@classcad/mcp 0.1.0

package/dist/auth.js

@@ -0,0 +1,272 @@
+// auth.ts — the MCP works for signed-in classcad.ch accounts.
+//
+// Sign-in is the loopback flow command-line tools use (gh, gcloud, firebase):
+//
+//   1. beginLogin() opens a one-shot listener on 127.0.0.1:<random port> and
+//      returns https://classcad.ch/connect?port=<port>&state=<random>.
+//   2. The user opens that link. classcad.ch signs them in (or up) with the
+//      existing Firebase accounts: Google, GitHub, email. Already signed in,
+//      it is one "Continue" click.
+//   3. The site sends the browser to http://127.0.0.1:<port>/callback#state=…&token=…
+//      The Firebase refresh token rides in the FRAGMENT, which never reaches
+//      a server log; the callback page POSTs it to this listener (same
+//      origin) and wipes it from the address bar.
+//   4. The MCP exchanges the refresh token at Firebase (proof that the account
+//      exists and is enabled), stores it in ~/.classcad-mcp/auth.json and
+//      resolves everyone waiting in waitForLogin() — that is how the agent
+//      learns "done": the `login` tool it is waiting on returns.
+//
+// Every later use refreshes the token at most once an hour (Firebase records
+// that as the account's last refresh). A rejected token (account disabled or
+// deleted, token revoked) signs the machine out; an unreachable Firebase is
+// tolerated for OFFLINE_GRACE_MS after the last successful check.
+import { createServer } from 'node:http';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+/** Firebase project whose accounts may use the MCP (classcad.ch / buerli.io accounts). */
+const PROJECT = process.env.CLASSCAD_AUTH_PROJECT || 'buerli';
+/** The project's public web API key (the same one classcad.ch ships). */
+const API_KEY = process.env.CLASSCAD_AUTH_API_KEY || 'AIzaSyCzKhVOXJOwLtmK9SjCoEEIkZ6N7ilSp9E';
+const TOKEN_URL = process.env.CLASSCAD_AUTH_TOKEN_URL || 'https://securetoken.googleapis.com/v1/token';
+/** The page that signs the user in and hands the token back. */
+const LOGIN_URL = process.env.CLASSCAD_AUTH_URL || 'https://classcad.ch/connect';
+const AUTH_FILE = process.env.CLASSCAD_AUTH_FILE || join(homedir(), '.classcad-mcp', 'auth.json');
+const OFFLINE_GRACE_MS = 14 * 24 * 3600 * 1000;
+const LOGIN_TTL_MS = 15 * 60 * 1000;
+/** The token was refused by Firebase: the sign-in is gone for good. */
+class Rejected extends Error {
+}
+// ─── storage ───────────────────────────────────────────────────────────────
+function readStored() {
+    try {
+        const s = JSON.parse(readFileSync(AUTH_FILE, 'utf8'));
+        return s.refreshToken && s.project === PROJECT ? s : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeStored(s) {
+    mkdirSync(dirname(AUTH_FILE), { recursive: true });
+    writeFileSync(AUTH_FILE, JSON.stringify(s, null, 2), { mode: 0o600 });
+}
+// ─── verification ──────────────────────────────────────────────────────────
+/** Firebase's answers for a refresh token that will never work again. */
+const DEAD_TOKEN = /^(TOKEN_EXPIRED|USER_DISABLED|USER_NOT_FOUND|INVALID_REFRESH_TOKEN|MISSING_REFRESH_TOKEN|PROJECT_NUMBER_MISMATCH)\b/;
+/** Exchanges a refresh token at Firebase. Throws Rejected for a dead token, anything else for "unreachable/misconfigured". */
+async function exchange(refreshToken) {
+    const res = await fetch(`${TOKEN_URL}?key=${encodeURIComponent(API_KEY)}`, {
+        method: 'POST',
+        // The web API key only serves the sites it is restricted to; the MCP
+        // speaks for the sign-in page's site.
+        headers: { 'content-type': 'application/x-www-form-urlencoded', referer: `${new URL(LOGIN_URL).origin}/` },
+        body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: refreshToken }),
+        signal: AbortSignal.timeout(15000),
+    });
+    const body = (await res.json().catch(() => ({})));
+    const message = String(body?.error?.message ?? `HTTP ${res.status}`);
+    if (DEAD_TOKEN.test(message))
+        throw new Rejected(message);
+    if (!res.ok)
+        throw new Error(`Firebase answered ${res.status}: ${message}`);
+    const claims = JSON.parse(Buffer.from(String(body.id_token).split('.')[1] ?? '', 'base64url').toString('utf8') || '{}');
+    if (claims.aud !== PROJECT)
+        throw new Rejected(`token belongs to project "${claims.aud}", not "${PROJECT}"`);
+    return {
+        account: { uid: claims.user_id ?? claims.sub ?? body.user_id, email: claims.email ?? null, name: claims.name ?? null },
+        refreshToken: body.refresh_token ?? refreshToken,
+        expiresAt: Date.now() + Number(body.expires_in ?? 3600) * 1000,
+    };
+}
+let verifiedUntil = 0;
+let checking = null;
+/** The current sign-in, checked against Firebase at most once per token lifetime. */
+export function authStatus() {
+    const stored = readStored();
+    if (!stored) {
+        verifiedUntil = 0;
+        return Promise.resolve({ signedIn: false, reason: 'not signed in' });
+    }
+    const account = { uid: stored.uid, email: stored.email, name: stored.name };
+    if (Date.now() < verifiedUntil)
+        return Promise.resolve({ signedIn: true, account });
+    checking ??= (async () => {
+        try {
+            const r = await exchange(stored.refreshToken);
+            writeStored({ ...stored, ...r.account, refreshToken: r.refreshToken, verifiedAt: Date.now() });
+            verifiedUntil = r.expiresAt - 60_000;
+            return { signedIn: true, account: r.account };
+        }
+        catch (err) {
+            if (err instanceof Rejected) {
+                rmSync(AUTH_FILE, { force: true });
+                return { signedIn: false, reason: `the sign-in is no longer valid (${err.message}); sign in again` };
+            }
+            if (Date.now() - stored.verifiedAt < OFFLINE_GRACE_MS)
+                return { signedIn: true, account, offline: true };
+            return { signedIn: false, reason: `could not reach Firebase to confirm the sign-in (${err.message})` };
+        }
+        finally {
+            checking = null;
+        }
+    })();
+    return checking;
+}
+/** Forgets the sign-in on this machine. */
+export function logout() {
+    verifiedUntil = 0;
+    const had = existsSync(AUTH_FILE);
+    rmSync(AUTH_FILE, { force: true });
+    return had;
+}
+let pending = null;
+/**
+ * Starts a sign-in (or returns the one already waiting): the link the user
+ * has to open. `client` names the host on the page ("Claude Code").
+ */
+export async function beginLogin(client) {
+    if (pending && Date.now() < pending.expiresAt)
+        return { url: pending.url, expiresAt: pending.expiresAt };
+    const state = randomBytes(24).toString('base64url');
+    let resolve;
+    let reject;
+    const done = new Promise((res, rej) => ((resolve = res), (reject = rej)));
+    done.catch(() => { });
+    const server = createServer((req, res) => handle(req, res).catch(err => send(res, 500, { ok: false, error: String(err?.message ?? err) })));
+    await new Promise((res, rej) => server.once('error', rej).listen(0, '127.0.0.1', () => res()));
+    const port = server.address().port;
+    const q = new URLSearchParams({ port: String(port), state });
+    if (client)
+        q.set('client', client);
+    const p = { url: `${LOGIN_URL}?${q}`, state, port, server, expiresAt: Date.now() + LOGIN_TTL_MS, done, resolve, reject };
+    pending = p;
+    const timer = setTimeout(() => finish(p, new Error('the sign-in link expired')), LOGIN_TTL_MS);
+    timer.unref();
+    server.unref();
+    return { url: p.url, expiresAt: p.expiresAt };
+    async function handle(req, res) {
+        // Only this listener's own address: no DNS rebinding, no other sites.
+        if (req.headers.host !== `127.0.0.1:${port}`)
+            return send(res, 403, { ok: false, error: 'forbidden' });
+        const path = new URL(req.url ?? '/', `http://127.0.0.1:${port}`).pathname;
+        if (req.method === 'GET' && path === '/callback') {
+            res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' });
+            return res.end(callbackPage(client ?? 'your agent'));
+        }
+        if (req.method === 'POST' && path === '/complete') {
+            if (req.headers.origin !== `http://127.0.0.1:${port}`)
+                return send(res, 403, { ok: false, error: 'forbidden' });
+            const body = JSON.parse((await readBody(req)) || '{}');
+            if (!sameSecret(String(body.state ?? ''), state))
+                return send(res, 400, { ok: false, error: 'This link does not belong to the waiting sign-in. Ask your agent for a new one.' });
+            if (pending !== p)
+                return send(res, 410, { ok: false, error: 'This sign-in is already finished.' });
+            try {
+                const r = await exchange(String(body.token ?? ''));
+                writeStored({ ...r.account, refreshToken: r.refreshToken, project: PROJECT, verifiedAt: Date.now() });
+                verifiedUntil = r.expiresAt - 60_000;
+                send(res, 200, { ok: true, email: r.account.email, name: r.account.name });
+                finish(p, r.account);
+            }
+            catch (err) {
+                send(res, 400, { ok: false, error: `Sign-in was refused: ${err.message}` });
+            }
+            return;
+        }
+        send(res, 404, { ok: false, error: 'not found' });
+    }
+}
+function finish(p, result) {
+    if (pending !== p)
+        return;
+    pending = null;
+    if (result instanceof Error)
+        p.reject(result);
+    else
+        p.resolve(result);
+    // Let the callback page's response flush, then stop listening.
+    setTimeout(() => p.server.close(), 1000).unref();
+}
+/** The link of a sign-in that is still waiting, if any. */
+export function pendingLogin() {
+    return pending && Date.now() < pending.expiresAt ? { url: pending.url, expiresAt: pending.expiresAt } : null;
+}
+/** Waits up to `ms` for the waiting sign-in. null = still waiting (or none started). */
+export async function waitForLogin(ms) {
+    const p = pending;
+    if (!p)
+        return null;
+    let t;
+    const timeout = new Promise(res => (t = setTimeout(() => res(null), ms)));
+    try {
+        return await Promise.race([p.done, timeout]);
+    }
+    finally {
+        clearTimeout(t);
+    }
+}
+// ─── helpers ───────────────────────────────────────────────────────────────
+function sameSecret(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        let data = '';
+        req.setEncoding('utf8');
+        req.on('data', c => {
+            data += c;
+            if (data.length > 64 * 1024)
+                req.destroy(new Error('body too large'));
+        });
+        req.on('end', () => resolve(data));
+        req.on('error', reject);
+    });
+}
+function send(res, status, body) {
+    if (res.headersSent)
+        return;
+    res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+    res.end(JSON.stringify(body));
+}
+const escapeHtml = (s) => s.replace(/[&<>"']/g, c => `&#${c.charCodeAt(0)};`);
+/** The page classcad.ch hands the browser to: posts the fragment to this listener, then says what happened. */
+function callbackPage(client) {
+    const who = escapeHtml(client);
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>ClassCAD · connecting</title>
+<style>
+  :root { color-scheme: light dark; --bg: #f6f5f2; --fg: #16161a; --muted: #6b6b73; --ok: #127a3a; --bad: #b3261e; }
+  @media (prefers-color-scheme: dark) { :root { --bg: #111114; --fg: #ececf0; --muted: #9a9aa3; --ok: #5bd48a; --bad: #ff8a80; } }
+  body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: var(--bg); color: var(--fg);
+         font: 16px/1.5 ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif; padding: 0 16px; }
+  main { max-width: 28rem; text-align: center; }
+  h1 { font-size: 1.5rem; margin: 0 0 .5rem; }
+  p { margin: .25rem 0; color: var(--muted); }
+  .ok { color: var(--ok); } .bad { color: var(--bad); }
+</style></head>
+<body><main><h1 id="t">Connecting ClassCAD …</h1><p id="m">One moment.</p></main>
+<script>
+(async () => {
+  const t = document.getElementById('t'), m = document.getElementById('m')
+  const q = new URLSearchParams(location.hash.slice(1))
+  history.replaceState(null, '', location.pathname)
+  try {
+    const r = await fetch('/complete', { method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ state: q.get('state'), token: q.get('token') }) })
+    const b = await r.json()
+    if (!b.ok) throw new Error(b.error)
+    t.textContent = 'You are signed in.'; t.className = 'ok'
+    m.textContent = 'Signed in as ' + (b.email || b.name || 'your account') + '. You can close this tab and go back to ${who}.'
+  } catch (e) {
+    t.textContent = 'That did not work.'; t.className = 'bad'
+    m.textContent = (e && e.message) || 'Ask ${who} for a new sign-in link.'
+  }
+})()
+</script></body></html>`;
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,8EAA8E;AAC9E,EAAE;AACF,6EAA6E;AAC7E,uEAAuE;AACvE,4EAA4E;AAC5E,6EAA6E;AAC7E,mCAAmC;AACnC,sFAAsF;AACtF,6EAA6E;AAC7E,uEAAuE;AACvE,kDAAkD;AAClD,+EAA+E;AAC/E,0EAA0E;AAC1E,2EAA2E;AAC3E,iEAAiE;AACjE,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,kEAAkE;AAClE,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAA;AAChG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,0FAA0F;AAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,QAAQ,CAAA;AAC7D,yEAAyE;AACzE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,yCAAyC,CAAA;AAC9F,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,6CAA6C,CAAA;AACtG,gEAAgE;AAChE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,6BAA6B,CAAA;AAChF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,WAAW,CAAC,CAAA;AAEjG,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAC9C,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAMnC,uEAAuE;AACvE,MAAM,QAAS,SAAQ,KAAK;CAAG;AAE/B,8EAA8E;AAE9E,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAW,CAAA;QAC/D,OAAO,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AACvE,CAAC;AAED,8EAA8E;AAE9E,yEAAyE;AACzE,MAAM,UAAU,GAAG,qHAAqH,CAAA;AAExI,8HAA8H;AAC9H,KAAK,UAAU,QAAQ,CAAC,YAAoB;IAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,QAAQ,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE;QACzE,MAAM,EAAE,MAAM;QACd,qEAAqE;QACrE,sCAAsC;QACtC,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,OAAO,EAAE,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,EAAE;QAC1G,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;QACvF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAwB,CAAA;IACxE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IACpE,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC,CAAA;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAA;IACvH,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,QAAQ,CAAC,6BAA6B,MAAM,CAAC,GAAG,WAAW,OAAO,GAAG,CAAC,CAAA;IAC5G,OAAO;QACL,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE;QACtH,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,YAAY;QAChD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;KAC/D,CAAA;AACH,CAAC;AAED,IAAI,aAAa,GAAG,CAAC,CAAA;AACrB,IAAI,QAAQ,GAA+B,IAAI,CAAA;AAI/C,qFAAqF;AACrF,MAAM,UAAU,UAAU;IACxB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,aAAa,GAAG,CAAC,CAAA;QACjB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,OAAO,GAAY,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;IACpF,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IACnF,QAAQ,KAAK,CAAC,KAAK,IAAyB,EAAE;QAC5C,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;YAC7C,WAAW,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC9F,aAAa,GAAG,CAAC,CAAC,SAAS,GAAG,MAAM,CAAA;YACpC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;gBAC5B,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBAClC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,GAAG,CAAC,OAAO,kBAAkB,EAAE,CAAA;YACtG,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,gBAAgB;gBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YACxG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAqD,GAAa,CAAC,OAAO,GAAG,EAAE,CAAA;QACnH,CAAC;gBAAS,CAAC;YACT,QAAQ,GAAG,IAAI,CAAA;QACjB,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,MAAM;IACpB,aAAa,GAAG,CAAC,CAAA;IACjB,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;IACjC,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,OAAO,GAAG,CAAA;AACZ,CAAC;AAcD,IAAI,OAAO,GAAmB,IAAI,CAAA;AAElC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAe;IAC9C,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAA;IACxG,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACnD,IAAI,OAA8B,CAAA;IAClC,IAAI,MAA2B,CAAA;IAC/B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAU,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IAClF,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACpB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3I,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACpG,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAA;IACxD,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5D,IAAI,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACnC,MAAM,CAAC,GAAY,EAAE,GAAG,EAAE,GAAG,SAAS,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IACjI,OAAO,GAAG,CAAC,CAAA;IACX,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;IAC9F,KAAK,CAAC,KAAK,EAAE,CAAA;IACb,MAAM,CAAC,KAAK,EAAE,CAAA;IACd,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAA;IAE7C,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC7D,sEAAsE;QACtE,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QACtG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAA;QACzE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACjD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAA;YACjI,OAAO,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,CAAC,CAAA;QACtD,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAClD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,oBAAoB,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;YAC/G,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAA;YACtD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iFAAiF,EAAE,CAAC,CAAA;YAChL,IAAI,OAAO,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAA;YACnG,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;gBAClD,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;gBACrG,aAAa,GAAG,CAAC,CAAC,SAAS,GAAG,MAAM,CAAA;gBACpC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC1E,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAyB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;YACxF,CAAC;YACD,OAAM;QACR,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IACnD,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,CAAU,EAAE,MAAuB;IACjD,IAAI,OAAO,KAAK,CAAC;QAAE,OAAM;IACzB,OAAO,GAAG,IAAI,CAAA;IACd,IAAI,MAAM,YAAY,KAAK;QAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;;QACxC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACtB,+DAA+D;IAC/D,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;AAClD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9G,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,MAAM,CAAC,GAAG,OAAO,CAAA;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,IAAI,CAA6B,CAAA;IACjC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/E,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;IAC9C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACxB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACxB,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;YACjB,IAAI,IAAI,CAAC,CAAA;YACT,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;gBAAE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA;QACvE,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QAClC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,IAAI,GAAG,CAAC,WAAW;QAAE,OAAM;IAC3B,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAA;IAC1F,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;AAErF,+GAA+G;AAC/G,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAC9B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;yHAyBgH,GAAG;;;+CAG7E,GAAG;;;wBAG1B,CAAA;AACxB,CAAC"}

package/dist/bridge/protocol.d.ts

@@ -0,0 +1,87 @@
+export declare const PROTOCOL_VERSION = 1;
+export type Capability = 'engine.execute' | 'selection.read' | 'selection.write';
+export type RawSelection = {
+    containerId: number;
+    graphicId: number;
+    prodRefId: number;
+};
+export type SelectionEntity = {
+    kind: 'face' | 'edge' | 'vertex' | 'curve' | 'unknown';
+    classcadId?: number;
+    position?: {
+        x: number;
+        y: number;
+        z: number;
+    };
+    normal?: {
+        x: number;
+        y: number;
+        z: number;
+    };
+    graphicType?: string;
+    raw: RawSelection;
+};
+export type ShareKind = 'invite' | 'bridge';
+export type AnnounceMessage = {
+    type: 'announce';
+    protocolVersion: number;
+    /** The share token this connection serves (one bridge connection per token). */
+    token: string;
+    kind: ShareKind;
+    drawingId: string;
+    app: string;
+    appVersion?: string;
+    capabilities: Capability[];
+    /** Stable per-connection id so the MCP can tell apart several apps for one token. */
+    clientId: string;
+    /** Legacy (pre-token) announce field; treated as the token when `token` is absent. */
+    sessionId?: string;
+    /** Legacy modeler announce field; treated as an 'invite' token when `token` is absent. */
+    invite?: string;
+};
+export type RequestMessage = {
+    type: 'request';
+    id: number;
+    method: BridgeMethod;
+    params?: unknown;
+};
+export type ResponseMessage = {
+    type: 'response';
+    id: number;
+    result?: unknown;
+    error?: {
+        code: string;
+        message: string;
+    };
+};
+export type EventMessage = {
+    type: 'event';
+    channel: BridgeEventChannel;
+    payload: unknown;
+};
+export type BridgeEnvelope = AnnounceMessage | RequestMessage | ResponseMessage | EventMessage;
+/** Methods the MCP calls on the app. */
+export type BridgeMethod = 'engine.execute' | 'session.attached' | 'session.detached' | 'selection.get' | 'selection.set';
+/** engine.execute reply: the engine's text messages and inflated binary graphic packages, in emission order. */
+export type EngineExecuteResult = {
+    messages: Record<string, any>[];
+    binaryMessages: Record<string, any>[];
+    /** Local WASM engine only: emitted messages that could not be decoded (dropped, never thrown into the engine). */
+    decodeErrors?: string[];
+};
+export type SessionAttachedParams = {
+    peerId: string;
+    role?: 'edit' | 'view';
+    client?: string;
+};
+export type SelectionGetResult = SelectionEntity[];
+export type SelectionSetParams = {
+    items: Array<RawSelection | {
+        classcadId: number;
+    }>;
+    replace?: boolean;
+};
+export type BridgeEventChannel = 'selection.changed';
+export type SelectionChangedPayload = {
+    items: SelectionEntity[];
+};

package/dist/bridge/protocol.js

@@ -0,0 +1,14 @@
+// bridge/protocol.ts — wire protocol between a buerli app and this MCP.
+//
+// Mirror of @buerli.io/classcad's src/bridge/protocol.ts (source of truth
+// there). Apps open an OUTBOUND WebSocket to the MCP's bridge listener and
+// announce a share token. Two kinds:
+//   • 'invite' — the app runs against a ClassCAD server; the MCP joins the
+//     server session with the token (use_session) and uses the bridge for
+//     app state (selection) only.
+//   • 'bridge' — the engine runs inside the app (WASM); the MCP relays its
+//     engine commands over this link (engine.execute) — the bridge IS the
+//     engine transport.
+// Plain TS, importable from Node and the browser.
+export const PROTOCOL_VERSION = 1;
+//# sourceMappingURL=protocol.js.map

package/dist/bridge/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/bridge/protocol.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,2EAA2E;AAC3E,qCAAqC;AACrC,2EAA2E;AAC3E,0EAA0E;AAC1E,kCAAkC;AAClC,2EAA2E;AAC3E,0EAA0E;AAC1E,wBAAwB;AACxB,kDAAkD;AAElD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAA"}

package/dist/bridge/server.d.ts

@@ -0,0 +1,35 @@
+import { WebSocket } from 'ws';
+import type { BridgeMethod, SelectionEntity, ShareKind } from './protocol.js';
+import { PROTOCOL_VERSION } from './protocol.js';
+export type AppConnection = {
+    clientId: string;
+    /** The share token this connection serves. */
+    token: string;
+    kind: ShareKind;
+    /** @deprecated alias of `token` (pre-token announces). */
+    sessionId: string;
+    drawingId: string;
+    app: string;
+    appVersion?: string;
+    capabilities: string[];
+    protocolVersion: number;
+    announcedAt: number;
+    request: <T = unknown>(method: BridgeMethod, params?: unknown) => Promise<T>;
+    onClose: (cb: () => void) => () => void;
+    cachedSelection: SelectionEntity[] | null;
+    socket: WebSocket;
+};
+export type BridgeRegistry = {
+    list: (token?: string) => AppConnection[];
+    pick: (token: string, clientId?: string) => AppConnection | null;
+    waitFor: (token: string, timeoutMs?: number) => Promise<AppConnection | null>;
+    onSelectionChanged: (sessionId: string, cb: (items: SelectionEntity[]) => void) => () => void;
+    close: () => Promise<void>;
+    readonly url: string;
+};
+export type StartBridgeOptions = {
+    listen?: string;
+    log?: (msg: string) => void;
+};
+export declare function startBridgeServer(opts?: StartBridgeOptions): Promise<BridgeRegistry>;
+export { PROTOCOL_VERSION };

package/dist/bridge/server.js

@@ -0,0 +1,236 @@
+// bridge/server.ts — WebSocket listener for CC apps to opt into.
+//
+// Apps connect outbound to ws://127.0.0.1:9096/bridge (default) and send an
+// `announce` with a share token. The MCP keeps a registry of these
+// connections keyed by clientId and indexed by token. Two uses:
+//   • kind 'invite'  — app-state bridge (selection) next to a server session
+//     the MCP joined with the same token.
+//   • kind 'bridge'  — the engine transport itself for in-app (WASM) engines:
+//     client.ts relays every engine command through `engine.execute`.
+import { WebSocketServer } from 'ws';
+import { PROTOCOL_VERSION } from './protocol.js';
+const REQUEST_TIMEOUT = 60_000; // app-side picks can be long
+export async function startBridgeServer(opts = {}) {
+    const listen = opts.listen ?? 'ws://127.0.0.1:9096/bridge';
+    const url = new URL(listen);
+    // Bind ONE address family explicitly. 'localhost' resolves to ::1 or
+    // 127.0.0.1 depending on the platform, so two processes could both hold
+    // "localhost:9096" and apps would land on either — the reason the MCP
+    // runs as a single daemon in the first place.
+    const host = (url.hostname || '127.0.0.1') === 'localhost' ? '127.0.0.1' : url.hostname;
+    const port = Number(url.port || '9096');
+    const path = url.pathname || '/bridge';
+    const wss = new WebSocketServer({ host, port, path });
+    const connections = new Map(); // clientId → conn
+    const selectionListeners = new Map();
+    // Resolvers waiting for a token to be announced (waitFor).
+    const waiters = new Map();
+    wss.on('connection', (socket) => {
+        let conn = null;
+        const pending = new Map();
+        const closeListeners = new Set();
+        const sendRaw = (env) => {
+            try {
+                socket.send(JSON.stringify(env));
+            }
+            catch (err) {
+                // socket may already be closing; safe to ignore
+            }
+        };
+        let nextId = 1;
+        const request = (method, params) => {
+            const id = nextId++;
+            return new Promise((resolve, reject) => {
+                const timer = setTimeout(() => {
+                    if (pending.has(id)) {
+                        pending.delete(id);
+                        reject(new Error(`bridge request timeout (${REQUEST_TIMEOUT}ms): ${method}`));
+                    }
+                }, REQUEST_TIMEOUT);
+                pending.set(id, { resolve: resolve, reject, timer });
+                sendRaw({ type: 'request', id, method, params });
+            });
+        };
+        socket.on('message', (data) => {
+            let env;
+            try {
+                env = JSON.parse(data.toString());
+            }
+            catch {
+                return;
+            }
+            if (env.type === 'announce') {
+                const a = env;
+                if (conn)
+                    return; // ignore re-announce on the same socket
+                // Token: current apps send `token` + `kind`; the modeler used to send
+                // its Drogon invite as `invite`, older builds a `sessionId`.
+                const token = a.token ?? a.invite ?? a.sessionId;
+                if (!token)
+                    return;
+                const kind = a.kind ?? 'invite';
+                conn = {
+                    clientId: a.clientId,
+                    token,
+                    kind,
+                    sessionId: token,
+                    drawingId: a.drawingId,
+                    app: a.app,
+                    appVersion: a.appVersion,
+                    capabilities: a.capabilities,
+                    protocolVersion: a.protocolVersion,
+                    announcedAt: Date.now(),
+                    request,
+                    onClose: (cb) => {
+                        closeListeners.add(cb);
+                        return () => {
+                            closeListeners.delete(cb);
+                        };
+                    },
+                    cachedSelection: null,
+                    socket,
+                };
+                connections.set(a.clientId, conn);
+                opts.log?.(`app ${a.clientId} (${a.app}) announced token ${token} [${a.kind ?? 'bridge'}]; ${connections.size} app(s)`);
+                const waiting = waiters.get(token);
+                if (waiting) {
+                    waiters.delete(token);
+                    for (const resolve of waiting)
+                        resolve(conn);
+                }
+                return;
+            }
+            if (env.type === 'response') {
+                const r = env;
+                const p = pending.get(r.id);
+                if (!p)
+                    return;
+                pending.delete(r.id);
+                if (p.timer)
+                    clearTimeout(p.timer);
+                if (r.error) {
+                    p.reject(new Error(`${r.error.code}: ${r.error.message}`));
+                }
+                else {
+                    p.resolve(r.result);
+                }
+                return;
+            }
+            if (env.type === 'event' && conn) {
+                const e = env;
+                if (e.channel === 'selection.changed') {
+                    const payload = (e.payload ?? {});
+                    const items = payload.items ?? [];
+                    conn.cachedSelection = items;
+                    const subs = selectionListeners.get(conn.sessionId);
+                    if (subs)
+                        for (const cb of subs)
+                            try {
+                                cb(items);
+                            }
+                            catch { }
+                }
+                return;
+            }
+        });
+        socket.on('close', () => {
+            // reject any in-flight requests
+            for (const [, p] of pending) {
+                try {
+                    p.reject(new Error('bridge socket closed'));
+                }
+                catch { }
+                if (p.timer)
+                    clearTimeout(p.timer);
+            }
+            pending.clear();
+            if (conn) {
+                connections.delete(conn.clientId);
+                opts.log?.(`app ${conn.clientId} (${conn.app}) gone (token ${conn.token}); ${connections.size} app(s)`);
+            }
+            for (const cb of closeListeners)
+                try {
+                    cb();
+                }
+                catch { }
+            closeListeners.clear();
+        });
+        socket.on('error', () => { });
+    });
+    // wait for listening, but don't block other startup if the port is busy —
+    // surface the error to the caller.
+    await new Promise((resolve, reject) => {
+        wss.once('listening', () => resolve());
+        wss.once('error', (err) => reject(err));
+    });
+    return {
+        url: `ws://${host}:${port}${path}`,
+        list: (token) => {
+            const all = [...connections.values()];
+            return token ? all.filter(c => c.token === token) : all;
+        },
+        pick: (token, clientId) => {
+            if (clientId)
+                return connections.get(clientId) ?? null;
+            const matches = [...connections.values()].filter(c => c.token === token);
+            if (matches.length === 0)
+                return null;
+            // most recently announced wins
+            matches.sort((a, b) => b.announcedAt - a.announcedAt);
+            return matches[0];
+        },
+        waitFor: (token, timeoutMs = 5_000) => {
+            const now = [...connections.values()].filter(c => c.token === token).sort((a, b) => b.announcedAt - a.announcedAt)[0];
+            if (now)
+                return Promise.resolve(now);
+            return new Promise(resolve => {
+                let set = waiters.get(token);
+                if (!set) {
+                    set = new Set();
+                    waiters.set(token, set);
+                }
+                const target = set;
+                const cb = (c) => {
+                    clearTimeout(timer);
+                    resolve(c);
+                };
+                const timer = setTimeout(() => {
+                    target.delete(cb);
+                    if (target.size === 0)
+                        waiters.delete(token);
+                    resolve(null);
+                }, timeoutMs);
+                target.add(cb);
+            });
+        },
+        onSelectionChanged: (sessionId, cb) => {
+            let set = selectionListeners.get(sessionId);
+            if (!set) {
+                set = new Set();
+                selectionListeners.set(sessionId, set);
+            }
+            set.add(cb);
+            return () => {
+                const s = selectionListeners.get(sessionId);
+                if (!s)
+                    return;
+                s.delete(cb);
+                if (s.size === 0)
+                    selectionListeners.delete(sessionId);
+            };
+        },
+        close: async () => {
+            for (const [, conn] of connections) {
+                try {
+                    conn.socket.close();
+                }
+                catch { }
+            }
+            connections.clear();
+            await new Promise((resolve) => wss.close(() => resolve()));
+        },
+    };
+}
+// re-export PROTOCOL_VERSION for callers that want to log compat info
+export { PROTOCOL_VERSION };
+//# sourceMappingURL=server.js.map