@cleocode/cleo 2026.3.74 → 2026.3.76

package/dist/mcp/lib/protocol-rules.js

@@ -1,12 +0,0 @@
-/**
- * Protocol Rule Definitions for CLEO MCP Server
- *
- * Re-exports from canonical location at src/core/compliance/protocol-rules.ts.
- * Retained for backward compatibility.
- *
- * @task T2918
- * @task T5707
- * @epic T2908
- */
-export { PROTOCOL_RULES, } from '@cleocode/core/internal';
-//# sourceMappingURL=protocol-rules.js.map

package/dist/mcp/lib/protocol-rules.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"protocol-rules.js","sourceRoot":"","sources":["../../../src/mcp/lib/protocol-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,cAAc,GAMf,MAAM,yBAAyB,CAAC"}

package/dist/mcp/lib/rate-limiter.d.ts

@@ -1,110 +0,0 @@
-/**
- * Rate Limiter for CLEO MCP Server
- *
- * Implements sliding window rate limiting per MCP-SERVER-SPECIFICATION Section 13.3:
- * - Query operations: 100/minute (default)
- * - Mutate operations: 30/minute (default)
- * - Spawn operations: 10/minute (default)
- *
- * Uses a sliding window algorithm with per-category tracking.
- * Limits are configurable via MCPConfig.rateLimiting.
- *
- * @task T2916
- */
-/**
- * Rate limit configuration for a single category
- */
-export interface RateLimitConfig {
-    /** Maximum requests allowed in the window */
-    maxRequests: number;
-    /** Time window in milliseconds */
-    windowMs: number;
-}
-/**
- * Complete rate limiting configuration
- */
-export interface RateLimitingConfig {
-    /** Enable/disable rate limiting globally */
-    enabled: boolean;
-    /** Limits for query gateway operations */
-    query: RateLimitConfig;
-    /** Limits for mutate gateway operations */
-    mutate: RateLimitConfig;
-    /** Limits for spawn operations (orchestrate.spawn) */
-    spawn: RateLimitConfig;
-}
-/**
- * Default rate limiting configuration per Section 13.3
- */
-export declare const DEFAULT_RATE_LIMITING: RateLimitingConfig;
-/**
- * Rate limit check result
- */
-export interface RateLimitResult {
-    /** Whether the request is allowed */
-    allowed: boolean;
-    /** Requests remaining in the current window */
-    remaining: number;
-    /** Maximum requests allowed in the window */
-    limit: number;
-    /** Milliseconds until the window resets */
-    resetMs: number;
-    /** The category that was checked */
-    category: string;
-}
-/**
- * Sliding window rate limiter
- *
- * Tracks request timestamps per category and rejects requests
- * that exceed the configured limit within the time window.
- */
-export declare class RateLimiter {
-    private buckets;
-    private config;
-    constructor(config?: Partial<RateLimitingConfig>);
-    /**
-     * Check if a request is allowed and record it if so.
-     *
-     * @param gateway - The gateway type ('query' or 'mutate')
-     * @param domain - The domain being accessed
-     * @param operation - The operation being performed
-     * @returns Rate limit check result with remaining quota
-     */
-    check(gateway: string, domain: string, operation: string): RateLimitResult;
-    /**
-     * Get current rate limit status without recording a request.
-     */
-    peek(gateway: string, domain: string, operation: string): RateLimitResult;
-    /**
-     * Reset all rate limit buckets (for testing)
-     */
-    reset(): void;
-    /**
-     * Reset a specific category bucket (for testing)
-     */
-    resetCategory(category: string): void;
-    /**
-     * Update configuration at runtime
-     */
-    updateConfig(config: Partial<RateLimitingConfig>): void;
-    /**
-     * Get current configuration (for diagnostics)
-     */
-    getConfig(): Readonly<RateLimitingConfig>;
-    /**
-     * Resolve the rate limit category for a given request.
-     *
-     * Spawn operations get their own stricter limit.
-     * Everything else is categorized by gateway type.
-     */
-    private resolveCategory;
-    /**
-     * Get the limit configuration for a category
-     */
-    private getLimitConfig;
-    /**
-     * Get or create a sliding window bucket for a category
-     */
-    private getOrCreateBucket;
-}
-//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/mcp/lib/rate-limiter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/mcp/lib/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,KAAK,EAAE,eAAe,CAAC;IACvB,2CAA2C;IAC3C,MAAM,EAAE,eAAe,CAAC;IACxB,sDAAsD;IACtD,KAAK,EAAE,eAAe,CAAC;CACxB;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAE,kBAKnC,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;CAClB;AASD;;;;;GAKG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAA+C;IAC9D,OAAO,CAAC,MAAM,CAAqB;gBAEvB,MAAM,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC;IAUhD;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe;IAwD1E;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe;IA0CzE;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAIrC;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI;IAOvD;;OAEG;IACH,SAAS,IAAI,QAAQ,CAAC,kBAAkB,CAAC;IAIzC;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAcvB;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAQ1B"}

package/dist/mcp/lib/rate-limiter.js

@@ -1,208 +0,0 @@
-/**
- * Rate Limiter for CLEO MCP Server
- *
- * Implements sliding window rate limiting per MCP-SERVER-SPECIFICATION Section 13.3:
- * - Query operations: 100/minute (default)
- * - Mutate operations: 30/minute (default)
- * - Spawn operations: 10/minute (default)
- *
- * Uses a sliding window algorithm with per-category tracking.
- * Limits are configurable via MCPConfig.rateLimiting.
- *
- * @task T2916
- */
-/**
- * Default rate limiting configuration per Section 13.3
- */
-export const DEFAULT_RATE_LIMITING = {
-    enabled: true,
-    query: { maxRequests: 100, windowMs: 60_000 },
-    mutate: { maxRequests: 30, windowMs: 60_000 },
-    spawn: { maxRequests: 10, windowMs: 60_000 },
-};
-/**
- * Sliding window rate limiter
- *
- * Tracks request timestamps per category and rejects requests
- * that exceed the configured limit within the time window.
- */
-export class RateLimiter {
-    buckets = new Map();
-    config;
-    constructor(config) {
-        this.config = {
-            ...DEFAULT_RATE_LIMITING,
-            ...config,
-            query: { ...DEFAULT_RATE_LIMITING.query, ...config?.query },
-            mutate: { ...DEFAULT_RATE_LIMITING.mutate, ...config?.mutate },
-            spawn: { ...DEFAULT_RATE_LIMITING.spawn, ...config?.spawn },
-        };
-    }
-    /**
-     * Check if a request is allowed and record it if so.
-     *
-     * @param gateway - The gateway type ('query' or 'mutate')
-     * @param domain - The domain being accessed
-     * @param operation - The operation being performed
-     * @returns Rate limit check result with remaining quota
-     */
-    check(gateway, domain, operation) {
-        if (!this.config.enabled) {
-            return {
-                allowed: true,
-                remaining: Infinity,
-                limit: Infinity,
-                resetMs: 0,
-                category: 'disabled',
-            };
-        }
-        // Determine the rate limit category
-        const category = this.resolveCategory(gateway, domain, operation);
-        const limitConfig = this.getLimitConfig(category);
-        const now = Date.now();
-        const windowStart = now - limitConfig.windowMs;
-        // Get or create bucket
-        const bucket = this.getOrCreateBucket(category);
-        // Prune expired timestamps
-        bucket.timestamps = bucket.timestamps.filter((ts) => ts > windowStart);
-        // Check limit
-        if (bucket.timestamps.length >= limitConfig.maxRequests) {
-            // Find earliest timestamp to compute reset time
-            const earliestInWindow = bucket.timestamps[0];
-            const resetMs = earliestInWindow + limitConfig.windowMs - now;
-            return {
-                allowed: false,
-                remaining: 0,
-                limit: limitConfig.maxRequests,
-                resetMs: Math.max(0, resetMs),
-                category,
-            };
-        }
-        // Record this request
-        bucket.timestamps.push(now);
-        const remaining = limitConfig.maxRequests - bucket.timestamps.length;
-        return {
-            allowed: true,
-            remaining,
-            limit: limitConfig.maxRequests,
-            resetMs: bucket.timestamps.length > 0
-                ? bucket.timestamps[0] + limitConfig.windowMs - now
-                : limitConfig.windowMs,
-            category,
-        };
-    }
-    /**
-     * Get current rate limit status without recording a request.
-     */
-    peek(gateway, domain, operation) {
-        if (!this.config.enabled) {
-            return {
-                allowed: true,
-                remaining: Infinity,
-                limit: Infinity,
-                resetMs: 0,
-                category: 'disabled',
-            };
-        }
-        const category = this.resolveCategory(gateway, domain, operation);
-        const limitConfig = this.getLimitConfig(category);
-        const now = Date.now();
-        const windowStart = now - limitConfig.windowMs;
-        const bucket = this.buckets.get(category);
-        if (!bucket) {
-            return {
-                allowed: true,
-                remaining: limitConfig.maxRequests,
-                limit: limitConfig.maxRequests,
-                resetMs: limitConfig.windowMs,
-                category,
-            };
-        }
-        const activeTimestamps = bucket.timestamps.filter((ts) => ts > windowStart);
-        const remaining = limitConfig.maxRequests - activeTimestamps.length;
-        return {
-            allowed: remaining > 0,
-            remaining: Math.max(0, remaining),
-            limit: limitConfig.maxRequests,
-            resetMs: activeTimestamps.length > 0
-                ? activeTimestamps[0] + limitConfig.windowMs - now
-                : limitConfig.windowMs,
-            category,
-        };
-    }
-    /**
-     * Reset all rate limit buckets (for testing)
-     */
-    reset() {
-        this.buckets.clear();
-    }
-    /**
-     * Reset a specific category bucket (for testing)
-     */
-    resetCategory(category) {
-        this.buckets.delete(category);
-    }
-    /**
-     * Update configuration at runtime
-     */
-    updateConfig(config) {
-        if (config.enabled !== undefined)
-            this.config.enabled = config.enabled;
-        if (config.query)
-            this.config.query = { ...this.config.query, ...config.query };
-        if (config.mutate)
-            this.config.mutate = { ...this.config.mutate, ...config.mutate };
-        if (config.spawn)
-            this.config.spawn = { ...this.config.spawn, ...config.spawn };
-    }
-    /**
-     * Get current configuration (for diagnostics)
-     */
-    getConfig() {
-        return { ...this.config };
-    }
-    /**
-     * Resolve the rate limit category for a given request.
-     *
-     * Spawn operations get their own stricter limit.
-     * Everything else is categorized by gateway type.
-     */
-    resolveCategory(gateway, domain, operation) {
-        // Spawn operations have their own limit
-        if (domain === 'orchestrate' && operation === 'spawn') {
-            return 'spawn';
-        }
-        // Map gateway to category
-        if (gateway === 'query') {
-            return 'query';
-        }
-        return 'mutate';
-    }
-    /**
-     * Get the limit configuration for a category
-     */
-    getLimitConfig(category) {
-        switch (category) {
-            case 'query':
-                return this.config.query;
-            case 'mutate':
-                return this.config.mutate;
-            case 'spawn':
-                return this.config.spawn;
-            default:
-                return this.config.mutate;
-        }
-    }
-    /**
-     * Get or create a sliding window bucket for a category
-     */
-    getOrCreateBucket(category) {
-        let bucket = this.buckets.get(category);
-        if (!bucket) {
-            bucket = { timestamps: [] };
-            this.buckets.set(category, bucket);
-        }
-        return bucket;
-    }
-}
-//# sourceMappingURL=rate-limiter.js.map

package/dist/mcp/lib/rate-limiter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/mcp/lib/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA0BH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAuB;IACvD,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7C,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7C,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;CAC7C,CAAC;AAyBF;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IACd,OAAO,GAAqC,IAAI,GAAG,EAAE,CAAC;IACtD,MAAM,CAAqB;IAEnC,YAAY,MAAoC;QAC9C,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,qBAAqB;YACxB,GAAG,MAAM;YACT,KAAK,EAAE,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE;YAC3D,MAAM,EAAE,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE;YAC9D,KAAK,EAAE,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE;SAC5D,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAe,EAAE,MAAc,EAAE,SAAiB;QACtD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,CAAC;gBACV,QAAQ,EAAE,UAAU;aACrB,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC;QAE/C,uBAAuB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEhD,2BAA2B;QAC3B,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;QAEvE,cAAc;QACd,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC;YACxD,gDAAgD;YAChD,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,gBAAgB,GAAG,WAAW,CAAC,QAAQ,GAAG,GAAG,CAAC;YAE9D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,CAAC;gBACZ,KAAK,EAAE,WAAW,CAAC,WAAW;gBAC9B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC;gBAC7B,QAAQ;aACT,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE5B,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAErE,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS;YACT,KAAK,EAAE,WAAW,CAAC,WAAW;YAC9B,OAAO,EACL,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBAC1B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,GAAG,GAAG;gBACnD,CAAC,CAAC,WAAW,CAAC,QAAQ;YAC1B,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,OAAe,EAAE,MAAc,EAAE,SAAiB;QACrD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,CAAC;gBACV,QAAQ,EAAE,UAAU;aACrB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC;QAE/C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,WAAW,CAAC,WAAW;gBAClC,KAAK,EAAE,WAAW,CAAC,WAAW;gBAC9B,OAAO,EAAE,WAAW,CAAC,QAAQ;gBAC7B,QAAQ;aACT,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC;QAEpE,OAAO;YACL,OAAO,EAAE,SAAS,GAAG,CAAC;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC;YACjC,KAAK,EAAE,WAAW,CAAC,WAAW;YAC9B,OAAO,EACL,gBAAgB,CAAC,MAAM,GAAG,CAAC;gBACzB,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,GAAG,GAAG;gBAClD,CAAC,CAAC,WAAW,CAAC,QAAQ;YAC1B,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,QAAgB;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAmC;QAC9C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACvE,IAAI,MAAM,CAAC,KAAK;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QAChF,IAAI,MAAM,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACpF,IAAI,MAAM,CAAC,KAAK;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IAClF,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,OAAe,EAAE,MAAc,EAAE,SAAiB;QACxE,wCAAwC;QACxC,IAAI,MAAM,KAAK,aAAa,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YACtD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,0BAA0B;QAC1B,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,QAAgB;QACrC,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAC3B,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAC5B,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAC3B;gBACE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,QAAgB;QACxC,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/mcp/lib/router.d.ts

@@ -1,58 +0,0 @@
-/**
- * Legacy Domain Router Types
- *
- * This file retains only the DomainRequest / DomainResponse interfaces
- * used by the gateway tool definitions (query.ts and mutate.ts) and
- * protocol enforcement. The DomainRouter class has been removed —
- * all routing now goes through the dispatch layer.
- *
- * @task T2911
- */
-/**
- * Request from MCP gateway
- */
-export interface DomainRequest {
-    gateway: 'query' | 'mutate';
-    domain: string;
-    operation: string;
-    params?: Record<string, unknown>;
-}
-/**
- * Response from domain handler
- */
-export interface DomainResponse {
-    _meta: {
-        gateway: string;
-        domain: string;
-        operation: string;
-        timestamp: string;
-        duration_ms: number;
-        [key: string]: unknown;
-    };
-    success: boolean;
-    data?: unknown;
-    partial?: boolean;
-    error?: {
-        code: string;
-        exitCode?: number;
-        message: string;
-        details?: Record<string, unknown>;
-        fix?: string;
-        alternatives?: Array<{
-            action: string;
-            command: string;
-        }>;
-    };
-}
-/**
- * Domain handler interface (legacy - retained for type compatibility)
- */
-export interface DomainHandler {
-    query(operation: string, params?: Record<string, unknown>): Promise<DomainResponse>;
-    mutate(operation: string, params?: Record<string, unknown>): Promise<DomainResponse>;
-    getSupportedOperations(): {
-        query: string[];
-        mutate: string[];
-    };
-}
-//# sourceMappingURL=router.d.ts.map

package/dist/mcp/lib/router.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/mcp/lib/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE;QACL,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC3D,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACpF,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrF,sBAAsB,IAAI;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CACjE"}

package/dist/mcp/lib/router.js

@@ -1,12 +0,0 @@
-/**
- * Legacy Domain Router Types
- *
- * This file retains only the DomainRequest / DomainResponse interfaces
- * used by the gateway tool definitions (query.ts and mutate.ts) and
- * protocol enforcement. The DomainRouter class has been removed —
- * all routing now goes through the dispatch layer.
- *
- * @task T2911
- */
-export {};
-//# sourceMappingURL=router.js.map

package/dist/mcp/lib/router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../../src/mcp/lib/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/mcp/lib/security.d.ts

@@ -1,161 +0,0 @@
-/**
- * Security Hardening and Input Sanitization for CLEO MCP Server
- *
- * Provides input validation, path sanitization, content filtering,
- * enum checking, and rate limiting for all MCP operations.
- *
- * @task T3144
- * @epic T3125
- */
-/**
- * Security validation error thrown when input fails sanitization
- */
-export declare class SecurityError extends Error {
-    code: string;
-    field?: string | undefined;
-    constructor(message: string, code?: string, field?: string | undefined);
-}
-/**
- * Sanitize and validate a task ID
- *
- * Validates format: ^T[0-9]+$
- * Rejects empty, malformed, or excessively large IDs
- *
- * @param id - Raw task ID input
- * @returns Sanitized task ID
- * @throws SecurityError if ID is invalid
- */
-export declare function sanitizeTaskId(value: unknown): string;
-/**
- * Sanitize and validate a file path
- *
- * Prevents path traversal attacks by ensuring the resolved path
- * stays within the project root directory.
- *
- * @param path - Raw path input
- * @param projectRoot - Project root directory (absolute path)
- * @returns Sanitized absolute path within project root
- * @throws SecurityError if path escapes project root or is invalid
- */
-export declare function sanitizePath(path: string, projectRoot: string): string;
-/**
- * Sanitize content string
- *
- * Enforces size limits and strips control characters (except newline, tab, CR).
- *
- * @param content - Raw content string
- * @param maxLength - Maximum allowed length (default: 64KB)
- * @returns Sanitized content string
- * @throws SecurityError if content exceeds size limit
- */
-export declare function sanitizeContent(content: string, maxLength?: number): string;
-/**
- * Validate that a value is in an allowed enum set
- *
- * @param value - Value to validate
- * @param allowed - Array of allowed values
- * @param fieldName - Name of the field (for error messages)
- * @returns The validated value
- * @throws SecurityError if value is not in allowed set
- */
-export declare function validateEnum(value: string, allowed: string[], fieldName: string): string;
-/**
- * Known enum values for CLEO domains
- */
-export declare const VALID_DOMAINS: readonly ["tasks", "session", "orchestrate", "research", "lifecycle", "validate", "release", "system"];
-export declare const VALID_GATEWAYS: readonly ["query", "mutate"];
-export declare const VALID_MANIFEST_STATUSES: readonly ["completed", "partial", "blocked", "archived"];
-export declare const VALID_LIFECYCLE_STAGE_STATUSES: readonly ["not_started", "in_progress", "blocked", "completed", "skipped", "failed"];
-export declare const ALL_VALID_STATUSES: readonly ["pending", "active", "blocked", "done", "cancelled", "archived", "completed", "partial", "blocked", "archived"];
-export declare const VALID_PRIORITIES: readonly ["critical", "high", "medium", "low"];
-/**
- * Rate limiter configuration
- */
-export interface RateLimitConfig {
-    /** Maximum requests allowed in the window */
-    maxRequests: number;
-    /** Time window in milliseconds */
-    windowMs: number;
-}
-/**
- * Rate limit check result
- */
-export interface RateLimitResult {
-    /** Whether the request is allowed */
-    allowed: boolean;
-    /** Remaining requests in current window */
-    remaining: number;
-    /** Milliseconds until window resets */
-    resetMs: number;
-    /** Total limit for the window */
-    limit: number;
-}
-/**
- * Default rate limit configurations per operation type
- */
-export declare const DEFAULT_RATE_LIMITS: Record<string, RateLimitConfig>;
-/**
- * In-memory sliding window rate limiter
- *
- * Tracks request timestamps per key and enforces configurable limits.
- */
-export declare class RateLimiter {
-    private windows;
-    private configs;
-    constructor(configs?: Record<string, RateLimitConfig>);
-    /**
-     * Check if a request is allowed under rate limits
-     *
-     * @param key - Rate limit bucket key (e.g., 'query', 'mutate', 'spawn')
-     * @returns Rate limit check result
-     */
-    check(key: string): RateLimitResult;
-    /**
-     * Record a request (call after check returns allowed: true)
-     *
-     * @param key - Rate limit bucket key
-     */
-    record(key: string): void;
-    /**
-     * Check and record in one step
-     *
-     * @param key - Rate limit bucket key
-     * @returns Rate limit check result (recorded if allowed)
-     */
-    consume(key: string): RateLimitResult;
-    /**
-     * Reset rate limit state for a specific key or all keys
-     *
-     * @param key - Optional key to reset (resets all if omitted)
-     */
-    reset(key?: string): void;
-    /**
-     * Get current configuration for a key
-     */
-    getConfig(key: string): RateLimitConfig | undefined;
-    /**
-     * Update configuration for a key
-     */
-    setConfig(key: string, config: RateLimitConfig): void;
-}
-/**
- * Sanitize all params in a DomainRequest before routing
- *
- * Applies appropriate sanitization based on known field names:
- * - taskId, parent, epicId -> sanitizeTaskId
- * - path, file -> sanitizePath (if projectRoot provided)
- * - title, description, notes, content -> sanitizeContent
- * - status -> validateEnum(TASK_STATUSES)
- * - priority -> validateEnum(VALID_PRIORITIES)
- * - domain -> validateEnum(VALID_DOMAINS)
- *
- * @param params - Raw request parameters
- * @param projectRoot - Project root for path sanitization
- * @returns Sanitized parameters
- * @throws SecurityError on validation failure
- */
-export declare function sanitizeParams(params: Record<string, unknown> | undefined, projectRoot?: string, context?: {
-    domain?: string;
-    operation?: string;
-}): Record<string, unknown> | undefined;
-//# sourceMappingURL=security.d.ts.map

package/dist/mcp/lib/security.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/mcp/lib/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;GAEG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAG7B,IAAI,EAAE,MAAM;IACZ,KAAK,CAAC,EAAE,MAAM;gBAFrB,OAAO,EAAE,MAAM,EACR,IAAI,GAAE,MAA+B,EACrC,KAAK,CAAC,EAAE,MAAM,YAAA;CAKxB;AAiBD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAqBrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAgDtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,MAAmC,GAC7C,MAAM,CAeR;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAgBxF;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,wGAShB,CAAC;AAEX,eAAO,MAAM,cAAc,8BAA+B,CAAC;AAE3D,eAAO,MAAM,uBAAuB,0DAAoB,CAAC;AAEzD,eAAO,MAAM,8BAA8B,sFAA2B,CAAC;AAEvE,eAAO,MAAM,kBAAkB,2HAAoD,CAAC;AAEpF,eAAO,MAAM,gBAAgB,gDAAkB,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAI/D,CAAC;AAEF;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAoC;IACnD,OAAO,CAAC,OAAO,CAA2C;gBAE9C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;IAQrD;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe;IAiCnC;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMzB;;;;;OAKG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe;IAUrC;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI;IAQzB;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAInD;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;CAGtD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CA6FrC"}