@hoilab/ada-cli 0.84.22 → 0.85.1

package/dist/core/mcp/oauth.js

@@ -0,0 +1,348 @@
+/**
+ * OAuth 2.0 + PKCE para servidores MCP.
+ *
+ * Ada-owned: no existe en upstream pi. Implementa el flujo que omp tiene en
+ * `mcp/oauth-flow.ts` + `mcp/oauth-discovery.ts` + `mcp/oauth-credentials.ts`:
+ *
+ * - PKCE S256 (RFC 7636): verifier 43-128 chars, challenge = BASE64URL(SHA256(verifier))
+ * - Descubrimiento RFC 8414 / RFC 9728 con resource indicators (RFC 8707)
+ * - Registro dinámico de cliente RFC 7591
+ * - Callback localhost (loopback) — el redirect_uri es http://127.0.0.1:{port}/callback
+ * - Refresh token
+ *
+ * Diferencia con el bearer estático que teníamos (`core/mcp/client.ts`): sin
+ * esto ningún servidor MCP corporativo detrás de un IdP es utilizable.
+ *
+ * Verificación CAP: `grep -rn "PKCE\|code_verifier\|code_challenge" packages/coding-agent/src/core/mcp`
+ * antes de este fichero devolvía 0 resultados (solo comentario en client.ts sobre
+ * bearer). Ver `AUDITORIA-OMP.md` MCP-01.
+ */
+import { createHash, randomBytes } from "node:crypto";
+/**
+ * BASE64URL sin padding.
+ * Usa Buffer.toString("base64url") cuando está disponible (Node >=15),
+ * con fallback manual para entornos sin soporte.
+ */
+export function base64UrlEncode(buf) {
+    // Node 16+ soporta "base64url" directamente
+    try {
+        return Buffer.from(buf).toString("base64url");
+    }
+    catch {
+        return Buffer.from(buf).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+    }
+}
+/** SHA256(verifier) → BASE64URL */
+export function computeChallenge(verifier) {
+    const digest = createHash("sha256").update(verifier, "utf8").digest();
+    return base64UrlEncode(digest);
+}
+/**
+ * Genera un par PKCE S256.
+ *
+ * - verifier: 32 bytes aleatorios → 43 chars base64url (dentro de 43-128)
+ * - challenge: BASE64URL(SHA256(verifier))
+ * - method: siempre "S256" (plain está prohibido en este módulo)
+ */
+export function generatePKCEPair() {
+    // 32 bytes = 43 chars base64url, mínimo válido. 96 bytes daría 128 chars (máximo),
+    // pero 32 es suficiente entropía (256 bits) y es lo que usa omp.
+    const verifier = base64UrlEncode(randomBytes(32));
+    // Defensa: por si el runtime cambia la codificación, garantizamos 43-128.
+    if (verifier.length < 43 || verifier.length > 128) {
+        throw new Error(`PKCE verifier fuera de rango: ${verifier.length}`);
+    }
+    const challenge = computeChallenge(verifier);
+    return { verifier, challenge, method: "S256" };
+}
+const DEFAULT_DISCOVERY_TIMEOUT_MS = 8_000;
+async function fetchJson(url, fetchImpl, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetchImpl(url, {
+            signal: controller.signal,
+            headers: { accept: "application/json" },
+        });
+        if (!res.ok)
+            return null;
+        const text = await res.text();
+        if (!text.trim())
+            return null;
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Descubre la configuración OAuth del servidor MCP.
+ *
+ * Orden (como en omp `oauth-discovery.ts:225-375`):
+ *  1. RFC 9728 — Protected Resource Metadata en
+ *     `/.well-known/oauth-protected-resource` (y variante con path).
+ *     Si responde con `authorization_servers`, se resuelve el primero.
+ *  2. RFC 8414 — Authorization Server Metadata en
+ *     `/.well-known/oauth-authorization-server`.
+ *  3. OpenID Discovery como fallback (`/.well-known/openid-configuration`).
+ *
+ * Además, si el servidor MCP responde 401 con `WWW-Authenticate: Bearer
+ * resource_metadata="..."`, ese URL tiene prioridad (no lo probamos aquí por
+ * no hacer una petición extra al MCP en discovery puro; el caller puede pasar
+ * la URL del header si la tiene).
+ */
+export async function discoverOAuthConfig(serverUrl, options = {}) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_DISCOVERY_TIMEOUT_MS;
+    let parsed;
+    try {
+        parsed = new URL(serverUrl);
+    }
+    catch {
+        throw new Error(`serverUrl no es una URL válida: ${serverUrl}`);
+    }
+    const origin = parsed.origin;
+    // 1. RFC 9728 — Protected Resource
+    const protectedCandidates = [
+        `${origin}/.well-known/oauth-protected-resource`,
+        // Variante con path (p.ej. /mcp → /.well-known/oauth-protected-resource/mcp)
+        `${origin}/.well-known/oauth-protected-resource${parsed.pathname}`,
+    ];
+    for (const url of protectedCandidates) {
+        const meta = (await fetchJson(url, fetchImpl, timeoutMs));
+        if (meta?.authorization_servers?.[0]) {
+            const issuer = meta.authorization_servers[0].replace(/\/+$/, "");
+            // Resolver el authorization server indicado
+            const asMeta = await fetchAuthorizationServerMetadata(issuer, fetchImpl, timeoutMs);
+            if (asMeta) {
+                return {
+                    issuer: asMeta.issuer ?? issuer,
+                    authorizationEndpoint: asMeta.authorization_endpoint,
+                    tokenEndpoint: asMeta.token_endpoint,
+                    registrationEndpoint: asMeta.registration_endpoint,
+                    scopesSupported: asMeta.scopes_supported ?? meta.scopes_supported,
+                    resource: meta.resource ?? serverUrl,
+                };
+            }
+        }
+    }
+    // 2. RFC 8414 directo
+    const asMeta = await fetchAuthorizationServerMetadata(origin, fetchImpl, timeoutMs);
+    if (asMeta) {
+        return {
+            issuer: asMeta.issuer ?? origin,
+            authorizationEndpoint: asMeta.authorization_endpoint,
+            tokenEndpoint: asMeta.token_endpoint,
+            registrationEndpoint: asMeta.registration_endpoint,
+            scopesSupported: asMeta.scopes_supported,
+            resource: serverUrl,
+        };
+    }
+    // 3. OpenID fallback
+    const oidcMeta = await fetchJson(`${origin}/.well-known/openid-configuration`, fetchImpl, timeoutMs);
+    if (oidcMeta && typeof oidcMeta === "object" && "authorization_endpoint" in oidcMeta) {
+        const m = oidcMeta;
+        if (m.authorization_endpoint && m.token_endpoint) {
+            return {
+                issuer: m.issuer ?? origin,
+                authorizationEndpoint: m.authorization_endpoint,
+                tokenEndpoint: m.token_endpoint,
+                registrationEndpoint: m.registration_endpoint,
+                scopesSupported: m.scopes_supported,
+                resource: serverUrl,
+            };
+        }
+    }
+    throw new Error(`No se pudo descubrir configuración OAuth para ${serverUrl} (RFC 8414/9728). ` +
+        `Verifica que el servidor publique /.well-known/oauth-authorization-server o /.well-known/oauth-protected-resource`);
+}
+async function fetchAuthorizationServerMetadata(issuerOrOrigin, fetchImpl, timeoutMs) {
+    const base = issuerOrOrigin.replace(/\/+$/, "");
+    const candidates = [
+        `${base}/.well-known/oauth-authorization-server`,
+        // Algunos IdP lo sirven sin prefijo extra cuando issuer ya incluye path
+        `${base}/.well-known/openid-configuration`,
+    ];
+    for (const url of candidates) {
+        const meta = (await fetchJson(url, fetchImpl, timeoutMs));
+        if (meta?.authorization_endpoint && meta?.token_endpoint)
+            return meta;
+    }
+    return null;
+}
+export async function registerClient(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    // Validación: solo loopback para este flujo
+    for (const uri of options.redirectUris) {
+        const u = new URL(uri);
+        if (u.hostname !== "127.0.0.1" && u.hostname !== "localhost" && u.hostname !== "[::1]") {
+            throw new Error(`redirect_uri debe ser loopback (127.0.0.1/localhost), recibido: ${uri}`);
+        }
+        if (u.protocol !== "http:") {
+            throw new Error(`redirect_uri loopback debe ser http:, recibido: ${uri}`);
+        }
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetchImpl(options.registrationEndpoint, {
+            method: "POST",
+            headers: { "content-type": "application/json", accept: "application/json" },
+            body: JSON.stringify({
+                client_name: options.clientName ?? "ada-cli",
+                redirect_uris: options.redirectUris,
+                grant_types: ["authorization_code", "refresh_token"],
+                response_types: ["code"],
+                scope: options.scope,
+                token_endpoint_auth_method: "none", // PKCE public client
+            }),
+            signal: controller.signal,
+        });
+        if (!res.ok) {
+            const body = await res.text().catch(() => "");
+            throw new Error(`Registro dinámico falló: HTTP ${res.status} ${body.slice(0, 500)}`);
+        }
+        const data = (await res.json());
+        if (!data.client_id)
+            throw new Error("Registro dinámico sin client_id en la respuesta");
+        return { clientId: data.client_id, clientSecret: data.client_secret };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers de callback localhost
+// ---------------------------------------------------------------------------
+/**
+ * Construye la URL de autorización para redirigir al usuario.
+ *
+ * El caller abre esta URL en el navegador y espera el callback en
+ * `redirectUri` (http://127.0.0.1:{port}/callback).
+ */
+export function buildAuthorizationUrl(config, params) {
+    const url = new URL(config.authorizationEndpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", params.clientId);
+    url.searchParams.set("redirect_uri", params.redirectUri);
+    url.searchParams.set("code_challenge", params.pkce.challenge);
+    url.searchParams.set("code_challenge_method", params.pkce.method);
+    if (params.scope ?? config.scopesSupported?.join(" ")) {
+        url.searchParams.set("scope", params.scope ?? config.scopesSupported.join(" "));
+    }
+    if (params.state)
+        url.searchParams.set("state", params.state);
+    // RFC 8707 resource indicator — lo exige omp discovery :351
+    if (params.resource ?? config.resource) {
+        url.searchParams.set("resource", params.resource ?? config.resource);
+    }
+    return url.toString();
+}
+/** Valida que una redirect_uri sea loopback (callback localhost). */
+export function isLoopbackRedirectUri(uri) {
+    try {
+        const u = new URL(uri);
+        return ((u.hostname === "127.0.0.1" || u.hostname === "localhost" || u.hostname === "[::1]") && u.protocol === "http:");
+    }
+    catch {
+        return false;
+    }
+}
+export async function exchangeCodeForToken(options) {
+    if (!isLoopbackRedirectUri(options.redirectUri)) {
+        throw new Error(`redirectUri debe ser loopback http://127.0.0.1:{port}/callback, recibido: ${options.redirectUri}`);
+    }
+    if (!options.code)
+        throw new Error("code vacío");
+    if (!options.verifier)
+        throw new Error("verifier vacío (PKCE)");
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    const body = new URLSearchParams();
+    body.set("grant_type", "authorization_code");
+    body.set("code", options.code);
+    body.set("redirect_uri", options.redirectUri);
+    body.set("client_id", options.clientId);
+    body.set("code_verifier", options.verifier);
+    if (options.clientSecret)
+        body.set("client_secret", options.clientSecret);
+    if (options.resource)
+        body.set("resource", options.resource);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetchImpl(options.tokenEndpoint, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+            body: body.toString(),
+            signal: controller.signal,
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            throw new Error(`Token exchange falló: HTTP ${res.status} ${text.slice(0, 800)}`);
+        }
+        const data = (await res.json());
+        if (!data.access_token)
+            throw new Error("Token exchange sin access_token");
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            expiresIn: data.expires_in,
+            tokenType: data.token_type ?? "Bearer",
+            scope: data.scope,
+            raw: data,
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export async function refreshAccessToken(options) {
+    if (!options.refreshToken)
+        throw new Error("refreshToken vacío");
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    const body = new URLSearchParams();
+    body.set("grant_type", "refresh_token");
+    body.set("refresh_token", options.refreshToken);
+    body.set("client_id", options.clientId);
+    if (options.clientSecret)
+        body.set("client_secret", options.clientSecret);
+    if (options.scope)
+        body.set("scope", options.scope);
+    if (options.resource)
+        body.set("resource", options.resource);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetchImpl(options.tokenEndpoint, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+            body: body.toString(),
+            signal: controller.signal,
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            throw new Error(`Refresh falló: HTTP ${res.status} ${text.slice(0, 800)}`);
+        }
+        const data = (await res.json());
+        if (!data.access_token)
+            throw new Error("Refresh sin access_token");
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            expiresIn: data.expires_in,
+            tokenType: data.token_type ?? "Bearer",
+            scope: data.scope,
+            raw: data,
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=oauth.js.map

package/dist/core/mcp/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/core/mcp/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AActD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAwB;IACvD,4CAA4C;IAC5C,IAAI,CAAC;QACJ,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxG,CAAC;AACF,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACtE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB;IAC/B,mFAAmF;IACnF,iEAAiE;IACjE,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,0EAA0E;IAC1E,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAuBD,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAE3C,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,SAAuB,EAAE,SAAiB;IAC/E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,SAAiB,EACjB,UAAiC,EAAE;IAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,4BAA4B,CAAC;IAEpE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B,mCAAmC;IACnC,MAAM,mBAAmB,GAAG;QAC3B,GAAG,MAAM,uCAAuC;QAChD,6EAA6E;QAC7E,GAAG,MAAM,wCAAwC,MAAM,CAAC,QAAQ,EAAE;KAClE,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,CAKhD,CAAC;QACT,IAAI,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACjE,4CAA4C;YAC5C,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YACpF,IAAI,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACN,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM;oBAC/B,qBAAqB,EAAE,MAAM,CAAC,sBAAsB;oBACpD,aAAa,EAAE,MAAM,CAAC,cAAc;oBACpC,oBAAoB,EAAE,MAAM,CAAC,qBAAqB;oBAClD,eAAe,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB;oBACjE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;iBACpC,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,sBAAsB;IACtB,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACpF,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO;YACN,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM;YAC/B,qBAAqB,EAAE,MAAM,CAAC,sBAAsB;YACpD,aAAa,EAAE,MAAM,CAAC,cAAc;YACpC,oBAAoB,EAAE,MAAM,CAAC,qBAAqB;YAClD,eAAe,EAAE,MAAM,CAAC,gBAAgB;YACxC,QAAQ,EAAE,SAAS;SACnB,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,mCAAmC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACrG,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,wBAAwB,IAAI,QAAQ,EAAE,CAAC;QACtF,MAAM,CAAC,GAAG,QAMT,CAAC;QACF,IAAI,CAAC,CAAC,sBAAsB,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;YAClD,OAAO;gBACN,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM;gBAC1B,qBAAqB,EAAE,CAAC,CAAC,sBAAsB;gBAC/C,aAAa,EAAE,CAAC,CAAC,cAAc;gBAC/B,oBAAoB,EAAE,CAAC,CAAC,qBAAqB;gBAC7C,eAAe,EAAE,CAAC,CAAC,gBAAgB;gBACnC,QAAQ,EAAE,SAAS;aACnB,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,IAAI,KAAK,CACd,iDAAiD,SAAS,oBAAoB;QAC7E,mHAAmH,CACpH,CAAC;AACH,CAAC;AAUD,KAAK,UAAU,gCAAgC,CAC9C,cAAsB,EACtB,SAAuB,EACvB,SAAiB;IAEjB,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG;QAClB,GAAG,IAAI,yCAAyC;QAChD,wEAAwE;QACxE,GAAG,IAAI,mCAAmC;KAC1C,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,CAAuC,CAAC;QAChG,IAAI,IAAI,EAAE,sBAAsB,IAAI,IAAI,EAAE,cAAc;YAAE,OAAO,IAAI,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAsBD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B;IAClE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE9C,4CAA4C;IAC5C,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,mEAAmE,GAAG,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;IACF,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;gBAC5C,aAAa,EAAE,OAAO,CAAC,YAAY;gBACnC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,0BAA0B,EAAE,MAAM,EAAE,qBAAqB;aACzD,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAC;QACjF,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACxF,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;IACvE,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACpC,MAAmB,EACnB,MAOC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,eAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,4DAA4D;IAC5D,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAS,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAChD,IAAI,CAAC;QACJ,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CACN,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAC9G,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AA4BD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA4B;IACtE,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACd,6EAA6E,OAAO,CAAC,WAAW,EAAE,CAClG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAEhE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE9C,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAM7B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC3E,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI;SACT,CAAC;IACH,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACF,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAuB;IAC/D,IAAI,CAAC,OAAO,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAEjE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE9C,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAM7B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACpE,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI;SACT,CAAC;IACH,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;AACF,CAAC"}

package/dist/core/mcp/tools.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Tools MCP expuestas al modelo: EXACTAMENTE DOS.
+ *
+ * No una por cada tool remota, a propósito. Un servidor con 40 herramientas
+ * inflaría el system prompt con 40 esquemas, desplazaría el prefijo cacheable
+ * (a 31x el token de miss en DeepSeek, eso se paga) y ahogaría a las tools
+ * propias del agente. Con dos, el descubrimiento es explícito y bajo demanda.
+ *
+ * Se registran SOLO en la sesión principal: un subagente no debe poder alcanzar
+ * el Jira de la empresa.
+ */
+import type { ToolDefinition } from "../extensions/types.ts";
+import type { McpManager } from "./manager.ts";
+export declare function createMcpTools(manager: McpManager): Record<string, ToolDefinition>;
+//# sourceMappingURL=tools.d.ts.map

package/dist/core/mcp/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAmB,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAyB/C,wBAAgB,cAAc,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CA2DlF"}

package/dist/core/mcp/tools.js

@@ -0,0 +1,84 @@
+/**
+ * Tools MCP expuestas al modelo: EXACTAMENTE DOS.
+ *
+ * No una por cada tool remota, a propósito. Un servidor con 40 herramientas
+ * inflaría el system prompt con 40 esquemas, desplazaría el prefijo cacheable
+ * (a 31x el token de miss en DeepSeek, eso se paga) y ahogaría a las tools
+ * propias del agente. Con dos, el descubrimiento es explícito y bajo demanda.
+ *
+ * Se registran SOLO en la sesión principal: un subagente no debe poder alcanzar
+ * el Jira de la empresa.
+ */
+import { Type } from "typebox";
+function textResult(text) {
+    return { content: [{ type: "text", text }], details: undefined };
+}
+function textOf(content) {
+    const text = content
+        .filter((block) => block.type === "text" && block.text)
+        .map((block) => block.text)
+        .join("\n")
+        .trim();
+    return text || "(sin contenido textual)";
+}
+const listParams = Type.Object({
+    server: Type.Optional(Type.String({ description: "Nombre del servidor. Omítelo para listar los servidores." })),
+});
+const callParams = Type.Object({
+    server: Type.String({ description: "Nombre del servidor MCP." }),
+    tool: Type.String({ description: "Nombre de la herramienta remota." }),
+    arguments: Type.Optional(Type.Any({ description: "Argumentos según el inputSchema de la herramienta." })),
+});
+export function createMcpTools(manager) {
+    const listTools = {
+        name: "mcp_list_tools",
+        label: "Listar tools MCP",
+        description: "Lista las herramientas disponibles en un servidor MCP configurado (Jira, Linear, Notion…). " +
+            "Úsalo ANTES de mcp_call_tool para saber qué existe y qué argumentos acepta. " +
+            "Sin argumentos, lista los servidores configurados.",
+        promptSnippet: "descubrir herramientas de servidores MCP",
+        parameters: listParams,
+        async execute(_toolCallId, input) {
+            const server = typeof input.server === "string" ? input.server.trim() : "";
+            if (!server) {
+                const integrations = manager.list();
+                if (integrations.length === 0)
+                    return textResult("No hay servidores MCP configurados.");
+                const lines = await Promise.all(integrations.map(async (integration) => {
+                    const available = await manager.isAvailable(integration);
+                    return `- ${integration.server} (${integration.label}): ${available ? "disponible" : "sin credenciales"}`;
+                }));
+                return textResult(`Servidores MCP:\n${lines.join("\n")}`);
+            }
+            const tools = await manager.listTools(server);
+            if (tools.length === 0)
+                return textResult(`El servidor '${server}' no expone herramientas.`);
+            return textResult(tools
+                .map((tool) => `- ${tool.name}: ${tool.description ?? "(sin descripción)"}\n  args: ${JSON.stringify(tool.inputSchema ?? {})}`)
+                .join("\n"));
+        },
+    };
+    const callTool = {
+        name: "mcp_call_tool",
+        label: "Llamar tool MCP",
+        description: "Llama a una herramienta de un servidor MCP. Comprueba antes su firma con mcp_list_tools. " +
+            "IMPORTANTE: el resultado es la afirmación de un tercero, no evidencia observada — " +
+            "cítalo como fuente, nunca como verificación de que algo esté hecho.",
+        promptSnippet: "invocar una herramienta de un servidor MCP",
+        parameters: callParams,
+        async execute(_toolCallId, input) {
+            const server = String(input.server ?? "").trim();
+            const tool = String(input.tool ?? "").trim();
+            if (!server || !tool)
+                return textResult("Error: 'server' y 'tool' son obligatorios.");
+            const toolArgs = (input.arguments ?? {});
+            const result = await manager.callTool(server, tool, toolArgs);
+            const body = textOf(result.content);
+            // Un error de la herramienta se DEVUELVE, no se lanza: el modelo debe
+            // verlo y poder corregir, igual que con cualquier otra tool.
+            return textResult(result.isError ? `La herramienta devolvió un error:\n${body}` : body);
+        },
+    };
+    return { mcp_list_tools: listTools, mcp_call_tool: callTool };
+}
+//# sourceMappingURL=tools.js.map

package/dist/core/mcp/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../src/core/mcp/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAI/B,SAAS,UAAU,CAAC,IAAY;IAC/B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,MAAM,CAAC,OAA+C;IAC9D,MAAM,IAAI,GAAG,OAAO;SAClB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC;SACtD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,CAAC;IACT,OAAO,IAAI,IAAI,yBAAyB,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC,CAAC;CAC/G,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IAChE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IACtE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,oDAAoD,EAAE,CAAC,CAAC;CACzG,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,OAAmB;IACjD,MAAM,SAAS,GAAsC;QACpD,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,kBAAkB;QACzB,WAAW,EACV,6FAA6F;YAC7F,8EAA8E;YAC9E,oDAAoD;QACrD,aAAa,EAAE,0CAA0C;QACzD,UAAU,EAAE,UAAU;QACtB,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK;YAC/B,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,UAAU,CAAC,qCAAqC,CAAC,CAAC;gBACxF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;oBACtC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;oBACzD,OAAO,KAAK,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,KAAK,MAAM,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;gBAC3G,CAAC,CAAC,CACF,CAAC;gBACF,OAAO,UAAU,CAAC,oBAAoB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,UAAU,CAAC,gBAAgB,MAAM,2BAA2B,CAAC,CAAC;YAC7F,OAAO,UAAU,CAChB,KAAK;iBACH,GAAG,CACH,CAAC,IAAI,EAAE,EAAE,CACR,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,IAAI,mBAAmB,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAChH;iBACA,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;QACH,CAAC;KACD,CAAC;IAEF,MAAM,QAAQ,GAAsC;QACnD,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACV,2FAA2F;YAC3F,oFAAoF;YACpF,qEAAqE;QACtE,aAAa,EAAE,4CAA4C;QAC3D,UAAU,EAAE,UAAU;QACtB,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK;YAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;gBAAE,OAAO,UAAU,CAAC,4CAA4C,CAAC,CAAC;YACtF,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpC,sEAAsE;YACtE,6DAA6D;YAC7D,OAAO,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzF,CAAC;KACD,CAAC;IAEF,OAAO,EAAE,cAAc,EAAE,SAA2B,EAAE,aAAa,EAAE,QAA0B,EAAE,CAAC;AACnG,CAAC"}

package/dist/core/memoria/almacen.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Almacén de memoria vectorial híbrida con ciclo de vida (ME1+ME2).
+ *
+ * - ME2: embeddings locales hash-based (ver embeddings.ts) y ciclo de vida
+ *   completo: creación → refresco → decaimiento → purga. La lectura filtra
+ *   SIEMPRE expirados (`expiraEn`) y sustituidos (`sustituidoPor`).
+ * - ME1: recall híbrido = coseno vectorial + BM25 léxico simple + decaimiento
+ *   exponencial por frescura + peso por fuente.
+ * - PR6: toda escritura pasa por redactarSecretos() ANTES de tocar el
+ *   almacén — no hay ruta que se lo salte (es privada por construcción).
+ *
+ * Persistencia opcional: JSON atómico en `<directorio>/memoria-hibrida.json`.
+ */
+import { type EscrituraMemoria, type FuenteMemoria, type OpcionesMemoria, type RegistroMemoria, type ResultadoRecall } from "./tipos.ts";
+export declare class MemoriaHibrida {
+    private readonly registros;
+    private readonly ahora;
+    private readonly ttlPorDefectoMs;
+    private readonly fichero?;
+    private contador;
+    constructor(opciones?: OpcionesMemoria);
+    /**
+     * Escribe una memoria nueva. PR6: el contenido pasa por redacción de
+     * secretos antes de calcular embedding ni persistir nada.
+     */
+    escribir(contenido: string, opciones?: {
+        fuente?: FuenteMemoria;
+        ttlMs?: number;
+    }): EscrituraMemoria;
+    /**
+     * Recall híbrido: solo vivos (no expirados, no sustituidos), puntuados por
+     * coseno + BM25 + frescura decae exponencial desde el último refresco +
+     * peso por fuente. `recordar` refresca lo que acierta: lo usado no muere.
+     */
+    recordar(consulta: string, limite?: number): ResultadoRecall[];
+    /** Refresca un registro: reinicia su reloj de decaimiento y extiende el TTL. */
+    refrescar(id: string): boolean;
+    /** Marca un registro como sustituido: desaparece de la lectura, purgable después. */
+    sustituir(idViejo: string, idNuevo: string): boolean;
+    /** Purga física: elimina expirados y sustituidos. Devuelve los ids eliminados. */
+    purgar(): string[];
+    tamano(): {
+        total: number;
+        vivos: number;
+    };
+    /** Copia de los registros vivos — entrada para el grafo episódico (ME5). */
+    vivos(): RegistroMemoria[];
+    /** Lee un registro por id; undefined si no existe. */
+    obtener(id: string): RegistroMemoria | undefined;
+    private estaVivo;
+    /** BM25 simple sobre los tokens de la consulta presentes en el documento. */
+    private bm25;
+    private cargar;
+    private persistir;
+}
+//# sourceMappingURL=almacen.d.ts.map

package/dist/core/memoria/almacen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"almacen.d.ts","sourceRoot":"","sources":["../../../src/core/memoria/almacen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,eAAe,EAEpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,MAAM,YAAY,CAAC;AAcpB,qBAAa,cAAc;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsC;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAK;gBAET,QAAQ,CAAC,EAAE,eAAe;IAOtC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,aAAa,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB;IAqBpG;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,eAAe,EAAE;IAiDzD,gFAAgF;IAChF,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAU9B,qFAAqF;IACrF,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;IAQpD,kFAAkF;IAClF,MAAM,IAAI,MAAM,EAAE;IAalB,MAAM,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAO1C,4EAA4E;IAC5E,KAAK,IAAI,eAAe,EAAE;IAK1B,sDAAsD;IACtD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAIhD,OAAO,CAAC,QAAQ;IAIhB,6EAA6E;IAC7E,OAAO,CAAC,IAAI;IAqBZ,OAAO,CAAC,MAAM;IAad,OAAO,CAAC,SAAS;CAIjB"}