@cleocode/cleo 2026.3.37 → 2026.3.39

package/dist/mcp/lib/router.d.ts

@@ -1,58 +0,0 @@
-/**
- * Legacy Domain Router Types
- *
- * This file retains only the DomainRequest / DomainResponse interfaces
- * used by the gateway tool definitions (query.ts and mutate.ts) and
- * protocol enforcement. The DomainRouter class has been removed —
- * all routing now goes through the dispatch layer.
- *
- * @task T2911
- */
-/**
- * Request from MCP gateway
- */
-export interface DomainRequest {
-    gateway: 'query' | 'mutate';
-    domain: string;
-    operation: string;
-    params?: Record<string, unknown>;
-}
-/**
- * Response from domain handler
- */
-export interface DomainResponse {
-    _meta: {
-        gateway: string;
-        domain: string;
-        operation: string;
-        timestamp: string;
-        duration_ms: number;
-        [key: string]: unknown;
-    };
-    success: boolean;
-    data?: unknown;
-    partial?: boolean;
-    error?: {
-        code: string;
-        exitCode?: number;
-        message: string;
-        details?: Record<string, unknown>;
-        fix?: string;
-        alternatives?: Array<{
-            action: string;
-            command: string;
-        }>;
-    };
-}
-/**
- * Domain handler interface (legacy - retained for type compatibility)
- */
-export interface DomainHandler {
-    query(operation: string, params?: Record<string, unknown>): Promise<DomainResponse>;
-    mutate(operation: string, params?: Record<string, unknown>): Promise<DomainResponse>;
-    getSupportedOperations(): {
-        query: string[];
-        mutate: string[];
-    };
-}
-//# sourceMappingURL=router.d.ts.map

package/dist/mcp/lib/router.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/mcp/lib/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE;QACL,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC3D,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACpF,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrF,sBAAsB,IAAI;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CACjE"}

package/dist/mcp/lib/router.js

@@ -1,12 +0,0 @@
-/**
- * Legacy Domain Router Types
- *
- * This file retains only the DomainRequest / DomainResponse interfaces
- * used by the gateway tool definitions (query.ts and mutate.ts) and
- * protocol enforcement. The DomainRouter class has been removed —
- * all routing now goes through the dispatch layer.
- *
- * @task T2911
- */
-export {};
-//# sourceMappingURL=router.js.map

package/dist/mcp/lib/router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../../src/mcp/lib/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/mcp/lib/security.d.ts

@@ -1,161 +0,0 @@
-/**
- * Security Hardening and Input Sanitization for CLEO MCP Server
- *
- * Provides input validation, path sanitization, content filtering,
- * enum checking, and rate limiting for all MCP operations.
- *
- * @task T3144
- * @epic T3125
- */
-/**
- * Security validation error thrown when input fails sanitization
- */
-export declare class SecurityError extends Error {
-    code: string;
-    field?: string | undefined;
-    constructor(message: string, code?: string, field?: string | undefined);
-}
-/**
- * Sanitize and validate a task ID
- *
- * Validates format: ^T[0-9]+$
- * Rejects empty, malformed, or excessively large IDs
- *
- * @param id - Raw task ID input
- * @returns Sanitized task ID
- * @throws SecurityError if ID is invalid
- */
-export declare function sanitizeTaskId(value: unknown): string;
-/**
- * Sanitize and validate a file path
- *
- * Prevents path traversal attacks by ensuring the resolved path
- * stays within the project root directory.
- *
- * @param path - Raw path input
- * @param projectRoot - Project root directory (absolute path)
- * @returns Sanitized absolute path within project root
- * @throws SecurityError if path escapes project root or is invalid
- */
-export declare function sanitizePath(path: string, projectRoot: string): string;
-/**
- * Sanitize content string
- *
- * Enforces size limits and strips control characters (except newline, tab, CR).
- *
- * @param content - Raw content string
- * @param maxLength - Maximum allowed length (default: 64KB)
- * @returns Sanitized content string
- * @throws SecurityError if content exceeds size limit
- */
-export declare function sanitizeContent(content: string, maxLength?: number): string;
-/**
- * Validate that a value is in an allowed enum set
- *
- * @param value - Value to validate
- * @param allowed - Array of allowed values
- * @param fieldName - Name of the field (for error messages)
- * @returns The validated value
- * @throws SecurityError if value is not in allowed set
- */
-export declare function validateEnum(value: string, allowed: string[], fieldName: string): string;
-/**
- * Known enum values for CLEO domains
- */
-export declare const VALID_DOMAINS: readonly ["tasks", "session", "orchestrate", "research", "lifecycle", "validate", "release", "system"];
-export declare const VALID_GATEWAYS: readonly ["query", "mutate"];
-export declare const VALID_MANIFEST_STATUSES: readonly ["completed", "partial", "blocked", "archived"];
-export declare const VALID_LIFECYCLE_STAGE_STATUSES: readonly ["not_started", "in_progress", "blocked", "completed", "skipped", "failed"];
-export declare const ALL_VALID_STATUSES: readonly ["pending", "active", "blocked", "done", "cancelled", "archived", "completed", "partial", "blocked", "archived"];
-export declare const VALID_PRIORITIES: readonly ["critical", "high", "medium", "low"];
-/**
- * Rate limiter configuration
- */
-export interface RateLimitConfig {
-    /** Maximum requests allowed in the window */
-    maxRequests: number;
-    /** Time window in milliseconds */
-    windowMs: number;
-}
-/**
- * Rate limit check result
- */
-export interface RateLimitResult {
-    /** Whether the request is allowed */
-    allowed: boolean;
-    /** Remaining requests in current window */
-    remaining: number;
-    /** Milliseconds until window resets */
-    resetMs: number;
-    /** Total limit for the window */
-    limit: number;
-}
-/**
- * Default rate limit configurations per operation type
- */
-export declare const DEFAULT_RATE_LIMITS: Record<string, RateLimitConfig>;
-/**
- * In-memory sliding window rate limiter
- *
- * Tracks request timestamps per key and enforces configurable limits.
- */
-export declare class RateLimiter {
-    private windows;
-    private configs;
-    constructor(configs?: Record<string, RateLimitConfig>);
-    /**
-     * Check if a request is allowed under rate limits
-     *
-     * @param key - Rate limit bucket key (e.g., 'query', 'mutate', 'spawn')
-     * @returns Rate limit check result
-     */
-    check(key: string): RateLimitResult;
-    /**
-     * Record a request (call after check returns allowed: true)
-     *
-     * @param key - Rate limit bucket key
-     */
-    record(key: string): void;
-    /**
-     * Check and record in one step
-     *
-     * @param key - Rate limit bucket key
-     * @returns Rate limit check result (recorded if allowed)
-     */
-    consume(key: string): RateLimitResult;
-    /**
-     * Reset rate limit state for a specific key or all keys
-     *
-     * @param key - Optional key to reset (resets all if omitted)
-     */
-    reset(key?: string): void;
-    /**
-     * Get current configuration for a key
-     */
-    getConfig(key: string): RateLimitConfig | undefined;
-    /**
-     * Update configuration for a key
-     */
-    setConfig(key: string, config: RateLimitConfig): void;
-}
-/**
- * Sanitize all params in a DomainRequest before routing
- *
- * Applies appropriate sanitization based on known field names:
- * - taskId, parent, epicId -> sanitizeTaskId
- * - path, file -> sanitizePath (if projectRoot provided)
- * - title, description, notes, content -> sanitizeContent
- * - status -> validateEnum(TASK_STATUSES)
- * - priority -> validateEnum(VALID_PRIORITIES)
- * - domain -> validateEnum(VALID_DOMAINS)
- *
- * @param params - Raw request parameters
- * @param projectRoot - Project root for path sanitization
- * @returns Sanitized parameters
- * @throws SecurityError on validation failure
- */
-export declare function sanitizeParams(params: Record<string, unknown> | undefined, projectRoot?: string, context?: {
-    domain?: string;
-    operation?: string;
-}): Record<string, unknown> | undefined;
-//# sourceMappingURL=security.d.ts.map

package/dist/mcp/lib/security.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/mcp/lib/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH;;GAEG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAG7B,IAAI,EAAE,MAAM;IACZ,KAAK,CAAC,EAAE,MAAM;gBAFrB,OAAO,EAAE,MAAM,EACR,IAAI,GAAE,MAA+B,EACrC,KAAK,CAAC,EAAE,MAAM,YAAA;CAKxB;AAiBD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAqBrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAgDtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,MAAmC,GAC7C,MAAM,CAeR;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAgBxF;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,wGAShB,CAAC;AAEX,eAAO,MAAM,cAAc,8BAA+B,CAAC;AAE3D,eAAO,MAAM,uBAAuB,0DAAoB,CAAC;AAEzD,eAAO,MAAM,8BAA8B,sFAA2B,CAAC;AAEvE,eAAO,MAAM,kBAAkB,2HAAoD,CAAC;AAEpF,eAAO,MAAM,gBAAgB,gDAAkB,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAI/D,CAAC;AAEF;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAoC;IACnD,OAAO,CAAC,OAAO,CAA2C;gBAE9C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;IAQrD;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe;IAiCnC;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMzB;;;;;OAKG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe;IAUrC;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI;IAQzB;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAInD;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;CAGtD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CA6FrC"}

package/dist/mcp/lib/security.js

@@ -1,361 +0,0 @@
-/**
- * Security Hardening and Input Sanitization for CLEO MCP Server
- *
- * Provides input validation, path sanitization, content filtering,
- * enum checking, and rate limiting for all MCP operations.
- *
- * @task T3144
- * @epic T3125
- */
-import { normalizeTaskId } from '@cleocode/core/internal';
-import { isAbsolute, normalize, relative, resolve } from 'path';
-import { LIFECYCLE_STAGE_STATUSES, MANIFEST_STATUSES, TASK_STATUSES, } from '@cleocode/contracts';
-import { TASK_PRIORITIES } from '@cleocode/core/internal';
-/**
- * Security validation error thrown when input fails sanitization
- */
-export class SecurityError extends Error {
-    code;
-    field;
-    constructor(message, code = 'E_SECURITY_VIOLATION', field) {
-        super(message);
-        this.code = code;
-        this.field = field;
-        this.name = 'SecurityError';
-    }
-}
-/**
- * Maximum task ID numeric value (prevent absurdly large IDs)
- */
-const MAX_TASK_ID_NUMBER = 999999;
-/**
- * Control character pattern (C0 and C1 control chars, excluding newline/tab/cr)
- */
-const CONTROL_CHAR_PATTERN = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x9F]/g;
-/**
- * Default maximum content length (64KB)
- */
-const DEFAULT_MAX_CONTENT_LENGTH = 64 * 1024;
-/**
- * Sanitize and validate a task ID
- *
- * Validates format: ^T[0-9]+$
- * Rejects empty, malformed, or excessively large IDs
- *
- * @param id - Raw task ID input
- * @returns Sanitized task ID
- * @throws SecurityError if ID is invalid
- */
-export function sanitizeTaskId(value) {
-    if (typeof value !== 'string') {
-        throw new SecurityError('Task ID must be a string', 'E_INVALID_TASK_ID', 'taskId');
-    }
-    const normalized = normalizeTaskId(value);
-    if (normalized === null) {
-        throw new SecurityError(`Invalid task ID format: ${value}`, 'E_INVALID_TASK_ID', 'taskId');
-    }
-    // Validate numeric value isn't absurdly large
-    const numericPart = parseInt(normalized.slice(1), 10);
-    if (numericPart > MAX_TASK_ID_NUMBER) {
-        throw new SecurityError(`Task ID exceeds maximum value: ${value}`, 'E_INVALID_TASK_ID', 'taskId');
-    }
-    return normalized;
-}
-/**
- * Sanitize and validate a file path
- *
- * Prevents path traversal attacks by ensuring the resolved path
- * stays within the project root directory.
- *
- * @param path - Raw path input
- * @param projectRoot - Project root directory (absolute path)
- * @returns Sanitized absolute path within project root
- * @throws SecurityError if path escapes project root or is invalid
- */
-export function sanitizePath(path, projectRoot) {
-    if (typeof path !== 'string') {
-        throw new SecurityError('Path must be a string', 'E_INVALID_PATH', 'path');
-    }
-    if (typeof projectRoot !== 'string' || projectRoot.length === 0) {
-        throw new SecurityError('Project root must be a non-empty string', 'E_INVALID_PATH', 'projectRoot');
-    }
-    const trimmedPath = path.trim();
-    if (trimmedPath.length === 0) {
-        throw new SecurityError('Path cannot be empty', 'E_INVALID_PATH', 'path');
-    }
-    // Check for null bytes (common injection vector)
-    if (trimmedPath.includes('\0')) {
-        throw new SecurityError('Path contains null bytes', 'E_PATH_TRAVERSAL', 'path');
-    }
-    // Normalize the project root
-    const normalizedRoot = resolve(projectRoot);
-    // Resolve the path relative to project root
-    let resolvedPath;
-    if (isAbsolute(trimmedPath)) {
-        resolvedPath = normalize(trimmedPath);
-    }
-    else {
-        resolvedPath = resolve(normalizedRoot, trimmedPath);
-    }
-    // Ensure the resolved path is within the project root
-    const relativePath = relative(normalizedRoot, resolvedPath);
-    // If relative path starts with '..' or is absolute, it escapes the root
-    if (relativePath.startsWith('..') || isAbsolute(relativePath)) {
-        throw new SecurityError(`Path traversal detected: "${path}" resolves outside project root`, 'E_PATH_TRAVERSAL', 'path');
-    }
-    return resolvedPath;
-}
-/**
- * Sanitize content string
- *
- * Enforces size limits and strips control characters (except newline, tab, CR).
- *
- * @param content - Raw content string
- * @param maxLength - Maximum allowed length (default: 64KB)
- * @returns Sanitized content string
- * @throws SecurityError if content exceeds size limit
- */
-export function sanitizeContent(content, maxLength = DEFAULT_MAX_CONTENT_LENGTH) {
-    if (typeof content !== 'string') {
-        throw new SecurityError('Content must be a string', 'E_INVALID_CONTENT', 'content');
-    }
-    if (content.length > maxLength) {
-        throw new SecurityError(`Content exceeds maximum length (${maxLength} characters): got ${content.length}`, 'E_CONTENT_TOO_LARGE', 'content');
-    }
-    // Strip control characters (preserve \n, \t, \r)
-    return content.replace(CONTROL_CHAR_PATTERN, '');
-}
-/**
- * Validate that a value is in an allowed enum set
- *
- * @param value - Value to validate
- * @param allowed - Array of allowed values
- * @param fieldName - Name of the field (for error messages)
- * @returns The validated value
- * @throws SecurityError if value is not in allowed set
- */
-export function validateEnum(value, allowed, fieldName) {
-    if (typeof value !== 'string') {
-        throw new SecurityError(`${fieldName} must be a string`, 'E_INVALID_ENUM', fieldName);
-    }
-    const trimmed = value.trim();
-    if (!allowed.includes(trimmed)) {
-        throw new SecurityError(`Invalid ${fieldName}: "${trimmed}". Allowed values: ${allowed.join(', ')}`, 'E_INVALID_ENUM', fieldName);
-    }
-    return trimmed;
-}
-/**
- * Known enum values for CLEO domains
- */
-export const VALID_DOMAINS = [
-    'tasks',
-    'session',
-    'orchestrate',
-    'research',
-    'lifecycle',
-    'validate',
-    'release',
-    'system',
-];
-export const VALID_GATEWAYS = ['query', 'mutate'];
-export const VALID_MANIFEST_STATUSES = MANIFEST_STATUSES;
-export const VALID_LIFECYCLE_STAGE_STATUSES = LIFECYCLE_STAGE_STATUSES;
-export const ALL_VALID_STATUSES = [...TASK_STATUSES, ...MANIFEST_STATUSES];
-export const VALID_PRIORITIES = TASK_PRIORITIES;
-/**
- * Default rate limit configurations per operation type
- */
-export const DEFAULT_RATE_LIMITS = {
-    query: { maxRequests: 100, windowMs: 60_000 },
-    mutate: { maxRequests: 30, windowMs: 60_000 },
-    spawn: { maxRequests: 10, windowMs: 60_000 },
-};
-/**
- * In-memory sliding window rate limiter
- *
- * Tracks request timestamps per key and enforces configurable limits.
- */
-export class RateLimiter {
-    windows = new Map();
-    configs = new Map();
-    constructor(configs) {
-        // Initialize with provided or default configs
-        const effectiveConfigs = configs ?? DEFAULT_RATE_LIMITS;
-        for (const [key, config] of Object.entries(effectiveConfigs)) {
-            this.configs.set(key, config);
-        }
-    }
-    /**
-     * Check if a request is allowed under rate limits
-     *
-     * @param key - Rate limit bucket key (e.g., 'query', 'mutate', 'spawn')
-     * @returns Rate limit check result
-     */
-    check(key) {
-        const config = this.configs.get(key);
-        if (!config) {
-            // No config for this key - allow by default
-            return { allowed: true, remaining: Infinity, resetMs: 0, limit: Infinity };
-        }
-        const now = Date.now();
-        const windowStart = now - config.windowMs;
-        // Get or create window
-        let timestamps = this.windows.get(key);
-        if (!timestamps) {
-            timestamps = [];
-            this.windows.set(key, timestamps);
-        }
-        // Prune expired timestamps
-        const validTimestamps = timestamps.filter((t) => t > windowStart);
-        this.windows.set(key, validTimestamps);
-        const remaining = Math.max(0, config.maxRequests - validTimestamps.length);
-        const oldestInWindow = validTimestamps.length > 0 ? validTimestamps[0] : now;
-        const resetMs = Math.max(0, oldestInWindow + config.windowMs - now);
-        return {
-            allowed: validTimestamps.length < config.maxRequests,
-            remaining,
-            resetMs,
-            limit: config.maxRequests,
-        };
-    }
-    /**
-     * Record a request (call after check returns allowed: true)
-     *
-     * @param key - Rate limit bucket key
-     */
-    record(key) {
-        const timestamps = this.windows.get(key) ?? [];
-        timestamps.push(Date.now());
-        this.windows.set(key, timestamps);
-    }
-    /**
-     * Check and record in one step
-     *
-     * @param key - Rate limit bucket key
-     * @returns Rate limit check result (recorded if allowed)
-     */
-    consume(key) {
-        const result = this.check(key);
-        if (result.allowed) {
-            this.record(key);
-            // Adjust remaining after recording
-            result.remaining = Math.max(0, result.remaining - 1);
-        }
-        return result;
-    }
-    /**
-     * Reset rate limit state for a specific key or all keys
-     *
-     * @param key - Optional key to reset (resets all if omitted)
-     */
-    reset(key) {
-        if (key) {
-            this.windows.delete(key);
-        }
-        else {
-            this.windows.clear();
-        }
-    }
-    /**
-     * Get current configuration for a key
-     */
-    getConfig(key) {
-        return this.configs.get(key);
-    }
-    /**
-     * Update configuration for a key
-     */
-    setConfig(key, config) {
-        this.configs.set(key, config);
-    }
-}
-/**
- * Sanitize all params in a DomainRequest before routing
- *
- * Applies appropriate sanitization based on known field names:
- * - taskId, parent, epicId -> sanitizeTaskId
- * - path, file -> sanitizePath (if projectRoot provided)
- * - title, description, notes, content -> sanitizeContent
- * - status -> validateEnum(TASK_STATUSES)
- * - priority -> validateEnum(VALID_PRIORITIES)
- * - domain -> validateEnum(VALID_DOMAINS)
- *
- * @param params - Raw request parameters
- * @param projectRoot - Project root for path sanitization
- * @returns Sanitized parameters
- * @throws SecurityError on validation failure
- */
-export function sanitizeParams(params, projectRoot, context) {
-    if (!params) {
-        return params;
-    }
-    const sanitized = { ...params };
-    for (const [key, value] of Object.entries(sanitized)) {
-        if (value === undefined || value === null) {
-            continue;
-        }
-        // Task ID fields
-        if (typeof value === 'string' &&
-            (key === 'taskId' ||
-                key === 'parent' ||
-                key === 'epicId' ||
-                key === 'parentId' ||
-                key === 'newParentId' ||
-                key === 'relatedId' ||
-                key === 'targetId')) {
-            // Allow empty string for 'parent' field (means "promote to root" / remove parent)
-            if (key === 'parent' && value === '') {
-                continue;
-            }
-            sanitized[key] = sanitizeTaskId(value);
-            continue;
-        }
-        // Task ID arrays (depends, addDepends, removeDepends)
-        if ((key === 'depends' || key === 'addDepends' || key === 'removeDepends') &&
-            Array.isArray(value)) {
-            sanitized[key] = value.map((v) => {
-                if (typeof v === 'string') {
-                    return sanitizeTaskId(v);
-                }
-                return v;
-            });
-            continue;
-        }
-        // Path fields
-        if (typeof value === 'string' && (key === 'path' || key === 'file') && projectRoot) {
-            sanitized[key] = sanitizePath(value, projectRoot);
-            continue;
-        }
-        // Content fields (with size limits)
-        if (typeof value === 'string' &&
-            (key === 'title' || key === 'description' || key === 'content')) {
-            const maxLen = key === 'title' ? 200 : DEFAULT_MAX_CONTENT_LENGTH;
-            sanitized[key] = sanitizeContent(value, maxLen);
-            continue;
-        }
-        // Notes can be string or array of strings
-        if (key === 'notes') {
-            if (typeof value === 'string') {
-                sanitized[key] = sanitizeContent(value);
-            }
-            else if (Array.isArray(value)) {
-                sanitized[key] = value.map((v) => (typeof v === 'string' ? sanitizeContent(v) : v));
-            }
-            continue;
-        }
-        // Status enum - accept both task statuses and manifest statuses
-        if (typeof value === 'string' && key === 'status') {
-            const isLifecycleStageStatus = context?.domain === 'pipeline' && context?.operation === 'stage.record';
-            sanitized[key] = validateEnum(value, isLifecycleStageStatus
-                ? [...LIFECYCLE_STAGE_STATUSES]
-                : [...TASK_STATUSES, ...MANIFEST_STATUSES], 'status');
-            continue;
-        }
-        // Priority enum
-        if (typeof value === 'string' && key === 'priority') {
-            sanitized[key] = validateEnum(value, [...VALID_PRIORITIES], 'priority');
-        }
-    }
-    return sanitized;
-}
-//# sourceMappingURL=security.js.map

package/dist/mcp/lib/security.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/mcp/lib/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAChE,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IAG7B;IACA;IAHT,YACE,OAAe,EACR,OAAe,sBAAsB,EACrC,KAAc;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHR,SAAI,GAAJ,IAAI,CAAiC;QACrC,UAAK,GAAL,KAAK,CAAS;QAGrB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;GAEG;AACH,MAAM,oBAAoB,GAAG,wCAAwC,CAAC;AAEtE;;GAEG;AACH,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,aAAa,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,aAAa,CAAC,2BAA2B,KAAK,EAAE,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IAC7F,CAAC;IAED,8CAA8C;IAC9C,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,WAAW,GAAG,kBAAkB,EAAE,CAAC;QACrC,MAAM,IAAI,aAAa,CACrB,kCAAkC,KAAK,EAAE,EACzC,mBAAmB,EACnB,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,WAAmB;IAC5D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CAAC,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,aAAa,CACrB,yCAAyC,EACzC,gBAAgB,EAChB,aAAa,CACd,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAEhC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CAAC,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,iDAAiD;IACjD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,aAAa,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,6BAA6B;IAC7B,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAE5C,4CAA4C;IAC5C,IAAI,YAAoB,CAAC;IACzB,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,YAAY,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,sDAAsD;IACtD,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAE5D,wEAAwE;IACxE,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,aAAa,CACrB,6BAA6B,IAAI,iCAAiC,EAClE,kBAAkB,EAClB,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,YAAoB,0BAA0B;IAE9C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,aAAa,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,aAAa,CACrB,mCAAmC,SAAS,qBAAqB,OAAO,CAAC,MAAM,EAAE,EACjF,qBAAqB,EACrB,SAAS,CACV,CAAC;IACJ,CAAC;IAED,iDAAiD;IACjD,OAAO,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,OAAiB,EAAE,SAAiB;IAC9E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,aAAa,CAAC,GAAG,SAAS,mBAAmB,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,aAAa,CACrB,WAAW,SAAS,MAAM,OAAO,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3E,gBAAgB,EAChB,SAAS,CACV,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO;IACP,SAAS;IACT,aAAa;IACb,UAAU;IACV,WAAW;IACX,UAAU;IACV,SAAS;IACT,QAAQ;CACA,CAAC;AAEX,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAU,CAAC;AAE3D,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;AAEzD,MAAM,CAAC,MAAM,8BAA8B,GAAG,wBAAwB,CAAC;AAEvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,iBAAiB,CAAU,CAAC;AAEpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AA0BhD;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAoC;IAClE,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7C,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7C,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;CAC7C,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACd,OAAO,GAA0B,IAAI,GAAG,EAAE,CAAC;IAC3C,OAAO,GAAiC,IAAI,GAAG,EAAE,CAAC;IAE1D,YAAY,OAAyC;QACnD,8CAA8C;QAC9C,MAAM,gBAAgB,GAAG,OAAO,IAAI,mBAAmB,CAAC;QACxD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAW;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,4CAA4C;YAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC;QAE1C,uBAAuB;QACvB,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACpC,CAAC;QAED,2BAA2B;QAC3B,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;QAEpE,OAAO;YACL,OAAO,EAAE,eAAe,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW;YACpD,SAAS;YACT,OAAO;YACP,KAAK,EAAE,MAAM,CAAC,WAAW;SAC1B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,GAAW;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC/C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,GAAW;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,mCAAmC;YACnC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAY;QAChB,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAW,EAAE,MAAuB;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA2C,EAC3C,WAAoB,EACpB,OAAiD;IAEjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,SAAS,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IAEzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,iBAAiB;QACjB,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,GAAG,KAAK,QAAQ;gBACf,GAAG,KAAK,QAAQ;gBAChB,GAAG,KAAK,QAAQ;gBAChB,GAAG,KAAK,UAAU;gBAClB,GAAG,KAAK,aAAa;gBACrB,GAAG,KAAK,WAAW;gBACnB,GAAG,KAAK,UAAU,CAAC,EACrB,CAAC;YACD,kFAAkF;YAClF,IAAI,GAAG,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACrC,SAAS;YACX,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACvC,SAAS;QACX,CAAC;QAED,sDAAsD;QACtD,IACE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,eAAe,CAAC;YACtE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACpB,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC1B,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC;gBAC3B,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,cAAc;QACd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YACnF,SAAS,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QAED,oCAAoC;QACpC,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,SAAS,CAAC,EAC/D,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,0BAA0B,CAAC;YAClE,SAAS,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,0CAA0C;QAC1C,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,SAAS,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YAC1C,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtF,CAAC;YACD,SAAS;QACX,CAAC;QAED,gEAAgE;QAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,sBAAsB,GAC1B,OAAO,EAAE,MAAM,KAAK,UAAU,IAAI,OAAO,EAAE,SAAS,KAAK,cAAc,CAAC;YAE1E,SAAS,CAAC,GAAG,CAAC,GAAG,YAAY,CAC3B,KAAK,EACL,sBAAsB;gBACpB,CAAC,CAAC,CAAC,GAAG,wBAAwB,CAAC;gBAC/B,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,iBAAiB,CAAC,EAC5C,QAAQ,CACT,CAAC;YACF,SAAS;QACX,CAAC;QAED,gBAAgB;QAChB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACpD,SAAS,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,GAAG,gBAAgB,CAAC,EAAE,UAAU,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/mcp/lib/verification-gates.d.ts

@@ -1,13 +0,0 @@
-/**
- * Verification Gate System for CLEO MCP Server
- *
- * Re-exports from canonical location at src/core/validation/operation-verification-gates.ts.
- * Retained for backward compatibility.
- *
- * @task T2936
- * @task T5707
- * @epic T2908
- */
-export { createVerificationGate, GATE_SEQUENCE, GateLayer, GateStatus, getWorkflowGateDefinition, isValidWorkflowGateName, VerificationGate, WORKFLOW_GATE_DEFINITIONS, WORKFLOW_GATE_SEQUENCE, WorkflowGateName, WorkflowGateTracker, } from '@cleocode/core/internal';
-export type { GateViolation, LayerResult, OperationContext, VerificationResult, WorkflowGateAgent, WorkflowGateDefinition, WorkflowGateState, WorkflowGateStatus, } from '@cleocode/core/internal';
-//# sourceMappingURL=verification-gates.d.ts.map

package/dist/mcp/lib/verification-gates.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verification-gates.d.ts","sourceRoot":"","sources":["../../../src/mcp/lib/verification-gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,SAAS,EACT,UAAU,EACV,yBAAyB,EACzB,uBAAuB,EACvB,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EACV,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC"}

package/dist/mcp/lib/verification-gates.js

@@ -1,12 +0,0 @@
-/**
- * Verification Gate System for CLEO MCP Server
- *
- * Re-exports from canonical location at src/core/validation/operation-verification-gates.ts.
- * Retained for backward compatibility.
- *
- * @task T2936
- * @task T5707
- * @epic T2908
- */
-export { createVerificationGate, GATE_SEQUENCE, GateLayer, GateStatus, getWorkflowGateDefinition, isValidWorkflowGateName, VerificationGate, WORKFLOW_GATE_DEFINITIONS, WORKFLOW_GATE_SEQUENCE, WorkflowGateName, WorkflowGateTracker, } from '@cleocode/core/internal';
-//# sourceMappingURL=verification-gates.js.map

package/dist/mcp/lib/verification-gates.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verification-gates.js","sourceRoot":"","sources":["../../../src/mcp/lib/verification-gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,SAAS,EACT,UAAU,EACV,yBAAyB,EACzB,uBAAuB,EACvB,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC"}