@cleocode/cleo 2026.3.56 → 2026.3.58

package/dist/mcp/lib/defaults.js

@@ -0,0 +1,61 @@
+/**
+ * Default configuration values for CLEO MCP Server
+ *
+ * @task T2928
+ * @task T3145
+ * @task T2916 - Rate limiting configuration (Section 13.3)
+ */
+import { DEFAULT_RATE_LIMITING } from './rate-limiter.js';
+export { DEFAULT_RATE_LIMITING } from './rate-limiter.js';
+/**
+ * Default lifecycle enforcement configuration
+ */
+export const DEFAULT_LIFECYCLE_ENFORCEMENT = {
+    mode: 'strict',
+    allowSkip: ['consensus'],
+    emergencyBypass: false,
+};
+/**
+ * Default protocol validation configuration
+ */
+export const DEFAULT_PROTOCOL_VALIDATION = {
+    strictMode: true,
+    blockOnViolation: true,
+    logViolations: true,
+};
+/**
+ * Default configuration values
+ */
+export const DEFAULT_CONFIG = {
+    cliPath: 'cleo',
+    timeout: 30000, // 30 seconds
+    logLevel: 'info',
+    enableMetrics: false,
+    maxRetries: 3,
+    queryCache: true,
+    queryCacheTtl: 30000, // 30 seconds
+    auditLog: true,
+    strictValidation: true,
+    lifecycleEnforcement: { ...DEFAULT_LIFECYCLE_ENFORCEMENT },
+    protocolValidation: { ...DEFAULT_PROTOCOL_VALIDATION },
+    rateLimiting: { ...DEFAULT_RATE_LIMITING },
+};
+/**
+ * Environment variable prefix for CLEO configuration
+ */
+export const ENV_PREFIX = 'CLEO_MCP_';
+/**
+ * Configuration schema for validation
+ */
+export const CONFIG_SCHEMA = {
+    cliPath: { type: 'string', required: true },
+    timeout: { type: 'number', min: 1000, max: 300000 },
+    logLevel: { type: 'string', enum: ['debug', 'info', 'warn', 'error'] },
+    enableMetrics: { type: 'boolean' },
+    maxRetries: { type: 'number', min: 0, max: 10 },
+    queryCache: { type: 'boolean' },
+    queryCacheTtl: { type: 'number', min: 0, max: 600000 },
+    auditLog: { type: 'boolean' },
+    strictValidation: { type: 'boolean' },
+};
+//# sourceMappingURL=defaults.js.map

package/dist/mcp/lib/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../../src/mcp/lib/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAgE1D;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA+B;IACvE,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,CAAC,WAAW,CAAC;IACxB,eAAe,EAAE,KAAK;CACvB,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAA6B;IACnE,UAAU,EAAE,IAAI;IAChB,gBAAgB,EAAE,IAAI;IACtB,aAAa,EAAE,IAAI;CACpB,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAc;IACvC,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,KAAK,EAAE,aAAa;IAC7B,QAAQ,EAAE,MAAM;IAChB,aAAa,EAAE,KAAK;IACpB,UAAU,EAAE,CAAC;IACb,UAAU,EAAE,IAAI;IAChB,aAAa,EAAE,KAAK,EAAE,aAAa;IACnC,QAAQ,EAAE,IAAI;IACd,gBAAgB,EAAE,IAAI;IACtB,oBAAoB,EAAE,EAAE,GAAG,6BAA6B,EAAE;IAC1D,kBAAkB,EAAE,EAAE,GAAG,2BAA2B,EAAE;IACtD,YAAY,EAAE,EAAE,GAAG,qBAAqB,EAAE;CAC3C,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE;IACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IACtE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE;IACtD,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7B,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CAC7B,CAAC"}

package/dist/mcp/lib/gate-validators.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Gate Validators for 4-Layer Verification System
+ *
+ * Re-exports from canonical location at src/core/validation/operation-gate-validators.ts.
+ * Retained for backward compatibility.
+ *
+ * @task T2936
+ * @task T3138
+ * @task T5707
+ * @epic T2908
+ */
+export { GATE_VALIDATION_RULES as VALIDATION_RULES, isFieldRequired, VALID_WORKFLOW_AGENTS, VALID_WORKFLOW_GATE_STATUSES, validateLayer1Schema, validateLayer2Semantic, validateLayer3Referential, validateLayer4Protocol, validateWorkflowGateName, validateWorkflowGateStatus, validateWorkflowGateUpdate, } from '@cleocode/core/internal';
+//# sourceMappingURL=gate-validators.d.ts.map

package/dist/mcp/lib/gate-validators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-validators.d.ts","sourceRoot":"","sources":["../../../src/mcp/lib/gate-validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,qBAAqB,IAAI,gBAAgB,EACzC,eAAe,EACf,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC"}

package/dist/mcp/lib/gate-validators.js

@@ -0,0 +1,13 @@
+/**
+ * Gate Validators for 4-Layer Verification System
+ *
+ * Re-exports from canonical location at src/core/validation/operation-gate-validators.ts.
+ * Retained for backward compatibility.
+ *
+ * @task T2936
+ * @task T3138
+ * @task T5707
+ * @epic T2908
+ */
+export { GATE_VALIDATION_RULES as VALIDATION_RULES, isFieldRequired, VALID_WORKFLOW_AGENTS, VALID_WORKFLOW_GATE_STATUSES, validateLayer1Schema, validateLayer2Semantic, validateLayer3Referential, validateLayer4Protocol, validateWorkflowGateName, validateWorkflowGateStatus, validateWorkflowGateUpdate, } from '@cleocode/core/internal';
+//# sourceMappingURL=gate-validators.js.map

package/dist/mcp/lib/gate-validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-validators.js","sourceRoot":"","sources":["../../../src/mcp/lib/gate-validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,qBAAqB,IAAI,gBAAgB,EACzC,eAAe,EACf,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC"}

package/dist/mcp/lib/gateway-meta.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Gateway metadata factory for MCP domain handlers.
+ *
+ * Creates LAFS-conformant GatewayMeta objects with all required fields,
+ * replacing the inline _meta construction previously duplicated across
+ * every domain handler.
+ *
+ * Uses the canonical GatewayMeta type from src/types/lafs.ts (which
+ * extends LAFSMeta from @cleocode/lafs-protocol) to ensure LAFS v1.2.3
+ * conformance.  Transport is 'sdk' per LAFS spec (MCP uses the SDK transport).
+ *
+ * @epic T4663
+ * @task T4700
+ */
+import type { GatewayMeta } from '@cleocode/contracts';
+/**
+ * GatewayMeta with an index signature for DomainResponse._meta
+ * compatibility.  All domain handlers receive this from
+ * createGatewayMeta().
+ *
+ * @task T4655
+ */
+export type GatewayMetaRecord = GatewayMeta & Record<string, unknown>;
+/**
+ * Create a fully typed GatewayMeta for MCP domain responses.
+ *
+ * @param gateway - Gateway name (e.g., 'query', 'mutate')
+ * @param domain - Domain name (e.g., 'tasks', 'session')
+ * @param operation - Operation name (e.g., 'show', 'list')
+ * @param startTime - Timestamp from Date.now() at start of request
+ * @returns GatewayMeta with all LAFS and CLEO-specific fields
+ *
+ * @task T4700
+ * @epic T4663
+ */
+export declare function createGatewayMeta(gateway: string, domain: string, operation: string, startTime: number): GatewayMetaRecord;
+//# sourceMappingURL=gateway-meta.d.ts.map

package/dist/mcp/lib/gateway-meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-meta.d.ts","sourceRoot":"","sources":["../../../src/mcp/lib/gateway-meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,iBAAiB,CAoBnB"}

package/dist/mcp/lib/gateway-meta.js

@@ -0,0 +1,50 @@
+/**
+ * Gateway metadata factory for MCP domain handlers.
+ *
+ * Creates LAFS-conformant GatewayMeta objects with all required fields,
+ * replacing the inline _meta construction previously duplicated across
+ * every domain handler.
+ *
+ * Uses the canonical GatewayMeta type from src/types/lafs.ts (which
+ * extends LAFSMeta from @cleocode/lafs-protocol) to ensure LAFS v1.2.3
+ * conformance.  Transport is 'sdk' per LAFS spec (MCP uses the SDK transport).
+ *
+ * @epic T4663
+ * @task T4700
+ */
+import { randomUUID } from 'node:crypto';
+import { getCurrentSessionId } from '@cleocode/core/internal';
+/**
+ * Create a fully typed GatewayMeta for MCP domain responses.
+ *
+ * @param gateway - Gateway name (e.g., 'query', 'mutate')
+ * @param domain - Domain name (e.g., 'tasks', 'session')
+ * @param operation - Operation name (e.g., 'show', 'list')
+ * @param startTime - Timestamp from Date.now() at start of request
+ * @returns GatewayMeta with all LAFS and CLEO-specific fields
+ *
+ * @task T4700
+ * @epic T4663
+ */
+export function createGatewayMeta(gateway, domain, operation, startTime) {
+    const sessionId = getCurrentSessionId();
+    return {
+        // LAFS canonical fields
+        specVersion: '1.2.3',
+        schemaVersion: '2026.2.1',
+        timestamp: new Date().toISOString(),
+        operation,
+        requestId: randomUUID(),
+        transport: 'sdk',
+        strict: true,
+        mvi: 'standard',
+        contextVersion: 1,
+        ...(sessionId && { sessionId }),
+        // CLEO gateway extensions
+        gateway,
+        domain,
+        duration_ms: Date.now() - startTime,
+        'x-cleo-transport': 'stdio',
+    };
+}
+//# sourceMappingURL=gateway-meta.js.map

package/dist/mcp/lib/gateway-meta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-meta.js","sourceRoot":"","sources":["../../../src/mcp/lib/gateway-meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAW9D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,MAAc,EACd,SAAiB,EACjB,SAAiB;IAEjB,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,OAAO;QACL,wBAAwB;QACxB,WAAW,EAAE,OAAO;QACpB,aAAa,EAAE,UAAU;QACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS;QACT,SAAS,EAAE,UAAU,EAAE;QACvB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,UAAU;QACf,cAAc,EAAE,CAAC;QACjB,GAAG,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;QAC/B,0BAA0B;QAC1B,OAAO;QACP,MAAM;QACN,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACnC,kBAAkB,EAAE,OAAO;KAC5B,CAAC;AACJ,CAAC"}

package/dist/mcp/lib/job-manager-accessor.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Singleton accessor for BackgroundJobManager.
+ * Allows the dispatch layer to access the job manager without MCP coupling.
+ *
+ * @task T4820
+ */
+import type { BackgroundJobManager } from './background-jobs.js';
+export declare function setJobManager(manager: BackgroundJobManager): void;
+export declare function getJobManager(): BackgroundJobManager | null;
+//# sourceMappingURL=job-manager-accessor.d.ts.map

package/dist/mcp/lib/job-manager-accessor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-manager-accessor.d.ts","sourceRoot":"","sources":["../../../src/mcp/lib/job-manager-accessor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAIjE,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAEjE;AAED,wBAAgB,aAAa,IAAI,oBAAoB,GAAG,IAAI,CAE3D"}

package/dist/mcp/lib/job-manager-accessor.js

@@ -0,0 +1,14 @@
+/**
+ * Singleton accessor for BackgroundJobManager.
+ * Allows the dispatch layer to access the job manager without MCP coupling.
+ *
+ * @task T4820
+ */
+let _instance = null;
+export function setJobManager(manager) {
+    _instance = manager;
+}
+export function getJobManager() {
+    return _instance;
+}
+//# sourceMappingURL=job-manager-accessor.js.map

package/dist/mcp/lib/job-manager-accessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-manager-accessor.js","sourceRoot":"","sources":["../../../src/mcp/lib/job-manager-accessor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,IAAI,SAAS,GAAgC,IAAI,CAAC;AAElD,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,SAAS,GAAG,OAAO,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/mcp/lib/protocol-enforcement.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Protocol Enforcement Middleware for CLEO MCP Server
+ *
+ * Re-exports from canonical location at src/core/compliance/protocol-enforcement.ts.
+ * Retained for backward compatibility.
+ *
+ * @task T2918
+ * @task T5707
+ * @epic T2908
+ */
+export { ProtocolEnforcer, ProtocolType, protocolEnforcer, type ViolationLogEntry, } from '@cleocode/core/internal';
+//# sourceMappingURL=protocol-enforcement.d.ts.map

package/dist/mcp/lib/protocol-enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-enforcement.d.ts","sourceRoot":"","sources":["../../../src/mcp/lib/protocol-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC"}

package/dist/mcp/lib/protocol-enforcement.js

@@ -0,0 +1,12 @@
+/**
+ * Protocol Enforcement Middleware for CLEO MCP Server
+ *
+ * Re-exports from canonical location at src/core/compliance/protocol-enforcement.ts.
+ * Retained for backward compatibility.
+ *
+ * @task T2918
+ * @task T5707
+ * @epic T2908
+ */
+export { ProtocolEnforcer, ProtocolType, protocolEnforcer, } from '@cleocode/core/internal';
+//# sourceMappingURL=protocol-enforcement.js.map

package/dist/mcp/lib/protocol-enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-enforcement.js","sourceRoot":"","sources":["../../../src/mcp/lib/protocol-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC"}

package/dist/mcp/lib/protocol-rules.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Protocol Rule Definitions for CLEO MCP Server
+ *
+ * Re-exports from canonical location at src/core/compliance/protocol-rules.ts.
+ * Retained for backward compatibility.
+ *
+ * @task T2918
+ * @task T5707
+ * @epic T2908
+ */
+export { PROTOCOL_RULES, type ProtocolRule, type ProtocolValidationResult, type ProtocolViolation, type RequirementLevel, type ViolationSeverity, } from '@cleocode/core/internal';
+//# sourceMappingURL=protocol-rules.d.ts.map

package/dist/mcp/lib/protocol-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-rules.d.ts","sourceRoot":"","sources":["../../../src/mcp/lib/protocol-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC"}

package/dist/mcp/lib/protocol-rules.js

@@ -0,0 +1,12 @@
+/**
+ * Protocol Rule Definitions for CLEO MCP Server
+ *
+ * Re-exports from canonical location at src/core/compliance/protocol-rules.ts.
+ * Retained for backward compatibility.
+ *
+ * @task T2918
+ * @task T5707
+ * @epic T2908
+ */
+export { PROTOCOL_RULES, } from '@cleocode/core/internal';
+//# sourceMappingURL=protocol-rules.js.map

package/dist/mcp/lib/protocol-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-rules.js","sourceRoot":"","sources":["../../../src/mcp/lib/protocol-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,cAAc,GAMf,MAAM,yBAAyB,CAAC"}

package/dist/mcp/lib/rate-limiter.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Rate Limiter for CLEO MCP Server
+ *
+ * Implements sliding window rate limiting per MCP-SERVER-SPECIFICATION Section 13.3:
+ * - Query operations: 100/minute (default)
+ * - Mutate operations: 30/minute (default)
+ * - Spawn operations: 10/minute (default)
+ *
+ * Uses a sliding window algorithm with per-category tracking.
+ * Limits are configurable via MCPConfig.rateLimiting.
+ *
+ * @task T2916
+ */
+/**
+ * Rate limit configuration for a single category
+ */
+export interface RateLimitConfig {
+    /** Maximum requests allowed in the window */
+    maxRequests: number;
+    /** Time window in milliseconds */
+    windowMs: number;
+}
+/**
+ * Complete rate limiting configuration
+ */
+export interface RateLimitingConfig {
+    /** Enable/disable rate limiting globally */
+    enabled: boolean;
+    /** Limits for query gateway operations */
+    query: RateLimitConfig;
+    /** Limits for mutate gateway operations */
+    mutate: RateLimitConfig;
+    /** Limits for spawn operations (orchestrate.spawn) */
+    spawn: RateLimitConfig;
+}
+/**
+ * Default rate limiting configuration per Section 13.3
+ */
+export declare const DEFAULT_RATE_LIMITING: RateLimitingConfig;
+/**
+ * Rate limit check result
+ */
+export interface RateLimitResult {
+    /** Whether the request is allowed */
+    allowed: boolean;
+    /** Requests remaining in the current window */
+    remaining: number;
+    /** Maximum requests allowed in the window */
+    limit: number;
+    /** Milliseconds until the window resets */
+    resetMs: number;
+    /** The category that was checked */
+    category: string;
+}
+/**
+ * Sliding window rate limiter
+ *
+ * Tracks request timestamps per category and rejects requests
+ * that exceed the configured limit within the time window.
+ */
+export declare class RateLimiter {
+    private buckets;
+    private config;
+    constructor(config?: Partial<RateLimitingConfig>);
+    /**
+     * Check if a request is allowed and record it if so.
+     *
+     * @param gateway - The gateway type ('query' or 'mutate')
+     * @param domain - The domain being accessed
+     * @param operation - The operation being performed
+     * @returns Rate limit check result with remaining quota
+     */
+    check(gateway: string, domain: string, operation: string): RateLimitResult;
+    /**
+     * Get current rate limit status without recording a request.
+     */
+    peek(gateway: string, domain: string, operation: string): RateLimitResult;
+    /**
+     * Reset all rate limit buckets (for testing)
+     */
+    reset(): void;
+    /**
+     * Reset a specific category bucket (for testing)
+     */
+    resetCategory(category: string): void;
+    /**
+     * Update configuration at runtime
+     */
+    updateConfig(config: Partial<RateLimitingConfig>): void;
+    /**
+     * Get current configuration (for diagnostics)
+     */
+    getConfig(): Readonly<RateLimitingConfig>;
+    /**
+     * Resolve the rate limit category for a given request.
+     *
+     * Spawn operations get their own stricter limit.
+     * Everything else is categorized by gateway type.
+     */
+    private resolveCategory;
+    /**
+     * Get the limit configuration for a category
+     */
+    private getLimitConfig;
+    /**
+     * Get or create a sliding window bucket for a category
+     */
+    private getOrCreateBucket;
+}
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/mcp/lib/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/mcp/lib/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,KAAK,EAAE,eAAe,CAAC;IACvB,2CAA2C;IAC3C,MAAM,EAAE,eAAe,CAAC;IACxB,sDAAsD;IACtD,KAAK,EAAE,eAAe,CAAC;CACxB;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAE,kBAKnC,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;CAClB;AASD;;;;;GAKG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAA+C;IAC9D,OAAO,CAAC,MAAM,CAAqB;gBAEvB,MAAM,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC;IAUhD;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe;IAwD1E;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe;IA0CzE;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAIrC;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI;IAOvD;;OAEG;IACH,SAAS,IAAI,QAAQ,CAAC,kBAAkB,CAAC;IAIzC;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAcvB;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAQ1B"}

package/dist/mcp/lib/rate-limiter.js

@@ -0,0 +1,208 @@
+/**
+ * Rate Limiter for CLEO MCP Server
+ *
+ * Implements sliding window rate limiting per MCP-SERVER-SPECIFICATION Section 13.3:
+ * - Query operations: 100/minute (default)
+ * - Mutate operations: 30/minute (default)
+ * - Spawn operations: 10/minute (default)
+ *
+ * Uses a sliding window algorithm with per-category tracking.
+ * Limits are configurable via MCPConfig.rateLimiting.
+ *
+ * @task T2916
+ */
+/**
+ * Default rate limiting configuration per Section 13.3
+ */
+export const DEFAULT_RATE_LIMITING = {
+    enabled: true,
+    query: { maxRequests: 100, windowMs: 60_000 },
+    mutate: { maxRequests: 30, windowMs: 60_000 },
+    spawn: { maxRequests: 10, windowMs: 60_000 },
+};
+/**
+ * Sliding window rate limiter
+ *
+ * Tracks request timestamps per category and rejects requests
+ * that exceed the configured limit within the time window.
+ */
+export class RateLimiter {
+    buckets = new Map();
+    config;
+    constructor(config) {
+        this.config = {
+            ...DEFAULT_RATE_LIMITING,
+            ...config,
+            query: { ...DEFAULT_RATE_LIMITING.query, ...config?.query },
+            mutate: { ...DEFAULT_RATE_LIMITING.mutate, ...config?.mutate },
+            spawn: { ...DEFAULT_RATE_LIMITING.spawn, ...config?.spawn },
+        };
+    }
+    /**
+     * Check if a request is allowed and record it if so.
+     *
+     * @param gateway - The gateway type ('query' or 'mutate')
+     * @param domain - The domain being accessed
+     * @param operation - The operation being performed
+     * @returns Rate limit check result with remaining quota
+     */
+    check(gateway, domain, operation) {
+        if (!this.config.enabled) {
+            return {
+                allowed: true,
+                remaining: Infinity,
+                limit: Infinity,
+                resetMs: 0,
+                category: 'disabled',
+            };
+        }
+        // Determine the rate limit category
+        const category = this.resolveCategory(gateway, domain, operation);
+        const limitConfig = this.getLimitConfig(category);
+        const now = Date.now();
+        const windowStart = now - limitConfig.windowMs;
+        // Get or create bucket
+        const bucket = this.getOrCreateBucket(category);
+        // Prune expired timestamps
+        bucket.timestamps = bucket.timestamps.filter((ts) => ts > windowStart);
+        // Check limit
+        if (bucket.timestamps.length >= limitConfig.maxRequests) {
+            // Find earliest timestamp to compute reset time
+            const earliestInWindow = bucket.timestamps[0];
+            const resetMs = earliestInWindow + limitConfig.windowMs - now;
+            return {
+                allowed: false,
+                remaining: 0,
+                limit: limitConfig.maxRequests,
+                resetMs: Math.max(0, resetMs),
+                category,
+            };
+        }
+        // Record this request
+        bucket.timestamps.push(now);
+        const remaining = limitConfig.maxRequests - bucket.timestamps.length;
+        return {
+            allowed: true,
+            remaining,
+            limit: limitConfig.maxRequests,
+            resetMs: bucket.timestamps.length > 0
+                ? bucket.timestamps[0] + limitConfig.windowMs - now
+                : limitConfig.windowMs,
+            category,
+        };
+    }
+    /**
+     * Get current rate limit status without recording a request.
+     */
+    peek(gateway, domain, operation) {
+        if (!this.config.enabled) {
+            return {
+                allowed: true,
+                remaining: Infinity,
+                limit: Infinity,
+                resetMs: 0,
+                category: 'disabled',
+            };
+        }
+        const category = this.resolveCategory(gateway, domain, operation);
+        const limitConfig = this.getLimitConfig(category);
+        const now = Date.now();
+        const windowStart = now - limitConfig.windowMs;
+        const bucket = this.buckets.get(category);
+        if (!bucket) {
+            return {
+                allowed: true,
+                remaining: limitConfig.maxRequests,
+                limit: limitConfig.maxRequests,
+                resetMs: limitConfig.windowMs,
+                category,
+            };
+        }
+        const activeTimestamps = bucket.timestamps.filter((ts) => ts > windowStart);
+        const remaining = limitConfig.maxRequests - activeTimestamps.length;
+        return {
+            allowed: remaining > 0,
+            remaining: Math.max(0, remaining),
+            limit: limitConfig.maxRequests,
+            resetMs: activeTimestamps.length > 0
+                ? activeTimestamps[0] + limitConfig.windowMs - now
+                : limitConfig.windowMs,
+            category,
+        };
+    }
+    /**
+     * Reset all rate limit buckets (for testing)
+     */
+    reset() {
+        this.buckets.clear();
+    }
+    /**
+     * Reset a specific category bucket (for testing)
+     */
+    resetCategory(category) {
+        this.buckets.delete(category);
+    }
+    /**
+     * Update configuration at runtime
+     */
+    updateConfig(config) {
+        if (config.enabled !== undefined)
+            this.config.enabled = config.enabled;
+        if (config.query)
+            this.config.query = { ...this.config.query, ...config.query };
+        if (config.mutate)
+            this.config.mutate = { ...this.config.mutate, ...config.mutate };
+        if (config.spawn)
+            this.config.spawn = { ...this.config.spawn, ...config.spawn };
+    }
+    /**
+     * Get current configuration (for diagnostics)
+     */
+    getConfig() {
+        return { ...this.config };
+    }
+    /**
+     * Resolve the rate limit category for a given request.
+     *
+     * Spawn operations get their own stricter limit.
+     * Everything else is categorized by gateway type.
+     */
+    resolveCategory(gateway, domain, operation) {
+        // Spawn operations have their own limit
+        if (domain === 'orchestrate' && operation === 'spawn') {
+            return 'spawn';
+        }
+        // Map gateway to category
+        if (gateway === 'query') {
+            return 'query';
+        }
+        return 'mutate';
+    }
+    /**
+     * Get the limit configuration for a category
+     */
+    getLimitConfig(category) {
+        switch (category) {
+            case 'query':
+                return this.config.query;
+            case 'mutate':
+                return this.config.mutate;
+            case 'spawn':
+                return this.config.spawn;
+            default:
+                return this.config.mutate;
+        }
+    }
+    /**
+     * Get or create a sliding window bucket for a category
+     */
+    getOrCreateBucket(category) {
+        let bucket = this.buckets.get(category);
+        if (!bucket) {
+            bucket = { timestamps: [] };
+            this.buckets.set(category, bucket);
+        }
+        return bucket;
+    }
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/mcp/lib/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/mcp/lib/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA0BH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAuB;IACvD,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7C,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7C,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;CAC7C,CAAC;AAyBF;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IACd,OAAO,GAAqC,IAAI,GAAG,EAAE,CAAC;IACtD,MAAM,CAAqB;IAEnC,YAAY,MAAoC;QAC9C,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,qBAAqB;YACxB,GAAG,MAAM;YACT,KAAK,EAAE,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE;YAC3D,MAAM,EAAE,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE;YAC9D,KAAK,EAAE,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE;SAC5D,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAe,EAAE,MAAc,EAAE,SAAiB;QACtD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,CAAC;gBACV,QAAQ,EAAE,UAAU;aACrB,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC;QAE/C,uBAAuB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEhD,2BAA2B;QAC3B,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;QAEvE,cAAc;QACd,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC;YACxD,gDAAgD;YAChD,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,gBAAgB,GAAG,WAAW,CAAC,QAAQ,GAAG,GAAG,CAAC;YAE9D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,CAAC;gBACZ,KAAK,EAAE,WAAW,CAAC,WAAW;gBAC9B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC;gBAC7B,QAAQ;aACT,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE5B,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAErE,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS;YACT,KAAK,EAAE,WAAW,CAAC,WAAW;YAC9B,OAAO,EACL,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBAC1B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,GAAG,GAAG;gBACnD,CAAC,CAAC,WAAW,CAAC,QAAQ;YAC1B,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,OAAe,EAAE,MAAc,EAAE,SAAiB;QACrD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,CAAC;gBACV,QAAQ,EAAE,UAAU;aACrB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC;QAE/C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,WAAW,CAAC,WAAW;gBAClC,KAAK,EAAE,WAAW,CAAC,WAAW;gBAC9B,OAAO,EAAE,WAAW,CAAC,QAAQ;gBAC7B,QAAQ;aACT,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC;QAEpE,OAAO;YACL,OAAO,EAAE,SAAS,GAAG,CAAC;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC;YACjC,KAAK,EAAE,WAAW,CAAC,WAAW;YAC9B,OAAO,EACL,gBAAgB,CAAC,MAAM,GAAG,CAAC;gBACzB,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,GAAG,GAAG;gBAClD,CAAC,CAAC,WAAW,CAAC,QAAQ;YAC1B,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,QAAgB;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAmC;QAC9C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACvE,IAAI,MAAM,CAAC,KAAK;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QAChF,IAAI,MAAM,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACpF,IAAI,MAAM,CAAC,KAAK;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IAClF,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,OAAe,EAAE,MAAc,EAAE,SAAiB;QACxE,wCAAwC;QACxC,IAAI,MAAM,KAAK,aAAa,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YACtD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,0BAA0B;QAC1B,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,QAAgB;QACrC,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAC3B,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAC5B,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAC3B;gBACE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,QAAgB;QACxC,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}