@knitli/openapi-mcp 0.0.0

package/dist/sqlite/release-completion.d.ts

@@ -0,0 +1,5 @@
+import { type BigIntStats } from "node:fs";
+import type { ManifestEnvelope, RuntimeLimits } from "../runtime/index.ts";
+export declare function releaseFileIdentity(path: string): BigIntStats;
+/** Filesystem completion is local ingress policy, never a portable semantic-store requirement. */
+export declare function verifyReleaseCompletion(path: string, payload: BigIntStats, envelope: ManifestEnvelope, limits: RuntimeLimits): void;

package/dist/sqlite/release-completion.js

@@ -0,0 +1,80 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, } from "node:fs";
+import { OpenApiMcpError } from "../runtime/errors.js";
+import { canonicalJson, parseJsonStrict } from "../runtime/strict-json.js";
+export function releaseFileIdentity(path) {
+    const value = lstatSync(path, { bigint: true });
+    if (!value.isFile() || value.isSymbolicLink())
+        throw new OpenApiMcpError("MANIFEST_INVALID");
+    return value;
+}
+function sameFile(left, right) {
+    return (left.dev === right.dev &&
+        left.ino === right.ino &&
+        left.birthtimeNs === right.birthtimeNs);
+}
+function sameSnapshot(left, right) {
+    return (sameFile(left, right) &&
+        left.size === right.size &&
+        left.mtimeNs === right.mtimeNs &&
+        left.ctimeNs === right.ctimeNs);
+}
+function readCompleteSidecar(path, maximum) {
+    const before = releaseFileIdentity(path);
+    if (before.size > BigInt(maximum) || !constants.O_NOFOLLOW)
+        throw new Error();
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const opened = fstatSync(fd, { bigint: true });
+        if (!sameSnapshot(before, opened) || !opened.isFile())
+            throw new Error();
+        const bytes = Buffer.alloc(Number(before.size) + 1);
+        let count = 0;
+        while (count < bytes.length) {
+            const read = readSync(fd, bytes, count, bytes.length - count, null);
+            if (read === 0)
+                break;
+            count += read;
+        }
+        const after = fstatSync(fd, { bigint: true });
+        const named = releaseFileIdentity(path);
+        if (count !== Number(before.size) ||
+            !sameSnapshot(before, after) ||
+            !sameSnapshot(before, named))
+            throw new Error();
+        return {
+            text: new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, count)),
+            identity: before,
+        };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Filesystem completion is local ingress policy, never a portable semantic-store requirement. */
+export function verifyReleaseCompletion(path, payload, envelope, limits) {
+    try {
+        if (!path.endsWith(".sqlite") ||
+            !sameFile(payload, releaseFileIdentity(path)))
+            throw new Error();
+        const stem = path.slice(0, -".sqlite".length);
+        const manifest = readCompleteSidecar(`${stem}.manifest.json`, limits.maxManifestBytes);
+        const signatureFile = readCompleteSidecar(`${stem}.manifest.sig`, 16 * 1024);
+        const signature = parseJsonStrict(signatureFile.text, {
+            maxBytes: 16 * 1024,
+            maxDepth: 4,
+            maxKeys: 8,
+        });
+        if (manifest.text !== envelope.manifestJson ||
+            canonicalJson(signature) !==
+                canonicalJson(envelope.signature))
+            throw new Error();
+        if (!sameSnapshot(manifest.identity, releaseFileIdentity(`${stem}.manifest.json`)) ||
+            !sameSnapshot(signatureFile.identity, releaseFileIdentity(`${stem}.manifest.sig`)))
+            throw new Error();
+        if (!sameFile(payload, releaseFileIdentity(path)))
+            throw new Error();
+    }
+    catch {
+        throw new OpenApiMcpError("MANIFEST_INVALID", "Release publication is incomplete or mismatched");
+    }
+}

package/dist/stdio/action-broker.d.ts

@@ -0,0 +1,15 @@
+import type { ActionDispatchPermit } from "../runtime/action-permit.ts";
+import type { ActionAuthorizer, AuthorizedActionDecision, CredentialAuthorizationBinding, PreparedCall, Sha256 } from "../runtime/types.ts";
+interface BoundaryOptions {
+    readonly now?: () => number;
+}
+/** Package-private: intentionally absent from every public barrel export. */
+export declare function createActionAuthorizationBoundary(authorizer: ActionAuthorizer, options?: BoundaryOptions): {
+    readonly broker: {
+        consume(decision: AuthorizedActionDecision, call: PreparedCall, binding: CredentialAuthorizationBinding): Promise<ActionDispatchPermit>;
+    };
+    readonly permits: {
+        consume(permit: ActionDispatchPermit, callDigest: Sha256, bindingDigest: Sha256): void;
+    };
+};
+export {};

package/dist/stdio/action-broker.js

@@ -0,0 +1,136 @@
+import { snapshotCredentialAuthorizationBinding } from "../runtime/credential-binding.js";
+import { OpenApiMcpError } from "../runtime/errors.js";
+import { verifyAndSnapshotPreparedCall } from "../runtime/prepared-call.js";
+const permitTtlMs = 120_000;
+const digestPattern = /^[0-9a-f]{64}$/;
+const baseDecisionKeys = [
+    "authorizationId",
+    "callDigest",
+    "credentialBindingDigest",
+    "path",
+    "status",
+];
+function denied() {
+    return new OpenApiMcpError("ACTION_DENIED", "Action authorization denied");
+}
+function snapshotDecision(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw denied();
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        throw denied();
+    const ownKeys = Reflect.ownKeys(value);
+    if (ownKeys.some((key) => typeof key !== "string"))
+        throw denied();
+    const keys = ownKeys;
+    const allowed = [...baseDecisionKeys, "policyDigest"];
+    if (keys.some((key) => !allowed.includes(key)) ||
+        baseDecisionKeys.some((key) => !keys.includes(key))) {
+        throw denied();
+    }
+    const fields = Object.create(null);
+    for (const key of keys) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (descriptor === undefined ||
+            !("value" in descriptor) ||
+            !descriptor.enumerable) {
+            throw denied();
+        }
+        fields[key] = descriptor.value;
+    }
+    if (fields.status !== "authorized" ||
+        (fields.path !== "per-call" && fields.path !== "exact-policy") ||
+        typeof fields.callDigest !== "string" ||
+        !digestPattern.test(fields.callDigest) ||
+        typeof fields.credentialBindingDigest !== "string" ||
+        !digestPattern.test(fields.credentialBindingDigest) ||
+        typeof fields.authorizationId !== "object" ||
+        fields.authorizationId === null) {
+        throw denied();
+    }
+    if ((fields.path === "exact-policy" &&
+        (typeof fields.policyDigest !== "string" ||
+            !digestPattern.test(fields.policyDigest))) ||
+        (fields.path === "per-call" && "policyDigest" in fields)) {
+        throw denied();
+    }
+    const snapshot = {
+        status: "authorized",
+        callDigest: fields.callDigest,
+        credentialBindingDigest: fields.credentialBindingDigest,
+        path: fields.path,
+        authorizationId: fields.authorizationId,
+        ...(fields.path === "exact-policy"
+            ? { policyDigest: fields.policyDigest }
+            : {}),
+    };
+    return Object.freeze(snapshot);
+}
+function sameTuple(decision, call, credential) {
+    return (decision.callDigest === call.preparedCallDigest &&
+        decision.credentialBindingDigest === credential.bindingDigest &&
+        credential.profileId === call.credentialProfileId &&
+        credential.profileDigest === call.credentialProfileDigest &&
+        credential.slotsDigest === call.reservedSlotsDigest);
+}
+/** Package-private: intentionally absent from every public barrel export. */
+export function createActionAuthorizationBoundary(authorizer, options = {}) {
+    const now = options.now ?? Date.now;
+    const ownedPermits = new WeakMap();
+    return Object.freeze({
+        broker: Object.freeze({
+            async consume(untrustedDecision, untrustedCall, untrustedBinding) {
+                try {
+                    // Check immutability before snapshotting: a successful frozen check
+                    // leaves even a Proxy target structurally stable for the subsequent
+                    // own-data validation. Mutable decisions never cross the await.
+                    const preserveDecisionIdentity = typeof untrustedDecision === "object" &&
+                        untrustedDecision !== null &&
+                        Object.isFrozen(untrustedDecision);
+                    const decision = snapshotDecision(untrustedDecision);
+                    const callPromise = verifyAndSnapshotPreparedCall(untrustedCall);
+                    const credentialPromise = snapshotCredentialAuthorizationBinding(untrustedBinding);
+                    const [call, credential] = await Promise.all([
+                        callPromise,
+                        credentialPromise,
+                    ]);
+                    if (!sameTuple(decision, call, credential))
+                        throw denied();
+                    await authorizer.consume(preserveDecisionIdentity ? untrustedDecision : decision, call, credential);
+                    const issuedAt = now();
+                    if (!Number.isFinite(issuedAt))
+                        throw denied();
+                    const permit = Object.freeze(Object.create(null));
+                    ownedPermits.set(permit, Object.freeze({
+                        callDigest: call.preparedCallDigest,
+                        credentialBindingDigest: credential.bindingDigest,
+                        expiresAt: issuedAt + permitTtlMs,
+                    }));
+                    return permit;
+                }
+                catch {
+                    throw denied();
+                }
+            },
+        }),
+        permits: Object.freeze({
+            consume(permit, callDigest, bindingDigest) {
+                if (typeof permit !== "object" || permit === null)
+                    throw denied();
+                const tuple = ownedPermits.get(permit);
+                if (tuple === undefined ||
+                    tuple.callDigest !== callDigest ||
+                    tuple.credentialBindingDigest !== bindingDigest) {
+                    throw denied();
+                }
+                const currentTime = now();
+                if (!Number.isFinite(currentTime) || currentTime >= tuple.expiresAt) {
+                    throw denied();
+                }
+                // No await can intervene between the successful check and deletion.
+                ownedPermits.delete(permit);
+            },
+        }),
+    });
+}

package/dist/stdio/authorizer.d.ts

@@ -0,0 +1,30 @@
+import { type ServerContext } from "@modelcontextprotocol/server";
+import type { ActionAuthorizer, VerifiedActionRequestState } from "../runtime/types.ts";
+import { type CompiledExactPolicy } from "./exact-policy.ts";
+interface InternalLimits {
+    readonly pending: number;
+    readonly receipts: number;
+    readonly activations: number;
+}
+export interface AuthorizerTestOptions {
+    /** Test seam. Production callers should leave this unset. */
+    readonly now?: () => number;
+    /** Test seam. Production callers should leave this unset. */
+    readonly randomBytes?: (size: number) => Uint8Array;
+    /** Test seam; values may only lower the production bounds. */
+    readonly limits?: Readonly<Partial<InternalLimits>>;
+}
+export interface ClientElicitationAuthorizerOptions extends AuthorizerTestOptions {
+    readonly elicitationAvailable: () => boolean;
+}
+export interface ExactPolicyAuthorizerOptions extends AuthorizerTestOptions {
+    readonly templates: readonly CompiledExactPolicy[];
+    readonly elicitationAvailable: () => boolean;
+}
+export interface StatefulActionAuthorizer extends ActionAuthorizer {
+    readonly requestStateVerifier: (state: string, context?: ServerContext) => Promise<VerifiedActionRequestState>;
+}
+export declare function createDenyActionAuthorizer(): ActionAuthorizer;
+export declare function createClientElicitationActionAuthorizer(options: ClientElicitationAuthorizerOptions): StatefulActionAuthorizer;
+export declare function createExactPolicyActionAuthorizer(options: ExactPolicyAuthorizerOptions): StatefulActionAuthorizer;
+export {};