@cleocode/cleo 2026.2.5

package/dist/dispatch/middleware/audit.js

@@ -0,0 +1,345 @@
+/**
+ * Audit Trail for MCP Server Mutations
+ *
+ * Logs all write operations to .cleo/audit-log.json for compliance
+ * and debugging purposes.
+ *
+ * @task T2920
+ * @task T2929
+ */
+import { promises as fs } from 'fs';
+import { join } from 'path';
+import { getConfig } from '../../mcp/lib/config.js';
+/**
+ * Maximum audit log size in bytes before rotation (default: 10MB)
+ */
+const MAX_AUDIT_LOG_SIZE = 10 * 1024 * 1024;
+/**
+ * Get audit log file path
+ */
+function getAuditLogPath() {
+    // Default to .cleo/audit-log.json in project root
+    return join(process.cwd(), '.cleo', 'audit-log.json');
+}
+/**
+ * Get current session ID from environment or config
+ */
+function getCurrentSessionId() {
+    // TODO: Integrate with session system when available
+    return process.env.CLEO_SESSION_ID || null;
+}
+/**
+ * Ensure .cleo directory exists
+ */
+async function ensureCleoDir() {
+    const cleoDir = join(process.cwd(), '.cleo');
+    try {
+        await fs.mkdir(cleoDir, { recursive: true });
+    }
+    catch (error) {
+        // Ignore if already exists
+        if (error.code !== 'EEXIST') {
+            throw error;
+        }
+    }
+}
+/**
+ * Log mutation to audit trail
+ *
+ * Appends a single-line JSON entry to .cleo/audit-log.json
+ * Non-blocking - errors are logged but not thrown
+ * Automatically rotates log if size exceeds limit
+ *
+ * @param entry Audit entry to log
+ */
+export async function logMutation(entry) {
+    try {
+        // Check if audit logging is enabled
+        const config = getConfig();
+        if (!config.auditLog) {
+            return; // Audit logging disabled
+        }
+        // Ensure .cleo directory exists
+        await ensureCleoDir();
+        // Get audit log path
+        const logPath = getAuditLogPath();
+        // Check if rotation is needed
+        await checkAndRotateLog(logPath);
+        // Serialize entry as single-line JSON
+        const line = JSON.stringify(entry) + '\n';
+        // Append to log file
+        await fs.appendFile(logPath, line, 'utf8');
+    }
+    catch (error) {
+        // Log error but don't throw - audit logging should not block operations
+        console.error('Failed to write audit log entry:', error);
+    }
+}
+/**
+ * Log error to audit trail
+ *
+ * Convenience function for logging errors with full context
+ *
+ * @param domain Domain where error occurred
+ * @param operation Operation that failed
+ * @param error Error object or message
+ * @param params Operation parameters
+ * @param exitCode Exit code (default: 1)
+ */
+export async function logError(domain, operation, error, params = {}, exitCode = 1) {
+    // Check if audit logging is enabled
+    const config = getConfig();
+    if (!config.auditLog) {
+        return; // Audit logging disabled
+    }
+    const errorMessage = error instanceof Error ? error.message : error;
+    const taskId = typeof params.taskId === 'string' ? params.taskId : undefined;
+    const entry = {
+        timestamp: new Date().toISOString(),
+        sessionId: getCurrentSessionId(),
+        domain,
+        operation,
+        params,
+        result: {
+            success: false,
+            exitCode,
+            duration: 0,
+        },
+        metadata: {
+            taskId,
+            source: 'mcp',
+        },
+        error: errorMessage,
+    };
+    await logMutation(entry);
+}
+/**
+ * Read audit log entries
+ *
+ * @param options Filter options
+ * @returns Array of audit entries
+ */
+export async function readAuditLog(options) {
+    try {
+        const logPath = getAuditLogPath();
+        // Read log file
+        const content = await fs.readFile(logPath, 'utf8');
+        // Parse JSONL
+        const entries = content
+            .split('\n')
+            .filter((line) => line.trim())
+            .map((line) => JSON.parse(line));
+        // Apply filters
+        let filtered = entries;
+        if (options?.since) {
+            filtered = filtered.filter((e) => e.timestamp >= options.since);
+        }
+        if (options?.domain) {
+            filtered = filtered.filter((e) => e.domain === options.domain);
+        }
+        if (options?.operation) {
+            filtered = filtered.filter((e) => e.operation === options.operation);
+        }
+        if (options?.success !== undefined) {
+            filtered = filtered.filter((e) => e.result.success === options.success);
+        }
+        // Apply limit
+        if (options?.limit) {
+            filtered = filtered.slice(-options.limit);
+        }
+        return filtered;
+    }
+    catch (error) {
+        // If file doesn't exist, return empty array
+        if (error.code === 'ENOENT') {
+            return [];
+        }
+        throw error;
+    }
+}
+/**
+ * Get audit statistics
+ *
+ * @returns Audit statistics
+ */
+export async function getAuditStats() {
+    const entries = await readAuditLog();
+    const stats = {
+        totalEntries: entries.length,
+        successCount: entries.filter((e) => e.result.success).length,
+        failureCount: entries.filter((e) => !e.result.success).length,
+        byDomain: {},
+        byOperation: {},
+        avgDuration: 0,
+    };
+    // Count by domain
+    for (const entry of entries) {
+        stats.byDomain[entry.domain] = (stats.byDomain[entry.domain] || 0) + 1;
+        const opKey = `${entry.domain}.${entry.operation}`;
+        stats.byOperation[opKey] = (stats.byOperation[opKey] || 0) + 1;
+    }
+    // Calculate average duration
+    const durations = entries.filter((e) => e.result.duration).map((e) => e.result.duration);
+    if (durations.length > 0) {
+        stats.avgDuration = durations.reduce((a, b) => a + b, 0) / durations.length;
+    }
+    return stats;
+}
+/**
+ * Clear audit log (use with caution)
+ *
+ * @returns Number of entries cleared
+ */
+export async function clearAuditLog() {
+    try {
+        const entries = await readAuditLog();
+        const count = entries.length;
+        const logPath = getAuditLogPath();
+        await fs.unlink(logPath);
+        return count;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return 0;
+        }
+        throw error;
+    }
+}
+/**
+ * Check and rotate audit log if size exceeds limit
+ *
+ * Rotates log to timestamped archive file when size exceeds MAX_AUDIT_LOG_SIZE
+ *
+ * @param logPath Path to audit log file
+ */
+async function checkAndRotateLog(logPath) {
+    try {
+        const stats = await fs.stat(logPath);
+        if (stats.size >= MAX_AUDIT_LOG_SIZE) {
+            const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+            const archivePath = join(process.cwd(), '.cleo', `audit-log-${timestamp}.json`);
+            // Move current log to archive
+            await fs.rename(logPath, archivePath);
+            console.log(`Rotated audit log: ${archivePath} (${stats.size} bytes)`);
+        }
+    }
+    catch (error) {
+        // If file doesn't exist, no rotation needed
+        if (error.code !== 'ENOENT') {
+            console.error('Failed to check/rotate audit log:', error);
+        }
+    }
+}
+/**
+ * Manually rotate audit log
+ *
+ * Forces rotation regardless of size
+ *
+ * @returns Path to rotated log file
+ */
+export async function rotateLog() {
+    try {
+        const logPath = getAuditLogPath();
+        const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+        const archivePath = join(process.cwd(), '.cleo', `audit-log-${timestamp}.json`);
+        // Check if log exists
+        try {
+            await fs.access(logPath);
+        }
+        catch {
+            return null; // No log to rotate
+        }
+        // Move current log to archive
+        await fs.rename(logPath, archivePath);
+        return archivePath;
+    }
+    catch (error) {
+        console.error('Failed to rotate audit log:', error);
+        return null;
+    }
+}
+/**
+ * Archive old audit entries
+ *
+ * Moves entries older than specified date to archive file
+ *
+ * @param beforeDate ISO date string
+ * @returns Number of entries archived
+ */
+export async function archiveAuditLog(beforeDate) {
+    try {
+        const entries = await readAuditLog();
+        const toArchive = entries.filter((e) => e.timestamp < beforeDate);
+        const toKeep = entries.filter((e) => e.timestamp >= beforeDate);
+        if (toArchive.length === 0) {
+            return 0;
+        }
+        // Write archive file
+        const archivePath = join(process.cwd(), '.cleo', `audit-log-archive-${beforeDate}.json`);
+        const archiveContent = toArchive.map((e) => JSON.stringify(e)).join('\n') + '\n';
+        await fs.writeFile(archivePath, archiveContent, 'utf8');
+        // Write remaining entries back to log
+        const logPath = getAuditLogPath();
+        const logContent = toKeep.map((e) => JSON.stringify(e)).join('\n') + '\n';
+        await fs.writeFile(logPath, logContent, 'utf8');
+        return toArchive.length;
+    }
+    catch (error) {
+        console.error('Failed to archive audit log:', error);
+        return 0;
+    }
+}
+/**
+ * Query audit log entries with filters
+ *
+ * @param options Query options
+ * @returns Filtered audit entries
+ */
+export async function queryAudit(options) {
+    const entries = await readAuditLog(options);
+    // Additional filters for new fields
+    let filtered = entries;
+    if (options?.taskId) {
+        filtered = filtered.filter((e) => e.metadata?.taskId === options.taskId);
+    }
+    if (options?.sessionId) {
+        filtered = filtered.filter((e) => e.sessionId === options.sessionId);
+    }
+    return filtered;
+}
+/**
+ * Creates an audit middleware that logs all mutate operations.
+ */
+export function createAudit() {
+    return async (req, next) => {
+        const startTime = Date.now();
+        const response = await next();
+        // Only audit mutations
+        if (req.gateway === 'mutate') {
+            const entry = {
+                timestamp: new Date().toISOString(),
+                sessionId: req.sessionId || null,
+                domain: req.domain,
+                operation: req.operation,
+                params: req.params || {},
+                result: {
+                    success: response.success,
+                    exitCode: response.error?.exitCode || 0,
+                    duration: Date.now() - startTime,
+                },
+                metadata: {
+                    taskId: req.params?.taskId || req.params?.parent,
+                    source: req.source,
+                    gateway: req.gateway,
+                },
+                error: response.error?.message,
+            };
+            // Fire and forget
+            logMutation(entry).catch(err => {
+                console.error(`[Audit] Failed to log mutation: ${err}`);
+            });
+        }
+        return response;
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/dispatch/middleware/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/dispatch/middleware/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAyBpD;;GAEG;AACH,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5C;;GAEG;AACH,SAAS,eAAe;IACtB,kDAAkD;IAClD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB;IAC1B,qDAAqD;IACrD,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2BAA2B;QAC3B,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAiB;IACjD,IAAI,CAAC;QACH,oCAAoC;QACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO,CAAC,yBAAyB;QACnC,CAAC;QAED,gCAAgC;QAChC,MAAM,aAAa,EAAE,CAAC;QAEtB,qBAAqB;QACrB,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAElC,8BAA8B;QAC9B,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEjC,sCAAsC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAE1C,qBAAqB;QACrB,MAAM,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,SAAiB,EACjB,KAAqB,EACrB,SAAkC,EAAE,EACpC,WAAmB,CAAC;IAEpB,oCAAoC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,CAAC,yBAAyB;IACnC,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7E,MAAM,KAAK,GAAe;QACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,mBAAmB,EAAE;QAChC,MAAM;QACN,SAAS;QACT,MAAM;QACN,MAAM,EAAE;YACN,OAAO,EAAE,KAAK;YACd,QAAQ;YACR,QAAQ,EAAE,CAAC;SACZ;QACD,QAAQ,EAAE;YACR,MAAM;YACN,MAAM,EAAE,KAAK;SACd;QACD,KAAK,EAAE,YAAY;KACpB,CAAC;IAEF,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAMlC;IACC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAElC,gBAAgB;QAChB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEnD,cAAc;QACd,MAAM,OAAO,GAAG,OAAO;aACpB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC7B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC,CAAC;QAEjD,gBAAgB;QAChB,IAAI,QAAQ,GAAG,OAAO,CAAC;QAEvB,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,KAAM,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,OAAO,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;YACnC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1E,CAAC;QAED,cAAc;QACd,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4CAA4C;QAC5C,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IAQjC,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;IAErC,MAAM,KAAK,GAAG;QACZ,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM;QAC5D,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM;QAC7D,QAAQ,EAAE,EAA4B;QACtC,WAAW,EAAE,EAA4B;QACzC,WAAW,EAAE,CAAC;KACf,CAAC;IAEF,kBAAkB;IAClB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACnD,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;IAED,6BAA6B;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC;IAC9E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;QAE7B,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAClC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEzB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAAC,OAAe;IAC9C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAErC,IAAI,KAAK,CAAC,IAAI,IAAI,kBAAkB,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACjE,MAAM,WAAW,GAAG,IAAI,CACtB,OAAO,CAAC,GAAG,EAAE,EACb,OAAO,EACP,aAAa,SAAS,OAAO,CAC9B,CAAC;YAEF,8BAA8B;YAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAEtC,OAAO,CAAC,GAAG,CAAC,sBAAsB,WAAW,KAAK,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4CAA4C;QAC5C,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,IAAI,CACtB,OAAO,CAAC,GAAG,EAAE,EACb,OAAO,EACP,aAAa,SAAS,OAAO,CAC9B,CAAC;QAEF,sBAAsB;QACtB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,mBAAmB;QAClC,CAAC;QAED,8BAA8B;QAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAEtC,OAAO,WAAW,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkB;IACtD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;QAErC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,UAAU,CAAC,CAAC;QAEhE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC;QACX,CAAC;QAED,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,CACtB,OAAO,CAAC,GAAG,EAAE,EACb,OAAO,EACP,qBAAqB,UAAU,OAAO,CACvC,CAAC;QACF,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACjF,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAExD,sCAAsC;QACtC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC1E,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAEhD,OAAO,SAAS,CAAC,MAAM,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAQhC;IACC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAE5C,oCAAoC;IACpC,IAAI,QAAQ,GAAG,OAAO,CAAC;IAEvB,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAID;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,GAAoB,EAAE,IAAkB,EAA6B,EAAE;QACnF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAE9B,uBAAuB;QACvB,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAe;gBACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;gBACxB,MAAM,EAAE;oBACN,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC;oBACvC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAG,GAAG,CAAC,MAAM,EAAE,MAAiB,IAAK,GAAG,CAAC,MAAM,EAAE,MAAiB;oBACxE,MAAM,EAAE,GAAG,CAAC,MAAa;oBACzB,OAAO,EAAE,GAAG,CAAC,OAAc;iBAC5B;gBACD,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO;aAC/B,CAAC;YAEF,kBAAkB;YAClB,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBAC7B,OAAO,CAAC,KAAK,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;YAC1D,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/dispatch/middleware/pipeline.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Unified CQRS Dispatch Layer -- Middleware Pipeline
+ *
+ * Provides compose() to chain multiple Middleware functions together
+ * into a single executable pipeline.
+ *
+ * @epic T4820
+ * @task T4815
+ */
+import { Middleware } from '../types.js';
+/**
+ * Composes an array of Middleware functions into a single Middleware function.
+ * Execution flows through the array from first to last, and returns bubble
+ * back up from last to first.
+ *
+ * @param middlewares Array of middleware functions to chain
+ * @returns A single composed Middleware function
+ */
+export declare function compose(middlewares: Middleware[]): Middleware;
+//# sourceMappingURL=pipeline.d.ts.map

package/dist/dispatch/middleware/pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../src/dispatch/middleware/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAqC,UAAU,EAAgB,MAAM,aAAa,CAAC;AAE1F;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAkC7D"}

package/dist/dispatch/middleware/pipeline.js

@@ -0,0 +1,47 @@
+/**
+ * Unified CQRS Dispatch Layer -- Middleware Pipeline
+ *
+ * Provides compose() to chain multiple Middleware functions together
+ * into a single executable pipeline.
+ *
+ * @epic T4820
+ * @task T4815
+ */
+/**
+ * Composes an array of Middleware functions into a single Middleware function.
+ * Execution flows through the array from first to last, and returns bubble
+ * back up from last to first.
+ *
+ * @param middlewares Array of middleware functions to chain
+ * @returns A single composed Middleware function
+ */
+export function compose(middlewares) {
+    if (middlewares.length === 0) {
+        return async (_req, next) => next();
+    }
+    return async (request, next) => {
+        let index = -1;
+        async function dispatch(i) {
+            if (i <= index) {
+                throw new Error('next() called multiple times in middleware');
+            }
+            index = i;
+            let fn = middlewares[i];
+            if (i === middlewares.length) {
+                // We've reached the end of the middleware chain; call the final handler
+                fn = async (_req, nxt) => nxt();
+            }
+            if (!fn) {
+                return next();
+            }
+            return fn(request, async () => {
+                if (i === middlewares.length) {
+                    return next();
+                }
+                return dispatch(i + 1);
+            });
+        }
+        return dispatch(0);
+    };
+}
+//# sourceMappingURL=pipeline.js.map

package/dist/dispatch/middleware/pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../../src/dispatch/middleware/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,WAAyB;IAC/C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,EAAE,IAAqB,EAAE,IAAkB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,EAAE,OAAwB,EAAE,IAAkB,EAA6B,EAAE;QACvF,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;QAEf,KAAK,UAAU,QAAQ,CAAC,CAAS;YAC/B,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YACD,KAAK,GAAG,CAAC,CAAC;YAEV,IAAI,EAAE,GAA2B,WAAW,CAAC,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;gBAC7B,wEAAwE;gBACxE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC;YAClC,CAAC;YAED,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAC5B,IAAI,CAAC,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;oBAC7B,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBACD,OAAO,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC;AACJ,CAAC"}

package/dist/dispatch/middleware/protocol-enforcement.d.ts

@@ -0,0 +1,6 @@
+import { Middleware } from '../types.js';
+/**
+ * Creates a middleware that enforces protocol compliance.
+ */
+export declare function createProtocolEnforcement(strictMode?: boolean): Middleware;
+//# sourceMappingURL=protocol-enforcement.d.ts.map

package/dist/dispatch/middleware/protocol-enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-enforcement.d.ts","sourceRoot":"","sources":["../../../src/dispatch/middleware/protocol-enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,UAAU,EAAgB,MAAM,aAAa,CAAC;AAGzE;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,GAAE,OAAc,GAAG,UAAU,CAOhF"}

package/dist/dispatch/middleware/protocol-enforcement.js

@@ -0,0 +1,12 @@
+import { ProtocolEnforcer } from '../../mcp/lib/protocol-enforcement.js';
+/**
+ * Creates a middleware that enforces protocol compliance.
+ */
+export function createProtocolEnforcement(strictMode = true) {
+    void new ProtocolEnforcer(strictMode);
+    return async (_req, next) => {
+        const response = await next();
+        return response;
+    };
+}
+//# sourceMappingURL=protocol-enforcement.js.map

package/dist/dispatch/middleware/protocol-enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-enforcement.js","sourceRoot":"","sources":["../../../src/dispatch/middleware/protocol-enforcement.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAEzE;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,aAAsB,IAAI;IAClE,KAAK,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAEtC,OAAO,KAAK,EAAE,IAAI,EAAE,IAAkB,EAA6B,EAAE;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/dispatch/middleware/rate-limiter.d.ts

@@ -0,0 +1,30 @@
+import { DispatchRequest, Middleware, RateLimitMeta } from '../types.js';
+/**
+ * Rate Limit Configuration
+ */
+export interface RateLimitConfig {
+    maxRequests: number;
+    windowMs: number;
+}
+export interface RateLimitingConfig {
+    enabled: boolean;
+    query: RateLimitConfig;
+    mutate: RateLimitConfig;
+    spawn: RateLimitConfig;
+}
+export declare const DEFAULT_RATE_LIMITING: RateLimitingConfig;
+export declare class RateLimiter {
+    private buckets;
+    private config;
+    constructor(config?: Partial<RateLimitingConfig>);
+    check(req: DispatchRequest): RateLimitMeta & {
+        allowed: boolean;
+    };
+    private resolveCategory;
+    private getLimitConfig;
+}
+/**
+ * Creates a rate limiting middleware.
+ */
+export declare function createRateLimiter(config?: Partial<RateLimitingConfig>): Middleware;
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/dispatch/middleware/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/dispatch/middleware/rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAoB,UAAU,EAAgB,aAAa,EAAE,MAAM,aAAa,CAAC;AAEzG;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,eAAe,CAAC;CACxB;AAED,eAAO,MAAM,qBAAqB,EAAE,kBAKnC,CAAC;AASF,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAA+C;IAC9D,OAAO,CAAC,MAAM,CAAqB;gBAEvB,MAAM,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC;IAUhD,KAAK,CAAC,GAAG,EAAE,eAAe,GAAG,aAAa,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE;IA2CjE,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,cAAc;CAGvB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,UAAU,CAqClF"}

package/dist/dispatch/middleware/rate-limiter.js

@@ -0,0 +1,101 @@
+export const DEFAULT_RATE_LIMITING = {
+    enabled: true,
+    query: { maxRequests: 100, windowMs: 60_000 },
+    mutate: { maxRequests: 30, windowMs: 60_000 },
+    spawn: { maxRequests: 10, windowMs: 60_000 },
+};
+export class RateLimiter {
+    buckets = new Map();
+    config;
+    constructor(config) {
+        this.config = {
+            ...DEFAULT_RATE_LIMITING,
+            ...config,
+            query: { ...DEFAULT_RATE_LIMITING.query, ...config?.query },
+            mutate: { ...DEFAULT_RATE_LIMITING.mutate, ...config?.mutate },
+            spawn: { ...DEFAULT_RATE_LIMITING.spawn, ...config?.spawn },
+        };
+    }
+    check(req) {
+        if (!this.config.enabled) {
+            return {
+                allowed: true,
+                remaining: Infinity,
+                limit: Infinity,
+                resetMs: 0,
+                category: 'disabled',
+            };
+        }
+        const category = this.resolveCategory(req.gateway, req.domain, req.operation);
+        const limitConfig = this.getLimitConfig(category);
+        const now = Date.now();
+        const windowStart = now - limitConfig.windowMs;
+        let bucket = this.buckets.get(category);
+        if (!bucket) {
+            bucket = { timestamps: [] };
+            this.buckets.set(category, bucket);
+        }
+        // Clean up old timestamps
+        bucket.timestamps = bucket.timestamps.filter(t => t > windowStart);
+        const allowed = bucket.timestamps.length < limitConfig.maxRequests;
+        if (allowed) {
+            bucket.timestamps.push(now);
+        }
+        const oldest = bucket.timestamps[0] || now;
+        const resetMs = Math.max(0, oldest + limitConfig.windowMs - now);
+        return {
+            allowed,
+            remaining: Math.max(0, limitConfig.maxRequests - bucket.timestamps.length),
+            limit: limitConfig.maxRequests,
+            resetMs,
+            category,
+        };
+    }
+    resolveCategory(gateway, domain, operation) {
+        if (domain === 'orchestrate' && operation === 'spawn') {
+            return 'spawn';
+        }
+        return gateway === 'query' ? 'query' : 'mutate';
+    }
+    getLimitConfig(category) {
+        return this.config[category];
+    }
+}
+/**
+ * Creates a rate limiting middleware.
+ */
+export function createRateLimiter(config) {
+    const limiter = new RateLimiter(config);
+    return async (req, next) => {
+        const check = limiter.check(req);
+        if (!check.allowed) {
+            return {
+                _meta: {
+                    gateway: req.gateway,
+                    domain: req.domain,
+                    operation: req.operation,
+                    timestamp: new Date().toISOString(),
+                    duration_ms: 0,
+                    source: req.source,
+                    requestId: req.requestId,
+                    rateLimit: check,
+                },
+                success: false,
+                error: {
+                    code: 'E_RATE_LIMIT_EXCEEDED',
+                    exitCode: 429, // Too Many Requests
+                    message: `Rate limit exceeded for category: ${check.category}. Please wait ${Math.ceil(check.resetMs / 1000)} seconds.`,
+                }
+            };
+        }
+        const response = await next();
+        response._meta.rateLimit = {
+            limit: check.limit,
+            remaining: check.remaining,
+            resetMs: check.resetMs,
+            category: check.category,
+        };
+        return response;
+    };
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/dispatch/middleware/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/dispatch/middleware/rate-limiter.ts"],"names":[],"mappings":"AAiBA,MAAM,CAAC,MAAM,qBAAqB,GAAuB;IACvD,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7C,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7C,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;CAC7C,CAAC;AASF,MAAM,OAAO,WAAW;IACd,OAAO,GAAqC,IAAI,GAAG,EAAE,CAAC;IACtD,MAAM,CAAqB;IAEnC,YAAY,MAAoC;QAC9C,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,qBAAqB;YACxB,GAAG,MAAM;YACT,KAAK,EAAE,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE;YAC3D,MAAM,EAAE,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE;YAC9D,KAAK,EAAE,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE;SAC5D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAoB;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,CAAC;gBACV,QAAQ,EAAE,UAAU;aACrB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC;QAE/C,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,0BAA0B;QAC1B,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC;QACnE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;QAEjE,OAAO;YACL,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAC1E,KAAK,EAAE,WAAW,CAAC,WAAW;YAC9B,OAAO;YACP,QAAQ;SACT,CAAC;IACJ,CAAC;IAEO,eAAe,CAAC,OAAe,EAAE,MAAc,EAAE,SAAiB;QACxE,IAAI,MAAM,KAAK,aAAa,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YACtD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,CAAC;IAEO,cAAc,CAAC,QAAsC;QAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAoC;IACpE,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAExC,OAAO,KAAK,EAAE,GAAoB,EAAE,IAAkB,EAA6B,EAAE;QACnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,KAAK,EAAE;oBACL,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,WAAW,EAAE,CAAC;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,SAAS,EAAE,KAAK;iBACjB;gBACD,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,uBAAuB;oBAC7B,QAAQ,EAAE,GAAG,EAAE,oBAAoB;oBACnC,OAAO,EAAE,qCAAqC,KAAK,CAAC,QAAQ,iBAAiB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,WAAW;iBACxH;aACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,QAAQ,CAAC,KAAK,CAAC,SAAS,GAAG;YACzB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/dispatch/middleware/sanitizer.d.ts

@@ -0,0 +1,10 @@
+import { Middleware } from '../types.js';
+/**
+ * Creates a middleware that sanitizes incoming request parameters.
+ * Uses the canonical sanitization logic from security.ts to handle
+ * Task IDs, paths, string lengths, and enum validation.
+ *
+ * @param getProjectRoot - Optional function to resolve the current project root for path sanitization
+ */
+export declare function createSanitizer(getProjectRoot?: () => string): Middleware;
+//# sourceMappingURL=sanitizer.d.ts.map

package/dist/dispatch/middleware/sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizer.d.ts","sourceRoot":"","sources":["../../../src/dispatch/middleware/sanitizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,UAAU,EAAgB,MAAM,aAAa,CAAC;AAG1F;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,UAAU,CA6BzE"}

package/dist/dispatch/middleware/sanitizer.js

@@ -0,0 +1,39 @@
+import { sanitizeParams as legacySanitizeParams } from '../../mcp/lib/security.js';
+/**
+ * Creates a middleware that sanitizes incoming request parameters.
+ * Uses the canonical sanitization logic from security.ts to handle
+ * Task IDs, paths, string lengths, and enum validation.
+ *
+ * @param getProjectRoot - Optional function to resolve the current project root for path sanitization
+ */
+export function createSanitizer(getProjectRoot) {
+    return async (req, next) => {
+        if (req.params) {
+            try {
+                const root = getProjectRoot ? getProjectRoot() : undefined;
+                req.params = legacySanitizeParams(req.params, root);
+            }
+            catch (error) {
+                return {
+                    _meta: {
+                        gateway: req.gateway,
+                        domain: req.domain,
+                        operation: req.operation,
+                        timestamp: new Date().toISOString(),
+                        duration_ms: 0,
+                        source: req.source,
+                        requestId: req.requestId,
+                    },
+                    success: false,
+                    error: {
+                        code: 'E_VALIDATION_FAILED',
+                        exitCode: 6, // VALIDATION_ERROR
+                        message: error instanceof Error ? error.message : String(error),
+                    }
+                };
+            }
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=sanitizer.js.map