@creezio/mcp-facade 0.22.0

package/dist/oauth/types.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Types OAuth MCP + transport Hono — adapters injectés (zéro hardcode marque).
+ */
+import type { Context, MiddlewareHandler } from "hono";
+import type { McpAdminSqliteDatabase } from "../admin/types.js";
+export type McpOAuthSqliteDatabase = McpAdminSqliteDatabase;
+/** Injection host pour le store OAuth (tables v22/v25/v27). */
+export type McpOAuthAdapters = {
+    getWriteDb: () => McpOAuthSqliteDatabase;
+    tableExists: (name: string) => boolean;
+    /** Secret JWT (défaut : process.env.MCP_JWT_SECRET). */
+    getJwtSecret?: () => string;
+    /** Resolver URL publique (défaut : MCP_PUBLIC_URL → APP_PUBLIC_URL → APP_BASE_URL). */
+    resolvePublicUrl?: () => string | null;
+};
+export type McpOAuthSessionUser = {
+    id: string;
+    username: string;
+};
+export type McpOAuthSession = {
+    email?: string | null;
+    sub?: string | null;
+};
+/**
+ * Pont session/credentials marque — ne pas hardcoder le cookie CRM.
+ */
+export type McpOAuthSessionBridge = {
+    getSessionFromContext: (c: Context) => Promise<McpOAuthSession | null | undefined>;
+    authenticateUser: (username: string, password: string) => McpOAuthSessionUser | null | Promise<McpOAuthSessionUser | null>;
+    /** Credentials legacy (setup desktop) — optionnel. */
+    validateCredentials?: (username: string, password: string) => boolean;
+    getOwnerId: () => string | null;
+    /** Pose cookie session après login consent (optionnel). */
+    createSessionCookie?: (c: Context, user: {
+        id?: string | null;
+        username: string;
+    }) => Promise<void>;
+};
+export type McpOAuthRoutesConfig = {
+    /** Titre produit pages consent (ex. « TempoFlow2 CRM »). */
+    productName: string;
+    /** resource_name metadata (défaut : `${productName} MCP`). */
+    resourceName?: string;
+    /** HTML `<li>…</li>` pour la liste de scopes consent. */
+    consentScopesHtml?: string;
+    session: McpOAuthSessionBridge;
+    /** Cookie Secure derrière tunnel (injectable ; défaut heuristique env). */
+    resolveCookieSecure?: (c: Context) => boolean;
+    /** Documentation URL path (défaut `/developers`). */
+    documentationPath?: string;
+    dcrRateLimit?: {
+        limit: number;
+        windowMs: number;
+    };
+};
+export type McpServerAuthContext = {
+    userId: string | null;
+    clientId?: string;
+    scopes?: string;
+};
+export type McpStreamableTransport = {
+    handleRequest: (c: Context) => Promise<Response> | Response;
+    close: () => Promise<void>;
+};
+export type McpConnectedServer = {
+    connect: (transport: McpStreamableTransport) => Promise<void>;
+    close: () => Promise<void>;
+};
+export type McpApiKeyRecord = {
+    id: string;
+    user_id?: string | null;
+    scopes?: string;
+};
+export type CreateMcpHonoAppOptions = {
+    /** Routes OAuth (createMcpOAuthRoutes). */
+    oauthRoutes: {
+        fetch: unknown;
+    } | import("hono").Hono;
+    buildMcpServer: (ctx: McpServerAuthContext) => Promise<McpConnectedServer>;
+    /** Factory transport Streamable HTTP (ex. `() => new StreamableHTTPTransport(...)`). */
+    createTransport: () => McpStreamableTransport;
+    /** Auth clé API locale (Hermes) — optionnel. */
+    apiKeyAuth?: {
+        prefix: string;
+        verify: (token: string) => McpApiKeyRecord | null;
+        resolveUserId?: (key: McpApiKeyRecord) => string | null;
+    };
+    ensureSchema?: () => void;
+    /** Middleware /mcp (ex. requestLogMcpMiddleware). */
+    mcpMiddleware?: MiddlewareHandler;
+    resolveCorsOrigin?: (origin: string) => string;
+    mcpRateLimit?: {
+        limit: number;
+        windowMs: number;
+    };
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/oauth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,MAAM,MAAM,sBAAsB,GAAG,sBAAsB,CAAC;AAE5D,+DAA+D;AAC/D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,MAAM,sBAAsB,CAAC;IACzC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,qBAAqB,EAAE,CACrB,CAAC,EAAE,OAAO,KACP,OAAO,CAAC,eAAe,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACjD,gBAAgB,EAAE,CAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,mBAAmB,GAAG,IAAI,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACtE,sDAAsD;IACtD,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACtE,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAChC,2DAA2D;IAC3D,mBAAmB,CAAC,EAAE,CACpB,CAAC,EAAE,OAAO,EACV,IAAI,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAC3C,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;IAC9C,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,aAAa,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;IAC5D,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,CAAC,SAAS,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,2CAA2C;IAC3C,WAAW,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,MAAM,EAAE,IAAI,CAAC;IACtD,cAAc,EAAE,CACd,GAAG,EAAE,oBAAoB,KACtB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC,wFAAwF;IACxF,eAAe,EAAE,MAAM,sBAAsB,CAAC;IAC9C,gDAAgD;IAChD,UAAU,CAAC,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,eAAe,GAAG,IAAI,CAAC;QAClD,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,GAAG,IAAI,CAAC;KACzD,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,qDAAqD;IACrD,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/C,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD,CAAC"}

package/dist/oauth/types.js

@@ -0,0 +1,5 @@
+/**
+ * Types OAuth MCP + transport Hono — adapters injectés (zéro hardcode marque).
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/oauth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/open-external-tab-host-tools.d.ts

@@ -0,0 +1,67 @@
+/**
+ * D-P18 — tool MCP host-only `open_external_tab` (desktop).
+ * SoT kit partagée TF / CV / Fidu. Métier résolution URL reste injecté.
+ */
+import { z } from "zod";
+export declare const CREEZIO_OPEN_EXTERNAL_TAB_MCP_TOOL_NAME: "open_external_tab";
+export type OpenExternalTabResolved = {
+    url: string;
+    fournisseurId: number;
+    title: string;
+    source: string;
+};
+export type OpenExternalTabResolveResult = ({
+    ok: true;
+} & OpenExternalTabResolved) | ({
+    ok: false;
+    error: string;
+} & Record<string, unknown>);
+export type OpenExternalTabHostMcpToolConfig = {
+    title: string;
+    description: string;
+    inputSchema: Record<string, z.ZodType>;
+};
+export type OpenExternalTabHostMcpRegisterFn = (name: string, config: OpenExternalTabHostMcpToolConfig, handler: (input: any) => Promise<unknown> | unknown) => void;
+export type OpenExternalTabUser = {
+    id: string;
+    role?: string;
+};
+export type CreateOpenExternalTabHostMcpToolsOptions = {
+    /** Enregistrement marque (`registerMcpTool` ou `server.registerTool`). */
+    registerTool: OpenExternalTabHostMcpRegisterFn;
+    /** `userId` du token MCP (Bearer / API key). */
+    getActorUserId: () => string | null | undefined;
+    /** Métier marque — résolution URL / catalogue. */
+    resolveOpenTabRequest: (input: {
+        url?: string;
+        outil_slug?: string;
+        fournisseur_id?: number;
+        title?: string;
+    }) => OpenExternalTabResolveResult;
+    /** Params IPC desktop (alias marque de `toSupplierOpenTabParams`). */
+    toOpenTabParams: (resolved: OpenExternalTabResolved) => Record<string, unknown>;
+    /**
+     * Dispatch action desktop (typiquement `dispatchSupplierAction`
+     * avec `"supplier_open_tab"`).
+     */
+    dispatchOpenTabAction: (params: Record<string, unknown>, opts: {
+        targetUserId: string;
+        requireTargetOnline: boolean;
+    }) => Promise<Record<string, unknown>>;
+    getUserById: (id: string) => OpenExternalTabUser | null | undefined;
+    getOwner: () => {
+        id: string;
+    } | null | undefined;
+    /** Titre tool MCP (défaut neutre). */
+    title?: string;
+    /** Description tool MCP (défaut neutre). */
+    description?: string;
+    /** Fidu : expose `outil_slug` dans le schéma. Défaut false. */
+    includeOutilSlug?: boolean;
+};
+/**
+ * Enregistre le tool MCP host `open_external_tab` (SoT kit).
+ * Retourne la liste des noms enregistrés (`["open_external_tab"]`).
+ */
+export declare function createOpenExternalTabHostMcpTools(options: CreateOpenExternalTabHostMcpToolsOptions): readonly string[];
+//# sourceMappingURL=open-external-tab-host-tools.d.ts.map

package/dist/open-external-tab-host-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-external-tab-host-tools.d.ts","sourceRoot":"","sources":["../src/open-external-tab-host-tools.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,uCAAuC,EAClD,mBAA4B,CAAC;AAE/B,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACpC,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,uBAAuB,CAAC,GACxC,CAAC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE7D,MAAM,MAAM,gCAAgC,GAAG;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG,CAC7C,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,gCAAgC,EACxC,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,KAChD,IAAI,CAAC;AAEV,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,0EAA0E;IAC1E,YAAY,EAAE,gCAAgC,CAAC;IAC/C,gDAAgD;IAChD,cAAc,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChD,kDAAkD;IAClD,qBAAqB,EAAE,CAAC,KAAK,EAAE;QAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,KAAK,4BAA4B,CAAC;IACnC,sEAAsE;IACtE,eAAe,EAAE,CACf,QAAQ,EAAE,uBAAuB,KAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B;;;OAGG;IACH,qBAAqB,EAAE,CACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,OAAO,CAAA;KAAE,KACzD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,mBAAmB,GAAG,IAAI,GAAG,SAAS,CAAC;IACpE,QAAQ,EAAE,MAAM;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAClD,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAoBF;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,wCAAwC,GAChD,SAAS,MAAM,EAAE,CA0FnB"}

package/dist/open-external-tab-host-tools.js

@@ -0,0 +1,92 @@
+/**
+ * D-P18 — tool MCP host-only `open_external_tab` (desktop).
+ * SoT kit partagée TF / CV / Fidu. Métier résolution URL reste injecté.
+ */
+import { z } from "zod";
+export const CREEZIO_OPEN_EXTERNAL_TAB_MCP_TOOL_NAME = "open_external_tab";
+function jsonResult(data) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(data, null, 1) }],
+    };
+}
+function errorResult(message) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify({ error: message }),
+            },
+        ],
+        isError: true,
+    };
+}
+/**
+ * Enregistre le tool MCP host `open_external_tab` (SoT kit).
+ * Retourne la liste des noms enregistrés (`["open_external_tab"]`).
+ */
+export function createOpenExternalTabHostMcpTools(options) {
+    const { registerTool, getActorUserId, resolveOpenTabRequest, toOpenTabParams, dispatchOpenTabAction, getUserById, getOwner, title = "Ouvrir un onglet externe", description = "Ouvre un onglet externe dans le desktop de l'utilisateur lié au token OAuth.", includeOutilSlug = false, } = options;
+    const inputSchema = {
+        url: z.string().optional().describe("URL ou domaine"),
+        fournisseur_id: z
+            .number()
+            .int()
+            .optional()
+            .describe("ID catalogue (0 ou omis = URL libre)"),
+        title: z.string().optional().describe("Titre d'onglet"),
+        target_user_id: z
+            .string()
+            .optional()
+            .describe("Compte principal uniquement : autre utilisateur cible"),
+    };
+    if (includeOutilSlug) {
+        inputSchema.outil_slug = z
+            .string()
+            .optional()
+            .describe("Slug catalogue");
+    }
+    registerTool(CREEZIO_OPEN_EXTERNAL_TAB_MCP_TOOL_NAME, { title, description, inputSchema }, async (input) => {
+        try {
+            const actorId = getActorUserId();
+            if (!actorId) {
+                return errorResult("token MCP sans user_id — reconnectez le client MCP");
+            }
+            let targetUserId = actorId;
+            if (input.target_user_id && input.target_user_id !== actorId) {
+                const actor = getUserById(actorId);
+                const owner = getOwner();
+                if (!actor || actor.role !== "owner" || actor.id !== owner?.id) {
+                    return errorResult("Seul le compte principal peut cibler un autre utilisateur");
+                }
+                if (!getUserById(input.target_user_id)) {
+                    return errorResult("Utilisateur cible introuvable");
+                }
+                targetUserId = input.target_user_id;
+            }
+            const resolved = resolveOpenTabRequest({
+                url: input.url,
+                outil_slug: input.outil_slug,
+                fournisseur_id: input.fournisseur_id,
+                title: input.title,
+            });
+            if (!resolved.ok)
+                return jsonResult(resolved);
+            const result = await dispatchOpenTabAction(toOpenTabParams(resolved), { targetUserId, requireTargetOnline: true });
+            return jsonResult({
+                ...result,
+                resolved: {
+                    url: resolved.url,
+                    fournisseur_id: resolved.fournisseurId,
+                    title: resolved.title,
+                    source: resolved.source,
+                },
+                target_user_id: targetUserId,
+            });
+        }
+        catch (error) {
+            return errorResult(error instanceof Error ? error.message : String(error));
+        }
+    });
+    return [CREEZIO_OPEN_EXTERNAL_TAB_MCP_TOOL_NAME];
+}
+//# sourceMappingURL=open-external-tab-host-tools.js.map

package/dist/open-external-tab-host-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-external-tab-host-tools.js","sourceRoot":"","sources":["../src/open-external-tab-host-tools.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,uCAAuC,GAClD,mBAA4B,CAAC;AAgE/B,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;aACzC;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAC/C,OAAiD;IAEjD,MAAM,EACJ,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,WAAW,EACX,QAAQ,EACR,KAAK,GAAG,0BAA0B,EAClC,WAAW,GACT,8EAA8E,EAChF,gBAAgB,GAAG,KAAK,GACzB,GAAG,OAAO,CAAC;IAEZ,MAAM,WAAW,GAA8B;QAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACrD,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CAAC,sCAAsC,CAAC;QACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACvD,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,uDAAuD,CAAC;KACrE,CAAC;IACF,IAAI,gBAAgB,EAAE,CAAC;QACrB,WAAW,CAAC,UAAU,GAAG,CAAC;aACvB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAChC,CAAC;IAED,YAAY,CACV,uCAAuC,EACvC,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,EACnC,KAAK,EAAE,KAAK,EAAE,EAAE;QACd,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,WAAW,CAChB,oDAAoD,CACrD,CAAC;YACJ,CAAC;YACD,IAAI,YAAY,GAAG,OAAO,CAAC;YAC3B,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;gBAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;gBACnC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,EAAE,KAAK,KAAK,EAAE,EAAE,EAAE,CAAC;oBAC/D,OAAO,WAAW,CAChB,2DAA2D,CAC5D,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;oBACvC,OAAO,WAAW,CAAC,+BAA+B,CAAC,CAAC;gBACtD,CAAC;gBACD,YAAY,GAAG,KAAK,CAAC,cAAc,CAAC;YACtC,CAAC;YACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC;gBACrC,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,eAAe,CAAC,QAAQ,CAAC,EACzB,EAAE,YAAY,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC5C,CAAC;YACF,OAAO,UAAU,CAAC;gBAChB,GAAG,MAAM;gBACT,QAAQ,EAAE;oBACR,GAAG,EAAE,QAAQ,CAAC,GAAG;oBACjB,cAAc,EAAE,QAAQ,CAAC,aAAa;oBACtC,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;iBACxB;gBACD,cAAc,EAAE,YAAY;aAC7B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,OAAO,CAAC,uCAAuC,CAAC,CAAC;AACnD,CAAC"}

package/dist/policy.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Policies MCP H4 — deny cross-layer cohérent api-kernel H2.
+ * H5 — plugin ACL (see/execute) alignée Product Hub.
+ */
+import type { McpAuthorizeContext, McpToolPolicyDecision } from "./types.js";
+export type PluginAclPolicyResolver = (pluginId: string) => {
+    allowedOrgIds: string[];
+    allowedUserIds: string[];
+    ownerOrgId?: string | null;
+    capabilitiesBySubject?: Record<string, Array<"see" | "install" | "execute">>;
+    failClosed?: boolean;
+    pluginId: string;
+} | undefined;
+export type PluginAclActorResolver = (ctx: McpAuthorizeContext) => {
+    orgId?: string | null;
+    userId?: string | null;
+    isOwner?: boolean;
+    isServiceKey?: boolean;
+    isImpersonating?: boolean;
+};
+export type DecidePluginAccessFn = (policy: {
+    pluginId: string;
+    allowedOrgIds: string[];
+    allowedUserIds: string[];
+    ownerOrgId?: string | null;
+    capabilitiesBySubject?: Record<string, Array<"see" | "install" | "execute">>;
+    failClosed?: boolean;
+} | undefined, actor: {
+    orgId?: string | null;
+    userId?: string | null;
+    isOwner?: boolean;
+    isServiceKey?: boolean;
+    isImpersonating?: boolean;
+}, action: "see" | "install" | "execute") => {
+    allow: true;
+} | {
+    allow: false;
+    reason: string;
+};
+/**
+ * Deny-by-default si la charge utile tente un échappement cross-layer
+ * (même sémantique que api-kernel `__cross/` / `core/` escaping).
+ */
+export declare function denyCrossLayerToolCall(ctx: McpAuthorizeContext): McpToolPolicyDecision;
+/**
+ * Compose plusieurs policies (premier deny gagne).
+ */
+export declare function composeToolPolicies(...policies: Array<(ctx: McpAuthorizeContext) => McpToolPolicyDecision | Promise<McpToolPolicyDecision>>): (ctx: McpAuthorizeContext) => Promise<McpToolPolicyDecision>;
+/**
+ * H5 — deny tools `plugin.<id>.*` si l'acteur n'a pas `execute`.
+ * Injecter `decidePluginAccess` depuis `@creezio/product-hub` pour
+ * une décision identique à l'API / control-plane.
+ */
+export declare function createDenyUnauthorizedPluginToolPolicy(opts: {
+    getPolicy: PluginAclPolicyResolver;
+    resolveActor?: PluginAclActorResolver;
+    decide: DecidePluginAccessFn;
+}): (ctx: McpAuthorizeContext) => McpToolPolicyDecision;
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,uBAAuB,GAAG,CAAC,QAAQ,EAAE,MAAM,KACnD;IACE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC;IAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACD,SAAS,CAAC;AAEd,MAAM,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,mBAAmB,KAAK;IACjE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,CACjC,MAAM,EACF;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAC5B,MAAM,EACN,KAAK,CAAC,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC,CACrC,CAAC;IACF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GACD,SAAS,EACb,KAAK,EAAE;IACL,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,EACD,MAAM,EAAE,KAAK,GAAG,SAAS,GAAG,SAAS,KAClC;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,mBAAmB,GACvB,qBAAqB,CAiCvB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,QAAQ,EAAE,KAAK,CAChB,CAAC,GAAG,EAAE,mBAAmB,KAAK,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CACrF,GACA,CAAC,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAQ9D;AAED;;;;GAIG;AACH,wBAAgB,sCAAsC,CAAC,IAAI,EAAE;IAC3D,SAAS,EAAE,uBAAuB,CAAC;IACnC,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,MAAM,EAAE,oBAAoB,CAAC;CAC9B,GAAG,CAAC,GAAG,EAAE,mBAAmB,KAAK,qBAAqB,CAqBtD"}

package/dist/policy.js

@@ -0,0 +1,88 @@
+/**
+ * Policies MCP H4 — deny cross-layer cohérent api-kernel H2.
+ * H5 — plugin ACL (see/execute) alignée Product Hub.
+ */
+/**
+ * Deny-by-default si la charge utile tente un échappement cross-layer
+ * (même sémantique que api-kernel `__cross/` / `core/` escaping).
+ */
+export function denyCrossLayerToolCall(ctx) {
+    const args = ctx.args || {};
+    for (const [key, value] of Object.entries(args)) {
+        const blob = `${key}=${stringifyArg(value)}`.toLowerCase();
+        if (blob.includes("__cross/") ||
+            blob.includes("__cross") ||
+            /(^|[=\s/])core\//.test(blob) ||
+            blob.includes("/../") ||
+            blob.includes("..\\")) {
+            return { allow: false, reason: "cross_layer_denied" };
+        }
+    }
+    // Un tool module/plugin ne peut pas se faire passer pour core via alias.
+    if (ctx.isAlias && ctx.space === "core") {
+        return { allow: false, reason: "alias_to_core_denied" };
+    }
+    // Spoof explicite de couche cible.
+    const targetSpace = args.targetSpace ?? args.target_space ?? args.space;
+    if (typeof targetSpace === "string" &&
+        targetSpace !== ctx.space &&
+        (targetSpace === "core" ||
+            targetSpace === "module" ||
+            targetSpace === "plugin")) {
+        return { allow: false, reason: "cross_layer_space_spoof" };
+    }
+    return { allow: true };
+}
+/**
+ * Compose plusieurs policies (premier deny gagne).
+ */
+export function composeToolPolicies(...policies) {
+    return async (ctx) => {
+        for (const p of policies) {
+            const d = await p(ctx);
+            if (!d.allow)
+                return d;
+        }
+        return { allow: true };
+    };
+}
+/**
+ * H5 — deny tools `plugin.<id>.*` si l'acteur n'a pas `execute`.
+ * Injecter `decidePluginAccess` depuis `@creezio/product-hub` pour
+ * une décision identique à l'API / control-plane.
+ */
+export function createDenyUnauthorizedPluginToolPolicy(opts) {
+    const resolveActor = opts.resolveActor ||
+        ((ctx) => ({
+            orgId: ctx.orgId ?? ctx.claims?.orgId ?? null,
+            userId: ctx.subject || null,
+            isOwner: Boolean(ctx.claims?.isOwner),
+            isServiceKey: ctx.subject === "opaque-token" || ctx.subject === "anonymous",
+        }));
+    return (ctx) => {
+        if (ctx.space !== "plugin")
+            return { allow: true };
+        const pluginId = ctx.ownerId;
+        if (!pluginId) {
+            return { allow: false, reason: "acl_plugin_owner_missing" };
+        }
+        const actor = resolveActor(ctx);
+        const decision = opts.decide(opts.getPolicy(pluginId), actor, "execute");
+        if (!decision.allow)
+            return { allow: false, reason: decision.reason };
+        return { allow: true };
+    };
+}
+function stringifyArg(value) {
+    if (value == null)
+        return "";
+    if (typeof value === "string")
+        return value;
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkDH;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAwB;IAExB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IACE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YACxB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EACrB,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC1D,CAAC;IAED,mCAAmC;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC;IACxE,IACE,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,KAAK,GAAG,CAAC,KAAK;QACzB,CAAC,WAAW,KAAK,MAAM;YACrB,WAAW,KAAK,QAAQ;YACxB,WAAW,KAAK,QAAQ,CAAC,EAC3B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAG,QAEF;IAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,CAAC,CAAC,KAAK;gBAAE,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sCAAsC,CAAC,IAItD;IACC,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACT,KAAK,EAAE,GAAG,CAAC,KAAK,IAAK,GAAG,CAAC,MAAM,EAAE,KAA4B,IAAI,IAAI;YACrE,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;YAC3B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC;YACrC,YAAY,EAAE,GAAG,CAAC,OAAO,KAAK,cAAc,IAAI,GAAG,CAAC,OAAO,KAAK,WAAW;SAC5E,CAAC,CAAC,CAAC;IAEN,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAC9D,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/runtime.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Contrat MCP produit (D1/C2 → M9) — une seule stack.
+ *
+ * - Exécuteur HTTP public : **Hono** `GET|POST /mcp`.
+ * - Façade Electron `@creezio/mcp-facade` : adaptateur brand-mounts (tests /
+ *   offline) **ou** proxy vers Hono dès qu'un upstream local est annoncé.
+ *
+ * Hermes / Cursor / ChatGPT → toujours `{base}/mcp`, jamais un 2ᵉ serveur
+ * MCP dans le process Electron.
+ */
+export declare const MCP_PRODUCT_EXECUTOR: "hono";
+export type McpProductExecutor = typeof MCP_PRODUCT_EXECUTOR;
+/** Rôle de la façade Electron (pas un 2ᵉ exécuteur produit). */
+export type McpFacadeRole = "local-brand-adapter" | "hono-proxy";
+export type McpFacadeMode = "local-adapter" | "hono-proxy" | "hono-preferred";
+export type McpUpstreamRef = {
+    /** Base URL Next locale, ex. http://127.0.0.1:3920 — sans slash final. */
+    getBaseUrl: () => string | null;
+    getApiKey: () => string | null;
+};
+export declare function resolveMcpFacadeRole(mode: McpFacadeMode, upstream: string | null): McpFacadeRole;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,eAAO,MAAM,oBAAoB,EAAG,MAAe,CAAC;AAEpD,MAAM,MAAM,kBAAkB,GAAG,OAAO,oBAAoB,CAAC;AAE7D,gEAAgE;AAChE,MAAM,MAAM,aAAa,GAAG,qBAAqB,GAAG,YAAY,CAAC;AAEjE,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,YAAY,GAAG,gBAAgB,CAAC;AAE9E,MAAM,MAAM,cAAc,GAAG;IAC3B,0EAA0E;IAC1E,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,aAAa,EACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,aAAa,CAKf"}

package/dist/runtime.js

@@ -0,0 +1,20 @@
+/**
+ * Contrat MCP produit (D1/C2 → M9) — une seule stack.
+ *
+ * - Exécuteur HTTP public : **Hono** `GET|POST /mcp`.
+ * - Façade Electron `@creezio/mcp-facade` : adaptateur brand-mounts (tests /
+ *   offline) **ou** proxy vers Hono dès qu'un upstream local est annoncé.
+ *
+ * Hermes / Cursor / ChatGPT → toujours `{base}/mcp`, jamais un 2ᵉ serveur
+ * MCP dans le process Electron.
+ */
+export const MCP_PRODUCT_EXECUTOR = "hono";
+export function resolveMcpFacadeRole(mode, upstream) {
+    if (mode === "local-adapter")
+        return "local-brand-adapter";
+    if (mode === "hono-proxy")
+        return "hono-proxy";
+    // hono-preferred
+    return upstream ? "hono-proxy" : "local-brand-adapter";
+}
+//# sourceMappingURL=runtime.js.map

package/dist/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAe,CAAC;AAepD,MAAM,UAAU,oBAAoB,CAClC,IAAmB,EACnB,QAAuB;IAEvB,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,qBAAqB,CAAC;IAC3D,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IAC/C,iBAAiB;IACjB,OAAO,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC;AACzD,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,163 @@
+export type McpToolSpace = "core" | "module" | "plugin";
+/**
+ * Surface publique listTools :
+ * - `canonical` — noms namespacés uniquement (module.panier.get)
+ * - `legacy-preferred` — si un alias legacy existe, masquer le canonique
+ * - `both` — alias + canonique (déconseillé — double exposition)
+ */
+export type McpPublicSurfaceMode = "canonical" | "legacy-preferred" | "both";
+export type McpToolDefinition = {
+    name: string;
+    description: string;
+    space: McpToolSpace;
+    /** Id module/plugin si space !== core. */
+    ownerId?: string;
+    inputSchema?: Record<string, unknown>;
+    /** Nom canonique si cette entrée est un alias legacy exposé. */
+    aliasOf?: string;
+    /** Rôles seedés dans `mcp_tool_policies` (ops de module). */
+    defaultRoles?: string[];
+    /**
+     * Seed policy `enabled` — false = à activer dans `/admin/mcp`.
+     * Absent = comportement historique (enabled).
+     */
+    mcpPublishDefault?: boolean;
+    requiredScope?: string;
+};
+export type McpToolCallResult = {
+    ok: boolean;
+    content?: unknown;
+    error?: string;
+};
+/**
+ * Acteur du call courant, transmis aux handlers (2ᵉ argument optionnel —
+ * rétro-compatible : les handlers existants à un argument restent valides).
+ */
+export type McpToolCallActor = {
+    subject?: string;
+    orgId?: string;
+    claims?: Record<string, unknown>;
+    /**
+     * Bearer (JWT session ou clé service) du call — à poser sur la requête
+     * synthétique `module.*` pour que `requireSession` / cookie+Authorization
+     * voient le même acteur que le chat OS.
+     */
+    bearerToken?: string | null;
+    /** Headers HTTP d'origine (Cookie, Authorization) à propager. */
+    headers?: Record<string, string>;
+};
+/** Options de `callTool` — Bearer + headers de la requête chat. */
+export type McpCallToolOpts = {
+    bearerToken?: string | null;
+    headers?: Record<string, string>;
+};
+export type McpToolHandler = (args: Record<string, unknown>, actor?: McpToolCallActor) => McpToolCallResult | Promise<McpToolCallResult>;
+/**
+ * Acteur résolu depuis un Bearer opaque (ex. clé API service vérifiée par
+ * l'app contre sa table `api_keys`). `null` = token inconnu → fallback JWT.
+ */
+export type McpBearerActor = {
+    subject: string;
+    orgId?: string;
+    claims?: Record<string, unknown>;
+};
+export type McpResolveBearerActorFn = (token: string) => McpBearerActor | null | Promise<McpBearerActor | null>;
+export type McpRegisteredTool = McpToolDefinition & {
+    handler: McpToolHandler;
+};
+export type DiscoverToolsFn = () => McpRegisteredTool[] | Promise<McpRegisteredTool[]>;
+/** Discovery scindée par couche (H2.3) — préférée à une liste plate. */
+export type DiscoverToolsBySpaceFn = () => Partial<Record<"module" | "plugin", McpRegisteredTool[]>> | Promise<Partial<Record<"module" | "plugin", McpRegisteredTool[]>>>;
+export type McpAuthorizeContext = {
+    name: string;
+    canonicalName: string;
+    space: McpToolSpace;
+    ownerId?: string;
+    subject?: string;
+    /** H5 — org claim JWT / opaque actor. */
+    orgId?: string;
+    /** Claims JWT bruts (orgId, isOwner, …). */
+    claims?: Record<string, unknown>;
+    args: Record<string, unknown>;
+    isAlias: boolean;
+};
+export type McpToolPolicyDecision = {
+    allow: true;
+} | {
+    allow: false;
+    reason: string;
+};
+export type McpAuthorizeToolCallFn = (ctx: McpAuthorizeContext) => McpToolPolicyDecision | Promise<McpToolPolicyDecision>;
+export type McpFacadeOptions = {
+    /** Secret JWT (local-config `mcpJwtSecret` / env MCP_JWT_SECRET). */
+    jwtSecret?: string | null;
+    /** Si true, auth JWT optionnelle (dev/sandbox). Défaut false en prod. */
+    allowUnauthenticated?: boolean;
+    /**
+     * Résolution d'acteur pour Bearer OPAQUE (non-JWT) — consultée AVANT la
+     * vérification JWT (ex. clé API service Hermes → owner). `null`/throw =
+     * fallback JWT inchangé. Ne jamais y mettre de métier marque.
+     */
+    resolveBearerActor?: McpResolveBearerActorFn;
+    /** Discoverer plat (H1 compat). */
+    discoverTools?: DiscoverToolsFn;
+    /**
+     * Discoverer scindé (H2) — tools modules vs plugins.
+     * Si fourni, fusionné avec `discoverTools` (plat).
+     */
+    discoverToolsBySpace?: DiscoverToolsBySpaceFn;
+    architectureVersion?: string;
+    brandId?: string;
+    /** Liste mounts api-kernel (optionnel, pour tool admin). */
+    listApiMounts?: () => Array<{
+        space: string;
+        id: string;
+    }>;
+    /**
+     * H4 — impose préfixes `core.*` / `creezio.*` · `module.<id>.*` · `plugin.<id>.*`
+     * Défaut true.
+     */
+    enforceNamespaces?: boolean;
+    /**
+     * H4 — aliases legacy → nom canonique namespacé
+     * (ex. get_panier → module.panier.get).
+     */
+    aliases?: Record<string, string>;
+    /**
+     * H4 — surface listTools (défaut `legacy-preferred` pour éviter
+     * la double exposition panier historique ↔ module.*).
+     */
+    publicSurface?: McpPublicSurfaceMode;
+    /** H4 — policy avant callTool (deny cross-layer par défaut). */
+    authorizeToolCall?: McpAuthorizeToolCallFn;
+    /**
+     * H4 — si false, ne pas installer denyCrossLayerToolCall par défaut.
+     * Défaut true.
+     */
+    defaultCrossLayerDeny?: boolean;
+    /**
+     * H5 — filtre listTools space=plugin selon ACL (optionnel).
+     * Si fourni, les tools plugin non visibles sont masqués.
+     */
+    filterPluginToolsForActor?: (tools: McpToolDefinition[], ctx: {
+        subject?: string;
+        orgId?: string;
+        claims?: Record<string, unknown>;
+    }) => McpToolDefinition[] | Promise<McpToolDefinition[]>;
+};
+export type McpListToolsResult = {
+    tools: McpToolDefinition[];
+};
+export type McpToolsBySpace = Record<McpToolSpace, McpToolDefinition[]>;
+export type McpAuthResult = {
+    ok: true;
+    subject?: string;
+    /** H5 — orgId depuis claim JWT `orgId` / `org_id`. */
+    orgId?: string;
+    claims?: Record<string, unknown>;
+} | {
+    ok: false;
+    error: string;
+    status: number;
+};
+//# sourceMappingURL=types.d.ts.map