@crewdhq/crewd-mcp 0.0.0-stage → 0.1.7

package/dist-mcp/core/registry.js

@@ -0,0 +1,224 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RegistryClient = exports.DEFAULT_REGISTRY_URL = void 0;
+exports.loadRegistryConfig = loadRegistryConfig;
+exports.parsePackageRef = parsePackageRef;
+exports.sanitizeUntrustedText = sanitizeUntrustedText;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_os_1 = __importDefault(require("node:os"));
+const yaml_1 = __importDefault(require("yaml"));
+exports.DEFAULT_REGISTRY_URL = "https://api.crewd.dev";
+function loadRegistryConfig() {
+    let registryUrl = process.env.CREWD_REGISTRY || "";
+    let token = process.env.CREWD_TOKEN || "";
+    if (!registryUrl || !token) {
+        const configPath = node_path_1.default.join(node_os_1.default.homedir(), ".config", "crewd", "config.yaml");
+        if (node_fs_1.default.existsSync(configPath)) {
+            try {
+                const fileContent = node_fs_1.default.readFileSync(configPath, "utf-8");
+                const parsed = yaml_1.default.parse(fileContent);
+                if (parsed && typeof parsed === "object") {
+                    if (!registryUrl && typeof parsed.registry === "string") {
+                        registryUrl = parsed.registry;
+                    }
+                    if (!token && typeof parsed.token === "string") {
+                        token = parsed.token;
+                    }
+                }
+            }
+            catch {
+                // Ignore config reading errors
+            }
+        }
+    }
+    if (!registryUrl) {
+        registryUrl = exports.DEFAULT_REGISTRY_URL;
+    }
+    return {
+        registryUrl: registryUrl.replace(/\/+$/, ""),
+        token: token || undefined,
+    };
+}
+function parsePackageRef(ref) {
+    // Expected formats: @namespace/name, @namespace/name@version, @namespace/name@^1.0.0
+    const parts = ref.split("@");
+    if (parts.length < 2) {
+        throw new Error(`Invalid package reference "${ref}": expected @namespace/name[@version]`);
+    }
+    const namePart = parts[1]; // "namespace/name"
+    const subparts = namePart.split("/");
+    if (subparts.length !== 2 || !subparts[0] || !subparts[1]) {
+        throw new Error(`Invalid package reference "${ref}": expected @namespace/name[@version]`);
+    }
+    const namespace = subparts[0];
+    const name = subparts[1];
+    const fullName = `@${namespace}/${name}`;
+    const versionRange = parts.length >= 3 && parts[2] ? parts[2] : "*";
+    return { fullName, namespace, name, versionRange };
+}
+/**
+ * Sanitizes untrusted text from package manifests, readmes, and descriptions.
+ * Truncates overly long fields and strips control characters.
+ */
+function sanitizeUntrustedText(text, maxLen = 500) {
+    if (!text)
+        return "";
+    // Strip null bytes and non-printable control characters except newline and tab
+    const cleaned = text.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "");
+    if (cleaned.length <= maxLen) {
+        return cleaned;
+    }
+    return cleaned.substring(0, maxLen) + "... [truncated]";
+}
+class RegistryClient {
+    baseUrl;
+    token;
+    constructor(baseUrl, token) {
+        const cfg = loadRegistryConfig();
+        this.baseUrl = (baseUrl || cfg.registryUrl).replace(/\/+$/, "");
+        this.token = token || cfg.token;
+    }
+    getHeaders() {
+        const headers = {
+            "Accept": "application/json",
+            "User-Agent": "crewd-mcp/0.1.0",
+        };
+        if (this.token) {
+            headers["Authorization"] = `Bearer ${this.token}`;
+        }
+        return headers;
+    }
+    async searchPackages(query, kind, limit) {
+        const url = new URL(`${this.baseUrl}/v1/search`);
+        if (query)
+            url.searchParams.set("q", query);
+        if (kind)
+            url.searchParams.set("type", kind);
+        if (limit)
+            url.searchParams.set("limit", String(limit));
+        let res;
+        try {
+            res = await fetch(url.toString(), {
+                method: "GET",
+                headers: this.getHeaders(),
+            });
+        }
+        catch (err) {
+            throw new Error(`registry unreachable at ${this.baseUrl}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (!res.ok) {
+            const errText = await res.text().catch(() => "");
+            throw new Error(`Registry search failed (HTTP ${res.status}): ${errText || res.statusText}`);
+        }
+        const data = await res.json();
+        return {
+            packages: (data.packages || []).map((p) => ({
+                ...p,
+                description: sanitizeUntrustedText(p.description, 500),
+            })),
+            total: data.total ?? (data.packages?.length || 0),
+        };
+    }
+    async getPackage(namespace, name) {
+        const url = `${this.baseUrl}/v1/packages/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}`;
+        let res;
+        try {
+            res = await fetch(url, {
+                method: "GET",
+                headers: this.getHeaders(),
+            });
+        }
+        catch (err) {
+            throw new Error(`registry unreachable at ${this.baseUrl}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (res.status === 404) {
+            throw new Error(`package not found: @${namespace}/${name}`);
+        }
+        if (!res.ok) {
+            const errText = await res.text().catch(() => "");
+            throw new Error(`Failed to fetch package @${namespace}/${name} (HTTP ${res.status}): ${errText}`);
+        }
+        const data = await res.json();
+        data.description = sanitizeUntrustedText(data.description, 500);
+        return data;
+    }
+    async getVersion(namespace, name, version) {
+        const url = `${this.baseUrl}/v1/packages/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/${encodeURIComponent(version)}`;
+        let res;
+        try {
+            res = await fetch(url, {
+                method: "GET",
+                headers: this.getHeaders(),
+            });
+        }
+        catch (err) {
+            throw new Error(`registry unreachable at ${this.baseUrl}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (res.status === 404) {
+            throw new Error(`package version not found: @${namespace}/${name}@${version}`);
+        }
+        if (!res.ok) {
+            const errText = await res.text().catch(() => "");
+            throw new Error(`Failed to fetch version @${namespace}/${name}@${version} (HTTP ${res.status}): ${errText}`);
+        }
+        const data = await res.json();
+        if (data.readme) {
+            data.readme = sanitizeUntrustedText(data.readme, 2000);
+        }
+        return data;
+    }
+    async resolve(packages, hosts) {
+        const url = `${this.baseUrl}/v1/resolve`;
+        const payload = {
+            packages: packages.map((p) => ({
+                name: p.name,
+                range: p.range || "*",
+                isTeam: p.isTeam || false,
+            })),
+            hosts: hosts || ["claude-code"],
+        };
+        let res;
+        try {
+            res = await fetch(url, {
+                method: "POST",
+                headers: {
+                    ...this.getHeaders(),
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify(payload),
+            });
+        }
+        catch (err) {
+            throw new Error(`registry unreachable at ${this.baseUrl}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (!res.ok) {
+            const errText = await res.text().catch(() => "");
+            throw new Error(`Dependency resolution failed (HTTP ${res.status}): ${errText || res.statusText}`);
+        }
+        return await res.json();
+    }
+    async downloadTarball(tarballUrl) {
+        const targetUrl = tarballUrl.startsWith("http") ? tarballUrl : `${this.baseUrl}${tarballUrl.startsWith("/") ? "" : "/"}${tarballUrl}`;
+        let res;
+        try {
+            res = await fetch(targetUrl, {
+                method: "GET",
+                headers: this.getHeaders(),
+            });
+        }
+        catch (err) {
+            throw new Error(`failed to download tarball from ${targetUrl}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (!res.ok) {
+            throw new Error(`Failed to download tarball from ${targetUrl}: HTTP ${res.status}`);
+        }
+        const arrayBuffer = await res.arrayBuffer();
+        return Buffer.from(arrayBuffer);
+    }
+}
+exports.RegistryClient = RegistryClient;
+//# sourceMappingURL=registry.js.map

package/dist-mcp/core/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/core/registry.ts"],"names":[],"mappings":";;;;;;AAQA,gDAgCC;AAED,0CAkBC;AAMD,sDAQC;AA1ED,sDAAyB;AACzB,0DAA6B;AAC7B,sDAAyB;AACzB,gDAAwB;AAGX,QAAA,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,SAAgB,kBAAkB;IAChC,IAAI,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;IACnD,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;IAE1C,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QAC9E,IAAI,iBAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,iBAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,cAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBACvC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACzC,IAAI,CAAC,WAAW,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBACxD,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC;oBAChC,CAAC;oBACD,IAAI,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;wBAC/C,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;oBACvB,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,4BAAoB,CAAC;IACrC,CAAC;IAED,OAAO;QACL,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,KAAK,EAAE,KAAK,IAAI,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAAC,GAAW;IACzC,qFAAqF;IACrF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,uCAAuC,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,uCAAuC,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;IACzC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAEpE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,IAA+B,EAAE,MAAM,GAAG,GAAG;IACjF,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,+EAA+E;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,iBAAiB,CAAC;AAC1D,CAAC;AAED,MAAa,cAAc;IACjB,OAAO,CAAS;IAChB,KAAK,CAAU;IAEvB,YAAY,OAAgB,EAAE,KAAc;QAC1C,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC;IAClC,CAAC;IAEO,UAAU;QAChB,MAAM,OAAO,GAA2B;YACtC,QAAQ,EAAE,kBAAkB;YAC5B,YAAY,EAAE,iBAAiB;SAChC,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,IAAa,EAAE,KAAc;QAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,YAAY,CAAC,CAAC;QACjD,IAAI,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,IAAI;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAExD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAChC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAmD,CAAC;QAC/E,OAAO;YACL,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1C,GAAG,CAAC;gBACJ,WAAW,EAAE,qBAAqB,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC;aACvD,CAAC,CAAC;YACH,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,IAAY;QAC9C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvG,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACrB,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,IAAI,IAAI,UAAU,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAoB,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,IAAY,EAAE,OAAe;QAC/D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACtI,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACrB,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,IAAI,IAAI,IAAI,OAAO,UAAU,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QAC/G,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAmB,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAkE,EAAE,KAAgB;QAChG,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,aAAa,CAAC;QACzC,MAAM,OAAO,GAAG;YACd,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,GAAG;gBACrB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK;aAC1B,CAAC,CAAC;YACH,KAAK,EAAE,KAAK,IAAI,CAAC,aAAa,CAAC;SAChC,CAAC;QAEF,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACrB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,GAAG,IAAI,CAAC,UAAU,EAAE;oBACpB,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,MAAM,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACrG,CAAC;QAED,OAAO,MAAM,GAAG,CAAC,IAAI,EAAqB,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;QACtI,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;gBAC3B,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;CACF;AA5JD,wCA4JC"}

package/dist-mcp/core/tar.d.ts

@@ -0,0 +1,23 @@
+export interface PackageFile {
+    path: string;
+    size: number;
+    content: Buffer;
+    type: string;
+}
+/**
+ * Validates integrity hash matching "sha256-<hex>".
+ */
+export declare function verifyTarballIntegrity(tarballBuffer: Buffer, expectedIntegrity: string): void;
+/**
+ * Validates that an archive file entry does not perform path traversal.
+ */
+export declare function validateSafePath(entryPath: string, rootDir: string): string;
+/**
+ * Parses and extracts all files from a tar.gz buffer in-memory with strict security validations.
+ */
+export declare function unpackTarballInMemory(tarballBuffer: Buffer): Promise<Map<string, PackageFile>>;
+/**
+ * Extracts a tar.gz buffer directly into a target directory with path safety enforcement.
+ */
+export declare function extractTarballToDisk(tarballBuffer: Buffer, destDir: string): Promise<string[]>;
+//# sourceMappingURL=tar.d.ts.map

package/dist-mcp/core/tar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar.d.ts","sourceRoot":"","sources":["../../src/core/tar.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAS7F;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAyB3E;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAoDpG;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAYpG"}

package/dist-mcp/core/tar.js

@@ -0,0 +1,145 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyTarballIntegrity = verifyTarballIntegrity;
+exports.validateSafePath = validateSafePath;
+exports.unpackTarballInMemory = unpackTarballInMemory;
+exports.extractTarballToDisk = extractTarballToDisk;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_stream_1 = require("node:stream");
+const tar = __importStar(require("tar"));
+/**
+ * Validates integrity hash matching "sha256-<hex>".
+ */
+function verifyTarballIntegrity(tarballBuffer, expectedIntegrity) {
+    const hash = node_crypto_1.default.createHash("sha256").update(tarballBuffer).digest("hex");
+    const computed = `sha256-${hash}`;
+    if (expectedIntegrity && expectedIntegrity !== computed) {
+        throw new Error(`Package integrity mismatch: registry declared ${expectedIntegrity}, but received tarball produced ${computed}`);
+    }
+}
+/**
+ * Validates that an archive file entry does not perform path traversal.
+ */
+function validateSafePath(entryPath, rootDir) {
+    // Reject absolute paths
+    if (node_path_1.default.isAbsolute(entryPath)) {
+        throw new Error(`Path traversal rejected: package entry "${entryPath}" is an absolute path`);
+    }
+    // Normalize path and check for traversal
+    const normalized = node_path_1.default.normalize(entryPath);
+    if (normalized === ".." ||
+        normalized.startsWith(".." + node_path_1.default.sep) ||
+        normalized.startsWith("../") ||
+        normalized.startsWith("..\\")) {
+        throw new Error(`Path traversal rejected: package entry "${entryPath}" navigates outside target directory`);
+    }
+    const resolved = node_path_1.default.resolve(rootDir, normalized);
+    const rootWithSep = rootDir.endsWith(node_path_1.default.sep) ? rootDir : rootDir + node_path_1.default.sep;
+    if (resolved !== rootDir && !resolved.startsWith(rootWithSep)) {
+        throw new Error(`Path traversal rejected: package entry "${entryPath}" escapes target root directory`);
+    }
+    return resolved;
+}
+/**
+ * Parses and extracts all files from a tar.gz buffer in-memory with strict security validations.
+ */
+async function unpackTarballInMemory(tarballBuffer) {
+    const files = new Map();
+    const dummyRoot = "/package/root";
+    await new Promise((resolve, reject) => {
+        const parser = new tar.Parser({
+            onReadEntry(entry) {
+                const entryPath = entry.path;
+                // Path traversal defense
+                try {
+                    validateSafePath(entryPath, dummyRoot);
+                }
+                catch (err) {
+                    entry.resume();
+                    reject(err);
+                    return;
+                }
+                // Check symlinks
+                if (entry.type === "SymbolicLink") {
+                    const linkTarget = entry.linkpath || "";
+                    if (node_path_1.default.isAbsolute(linkTarget) || linkTarget.startsWith("..")) {
+                        entry.resume();
+                        reject(new Error(`Path traversal rejected: symlink "${entryPath}" targets external path "${linkTarget}"`));
+                        return;
+                    }
+                }
+                const chunks = [];
+                entry.on("data", (chunk) => chunks.push(chunk));
+                entry.on("end", () => {
+                    if (entry.type === "File") {
+                        files.set(entryPath, {
+                            path: entryPath,
+                            size: entry.size || 0,
+                            content: Buffer.concat(chunks),
+                            type: entry.type,
+                        });
+                    }
+                });
+                entry.on("error", (err) => reject(err));
+            },
+        });
+        parser.on("error", reject);
+        parser.on("finish", () => resolve());
+        const stream = node_stream_1.Readable.from(tarballBuffer);
+        stream.pipe(parser);
+    });
+    return files;
+}
+/**
+ * Extracts a tar.gz buffer directly into a target directory with path safety enforcement.
+ */
+async function extractTarballToDisk(tarballBuffer, destDir) {
+    const files = await unpackTarballInMemory(tarballBuffer);
+    const writtenPaths = [];
+    for (const [relPath, file] of files.entries()) {
+        const fullPath = validateSafePath(relPath, destDir);
+        node_fs_1.default.mkdirSync(node_path_1.default.dirname(fullPath), { recursive: true });
+        node_fs_1.default.writeFileSync(fullPath, file.content);
+        writtenPaths.push(relPath);
+    }
+    return writtenPaths;
+}
+//# sourceMappingURL=tar.js.map

package/dist-mcp/core/tar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar.js","sourceRoot":"","sources":["../../src/core/tar.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA,wDASC;AAKD,4CAyBC;AAKD,sDAoDC;AAKD,oDAYC;AAjID,8DAAiC;AACjC,0DAA6B;AAC7B,sDAAyB;AACzB,6CAAuC;AACvC,yCAA2B;AAS3B;;GAEG;AACH,SAAgB,sBAAsB,CAAC,aAAqB,EAAE,iBAAyB;IACrF,MAAM,IAAI,GAAG,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,UAAU,IAAI,EAAE,CAAC;IAElC,IAAI,iBAAiB,IAAI,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,iDAAiD,iBAAiB,mCAAmC,QAAQ,EAAE,CAChH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,SAAiB,EAAE,OAAe;IACjE,wBAAwB;IACxB,IAAI,mBAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,2CAA2C,SAAS,uBAAuB,CAAC,CAAC;IAC/F,CAAC;IAED,yCAAyC;IACzC,MAAM,UAAU,GAAG,mBAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7C,IACE,UAAU,KAAK,IAAI;QACnB,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,mBAAI,CAAC,GAAG,CAAC;QACtC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,SAAS,sCAAsC,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,mBAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,mBAAI,CAAC,GAAG,CAAC;IAE9E,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,2CAA2C,SAAS,iCAAiC,CAAC,CAAC;IACzG,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,qBAAqB,CAAC,aAAqB;IAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,MAAM,SAAS,GAAG,eAAe,CAAC;IAElC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC;YAC5B,WAAW,CAAC,KAAK;gBACf,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;gBAE7B,yBAAyB;gBACzB,IAAI,CAAC;oBACH,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBACzC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,KAAK,CAAC,MAAM,EAAE,CAAC;oBACf,MAAM,CAAC,GAAG,CAAC,CAAC;oBACZ,OAAO;gBACT,CAAC;gBAED,iBAAiB;gBACjB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBAClC,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;oBACxC,IAAI,mBAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/D,KAAK,CAAC,MAAM,EAAE,CAAC;wBACf,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,SAAS,4BAA4B,UAAU,GAAG,CAAC,CAAC,CAAC;wBAC3G,OAAO;oBACT,CAAC;gBACH,CAAC;gBAED,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxD,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACnB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;wBAC1B,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE;4BACnB,IAAI,EAAE,SAAS;4BACf,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;4BACrB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;4BAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;yBACjB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACnD,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,sBAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,oBAAoB,CAAC,aAAqB,EAAE,OAAe;IAC/E,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpD,iBAAE,CAAC,SAAS,CAAC,mBAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,iBAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist-mcp/core/token.d.ts

@@ -0,0 +1,23 @@
+export interface ConfirmTokenData {
+    token: string;
+    pkgName: string;
+    version: string;
+    plannedFiles: string[];
+    integrity: string;
+    createdAt: number;
+    expiresAt: number;
+}
+export declare const TOKEN_TTL_MS: number;
+/**
+ * Creates and registers a single-use confirm token for a planned package hire.
+ */
+export declare function createConfirmToken(pkgName: string, version: string, plannedFiles: string[], integrity: string, ttlMs?: number): ConfirmTokenData;
+/**
+ * Validates and consumes a confirm token. The token is single-use and will be removed immediately.
+ */
+export declare function consumeConfirmToken(token: string, pkgName: string, version?: string): ConfirmTokenData;
+/**
+ * Clears all tokens (useful in test teardown).
+ */
+export declare function clearTokenStore(): void;
+//# sourceMappingURL=token.d.ts.map

package/dist-mcp/core/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/core/token.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,eAAO,MAAM,YAAY,QAAgB,CAAC;AAE1C;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EAAE,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,SAAe,GACnB,gBAAgB,CAsBlB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAmCtG;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}

package/dist-mcp/core/token.js

@@ -0,0 +1,70 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOKEN_TTL_MS = void 0;
+exports.createConfirmToken = createConfirmToken;
+exports.consumeConfirmToken = consumeConfirmToken;
+exports.clearTokenStore = clearTokenStore;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+// In-memory store for short-lived confirmation tokens
+const tokenStore = new Map();
+// Token lifetime: 5 minutes
+exports.TOKEN_TTL_MS = 5 * 60 * 1000;
+/**
+ * Creates and registers a single-use confirm token for a planned package hire.
+ */
+function createConfirmToken(pkgName, version, plannedFiles, integrity, ttlMs = exports.TOKEN_TTL_MS) {
+    // Clean up any expired tokens
+    const now = Date.now();
+    for (const [key, val] of tokenStore.entries()) {
+        if (val.expiresAt <= now) {
+            tokenStore.delete(key);
+        }
+    }
+    const token = `crewd_confirm_${node_crypto_1.default.randomBytes(24).toString("hex")}`;
+    const data = {
+        token,
+        pkgName,
+        version,
+        plannedFiles,
+        integrity,
+        createdAt: now,
+        expiresAt: now + ttlMs,
+    };
+    tokenStore.set(token, data);
+    return data;
+}
+/**
+ * Validates and consumes a confirm token. The token is single-use and will be removed immediately.
+ */
+function consumeConfirmToken(token, pkgName, version) {
+    if (!token) {
+        throw new Error("Missing confirm_token. Run 'plan_hire' first and provide the resulting confirm_token.");
+    }
+    const data = tokenStore.get(token);
+    if (!data) {
+        throw new Error("Invalid or expired confirm_token. Tokens are single-use and expire after 5 minutes. Run 'plan_hire' to generate a fresh token.");
+    }
+    // Single-use: remove immediately
+    tokenStore.delete(token);
+    const now = Date.now();
+    if (data.expiresAt < now) {
+        throw new Error("confirm_token has expired (5-minute limit exceeded). Run 'plan_hire' to generate a fresh token.");
+    }
+    if (data.pkgName !== pkgName) {
+        throw new Error(`confirm_token mismatch: token was issued for "${data.pkgName}", but requested hire is for "${pkgName}".`);
+    }
+    if (version && version !== "*" && data.version !== version) {
+        throw new Error(`confirm_token version mismatch: token was issued for version "${data.version}", but requested hire is for "${version}".`);
+    }
+    return data;
+}
+/**
+ * Clears all tokens (useful in test teardown).
+ */
+function clearTokenStore() {
+    tokenStore.clear();
+}
+//# sourceMappingURL=token.js.map

package/dist-mcp/core/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/core/token.ts"],"names":[],"mappings":";;;;;;AAqBA,gDA4BC;AAKD,kDAmCC;AAKD,0CAEC;AAhGD,8DAAiC;AAYjC,sDAAsD;AACtD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;AAEvD,4BAA4B;AACf,QAAA,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C;;GAEG;AACH,SAAgB,kBAAkB,CAChC,OAAe,EACf,OAAe,EACf,YAAsB,EACtB,SAAiB,EACjB,KAAK,GAAG,oBAAY;IAEpB,8BAA8B;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YACzB,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,qBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACxE,MAAM,IAAI,GAAqB;QAC7B,KAAK;QACL,OAAO;QACP,OAAO;QACP,YAAY;QACZ,SAAS;QACT,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,KAAK;KACvB,CAAC;IAEF,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,KAAa,EAAE,OAAe,EAAE,OAAgB;IAClF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,gIAAgI,CACjI,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,iDAAiD,IAAI,CAAC,OAAO,iCAAiC,OAAO,IAAI,CAC1G,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,iEAAiE,IAAI,CAAC,OAAO,iCAAiC,OAAO,IAAI,CAC1H,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe;IAC7B,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC"}

package/dist-mcp/server.d.ts

@@ -0,0 +1,14 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { RegistryClient } from "./core/registry.js";
+/**
+ * Creates and configures the Crewd MCP server with all 6 tools.
+ */
+export declare function createCrewdMcpServer(options?: {
+    registryClient?: RegistryClient;
+    projectRoot?: string;
+}): McpServer;
+/**
+ * Starts the MCP server on stdio transport.
+ */
+export declare function startStdioServer(): Promise<void>;
+//# sourceMappingURL=server.d.ts.map

package/dist-mcp/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,OAAO,EAAE,cAAc,EAA0C,MAAM,oBAAoB,CAAC;AAQ5F;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IAC7C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,SAAS,CAgeZ;AAED;;GAEG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAItD"}