@inhuman.tools/harness 0.0.0-stage → 0.1.0

package/dist/providers/web/wire/json.js

@@ -0,0 +1,18 @@
+/** Object field without `as { key?: unknown }`. `Reflect.get` is lib `any`; this seals it. */
+export function readField(obj, key) {
+    if (!(key in obj))
+        return undefined;
+    const value = Reflect.get(obj, key);
+    return value;
+}
+/** One leftover `object` → `Record` hole. */
+export function asRecord(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return null;
+    return value;
+}
+/** `JSON.parse` is lib `any`. Public return is `unknown`. */
+export function parseJsonUnknown(text) {
+    return JSON.parse(text);
+}
+//# sourceMappingURL=json.js.map

package/dist/providers/web/wire/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../../src/providers/web/wire/json.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAE9F,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,GAAW;IAChD,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/providers/web/wire/ssrf.d.ts

@@ -0,0 +1,3 @@
+/** Reject non-http(s), credentials-in-URL, and private/reserved hostnames before extract. */
+export declare function publicHttpUrl(raw: string): URL;
+//# sourceMappingURL=ssrf.d.ts.map

package/dist/providers/web/wire/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../../../../src/providers/web/wire/ssrf.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAE7F,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAe9C"}

package/dist/providers/web/wire/ssrf.js

@@ -0,0 +1,38 @@
+/** Reject non-http(s), credentials-in-URL, and private/reserved hostnames before extract. */
+export function publicHttpUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`invalid URL: ${raw}`);
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error(`only http(s) allowed: ${url.protocol}`);
+    }
+    if (url.username !== "" || url.password !== "") {
+        throw new Error("URL credentials are not allowed");
+    }
+    assertPublicHost(url.hostname);
+    return url;
+}
+function assertPublicHost(hostname) {
+    const h = hostname.toLowerCase().replaceAll(/^\[|\]$/g, "");
+    if (h === "localhost" ||
+        h === "0.0.0.0" ||
+        h === "::" ||
+        h === "::1" ||
+        h.endsWith(".local") ||
+        h === "metadata.google.internal" ||
+        h === "metadata.goog" ||
+        /^(?:127\.|10\.|192\.168\.|169\.254\.|100\.(?:6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.|172\.(?:1[6-9]|2\d|3[01])\.)/.test(h) ||
+        h.startsWith("::ffff:127.") ||
+        h.startsWith("::ffff:10.") ||
+        h.startsWith("::ffff:192.168.") ||
+        h.startsWith("fc") ||
+        h.startsWith("fd") ||
+        h.startsWith("fe80:")) {
+        throw new Error(`blocked host: ${hostname}`);
+    }
+}
+//# sourceMappingURL=ssrf.js.map

package/dist/providers/web/wire/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../../../src/providers/web/wire/ssrf.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAE7F,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IACE,CAAC,KAAK,WAAW;QACjB,CAAC,KAAK,SAAS;QACf,CAAC,KAAK,IAAI;QACV,CAAC,KAAK,KAAK;QACX,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpB,CAAC,KAAK,0BAA0B;QAChC,CAAC,KAAK,eAAe;QACrB,6GAA6G,CAAC,IAAI,CAChH,CAAC,CACF;QACD,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC;QAC3B,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;QAC1B,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAC/B,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/dist/providers/web/wire/types.d.ts

@@ -0,0 +1,37 @@
+/** Shared search/extract wire types. Product driver IDs stay with registrations. */
+export declare const WEB_SEARCH_CAN = "web-search";
+export declare const WEB_EXTRACT_CAN = "web-extract";
+export declare const KEYLESS_RING: readonly ["exa", "parallel", "firecrawl", "keenable", "tavily"];
+export type KeylessVendor = (typeof KEYLESS_RING)[number];
+export type SearchHit = {
+    readonly title: string;
+    readonly url: string;
+    readonly snippet: string;
+};
+export type SearchOk = {
+    readonly ok: true;
+    readonly hits: readonly SearchHit[];
+    readonly vendor: KeylessVendor | "grok";
+};
+export type SearchErr = {
+    readonly ok: false;
+    readonly error: string;
+    readonly throttled: boolean;
+    readonly retryable?: boolean;
+    readonly vendor: KeylessVendor | "grok" | "keyless";
+};
+export type SearchOutcome = SearchOk | SearchErr;
+export type SearchRequest = {
+    readonly query: string;
+    readonly limit: number;
+    readonly signal: AbortSignal;
+    readonly apiKey?: string;
+    readonly apiUrl?: string;
+    readonly sessionId: string;
+};
+export declare function hitsOf(rows: ReadonlyArray<{
+    title?: unknown;
+    url?: unknown;
+    snippet?: unknown;
+}>, limit: number): SearchHit[];
+//# sourceMappingURL=types.d.ts.map

package/dist/providers/web/wire/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/providers/web/wire/types.ts"],"names":[],"mappings":"AAAA,oFAAoF;AAEpF,eAAO,MAAM,cAAc,eAAe,CAAC;AAC3C,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C,eAAO,MAAM,YAAY,iEAAkE,CAAC;AAC5F,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEjD,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAgB,MAAM,CACpB,IAAI,EAAE,aAAa,CAAC;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,EAC1E,KAAK,EAAE,MAAM,GACZ,SAAS,EAAE,CAab"}

package/dist/providers/web/wire/types.js

@@ -0,0 +1,21 @@
+/** Shared search/extract wire types. Product driver IDs stay with registrations. */
+export const WEB_SEARCH_CAN = "web-search";
+export const WEB_EXTRACT_CAN = "web-extract";
+export const KEYLESS_RING = ["exa", "parallel", "firecrawl", "keenable", "tavily"];
+export function hitsOf(rows, limit) {
+    const out = [];
+    for (const row of rows) {
+        const url = typeof row.url === "string" ? row.url.trim() : "";
+        if (url === "")
+            continue;
+        out.push({
+            title: typeof row.title === "string" ? row.title : "",
+            url,
+            snippet: typeof row.snippet === "string" ? row.snippet : "",
+        });
+        if (out.length >= limit)
+            break;
+    }
+    return out;
+}
+//# sourceMappingURL=types.js.map

package/dist/providers/web/wire/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/providers/web/wire/types.ts"],"names":[],"mappings":"AAAA,oFAAoF;AAEpF,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAC3C,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAE7C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAC;AAkC5F,MAAM,UAAU,MAAM,CACpB,IAA0E,EAC1E,KAAa;IAEb,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACzB,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACrD,GAAG;YACH,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;SAC5D,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,IAAI,KAAK;YAAE,MAAM;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/runtime/bot-mcp.d.ts

@@ -0,0 +1,35 @@
+/**
+ * A bot names an MCP server. The connection's project pin decides the pool:
+ * a global bot sees connections with no project, and a project or session
+ * bot sees connections pinned to the session's project.
+ */
+import { type BotMcpGrant } from "../extensions/schemas/index.js";
+export type McpServerFace = {
+    readonly id: string;
+    readonly name: string;
+    /** Empty when the connection is global. Otherwise the project root path. */
+    readonly project: string;
+    readonly account: string;
+    readonly session: string;
+};
+export declare function bindMcpFaces(catalog: object, faces: ReadonlyMap<string, McpServerFace>): void;
+export declare function clearMcpFaces(catalog: object): void;
+export declare function mcpFaceOf(catalog: object, connectionKey: string): McpServerFace | undefined;
+/** `configuration.project` pins a connection. Without it the connection is global. */
+export declare function mcpServerFace(id: string, spec: {
+    readonly name: string;
+    readonly configuration: unknown;
+}): McpServerFace;
+export declare function mcpJsonOf(grants: readonly BotMcpGrant[]): string;
+export declare function parseBotMcp(text: string): readonly BotMcpGrant[];
+/**
+ * Global bots reach unpinned connections. Every other scope reaches the
+ * connection pinned to `projectPath`. A grant with no tool list is the
+ * whole server; `account` and `session` must match when the grant sets them.
+ */
+export declare function botMcpAllows(bot: {
+    readonly recipeScope: "session" | "project" | "global";
+    readonly mcpJson: string;
+}, face: McpServerFace, tool: string, projectPath: string): boolean;
+export { type BotMcpGrant } from "../extensions/schemas/index.js";
+//# sourceMappingURL=bot-mcp.d.ts.map

package/dist/runtime/bot-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bot-mcp.d.ts","sourceRoot":"","sources":["../../src/runtime/bot-mcp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAE3E,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAIF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,IAAI,CAE7F;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEnD;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAE3F;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAC3B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;CAAE,GAC/D,aAAa,CASf;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAWhE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,WAAW,EAAE,CAWhE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE;IAAE,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACzF,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAST;AAsBD,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/runtime/bot-mcp.js

@@ -0,0 +1,97 @@
+/**
+ * A bot names an MCP server. The connection's project pin decides the pool:
+ * a global bot sees connections with no project, and a project or session
+ * bot sees connections pinned to the session's project.
+ */
+import { botMcpGrantSchema } from "../extensions/schemas/index.js";
+const facesByCatalog = new WeakMap();
+export function bindMcpFaces(catalog, faces) {
+    facesByCatalog.set(catalog, faces);
+}
+export function clearMcpFaces(catalog) {
+    facesByCatalog.delete(catalog);
+}
+export function mcpFaceOf(catalog, connectionKey) {
+    return facesByCatalog.get(catalog)?.get(connectionKey);
+}
+/** `configuration.project` pins a connection. Without it the connection is global. */
+export function mcpServerFace(id, spec) {
+    const bag = record(spec.configuration);
+    return {
+        id,
+        name: spec.name.trim(),
+        project: fieldText(bag, "project"),
+        account: fieldText(bag, "account") || fieldText(bag, "accountId"),
+        session: fieldText(bag, "session") || fieldText(bag, "sessionId"),
+    };
+}
+export function mcpJsonOf(grants) {
+    if (grants.length === 0)
+        return "";
+    return JSON.stringify(grants.map((grant) => {
+        const row = { server: grant.server };
+        if (grant.tools != null)
+            row.tools = [...grant.tools];
+        if (grant.account != null)
+            row.account = grant.account;
+        if (grant.session != null)
+            row.session = grant.session;
+        return row;
+    }));
+}
+export function parseBotMcp(text) {
+    const trimmed = text.trim();
+    if (trimmed === "")
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        return [];
+    }
+    const result = botMcpGrantSchema.array().safeParse(parsed);
+    return result.success ? result.data : [];
+}
+/**
+ * Global bots reach unpinned connections. Every other scope reaches the
+ * connection pinned to `projectPath`. A grant with no tool list is the
+ * whole server; `account` and `session` must match when the grant sets them.
+ */
+export function botMcpAllows(bot, face, tool, projectPath) {
+    const grants = parseBotMcp(bot.mcpJson);
+    if (grants.length === 0)
+        return false;
+    if (bot.recipeScope === "global") {
+        if (face.project !== "")
+            return false;
+    }
+    else if (face.project === "" || face.project !== projectPath) {
+        return false;
+    }
+    return grants.some((grant) => grantMatches(grant, face, tool));
+}
+function grantMatches(grant, face, tool) {
+    if (grant.server !== face.name && grant.server !== face.id)
+        return false;
+    if (grant.account !== undefined && grant.account !== face.account)
+        return false;
+    if (grant.session !== undefined && grant.session !== face.session)
+        return false;
+    if (grant.tools !== undefined && !grant.tools.includes(tool))
+        return false;
+    return true;
+}
+function record(value) {
+    if (value == null || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const out = {};
+    for (const [key, entry] of Object.entries(value))
+        out[key] = entry;
+    return out;
+}
+function fieldText(bag, key) {
+    const value = bag?.[key];
+    return typeof value === "string" ? value.trim() : "";
+}
+//# sourceMappingURL=bot-mcp.js.map

package/dist/runtime/bot-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bot-mcp.js","sourceRoot":"","sources":["../../src/runtime/bot-mcp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,iBAAiB,EAAoB,MAAM,sBAAsB,CAAC;AAW3E,MAAM,cAAc,GAAG,IAAI,OAAO,EAA8C,CAAC;AAEjF,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,KAAyC;IACrF,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,aAAqB;IAC9D,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;AACzD,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAC3B,EAAU,EACV,IAAgE;IAEhE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACvC,OAAO;QACL,EAAE;QACF,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QACtB,OAAO,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC;QAClC,OAAO,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;QACjE,OAAO,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAA8B;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,IAAI,CAAC,SAAS,CACnB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACnB,MAAM,GAAG,GAA4B,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI;YAAE,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI;YAAE,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACvD,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI;YAAE,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACvD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAyF,EACzF,IAAmB,EACnB,IAAY,EACZ,WAAmB;IAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,GAAG,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;SAAM,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,YAAY,CAAC,KAAkB,EAAE,IAAmB,EAAE,IAAY;IACzE,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAmC,EAAE,GAAW;IACjE,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC"}

package/dist/runtime/compose.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Production runtime assembly. Catalog, registered drivers, MCP projection,
+ * and session replica intern bind here. Observers start on activate.
+ * Callers supply the completion roster. MCP catalog projection is the one concrete provider this package imports.
+ */
+import type { SessionRoot } from "@inhuman.tools/harness-model";
+import type { ConnectionSpec, DriverSpec } from "@inhuman.tools/plexus-expectations";
+import type { ConnectionSecretsView, DriverConnectionClass, PEWDriver } from "@inhuman.tools/plexus-expectations/driver";
+import { type AdoptCallback, type CredentialsStore, type DriverAdoptArgs, type DriverInventory, type DriverRegistry, type InternKernel, type ResolveOptions, type ResolvePurpose } from "../connections/index.js";
+import type { DocumentCheckpoint, DocumentKey, FlushResult } from "../protocol/document/index.js";
+import { type KernelToolCatalog } from "../tool-catalog/index.js";
+import type { CreateResult, DocumentRef, OpenResult } from "../yjs/index.js";
+import type { EligibilitySnapshot } from "./types.js";
+type KernelTables = {
+    readonly connections: Record<string, ConnectionSpec | undefined>;
+    readonly drivers: Record<string, DriverSpec | undefined>;
+};
+/**
+ * Smallest document face ProductionRuntime stores. DocumentService and
+ * RemoteDocumentAdapter both satisfy it; this package is not an image writer.
+ */
+export interface RuntimeDocuments {
+    readonly serverEpoch: number;
+    getLoaded(key: DocumentKey): DocumentRef | undefined;
+    loaded(): readonly DocumentRef[];
+    checkpoint(key: DocumentKey): DocumentCheckpoint | undefined;
+    openExisting(key: DocumentKey): Promise<OpenResult>;
+    create(key: DocumentKey, initial?: Uint8Array): Promise<CreateResult>;
+    flush(key: DocumentKey, checkpoint: DocumentCheckpoint, options?: {
+        readonly runtimeGeneration?: number;
+        readonly connectionEpoch?: number;
+    }): Promise<FlushResult>;
+    release(key: DocumentKey): void | Promise<void>;
+}
+type RuntimeOpts = {
+    readonly registry: DriverRegistry;
+    readonly catalog?: KernelToolCatalog;
+    readonly moduleRoot?: string;
+    readonly documents?: RuntimeDocuments;
+};
+export declare class ProductionRuntime<T extends {
+    readonly root: SessionRoot;
+} = {
+    readonly root: SessionRoot;
+}> implements Disposable {
+    #private;
+    readonly catalog: KernelToolCatalog;
+    readonly registry: DriverRegistry;
+    readonly documents: RuntimeDocuments | undefined;
+    constructor(opts: RuntimeOpts);
+    get activated(): boolean;
+    /** Stamp registered drivers onto the kernel table. No observers. */
+    bind(tables: KernelTables, opts?: {
+        readonly moduleRoot?: string;
+    }): void;
+    /**
+     * Start catalog projection. Honor, intern, and child processes stay with
+     * the caller; this only attaches the connection-tool host.
+     */
+    activate(): void;
+    intern(sessionId: string, replica: T): T;
+    replica(sessionId: string): T | undefined;
+    get acquired(): ReadonlySet<string>;
+    replicaEntries(): IterableIterator<[string, T]>;
+    replicaValues(): IterableIterator<T>;
+    eligibilitySnapshot(facts: {
+        readonly occupied: ReadonlySet<string>;
+        readonly reserved: ReadonlySet<string>;
+        readonly resident?: ReadonlySet<string>;
+        readonly conversations?: ReadonlySet<string>;
+    }): EligibilitySnapshot;
+    adopt(driverName: string, inventory: DriverInventory, args: DriverAdoptArgs, callback: AdoptCallback, options?: ResolveOptions): Promise<import("../connections/index.js").DriverAdoptBags>;
+    /**
+     * Registered in-process class wins by name. Unregistered importPath uses
+     * the injected loader.
+     */
+    loadDriver(driver: {
+        readonly name: string;
+        readonly importPath: string;
+    }, purpose?: ResolvePurpose): DriverConnectionClass | Promise<DriverConnectionClass>;
+    /**
+     * Resolve the class before PEW intern so a descriptor miss does not leave
+     * a rejected lease. Same name-wins door as {@link loadDriver}.
+     */
+    internDiscovery(kernel: InternKernel, owner: object, connectionId: string, options: {
+        readonly secrets: CredentialsStore | ConnectionSecretsView;
+        readonly awareness?: PEWDriver["awareness"];
+    }): Promise<PEWDriver>;
+    [Symbol.dispose](): void;
+}
+export {};
+//# sourceMappingURL=compose.d.ts.map

package/dist/runtime/compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/runtime/compose.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AACrF,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EACrB,SAAS,EACV,MAAM,2CAA2C,CAAC;AAInD,OAAO,EAML,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAqC,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAKnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,KAAK,YAAY,GAAG;IAClB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,CAAC,CAAC;IACjE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC,CAAC;CAC1D,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,CAAC;IACrD,MAAM,IAAI,SAAS,WAAW,EAAE,CAAC;IACjC,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG,kBAAkB,GAAG,SAAS,CAAC;IAC7D,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACtE,KAAK,CACH,GAAG,EAAE,WAAW,EAChB,UAAU,EAAE,kBAAkB,EAC9B,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;KACnC,GACA,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,KAAK,WAAW,GAAG;IACjB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;CACvC,CAAC;AAgBF,qBAAa,iBAAiB,CAC5B,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CACzE,YAAW,UAAU;;IACrB,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;gBAOrC,IAAI,EAAE,WAAW;IAO7B,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,oEAAoE;IACpE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAMzE;;;OAGG;IACH,QAAQ,IAAI,IAAI;IAUhB,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC;IAKxC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS;IAIzC,IAAI,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAC,CAElC;IAED,cAAc,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAI/C,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAC;IAIpC,mBAAmB,CAAC,KAAK,EAAE;QACzB,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;KAC9C,GAAG,mBAAmB;IA8BvB,KAAK,CACH,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE,cAAmB;IAK9B;;;OAGG;IACH,UAAU,CACR,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAC9D,OAAO,GAAE,cAA4B,GACpC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAMzD;;;OAGG;IACG,eAAe,CACnB,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;QACP,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,qBAAqB,CAAC;QAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;KAC7C,GACA,OAAO,CAAC,SAAS,CAAC;IAiBrB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI;CAMzB"}

package/dist/runtime/compose.js

@@ -0,0 +1,143 @@
+import { acquireConnection } from "@inhuman.tools/plexus-expectations/executor";
+import { action } from "mobx";
+import { adoptRegisteredDriver, applyRegistryToDrivers, externalLoaderFor, loadDriverModule, secretsView, } from "../connections/index.js";
+import { KernelToolCatalog as CatalogTable } from "../tool-catalog/index.js";
+import { McpConnectionToolCatalogHost } from "./connection-tools.js";
+import { isConversationSession } from "./eligibility.js";
+import { collectDelegatedGrants } from "./grants.js";
+function secretsOf(secrets, connectionId) {
+    if (typeof secrets.read === "function") {
+        return secretsView(secrets, connectionId);
+    }
+    return secrets;
+}
+function bindAwareness(instance, awareness) {
+    if (awareness === undefined)
+        return;
+    action(() => {
+        instance.awareness = awareness;
+    })();
+}
+export class ProductionRuntime {
+    catalog;
+    registry;
+    documents;
+    #replicas = new Map();
+    #moduleRoot;
+    #tables = null;
+    #connectionHost = null;
+    #activated = false;
+    constructor(opts) {
+        this.registry = opts.registry;
+        this.catalog = opts.catalog ?? new CatalogTable();
+        this.#moduleRoot = opts.moduleRoot;
+        this.documents = opts.documents;
+    }
+    get activated() {
+        return this.#activated;
+    }
+    /** Stamp registered drivers onto the kernel table. No observers. */
+    bind(tables, opts) {
+        if (opts?.moduleRoot != null)
+            this.#moduleRoot = opts.moduleRoot;
+        applyRegistryToDrivers(this.registry, tables.drivers);
+        this.#tables = tables;
+    }
+    /**
+     * Start catalog projection. Honor, intern, and child processes stay with
+     * the caller; this only attaches the connection-tool host.
+     */
+    activate() {
+        if (this.#activated)
+            return;
+        const tables = this.#tables;
+        if (tables == null) {
+            throw new Error("runtime: bind kernel tables before activate");
+        }
+        this.#activated = true;
+        this.#connectionHost = new McpConnectionToolCatalogHost(this.catalog, tables.connections);
+    }
+    intern(sessionId, replica) {
+        this.#replicas.set(sessionId, replica);
+        return replica;
+    }
+    replica(sessionId) {
+        return this.#replicas.get(sessionId);
+    }
+    get acquired() {
+        return new Set(this.#replicas.keys());
+    }
+    replicaEntries() {
+        return this.#replicas.entries();
+    }
+    replicaValues() {
+        return this.#replicas.values();
+    }
+    eligibilitySnapshot(facts) {
+        const acquired = this.acquired;
+        const resident = new Set(facts.resident);
+        const conversations = new Set(facts.conversations);
+        if (facts.resident == null || facts.conversations == null) {
+            for (const [id, replica] of this.#replicas) {
+                if (facts.resident == null && replica.root.agent.spec.resident) {
+                    resident.add(id);
+                }
+                if (facts.conversations == null && isConversationSession(replica.root)) {
+                    conversations.add(id);
+                }
+            }
+        }
+        return {
+            acquired,
+            occupied: facts.occupied,
+            resident,
+            reserved: facts.reserved,
+            conversations,
+            grants: collectDelegatedGrants(this, acquired),
+        };
+    }
+    #resolveOptions(extra = {}) {
+        const loadExternal = extra.loadExternal ?? (this.#moduleRoot == null ? undefined : externalLoaderFor(this.#moduleRoot));
+        return loadExternal == null ? extra : { ...extra, loadExternal };
+    }
+    adopt(driverName, inventory, args, callback, options = {}) {
+        return adoptRegisteredDriver(this.registry, driverName, inventory, args, callback, this.#resolveOptions(options));
+    }
+    /**
+     * Registered in-process class wins by name. Unregistered importPath uses
+     * the injected loader.
+     */
+    loadDriver(driver, purpose = "execution") {
+        const registered = this.registry.get(driver.name);
+        if (registered !== undefined)
+            return registered.connection;
+        return loadDriverModule(this.registry, driver, this.#resolveOptions({ purpose }));
+    }
+    /**
+     * Resolve the class before PEW intern so a descriptor miss does not leave
+     * a rejected lease. Same name-wins door as {@link loadDriver}.
+     */
+    async internDiscovery(kernel, owner, connectionId, options) {
+        const spec = kernel.connections[connectionId];
+        if (spec === undefined) {
+            throw new Error(`connections: unknown connection ${connectionId}`);
+        }
+        const connectionClass = await this.loadDriver(spec.driver, "discovery");
+        const secrets = secretsOf(options.secrets, connectionId);
+        const instance = await acquireConnection(kernel, owner, connectionId, async () => {
+            const minted = new connectionClass(connectionId, spec.configuration, secrets);
+            bindAwareness(minted, options.awareness);
+            return minted;
+        });
+        bindAwareness(instance, options.awareness);
+        await instance.ensureBootstrapStarted();
+        return instance;
+    }
+    [Symbol.dispose]() {
+        this.#connectionHost?.[Symbol.dispose]();
+        this.#connectionHost = null;
+        this.#activated = false;
+        this.#replicas.clear();
+    }
+}
+//# sourceMappingURL=compose.js.map

package/dist/runtime/compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../src/runtime/compose.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAE9B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GASZ,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,iBAAiB,IAAI,YAAY,EAA0B,MAAM,gBAAgB,CAAC;AAG3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAqCrD,SAAS,SAAS,CAAC,OAAiD,EAAE,YAAoB;IACxF,IAAI,OAAQ,OAA4B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7D,OAAO,WAAW,CAAC,OAA2B,EAAE,YAAY,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,OAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CAAC,QAAmB,EAAE,SAAiC;IAC3E,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO;IACpC,MAAM,CAAC,GAAG,EAAE;QACV,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;IACjC,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,MAAM,OAAO,iBAAiB;IAGnB,OAAO,CAAoB;IAC3B,QAAQ,CAAiB;IACzB,SAAS,CAA+B;IACxC,SAAS,GAAG,IAAI,GAAG,EAAa,CAAC;IAC1C,WAAW,CAAqB;IAChC,OAAO,GAAwB,IAAI,CAAC;IACpC,eAAe,GAAwC,IAAI,CAAC;IAC5D,UAAU,GAAG,KAAK,CAAC;IAEnB,YAAY,IAAiB;QAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,YAAY,EAAE,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,oEAAoE;IACpE,IAAI,CAAC,MAAoB,EAAE,IAAuC;QAChE,IAAI,IAAI,EAAE,UAAU,IAAI,IAAI;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC;QACjE,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,eAAe,GAAG,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,CAAC,SAAiB,EAAE,OAAU;QAClC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IAClC,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAED,mBAAmB,CAAC,KAKnB;QACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,KAAK,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;YAC1D,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC3C,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC/D,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACnB,CAAC;gBACD,IAAI,KAAK,CAAC,aAAa,IAAI,IAAI,IAAI,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO;YACL,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa;YACb,MAAM,EAAE,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,QAAwB,EAAE;QACxC,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACrG,OAAO,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC;IACnE,CAAC;IAED,KAAK,CACH,UAAkB,EAClB,SAA0B,EAC1B,IAAqB,EACrB,QAAuB,EACvB,UAA0B,EAAE;QAE5B,OAAO,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IACpH,CAAC;IAED;;;OAGG;IACH,UAAU,CACR,MAA8D,EAC9D,UAA0B,WAAW;QAErC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC,UAAU,CAAC;QAC3D,OAAO,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACpF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CACnB,MAAoB,EACpB,KAAa,EACb,YAAoB,EACpB,OAGC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,YAAY,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,IAAI,EAAE;YAC/E,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAC9E,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACzC,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,QAAQ,CAAC,sBAAsB,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,CAAC,MAAM,CAAC,OAAO,CAAC;QACd,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;CACF"}

package/dist/runtime/connection-tools.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Expand connection-sourced tools into the one catalog table.
+ * Wire modelName (mcp__{slug}__…) is projection for tools[] only — route by
+ * connectionKey (+ serverToolName), never by re-parsing the wire name.
+ *
+ * Membership is yaml MCP ConnectionSpecs. Tools ride `spec.live.tools`
+ * (PEW mirrors instance state extras onto live at ensure). Catalog is
+ * projection, not an execute door.
+ */
+import type { ConnectionSpec } from "@inhuman.tools/plexus-expectations";
+import type { CatalogEntry, KernelToolCatalog } from "../tool-catalog/index.js";
+import { type McpServerFace } from "./bot-mcp.js";
+/**
+ * Kernel-lifetime owner of MCP catalog slices. A session must never own these:
+ * many sessions share one kernel catalog. Tools appear when PEW ensure mirrors
+ * connection `state.tools` onto ConnectionSpec.live.
+ */
+export declare class McpConnectionToolCatalogHost implements Disposable {
+    #private;
+    readonly catalog: KernelToolCatalog;
+    readonly connections: {
+        readonly [connectionKey: string]: ConnectionSpec | undefined;
+    };
+    constructor(catalog: KernelToolCatalog, connections: {
+        readonly [connectionKey: string]: ConnectionSpec | undefined;
+    });
+    get connectionFaces(): ReadonlyMap<string, McpServerFace>;
+    get connectionEntries(): readonly CatalogEntry[];
+    [Symbol.dispose](): void;
+}
+//# sourceMappingURL=connection-tools.d.ts.map

package/dist/runtime/connection-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-tools.d.ts","sourceRoot":"","sources":["../../src/runtime/connection-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAUzE,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEtE,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AA6B9F;;;;GAIG;AACH,qBAAa,4BAA6B,YAAW,UAAU;;IAI3D,QAAQ,CAAC,OAAO,EAAE,iBAAiB;IACnC,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;KAC9D;gBAHQ,OAAO,EAAE,iBAAiB,EAC1B,WAAW,EAAE;QACpB,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;KAC9D;IASH,IACI,eAAe,IAAI,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAQxD;IAED,IACI,iBAAiB,IAAI,SAAS,YAAY,EAAE,CAS/C;IAED,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI;CAOzB"}