@aquex/cmos-mcp 1.0.0

package/dist/registry/semver-validator.js

@@ -0,0 +1,115 @@
+"use strict";
+/**
+ * SemVer Validator
+ *
+ * Validates semantic versioning strings according to SemVer 2.0.0 specification.
+ * Supports strict X.Y.Z format (major.minor.patch).
+ *
+ * @module registry/semver-validator
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isValidSemVer = isValidSemVer;
+exports.parseSemVer = parseSemVer;
+exports.compareSemVer = compareSemVer;
+exports.validateSemVerOrThrow = validateSemVerOrThrow;
+exports.areVersionsCompatible = areVersionsCompatible;
+/**
+ * SemVer regex pattern
+ * Matches versions in X.Y.Z format where X, Y, Z are non-negative integers
+ */
+const SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+/**
+ * Validates if a string is a valid SemVer version
+ *
+ * @param version - Version string to validate
+ * @returns true if valid SemVer, false otherwise
+ */
+function isValidSemVer(version) {
+    if (!version || typeof version !== 'string') {
+        return false;
+    }
+    return SEMVER_PATTERN.test(version.trim());
+}
+/**
+ * Parses a SemVer string into its components
+ *
+ * @param version - Version string to parse
+ * @returns SemVer components or null if invalid
+ */
+function parseSemVer(version) {
+    if (!isValidSemVer(version)) {
+        return null;
+    }
+    const trimmed = version.trim();
+    const match = trimmed.match(SEMVER_PATTERN);
+    if (!match) {
+        return null;
+    }
+    return {
+        major: parseInt(match[1], 10),
+        minor: parseInt(match[2], 10),
+        patch: parseInt(match[3], 10),
+        raw: trimmed,
+    };
+}
+/**
+ * Compares two SemVer versions
+ *
+ * @param v1 - First version string
+ * @param v2 - Second version string
+ * @returns -1 if v1 < v2, 0 if equal, 1 if v1 > v2, null if either is invalid
+ */
+function compareSemVer(v1, v2) {
+    const parsed1 = parseSemVer(v1);
+    const parsed2 = parseSemVer(v2);
+    if (!parsed1 || !parsed2) {
+        return null;
+    }
+    // Compare major
+    if (parsed1.major !== parsed2.major) {
+        return parsed1.major < parsed2.major ? -1 : 1;
+    }
+    // Compare minor
+    if (parsed1.minor !== parsed2.minor) {
+        return parsed1.minor < parsed2.minor ? -1 : 1;
+    }
+    // Compare patch
+    if (parsed1.patch !== parsed2.patch) {
+        return parsed1.patch < parsed2.patch ? -1 : 1;
+    }
+    return 0;
+}
+/**
+ * Validates that a version string is valid SemVer and throws if not
+ *
+ * @param version - Version string to validate
+ * @param fieldName - Name of field for error message (default: "version")
+ * @throws Error if version is invalid
+ */
+function validateSemVerOrThrow(version, fieldName = 'version') {
+    if (!isValidSemVer(version)) {
+        throw new Error(`Invalid SemVer format for ${fieldName}: "${version}". Expected format: X.Y.Z (e.g., 1.0.0)`);
+    }
+}
+/**
+ * Checks if two versions are compatible (same major version)
+ *
+ * @param v1 - First version string
+ * @param v2 - Second version string
+ * @returns true if compatible, false otherwise or if invalid
+ */
+function areVersionsCompatible(v1, v2) {
+    const parsed1 = parseSemVer(v1);
+    const parsed2 = parseSemVer(v2);
+    if (!parsed1 || !parsed2) {
+        return false;
+    }
+    // In SemVer, major version 0 is for initial development
+    // Different minor versions in 0.x.x are NOT compatible
+    if (parsed1.major === 0 || parsed2.major === 0) {
+        return parsed1.major === parsed2.major && parsed1.minor === parsed2.minor;
+    }
+    // For major >= 1, same major version indicates compatibility
+    return parsed1.major === parsed2.major;
+}
+//# sourceMappingURL=semver-validator.js.map

package/dist/registry/semver-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver-validator.js","sourceRoot":"","sources":["../../src/registry/semver-validator.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAgBH,sCAMC;AAQD,kCAkBC;AASD,sCAwBC;AASD,sDAMC;AASD,sDAgBC;AArHD;;;GAGG;AACH,MAAM,cAAc,GAAG,4CAA4C,CAAC;AAEpE;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,OAAe;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,OAAe;IACzC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAE5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,EAAE,OAAO;KACb,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,EAAU,EAAE,EAAU;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAEhC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gBAAgB;IAChB,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,gBAAgB;IAChB,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,gBAAgB;IAChB,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,OAAe,EAAE,YAAoB,SAAS;IAClF,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,MAAM,OAAO,yCAAyC,CAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,EAAU,EAAE,EAAU;IAC1D,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAEhC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wDAAwD;IACxD,uDAAuD;IACvD,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;IAC5E,CAAC;IAED,6DAA6D;IAC7D,OAAO,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;AACzC,CAAC"}

package/dist/schemas/generic-mission.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Generic Mission Template Schema
+ *
+ * Universal mission structure using ICEV pattern:
+ * - Intent: Objective and desired outcome
+ * - Context: Background, dependencies, and constraints
+ * - Execution: Implementation details (via domainFields)
+ * - Verification: Success criteria and deliverables
+ *
+ * @version 2.0
+ */
+/**
+ * Core generic mission interface that works across any domain.
+ * Domain-specific extensions should be added via the domainFields property.
+ */
+export interface GenericMission {
+    /** Schema type identifier */
+    schemaType: 'Mission';
+    /** Schema version for compatibility tracking */
+    schemaVersion: '2.0';
+    /** Unique identifier for this mission */
+    missionId: string;
+    /** Primary desired outcome - what success looks like */
+    objective: string;
+    /** Background information and constraints */
+    context: {
+        /** Why this mission exists and relevant history */
+        background?: string;
+        /** Other missions, systems, or resources required */
+        dependencies?: string[];
+        /** Limitations, restrictions, or boundaries */
+        constraints?: string[];
+    };
+    /** Measurable conditions that indicate mission completion */
+    successCriteria: string[];
+    /** Tangible outputs that will be created */
+    deliverables: string[];
+    /** Domain-specific fields (populated by domain packs) */
+    domainFields: Record<string, unknown>;
+}
+/**
+ * JSON Schema definition for validating GenericMission objects
+ */
+export declare const genericMissionSchema: {
+    readonly $schema: "http://json-schema.org/draft-07/schema#";
+    readonly type: "object";
+    readonly required: readonly ["schemaType", "schemaVersion", "missionId", "objective", "successCriteria", "deliverables"];
+    readonly properties: {
+        readonly schemaType: {
+            readonly type: "string";
+            readonly const: "Mission";
+            readonly description: "Schema type identifier";
+        };
+        readonly schemaVersion: {
+            readonly type: "string";
+            readonly const: "2.0";
+            readonly description: "Schema version for compatibility";
+        };
+        readonly missionId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Unique identifier for this mission";
+        };
+        readonly objective: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Primary desired outcome";
+        };
+        readonly context: {
+            readonly type: "object";
+            readonly properties: {
+                readonly background: {
+                    readonly type: "string";
+                    readonly description: "Mission background and history";
+                };
+                readonly dependencies: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Required missions, systems, or resources";
+                };
+                readonly constraints: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Limitations or boundaries";
+                };
+            };
+            readonly additionalProperties: false;
+        };
+        readonly successCriteria: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "string";
+            };
+            readonly minItems: 1;
+            readonly description: "Measurable completion conditions";
+        };
+        readonly deliverables: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "string";
+            };
+            readonly minItems: 1;
+            readonly description: "Tangible outputs to be created";
+        };
+        readonly domainFields: {
+            readonly type: "object";
+            readonly description: "Domain-specific fields populated by domain packs";
+        };
+    };
+    readonly additionalProperties: false;
+};
+/**
+ * Type guard to check if an object is a valid GenericMission
+ */
+export declare function isGenericMission(obj: unknown): obj is GenericMission;
+//# sourceMappingURL=generic-mission.d.ts.map

package/dist/schemas/generic-mission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic-mission.d.ts","sourceRoot":"","sources":["../../src/schemas/generic-mission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,6BAA6B;IAC7B,UAAU,EAAE,SAAS,CAAC;IAEtB,gDAAgD;IAChD,aAAa,EAAE,KAAK,CAAC;IAErB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAElB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAElB,6CAA6C;IAC7C,OAAO,EAAE;QACP,mDAAmD;QACnD,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,qDAAqD;QACrD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QAExB,+CAA+C;QAC/C,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAEF,6DAA6D;IAC7D,eAAe,EAAE,MAAM,EAAE,CAAC;IAE1B,4CAA4C;IAC5C,YAAY,EAAE,MAAM,EAAE,CAAC;IAEvB,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8EvB,CAAC;AAEX;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,cAAc,CAmBpE"}

package/dist/schemas/generic-mission.js

@@ -0,0 +1,118 @@
+"use strict";
+/**
+ * Generic Mission Template Schema
+ *
+ * Universal mission structure using ICEV pattern:
+ * - Intent: Objective and desired outcome
+ * - Context: Background, dependencies, and constraints
+ * - Execution: Implementation details (via domainFields)
+ * - Verification: Success criteria and deliverables
+ *
+ * @version 2.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.genericMissionSchema = void 0;
+exports.isGenericMission = isGenericMission;
+/**
+ * JSON Schema definition for validating GenericMission objects
+ */
+exports.genericMissionSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    type: 'object',
+    required: [
+        'schemaType',
+        'schemaVersion',
+        'missionId',
+        'objective',
+        'successCriteria',
+        'deliverables',
+    ],
+    properties: {
+        schemaType: {
+            type: 'string',
+            const: 'Mission',
+            description: 'Schema type identifier',
+        },
+        schemaVersion: {
+            type: 'string',
+            const: '2.0',
+            description: 'Schema version for compatibility',
+        },
+        missionId: {
+            type: 'string',
+            minLength: 1,
+            description: 'Unique identifier for this mission',
+        },
+        objective: {
+            type: 'string',
+            minLength: 1,
+            description: 'Primary desired outcome',
+        },
+        context: {
+            type: 'object',
+            properties: {
+                background: {
+                    type: 'string',
+                    description: 'Mission background and history',
+                },
+                dependencies: {
+                    type: 'array',
+                    items: {
+                        type: 'string',
+                    },
+                    description: 'Required missions, systems, or resources',
+                },
+                constraints: {
+                    type: 'array',
+                    items: {
+                        type: 'string',
+                    },
+                    description: 'Limitations or boundaries',
+                },
+            },
+            additionalProperties: false,
+        },
+        successCriteria: {
+            type: 'array',
+            items: {
+                type: 'string',
+            },
+            minItems: 1,
+            description: 'Measurable completion conditions',
+        },
+        deliverables: {
+            type: 'array',
+            items: {
+                type: 'string',
+            },
+            minItems: 1,
+            description: 'Tangible outputs to be created',
+        },
+        domainFields: {
+            type: 'object',
+            description: 'Domain-specific fields populated by domain packs',
+        },
+    },
+    additionalProperties: false,
+};
+/**
+ * Type guard to check if an object is a valid GenericMission
+ */
+function isGenericMission(obj) {
+    if (!obj || typeof obj !== 'object')
+        return false;
+    const mission = obj;
+    return (mission.schemaType === 'Mission' &&
+        mission.schemaVersion === '2.0' &&
+        typeof mission.missionId === 'string' &&
+        mission.missionId.length > 0 &&
+        typeof mission.objective === 'string' &&
+        mission.objective.length > 0 &&
+        Array.isArray(mission.successCriteria) &&
+        mission.successCriteria.length > 0 &&
+        Array.isArray(mission.deliverables) &&
+        mission.deliverables.length > 0 &&
+        typeof mission.domainFields === 'object' &&
+        mission.domainFields !== null);
+}
+//# sourceMappingURL=generic-mission.js.map

package/dist/schemas/generic-mission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic-mission.js","sourceRoot":"","sources":["../../src/schemas/generic-mission.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA+HH,4CAmBC;AAzGD;;GAEG;AACU,QAAA,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE;QACR,YAAY;QACZ,eAAe;QACf,WAAW;QACX,WAAW;QACX,iBAAiB;QACjB,cAAc;KACf;IACD,UAAU,EAAE;QACV,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,wBAAwB;SACtC;QACD,aAAa,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,kCAAkC;SAChD;QACD,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,CAAC;YACZ,WAAW,EAAE,oCAAoC;SAClD;QACD,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,CAAC;YACZ,WAAW,EAAE,yBAAyB;SACvC;QACD,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,gCAAgC;iBAC9C;gBACD,YAAY,EAAE;oBACZ,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE;wBACL,IAAI,EAAE,QAAQ;qBACf;oBACD,WAAW,EAAE,0CAA0C;iBACxD;gBACD,WAAW,EAAE;oBACX,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE;wBACL,IAAI,EAAE,QAAQ;qBACf;oBACD,WAAW,EAAE,2BAA2B;iBACzC;aACF;YACD,oBAAoB,EAAE,KAAK;SAC5B;QACD,eAAe,EAAE;YACf,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;aACf;YACD,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,kCAAkC;SAChD;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;aACf;YACD,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,gCAAgC;SAC9C;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,kDAAkD;SAChE;KACF;IACD,oBAAoB,EAAE,KAAK;CACnB,CAAC;AAEX;;GAEG;AACH,SAAgB,gBAAgB,CAAC,GAAY;IAC3C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAElD,MAAM,OAAO,GAAG,GAA8B,CAAC;IAE/C,OAAO,CACL,OAAO,CAAC,UAAU,KAAK,SAAS;QAChC,OAAO,CAAC,aAAa,KAAK,KAAK;QAC/B,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;QACrC,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAC5B,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;QACrC,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAC5B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QACtC,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAClC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;QACnC,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAC/B,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;QACxC,OAAO,CAAC,YAAY,KAAK,IAAI,CAC9B,CAAC;AACJ,CAAC"}

package/dist/security/workspace-guard.d.ts

@@ -0,0 +1,10 @@
+import { SafeFilePathOptions } from '../validation/common';
+export declare function getWorkspaceRoot(): string;
+export declare function getWorkspaceAllowlist(): string[];
+export interface WorkspacePathOptions extends SafeFilePathOptions {
+    readonly allowRelative?: boolean;
+    readonly baseDir?: string;
+}
+export declare function resolveWorkspacePath(inputPath: string, options?: WorkspacePathOptions): Promise<string>;
+export declare function isPathWithinWorkspace(targetPath: string): boolean;
+//# sourceMappingURL=workspace-guard.d.ts.map

package/dist/security/workspace-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-guard.d.ts","sourceRoot":"","sources":["../../src/security/workspace-guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAoDzE,wBAAgB,gBAAgB,IAAI,MAAM,CASzC;AAED,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAUhD;AAkBD,MAAM,WAAW,oBAAqB,SAAQ,mBAAmB;IAC/D,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAIjE"}

package/dist/security/workspace-guard.js

@@ -0,0 +1,116 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getWorkspaceRoot = getWorkspaceRoot;
+exports.getWorkspaceAllowlist = getWorkspaceAllowlist;
+exports.resolveWorkspacePath = resolveWorkspacePath;
+exports.isPathWithinWorkspace = isPathWithinWorkspace;
+const path_1 = __importDefault(require("path"));
+const common_1 = require("../validation/common");
+const errors_1 = require("../validation/errors");
+const WORKSPACE_ROOT_ENV_VARS = [
+    'MISSION_PROTOCOL_WORKSPACE_ROOT',
+    'MCP_WORKSPACE_ROOT',
+    'WORKSPACE_ROOT',
+];
+const WORKSPACE_ALLOWLIST_ENV_VAR = 'MISSION_PROTOCOL_WORKSPACE_ALLOWLIST';
+function normalizePath(value) {
+    return path_1.default.resolve(value);
+}
+function splitAllowlist(value) {
+    return value
+        .split(path_1.default.delimiter)
+        .flatMap((segment) => segment.split(','))
+        .flatMap((segment) => segment.split('\n'))
+        .map((segment) => segment.trim())
+        .filter(Boolean);
+}
+function isWithinBase(targetPath, basePath) {
+    const normalizedBase = normalizePath(basePath);
+    const normalizedTarget = normalizePath(targetPath);
+    if (normalizedTarget === normalizedBase) {
+        return true;
+    }
+    const baseWithSep = normalizedBase.endsWith(path_1.default.sep)
+        ? normalizedBase
+        : `${normalizedBase}${path_1.default.sep}`;
+    return normalizedTarget.startsWith(baseWithSep);
+}
+function uniqueAllowlist(entries) {
+    const seen = new Set();
+    const ordered = [];
+    for (const entry of entries) {
+        const normalized = normalizePath(entry);
+        if (!seen.has(normalized)) {
+            seen.add(normalized);
+            ordered.push(normalized);
+        }
+    }
+    return ordered;
+}
+function getWorkspaceRoot() {
+    for (const envVar of WORKSPACE_ROOT_ENV_VARS) {
+        const value = process.env[envVar];
+        if (value && value.trim().length > 0) {
+            return normalizePath(value);
+        }
+    }
+    return process.cwd();
+}
+function getWorkspaceAllowlist() {
+    const envValue = process.env[WORKSPACE_ALLOWLIST_ENV_VAR];
+    const candidates = envValue ? splitAllowlist(envValue) : [];
+    const normalized = uniqueAllowlist(candidates);
+    if (normalized.length === 0) {
+        return [getWorkspaceRoot()];
+    }
+    return normalized;
+}
+function ensureBaseInAllowlist(baseDir, allowlist) {
+    const normalizedBase = normalizePath(baseDir);
+    const allowed = allowlist.some((entry) => isWithinBase(normalizedBase, entry));
+    if (!allowed) {
+        throw new errors_1.SanitizationError('Base directory is not within the configured workspace allowlist', {
+            data: {
+                baseDir: normalizedBase,
+                allowlist,
+            },
+        });
+    }
+    return normalizedBase;
+}
+async function resolveWorkspacePath(inputPath, options = {}) {
+    const allowlist = getWorkspaceAllowlist();
+    const candidateBases = options.baseDir
+        ? [ensureBaseInAllowlist(options.baseDir, allowlist)]
+        : allowlist;
+    let lastError;
+    for (const base of candidateBases) {
+        try {
+            return await (0, common_1.safeFilePath)(inputPath, {
+                ...options,
+                baseDir: base,
+            });
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    if (lastError instanceof Error) {
+        throw lastError;
+    }
+    throw new errors_1.SanitizationError('Path is not within allowed workspace directories', {
+        data: {
+            path: inputPath,
+            allowlist,
+        },
+    });
+}
+function isPathWithinWorkspace(targetPath) {
+    const allowlist = getWorkspaceAllowlist();
+    const normalizedTarget = normalizePath(targetPath);
+    return allowlist.some((entry) => isWithinBase(normalizedTarget, entry));
+}
+//# sourceMappingURL=workspace-guard.js.map

package/dist/security/workspace-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-guard.js","sourceRoot":"","sources":["../../src/security/workspace-guard.ts"],"names":[],"mappings":";;;;;AAqDA,4CASC;AAED,sDAUC;AAuBD,oDAgCC;AAED,sDAIC;AAvID,gDAAwB;AACxB,iDAAyE;AACzE,iDAAyD;AAEzD,MAAM,uBAAuB,GAAG;IAC9B,iCAAiC;IACjC,oBAAoB;IACpB,gBAAgB;CACR,CAAC;AAEX,MAAM,2BAA2B,GAAG,sCAAsC,CAAC;AAE3E,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,cAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK;SACT,KAAK,CAAC,cAAI,CAAC,SAAS,CAAC;SACrB,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACxC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;SAChC,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CAAC,UAAkB,EAAE,QAAgB;IACxD,MAAM,cAAc,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,gBAAgB,KAAK,cAAc,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,cAAI,CAAC,GAAG,CAAC;QACnD,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,GAAG,cAAc,GAAG,cAAI,CAAC,GAAG,EAAE,CAAC;IACnC,OAAO,gBAAgB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,OAA0B;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAgB,gBAAgB;IAC9B,KAAK,MAAM,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC;AAED,SAAgB,qBAAqB;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAE/C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe,EAAE,SAA4B;IAC1E,MAAM,cAAc,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAE9C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,0BAAiB,CAAC,iEAAiE,EAAE;YAC7F,IAAI,EAAE;gBACJ,OAAO,EAAE,cAAc;gBACvB,SAAS;aACV;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAOM,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,UAAgC,EAAE;IAElC,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;IAC1C,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO;QACpC,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,SAAkB,CAAC;IAEvB,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,IAAA,qBAAY,EAAC,SAAS,EAAE;gBACnC,GAAG,OAAO;gBACV,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IAED,IAAI,SAAS,YAAY,KAAK,EAAE,CAAC;QAC/B,MAAM,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,0BAAiB,CAAC,kDAAkD,EAAE;QAC9E,IAAI,EAAE;YACJ,IAAI,EAAE,SAAS;YACf,SAAS;SACV;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,qBAAqB,CAAC,UAAkB;IACtD,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;IAC1C,MAAM,gBAAgB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/dist/server-health.d.ts

@@ -0,0 +1,73 @@
+/**
+ * MCP Server Health Module
+ *
+ * Tracks server process health and detects stale code (build drift).
+ * At startup, captures the build manifest from dist/.build-manifest.json.
+ * At runtime, re-reads the manifest to detect if a rebuild has occurred
+ * since the server started.
+ *
+ * @module server-health
+ */
+/**
+ * Build manifest written by scripts/generate-build-manifest.js
+ */
+export interface BuildManifest {
+    /** SHA-256 hash of all compiled JS files */
+    buildHash: string;
+    /** ISO timestamp of the build */
+    buildTime: string;
+    /** Number of JS files in the build */
+    fileCount: number;
+}
+/**
+ * Server health status returned by getServerHealth().
+ */
+export interface ServerHealthStatus {
+    /** Server uptime in seconds */
+    uptimeSeconds: number;
+    /** Server start time as ISO string */
+    startedAt: string;
+    /** Current memory usage in MB */
+    memoryUsageMb: number;
+    /** Build manifest captured at startup (null if manifest not found) */
+    startupBuild: BuildManifest | null;
+    /** Current build manifest on disk (null if manifest not found) */
+    currentBuild: BuildManifest | null;
+    /** Whether running code matches the latest build */
+    codeIsCurrent: boolean;
+    /** Human-readable staleness message (null if code is current) */
+    stalenessMessage: string | null;
+    /** Process PID */
+    pid: number;
+    /** Node.js version */
+    nodeVersion: string;
+}
+/**
+ * Read the build manifest from disk.
+ * Returns null if the file doesn't exist or is malformed.
+ */
+export declare function readBuildManifest(distDir?: string): BuildManifest | null;
+/**
+ * Initialize server health tracking.
+ * Call this once at server startup to capture the initial build manifest.
+ */
+export declare function initServerHealth(distDir?: string): void;
+/**
+ * Get the current server health status.
+ * Re-reads the build manifest from disk to detect drift.
+ */
+export declare function getServerHealth(): ServerHealthStatus;
+/**
+ * Check if the server is running stale code.
+ * Convenience wrapper for use in onboard/health flows.
+ */
+export declare function isServerStale(): boolean;
+/**
+ * Get the startup manifest (for testing).
+ */
+export declare function getStartupManifest(): BuildManifest | null;
+/**
+ * Reset server health state (for testing).
+ */
+export declare function resetServerHealth(): void;
+//# sourceMappingURL=server-health.d.ts.map

package/dist/server-health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-health.d.ts","sourceRoot":"","sources":["../src/server-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,YAAY,EAAE,aAAa,GAAG,IAAI,CAAC;IACnC,kEAAkE;IAClE,YAAY,EAAE,aAAa,GAAG,IAAI,CAAC;IACnC,oDAAoD;IACpD,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAQD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CA4BxE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAcvD;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,kBAAkB,CAmDpD;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAGvC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,aAAa,GAAG,IAAI,CAEzD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAKxC"}