@brightbeamai/chap-coordinator-mcp 0.3.4 → 0.3.5

package/dist/index.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  AGENT_MCP_TOOLS: () => AGENT_MCP_TOOLS,
   META_CLIENT_CAPABILITIES: () => META_CLIENT_CAPABILITIES,
   META_CLIENT_INFO: () => META_CLIENT_INFO,
   META_PROTOCOL_VERSION: () => META_PROTOCOL_VERSION,
@@ -33,6 +34,7 @@ __export(src_exports, {
   TOOL_DESCRIPTIONS: () => TOOL_DESCRIPTIONS,
   TOOL_NAMES: () => TOOL_NAMES,
   UNSUPPORTED_PROTOCOL_VERSION: () => UNSUPPORTED_PROTOCOL_VERSION,
+  chapMcpHttpHandler: () => chapMcpHttpHandler,
   classifyEnvelope: () => classifyEnvelope,
   coerceToolArgs: () => coerceToolArgs,
   dispatchToolCall: () => dispatchToolCall,
@@ -42,7 +44,7 @@ __export(src_exports, {
 });
 module.exports = __toCommonJS(src_exports);
 var import_server = require("@modelcontextprotocol/sdk/server/index.js");
-var import_types2 = require("@modelcontextprotocol/sdk/types.js");
+var import_types3 = require("@modelcontextprotocol/sdk/types.js");
 var import_zod = require("zod");
 
 // src/schemas.ts
@@ -110,6 +112,18 @@ var SCHEMAS = {
         enum: ["shadow", "trial", "production"],
         default: "production",
         description: "Highest mode a task in this workspace may request. A task.create above the ceiling is refused with -32040. The ceiling can be changed afterwards with chap.control.set_mode_ceiling."
+      },
+      join_policy: {
+        type: "string",
+        enum: ["open", "invite"],
+        default: "open",
+        description: "Who may join. 'open' admits anyone. 'invite' admits only a participant an admin invited with chap.workspace.invite, and the workspace's first member, which becomes its admin; any other join is refused with -32011. It cannot be changed afterwards."
+      },
+      review_rule: {
+        type: "string",
+        pattern: "^(any_one_approves|all_approve|quorum:[1-9][0-9]*)$",
+        default: "any_one_approves",
+        description: "The rule of every review that task.complete opens here: any_one_approves, all_approve or quorum:<n>. An author cannot open a review of their own review-required task, so this is how a workspace asks for more than one approval. It cannot be changed afterwards."
       }
     },
     additionalProperties: false
@@ -131,6 +145,26 @@ var SCHEMAS = {
     },
     required: ["workspace", "profiles"]
   },
+  "chap.workspace.invite": {
+    type: "object",
+    properties: {
+      workspace: WORKSPACE_ID,
+      from: { ...PARTICIPANT_URI, description: "The admin who invites. Any other sender is refused with -32011." },
+      uri: { ...PARTICIPANT_URI, description: "The participant invited. Its scheme must name type, as at a join." },
+      type: {
+        type: "string",
+        enum: ["human", "agent", "service"],
+        description: "The kind of participant invited, which the scheme of uri must name. The member takes this type. group: and workspace: URIs name address scopes, which cannot join, and are refused with -32602."
+      },
+      role: { type: "string", description: "The role the member takes when it joins, whatever role the join names. Only an invitation grants 'admin' after the first member, and only to a human or a service." },
+      jwks: {
+        type: "object",
+        description: "Keys to pin, as {keys: [JWK, ...]}, each with a kid. The join's keys must be among them, and the member holds them. For a member that holds no key in force, the call registers these keys at once: the way back for a member whose keys were all revoked."
+      },
+      oidc_sub: { type: "string", description: "The OIDC subject whose token admits the invitee: the join must carry an oidc_token for it. Needs a token verifier on the coordinator." }
+    },
+    required: ["workspace", "from", "uri", "type"]
+  },
   "chap.participant.join": {
     type: "object",
     properties: {
@@ -138,10 +172,10 @@ var SCHEMAS = {
       from: PARTICIPANT_URI,
       type: {
         type: "string",
-        enum: ["human", "agent", "service", "group", "workspace"],
-        description: "The kind of participant. Only members of type 'human' are eligible for the review that chap.task.complete opens on a task marked review_required, and a completion with no eligible human is refused with -32011."
+        enum: ["human", "agent", "service"],
+        description: "The kind of participant, which the scheme of from must name: 'agent:' for an agent, and so on. Any other join is refused with -32602, and so is a join of a group: or workspace: URI, which names an address scope. Only members of type 'human' are eligible for the review that chap.task.complete opens on a task marked review_required, and a completion with no eligible human is refused with -32011. In a workspace that requires signatures, a participant that signs joins with a key."
       },
-      role: { type: "string", description: "Operator-defined role, e.g. 'reviewer' or 'drafter'. One value is read by the coordinator: 'admin' permits revoking another member's key." },
+      role: { type: "string", description: "Operator-defined role, e.g. 'reviewer' or 'drafter'. One value is read by the coordinator: 'admin', which changes the profiles, invites, and revokes another member's key. It is granted, never claimed: only the workspace's first member, or a participant an admin's invitation names as admin, may name it at a join, and any other join naming it is refused with -32011. Only a human or a service holds it. An invitation's role replaces the one named here." },
       display_name: { type: "string", description: "Human-readable name for interfaces. Not used in authorisation." }
     },
     required: ["workspace", "from", "type"]
@@ -257,6 +291,11 @@ var SCHEMAS = {
     },
     required: ["workspace", "from", "task_id", "to", "artefact"]
   },
+  "chap.review.acknowledge": {
+    type: "object",
+    properties: { workspace: WORKSPACE_ID, from: PARTICIPANT_URI, task_id: TASK_ID },
+    required: ["workspace", "from", "task_id"]
+  },
   "chap.decide.approve": {
     type: "object",
     properties: {
@@ -761,19 +800,21 @@ var TOOL_DESCRIPTIONS = {
   "chap.workspace.create": "Create a workspace: the container for the participants, tasks and audit log of one piece of collaborative work. Returns the workspace id, which every later call carries.",
   "chap.workspace.describe": "Report the current state of a workspace: its members, enabled profiles, audit length, and task and override counts.",
   "chap.workspace.set_profiles": "Replace the whole set of profiles enabled on a workspace. The list is not merged: any profile absent from it is dropped, so send the complete set you want. Enabling audit-scitt/1.0 on a workspace that already has entries starts the chain from that point and leaves the earlier entries permanently outside it, which chap.audit.verify_chain then reports as not_evaluated. Prefer setting profiles at chap.workspace.create, where no entries exist yet to strand.",
+  "chap.workspace.invite": "Invite a participant to a workspace, as its admin. The invitation names the type and role the member takes when it joins, and may pin its keys and its OIDC subject. A workspace whose join policy is 'invite' admits nobody else. For a member that holds no key in force, the call registers the keys it names at once, so a member whose keys were all revoked can sign again. Where a token or credential verifier is configured, an invitation names no keys for a person: their keys arrive with the token they join with (-32602).",
   "chap.participant.join": "Add a participant to a workspace. The type given, human, agent, service, group or workspace, decides whether they are eligible to review work that requires it.",
   "chap.participant.leave": "Remove a participant from a workspace. Entries they have already written stay in the audit log and their past signatures still verify, so leaving is not a way to withdraw a decision. They can no longer be assigned tasks or act as a reviewer, and returning means a fresh chap.participant.join.",
   "chap.task.create": "Create a task: a unit of work assigned to one participant. Set review_required to make completion depend on a reviewer decision rather than on the assignee. Returns a task_id that the rest of the lifecycle takes. Supplying idempotency_key is what makes a retry safe: a repeat carrying a key already seen returns the original task, while a repeat without one creates a second task. Assigning to a paused member is refused.",
-  "chap.task.update": "Move a task to a new state. Only the transitions in the specification's lifecycle table are accepted, and a task that requires review cannot be completed here.",
+  "chap.task.update": "Move a task to a new state. Only the transitions in the specification's lifecycle table are accepted, and a task that requires review cannot be completed here. A task whose review no decision has closed, or a successor that carries one on, is not declined (-32602).",
   "chap.task.complete": "Submit a task's output. A task that requires review does not complete: the output is held as the artefact under review, the task moves to review_requested, and a reviewer decision completes it. Any other task completes immediately.",
   "chap.audit.read": "Read entries from a workspace's audit log, optionally within a sequence range and filtered by method, sender, task or outcome. This is the query surface for everything the workspace has recorded, decisions and overrides included. An accepted call is under 'envelope'. A refused attempt the coordinator recorded, such as a decision by someone the review was not addressed to, is under 'request' with an 'outcome' giving the error code, and it did not take effect. Reads only: it records nothing, so it never appears in its own output. Entries come back as recorded, without aggregation, so grouping them, by tag for instance, is the reader's job.",
   // review/1.0
-  "chap.review.request": "Open a review on a task and address it to one or more reviewers. They then call chap.decide.approve, chap.decide.reject, chap.decide.override or chap.abstain.declare. Repeating the request with the same artefact adds reviewers to the open review.",
+  "chap.review.request": "Open a review on a task and address it to one or more reviewers. They then call chap.decide.approve, chap.decide.reject, chap.decide.override or chap.abstain.declare, and may first say they have begun with chap.review.acknowledge. Repeating the request with the same artefact adds reviewers to the open review. A task marked review_required is reviewed through chap.task.complete, which opens its review under the workspace's rule; on such a task this tool only adds people to a review already open, and before it opens is refused with -32011.",
+  "chap.review.acknowledge": "Say that this reviewer has begun the open review on a task, before deciding it. The call is recorded, so the audit log shows when each reviewer took the review up as well as when they decided. It decides nothing: the review stays open and the acknowledgement counts towards no rule. Only someone who may decide the review may send it, and anyone else is refused with -32011. A task with no open review is refused with -32010, and a second acknowledgement from the same reviewer in the same round with -32602. Returns requested_at, the time the round opened, which names it.",
   "chap.decide.approve": "Approve the artefact under review as it stands. Only a reviewer the review was addressed to may decide, and anyone else is refused with -32011. The task completes once the review's rule is satisfied, so under all_approve or quorum:N an approval may leave the review open awaiting others. Use chap.decide.override instead to accept a corrected version.",
   "chap.decide.reject": "Reject the artefact under review. The task is declined, or returns to in_progress when request_revision is set, which is the choice between ending the work and sending it back. Only a reviewer the review was addressed to may decide. Use chap.decide.override instead to correct the artefact and accept it rather than refuse it.",
   "chap.decide.override": "Correct the artefact under review with an RFC 6902 JSON Patch and accept the result. The patch, the rationale and any tags are recorded together, so the audit log holds what was changed and why, rather than only that the work was not accepted as written.",
   "chap.abstain.declare": "Stand aside from a review this participant cannot decide, for example on a conflict of interest or for want of context. Use it in place of chap.decide.reject, which judges the work; abstaining judges nothing and leaves the artefact intact. It requires an open review addressed to the caller and answers -32010 otherwise. The task moves to abstained, which is not terminal: chap.escalate.raise or a fresh chap.review.request can still carry it forward.",
-  "chap.escalate.raise": "Hand a task upwards, where the current holder can act but should not decide alone. The original moves to escalated and is linked to a new task for whoever takes it on. Use chap.handoff.propose to pass work sideways without that link, and chap.control.supersede to replace a task outright. The successor starts with an empty input unless one is supplied, so restate whatever the new assignee needs. A completed, cancelled or superseded task cannot be escalated. The successor takes the mode new_task.mode names, or else the original's, and requires review when the original did, or when it is a trial task under modes/1.0. A paused assignee is refused with -32063, and a mode above the workspace's current ceiling with -32040; after the ceiling is lowered, name a mode within it.",
+  "chap.escalate.raise": "Hand a task upwards, where the current holder can act but should not decide alone. The original moves to escalated and is linked to a new task for whoever takes it on. Use chap.handoff.propose to pass work sideways without that link, and chap.control.supersede to replace a task outright. The successor starts with an empty input unless one is supplied, so restate whatever the new assignee needs. A completed, cancelled or superseded task cannot be escalated. The successor takes the mode new_task.mode names, or else the original's, and requires review when the original did or held a review, or when it is a trial task under modes/1.0. Whoever made the original's work counts as an author of the successor's review. A paused assignee is refused with -32063, and a mode above the workspace's current ceiling with -32040; after the ceiling is lowered, name a mode within it.",
   // whisper/1.0
   "chap.whisper.ask": "Put one question to one or more participants, with a deadline and a default. If the deadline passes unanswered the default applies, so a task is never blocked waiting on a reply.",
   "chap.whisper.answer": "Answer an open whisper. Where the question carried options, the answer must name one of their ids and any other value is refused with -32022. A whisper already answered is refused with -32020 and one past its deadline with -32021, in which case the default supplied at chap.whisper.ask has already been applied.",
@@ -789,10 +830,10 @@ var TOOL_DESCRIPTIONS = {
   // control/1.0
   "chap.control.pause": "Pause work. Scoped to a task it moves that task to paused; to a participant it stops new tasks being assigned to them; to the workspace it refuses every method except describing, reading the audit log, joining, leaving and resuming.",
   "chap.control.resume": "Resume work paused at the same scope: a task returns to the state it held at the pause, a participant can be assigned tasks again, a workspace returns to active.",
-  "chap.control.cancel": "Cancel a task. Cancelled is terminal, and a task that has already settled cannot be cancelled.",
+  "chap.control.cancel": "Cancel a task. Cancelled is terminal, and a task that has already settled cannot be cancelled. From the moment a review the task requires opens until a reviewer rejects the work, the authors of the work cannot cancel it, even once they take the work back, nor a successor that carries its review (-32011).",
   "chap.control.snapshot": "Capture the workspace state as an artefact before a change you may want to undo. Returns a snapshot artefact id, which is the only thing chap.control.rollback accepts as a target; the label is for a human reading the log and cannot be used to select it. Taking a snapshot changes nothing. Note that a rollback restores only the mode ceiling and member roles, so a snapshot is a narrow safety net rather than a general undo.",
   "chap.control.rollback": "Restore workspace state from a snapshot. The mode ceiling and member roles are restored; the rollback is appended to the audit log rather than rewriting it.",
-  "chap.control.supersede": "Replace a task with a successor in one call. The original moves to superseded and stays linked to its replacement. The successor requires review when the original did, whatever its own review_required says, and a paused assignee is refused with -32063.",
+  "chap.control.supersede": "Replace a task with a successor in one call. The original moves to superseded and stays linked to its replacement. The successor requires review when the original did, whatever its own review_required says, and whoever made the original's work counts as an author of the successor's review. A paused assignee is refused with -32063, and from the moment a review the original requires opens until a reviewer rejects the work, the authors of the work cannot supersede it, nor a successor that carries its review (-32011).",
   "chap.control.set_mode_ceiling": "Set the highest operating mode tasks in this workspace may request. A task above the ceiling is refused.",
   // routing/1.0
   "chap.task.route": "Choose an assignee for a task from a list of candidates and reassign the task to the one selected. Use it where the choice itself belongs on the record: it writes a route_decision artefact naming the policy, the candidate chosen and the alternatives passed over, none of which is captured by setting assignee directly on chap.task.create. The default policy takes the first candidate that is a workspace member and is not paused. An operator-supplied policy may choose on any basis, and the call is refused with -32510 when its choice is not a member, or with -32063 when its choice is paused.",
@@ -843,8 +884,10 @@ var IDEMPOTENT = /* @__PURE__ */ new Set([
   // pausing an already paused target changes nothing
   "chap.control.set_mode_ceiling",
   // setting the ceiling it already has changes nothing
-  "chap.deliberate.close"
+  "chap.deliberate.close",
   // returns the same outcome, recomputing nothing
+  "chap.review.acknowledge"
+  // a second acknowledgement in the round is refused and records nothing
 ]);
 var OPEN_WORLD = /* @__PURE__ */ new Set([
   "chap.audit.submit_to_scitt",
@@ -854,6 +897,7 @@ var TITLES = {
   "chap.workspace.create": "Create workspace",
   "chap.workspace.describe": "Describe workspace",
   "chap.workspace.set_profiles": "Replace workspace profiles",
+  "chap.workspace.invite": "Invite participant",
   "chap.participant.join": "Add participant",
   "chap.participant.leave": "Remove participant",
   "chap.task.create": "Create task",
@@ -861,6 +905,7 @@ var TITLES = {
   "chap.task.complete": "Submit task output",
   "chap.audit.read": "Read audit log",
   "chap.review.request": "Request review",
+  "chap.review.acknowledge": "Acknowledge review",
   "chap.decide.approve": "Approve",
   "chap.decide.reject": "Reject",
   "chap.decide.override": "Override with a correction",
@@ -901,6 +946,19 @@ var TOOL_ANNOTATIONS = Object.fromEntries(
     openWorldHint: OPEN_WORLD.has(name)
   }])
 );
+var AGENT_MCP_TOOLS = /* @__PURE__ */ new Set([
+  "chap.task.create",
+  "chap.task.update",
+  "chap.task.complete",
+  "chap.whisper.ask",
+  "chap.decide.approve",
+  "chap.decide.reject",
+  "chap.decide.override",
+  "chap.review.acknowledge",
+  "chap.workspace.describe",
+  "chap.audit.read",
+  "chap.audit.verify_chain"
+]);
 
 // src/envelope.ts
 var import_types = require("@modelcontextprotocol/sdk/types.js");
@@ -953,6 +1011,335 @@ function readMeta(params) {
   return meta;
 }
 
+// src/remote.ts
+var ChapEndpointError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ChapEndpointError";
+  }
+};
+
+// src/http.ts
+var import_streamableHttp = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
+var import_types2 = require("@modelcontextprotocol/sdk/types.js");
+var HEADER_MISMATCH = -32020;
+var DEFAULT_MAX_BODY_BYTES = 1048576 + 65536;
+var DEFAULT_TIMEOUT_MS = 45e3;
+var HANDSHAKE_VERSIONS = import_types2.SUPPORTED_PROTOCOL_VERSIONS.filter(
+  (v) => !MODERN_PROTOCOL_VERSIONS.includes(v)
+);
+var MODERN_METHODS = /* @__PURE__ */ new Set(["server/discover", "tools/list", "tools/call"]);
+var ROUTING_HEADERS = /* @__PURE__ */ new Set(["mcp-protocol-version", "mcp-method", "mcp-name"]);
+var STATUS_FOR_CODE = /* @__PURE__ */ new Map([
+  [import_types2.ErrorCode.ParseError, 400],
+  [import_types2.ErrorCode.InvalidRequest, 400],
+  [import_types2.ErrorCode.InvalidParams, 400],
+  [HEADER_MISMATCH, 400],
+  [UNSUPPORTED_PROTOCOL_VERSION, 400],
+  [import_types2.ErrorCode.MethodNotFound, 404]
+]);
+var NOT_ONE_MESSAGE = "Body must be a single JSON-RPC request or notification object";
+var INTERNAL = { code: import_types2.ErrorCode.InternalError, message: "Internal error" };
+function mcpHttpHandler(settings) {
+  return async function handle(req, res, parsedBody) {
+    try {
+      const hosts = servedHosts(req, settings.allowedHosts);
+      if (!hosts.has((req.headers.host ?? "").toLowerCase())) {
+        answer(res, 421, { code: import_types2.ErrorCode.InvalidRequest, message: "Unknown host: add it to allowedHosts to serve under that name" });
+        return;
+      }
+      if (foreignOrigin(req.headers.origin, hosts, settings.allowedOrigins)) {
+        answer(res, 403, { code: import_types2.ErrorCode.InvalidRequest, message: "Cross-origin requests are refused: add the origin to allowedOrigins to serve it" });
+        return;
+      }
+      if (req.method !== "POST") {
+        res.writeHead(405, { allow: "POST" }).end();
+        return;
+      }
+      const declared = req.headers["mcp-protocol-version"];
+      if (declared === void 0 || typeof declared === "string" && HANDSHAKE_VERSIONS.includes(declared)) {
+        await handshake(settings, req, res, parsedBody);
+        return;
+      }
+      await singleExchange(settings, req, res, parsedBody);
+    } catch (err) {
+      console.error("MCP request failed:", err);
+      if (!res.headersSent) answer(res, 500, INTERNAL);
+      else res.destroy();
+    }
+  };
+}
+async function handshake(settings, req, res, parsedBody) {
+  let body = parsedBody;
+  if (body === void 0 && isJsonType(req.headers["content-type"])) {
+    const read = await readJson(req, res, settings.maxBodyBytes);
+    if (!read) return;
+    body = read.value;
+  }
+  if (Array.isArray(body)) {
+    answer(res, 400, { code: import_types2.ErrorCode.InvalidRequest, message: "A batch is not accepted: send each JSON-RPC message in a POST of its own" });
+    return;
+  }
+  const header = req.headers["mcp-protocol-version"];
+  const version = envelopeVersion(body);
+  if (version !== void 0 && version !== header) {
+    answer(res, 400, {
+      code: HEADER_MISMATCH,
+      message: header === void 0 ? "mcp-protocol-version header is missing, and the request envelope declares a protocol version" : "mcp-protocol-version header does not match the request envelope's protocol version"
+    }, idOf(body));
+    return;
+  }
+  const id = (0, import_types2.isJSONRPCRequest)(body) ? body.id : void 0;
+  const server = settings.makeServer();
+  const transport = new import_streamableHttp.StreamableHTTPServerTransport({ sessionIdGenerator: void 0, maxRequestBodySize: settings.maxBodyBytes });
+  const timer = setTimeout(() => {
+    console.error(`MCP request ${JSON.stringify(id ?? null)} had no answer within ${settings.timeoutMs} ms`);
+    if (!res.headersSent) answer(res, 500, INTERNAL, id);
+    else if (id !== void 0) transport.send({ jsonrpc: "2.0", id, error: INTERNAL }).catch(() => res.destroy());
+    else res.destroy();
+  }, settings.timeoutMs);
+  res.on("close", () => {
+    clearTimeout(timer);
+    void transport.close();
+    void server.close();
+  });
+  await server.connect(transport);
+  await transport.handleRequest(req, res, body);
+}
+async function singleExchange(settings, req, res, parsedBody) {
+  if (!acceptsJson(req.headers.accept)) {
+    res.writeHead(406).end();
+    return;
+  }
+  if (!isJsonType(req.headers["content-type"])) {
+    answer(res, 415, { code: import_types2.ErrorCode.InvalidRequest, message: "Unsupported Media Type: Content-Type must be application/json" });
+    return;
+  }
+  let body = parsedBody;
+  if (body === void 0) {
+    const read = await readJson(req, res, settings.maxBodyBytes);
+    if (!read) return;
+    body = read.value;
+  }
+  if (isObject(body) && !("id" in body)) {
+    if (!(0, import_types2.isJSONRPCNotification)(body)) {
+      answer(res, 400, { code: import_types2.ErrorCode.InvalidRequest, message: NOT_ONE_MESSAGE });
+      return;
+    }
+    const version = String(req.headers["mcp-protocol-version"]);
+    if (!MODERN_PROTOCOL_VERSIONS.includes(version)) {
+      answer(res, 400, unsupported(version));
+      return;
+    }
+    res.writeHead(202).end();
+    return;
+  }
+  if (!(0, import_types2.isJSONRPCRequest)(body)) {
+    answer(res, 400, { code: import_types2.ErrorCode.InvalidRequest, message: NOT_ONE_MESSAGE }, idOf(body));
+    return;
+  }
+  const refusal = duplicatedHeader(req.rawHeaders) ?? classify(body, req.headers);
+  if (refusal) {
+    answer(res, STATUS_FOR_CODE.get(refusal.code) ?? 200, refusal, body.id);
+    return;
+  }
+  if (!MODERN_METHODS.has(body.method)) {
+    answer(res, 404, { code: import_types2.ErrorCode.MethodNotFound, message: "Method not found", data: body.method }, body.id);
+    return;
+  }
+  if (!validParams(body)) {
+    answer(res, 400, { code: import_types2.ErrorCode.InvalidParams, message: "Invalid request parameters" }, body.id);
+    return;
+  }
+  const outcome = await exchange(settings, res, body);
+  switch (outcome.kind) {
+    case "reply": {
+      const error = outcome.message.error;
+      const status = error ? STATUS_FOR_CODE.get(error.code) ?? 200 : 200;
+      res.writeHead(status, { "content-type": "application/json" }).end(JSON.stringify(outcome.message));
+      return;
+    }
+    case "gone":
+      return;
+    case "timeout":
+      console.error(`MCP request ${JSON.stringify(body.id)} had no answer within ${settings.timeoutMs} ms`);
+      answer(res, 500, INTERNAL, body.id);
+      return;
+    case "error":
+      console.error("MCP request failed:", outcome.error);
+      answer(res, 500, INTERNAL, body.id);
+  }
+}
+async function exchange(settings, res, request) {
+  let settle;
+  const outcome = new Promise((resolve) => {
+    settle = resolve;
+  });
+  const timer = setTimeout(() => settle({ kind: "timeout" }), settings.timeoutMs);
+  const gone = () => settle({ kind: "gone" });
+  res.once("close", gone);
+  const server = settings.makeServer();
+  server.onerror = (error) => settle({ kind: "error", error });
+  const transport = new SingleExchangeTransport((message) => settle({ kind: "reply", message }));
+  try {
+    await server.connect(transport);
+    transport.onmessage?.(request);
+    return await outcome;
+  } finally {
+    clearTimeout(timer);
+    res.off("close", gone);
+    await server.close();
+  }
+}
+function classify(body, headers) {
+  const meta = isObject(body.params) ? body.params._meta : void 0;
+  if (!isObject(meta)) {
+    return {
+      code: import_types2.ErrorCode.InvalidParams,
+      message: `params._meta must be an object carrying the required '${META_PROTOCOL_VERSION}' and '${META_CLIENT_CAPABILITIES}' envelope keys`
+    };
+  }
+  const missing = [META_PROTOCOL_VERSION, META_CLIENT_CAPABILITIES].filter((key) => !(key in meta));
+  if (missing.length) {
+    return { code: import_types2.ErrorCode.InvalidParams, message: `params._meta is missing the required envelope key(s): ${missing.join(", ")}` };
+  }
+  const version = meta[META_PROTOCOL_VERSION];
+  if (headers["mcp-protocol-version"] !== version) {
+    return { code: HEADER_MISMATCH, message: "mcp-protocol-version header does not match the request envelope's protocol version" };
+  }
+  if (headers["mcp-method"] !== body.method) {
+    return { code: HEADER_MISMATCH, message: "mcp-method header does not match the request body's method" };
+  }
+  const named = body.method === "tools/call" && isObject(body.params) ? body.params.name : void 0;
+  if (named !== void 0 && named !== null && decodeHeaderValue(headers["mcp-name"]) !== named) {
+    return { code: HEADER_MISMATCH, message: "mcp-name header does not match the request body's 'name' parameter" };
+  }
+  if (!MODERN_PROTOCOL_VERSIONS.includes(version)) return unsupported(String(version));
+  return null;
+}
+function validParams(body) {
+  const params = body.params ?? {};
+  if (body.method === "tools/call") {
+    return typeof params.name === "string" && (params.arguments === void 0 || isObject(params.arguments));
+  }
+  if (body.method === "tools/list") return params.cursor === void 0 || typeof params.cursor === "string";
+  return true;
+}
+function unsupported(requested) {
+  return { code: UNSUPPORTED_PROTOCOL_VERSION, message: "Unsupported protocol version", data: { supported: [...MODERN_PROTOCOL_VERSIONS], requested } };
+}
+function duplicatedHeader(rawHeaders) {
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < rawHeaders.length; i += 2) {
+    const name = rawHeaders[i].toLowerCase();
+    if (!ROUTING_HEADERS.has(name)) continue;
+    if (seen.has(name)) return { code: HEADER_MISMATCH, message: `${name} header appears more than once` };
+    seen.add(name);
+  }
+  return null;
+}
+function decodeHeaderValue(value) {
+  if (typeof value !== "string") return void 0;
+  const m = /^=\?base64\?(.*)\?=$/.exec(value);
+  if (!m) return value;
+  const bytes = Buffer.from(m[1], "base64");
+  if (bytes.toString("base64") !== m[1]) return void 0;
+  const text = new TextDecoder("utf-8", { fatal: true });
+  try {
+    return text.decode(bytes);
+  } catch {
+    return void 0;
+  }
+}
+function envelopeVersion(body) {
+  const meta = isObject(body) && isObject(body.params) ? body.params._meta : void 0;
+  const version = isObject(meta) ? meta[META_PROTOCOL_VERSION] : void 0;
+  return version === null ? void 0 : version;
+}
+function servedHosts(req, extra) {
+  const port = req.socket.localPort;
+  return /* @__PURE__ */ new Set([`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`, ...extra]);
+}
+function foreignOrigin(origin, hosts, origins) {
+  if (origin === void 0) return false;
+  let url;
+  try {
+    url = new URL(origin);
+  } catch {
+    return true;
+  }
+  return !(hosts.has(url.host.toLowerCase()) || origins.includes(url.origin));
+}
+function acceptsJson(accept) {
+  return (accept ?? "").split(",").some((part) => {
+    const type = part.split(";")[0].trim().toLowerCase();
+    return type === "application/json" || type === "application/*" || type === "*/*";
+  });
+}
+function isJsonType(contentType) {
+  return (contentType ?? "").toLowerCase().startsWith("application/json");
+}
+function answer(res, status, error, id) {
+  res.writeHead(status, { "content-type": "application/json" }).end(JSON.stringify({ jsonrpc: "2.0", ...id !== void 0 ? { id } : {}, error }));
+}
+function idOf(body) {
+  if (!isObject(body)) return void 0;
+  const id = body.id;
+  return typeof id === "string" || typeof id === "number" && Number.isInteger(id) ? id : void 0;
+}
+var BodyTooLarge = class extends Error {
+};
+async function readJson(req, res, limit) {
+  let text;
+  try {
+    text = await readBody(req, limit);
+  } catch (err) {
+    if (err instanceof BodyTooLarge) {
+      answer(res, 413, { code: import_types2.ErrorCode.InvalidRequest, message: `Payload Too Large: Request body must not exceed ${limit} bytes` });
+    } else {
+      res.destroy();
+    }
+    return void 0;
+  }
+  try {
+    return { value: JSON.parse(text) };
+  } catch {
+    answer(res, 400, { code: import_types2.ErrorCode.ParseError, message: "Parse error" });
+    return void 0;
+  }
+}
+async function readBody(req, limit) {
+  if (Number(req.headers["content-length"]) > limit) throw new BodyTooLarge();
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    size += chunk.length;
+    if (size > limit) throw new BodyTooLarge();
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var SingleExchangeTransport = class {
+  constructor(onreply) {
+    this.onreply = onreply;
+  }
+  onreply;
+  onclose;
+  onerror;
+  onmessage;
+  async start() {
+  }
+  async send(message) {
+    if ("id" in message && ("result" in message || "error" in message)) this.onreply(message);
+  }
+  async close() {
+    this.onclose?.();
+  }
+};
+
 // src/index.ts
 var META_SERVER_INFO = "io.modelcontextprotocol/serverInfo";
 var LIST_TTL_MS = 36e5;
@@ -963,10 +1350,32 @@ var ServerDiscoverRequestSchema = import_zod.z.object({
   // exist in zod 3, where it stopped the package at import.
   params: import_zod.z.optional(import_zod.z.object({ _meta: import_zod.z.optional(import_zod.z.record(import_zod.z.string(), import_zod.z.unknown())) }).passthrough())
 });
+var INTERNAL_ERROR = -32603;
+var FAILED_INSIDE = { chap_error: INTERNAL_ERROR, message: "The CHAP call failed inside the server; its log has the detail." };
+function refusePerson(participant) {
+  if (participant?.startsWith("human:")) {
+    throw new Error(`participant ${participant} names a person. This server acts for an agent, and a person decides in a desk; give the agent's own URI, such as agent:assistant.`);
+  }
+}
+function pinnedSchema(schema, participant) {
+  if (!schema.properties?.from) return schema;
+  return {
+    ...schema,
+    properties: {
+      ...schema.properties,
+      from: {
+        type: "string",
+        description: `This server acts as ${participant}: it fills this in, and refuses a call that names anyone else.`
+      }
+    },
+    required: (schema.required ?? []).filter((key) => key !== "from")
+  };
+}
 function makeChapMcpServer(coord, options = {}) {
+  refusePerson(options.participant);
   const serverInfo = {
     name: options.name ?? "chap",
-    version: options.version ?? "0.3.4"
+    version: options.version ?? "0.3.5"
   };
   const server = new import_server.Server(
     serverInfo,
@@ -987,13 +1396,13 @@ function makeChapMcpServer(coord, options = {}) {
       // not already see. The annotation carries a readable one.
       title: ann?.title ?? name,
       description: TOOL_DESCRIPTIONS[name] ?? `CHAP method ${methodForTool(name)}.`,
-      inputSchema: SCHEMAS[name],
+      inputSchema: options.participant === void 0 ? SCHEMAS[name] : pinnedSchema(SCHEMAS[name], options.participant),
       // Behavioural hints. Without these a client has only the prose to go
       // on when deciding whether a call is safe to make or to retry.
       ...ann ? { annotations: ann } : {}
     };
   });
-  server.setRequestHandler(import_types2.ListToolsRequestSchema, async (request) => {
+  server.setRequestHandler(import_types3.ListToolsRequestSchema, async (request) => {
     const era = classifyEnvelope(request.params);
     if (era === "legacy") return { tools: enabledTools };
     return {
@@ -1006,7 +1415,7 @@ function makeChapMcpServer(coord, options = {}) {
   });
   server.setRequestHandler(ServerDiscoverRequestSchema, async (request) => {
     if (classifyEnvelope(request.params) === "legacy") {
-      throw new ProtocolError(import_types2.ErrorCode.MethodNotFound, "Method not found", "server/discover");
+      throw new ProtocolError(import_types3.ErrorCode.MethodNotFound, "Method not found", "server/discover");
     }
     return {
       resultType: "complete",
@@ -1018,18 +1427,15 @@ function makeChapMcpServer(coord, options = {}) {
       _meta: { [META_SERVER_INFO]: serverInfo }
     };
   });
-  server.setRequestHandler(import_types2.CallToolRequestSchema, async (request) => {
+  server.setRequestHandler(import_types3.CallToolRequestSchema, async (request) => {
     const era = classifyEnvelope(request.params);
     const terminal = (result) => era === "modern" ? { resultType: "complete", ...result } : result;
     const toolName = request.params.name;
     const rawArgs = request.params.arguments ?? {};
-    const method = methodForTool(toolName);
-    if (!method) {
-      return terminal({
-        isError: true,
-        content: [{ type: "text", text: `Unknown CHAP tool: ${toolName}` }]
-      });
+    if (!Object.hasOwn(SCHEMAS, toolName)) {
+      throw new ProtocolError(import_types3.ErrorCode.InvalidParams, `Unknown tool: ${toolName}`);
     }
+    const method = methodForTool(toolName);
     if (!filter(toolName)) {
       return terminal({
         isError: true,
@@ -1057,20 +1463,25 @@ function makeChapMcpServer(coord, options = {}) {
     };
     let response;
     try {
-      response = coord.dispatch(envelope);
+      response = await coord.dispatch(envelope);
     } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
+      if (e instanceof ChapEndpointError) {
+        return terminal({ isError: true, content: [{ type: "text", text: e.message }] });
+      }
+      console.error("CHAP dispatch failed:", e);
       return terminal({
         isError: true,
-        content: [{ type: "text", text: `CHAP dispatch threw: ${msg}` }]
+        content: [{ type: "text", text: FAILED_INSIDE.message }]
       });
     }
     if (response.error) {
+      const internal = response.error.code === INTERNAL_ERROR;
+      if (internal) console.error("CHAP call failed:", response.error);
       return terminal({
         isError: true,
         content: [{
           type: "text",
-          text: JSON.stringify({
+          text: JSON.stringify(internal ? FAILED_INSIDE : {
             chap_error: response.error.code,
             message: response.error.message,
             ...response.error.data !== void 0 ? { data: response.error.data } : {}
@@ -1103,8 +1514,37 @@ function dispatchToolCall(coord, toolName, args, envelopeId = "mcp-call") {
     params: coerceToolArgs(toolName, args ?? {})
   });
 }
+function chapMcpHttpHandler(coord, options = {}) {
+  const {
+    maxBodyBytes = DEFAULT_MAX_BODY_BYTES,
+    timeoutMs = DEFAULT_TIMEOUT_MS,
+    allowedHosts = [],
+    allowedOrigins = [],
+    ...serverOptions
+  } = options;
+  refusePerson(serverOptions.participant);
+  return mcpHttpHandler({
+    makeServer: () => makeChapMcpServer(coord, serverOptions),
+    maxBodyBytes,
+    timeoutMs,
+    allowedHosts: allowedHosts.map((host) => host.toLowerCase()),
+    allowedOrigins: allowedOrigins.map((origin) => {
+      let parsed;
+      try {
+        parsed = new URL(origin).origin;
+      } catch {
+        parsed = void 0;
+      }
+      if (parsed === void 0 || parsed === "null") {
+        throw new TypeError(`allowedOrigins takes origins such as http://localhost:6274; ${JSON.stringify(origin)} is not one`);
+      }
+      return parsed;
+    })
+  });
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AGENT_MCP_TOOLS,
   META_CLIENT_CAPABILITIES,
   META_CLIENT_INFO,
   META_PROTOCOL_VERSION,
@@ -1118,6 +1558,7 @@ function dispatchToolCall(coord, toolName, args, envelopeId = "mcp-call") {
   TOOL_DESCRIPTIONS,
   TOOL_NAMES,
   UNSUPPORTED_PROTOCOL_VERSION,
+  chapMcpHttpHandler,
   classifyEnvelope,
   coerceToolArgs,
   dispatchToolCall,