@interlok/cli 0.0.0-stage → 1.3.0

package/dist/proof-verify.js

@@ -0,0 +1,513 @@
+/**
+ * Interlok proof bundle verifier (.ilproof, format "interlok.proof/1").
+ *
+ * Runs unchanged in a browser (interlok.io/verify) and in Node (`interlok verify`): WebCrypto for
+ * ECDSA P-256 and SHA-256, fflate for the zip. Imports nothing else, so the CLI vendors this file
+ * byte-for-byte and a test fails the build if the two copies drift. Nothing is uploaded anywhere.
+ *
+ * Seven checks, each pass / fail / skipped with record-level detail:
+ *   1 manifest   DSSE signature over manifest.json by an org key valid at generated_at
+ *   2 files      every file's SHA-256 matches the manifest
+ *   3 records    every record's payload hash, entry hash and signature; statements match records
+ *   4 continuity seq is contiguous and prev_hash links are unbroken from chain_start_prev to chain_head
+ *   5 anchors    every record has a Merkle inclusion proof to a signed anchor
+ *   6 public     the bundle's anchor roots match the publicly published anchors (online, optional)
+ *   7 keys       the org keys used are listed in the customer's own published key file (optional)
+ */
+import { unzipSync, strFromU8 } from "fflate";
+export const PROOF_FORMAT = "interlok.proof/1";
+export const DSSE_PAYLOAD_TYPE = "application/vnd.interlok.proof-manifest+json";
+export const STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
+export const PREDICATE_TYPE = "https://interlok.io/attestation/determination/v1";
+/* ---------------- primitives (identical semantics to src/lib/ledger) ---------------- */
+const enc = new TextEncoder();
+const subtle = () => globalThis.crypto.subtle;
+const buf = (u) => u.buffer.slice(u.byteOffset, u.byteOffset + u.byteLength);
+/** Canonical JSON: sorted keys, no whitespace, undefined dropped. Same as the ledger's. */
+export function canonicalize(value) {
+    if (value === null || typeof value === "boolean")
+        return JSON.stringify(value);
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new Error("non-finite number");
+        return JSON.stringify(value);
+    }
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "undefined")
+        throw new Error("undefined not allowed in canonical JSON");
+    if (Array.isArray(value))
+        return "[" + value.map(canonicalize).join(",") + "]";
+    if (typeof value === "object") {
+        const obj = value;
+        const keys = Object.keys(obj)
+            .filter((k) => obj[k] !== undefined)
+            .sort();
+        return "{" + keys.map((k) => JSON.stringify(k) + ":" + canonicalize(obj[k])).join(",") + "}";
+    }
+    throw new Error(`unsupported type ${typeof value}`);
+}
+export async function sha256Hex(data) {
+    const bytes = typeof data === "string" ? enc.encode(data) : data;
+    const d = new Uint8Array(await subtle().digest("SHA-256", buf(bytes)));
+    return Array.from(d, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+export function fromB64url(s) {
+    const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - (s.length % 4));
+    const bin = atob(s.replace(/-/g, "+").replace(/_/g, "/") + pad);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+export function toB64(u) {
+    let bin = "";
+    for (const x of u)
+        bin += String.fromCharCode(x);
+    return btoa(bin);
+}
+export function fromB64(s) {
+    const bin = atob(s);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+const keyCache = new Map();
+function importPub(jwk) {
+    const k = `${jwk.x}.${jwk.y}`;
+    let p = keyCache.get(k);
+    if (!p) {
+        p = subtle().importKey("jwk", { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y, ext: true }, { name: "ECDSA", namedCurve: "P-256" }, true, ["verify"]);
+        keyCache.set(k, p);
+    }
+    return p;
+}
+export async function verifySig(jwk, sigB64url, data) {
+    try {
+        const bytes = typeof data === "string" ? enc.encode(data) : data;
+        return await subtle().verify({ name: "ECDSA", hash: "SHA-256" }, await importPub(jwk), buf(fromB64url(sigB64url)), buf(bytes));
+    }
+    catch {
+        return false;
+    }
+}
+/** DSSE pre-authentication encoding: "DSSEv1 <len(type)> <type> <len(body)> <body>". */
+export function pae(payloadType, body) {
+    const head = enc.encode(`DSSEv1 ${enc.encode(payloadType).length} ${payloadType} ${body.length} `);
+    const out = new Uint8Array(head.length + body.length);
+    out.set(head, 0);
+    out.set(body, head.length);
+    return out;
+}
+export async function verifyMerkle(leaf, proof, root) {
+    let h = leaf;
+    for (const s of proof)
+        h = await sha256Hex(s.position === "right" ? h + s.hash : s.hash + h);
+    return h === root;
+}
+/* ---------------- ledger record v2: salted field commitments ---------------- */
+/**
+ * A v2 record's payload_hash is a Merkle root over one commitment per leaf field,
+ * sha256(salt | path | JCS(value)), with paths as RFC 6901 JSON pointers sorted by code point.
+ * Revealing a field means giving its value and salt; hiding it means giving only its commitment.
+ * Every signature still verifies either way. Arrays and empty objects are leaves.
+ */
+const esc6901 = (k) => k.replace(/~/g, "~0").replace(/\//g, "~1");
+const unesc6901 = (k) => k.replace(/~1/g, "/").replace(/~0/g, "~");
+export function flattenPayload(value, path = "") {
+    if (value !== null &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        Object.keys(value).length) {
+        const out = [];
+        for (const k of Object.keys(value).sort()) {
+            const v = value[k];
+            if (v === undefined)
+                continue;
+            out.push(...flattenPayload(v, `${path}/${esc6901(k)}`));
+        }
+        return out;
+    }
+    return [{ path: path || "/", value }];
+}
+export const leafHash = (salt, path, value) => sha256Hex(`${salt}|${path}|${canonicalize(value)}`);
+export async function merkleRootHex(leaves) {
+    if (!leaves.length)
+        return sha256Hex("");
+    let level = leaves.slice();
+    while (level.length > 1) {
+        if (level.length % 2)
+            level.push(level[level.length - 1]);
+        const next = [];
+        for (let i = 0; i < level.length; i += 2)
+            next.push(await sha256Hex(level[i] + level[i + 1]));
+        level = next;
+    }
+    return level[0];
+}
+/** The root over a record's fields, revealed or committed. */
+export async function rootFromFields(fields) {
+    const paths = Object.keys(fields).sort();
+    const leaves = [];
+    for (const p of paths) {
+        const f = fields[p];
+        leaves.push("c" in f ? f.c : await leafHash(f.s, p, f.v));
+    }
+    return merkleRootHex(leaves);
+}
+/** The root for a full payload and its salts (one salt per leaf path). */
+export async function payloadRootV2(payload, salts) {
+    const fields = {};
+    for (const { path, value } of flattenPayload(payload)) {
+        const s = salts[path];
+        if (typeof s !== "string")
+            throw new Error(`missing salt for ${path}`);
+        fields[path] = { v: value, s };
+    }
+    return rootFromFields(fields);
+}
+/** What an auditor sees: revealed values in place, hidden ones as "[redacted]". */
+export function viewFromFields(fields) {
+    const root = {};
+    for (const p of Object.keys(fields).sort()) {
+        const f = fields[p];
+        const segs = p.split("/").slice(1).map(unesc6901);
+        let cur = root;
+        for (let i = 0; i < segs.length - 1; i++)
+            cur = (cur[segs[i]] ??= {});
+        cur[segs[segs.length - 1]] = "c" in f ? "[redacted]" : f.v;
+    }
+    return root;
+}
+/** In-scope record → in-toto Statement v1. Used by the builder and re-derived by the verifier. */
+export function statementFor(org, r) {
+    const p = (r.payload ?? {});
+    return {
+        _type: STATEMENT_TYPE,
+        subject: [{ name: `interlok:ledger:${org}:${r.seq}`, digest: { sha256: r.entry_hash } }],
+        predicateType: PREDICATE_TYPE,
+        predicate: {
+            kind: p.kind ?? null,
+            ts: p.ts ?? null,
+            actor: p.actor ?? null,
+            subject: p.subject ?? null,
+            data: p.data ?? null,
+            ledger: { seq: r.seq, entry_hash: r.entry_hash, signer_kid: r.signer_kid },
+        },
+    };
+}
+/* ---------------- the verifier ---------------- */
+const CHECK_NAMES = [
+    "",
+    "Manifest signature",
+    "File digests",
+    "Record signatures",
+    "Chain continuity",
+    "Anchor inclusion",
+    "Public anchors",
+    "Customer key file",
+];
+const MAX_LISTED = 50;
+const MAX_BUNDLE_BYTES = 256 * 1024 * 1024;
+const MAX_UNPACKED_BYTES = 1024 * 1024 * 1024;
+function check(id) {
+    return { id, name: CHECK_NAMES[id], status: "pass", detail: "", records: [] };
+}
+function fail(c, seq, problem) {
+    c.status = "fail";
+    if (c.records.length < MAX_LISTED)
+        c.records.push({ seq, problem });
+}
+function keyValidAt(k, iso, graceMs) {
+    if (!iso)
+        return true;
+    const t = Date.parse(iso);
+    if (Number.isNaN(t))
+        return true;
+    if (k.valid_from && t < Date.parse(k.valid_from) - graceMs)
+        return false;
+    if (k.valid_to && t > Date.parse(k.valid_to) + graceMs)
+        return false;
+    return true;
+}
+const parseJsonl = (s) => s
+    .split("\n")
+    .filter((l) => l.trim())
+    .map((l) => JSON.parse(l));
+export async function verifyProofBundle(zip, opts = {}) {
+    const grace = opts.keyGraceMs ?? 5 * 60_000;
+    const checks = [1, 2, 3, 4, 5, 6, 7].map(check);
+    const [c1, c2, c3, c4, c5, c6, c7] = checks;
+    const result = {
+        ok: false,
+        format: null,
+        bundle_id: null,
+        org: null,
+        record_count: 0,
+        checks,
+    };
+    const abort = (msg) => {
+        for (const c of checks) {
+            c.status = c.id <= 5 ? "fail" : "skipped";
+            c.detail = c.id <= 5 ? msg : "not checked";
+        }
+        return result;
+    };
+    let files;
+    if (zip.length > MAX_BUNDLE_BYTES)
+        return abort("bundle is larger than the 256 MB this verifier accepts");
+    try {
+        // A zip bomb would expand to gigabytes in memory: cap what we are willing to unpack.
+        let total = 0;
+        files = unzipSync(zip, {
+            filter: (f) => {
+                total += f.originalSize;
+                if (total > MAX_UNPACKED_BYTES)
+                    throw new Error("too large");
+                return true;
+            },
+        });
+    }
+    catch {
+        return abort("not a readable .ilproof (zip) file, or it unpacks to more than 1 GB");
+    }
+    const text = (n) => (files[n] ? strFromU8(files[n]) : null);
+    let manifest;
+    let envelope;
+    let keys;
+    let chain;
+    let statements;
+    let proofs;
+    let anchors;
+    try {
+        manifest = JSON.parse(text("manifest.json") ?? "null");
+        envelope = JSON.parse(text("manifest.dsse.json") ?? "null");
+        keys = JSON.parse(text("keys.json") ?? "null");
+        chain = parseJsonl(text("chain.jsonl") ?? "");
+        statements = parseJsonl(text("statements.jsonl") ?? "");
+        proofs = JSON.parse(text("proofs/merkle.json") ?? "{}");
+        anchors = JSON.parse(text("anchors.json") ?? "[]");
+    }
+    catch {
+        return abort("a bundle file is not valid JSON");
+    }
+    if (!manifest || !envelope || !keys)
+        return abort("manifest, signature or key file is missing");
+    result.format = manifest.format ?? null;
+    result.bundle_id = manifest.bundle_id ?? null;
+    result.org = manifest.org ?? null;
+    result.record_count = chain.length;
+    if (manifest.format !== PROOF_FORMAT)
+        return abort(`unsupported format ${manifest.format}`);
+    const orgKeys = keys.org ?? {};
+    const orgId = manifest.org?.id ?? "";
+    // 1 · manifest signature: the DSSE payload must BE manifest.json, and an org key valid at
+    //     generated_at must have signed it.
+    {
+        const body = files["manifest.json"];
+        let payloadOk = false;
+        try {
+            payloadOk = envelope.payloadType === DSSE_PAYLOAD_TYPE && toB64(body) === envelope.payload;
+        }
+        catch {
+            payloadOk = false;
+        }
+        if (!payloadOk)
+            fail(c1, null, "the signed payload is not this manifest.json");
+        const signed = [];
+        for (const s of envelope.signatures ?? []) {
+            const k = orgKeys[s.keyid];
+            if (!k)
+                continue;
+            if (!keyValidAt(k, manifest.generated_at, grace)) {
+                fail(c1, null, `key ${s.keyid} was not valid at ${manifest.generated_at}`);
+                continue;
+            }
+            if (await verifySig(k.jwk, s.sig, pae(DSSE_PAYLOAD_TYPE, body)))
+                signed.push(s.keyid);
+        }
+        if (!signed.length)
+            fail(c1, null, "no valid signature by an org key");
+        c1.detail =
+            c1.status === "pass"
+                ? `signed by ${signed.join(", ")}; generated ${manifest.generated_at} by ${manifest.generated_by?.display ?? manifest.generated_by?.id ?? "unknown"}`
+                : "the manifest cannot be trusted";
+    }
+    // 2 · file digests: every listed file matches, and nothing unlisted hides in the zip.
+    {
+        const listed = manifest.files ?? {};
+        for (const [name, meta] of Object.entries(listed)) {
+            if (!files[name])
+                fail(c2, null, `${name} is listed but missing`);
+            else if ((await sha256Hex(files[name])) !== meta.sha256)
+                fail(c2, null, `${name} was modified`);
+        }
+        for (const name of Object.keys(files)) {
+            if (name.endsWith("/"))
+                continue;
+            if (name === "manifest.json" || name === "manifest.dsse.json")
+                continue;
+            if (!listed[name])
+                fail(c2, null, `${name} is not in the manifest`);
+        }
+        c2.detail =
+            c2.status === "pass"
+                ? `${Object.keys(listed).length} files match`
+                : "files differ from what was signed";
+    }
+    // 3 · records: payload hash (when revealed), entry hash, signature by a key valid at the time.
+    const bySeq = new Map();
+    {
+        let revealed = 0;
+        for (const r of chain) {
+            if (r.fields) {
+                // v2: the field reveals and commitments must hash to the signed payload_hash.
+                revealed++;
+                let root = "";
+                try {
+                    root = await rootFromFields(r.fields);
+                }
+                catch {
+                    root = "";
+                }
+                if (root !== r.payload_hash) {
+                    fail(c3, r.seq, "fields do not match the signed commitment");
+                    continue;
+                }
+                r.payload = viewFromFields(r.fields);
+            }
+            bySeq.set(r.seq, r);
+            if (r.payload !== undefined && !r.fields) {
+                revealed++;
+                if ((await sha256Hex(canonicalize(r.payload))) !== r.payload_hash) {
+                    fail(c3, r.seq, "content does not match its signed hash");
+                    continue;
+                }
+            }
+            if ((await sha256Hex(`${r.seq}|${r.prev_hash}|${r.payload_hash}`)) !== r.entry_hash) {
+                fail(c3, r.seq, "entry hash mismatch");
+                continue;
+            }
+            const k = orgKeys[r.signer_kid];
+            if (!k) {
+                fail(c3, r.seq, `unknown signing key ${r.signer_kid}`);
+                continue;
+            }
+            if (!keyValidAt(k, r.payload?.ts, grace))
+                fail(c3, r.seq, "key was not valid at the record's time");
+            else if (!(await verifySig(k.jwk, r.signature, r.entry_hash)))
+                fail(c3, r.seq, "bad signature");
+        }
+        // Statements must be exactly the in-toto form of the revealed in-scope records.
+        for (const s of statements) {
+            const seq = Number(String(s?.subject?.[0]?.name ?? "")
+                .split(":")
+                .pop());
+            const r = bySeq.get(seq);
+            if (!r || r.payload === undefined) {
+                fail(c3, Number.isFinite(seq) ? seq : null, "statement has no revealed record");
+                continue;
+            }
+            if (canonicalize(statementFor(orgId, r)) !== canonicalize(s))
+                fail(c3, seq, "statement does not match its record");
+        }
+        c3.detail =
+            c3.status === "pass"
+                ? `${chain.length} records verified (${revealed} revealed, ${chain.length - revealed} hash-only); ${statements.length} statements`
+                : "one or more records fail";
+    }
+    // 4 · continuity: contiguous seq, unbroken prev_hash links, the head the manifest names.
+    {
+        const sorted = [...chain].sort((a, b) => a.seq - b.seq);
+        if (sorted.length !== chain.length || chain.some((r, i) => r.seq !== sorted[i].seq))
+            fail(c4, null, "records are out of order");
+        if (chain.length !== manifest.record_count)
+            fail(c4, null, `manifest says ${manifest.record_count} records, bundle has ${chain.length}`);
+        let prev = manifest.chain_start_prev;
+        let expect = manifest.first_seq;
+        for (const r of sorted) {
+            if (r.seq !== expect)
+                fail(c4, r.seq, `expected #${expect}: a record is missing`);
+            if (r.prev_hash !== prev)
+                fail(c4, r.seq, "link to the previous record is broken");
+            prev = r.entry_hash;
+            expect = r.seq + 1;
+        }
+        if (sorted.length && sorted[sorted.length - 1].seq !== manifest.last_seq)
+            fail(c4, null, "the last record is not the one the manifest names");
+        if (prev !== manifest.chain_head)
+            fail(c4, null, "chain head does not match the manifest");
+        c4.detail =
+            c4.status === "pass"
+                ? `#${manifest.first_seq}–#${manifest.last_seq}, no gaps, head ${String(manifest.chain_head).slice(0, 12)}`
+                : "the chain is incomplete or altered";
+    }
+    // 5 · anchors: each anchor is signed by the anchor key; each record proves into one.
+    {
+        const byId = new Map(anchors.map((a) => [a.id, a]));
+        for (const a of anchors) {
+            const { anchor_hash, signature, signer_kid, ...body } = a.anchor;
+            const pub = keys.anchor?.[signer_kid];
+            if (!pub)
+                fail(c5, null, `anchor ${a.id}: unknown anchor key`);
+            else if ((await sha256Hex(canonicalize(body))) !== anchor_hash)
+                fail(c5, null, `anchor ${a.id}: altered`);
+            else if (!(await verifySig(pub, signature, anchor_hash)))
+                fail(c5, null, `anchor ${a.id}: bad signature`);
+            else if (a.anchor.merkle_root !== a.merkle_root)
+                fail(c5, null, `anchor ${a.id}: root mismatch`);
+        }
+        for (const r of chain) {
+            const p = proofs[String(r.seq)];
+            const a = p ? byId.get(p.anchor_id) : undefined;
+            if (!p || !a) {
+                fail(c5, r.seq, "not covered by an anchor");
+                continue;
+            }
+            if (r.seq < a.from_seq || r.seq > a.to_seq)
+                fail(c5, r.seq, "proof names the wrong anchor");
+            else if (!(await verifyMerkle(r.entry_hash, p.proof, a.merkle_root)))
+                fail(c5, r.seq, "inclusion proof does not reach the anchor root");
+        }
+        c5.detail =
+            c5.status === "pass"
+                ? `${chain.length} records proven into ${anchors.length} signed anchors`
+                : "anchoring fails";
+    }
+    // 6 · public anchors (online)
+    if (!opts.publicAnchors) {
+        c6.status = "skipped";
+        c6.detail = "not checked (offline)";
+    }
+    else {
+        const pub = new Set(opts.publicAnchors.map((a) => a.merkle_root));
+        for (const a of anchors)
+            if (!pub.has(a.merkle_root))
+                fail(c6, null, `anchor ${a.id} is not in the public feed`);
+        c6.detail =
+            c6.status === "pass"
+                ? `${anchors.length} anchors match the public feed`
+                : "an anchor was not published";
+    }
+    // 7 · customer key file (optional)
+    if (!opts.publishedKids) {
+        c7.status = "skipped";
+        c7.detail = "no customer key file supplied";
+    }
+    else {
+        const listed = new Set(opts.publishedKids);
+        const used = new Set(chain.map((r) => r.signer_kid));
+        for (const s of envelope.signatures ?? [])
+            used.add(s.keyid);
+        for (const kid of used)
+            if (!listed.has(kid))
+                fail(c7, null, `key ${kid} is not in the customer's file`);
+        c7.detail =
+            c7.status === "pass"
+                ? `${used.size} keys listed by the customer`
+                : "a key is not the customer's";
+    }
+    result.ok = checks.every((c) => c.status !== "fail");
+    return result;
+}

package/dist/proxy.d.ts

@@ -0,0 +1,69 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+/**
+ * `interlok proxy`: sits between any MCP client and any MCP server. Every `tools/call` is either
+ * recorded into a Shadow run (and always forwarded) or asked of the Gate (and forwarded only when
+ * allowed or released by a person). Everything else passes through untouched.
+ *
+ *   stdio:  interlok proxy --name github -- npx -y @modelcontextprotocol/server-github
+ *   http:   interlok proxy --name crm --upstream https://mcp.example.com/mcp --port 8787
+ *
+ * Mode: Shadow when INTERLOK_SHADOW_RUN (or --shadow <run>) is set, Gate otherwise. The proxy never
+ * reads or forwards Interlok credentials to the MCP server, and writes only protocol messages to
+ * stdout; everything it has to say goes to stderr.
+ */
+export type JsonRpc = {
+    jsonrpc: "2.0";
+    id?: string | number | null;
+    method?: string;
+    params?: any;
+    result?: any;
+    error?: any;
+};
+export interface Decision {
+    /** forward the call to the server, or answer the client with `message` instead */
+    forward: boolean;
+    message?: string;
+}
+export interface ProxyConfig {
+    api: string;
+    key: string;
+    agent: string;
+    connection: string;
+    shadowRun?: string;
+    environment?: "production" | "staging" | "dev";
+    /** How long to wait for a person on a held call before answering "still held". */
+    waitSeconds: number;
+    /** When Interlok cannot be reached: refuse (default) or let the call through. */
+    failOpen: boolean;
+    fetch?: typeof fetch;
+    log?: (line: string) => void;
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare const isToolCall: (m: JsonRpc) => boolean;
+/** A tools/call answer the model can read: MCP reports a refused call as a result with isError. */
+export declare function refusal(id: JsonRpc["id"], text: string): JsonRpc;
+/** MCP `_meta` key an agent may use to say what it is trying to do (intent, alternatives, confidence). */
+export declare const DECISION_META_KEY = "interlok/decision";
+/**
+ * Take the agent's decision record off the call. It is for Interlok, so it never reaches the MCP
+ * server: the key is deleted from the message in place, before the message can be forwarded.
+ */
+export declare function takeDecisionRecord(msg: JsonRpc): unknown;
+/** One line for the model: why, and what to do next. */
+export declare function guidanceText(g: any): string;
+/** Decide one tools/call. Shadow never blocks; Gate forwards only on allow or a human release. */
+export declare function decider(cfg: ProxyConfig): (msg: JsonRpc) => Promise<Decision>;
+/** Register the server's tools once its tools/list answer comes back: pins descriptions for drift. */
+export declare function registerTools(cfg: ProxyConfig, tools: any[], transport: string, url?: string): Promise<void>;
+/**
+ * The message pump shared by both transports. `toServer` / `toClient` write one message each way.
+ * Tool calls are decided concurrently so a held call never blocks pings, cancellations or other calls.
+ */
+export declare function interceptor(cfg: ProxyConfig, toServer: (m: JsonRpc) => void, toClient: (m: JsonRpc) => void, transport: string): {
+    fromClient(m: JsonRpc): void;
+    fromServer(m: JsonRpc): void;
+};
+export declare function proxyStdio(cfg: ProxyConfig, command: string, args: string[]): Promise<number>;
+/** Streamable HTTP: the client talks to http://127.0.0.1:<port>/mcp; the proxy talks to --upstream. */
+export declare function proxyHttp(cfg: ProxyConfig, upstream: string, port: number, host?: string): Promise<import("http").Server<typeof IncomingMessage, typeof ServerResponse>>;
+export declare function proxyCommand(args: string[], value: (n: string) => string | undefined, has: (n: string) => boolean): Promise<undefined>;