@acr-js/meta-mcp 0.8.2

package/dist/packages/auth-vault/test/vault.test.js

@@ -0,0 +1,89 @@
+import { describe, it, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, unlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { AuthVault } from '../src/vault.js';
+import { deriveKey, encryptSecret, decryptSecret } from '../src/crypto.js';
+describe('Auth Vault (SQLite3MultipleCiphers & SQLCipher Engine)', () => {
+    const testDbFile = join(tmpdir(), `acr_test_vault_${Date.now()}.db`);
+    after(() => {
+        if (existsSync(testDbFile)) {
+            try {
+                unlinkSync(testDbFile);
+            }
+            catch { }
+        }
+    });
+    it('1. should encrypt and decrypt across AES-256-GCM, ChaCha20-Poly1305, and SQLCipher-v4', () => {
+        const keys = deriveKey('super-master-key-007', 'test-salt-123');
+        // AES-256-GCM
+        const gcmPayload = encryptSecret('secret-gcm-data', keys, 'aes-256-gcm');
+        assert.equal(gcmPayload.algorithm, 'aes-256-gcm');
+        assert.equal(decryptSecret(gcmPayload, keys), 'secret-gcm-data');
+        // ChaCha20-Poly1305
+        const chachaPayload = encryptSecret('secret-chacha-data', keys, 'chacha20-poly1305');
+        assert.equal(chachaPayload.algorithm, 'chacha20-poly1305');
+        assert.equal(decryptSecret(chachaPayload, keys), 'secret-chacha-data');
+        // SQLCipher-v4 (AES-256-CBC + HMAC-SHA512)
+        const sqlcipherPayload = encryptSecret('secret-sqlcipher-data', keys, 'sqlcipher-v4');
+        assert.equal(sqlcipherPayload.algorithm, 'sqlcipher-v4');
+        assert.equal(decryptSecret(sqlcipherPayload, keys), 'secret-sqlcipher-data');
+    });
+    it('2. should persist secrets to isolated database file and reload across instances', () => {
+        const vault1 = new AuthVault({
+            dbPath: testDbFile,
+            masterSecret: 'vault-master-passphrase-99',
+            cipher: 'aes-256-gcm',
+        });
+        vault1.storeSecret('sec_ref_context7_token', 'context7', 'CONTEXT7_API_KEY', 'dynamic-ctx7-key-value', 'personal', 'chacha20-poly1305');
+        vault1.storeSecret('sec_ref_gitee_token', 'gitee-cloud', 'GITEE_TOKEN', 'dynamic-gitee-token-value', 'org', 'sqlcipher-v4');
+        assert.ok(existsSync(testDbFile), 'Database file should be created on disk');
+        // Reopen with instance 2
+        const vault2 = new AuthVault({
+            dbPath: testDbFile,
+            masterSecret: 'vault-master-passphrase-99',
+        });
+        assert.equal(vault2.getSecret('sec_ref_context7_token'), 'dynamic-ctx7-key-value');
+        assert.equal(vault2.getSecret('sec_ref_gitee_token'), 'dynamic-gitee-token-value');
+    });
+    it('3. should reject database opening with invalid master key (tamper protection)', () => {
+        assert.throws(() => {
+            new AuthVault({
+                dbPath: testDbFile,
+                masterSecret: 'wrong-master-passphrase',
+            });
+        }, /Database decryption failed/);
+    });
+    it('4. should rotate master key and re-encrypt all stored database records', () => {
+        const vault = new AuthVault({
+            dbPath: testDbFile,
+            masterSecret: 'vault-master-passphrase-99',
+        });
+        vault.rotateMasterKey('new-stronger-passphrase-2026');
+        // Reopen with new passphrase
+        const reloadedVault = new AuthVault({
+            dbPath: testDbFile,
+            masterSecret: 'new-stronger-passphrase-2026',
+        });
+        assert.equal(reloadedVault.getSecret('sec_ref_context7_token'), 'dynamic-ctx7-key-value');
+        assert.equal(reloadedVault.getSecret('sec_ref_gitee_token'), 'dynamic-gitee-token-value');
+    });
+    it('5. should enforce domain boundaries on secret resolution', () => {
+        const vault = new AuthVault({
+            dbPath: testDbFile,
+            masterSecret: 'new-stronger-passphrase-2026',
+        });
+        const envMap = {
+            TOKEN: 'sec_ref_gitee_token',
+        };
+        // Allowed for org domain
+        const resolved = vault.resolveSecretRefs(envMap, ['org', 'enterprise']);
+        assert.equal(resolved.TOKEN, 'dynamic-gitee-token-value');
+        // Rejected if domain not in allowed scope
+        assert.throws(() => {
+            vault.resolveSecretRefs(envMap, ['personal']);
+        }, /Domain violation/);
+    });
+});
+//# sourceMappingURL=vault.test.js.map

package/dist/packages/auth-vault/test/vault.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.test.js","sourceRoot":"","sources":["../../../../packages/auth-vault/test/vault.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3E,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAErE,KAAK,CAAC,GAAG,EAAE;QACT,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,UAAU,CAAC,UAAU,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,IAAI,GAAG,SAAS,CAAC,sBAAsB,EAAE,eAAe,CAAC,CAAC;QAEhE,cAAc;QACd,MAAM,UAAU,GAAG,aAAa,CAAC,iBAAiB,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAEjE,oBAAoB;QACpB,MAAM,aAAa,GAAG,aAAa,CAAC,oBAAoB,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACrF,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,oBAAoB,CAAC,CAAC;QAEvE,2CAA2C;QAC3C,MAAM,gBAAgB,GAAG,aAAa,CAAC,uBAAuB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QACtF,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;YAC3B,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,4BAA4B;YAC1C,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;QAEH,MAAM,CAAC,WAAW,CAChB,wBAAwB,EACxB,UAAU,EACV,kBAAkB,EAClB,wBAAwB,EACxB,UAAU,EACV,mBAAmB,CACpB,CAAC;QACF,MAAM,CAAC,WAAW,CAChB,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,2BAA2B,EAC3B,KAAK,EACL,cAAc,CACf,CAAC;QAEF,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,yCAAyC,CAAC,CAAC;QAE7E,yBAAyB;QACzB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;YAC3B,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,4BAA4B;SAC3C,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC,CAAC;QACnF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,CAAC,MAAM,CACX,GAAG,EAAE;YACH,IAAI,SAAS,CAAC;gBACZ,MAAM,EAAE,UAAU;gBAClB,YAAY,EAAE,yBAAyB;aACxC,CAAC,CAAC;QACL,CAAC,EACD,4BAA4B,CAC7B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC;YAC1B,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,4BAA4B;SAC3C,CAAC,CAAC;QAEH,KAAK,CAAC,eAAe,CAAC,8BAA8B,CAAC,CAAC;QAEtD,6BAA6B;QAC7B,MAAM,aAAa,GAAG,IAAI,SAAS,CAAC;YAClC,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,8BAA8B;SAC7C,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC1F,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC;YAC1B,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,8BAA8B;SAC7C,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG;YACb,KAAK,EAAE,qBAAqB;SAC7B,CAAC;QAEF,yBAAyB;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;QAE1D,0CAA0C;QAC1C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE;YACjB,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/packages/catalog-projector/src/index.d.ts

@@ -0,0 +1,3 @@
+export * from './types.js';
+export * from './projector.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/packages/catalog-projector/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../packages/catalog-projector/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}

package/dist/packages/catalog-projector/src/index.js

@@ -0,0 +1,3 @@
+export * from './types.js';
+export * from './projector.js';
+//# sourceMappingURL=index.js.map

package/dist/packages/catalog-projector/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/catalog-projector/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}

package/dist/packages/catalog-projector/src/projector.d.ts

@@ -0,0 +1,28 @@
+import { PolicyCatalog, ProjectedCatalog, RawCatalog } from './types.js';
+export declare function namespaceTool(serverId: string, originalName: string): string;
+export declare function denamespaceTool(namespacedName: string): {
+    serverId: string;
+    originalName: string;
+};
+export interface CatalogProjectorOptions {
+    isServerEnabled?: (serverId: string) => boolean;
+    isToolEnabled?: (toolName: string) => boolean;
+    isServerQuarantined?: (serverId: string) => boolean;
+}
+export declare class CatalogProjector {
+    private readonly options;
+    constructor(options?: CatalogProjectorOptions);
+    buildRawCatalog(serverToolMap: Record<string, Array<{
+        name: string;
+        description?: string;
+        inputSchema?: any;
+    }>>): RawCatalog;
+    buildPolicyCatalog(rawCatalog: RawCatalog): PolicyCatalog;
+    projectForCaller(policyCatalog: PolicyCatalog, caller: {
+        did: string;
+        role: string;
+        capabilities?: string[];
+        allowedPrefixes?: string[];
+    }): ProjectedCatalog;
+}
+//# sourceMappingURL=projector.d.ts.map

package/dist/packages/catalog-projector/src/projector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projector.d.ts","sourceRoot":"","sources":["../../../../packages/catalog-projector/src/projector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE5F,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAO5E;AAED,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlG;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAChD,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC9C,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;CACrD;AAED,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,GAAE,uBAA4B,EAAI;IAE/D,eAAe,CACpB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC,CAAC,GAC9F,UAAU,CAuBZ;IAEM,kBAAkB,CAAC,UAAU,EAAE,UAAU,GAAG,aAAa,CAoB/D;IAEM,gBAAgB,CACrB,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GACzF,gBAAgB,CAwBlB;CACF"}

package/dist/packages/catalog-projector/src/projector.js

@@ -0,0 +1,85 @@
+export function namespaceTool(serverId, originalName) {
+    // If already namespaced, don't duplicate
+    if (originalName.startsWith(`${serverId}__`)) {
+        return originalName;
+    }
+    const cleanServer = serverId.replace(/[^a-zA-Z0-9_-]/g, '_');
+    return `${cleanServer}__${originalName}`;
+}
+export function denamespaceTool(namespacedName) {
+    const parts = namespacedName.split('__');
+    if (parts.length < 2) {
+        return { serverId: 'default', originalName: namespacedName };
+    }
+    const serverId = parts[0];
+    const originalName = parts.slice(1).join('__');
+    return { serverId, originalName };
+}
+export class CatalogProjector {
+    options;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    buildRawCatalog(serverToolMap) {
+        const tools = [];
+        const serverCounts = {};
+        for (const [serverId, rawTools] of Object.entries(serverToolMap)) {
+            serverCounts[serverId] = rawTools.length;
+            for (const t of rawTools) {
+                tools.push({
+                    name: namespaceTool(serverId, t.name),
+                    originalName: t.name,
+                    serverId,
+                    description: t.description || `Tool ${t.name} from server ${serverId}`,
+                    inputSchema: t.inputSchema || { type: 'object' },
+                });
+            }
+        }
+        return {
+            tools,
+            totalDiscovered: tools.length,
+            serverCounts,
+            generatedAt: new Date().toISOString(),
+        };
+    }
+    buildPolicyCatalog(rawCatalog) {
+        const isServerEnabled = this.options.isServerEnabled ?? (() => true);
+        const isToolEnabled = this.options.isToolEnabled ?? (() => true);
+        const isServerQuarantined = this.options.isServerQuarantined ?? (() => false);
+        const filtered = [];
+        for (const tool of rawCatalog.tools) {
+            if (!isServerEnabled(tool.serverId))
+                continue;
+            if (isServerQuarantined(tool.serverId))
+                continue;
+            if (!isToolEnabled(tool.name))
+                continue;
+            filtered.push(tool);
+        }
+        return {
+            tools: filtered,
+            totalPolicyAllowed: filtered.length,
+            totalFiltered: rawCatalog.totalDiscovered - filtered.length,
+            generatedAt: new Date().toISOString(),
+        };
+    }
+    projectForCaller(policyCatalog, caller) {
+        let visible = policyCatalog.tools;
+        // Filter by allowed prefixes if configured
+        if (caller.allowedPrefixes && caller.allowedPrefixes.length > 0) {
+            visible = visible.filter((t) => caller.allowedPrefixes.some((prefix) => t.serverId === prefix || t.name.startsWith(`${prefix}__`)));
+        }
+        // Role-based filtering: guests only see read-only tools
+        if (caller.role === 'guest') {
+            visible = visible.filter((t) => /get|list|read|inspect|search|find|status/i.test(t.originalName));
+        }
+        return {
+            callerDid: caller.did,
+            role: caller.role,
+            tools: visible,
+            totalVisible: visible.length,
+            generatedAt: new Date().toISOString(),
+        };
+    }
+}
+//# sourceMappingURL=projector.js.map

package/dist/packages/catalog-projector/src/projector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projector.js","sourceRoot":"","sources":["../../../../packages/catalog-projector/src/projector.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,YAAoB;IAClE,yCAAyC;IACzC,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAC;QAC7C,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,GAAG,WAAW,KAAK,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,cAAsB;IACpD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAQD,MAAM,OAAO,gBAAgB;IACE,OAAO;IAApC,YAA6B,OAAO,GAA4B,EAAE;uBAArC,OAAO;IAAiC,CAAC;IAE/D,eAAe,CACpB,aAA+F;QAE/F,MAAM,KAAK,GAAwB,EAAE,CAAC;QACtC,MAAM,YAAY,GAA2B,EAAE,CAAC;QAEhD,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACjE,YAAY,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;oBACrC,YAAY,EAAE,CAAC,CAAC,IAAI;oBACpB,QAAQ;oBACR,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,QAAQ,CAAC,CAAC,IAAI,gBAAgB,QAAQ,EAAE;oBACtE,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;iBACjD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK;YACL,eAAe,EAAE,KAAK,CAAC,MAAM;YAC7B,YAAY;YACZ,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;IACJ,CAAC;IAEM,kBAAkB,CAAC,UAAsB;QAC9C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAE9E,MAAM,QAAQ,GAAwB,EAAE,CAAC;QAEzC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACpC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC9C,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACjD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO;YACL,KAAK,EAAE,QAAQ;YACf,kBAAkB,EAAE,QAAQ,CAAC,MAAM;YACnC,aAAa,EAAE,UAAU,CAAC,eAAe,GAAG,QAAQ,CAAC,MAAM;YAC3D,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;IACJ,CAAC;IAEM,gBAAgB,CACrB,aAA4B,EAC5B,MAA0F;QAE1F,IAAI,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC;QAElC,2CAA2C;QAC3C,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7B,MAAM,CAAC,eAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,CACpG,CAAC;QACJ,CAAC;QAED,wDAAwD;QACxD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7B,2CAA2C,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CACjE,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,OAAO;YACd,YAAY,EAAE,OAAO,CAAC,MAAM;YAC5B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;IACJ,CAAC;CACF"}

package/dist/packages/catalog-projector/src/types.d.ts

@@ -0,0 +1,33 @@
+export interface McpToolDefinition {
+    name: string;
+    originalName: string;
+    serverId: string;
+    description: string;
+    inputSchema: {
+        type: 'object';
+        properties?: Record<string, unknown>;
+        required?: string[];
+        [key: string]: unknown;
+    };
+    tags?: string[];
+}
+export interface RawCatalog {
+    tools: McpToolDefinition[];
+    totalDiscovered: number;
+    serverCounts: Record<string, number>;
+    generatedAt: string;
+}
+export interface PolicyCatalog {
+    tools: McpToolDefinition[];
+    totalPolicyAllowed: number;
+    totalFiltered: number;
+    generatedAt: string;
+}
+export interface ProjectedCatalog {
+    callerDid: string;
+    role: string;
+    tools: McpToolDefinition[];
+    totalVisible: number;
+    generatedAt: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/packages/catalog-projector/src/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../packages/catalog-projector/src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB"}

package/dist/packages/catalog-projector/src/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/packages/catalog-projector/src/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../packages/catalog-projector/src/types.ts"],"names":[],"mappings":""}

package/dist/packages/catalog-projector/test/catalog.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=catalog.test.d.ts.map

package/dist/packages/catalog-projector/test/catalog.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.test.d.ts","sourceRoot":"","sources":["../../../../packages/catalog-projector/test/catalog.test.ts"],"names":[],"mappings":""}

package/dist/packages/catalog-projector/test/catalog.test.js

@@ -0,0 +1,41 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { CatalogProjector, namespaceTool, denamespaceTool } from '../src/index.js';
+describe('Catalog Projector (3-Tier Catalog Pipeline)', () => {
+    it('should namespace and denamespace tool identifiers deterministically', () => {
+        const ns = namespaceTool('gitee-server', 'create_issue');
+        assert.equal(ns, 'gitee-server__create_issue');
+        const { serverId, originalName } = denamespaceTool(ns);
+        assert.equal(serverId, 'gitee-server');
+        assert.equal(originalName, 'create_issue');
+    });
+    it('should transform Raw -> Policy -> Projected catalog accurately', () => {
+        const rawToolsMap = {
+            github: [
+                { name: 'list_repos', description: 'List repositories' },
+                { name: 'delete_repo', description: 'Delete repository' },
+            ],
+            internal_db: [
+                { name: 'read_metrics', description: 'Read system metrics' }
+            ]
+        };
+        const projector = new CatalogProjector({
+            isServerEnabled: (s) => s === 'github' || s === 'internal_db',
+            isServerQuarantined: () => false,
+            isToolEnabled: (t) => t !== 'github__delete_repo'
+        });
+        const raw = projector.buildRawCatalog(rawToolsMap);
+        assert.equal(raw.totalDiscovered, 3);
+        const policy = projector.buildPolicyCatalog(raw);
+        assert.equal(policy.totalPolicyAllowed, 2);
+        assert.equal(policy.totalFiltered, 1);
+        assert.ok(policy.tools.every(t => t.name !== 'github__delete_repo'));
+        const projected = projector.projectForCaller(policy, {
+            did: 'did:key:agent-readonly',
+            role: 'guest'
+        });
+        // Guest should only see read/list tools
+        assert.equal(projected.totalVisible, 2);
+    });
+});
+//# sourceMappingURL=catalog.test.js.map

package/dist/packages/catalog-projector/test/catalog.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.test.js","sourceRoot":"","sources":["../../../../packages/catalog-projector/test/catalog.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEnF,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,EAAE,GAAG,aAAa,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,4BAA4B,CAAC,CAAC;QAE/C,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,WAAW,GAAG;YAClB,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE;gBACxD,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE;aAC1D;YACD,WAAW,EAAE;gBACX,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,qBAAqB,EAAE;aAC7D;SACF,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,gBAAgB,CAAC;YACrC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,aAAa;YAC7D,mBAAmB,EAAE,GAAG,EAAE,CAAC,KAAK;YAChC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,qBAAqB;SAClD,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,SAAS,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,SAAS,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC;QAErE,MAAM,SAAS,GAAG,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE;YACnD,GAAG,EAAE,wBAAwB;YAC7B,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QAEH,wCAAwC;QACxC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/packages/config-parser/src/index.d.ts

@@ -0,0 +1,5 @@
+export * from './types.js';
+export * from './sanitizer.js';
+export * from './parser.js';
+export * from './manifest.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/packages/config-parser/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../packages/config-parser/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}

package/dist/packages/config-parser/src/index.js

@@ -0,0 +1,5 @@
+export * from './types.js';
+export * from './sanitizer.js';
+export * from './parser.js';
+export * from './manifest.js';
+//# sourceMappingURL=index.js.map

package/dist/packages/config-parser/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/config-parser/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}

package/dist/packages/config-parser/src/manifest.d.ts

@@ -0,0 +1,3 @@
+import { InstallManifest, RawMcpConfig } from './types.js';
+export declare function compileInstallManifest(input: string | RawMcpConfig, domain?: 'personal' | 'org' | 'enterprise' | 'ephemeral'): InstallManifest;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/packages/config-parser/src/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../../../packages/config-parser/src/manifest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAuB,MAAM,YAAY,CAAC;AAGhF,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GAAG,YAAY,EAC5B,MAAM,GAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAwB,GACnE,eAAe,CAkCjB"}

package/dist/packages/config-parser/src/manifest.js

@@ -0,0 +1,33 @@
+import { createHash } from 'node:crypto';
+import { parseAndSanitizeServer, parseRawConfig } from './parser.js';
+export function compileInstallManifest(input, domain = 'personal') {
+    const raw = parseRawConfig(input);
+    const mcpServers = raw.mcpServers ?? {};
+    const servers = [];
+    let totalSecretRefs = 0;
+    for (const [serverId, config] of Object.entries(mcpServers)) {
+        const sanitized = parseAndSanitizeServer(serverId, config, domain);
+        servers.push(sanitized);
+        totalSecretRefs += sanitized.secretRefs.length;
+    }
+    // Deterministic canonical payload for SHA-256 fingerprint
+    const canonicalPayload = JSON.stringify({
+        v: '1.0.0',
+        servers: servers.map((s) => ({
+            id: s.serverId,
+            transport: s.transport,
+            stdio: s.stdioSpec,
+            remote: s.remoteSpec,
+        })),
+    });
+    const fingerprintSha256 = createHash('sha256').update(canonicalPayload).digest('hex');
+    return {
+        manifestVersion: '1.0.0',
+        generatedAt: new Date().toISOString(),
+        fingerprintSha256,
+        servers,
+        totalServers: servers.length,
+        totalSecretRefs,
+    };
+}
+//# sourceMappingURL=manifest.js.map

package/dist/packages/config-parser/src/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../../packages/config-parser/src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAErE,MAAM,UAAU,sBAAsB,CACpC,KAA4B,EAC5B,MAAM,GAAoD,UAAU;IAEpE,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAExC,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,eAAe,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;IACjD,CAAC;IAED,0DAA0D;IAC1D,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC;QACtC,CAAC,EAAE,OAAO;QACV,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,EAAE,EAAE,CAAC,CAAC,QAAQ;YACd,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,KAAK,EAAE,CAAC,CAAC,SAAS;YAClB,MAAM,EAAE,CAAC,CAAC,UAAU;SACrB,CAAC,CAAC;KACJ,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEtF,OAAO;QACL,eAAe,EAAE,OAAO;QACxB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,iBAAiB;QACjB,OAAO;QACP,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,eAAe;KAChB,CAAC;AACJ,CAAC"}

package/dist/packages/config-parser/src/parser.d.ts

@@ -0,0 +1,9 @@
+import { RawMcpConfig, RawServerConfig, SanitizedServerSpec, TransportType } from './types.js';
+export declare class ConfigParseError extends Error {
+    readonly details?: unknown;
+    constructor(message: string, details?: unknown);
+}
+export declare function parseRawConfig(input: string | RawMcpConfig): RawMcpConfig;
+export declare function deduceTransport(config: RawServerConfig): TransportType;
+export declare function parseAndSanitizeServer(serverId: string, config: RawServerConfig, domain?: 'personal' | 'org' | 'enterprise' | 'ephemeral'): SanitizedServerSpec;
+//# sourceMappingURL=parser.d.ts.map

package/dist/packages/config-parser/src/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../../../packages/config-parser/src/parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG/F,qBAAa,gBAAiB,SAAQ,KAAK;aACI,OAAO,CAAC,EAAE,OAAO;IAA9D,YAAY,OAAO,EAAE,MAAM,EAAkB,OAAO,CAAC,EAAE,OAAO,EAG7D;CACF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,YAAY,CASzE;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,aAAa,CAWtE;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,eAAe,EACvB,MAAM,GAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAwB,GACnE,mBAAmB,CAyCrB"}

package/dist/packages/config-parser/src/parser.js

@@ -0,0 +1,69 @@
+import { sanitizeEnvAndHeaders } from './sanitizer.js';
+export class ConfigParseError extends Error {
+    details;
+    constructor(message, details) {
+        super(message);
+        this.details = details;
+        this.name = 'ConfigParseError';
+    }
+}
+export function parseRawConfig(input) {
+    if (typeof input === 'string') {
+        try {
+            return JSON.parse(input);
+        }
+        catch (err) {
+            throw new ConfigParseError(`Invalid JSON syntax in MCP configuration: ${err.message}`, err);
+        }
+    }
+    return input;
+}
+export function deduceTransport(config) {
+    if ('command' in config && typeof config.command === 'string') {
+        return 'stdio';
+    }
+    if ('url' in config && typeof config.url === 'string') {
+        if (config.transport === 'streamable_http' || config.url.includes('/mcp')) {
+            return 'streamable_http';
+        }
+        return 'sse';
+    }
+    throw new ConfigParseError('Unable to deduce transport: entry must contain either "command" or "url".', config);
+}
+export function parseAndSanitizeServer(serverId, config, domain = 'personal') {
+    const transport = deduceTransport(config);
+    if (transport === 'stdio') {
+        const stdioConf = config;
+        if (!stdioConf.command || typeof stdioConf.command !== 'string') {
+            throw new ConfigParseError(`Server "${serverId}" has missing or invalid "command" field.`);
+        }
+        const { sanitized, secretRefs } = sanitizeEnvAndHeaders(serverId, stdioConf.env, domain);
+        return {
+            serverId,
+            displayName: serverId,
+            transport: 'stdio',
+            stdioSpec: {
+                command: stdioConf.command,
+                args: Array.isArray(stdioConf.args) ? stdioConf.args : [],
+                envRefs: sanitized,
+            },
+            secretRefs,
+        };
+    }
+    const remoteConf = config;
+    if (!remoteConf.url || typeof remoteConf.url !== 'string') {
+        throw new ConfigParseError(`Server "${serverId}" has missing or invalid "url" field.`);
+    }
+    const { sanitized, secretRefs } = sanitizeEnvAndHeaders(serverId, remoteConf.headers, domain);
+    return {
+        serverId,
+        displayName: serverId,
+        transport,
+        remoteSpec: {
+            url: remoteConf.url,
+            headerRefs: sanitized,
+        },
+        secretRefs,
+    };
+}
+//# sourceMappingURL=parser.js.map

package/dist/packages/config-parser/src/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../../../packages/config-parser/src/parser.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACI,OAAO;IAApD,YAAY,OAAe,EAAkB,OAAiB;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;uBAD4B,OAAO;QAElD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,KAA4B;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAiB,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAgB,CAAC,6CAA6C,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,IAAI,SAAS,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9D,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACtD,IAAI,MAAM,CAAC,SAAS,KAAK,iBAAiB,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,gBAAgB,CAAC,2EAA2E,EAAE,MAAM,CAAC,CAAC;AAClH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,MAAuB,EACvB,MAAM,GAAoD,UAAU;IAEpE,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAE1C,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAA4E,CAAC;QAC/F,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,IAAI,gBAAgB,CAAC,WAAW,QAAQ,2CAA2C,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEzF,OAAO;YACL,QAAQ;YACR,WAAW,EAAE,QAAQ;YACrB,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE;gBACT,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACzD,OAAO,EAAE,SAAS;aACnB;YACD,UAAU;SACX,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAkG,CAAC;IACtH,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,gBAAgB,CAAC,WAAW,QAAQ,uCAAuC,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE9F,OAAO;QACL,QAAQ;QACR,WAAW,EAAE,QAAQ;QACrB,SAAS;QACT,UAAU,EAAE;YACV,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,UAAU,EAAE,SAAS;SACtB;QACD,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/packages/config-parser/src/sanitizer.d.ts

@@ -0,0 +1,7 @@
+import { SecretRef } from './types.js';
+export declare function isSensitiveKey(key: string): boolean;
+export declare function sanitizeEnvAndHeaders(serverId: string, envOrHeaders: Record<string, string> | undefined, defaultDomain?: 'personal' | 'org' | 'enterprise' | 'ephemeral'): {
+    sanitized: Record<string, string>;
+    secretRefs: SecretRef[];
+};
+//# sourceMappingURL=sanitizer.d.ts.map

package/dist/packages/config-parser/src/sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizer.d.ts","sourceRoot":"","sources":["../../../../packages/config-parser/src/sanitizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAavC,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAChD,aAAa,GAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAwB,GAC1E;IAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CA0BhE"}

package/dist/packages/config-parser/src/sanitizer.js

@@ -0,0 +1,40 @@
+import { createHash } from 'node:crypto';
+const SENSITIVE_KEY_PATTERNS = [
+    /token/i,
+    /secret/i,
+    /key/i,
+    /password/i,
+    /auth/i,
+    /bearer/i,
+    /credential/i,
+    /api[_-]?key/i,
+];
+export function isSensitiveKey(key) {
+    return SENSITIVE_KEY_PATTERNS.some((pattern) => pattern.test(key));
+}
+export function sanitizeEnvAndHeaders(serverId, envOrHeaders, defaultDomain = 'personal') {
+    if (!envOrHeaders) {
+        return { sanitized: {}, secretRefs: [] };
+    }
+    const sanitized = {};
+    const secretRefs = [];
+    for (const [k, v] of Object.entries(envOrHeaders)) {
+        if (isSensitiveKey(k) || (typeof v === 'string' && v.length > 24 && /^[a-zA-Z0-9_\-\.]+$/.test(v))) {
+            const hash = createHash('sha256').update(`${serverId}:${k}:${v}`).digest('hex').slice(0, 12);
+            const refId = `sec_ref_${hash}`;
+            sanitized[k] = refId;
+            secretRefs.push({
+                refId,
+                key: k,
+                serverId,
+                domain: defaultDomain,
+                originalValue: v,
+            });
+        }
+        else {
+            sanitized[k] = v;
+        }
+    }
+    return { sanitized, secretRefs };
+}
+//# sourceMappingURL=sanitizer.js.map

package/dist/packages/config-parser/src/sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizer.js","sourceRoot":"","sources":["../../../../packages/config-parser/src/sanitizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AAGtD,MAAM,sBAAsB,GAAG;IAC7B,QAAQ;IACR,SAAS;IACT,MAAM;IACN,WAAW;IACX,OAAO;IACP,SAAS;IACT,aAAa;IACb,cAAc;CACf,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,YAAgD,EAChD,aAAa,GAAoD,UAAU;IAE3E,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7F,MAAM,KAAK,GAAG,WAAW,IAAI,EAAE,CAAC;YAChC,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC;gBACd,KAAK;gBACL,GAAG,EAAE,CAAC;gBACN,QAAQ;gBACR,MAAM,EAAE,aAAa;gBACrB,aAAa,EAAE,CAAC;aACjB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC"}

package/dist/packages/config-parser/src/types.d.ts

@@ -0,0 +1,47 @@
+export type TransportType = 'stdio' | 'sse' | 'streamable_http';
+export interface StdioServerConfig {
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+}
+export interface RemoteServerConfig {
+    url: string;
+    headers?: Record<string, string>;
+    transport?: 'sse' | 'streamable_http';
+}
+export type RawServerConfig = StdioServerConfig | RemoteServerConfig;
+export interface RawMcpConfig {
+    mcpServers?: Record<string, RawServerConfig>;
+    $schema?: string;
+}
+export interface SecretRef {
+    refId: string;
+    key: string;
+    serverId: string;
+    domain: 'personal' | 'org' | 'enterprise' | 'ephemeral';
+    originalValue: string;
+}
+export interface SanitizedServerSpec {
+    serverId: string;
+    displayName: string;
+    transport: TransportType;
+    stdioSpec?: {
+        command: string;
+        args: string[];
+        envRefs: Record<string, string>;
+    };
+    remoteSpec?: {
+        url: string;
+        headerRefs: Record<string, string>;
+    };
+    secretRefs: SecretRef[];
+}
+export interface InstallManifest {
+    manifestVersion: string;
+    generatedAt: string;
+    fingerprintSha256: string;
+    servers: SanitizedServerSpec[];
+    totalServers: number;
+    totalSecretRefs: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/packages/config-parser/src/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../packages/config-parser/src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,KAAK,GAAG,iBAAiB,CAAC;AAEhE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,KAAK,GAAG,iBAAiB,CAAC;CACvC;AAED,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;AAErE,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAW,CAAC;IACxD,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,aAAa,CAAC;IACzB,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC;IACF,UAAU,CAAC,EAAE;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,CAAC;IACF,UAAU,EAAE,SAAS,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;CACzB"}

package/dist/packages/config-parser/src/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/packages/config-parser/src/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../packages/config-parser/src/types.ts"],"names":[],"mappings":""}

package/dist/packages/config-parser/test/parser.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=parser.test.d.ts.map