
+        if (raw.type === "head" && !isCanonicalHead(raw.headers)) {
+            throw new FrameError("head headers are not canonical");
+        }
+        let signature;
+        try {
+            signature = fromB64url(raw.sig);
+        }
+        catch {
+            throw new FrameError("malformed signature");
+        }
+        let signingInput;
+        try {
+            signingInput = frameSigningInput(this.requestId, raw, this.prev);
+        }
+        catch {
+            // A `data` payload that is not canonical base64url (contract C1) lands here: the hub is
+            // untrusted for integrity (spec D14), so its input is rejected, never thrown past us.
+            throw new FrameError("malformed frame fields");
+        }
+        if (!verifyBytes(this.publicKey, signingInput, signature)) {
+            throw new FrameError("frame signature does not verify");
+        }
+        this.prev = raw.sig;
+        this.expectedSeq += 1;
+        this.last = raw.type;
+        this.done = raw.type === "end" || raw.type === "error";
+        return signedFieldsOnly(raw);
+    }
+}
+//# sourceMappingURL=frames.js.map

package/dist/relay-protocol/headers.d.ts

@@ -0,0 +1,18 @@
+import type { HeaderPair } from "./wire.js";
+export type HeaderErrorCode = "duplicate_header" | "invalid_header";
+export declare class HeaderError extends Error {
+    readonly code: HeaderErrorCode;
+    constructor(code: HeaderErrorCode, message: string);
+}
+export declare function isForwardedRequestHeader(name: string): boolean;
+export declare function isReturnedResponseHeader(name: string): boolean;
+/**
+ * Contract C6: lower-case, keep allowed, refuse control characters and non-token names,
+ * trim, refuse duplicates, sort by name. A header that is not on the allowlist is ignored
+ * without being validated — it never reaches the digest.
+ */
+export declare function filterHeaders(pairs: Iterable<readonly [string, string]>, allowed: (name: string) => boolean): HeaderPair[];
+export declare function canonicalHeaders(pairs: Iterable<readonly [string, string]>, allowed: (name: string) => boolean): string;
+export declare function requestHeadersDigest(pairs: Iterable<readonly [string, string]>): string;
+export declare function bodyDigest(body: Uint8Array): string;
+//# sourceMappingURL=headers.d.ts.map

package/dist/relay-protocol/headers.js

@@ -0,0 +1,88 @@
+// GENERATED COPY of relay/src/protocol/headers.ts (#1377). Do not edit here: edit the relay's file,
+// then run `npm run sync:relay-protocol` in cli/. `npm run check:relay-protocol` fails on any drift.
+import { sha256b64url } from "./b64.js";
+const FORWARDED_REQUEST_HEADERS = new Set([
+    "accept",
+    "authorization",
+    "content-type",
+    "idempotency-key",
+    "last-event-id",
+    "mcp-method",
+    "mcp-name",
+    "mcp-protocol-version",
+    "mcp-session-id",
+    "traceparent",
+    "tracestate",
+]);
+const RETURNED_RESPONSE_HEADERS = new Set([
+    "cache-control",
+    "content-type",
+    "etag",
+    "location",
+    "mcp-protocol-version",
+    "mcp-session-id",
+    "retry-after",
+    "www-authenticate",
+]);
+export class HeaderError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "HeaderError";
+        this.code = code;
+    }
+}
+export function isForwardedRequestHeader(name) {
+    return FORWARDED_REQUEST_HEADERS.has(name) || name.startsWith("mcp-param-");
+}
+export function isReturnedResponseHeader(name) {
+    return RETURNED_RESPONSE_HEADERS.has(name);
+}
+const SURROUNDING_WHITESPACE = /^[ \t]+|[ \t]+$/g;
+/** RFC 7230 token, already lower-cased. Only the `mcp-param-` prefix can reach it unvetted. */
+const HEADER_NAME_TOKEN = /^[!#$%&'*+\-.^_`|~0-9a-z]+$/;
+/**
+ * Any code unit below 0x20 except TAB, plus DEL. The canonical form joins pairs with ":"
+ * and "\n", so a value carrying either separator would let two different header sets
+ * produce one digest — and the hub, untrusted for integrity (spec D14), is the party that
+ * would exploit that. Refusing the whole control range keeps the rule trivial to restate
+ * in Java.
+ */
+const FORBIDDEN_VALUE_CHARS = /[\u0000-\u0008\u000a-\u001f\u007f]/;
+/**
+ * Contract C6: lower-case, keep allowed, refuse control characters and non-token names,
+ * trim, refuse duplicates, sort by name. A header that is not on the allowlist is ignored
+ * without being validated — it never reaches the digest.
+ */
+export function filterHeaders(pairs, allowed) {
+    const kept = new Map();
+    for (const [rawName, rawValue] of pairs) {
+        const name = rawName.toLowerCase();
+        if (!allowed(name)) {
+            continue;
+        }
+        if (!HEADER_NAME_TOKEN.test(name)) {
+            throw new HeaderError("invalid_header", `header name ${JSON.stringify(name)} is not a token`);
+        }
+        if (FORBIDDEN_VALUE_CHARS.test(rawValue)) {
+            throw new HeaderError("invalid_header", `header ${name} carries a control character`);
+        }
+        if (kept.has(name)) {
+            throw new HeaderError("duplicate_header", `header ${name} appears more than once`);
+        }
+        kept.set(name, rawValue.replace(SURROUNDING_WHITESPACE, ""));
+    }
+    return [...kept.entries()].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+}
+export function canonicalHeaders(pairs, allowed) {
+    return filterHeaders(pairs, allowed)
+        .map(([name, value]) => `${name}:${value}\n`)
+        .join("");
+}
+export function requestHeadersDigest(pairs) {
+    return sha256b64url(canonicalHeaders(pairs, isForwardedRequestHeader));
+}
+export function bodyDigest(body) {
+    return sha256b64url(body);
+}
+//# sourceMappingURL=headers.js.map