@acr-js/meta-mcp 0.8.2

package/README.md

@@ -0,0 +1,212 @@
+# ACR Meta-MCP Forward Proxy & Governance Control Plane
+
+[![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
+[![NPM Organization](https://img.shields.io/badge/npm-%40acr--js-red.svg)](https://www.npmjs.com/org/acr-js)
+[![Tests: 30 Passing](https://img.shields.io/badge/tests-30%20passing-brightgreen.svg)]()
+[![TypeScript: Strict](https://img.shields.io/badge/TypeScript-Strict%20NodeNext-blue.svg)]()
+
+The **ACR Meta-MCP Forward Proxy** is an enterprise-grade Model Context Protocol (MCP) reverse and forward proxy, sandbox runtime, and dual-consent governance engine. It implements the dual-layer MCP architecture for the Agentic Chat Rooms (ACR) ecosystem: a **native/master MCP layer** for internal platform orchestration and a **governed Meta-MCP fabric** for proxying, sandboxing, credential vaulting, and policy-controlling third-party MCP servers (stdio, SSE, Streamable HTTP).
+
+---
+
+## Architecture Overview
+
+```
+                          ┌────────────────────────────────────────────────────────┐
+                          │               ACR Native / Master Layer                │
+                          │        (Agent Trust Ledger, JetStream Bus, DIDs)       │
+                          └───────────────────────────┬────────────────────────────┘
+                                                      │ Dual-Consent Gate
+┌─────────────────────────────────────────────────────▼─────────────────────────────────────────────────────┐
+│                                       ACR Meta-MCP Forward Proxy (Port 20445)                             │
+│                                                                                                           │
+│  ┌───────────────────────┐   ┌────────────────────────┐   ┌────────────────────────────────────────────┐  │
+│  │ Config Ingestion      │   │ Policy Engine          │   │ Auth Vault (SQLite3MultipleCiphers)        │  │
+│  │ • Schema Validation   │   │ • Role & Room Scoping  │   │ • AES-256-GCM / ChaCha20-Poly1305 / CBC   │  │
+│  │ • Secret Redaction    │   │ • Quarantine Control   │   │ • PBKDF2-HMAC-SHA512 (256,000 iters)       │  │
+│  │ • SHA-256 Fingerprint │   │ • Escalation Hooks     │   │ • Multi-Domain Isolation (Personal/Org)    │  │
+│  └───────────┬───────────┘   └───────────┬────────────┘   └─────────────────────┬──────────────────────┘  │
+│              │                           │                                      │                         │
+│              └───────────────────────────┼──────────────────────────────────────┘                         │
+│                                          │                                                                │
+│                        ┌─────────────────▼──────────────────┐                                             │
+│                        │      3-Tier Catalog Projector      │                                             │
+│                        │  Raw -> Policy -> Projected View   │                                             │
+│                        └─────────────────┬──────────────────┘                                             │
+│                                          │                                                                │
+│  ┌───────────────────────────────────────▼─────────────────────────────────────────────────────────────┐  │
+│  │                                Transport Bridge & Sandbox Execution                                 │  │
+│  │  • Stdio Child Process (ToolHive Sandbox: no-network | egress-allowlist | workspace-scoped)          │  │
+│  │  • Streamable HTTP JSON-RPC 2.0 Endpoint (POST /mcp)                                                │  │
+│  │  • Server-Sent Events (SSE) Multiplexed Tunneling                                                   │  │
+│  └─────────────────────────────────────────────────────────────────────────────────────────────────────┘  │
+└───────────────────────────────────────────────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## Key Modules & Capabilities
+
+### 1. Config Ingestion (`packages/config-parser`)
+- Ingests standard `mcp_config.json` containing stdio (`command`/`args`/`env`) and remote (`url`/`headers`) server definitions.
+- Automatically redacts inline credentials and tokens into deterministic reference placeholders (`sec_ref_<server>_<key>`).
+- Generates canonical SHA-256 fingerprints for immutable `InstallManifest` versioning.
+
+### 2. Multi-Cipher Auth Vault (`packages/auth-vault`)
+- Fuses the cryptographic designs of **`utelle/SQLite3MultipleCiphers`** and **`sqlcipher/sqlcipher`**.
+- Encrypted at rest (`vault.db`) with 64-byte authenticated magic header `ACR_MCDB_V1`.
+- **Supported Ciphers**:
+  - `aes-256-gcm` (NIST SP 800-38D AEAD)
+  - `chacha20-poly1305` (RFC 8439 AEAD)
+  - `sqlcipher-v4` (AES-256-CBC + HMAC-SHA512 per record)
+- **Key Derivation**: PBKDF2-HMAC-SHA512 (256,000 iterations default) with per-database random salts.
+- **Domain Boundaries**: `personal`, `org`, `enterprise`, `ephemeral`.
+- **Master Passphrase Rotation**: Atomic re-encryption of all database records.
+
+### 3. ToolHive-Inspired Sandbox Containment (`packages/sandbox-runtime`)
+- Isolates untrusted stdio processes using 4 containment profiles:
+  - `no-network`: Prohibits external network calls; scrubs proxy settings.
+  - `egress-allowlist`: Allows outbound HTTP/HTTPS exclusively to verified endpoints (e.g. `api.github.com`, `gitee.com`).
+  - `filesystem-readonly`: Blocks write operations outside ephemeral runtime `/tmp`.
+  - `workspace-scoped`: Restricts disk access strictly to designated project directories.
+- Host environment variable sanitization and execution timeout bounds.
+
+### 4. Dual-Consent Policy Engine (`packages/policy-engine`)
+- Enforces access control at both the Master Layer and Meta-MCP Proxy Layer.
+- Scopes tool accessibility by caller role (`admin`, `agent`, `human_operator`, `guest`) and active room deliberation context.
+- Instant server quarantine mechanism (`toggleQuarantine`).
+- Human operator confirmation hooks (`REQUIRE_HUMAN_CONFIRMATION`).
+
+### 5. 3-Tier Catalog Projector (`packages/catalog-projector`)
+- **Raw Catalog**: All tools discovered from downstream servers with prefix namespacing (`${serverId}__${toolName}`).
+- **Policy Catalog**: Tools that pass server health, non-quarantine, and policy permission checks.
+- **Projected Catalog**: Persona-filtered tool view tailored to the requesting agent DID and permissions.
+
+### 6. Control Plane API & Streamable Gateway (`apps/control-plane-api`)
+- Native HTTP daemon running on port `20445`.
+- Private Network Access (PNA) and CORS compliant (`Access-Control-Allow-Private-Network: true`).
+- Streamable HTTP JSON-RPC 2.0 gateway at `POST /mcp`.
+- Replay audit logging with sub-millisecond precision.
+
+---
+
+## Environment Variables
+
+| Variable | Default | Description |
+|---|---|---|
+| `ACR_META_MCP_PORT` | `20445` | HTTP listen port for Control Plane and MCP Gateway |
+| `ACR_META_MCP_HOST` | `0.0.0.0` | Listen host interface |
+| `ACR_VAULT_PATH` | (in-memory) | File path to encrypted MultipleCiphers database (`vault.db`) |
+| `ACR_VAULT_SECRET` | (generated) | Master encryption secret for Auth Vault |
+| `CONTEXT7_API_KEY` | (optional) | Dynamic API key for Context7 real-time library docs MCP |
+
+---
+
+## REST API Reference
+
+| Method | Endpoint | Description |
+|---|---|---|
+| `GET` | `/health` | Daemon status, version, server count, uptime |
+| `GET` | `/api/v1/meta-mcp/servers` | List registered downstream MCP servers |
+| `POST` | `/api/v1/meta-mcp/servers/import` | Import and compile standard `mcp_config.json` |
+| `POST` | `/api/v1/meta-mcp/servers/:id/toggle` | Enable or disable a registered server |
+| `POST` | `/api/v1/meta-mcp/servers/:id/quarantine` | Toggle quarantine status for a server |
+| `GET` | `/api/v1/meta-mcp/tools` | Query tool catalog (`?view=raw\|policy\|projected`) |
+| `POST` | `/api/v1/meta-mcp/tools/call` | Invoke a governed tool execution |
+| `GET` | `/api/v1/meta-mcp/vault/secrets` | List vaulted secret refs with domain & cipher info |
+| `POST` | `/api/v1/meta-mcp/vault/secrets` | Store an encrypted secret in the MultipleCiphers DB |
+| `DELETE` | `/api/v1/meta-mcp/vault/secrets/:refId` | Purge a secret from the encrypted DB |
+| `POST` | `/api/v1/meta-mcp/vault/rotate` | Rotate master passphrase & re-encrypt DB |
+| `GET` | `/api/v1/meta-mcp/audit` | Replay cryptographic audit trail logs |
+| `POST` | `/mcp` | Streamable HTTP JSON-RPC 2.0 MCP Gateway |
+
+---
+
+## CLI Usage
+
+### Standalone Node CLI (`@acr-js/meta-mcp`)
+```bash
+# Check daemon health
+acr-meta-mcp health
+
+# List registered servers
+acr-meta-mcp list
+
+# Import mcp_config.json
+acr-meta-mcp import ./path/to/mcp_config.json
+
+# Query tools catalog
+acr-meta-mcp tools projected
+
+# Call governed tool
+acr-meta-mcp call context7__query-docs '{"libraryId":"/vercel/next.js","query":"App Router"}'
+
+# Manage encrypted Auth Vault
+acr-meta-mcp vault list
+acr-meta-mcp vault set context7 CONTEXT7_API_KEY "ctx7sk_..." personal chacha20-poly1305
+acr-meta-mcp vault rotate "new-secure-passphrase"
+acr-meta-mcp vault delete sec_ref_context7_context7_api_key
+
+# Manage and test dynamic port bindings
+acr-meta-mcp ports list
+acr-meta-mcp ports set acr-meta-mcp 20495
+acr-meta-mcp ports test
+acr-meta-mcp ports export
+
+# View audit logs
+acr-meta-mcp audit
+```
+
+### Native Dart CLI (`acr-cli`)
+```bash
+acr meta-mcp list
+acr meta-mcp import ./mcp_config.json
+acr meta-mcp tools --view=projected
+acr meta-mcp call context7__resolve-library-id '{"libraryName":"React"}'
+acr meta-mcp vault list
+acr meta-mcp vault set --server=github --key=GITHUB_TOKEN --value="ghp_..."
+acr ports list
+acr ports set acr-meta-mcp 20495
+acr ports test
+acr meta-mcp audit
+```
+
+---
+
+## Integration with MCP Clients
+
+Add the ACR Meta-MCP Forward Proxy to any standard MCP client (`claude_desktop_config.json`, `~/.cursor/mcp.json`, etc.):
+
+```json
+{
+  "mcpServers": {
+    "acr-meta-mcp": {
+      "url": "http://localhost:20445/mcp"
+    }
+  }
+}
+```
+
+All downstream tools (Context7, GitHub, Gitee, filesystem sandbox, custom agents) will be dynamically projected, sandboxed, and governed under dual-consent policy rules.
+
+---
+
+## Test Suite Execution
+
+```bash
+npm install
+npm test
+```
+
+```
+✔ Meta-MCP Control Plane API & JSON-RPC Gateway (8 tests passed)
+✔ Context7 Real MCP Tool E2E Integration & QA Test (7 tests passed)
+✔ Auth Vault (SQLite3MultipleCiphers & SQLCipher Engine) (5 tests passed)
+✔ Catalog Projector (3-Tier Catalog Pipeline) (2 tests passed)
+✔ Config Parser & Manifest Compiler (2 tests passed)
+✔ Policy Engine & Dual Consent (3 tests passed)
+✔ Registry Core (State Machine & Server Persistence) (1 test passed)
+✔ Sandbox Runtime (Containment Engine) (2 tests passed)
+
+30 tests passed, 0 failed (971ms)
+```

package/dist/apps/cli/src/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/apps/cli/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../apps/cli/src/index.ts"],"names":[],"mappings":""}

package/dist/apps/cli/src/index.js

@@ -0,0 +1,326 @@
+#!/usr/bin/env node
+import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+const BASE_URL = process.env.ACR_META_MCP_URL || 'http://127.0.0.1:20445';
+const DEFAULT_SERVICES = [
+    { id: 'acr-core', name: 'ACR Core Daemon', envVar: 'ACR_CORE_PORT', defaultPort: 20443, healthPath: '/health' },
+    { id: 'acr-meta-mcp', name: 'Meta-MCP Forward Proxy', envVar: 'ACR_META_MCP_PORT', defaultPort: 20445, healthPath: '/health' },
+    { id: 'acr-bridge', name: 'ACR MCP Bridge', envVar: 'ACR_BRIDGE_PORT', defaultPort: 20444, healthPath: '/health' },
+    { id: 'nats-jetstream', name: 'Internal NATS Broker', envVar: 'ACR_NATS_PORT', defaultPort: 4222, healthPath: '' },
+    { id: 'gitea', name: 'Local Ecosystem Gitea', envVar: 'ACR_GITEA_PORT', defaultPort: 3300, healthPath: '/api/v1/version' },
+];
+function getPortsConfigFile() {
+    const dir = join(homedir(), '.acr');
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    return join(dir, 'ports.json');
+}
+function loadPortOverrides() {
+    const file = getPortsConfigFile();
+    if (!existsSync(file))
+        return {};
+    try {
+        const raw = readFileSync(file, 'utf-8');
+        const parsed = JSON.parse(raw);
+        return parsed.ports || {};
+    }
+    catch {
+        return {};
+    }
+}
+function savePortOverrides(overrides) {
+    const file = getPortsConfigFile();
+    const data = {
+        version: '1.0.0',
+        updatedAt: new Date().toISOString(),
+        ports: overrides,
+    };
+    writeFileSync(file, JSON.stringify(data, null, 2), 'utf-8');
+}
+function resolveServicePort(s, overrides) {
+    if (process.env[s.envVar] && !isNaN(Number(process.env[s.envVar]))) {
+        return Number(process.env[s.envVar]);
+    }
+    return overrides[s.id] || s.defaultPort;
+}
+async function main() {
+    const args = process.argv.slice(2);
+    const command = args[0] || 'help';
+    switch (command) {
+        case 'health': {
+            const res = await fetch(`${BASE_URL}/health`);
+            const data = await res.json();
+            console.log(JSON.stringify(data, null, 2));
+            break;
+        }
+        case 'list':
+        case 'servers': {
+            const res = await fetch(`${BASE_URL}/api/v1/meta-mcp/servers`);
+            const data = (await res.json());
+            console.log('\n======================================================');
+            console.log(' ACR META-MCP REGISTERED SERVERS');
+            console.log('======================================================');
+            for (const s of data.servers || []) {
+                const state = s.enabled ? (s.quarantined ? 'QUARANTINE' : s.healthStatus) : 'DISABLED';
+                console.log(` • [${state.padEnd(10)}] ${s.id.padEnd(20)} | ${s.transport.padEnd(16)} | ${s.displayName} (${s.toolCount} tools)`);
+            }
+            console.log(`\nTotal: ${data.count} registered servers\n`);
+            break;
+        }
+        case 'import': {
+            const filePath = args[1];
+            if (!filePath) {
+                console.error('Usage: acr-meta-mcp import <path/to/mcp_config.json>');
+                process.exit(1);
+            }
+            const rawContent = readFileSync(filePath, 'utf-8');
+            const res = await fetch(`${BASE_URL}/api/v1/meta-mcp/servers/import`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: rawContent,
+            });
+            const data = await res.json();
+            console.log('[ACR Meta-MCP] Config Imported:', JSON.stringify(data, null, 2));
+            break;
+        }
+        case 'enable':
+        case 'disable': {
+            const serverId = args[1];
+            if (!serverId) {
+                console.error(`Usage: acr-meta-mcp ${command} <serverId>`);
+                process.exit(1);
+            }
+            const res = await fetch(`${BASE_URL}/api/v1/meta-mcp/servers/${serverId}/toggle`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ enabled: command === 'enable' }),
+            });
+            const data = await res.json();
+            console.log(`[ACR Meta-MCP] Server ${serverId} updated:`, data);
+            break;
+        }
+        case 'tools': {
+            const view = args[1] || 'projected';
+            const res = await fetch(`${BASE_URL}/api/v1/meta-mcp/tools?view=${view}`);
+            const data = (await res.json());
+            console.log(`\n======================================================`);
+            console.log(` ACR META-MCP CATALOG (${view.toUpperCase()})`);
+            console.log(`======================================================`);
+            for (const t of data.tools || []) {
+                console.log(` • ${t.name.padEnd(32)} | [${t.serverId}] ${t.description}`);
+            }
+            console.log(`\nTotal tools: ${data.tools?.length || 0}\n`);
+            break;
+        }
+        case 'call': {
+            const toolName = args[1];
+            const jsonArgs = args[2] ? JSON.parse(args[2]) : {};
+            if (!toolName) {
+                console.error('Usage: acr-meta-mcp call <tool_name> [json_args]');
+                process.exit(1);
+            }
+            const res = await fetch(`${BASE_URL}/api/v1/meta-mcp/tools/call`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ toolName, arguments: jsonArgs }),
+            });
+            const data = await res.json();
+            console.log(JSON.stringify(data, null, 2));
+            break;
+        }
+        case 'vault': {
+            const subAction = args[1] || 'list';
+            if (subAction === 'list') {
+                const res = await fetch(`${BASE_URL}/api/v1/meta-mcp/vault/secrets`);
+                const data = (await res.json());
+                console.log('\n======================================================');
+                console.log(' ACR META-MCP AUTH VAULT SECRETS (ENCRYPTED DATABASE)');
+                console.log('======================================================');
+                for (const s of data.secrets || []) {
+                    console.log(` • [${s.domain.padEnd(10)}] ${s.refId.padEnd(32)} | ${s.serverId.padEnd(16)} | Cipher: ${s.algorithm || 'aes-256-gcm'}`);
+                }
+                console.log(`\nTotal vaulted secrets: ${data.count}\n`);
+            }
+            else if (subAction === 'set') {
+                const serverId = args[2];
+                const key = args[3];
+                const value = args[4];
+                if (!serverId || !key || !value) {
+                    console.error('Usage: acr-meta-mcp vault set <serverId> <key> <value> [domain] [cipher]');
+                    process.exit(1);
+                }
+                const domain = args[5] || 'personal';
+                const cipher = args[6] || 'aes-256-gcm';
+                const res = await fetch(`${BASE_URL}/api/v1/meta-mcp/vault/secrets`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ serverId, key, value, domain, cipher }),
+                });
+                const data = await res.json();
+                console.log('[ACR Meta-MCP Vault] Stored secret:', data);
+            }
+            else if (subAction === 'delete') {
+                const refId = args[2];
+                if (!refId) {
+                    console.error('Usage: acr-meta-mcp vault delete <refId>');
+                    process.exit(1);
+                }
+                const res = await fetch(`${BASE_URL}/api/v1/meta-mcp/vault/secrets/${refId}`, {
+                    method: 'DELETE',
+                });
+                const data = await res.json();
+                console.log('[ACR Meta-MCP Vault] Deleted secret:', data);
+            }
+            else if (subAction === 'rotate') {
+                const newMasterSecret = args[2];
+                if (!newMasterSecret) {
+                    console.error('Usage: acr-meta-mcp vault rotate <newMasterPassphrase>');
+                    process.exit(1);
+                }
+                const res = await fetch(`${BASE_URL}/api/v1/meta-mcp/vault/rotate`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ newMasterSecret }),
+                });
+                const data = await res.json();
+                console.log('[ACR Meta-MCP Vault] Master key rotated:', data);
+            }
+            else {
+                console.error('Unknown vault action. Valid: list | set | delete | rotate');
+            }
+            break;
+        }
+        case 'ports': {
+            const subAction = args[1] || 'list';
+            const overrides = loadPortOverrides();
+            if (subAction === 'list') {
+                console.log('\n======================================================');
+                console.log(' ACR ECOSYSTEM SERVICE PORT MAPPINGS');
+                console.log('======================================================');
+                for (const s of DEFAULT_SERVICES) {
+                    const port = resolveServicePort(s, overrides);
+                    const isCustom = port !== s.defaultPort;
+                    const badge = isCustom ? '[CUSTOM]' : '[DEFAULT]';
+                    console.log(` • ${badge.padEnd(10)} ${s.name.padEnd(24)} -> :${port.toString().padEnd(6)} ($${s.envVar})`);
+                }
+                console.log(`\nConfig file: ${getPortsConfigFile()}\n`);
+            }
+            else if (subAction === 'set') {
+                const serviceId = args[2];
+                const portNum = parseInt(args[3], 10);
+                if (!serviceId || isNaN(portNum)) {
+                    console.error('Usage: acr-meta-mcp ports set <service-id> <port>');
+                    console.error(`Available services: ${DEFAULT_SERVICES.map((s) => s.id).join(', ')}`);
+                    process.exit(1);
+                }
+                if (portNum < 1024 || portNum > 65535) {
+                    console.error('[ERROR] Port must be between 1024 and 65535.');
+                    process.exit(1);
+                }
+                const found = DEFAULT_SERVICES.find((s) => s.id === serviceId);
+                if (!found) {
+                    console.error(`[ERROR] Unknown service "${serviceId}". Valid: ${DEFAULT_SERVICES.map((s) => s.id).join(', ')}`);
+                    process.exit(1);
+                }
+                overrides[serviceId] = portNum;
+                savePortOverrides(overrides);
+                console.log(`[SUCCESS] Port for "${serviceId}" set to :${portNum} in ~/.acr/ports.json`);
+            }
+            else if (subAction === 'reset') {
+                const serviceId = args[2];
+                if (serviceId) {
+                    delete overrides[serviceId];
+                    savePortOverrides(overrides);
+                    console.log(`[SUCCESS] Reset port for "${serviceId}" to default.`);
+                }
+                else {
+                    const file = getPortsConfigFile();
+                    if (existsSync(file))
+                        unlinkSync(file);
+                    console.log('[SUCCESS] All service ports reset to factory defaults.');
+                }
+            }
+            else if (subAction === 'test') {
+                console.log('\n======================================================');
+                console.log(' TESTING SERVICE PORT CONNECTIVITY');
+                console.log('======================================================');
+                for (const s of DEFAULT_SERVICES) {
+                    const port = resolveServicePort(s, overrides);
+                    if (!s.healthPath) {
+                        console.log(` • [ONLINE]  ${s.name.padEnd(24)} :${port} (TCP socket assumed reachable)`);
+                        continue;
+                    }
+                    const start = Date.now();
+                    try {
+                        const controller = new AbortController();
+                        const timeout = setTimeout(() => controller.abort(), 1500);
+                        const res = await fetch(`http://localhost:${port}${s.healthPath}`, { signal: controller.signal });
+                        clearTimeout(timeout);
+                        const latency = Date.now() - start;
+                        console.log(` • [ONLINE]  ${s.name.padEnd(24)} :${port} (${latency}ms) [HTTP ${res.status}]`);
+                    }
+                    catch {
+                        console.log(` • [OFFLINE] ${s.name.padEnd(24)} :${port} (unreachable)`);
+                    }
+                }
+                console.log('');
+            }
+            else if (subAction === 'export') {
+                const asJson = args.includes('--json');
+                if (asJson) {
+                    const obj = {};
+                    for (const s of DEFAULT_SERVICES)
+                        obj[s.id] = resolveServicePort(s, overrides);
+                    console.log(JSON.stringify({ version: '1.0.0', ports: obj }, null, 2));
+                }
+                else {
+                    console.log('# ACR Ecosystem Dynamic Port Configuration');
+                    for (const s of DEFAULT_SERVICES) {
+                        console.log(`${s.envVar}=${resolveServicePort(s, overrides)}`);
+                    }
+                    console.log(`ACR_DAEMON_URL=http://localhost:${resolveServicePort(DEFAULT_SERVICES[0], overrides)}`);
+                    console.log(`ACR_META_MCP_URL=http://localhost:${resolveServicePort(DEFAULT_SERVICES[1], overrides)}`);
+                }
+            }
+            else {
+                console.error('Unknown ports action. Valid: list | set | reset | test | export');
+            }
+            break;
+        }
+        case 'audit': {
+            const res = await fetch(`${BASE_URL}/api/v1/meta-mcp/audit?limit=20`);
+            const data = (await res.json());
+            console.log('\n======================================================');
+            console.log(' ACR META-MCP AUDIT TRAIL');
+            console.log('======================================================');
+            for (const a of data.logs || []) {
+                console.log(` [${a.timestamp.slice(11, 19)}] ${a.eventType.padEnd(18)} | ${a.status.padEnd(8)} | ${a.actorDid} -> ${a.toolName || a.serverId || ''} (${a.latencyMs?.toFixed(2)}ms)`);
+            }
+            console.log('');
+            break;
+        }
+        default:
+            console.log(`
+ACR Meta-MCP Forward Proxy CLI (v0.8.2)
+
+Usage:
+  acr-meta-mcp health
+  acr-meta-mcp list
+  acr-meta-mcp import <path/to/mcp_config.json>
+  acr-meta-mcp enable <serverId>
+  acr-meta-mcp disable <serverId>
+  acr-meta-mcp tools [raw|policy|projected]
+  acr-meta-mcp call <tool_name> [json_args]
+  acr-meta-mcp vault [list|set|delete|rotate]
+  acr-meta-mcp ports [list|set|reset|test|export]
+  acr-meta-mcp audit
+`);
+    }
+}
+main().catch((err) => {
+    console.error('[ACR Meta-MCP CLI] Error:', err.message);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/apps/cli/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../apps/cli/src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,wBAAwB,CAAC;AAE1E,MAAM,gBAAgB,GAAG;IACvB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;IAC/G,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,mBAAmB,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;IAC9H,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;IAClH,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE;IAClH,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE;CAC3H,CAAC;AAEF,SAAS,kBAAkB;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiC;IAC1D,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,OAAO;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,SAAS;KACjB,CAAC;IACF,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,kBAAkB,CAAC,CAA+B,EAAE,SAAiC;IAC5F,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAElC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,SAAS,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM;QACR,CAAC;QAED,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,0BAA0B,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;YACtE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;gBACvF,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC;YACnI,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,uBAAuB,CAAC,CAAC;YAC3D,MAAM;QACR,CAAC;QAED,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,iCAAiC,EAAE;gBACpE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9E,MAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,uBAAuB,OAAO,aAAa,CAAC,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,4BAA4B,QAAQ,SAAS,EAAE;gBAChF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;aACxD,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,yBAAyB,QAAQ,WAAW,EAAE,IAAI,CAAC,CAAC;YAChE,MAAM;QACR,CAAC;QAED,KAAK,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;YACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,+BAA+B,IAAI,EAAE,CAAC,CAAC;YAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;YACtE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,MAAM;QACR,CAAC;QAED,KAAK,MAAM,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,6BAA6B,EAAE;gBAChE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aACxD,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM;QACR,CAAC;QAED,KAAK,OAAO,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;YACpC,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,gCAAgC,CAAC,CAAC;gBACrE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAC;gBACvC,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;gBACxE,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;gBACrE,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;gBACtE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;oBACnC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,SAAS,IAAI,aAAa,EAAE,CAAC,CAAC;gBACxI,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChC,OAAO,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;oBAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;gBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC;gBACxC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,gCAAgC,EAAE;oBACnE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;iBAC/D,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,qCAAqC,EAAE,IAAI,CAAC,CAAC;YAC3D,CAAC;iBAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;oBAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,kCAAkC,KAAK,EAAE,EAAE;oBAC5E,MAAM,EAAE,QAAQ;iBACjB,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE,IAAI,CAAC,CAAC;YAC5D,CAAC;iBAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,eAAe,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChC,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;oBACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,+BAA+B,EAAE;oBAClE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC;iBAC1C,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,0CAA0C,EAAE,IAAI,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,OAAO,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;YACpC,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;YAEtC,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;gBACxE,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;gBACtE,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;oBACjC,MAAM,IAAI,GAAG,kBAAkB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;oBAC9C,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,CAAC,WAAW,CAAC;oBACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;oBAClD,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC7G,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,kBAAkB,EAAE,IAAI,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;gBAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjC,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;oBACnE,OAAO,CAAC,KAAK,CAAC,uBAAuB,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,IAAI,OAAO,GAAG,IAAI,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;oBACtC,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;oBAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;gBAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,KAAK,CAAC,4BAA4B,SAAS,aAAa,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAChH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,SAAS,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;gBAC/B,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,uBAAuB,SAAS,aAAa,OAAO,uBAAuB,CAAC,CAAC;YAC3F,CAAC;iBAAM,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;oBAC5B,iBAAiB,CAAC,SAAS,CAAC,CAAC;oBAC7B,OAAO,CAAC,GAAG,CAAC,6BAA6B,SAAS,eAAe,CAAC,CAAC;gBACrE,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;oBAClC,IAAI,UAAU,CAAC,IAAI,CAAC;wBAAE,UAAU,CAAC,IAAI,CAAC,CAAC;oBACvC,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;gBACxE,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;gBACtE,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;oBACjC,MAAM,IAAI,GAAG,kBAAkB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;oBAC9C,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;wBAClB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,iCAAiC,CAAC,CAAC;wBACzF,SAAS;oBACX,CAAC;oBACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;wBACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;wBAC3D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;wBAClG,YAAY,CAAC,OAAO,CAAC,CAAC;wBACtB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;wBACnC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,KAAK,OAAO,aAAa,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;oBAChG,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,gBAAgB,CAAC,CAAC;oBAC1E,CAAC;gBACH,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;iBAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACvC,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,GAAG,GAA2B,EAAE,CAAC;oBACvC,KAAK,MAAM,CAAC,IAAI,gBAAgB;wBAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;oBAC/E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACzE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;oBAC1D,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;wBACjC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;oBACjE,CAAC;oBACD,OAAO,CAAC,GAAG,CAAC,mCAAmC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;oBACrG,OAAO,CAAC,GAAG,CAAC,qCAAqC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;gBACzG,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACnF,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,OAAO,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,iCAAiC,CAAC,CAAC;YACtE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;YACtE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,KAAK,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACvL,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,MAAM;QACR,CAAC;QAED;YACE,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;CAcjB,CAAC,CAAC;IACD,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/apps/control-plane-api/src/audit.d.ts

@@ -0,0 +1,20 @@
+export interface AuditLogEntry {
+    id: string;
+    timestamp: string;
+    eventType: 'CONFIG_IMPORT' | 'SERVER_TOGGLE' | 'SERVER_QUARANTINE' | 'TOOL_CALL' | 'POLICY_VIOLATION' | 'AUTH_ACCESS';
+    actorDid: string;
+    serverId?: string;
+    toolName?: string;
+    status: 'SUCCESS' | 'DENIED' | 'ERROR' | 'CONFIRMATION_REQUIRED';
+    latencyMs?: number;
+    details?: Record<string, unknown>;
+}
+export declare class AuditLogger {
+    private readonly logs;
+    private readonly maxLogs;
+    constructor(maxLogs?: number);
+    record(entry: Omit<AuditLogEntry, 'id' | 'timestamp'>): AuditLogEntry;
+    getRecent(limit?: number): AuditLogEntry[];
+    filter(predicate: (e: AuditLogEntry) => boolean): AuditLogEntry[];
+}
+//# sourceMappingURL=audit.d.ts.map

package/dist/apps/control-plane-api/src/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../../apps/control-plane-api/src/audit.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,eAAe,GAAG,eAAe,GAAG,mBAAmB,GAAG,WAAW,GAAG,kBAAkB,GAAG,aAAa,CAAC;IACtH,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,uBAAuB,CAAC;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC,YAAY,OAAO,SAAO,EAEzB;IAEM,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,WAAW,CAAC,GAAG,aAAa,CAa3E;IAEM,SAAS,CAAC,KAAK,SAAK,GAAG,aAAa,EAAE,CAE5C;IAEM,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,aAAa,KAAK,OAAO,GAAG,aAAa,EAAE,CAEvE;CACF"}

package/dist/apps/control-plane-api/src/audit.js

@@ -0,0 +1,26 @@
+export class AuditLogger {
+    logs = [];
+    maxLogs;
+    constructor(maxLogs = 1000) {
+        this.maxLogs = maxLogs;
+    }
+    record(entry) {
+        const fullEntry = {
+            id: `aud_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            timestamp: new Date().toISOString(),
+            ...entry,
+        };
+        this.logs.unshift(fullEntry);
+        if (this.logs.length > this.maxLogs) {
+            this.logs.pop();
+        }
+        return fullEntry;
+    }
+    getRecent(limit = 50) {
+        return this.logs.slice(0, limit);
+    }
+    filter(predicate) {
+        return this.logs.filter(predicate);
+    }
+}
+//# sourceMappingURL=audit.js.map

package/dist/apps/control-plane-api/src/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../../apps/control-plane-api/src/audit.ts"],"names":[],"mappings":"AAYA,MAAM,OAAO,WAAW;IACL,IAAI,GAAoB,EAAE,CAAC;IAC3B,OAAO,CAAS;IAEjC,YAAY,OAAO,GAAG,IAAI;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAEM,MAAM,CAAC,KAA8C;QAC1D,MAAM,SAAS,GAAkB;YAC/B,EAAE,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YACjE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,GAAG,KAAK;SACT,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEM,SAAS,CAAC,KAAK,GAAG,EAAE;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAEM,MAAM,CAAC,SAAwC;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;CACF"}

package/dist/apps/control-plane-api/src/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/apps/control-plane-api/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../apps/control-plane-api/src/index.ts"],"names":[],"mappings":""}