@cybedefend/vibedefend 1.5.0 → 1.6.0

package/dist/mcp/verify/cache.js

@@ -0,0 +1,182 @@
+/**
+ * What we already know about a server and its tools, on this machine.
+ *
+ * One JSON file per server under `~/.cybedefend/mcp/cache/`. One file, not
+ * one database, for a reason the plan states: the agent spawns one proxy per
+ * MCP server and they all start at once, so a shared file would be five
+ * processes writing the same document within the same second. Per-server
+ * files never collide, and the interface below is narrow enough that moving
+ * to SQLite later is a swap rather than a rewrite.
+ *
+ * ─── The two rules that matter ──────────────────────────────────────────────
+ *
+ *  - `ok` expires after seven days. A tool that was clean last week is
+ *    probably still clean, and re-asking a backend about it on every session
+ *    would make the common case the expensive one. Seven days bounds how
+ *    stale that assumption can get.
+ *  - `malicious` NEVER expires. Nothing about the passage of time makes a
+ *    known-bad tool good again, and an expiry would silently reopen a server
+ *    the user was protected from. Only an explicit `vibedefend allow` clears
+ *    it.
+ *
+ * Overrides live in the same file as the verdicts they override, so a server
+ * the user allowed cannot end up half-allowed because two files disagreed.
+ */
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { writeFileAtomic } from '../config/atomicWrite.js';
+import { mcpCacheDir } from '../proxy/paths.js';
+import { serverIdFileName } from './identity.js';
+import { isServerAction } from './policy.js';
+/** Seven days on `ok`; `malicious` never expires. */
+export const OK_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+export function sameStamp(a, b) {
+    if (a === null || b === null)
+        return a === b;
+    return a.mtimeMs === b.mtimeMs && a.size === b.size;
+}
+export function emptyCacheFile(serverId, now) {
+    const stamp = now.toISOString();
+    return {
+        version: 1,
+        serverId,
+        server: { firstSeen: stamp, lastSeen: stamp, verdict: 'unknown' },
+        tools: {},
+    };
+}
+export function createJsonVerifyCache(options = {}) {
+    const dir = options.dir ?? mcpCacheDir(options.env ?? process.env);
+    const pathFor = (serverId) => join(dir, serverIdFileName(serverId));
+    return {
+        read(serverId) {
+            let text;
+            try {
+                text = readFileSync(pathFor(serverId), 'utf8');
+            }
+            catch {
+                return null;
+            }
+            return parseCacheFile(text, serverId);
+        },
+        write(file) {
+            // 0600: a `reason` may quote a tool description, which is the content
+            // of a server the user has not decided to trust yet.
+            writeFileAtomic(pathFor(file.serverId), `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+        },
+        stat(serverId) {
+            const stats = statSync(pathFor(serverId), { throwIfNoEntry: false });
+            return stats ? { mtimeMs: stats.mtimeMs, size: stats.size } : null;
+        },
+        list() {
+            if (!existsSync(dir))
+                return [];
+            const files = [];
+            for (const name of readdirSync(dir)) {
+                if (!name.endsWith('.json'))
+                    continue;
+                try {
+                    const parsed = parseCacheFile(readFileSync(join(dir, name), 'utf8'), '');
+                    if (parsed)
+                        files.push(parsed);
+                }
+                catch {
+                    /* a corrupt file is one server we cannot report, not a failure */
+                }
+            }
+            return files;
+        },
+    };
+}
+/**
+ * Reads a cache file, or `null`.
+ *
+ * A cache is a performance aid, never a source of truth for something we
+ * could not otherwise obtain, so a corrupt one reads as "nothing known" and
+ * the next verification rewrites it. The one thing NOT dropped on the way is
+ * a `malicious` verdict: see `mergeVerdict`.
+ */
+export function parseCacheFile(text, serverId) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== 'object' || parsed === null)
+        return null;
+    const typed = parsed;
+    if (typed.version !== 1 || typeof typed.server !== 'object' || !typed.server)
+        return null;
+    const tools = {};
+    for (const [digest, record] of Object.entries(typed.tools ?? {})) {
+        if (typeof record !== 'object' || record === null)
+            continue;
+        const entry = record;
+        if (!isVerdict(entry.verdict))
+            continue;
+        // An action this binary cannot read is no action: the verdict decides.
+        if (entry.action !== undefined && !isServerAction(entry.action))
+            delete entry.action;
+        tools[digest] = entry;
+    }
+    return {
+        version: 1,
+        serverId: typed.serverId || serverId,
+        server: {
+            firstSeen: typed.server.firstSeen ?? new Date(0).toISOString(),
+            lastSeen: typed.server.lastSeen ?? new Date(0).toISOString(),
+            verdict: isVerdict(typed.server.verdict) ? typed.server.verdict : 'unknown',
+            reason: typed.server.reason,
+            verdictAt: typed.server.verdictAt,
+            action: isServerAction(typed.server.action) ? typed.server.action : undefined,
+            override: typed.server.override === 'allow' || typed.server.override === 'deny' ? typed.server.override : undefined,
+            overrideAt: typed.server.overrideAt,
+            toolDigests: Array.isArray(typed.server.toolDigests)
+                ? typed.server.toolDigests.filter((digest) => typeof digest === 'string')
+                : undefined,
+        },
+        tools,
+    };
+}
+function isVerdict(value) {
+    return value === 'ok' || value === 'suspicious' || value === 'malicious' || value === 'pending' || value === 'unknown';
+}
+/** Has this record aged out? `malicious` never does. */
+export function isExpired(record, now, ttlMs = OK_TTL_MS) {
+    if (record.verdict === 'malicious')
+        return false;
+    if (record.verdict !== 'ok')
+        return true;
+    if (!record.verdictAt)
+        return true;
+    const at = Date.parse(record.verdictAt);
+    return Number.isNaN(at) || now.getTime() - at > ttlMs;
+}
+/**
+ * Combines what we knew with what we just learned.
+ *
+ * The rule the previous generation arrived at and this keeps: a FRESH answer
+ * that says "not known" never overwrites a fact we already have, and a fresh
+ * answer that DOES know always wins. Without the first half, one backend
+ * outage would quietly clear every `malicious` on the machine; without the
+ * second, a tool that has just been reclassified would stay wrong for a week.
+ */
+export function mergeVerdict(previous, next) {
+    if (!previous)
+        return next;
+    // The submission mark is a fact about what WE did, not a verdict: it
+    // survives whatever the fresh answer says, or the same digest would be
+    // bought again after every lookup that still came back "unknown".
+    const submittedAt = next.submittedAt ?? previous.submittedAt;
+    const marked = (record) => (submittedAt ? { ...record, submittedAt } : record);
+    if (next.verdict === 'unknown' || next.verdict === 'pending') {
+        return previous.verdict === 'unknown' || previous.verdict === 'pending' ? marked(next) : marked(previous);
+    }
+    return marked(next);
+}
+export function ensureCacheDir(options = {}) {
+    const dir = options.dir ?? mcpCacheDir(options.env ?? process.env);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+}
+//# sourceMappingURL=cache.js.map

package/dist/mcp/verify/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../src/mcp/verify/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,cAAc,EAAqB,MAAM,aAAa,CAAC;AAqFhE,qDAAqD;AACrD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAkCjD,MAAM,UAAU,SAAS,CAAC,CAAoB,EAAE,CAAoB;IAClE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAQD,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,GAAS;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,OAAO;QACL,OAAO,EAAE,CAAC;QACV,QAAQ;QACR,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE;QACjE,KAAK,EAAE,EAAE;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAA4B,EAAE;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnE,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEpF,OAAO;QACL,IAAI,CAAC,QAAQ;YACX,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;QAED,KAAK,CAAC,IAAI;YACR,sEAAsE;YACtE,qDAAqD;YACrD,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,CAAC,QAAQ;YACX,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,CAAC;QAED,IAAI;YACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;YAChC,MAAM,KAAK,GAAsB,EAAE,CAAC;YACpC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,SAAS;gBACtC,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;oBACzE,IAAI,MAAM;wBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,kEAAkE;gBACpE,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,QAAgB;IAC3D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAkC,CAAC;IACjD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAE1F,MAAM,KAAK,GAA+B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC5D,MAAM,KAAK,GAAG,MAAoB,CAAC;QACnC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,SAAS;QACxC,uEAAuE;QACvE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC;QACrF,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ;QACpC,MAAM,EAAE;YACN,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YAC9D,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YAC5D,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAC3E,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;YAC3B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;YACjC,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAC7E,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACnH,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;YACnC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;gBAClD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;gBAC3F,CAAC,CAAC,SAAS;SACd;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,CAAC;AACzH,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,SAAS,CAAC,MAAgD,EAAE,GAAS,EAAE,KAAK,GAAG,SAAS;IACtG,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgC,EAAE,IAAgB;IAC7E,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,qEAAqE;IACrE,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAc,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACvG,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAA4B,EAAE;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACnE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/mcp/verify/contract-errors.js

@@ -0,0 +1,198 @@
+/**
+ * What the backend refused, and since when.
+ *
+ * ── TWO FAMILIES OF FAILURE, AND ONLY ONE OF THEM IS FAIL-OPEN ──────────────
+ *
+ * A network error, a timeout or a 5xx means the backend could not answer. The
+ * proxy forwards the tool list, records `pending`, and says nothing to the
+ * agent: an outage must not turn every MCP server off, and the user cannot do
+ * anything about it anyway.
+ *
+ * A 400, 409 or 422 means the backend answered, and refused what we sent. That
+ * is not an outage, it is a DISAGREEMENT ABOUT THE CONTRACT — our request is
+ * malformed, or our digest formula is not one this server can compute. Filing
+ * it as `pending` would be a lie in the one direction that matters: `pending`
+ * says "we will retry and it will work", and retrying cannot help. Worse, it
+ * is indistinguishable from an ordinary outage, so a client that has stopped
+ * being able to verify ANYTHING looks exactly like a client waiting on a slow
+ * backend — for as long as nobody looks.
+ *
+ * ── WHY ITS OWN FILE, AND NOT THE PER-SERVER CACHE ─────────────────────────
+ *
+ * A contract error is not a property of the MCP server we happened to be
+ * asking about when it happened: it is a property of the client ↔ backend
+ * pair. A `409 DIGEST_VERSION_UNSUPPORTED` hits EVERY server, and writing it
+ * into the cache of whichever one we were looking at would draw a false map —
+ * one server "at fault", the others "clean", when in fact nothing is being
+ * verified anywhere.
+ *
+ * ── WHY SESSIONS AND NOT OCCURRENCES ───────────────────────────────────────
+ *
+ * The alert threshold is "it survived a restart". Counting occurrences would
+ * fire on a single session that listed three servers; counting distinct
+ * sessions asks the only question worth asking — did restarting fix it. Only
+ * the LAST session id is kept, not the set: the count is the answer, the list
+ * would only grow.
+ */
+import { mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { writeFileAtomic } from '../config/atomicWrite.js';
+import { sanitise } from '../proxy/inject.js';
+import { mcpHomeDir } from '../proxy/paths.js';
+/**
+ * The statuses that mean "your request is the problem".
+ *
+ * `400` malformed, `422` unprocessable, `409` a state disagreement — which is
+ * what an unsupported digest version is. `403` and `404` joined them with the
+ * org-scoped routes: the organization is in the PATH, and "not a member" or
+ * "no such organization" is an answer about what this machine selected, not
+ * about the backend's health — retrying with the same organization cannot
+ * help. Everything else, 429 and 5xx included, describes something that
+ * happened to the BACKEND and stays fail-open.
+ */
+export const CONTRACT_ERROR_STATUSES = [400, 403, 404, 409, 422];
+export function isContractErrorStatus(status) {
+    return CONTRACT_ERROR_STATUSES.includes(status);
+}
+/**
+ * ── `code` AND `supported` COME OFF THE WIRE ────────────────────────────────
+ *
+ * They are fields of an HTTP response. They are written to disk here, and
+ * rendered into the user's terminal by `vibedefend status`. This repository
+ * already has a doctrine for that — every string that came from a server goes
+ * through `sanitise` before it reaches a reader — and this path had missed it
+ * because the fields look like metadata rather than prose.
+ *
+ * What it costs if forgotten: an ESC[2J clears the screen, a carriage return
+ * rewrites the line above, a newline forges a second status line. `apiBase`
+ * is gated by the origin allowlist, true — but "the source is trusted" is
+ * exactly the reasoning that cost the two defects found in the Phase 4
+ * end-of-session review.
+ *
+ * The bounds are the other half: the SENDER, not us, would otherwise choose
+ * how much we write to the user's disk on every single occurrence.
+ */
+export const MAX_CONTRACT_CODE_CHARS = 64;
+export const MAX_SUPPORTED_VERSIONS = 8;
+export const MAX_SUPPORTED_VERSION_CHARS = 16;
+/** One code, safe to store and to print. */
+function safeCode(code) {
+    if (code === undefined)
+        return undefined;
+    const clean = sanitise(code, MAX_CONTRACT_CODE_CHARS);
+    return clean.length > 0 ? clean : undefined;
+}
+/** The supported-version list, bounded in both directions and sanitised. */
+function safeSupported(supported) {
+    if (supported === undefined)
+        return undefined;
+    const clean = supported
+        .slice(0, MAX_SUPPORTED_VERSIONS)
+        .map((value) => sanitise(value, MAX_SUPPORTED_VERSION_CHARS))
+        .filter((value) => value.length > 0);
+    return clean.length > 0 ? clean : undefined;
+}
+/** Distinct sessions before the agent is told. See the header. */
+export const PERSISTENT_AFTER_SESSIONS = 2;
+export function contractErrorsFile(env = process.env) {
+    return join(mcpHomeDir(env), 'contract-errors.json');
+}
+/**
+ * The key of a record. Route + status + code, so an unsupported digest version
+ * and a malformed body on the same route stay two separate lines — they have
+ * two separate fixes.
+ */
+function keyOf(input) {
+    return `${input.route}|${input.status}|${input.code ?? ''}`;
+}
+/**
+ * Reads the file, or an empty one.
+ *
+ * A malformed file reads as empty rather than throwing. Several proxies write
+ * this concurrently (one process per MCP server), and this is a JOURNAL: a
+ * corrupt journal must never be the reason a verification fails.
+ */
+function read(env) {
+    try {
+        const parsed = JSON.parse(readFileSync(contractErrorsFile(env), 'utf8'));
+        if (!parsed || typeof parsed !== 'object')
+            return { version: 1, errors: {} };
+        const file = parsed;
+        if (!file.errors || typeof file.errors !== 'object')
+            return { version: 1, errors: {} };
+        return { version: 1, errors: file.errors };
+    }
+    catch {
+        return { version: 1, errors: {} };
+    }
+}
+/** Every contract error on file, worst-persisting first. */
+export function listContractErrors(env = process.env) {
+    return Object.values(read(env).errors)
+        .map(({ lastSessionId: _ignored, ...record }) => record)
+        .sort((left, right) => right.sessions - left.sessions || left.route.localeCompare(right.route));
+}
+/** The ones that survived a restart — the threshold for telling the agent. */
+export function persistentContractErrors(env = process.env) {
+    return listContractErrors(env).filter((record) => record.sessions >= PERSISTENT_AFTER_SESSIONS);
+}
+/**
+ * Files one occurrence.
+ *
+ * Best-effort by design: a failure to write must not take down the
+ * verification that was already failing. The caller is in a `catch`.
+ */
+export function recordContractError(input, deps = {}) {
+    const env = deps.env ?? process.env;
+    const at = (deps.now ?? new Date()).toISOString();
+    // Sanitised HERE, at the one place wire data enters the record, rather than
+    // at each of the two places it leaves it. A guard on the way out is a guard
+    // the third reader forgets.
+    const code = safeCode(input.code);
+    const supported = safeSupported(input.supported);
+    try {
+        const file = read(env);
+        const key = keyOf({ ...input, code });
+        const existing = file.errors[key];
+        file.errors[key] = existing
+            ? {
+                ...existing,
+                // The code and the supported list can only get MORE precise: a
+                // backend that starts naming its refusal should not be ignored
+                // because the first occurrence was anonymous.
+                code: code ?? existing.code,
+                supported: supported ?? existing.supported,
+                lastSeenAt: at,
+                // Only a NEW session id advances the count. Three refusals inside
+                // one run are one session, which is the whole point.
+                sessions: existing.lastSessionId === input.sessionId ? existing.sessions : existing.sessions + 1,
+                lastSessionId: input.sessionId,
+            }
+            : {
+                route: input.route,
+                status: input.status,
+                code,
+                supported,
+                firstSeenAt: at,
+                lastSeenAt: at,
+                sessions: 1,
+                lastSessionId: input.sessionId,
+            };
+        mkdirSync(mcpHomeDir(env), { recursive: true });
+        writeFileAtomic(contractErrorsFile(env), `${JSON.stringify(file, null, 2)}\n`);
+    }
+    catch {
+        /* a journal that cannot be written is still not a reason to fail a check */
+    }
+}
+/** Clears the file. `vibedefend status` uses it once the disagreement is fixed. */
+export function clearContractErrors(env = process.env) {
+    try {
+        mkdirSync(mcpHomeDir(env), { recursive: true });
+        writeFileAtomic(contractErrorsFile(env), `${JSON.stringify({ version: 1, errors: {} }, null, 2)}\n`);
+    }
+    catch {
+        /* nothing to do: the next successful call will not re-file anything */
+    }
+}
+//# sourceMappingURL=contract-errors.js.map

package/dist/mcp/verify/contract-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-errors.js","sourceRoot":"","sources":["../../../src/mcp/verify/contract-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAK/C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAEpF,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACxC,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C,4CAA4C;AAC5C,SAAS,QAAQ,CAAC,IAAwB;IACxC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,SAA+B;IACpD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,KAAK,GAAG,SAAS;SACpB,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC;SAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;SAC5D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAmC3C,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,sBAAsB,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,KAAK,CAAC,KAA4D;IACzE,OAAO,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,IAAI,CAAC,GAAsB;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC7E,MAAM,IAAI,GAAG,MAAqC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpC,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;SACnC,GAAG,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;SACvD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,wBAAwB,CACtC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,yBAAyB,CAAC,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAyB,EACzB,OAA0B,EAAE;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,4EAA4E;IAC5E,4EAA4E;IAC5E,4BAA4B;IAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ;YACzB,CAAC,CAAC;gBACE,GAAG,QAAQ;gBACX,+DAA+D;gBAC/D,+DAA+D;gBAC/D,8CAA8C;gBAC9C,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI;gBAC3B,SAAS,EAAE,SAAS,IAAI,QAAQ,CAAC,SAAS;gBAC1C,UAAU,EAAE,EAAE;gBACd,kEAAkE;gBAClE,qDAAqD;gBACrD,QAAQ,EACN,QAAQ,CAAC,aAAa,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC;gBACxF,aAAa,EAAE,KAAK,CAAC,SAAS;aAC/B;YACH,CAAC,CAAC;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI;gBACJ,SAAS;gBACT,WAAW,EAAE,EAAE;gBACf,UAAU,EAAE,EAAE;gBACd,QAAQ,EAAE,CAAC;gBACX,aAAa,EAAE,KAAK,CAAC,SAAS;aAC/B,CAAC;QAEN,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,eAAe,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,eAAe,CACb,kBAAkB,CAAC,GAAG,CAAC,EACvB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC3D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;AACH,CAAC"}

package/dist/mcp/verify/digest.js

@@ -0,0 +1,91 @@
+import { createHash } from 'node:crypto';
+/**
+ * Maximum nesting depth accepted by the canonicalisation.
+ *
+ * The depth is attacker-controlled and the canonicalisation recurses. On this
+ * engine the stack overflows around 2,500 levels, while a 5,000-level schema
+ * weighs only ~30 KB, far below any size cap. Without a bound the resulting
+ * `RangeError` was neither a business error nor a shape error: it became an
+ * internal failure that took the whole batch down with it.
+ *
+ * 100 is two orders of magnitude above any real JSON Schema (the deepest
+ * schemas MCP servers produce stay around twenty levels) and twenty-five times
+ * below the measured overflow: the bound refuses an attack, never a
+ * legitimate schema.
+ */
+export const MAX_CANONICAL_DEPTH = 100;
+/**
+ * A caller-side shape error, not a server failure. Kept as a dedicated class
+ * rather than a bare `RangeError` so a controller can map it to an
+ * invalid-argument response, exactly as it already does for a `SyntaxError`
+ * on a syntactically invalid schema. A genuine stack overflow stays a failure.
+ */
+export class ToolSchemaTooDeepError extends Error {
+    maxDepth;
+    constructor(maxDepth) {
+        super(`tool schema nesting exceeds ${maxDepth} levels`);
+        this.maxDepth = maxDepth;
+        this.name = 'ToolSchemaTooDeepError';
+    }
+}
+/**
+ * JSON with keys sorted at every depth: two payloads that differ only by key
+ * order produce a single string. Arrays keep their order, because in JSON
+ * Schema `required` and `enum` are ordered data.
+ *
+ * Depth-bounded: see `MAX_CANONICAL_DEPTH`.
+ */
+export function stableStringify(value) {
+    return canonicalize(value, 0);
+}
+/**
+ * The depth is passed explicitly, never through a default parameter exposed to
+ * `Array.prototype.map`: `value.map(canonicalize)` would pass the array INDEX
+ * as the second argument and reset the bound on every first element, a guard
+ * that compiles, passes nominal tests, and guards nothing.
+ */
+function canonicalize(value, depth) {
+    if (depth > MAX_CANONICAL_DEPTH) {
+        throw new ToolSchemaTooDeepError(MAX_CANONICAL_DEPTH);
+    }
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value) ?? 'null';
+    if (Array.isArray(value))
+        return `[${value.map((item) => canonicalize(item, depth + 1)).join(',')}]`;
+    const entries = Object.keys(value)
+        .sort()
+        .map((k) => `${JSON.stringify(k)}:${canonicalize(value[k], depth + 1)}`);
+    return `{${entries.join(',')}}`;
+}
+/**
+ * Version of the digest formula, carried as a prefix of every digest
+ * (`d1:<sha256 hex>`). The digest is shared across organisations and
+ * repositories: bump this when the formula changes so old verdicts are
+ * ignored rather than silently mismatched.
+ */
+export const DIGEST_VERSION = 'd1';
+/**
+ * Digest of a tool definition: exactly the surface the agent consumes and the
+ * attacker controls. `title` and `annotations` are included on purpose: the
+ * agent reads them too (a lying `destructiveHint: false`, for instance).
+ *
+ * No whitespace normalisation. This digest is the cache key of the backend
+ * judge, and the judge reads the RAW text: two descriptions it would read
+ * differently must never share a verdict.
+ *
+ * Shared contract with the backend: `tests/mcp/verify/__fixtures__/digest-vectors.json`
+ * pins the expected output on both sides.
+ */
+export function toolDigest(tool) {
+    const canonical = stableStringify({
+        name: tool.name ?? '',
+        title: tool.title ?? '',
+        description: tool.description ?? '',
+        inputSchema: tool.inputSchema ?? null,
+        outputSchema: tool.outputSchema ?? null,
+        annotations: tool.annotations ?? null,
+    });
+    const hex = createHash('sha256').update(canonical, 'utf8').digest('hex');
+    return `${DIGEST_VERSION}:${hex}`;
+}
+//# sourceMappingURL=digest.js.map

package/dist/mcp/verify/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../../../src/mcp/verify/digest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAczC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC1B;IAArB,YAAqB,QAAgB;QACnC,KAAK,CAAC,+BAA+B,QAAQ,SAAS,CAAC,CAAC;QADrC,aAAQ,GAAR,QAAQ,CAAQ;QAEnC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,IAAI,KAAK,GAAG,mBAAmB,EAAE,CAAC;QAChC,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC;SAC1D,IAAI,EAAE;SACN,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAC3F,CAAC;IACJ,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,MAAM,SAAS,GAAG,eAAe,CAAC;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;QACvC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;KACtC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,OAAO,GAAG,cAAc,IAAI,GAAG,EAAE,CAAC;AACpC,CAAC"}

package/dist/mcp/verify/factory.js

@@ -0,0 +1,56 @@
+import { PROXY_ENV_PREFIX } from '../proxy/paths.js';
+import { persistedOrganization, resolveBackendAccess } from './backend.js';
+import { createJsonVerifyCache } from './cache.js';
+import { upstreamServerId } from './identity.js';
+import { verifyTokenResolver } from './token.js';
+import { DEFAULT_VERIFY_TIMEOUT_MS, Verifier } from './verifier.js';
+/**
+ * A verifier for `spec`, named `serverName` on every finding.
+ *
+ * `spec` is the STORED spec, never the expanded one: `upstreamServerId`
+ * hashes it, and that hash keys the cache and the user's overrides.
+ */
+export function buildVerifier(spec, serverName, logger, env, overrides = {}) {
+    const serverId = upstreamServerId(spec);
+    const timeoutMs = overrides.timeoutMs ?? positiveMs(env[`${PROXY_ENV_PREFIX}VERIFY_TIMEOUT_MS`]) ?? DEFAULT_VERIFY_TIMEOUT_MS;
+    const resolved = overrides.backend === undefined
+        ? (overrides.resolveBackendAccessFn ?? resolveBackendAccess)({
+            env,
+            warn: (message, fields) => logger.warn(message, fields),
+        })
+        : overrides.backend;
+    const backend = resolved
+        ? {
+            ...resolved,
+            options: {
+                resolveTokenFn: verifyTokenResolver({ env }),
+                ...('options' in resolved ? (resolved.options ?? {}) : {}),
+            },
+        }
+        : null;
+    const verifier = new Verifier({
+        serverId,
+        serverName,
+        spec,
+        cache: overrides.cache ?? createJsonVerifyCache({ env }),
+        logger,
+        timeoutMs,
+        callTimeoutMs: overrides.callTimeoutMs,
+        now: overrides.now,
+        sessionId: overrides.sessionId,
+        env,
+        backend: backend ?? undefined,
+        // With no backend at all, the last known policy of the persisted
+        // organization still applies to what the cache decides.
+        organizationId: backend?.organizationId ?? persistedOrganization()?.id,
+    });
+    return { verifier, serverId, serverName, timeoutMs, backend };
+}
+/** A strictly positive number of milliseconds from an environment value, or nothing. */
+export function positiveMs(value) {
+    if (!value)
+        return undefined;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
+//# sourceMappingURL=factory.js.map

package/dist/mcp/verify/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../../src/mcp/verify/factory.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAsB,MAAM,cAAc,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAoB,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAsB,MAAM,eAAe,CAAC;AA8BxF;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAkB,EAClB,UAAkB,EAClB,MAAc,EACd,GAAsB,EACtB,YAAoC,EAAE;IAEtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,SAAS,GACb,SAAS,CAAC,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,gBAAgB,mBAAmB,CAAC,CAAC,IAAI,yBAAyB,CAAC;IAC9G,MAAM,QAAQ,GACZ,SAAS,CAAC,OAAO,KAAK,SAAS;QAC7B,CAAC,CAAC,CAAC,SAAS,CAAC,sBAAsB,IAAI,oBAAoB,CAAC,CAAC;YACzD,GAAG;YACH,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;SACxD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;IACxB,MAAM,OAAO,GAAyB,QAAQ;QAC5C,CAAC,CAAC;YACE,GAAG,QAAQ;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC;gBAC5C,GAAG,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D;SACF;QACH,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC;QAC5B,QAAQ;QACR,UAAU;QACV,IAAI;QACJ,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC;QACxD,MAAM;QACN,SAAS;QACT,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,GAAG;QACH,OAAO,EAAE,OAAO,IAAI,SAAS;QAC7B,iEAAiE;QACjE,wDAAwD;QACxD,cAAc,EAAE,OAAO,EAAE,cAAc,IAAI,qBAAqB,EAAE,EAAE,EAAE;KACvE,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,UAAU,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC"}