@descryy/mcp 0.11.4 → 0.11.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@descryy/mcp",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "type": "module",
   "description": "Descry's MCP server: the agent-facing front door over the query layer. The stdio transport is JSON-RPC 2.0 by hand rather than seventeen packages of HTTP and OAuth. Twenty-one tools; most read the graph and nothing else. The @descryy dependencies are here for the three that do more: observe_runtime boots or attaches to a real application, observe_tests runs the project's own test suite, and the browser tools drive a real browser — each writing what it witnessed into the graph as R4 facts. @descryy/runtime-browser is declared below like the others. It is still imported by specifier at call time rather than statically — not because it is unpublished (it is not) but because that indirection is an injection seam real tests use to drive the settle logic against a fake module with no real browser involved; see playwright-driver.ts. A missing package, a missing Chromium binary, or an import failure each still returns a named, remediable refusal rather than a crash or an empty result.",
   "license": "MIT",
@@ -32,9 +32,6 @@
     "registry": "https://registry.npmjs.org",
     "access": "public"
   },
-  "scripts": {
-    "build": "tsc -b"
-  },
   "devDependencies": {
     "pg": "8.13.1"
   },
@@ -44,14 +41,14 @@
     "@descryy/runtime-backend-observation": "0.3.6",
     "@descryy/runtime-browser": "0.4.8",
     "@descryy/runtime-contracts": "0.3.3",
-    "@descryy/runtime-controller": "0.3.7",
+    "@descryy/runtime-controller": "0.3.8",
     "@descryy/runtime-database-observation": "0.4.8",
     "@descryy/runtime-environment-profile": "0.4.5",
     "@descryy/runtime-evidence-correlation": "0.4.9",
     "@descryy/runtime-evidence-store": "0.4.2",
     "@descryy/runtime-graph-correlator": "0.4.8",
     "@descryy/runtime-identity-grounding": "0.4.4",
-    "@descryy/runtime-orchestrator": "0.4.8",
+    "@descryy/runtime-orchestrator": "0.4.9",
     "@descryy/runtime-test-runner": "0.4.9"
   },
   "optionalDependencies": {
@@ -74,5 +71,8 @@
     "@descryy/adapter-ruby": "0.5.2",
     "@descryy/adapter-rust": "0.5.1",
     "@descryy/adapter-swift": "0.5.2"
+  },
+  "scripts": {
+    "build": "tsc -b"
   }
-}
+}

package/dist/action-handshake.d.ts

@@ -1,38 +0,0 @@
-/** Two-call action-tool handshake, §7/DEC-278. G5 doesn't run in MCP mode, so this replaces it —
- *  the server owns both decision and state, holding the gate without client cooperation. A tool
- *  opts in via `class: "action"` + `describeAction`. Token binds to call 1's exact args, is
- *  single-use, expires in 5 minutes (a starting value), and any bad token throws
- *  `ToolInputError` rather than a silent no-op.
- *
- *  **Redemption runs the frozen args and says so when that cost the caller something.** It used
- *  to ignore anything else supplied and disclose nothing, which is the "silently do less" rule 7
- *  forbids: documenting a substitution in five tool descriptions does not make it not silent,
- *  because the caller who gets it wrong is by definition the one who did not read them. So a
- *  conflicting value is still discarded — the frozen args are the ones a human saw in `willDo`,
- *  and honouring a value nobody confirmed would defeat the gate — but the keys dropped come back
- *  on the dispatch and are disclosed by name in the reply.
- *
- *  What is *not* a discard, and this is the whole difficulty: call 2 carrying only the token is
- *  the documented normal path, and a client echoing the original args back alongside it is
- *  equally correct. An omitted key used its frozen value; a re-sent identical key changed
- *  nothing. Only a conflicting value is reported, or the disclosure would fire on every correct
- *  call and be trained away before the one time it mattered. Ruled in
- *  `DEC-NEXT-late-arguments-on-a-confirming-call.md`. */
-import { type ToolContext, type ToolDefinition } from "./tools/kit.ts";
-export type ActionDispatch = {
-    readonly kind: "run";
-    readonly args: Record<string, unknown>;
-    /** Arguments the confirming call supplied that conflicted with the frozen ones and were
-     *  therefore not used. Present only on a redemption, and only when non-empty — every other
-     *  path discarded nothing and must say nothing. Rendered into the reply's `disclosures`. */
-    readonly discardedArgs?: readonly string[];
-} | {
-    readonly kind: "handshake";
-    readonly token: string;
-    readonly willDo: string;
-};
-/** Decides what a call should do, before any budget timer starts. `read`/`stateful-read` and an
- *  ungated `action` call resolve to `{ kind: "run", args }`; an unconfirmed gated call resolves to
- *  `{ kind: "handshake", token, willDo }`; a redeemed one runs the args captured at mint time. */
-export declare function resolveActionDispatch(tool: ToolDefinition, args: Record<string, unknown>, ctx: ToolContext): Promise<ActionDispatch>;
-//# sourceMappingURL=action-handshake.d.ts.map

package/dist/action-handshake.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"action-handshake.d.ts","sourceRoot":"","sources":["../src/action-handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;yDAmByD;AAIzD,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAiCvF,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC;;gGAE4F;IAC5F,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF;;kGAEkG;AAClG,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,WAAW,GACf,OAAO,CAAC,cAAc,CAAC,CAazB"}

package/dist/action-handshake.js

@@ -1,127 +0,0 @@
-/** Two-call action-tool handshake, §7/DEC-278. G5 doesn't run in MCP mode, so this replaces it —
- *  the server owns both decision and state, holding the gate without client cooperation. A tool
- *  opts in via `class: "action"` + `describeAction`. Token binds to call 1's exact args, is
- *  single-use, expires in 5 minutes (a starting value), and any bad token throws
- *  `ToolInputError` rather than a silent no-op.
- *
- *  **Redemption runs the frozen args and says so when that cost the caller something.** It used
- *  to ignore anything else supplied and disclose nothing, which is the "silently do less" rule 7
- *  forbids: documenting a substitution in five tool descriptions does not make it not silent,
- *  because the caller who gets it wrong is by definition the one who did not read them. So a
- *  conflicting value is still discarded — the frozen args are the ones a human saw in `willDo`,
- *  and honouring a value nobody confirmed would defeat the gate — but the keys dropped come back
- *  on the dispatch and are disclosed by name in the reply.
- *
- *  What is *not* a discard, and this is the whole difficulty: call 2 carrying only the token is
- *  the documented normal path, and a client echoing the original args back alongside it is
- *  equally correct. An omitted key used its frozen value; a re-sent identical key changed
- *  nothing. Only a conflicting value is reported, or the disclosure would fire on every correct
- *  call and be trained away before the one time it mattered. Ruled in
- *  `DEC-NEXT-late-arguments-on-a-confirming-call.md`. */
-import { randomBytes } from "node:crypto";
-import { ToolInputError } from "./tools/kit.js";
-const TOKEN_TTL_MS = 5 * 60 * 1000;
-const storesBySession = new WeakMap();
-function storeFor(session) {
-    let store = storesBySession.get(session);
-    if (store === undefined) {
-        store = new Map();
-        storesBySession.set(session, store);
-    }
-    return store;
-}
-function prune(store) {
-    const now = Date.now();
-    for (const [token, pending] of store) {
-        if (pending.expiresAt < now)
-            store.delete(token);
-    }
-}
-function mintToken() {
-    return `act_${randomBytes(9).toString("base64url")}`;
-}
-/** Decides what a call should do, before any budget timer starts. `read`/`stateful-read` and an
- *  ungated `action` call resolve to `{ kind: "run", args }`; an unconfirmed gated call resolves to
- *  `{ kind: "handshake", token, willDo }`; a redeemed one runs the args captured at mint time. */
-export async function resolveActionDispatch(tool, args, ctx) {
-    if (tool.class !== "action")
-        return { kind: "run", args };
-    const confirmToken = args["confirmToken"];
-    if (confirmToken !== undefined && typeof confirmToken !== "string") {
-        throw new ToolInputError('"confirmToken" must be a string');
-    }
-    if (confirmToken === undefined) {
-        return mintOrPassThrough(tool, args, ctx);
-    }
-    return redeem(tool, args, confirmToken, ctx);
-}
-async function mintOrPassThrough(tool, args, ctx) {
-    if (tool.describeAction === undefined) {
-        // Registry bug, not a caller mistake: `class: "action"` declared with no describeAction.
-        throw new Error(`${tool.name} declares class "action" but has no describeAction`);
-    }
-    const willDo = await tool.describeAction(args, ctx);
-    if (willDo === undefined)
-        return { kind: "run", args };
-    const store = storeFor(ctx.session);
-    prune(store);
-    const token = mintToken();
-    store.set(token, { toolName: tool.name, args, expiresAt: Date.now() + TOKEN_TTL_MS });
-    return { kind: "handshake", token, willDo };
-}
-async function redeem(tool, supplied, confirmToken, ctx) {
-    const store = storeFor(ctx.session);
-    const pending = store.get(confirmToken);
-    // Deleted on lookup, not on success: a replayed token is a used token
-    // whether or not what follows here succeeds.
-    store.delete(confirmToken);
-    if (pending === undefined) {
-        throw new ToolInputError(`"confirmToken" is unknown or was already used. Call ${tool.name} again without confirmToken for a fresh one.`);
-    }
-    if (pending.expiresAt < Date.now()) {
-        throw new ToolInputError(`"confirmToken" expired. Call ${tool.name} again without confirmToken for a fresh one.`);
-    }
-    if (pending.toolName !== tool.name) {
-        throw new ToolInputError(`"confirmToken" was not issued for ${tool.name}.`);
-    }
-    const discardedArgs = conflictingKeys(supplied, pending.args);
-    return discardedArgs.length === 0
-        ? { kind: "run", args: pending.args }
-        : { kind: "run", args: pending.args, discardedArgs };
-}
-/** Keys the confirming call supplied with a value the frozen args do not already hold. `confirmToken`
- *  is excluded: it is the handshake's own argument, never one of the tool's. Sorted so the disclosure
- *  reads the same on every run — a reply a caller diffs must not reorder on rerun (§9 layer 6). */
-function conflictingKeys(supplied, frozen) {
-    const conflicts = [];
-    for (const key of Object.keys(supplied)) {
-        if (key === "confirmToken")
-            continue;
-        if (!sameValue(supplied[key], frozen[key]))
-            conflicts.push(key);
-    }
-    return conflicts.sort();
-}
-/** Structural equality over the JSON an MCP client can actually send — objects, arrays, and the
- *  four scalar types. Object key *order* is not part of a JSON value's identity, so it is not
- *  compared: a client that rebuilds an argument from its own state and sends the same fields in a
- *  different order discarded nothing, and telling it otherwise is the false positive that would
- *  make this disclosure worth ignoring. */
-function sameValue(a, b) {
-    if (a === b)
-        return true;
-    if (typeof a !== "object" || typeof b !== "object" || a === null || b === null)
-        return false;
-    if (Array.isArray(a) || Array.isArray(b)) {
-        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
-            return false;
-        return a.every((item, index) => sameValue(item, b[index]));
-    }
-    const left = a;
-    const right = b;
-    const leftKeys = Object.keys(left);
-    if (leftKeys.length !== Object.keys(right).length)
-        return false;
-    return leftKeys.every((key) => Object.hasOwn(right, key) && sameValue(left[key], right[key]));
-}
-//# sourceMappingURL=action-handshake.js.map

package/dist/action-handshake.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"action-handshake.js","sourceRoot":"","sources":["../src/action-handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;yDAmByD;AAEzD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAyC,MAAM,gBAAgB,CAAC;AAGvF,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAQnC,MAAM,eAAe,GAAG,IAAI,OAAO,EAAuC,CAAC;AAE3E,SAAS,QAAQ,CAAC,OAAgB;IAChC,IAAI,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QAClB,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,KAAiC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG;YAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACvD,CAAC;AAaD;;kGAEkG;AAClG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAoB,EACpB,IAA6B,EAC7B,GAAgB;IAEhB,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAE1D,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,cAAc,CAAC,iCAAiC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,IAAoB,EACpB,IAA6B,EAC7B,GAAgB;IAEhB,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACtC,yFAAyF;QACzF,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,oDAAoD,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAEvD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,KAAK,CAAC,KAAK,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;IAEtF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,IAAoB,EACpB,QAAiC,EACjC,YAAoB,EACpB,GAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,sEAAsE;IACtE,6CAA6C;IAC7C,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAE3B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,cAAc,CACtB,uDAAuD,IAAI,CAAC,IAAI,8CAA8C,CAC/G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,cAAc,CACtB,gCAAgC,IAAI,CAAC,IAAI,8CAA8C,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,cAAc,CAAC,qCAAqC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC;QAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;QACrC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;AACzD,CAAC;AAED;;mGAEmG;AACnG,SAAS,eAAe,CACtB,QAAiC,EACjC,MAA+B;IAE/B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,cAAc;YAAE,SAAS;QACrC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;2CAI2C;AAC3C,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7F,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAClF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAG,CAA4B,CAAC;IAC1C,MAAM,KAAK,GAAG,CAA4B,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC"}

package/dist/bin/descry-mcp.d.ts

@@ -1,7 +0,0 @@
-#!/usr/bin/env node
-/** The executable an MCP host launches. Takes the repo path (default cwd); everything else comes
- *  from `.descry/config.json`. `serveStdio` redirects console to stderr on its first line, so this
- *  file writes nothing before opening anything — earlier output corrupts the handshake frame, the
- *  worst place to fail (host just reports "server did not start"). */
-export {};
-//# sourceMappingURL=descry-mcp.d.ts.map

package/dist/bin/descry-mcp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"descry-mcp.d.ts","sourceRoot":"","sources":["../../src/bin/descry-mcp.ts"],"names":[],"mappings":";AACA;;;sEAGsE"}

package/dist/bin/descry-mcp.js

@@ -1,72 +0,0 @@
-#!/usr/bin/env node
-/** The executable an MCP host launches. Takes the repo path (default cwd); everything else comes
- *  from `.descry/config.json`. `serveStdio` redirects console to stderr on its first line, so this
- *  file writes nothing before opening anything — earlier output corrupts the handshake frame, the
- *  worst place to fail (host just reports "server did not start"). */
-import process from "node:process";
-import { createRequire } from "node:module";
-import { resolve } from "node:path";
-import { createMcpServer, isOutOfBand } from "../server.js";
-import { Session } from "../session.js";
-import { serveStdio } from "../transport.js";
-import { createPlaywrightBrowserDriver } from "../browser/playwright-driver.js";
-import { createDefaultCredentialStore } from "../credential-store.js";
-/** Read from the installed package, not hardcoded. It used to be literal `"0.0.0"` for every
- *  release, so no host could tell that 0.1.2 shipped from an off-main branch with an extra tool —
- *  a server that can't say what it is can't be caught drifting. */
-const VERSION = (() => {
-    try {
-        const pkg = createRequire(import.meta.url)("../../package.json");
-        return typeof pkg.version === "string" ? pkg.version : "0.0.0";
-    }
-    catch {
-        // Never fatal. A host that cannot read a version still gets a server, and
-        // failing the handshake over a label would be the worse trade.
-        return "0.0.0";
-    }
-})();
-const USAGE = `descry-mcp — Descry's MCP server (stdio)
-
-  descry-mcp [repository-path]
-
-Reads .descry/config.json from the repository for the graph location and the
-list of adapter packages to load. Runs until stdin closes.
-`;
-async function main() {
-    const args = process.argv.slice(2);
-    if (args.includes("--help") || args.includes("-h")) {
-        process.stderr.write(USAGE);
-        return 0;
-    }
-    const repoPath = resolve(args[0] ?? process.cwd());
-    const session = await Session.open({ repoPath });
-    // Session never defaults this driver factory away from null; without this line every browser_*
-    // tool refuses unconditionally regardless of what's installed. createPlaywrightBrowserDriver
-    // still turns a missing package/binary into a named refusal, not a crash.
-    session.useBrowserDriverFactory((options) => createPlaywrightBrowserDriver(options));
-    // RG-1(4)'s remaining gap: `credentialStore` was settable but nothing outside a test ever
-    // set it, so `${credential:NAME}` refused unconditionally in real use. The documented
-    // default location is `~/.descry/credentials` (`credential-store.ts`'s own header) — the
-    // same store `descry credential set` writes into.
-    session.credentialStore = createDefaultCredentialStore();
-    const server = createMcpServer({ session, name: "descry", version: VERSION });
-    try {
-        await serveStdio({ stdin: process.stdin, stdout: process.stdout, stderr: process.stderr }, (line, transport) => server.dispatch(line, transport), 
-        // Without this, `notifications/cancelled` waits in the ordered queue
-        // behind the very call it cancels and can never do anything.
-        { isOutOfBand });
-        return 0;
-    }
-    finally {
-        // `dispose`, not `close`: end-of-stdin is "disconnect," and §4 requires reaping every browser
-        // this connection owns — a leaked Chromium keeps running on the developer's machine.
-        await session.dispose();
-    }
-}
-main().then((code) => {
-    process.exitCode = code;
-}, (error) => {
-    process.stderr.write(`descry-mcp: ${error instanceof Error ? error.stack ?? error.message : String(error)}\n`);
-    process.exitCode = 1;
-});
-//# sourceMappingURL=descry-mcp.js.map

package/dist/bin/descry-mcp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"descry-mcp.js","sourceRoot":"","sources":["../../src/bin/descry-mcp.ts"],"names":[],"mappings":";AACA;;;sEAGsE;AAEtE,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAEtE;;mEAEmE;AACnE,MAAM,OAAO,GAAW,CAAC,GAAW,EAAE;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAA0B,CAAC;QAC1F,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,+DAA+D;QAC/D,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,MAAM,KAAK,GAAG;;;;;;CAMb,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjD,+FAA+F;IAC/F,6FAA6F;IAC7F,0EAA0E;IAC1E,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,0FAA0F;IAC1F,sFAAsF;IACtF,yFAAyF;IACzF,kDAAkD;IAClD,OAAO,CAAC,eAAe,GAAG,4BAA4B,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAE9E,IAAI,CAAC;QACH,MAAM,UAAU,CACd,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EACxE,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QACrD,qEAAqE;QACrE,6DAA6D;QAC7D,EAAE,WAAW,EAAE,CAChB,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,8FAA8F;QAC9F,qFAAqF;QACrF,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE;IACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,eAAe,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACzF,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CACF,CAAC"}

package/dist/browser/auth.d.ts

@@ -1,84 +0,0 @@
-/**
- * Reading an authenticated session in from a file — B1 of
- * `documents/plans/browser-reliability.md`.
- *
- * ## What was already here, and what was missing
- *
- * `browser_start_session` already accepted an inline `storageState` (11.4-b)
- * and `driver.ts` already carries it. Two things were missing and both are
- * about *reuse*: a caller had no way to point at a file, and a session had no
- * way to write one. Without those, "seed an authenticated session" means the
- * caller has to produce the cookie values by hand every time, which in
- * practice means nobody does it.
- *
- * So this module is the file half: load a browser's own saved state blob and
- * narrow it to the same-origin shape the port carries, refusing anything that
- * reaches outside the consented origin.
- *
- * ## Why the narrowing refuses rather than filters
- *
- * A saved state is whatever the browser had. A developer who logs in to their
- * application and saves the state has a file with one origin in it; a
- * developer who reuses a personal profile has a file with everything they are
- * logged into. Loading the second one wholesale would put unrelated
- * production sessions inside a browser the developer approved for one local
- * application. Quietly keeping only the matching cookies is worse than
- * refusing: a caller who believes they seeded a session and did not gets a run
- * that silently tested the logged-out surface and reported it as a clean one.
- *
- * ## Secrets
- *
- * Nothing here formats a value, including in a refusal — every message names a
- * cookie, a host or a path. `storageStateSecrets` returns the literal values
- * for `@descryy/core`'s `redactSecretsInText`, which replaces literal
- * substrings and never interprets one as a pattern, for the reason that
- * redactor's own header gives.
- *
- * Rule 1: a cookie, a header and an origin are facts about HTTP. No language,
- * framework or file extension is named here.
- */
-import type { BrowserStorageState } from "./driver.ts";
-export interface StorageStateContext {
-    /** The origin this session's consent is bound to. Everything loaded must be within it. */
-    readonly consentedOrigin: string;
-    /** The repository root, for resolving a relative path. */
-    readonly repoPath: string;
-}
-/**
- * Load a browser's saved storage state and narrow it to one origin.
- *
- * `path` is absolute or relative to the repository root. Throws
- * `ToolInputError` — every failure here is something the caller can fix by
- * changing an argument, and none of them is a bug in this server.
- */
-export declare function loadStorageStateFile(path: string, context: StorageStateContext): BrowserStorageState;
-/**
- * The parse-and-narrow half of {@link loadStorageStateFile}, taken directly rather than read
- * from a file — `browser-start-session.ts`'s `storageStateCredential` calls this against text
- * retrieved from `Session.credentialStore` (RG-1(4), lane "signin"). `sourceLabel` replaces the
- * file path in every message this can throw, so a credential-sourced refusal reads
- * `credential "NAME"` rather than a nonexistent file path.
- */
-export declare function parseStorageStateJson(text: string, sourceLabel: string, context: StorageStateContext): BrowserStorageState;
-/**
- * Where a saved state may be written.
- *
- * Inside the repository is refused. A storage state is a live credential in a
- * file, and the likeliest thing to happen to a file written into a working
- * tree is that it gets committed. Refusing costs the caller one argument; the
- * alternative costs them a session in their history.
- */
-export declare function resolveSavePath(raw: string, repoPath: string): string;
-/**
- * Every literal value a state carries. Names are deliberately absent — a
- * cookie called `session` is not a secret, and redacting the word would make
- * every reply that mentions a session unreadable.
- *
- * Values under four characters are dropped: one that short matches everywhere
- * and would redact a reply into noise, which is a worse outcome than leaving
- * a four-character credential in it.
- */
-export declare function storageStateSecrets(state: BrowserStorageState | null): readonly string[];
-/** The same, for header values. Separate because headers are not part of a storage state. */
-export declare function headerSecrets(headers: Readonly<Record<string, string>> | null): readonly string[];
-//# sourceMappingURL=auth.d.ts.map

package/dist/browser/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/browser/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAMH,OAAO,KAAK,EAAE,mBAAmB,EAAgB,MAAM,aAAa,CAAC;AAErE,MAAM,WAAW,mBAAmB;IAClC,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AA0BD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,mBAAmB,CAepG;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,mBAAmB,CAW1H;AAmGD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAWrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,MAAM,EAAE,CAIxF;AAED,6FAA6F;AAC7F,wBAAgB,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,MAAM,EAAE,CAGjG"}

package/dist/browser/auth.js

@@ -1,233 +0,0 @@
-/**
- * Reading an authenticated session in from a file — B1 of
- * `documents/plans/browser-reliability.md`.
- *
- * ## What was already here, and what was missing
- *
- * `browser_start_session` already accepted an inline `storageState` (11.4-b)
- * and `driver.ts` already carries it. Two things were missing and both are
- * about *reuse*: a caller had no way to point at a file, and a session had no
- * way to write one. Without those, "seed an authenticated session" means the
- * caller has to produce the cookie values by hand every time, which in
- * practice means nobody does it.
- *
- * So this module is the file half: load a browser's own saved state blob and
- * narrow it to the same-origin shape the port carries, refusing anything that
- * reaches outside the consented origin.
- *
- * ## Why the narrowing refuses rather than filters
- *
- * A saved state is whatever the browser had. A developer who logs in to their
- * application and saves the state has a file with one origin in it; a
- * developer who reuses a personal profile has a file with everything they are
- * logged into. Loading the second one wholesale would put unrelated
- * production sessions inside a browser the developer approved for one local
- * application. Quietly keeping only the matching cookies is worse than
- * refusing: a caller who believes they seeded a session and did not gets a run
- * that silently tested the logged-out surface and reported it as a clean one.
- *
- * ## Secrets
- *
- * Nothing here formats a value, including in a refusal — every message names a
- * cookie, a host or a path. `storageStateSecrets` returns the literal values
- * for `@descryy/core`'s `redactSecretsInText`, which replaces literal
- * substrings and never interprets one as a pattern, for the reason that
- * redactor's own header gives.
- *
- * Rule 1: a cookie, a header and an origin are facts about HTTP. No language,
- * framework or file extension is named here.
- */
-import { readFileSync } from "node:fs";
-import { isAbsolute, join, relative, resolve } from "node:path";
-import { ToolInputError } from "../tools/kit.js";
-const SAME_SITE = ["Strict", "Lax", "None"];
-function hostOf(origin) {
-    try {
-        return new URL(origin).hostname;
-    }
-    catch {
-        return origin;
-    }
-}
-/**
- * Does `domain` name the consented host and nothing else?
- *
- * A leading dot is how a saved jar spells "this domain and its subdomains", so
- * `.localhost` for `localhost` is the same host written two ways. What is not
- * accepted is a domain that covers *more* than the consented host — a cookie
- * for a parent domain travels to every sibling application under it, and that
- * is the widening this check exists to stop happening by accident.
- */
-function namesConsentedHost(domain, host) {
-    const bare = (domain.startsWith(".") ? domain.slice(1) : domain).toLowerCase();
-    return bare === host.toLowerCase();
-}
-/**
- * Load a browser's saved storage state and narrow it to one origin.
- *
- * `path` is absolute or relative to the repository root. Throws
- * `ToolInputError` — every failure here is something the caller can fix by
- * changing an argument, and none of them is a bug in this server.
- */
-export function loadStorageStateFile(path, context) {
-    const resolved = isAbsolute(path) ? path : join(context.repoPath, path);
-    let text;
-    try {
-        text = readFileSync(resolved, "utf8");
-    }
-    catch (error) {
-        throw new ToolInputError(`Could not read the storage state at ${resolved}: ${error instanceof Error ? error.message : String(error)}. ` +
-            "A relative path is resolved against the repository root. The usual way to produce this file is to " +
-            "start a session with headless false and saveStorageStateTo, log in by hand, and close it.");
-    }
-    return parseStorageStateJson(text, resolved, context);
-}
-/**
- * The parse-and-narrow half of {@link loadStorageStateFile}, taken directly rather than read
- * from a file — `browser-start-session.ts`'s `storageStateCredential` calls this against text
- * retrieved from `Session.credentialStore` (RG-1(4), lane "signin"). `sourceLabel` replaces the
- * file path in every message this can throw, so a credential-sourced refusal reads
- * `credential "NAME"` rather than a nonexistent file path.
- */
-export function parseStorageStateJson(text, sourceLabel, context) {
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
-        // The parser's own message quotes the text around the failure, and in this
-        // one file that text is credential material.
-        throw new ToolInputError(`The storage state at ${sourceLabel} is not valid JSON. Its contents are deliberately not quoted here.`);
-    }
-    return narrowToOrigin(parsed, sourceLabel, context);
-}
-function narrowToOrigin(raw, path, context) {
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-        throw new ToolInputError(`The storage state at ${path} is not an object.`);
-    }
-    const fields = raw;
-    const rawCookies = fields["cookies"];
-    const rawOrigins = fields["origins"];
-    // Both keys required rather than defaulted to empty. A blob missing one is
-    // far more likely to be the wrong file than a deliberately empty jar, and
-    // loading it produces a session that looks seeded and is not.
-    if (!Array.isArray(rawCookies) || !Array.isArray(rawOrigins)) {
-        throw new ToolInputError(`${path} does not look like a saved browser storage state — it needs a "cookies" array and an "origins" ` +
-            "array. Nothing was loaded.");
-    }
-    const host = hostOf(context.consentedOrigin);
-    const strayHosts = new Set();
-    const cookies = [];
-    for (const [index, entry] of rawCookies.entries()) {
-        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
-            throw new ToolInputError(`${path}: cookies[${index}] is not an object. Nothing was loaded.`);
-        }
-        const cookie = entry;
-        const name = cookie["name"];
-        const value = cookie["value"];
-        const domain = cookie["domain"];
-        if (typeof name !== "string" || typeof value !== "string") {
-            throw new ToolInputError(`${path}: cookies[${index}] needs a string "name" and "value". Nothing was loaded.`);
-        }
-        if (typeof domain !== "string" || !namesConsentedHost(domain, host)) {
-            strayHosts.add(typeof domain === "string" ? domain : "(no domain)");
-            continue;
-        }
-        const sameSite = cookie["sameSite"];
-        cookies.push({
-            name,
-            value,
-            // The domain is deliberately dropped rather than carried: the port's
-            // shape has no field for one, which is what makes a second origin
-            // unnameable rather than merely unaccepted.
-            ...(typeof cookie["path"] === "string" ? { path: cookie["path"] } : {}),
-            ...(typeof cookie["httpOnly"] === "boolean" ? { httpOnly: cookie["httpOnly"] } : {}),
-            ...(typeof cookie["secure"] === "boolean" ? { secure: cookie["secure"] } : {}),
-            ...(typeof sameSite === "string" && SAME_SITE.includes(sameSite)
-                ? { sameSite: sameSite }
-                : {}),
-        });
-    }
-    const strayOrigins = new Set();
-    const localStorage = {};
-    for (const [index, entry] of rawOrigins.entries()) {
-        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
-            throw new ToolInputError(`${path}: origins[${index}] is not an object. Nothing was loaded.`);
-        }
-        const origin = entry["origin"];
-        if (typeof origin !== "string") {
-            throw new ToolInputError(`${path}: origins[${index}] needs a string "origin". Nothing was loaded.`);
-        }
-        if (origin !== context.consentedOrigin) {
-            strayOrigins.add(origin);
-            continue;
-        }
-        const items = entry["localStorage"];
-        if (items !== undefined && !Array.isArray(items)) {
-            throw new ToolInputError(`${path}: origins[${index}].localStorage is not an array. Nothing was loaded.`);
-        }
-        for (const item of items ?? []) {
-            if (typeof item !== "object" || item === null)
-                continue;
-            const { name, value } = item;
-            if (typeof name === "string" && typeof value === "string")
-                localStorage[name] = value;
-        }
-    }
-    if (strayHosts.size > 0 || strayOrigins.size > 0) {
-        const parts = [];
-        if (strayHosts.size > 0)
-            parts.push(`cookies for ${[...strayHosts].join(", ")}`);
-        if (strayOrigins.size > 0)
-            parts.push(`stored data for ${[...strayOrigins].join(", ")}`);
-        throw new ToolInputError(`${path} carries ${parts.join(" and ")}, which ${context.consentedOrigin} does not cover. This session's ` +
-            "consent is bound to one origin, and seeding credentials for other hosts would put sessions the " +
-            "developer never approved inside this browser. Nothing was loaded, and no value from the file is " +
-            "printed here. Save a state for this application alone — a session started with saveStorageStateTo " +
-            "writes exactly that.");
-    }
-    return {
-        ...(cookies.length === 0 ? {} : { cookies }),
-        ...(Object.keys(localStorage).length === 0 ? {} : { localStorage }),
-    };
-}
-/**
- * Where a saved state may be written.
- *
- * Inside the repository is refused. A storage state is a live credential in a
- * file, and the likeliest thing to happen to a file written into a working
- * tree is that it gets committed. Refusing costs the caller one argument; the
- * alternative costs them a session in their history.
- */
-export function resolveSavePath(raw, repoPath) {
-    const path = isAbsolute(raw) ? raw : resolve(join(repoPath, raw));
-    const within = relative(resolve(repoPath), path);
-    if (within !== "" && !within.startsWith("..") && !isAbsolute(within)) {
-        throw new ToolInputError(`"saveStorageStateTo" resolves to ${path}, which is inside the repository at ${repoPath}. A saved storage ` +
-            "state is a live credential in a file, and a credential written into a working tree is one `git add .` " +
-            "away from being committed. Give an absolute path outside the repository.");
-    }
-    return path;
-}
-/**
- * Every literal value a state carries. Names are deliberately absent — a
- * cookie called `session` is not a secret, and redacting the word would make
- * every reply that mentions a session unreadable.
- *
- * Values under four characters are dropped: one that short matches everywhere
- * and would redact a reply into noise, which is a worse outcome than leaving
- * a four-character credential in it.
- */
-export function storageStateSecrets(state) {
-    if (state === null)
-        return [];
-    const values = [...(state.cookies ?? []).map((cookie) => cookie.value), ...Object.values(state.localStorage ?? {})];
-    return [...new Set(values.filter((value) => value.length >= 4))];
-}
-/** The same, for header values. Separate because headers are not part of a storage state. */
-export function headerSecrets(headers) {
-    if (headers === null)
-        return [];
-    return [...new Set(Object.values(headers).filter((value) => value.length >= 4))];
-}
-//# sourceMappingURL=auth.js.map