@lerianstudio/matcher-mcp 1.0.0-beta.5

package/dist/tools/report/unmatched.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unmatched.js","sourceRoot":"","sources":["../../../src/tools/report/unmatched.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,iFAAiF;AACjF,6EAA6E;AAC7E,qEAAqE;AACrE,+EAA+E;AAC/E,iDAAiD;AAEjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,aAAa,CAAA;AAEpB,yFAAyF;AACzF,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,uEAAuE;QACrE,iDAAiD,CACpD;IACH,GAAG,sBAAsB;IACzB,GAAG,0BAA0B;CAC9B,CAAA;AAOD;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAiB;IAC3D,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,WAAW,EACT,iEAAiE;YACjE,qEAAqE;YACrE,oEAAoE;YACpE,yEAAyE;YACzE,sEAAsE;YACtE,4DAA4D;QAC9D,WAAW,EAAE,yBAAyB;KACvC,EACD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAA;QAC7C,OAAO,cAAc,CACnB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;YACpD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,EACD,KAAK,CACN,CAAA;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/tools/report/variance.js

@@ -0,0 +1,44 @@
+// `report_variance` — curated GET /v1/reports/contexts/{contextId}/variance.
+//
+// Cursor-paginated variance report rows for a context within a date window.
+// date_from/date_to/source_id filter and cursor/limit/sort_order page; matcher's
+// { items, nextCursor } envelope is returned as-is — no auto-pagination (the
+// model re-calls with the returned cursor). The report is implicitly
+// tenant-scoped by the relayed token; contextId is a routing path param, not a
+// tenant field, and no tenant field is accepted.
+import { z } from 'zod';
+import { buildReportPaginatedQuery, contextReportPath, dispatchReport, reportFilterInputShape, reportPaginationInputShape, } from './shared.js';
+/** Zod raw shape for `report_variance` input — contextId path + filter + pagination. */
+export const varianceReportInputShape = {
+    contextId: z
+        .string()
+        .min(1)
+        .describe('The reconciliation context id (UUID) whose variance rows to report. ' +
+        'Routing path param, not a tenant field.'),
+    ...reportFilterInputShape,
+    ...reportPaginationInputShape,
+};
+/**
+ * Register `report_variance`. Passes the date filter + pagination through and
+ * returns matcher's pagination envelope verbatim; a matcher error surfaces via
+ * the shared toToolError.
+ */
+export function registerReportVarianceTool(server) {
+    server.registerTool('report_variance', {
+        description: 'List variance report rows for a context within a date window ' +
+            '(cursor-paginated). Pass contextId (UUID path param — not a tenant ' +
+            'field), and optionally date_from/date_to (YYYY-MM-DD, window ≤ 90 ' +
+            'days), source_id, limit (1–200), sort_order (asc|desc), and/or cursor. ' +
+            'The response carries { items, nextCursor } — paginate by re-calling ' +
+            'with the returned nextCursor. No tenant field is accepted.',
+        inputSchema: varianceReportInputShape,
+    }, async (args, extra) => {
+        const query = buildReportPaginatedQuery(args);
+        return dispatchReport({
+            method: 'GET',
+            path: contextReportPath(args.contextId, 'variance'),
+            ...(query !== undefined ? { query } : {}),
+        }, extra);
+    });
+}
+//# sourceMappingURL=variance.js.map

package/dist/tools/report/variance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"variance.js","sourceRoot":"","sources":["../../../src/tools/report/variance.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,4EAA4E;AAC5E,iFAAiF;AACjF,6EAA6E;AAC7E,qEAAqE;AACrE,+EAA+E;AAC/E,iDAAiD;AAEjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,aAAa,CAAA;AAEpB,wFAAwF;AACxF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,sEAAsE;QACpE,yCAAyC,CAC5C;IACH,GAAG,sBAAsB;IACzB,GAAG,0BAA0B;CAC9B,CAAA;AAOD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAiB;IAC1D,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,WAAW,EACT,+DAA+D;YAC/D,qEAAqE;YACrE,oEAAoE;YACpE,yEAAyE;YACzE,sEAAsE;YACtE,4DAA4D;QAC9D,WAAW,EAAE,wBAAwB;KACtC,EACD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAA;QAC7C,OAAO,cAAc,CACnB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;YACnD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,EACD,KAAK,CACN,CAAA;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/tools/source/create.js

@@ -0,0 +1,84 @@
+// `source_create` — curated POST /v1/contexts/{contextId}/sources.
+//
+// A typed, richly-described front door to creating a reconciliation source under
+// a context, mirroring the spec's CreateSourceRequest. The Zod schema models the
+// required scalars (name, type, side) and the documented enums; `config` is left
+// as an open record (per the established pattern) — its shape depends on the
+// source type and matcher validates it server-side, so we do not duplicate that
+// validation here.
+//
+// `contextId` is a routing path param (matcher validates it belongs to the
+// relayed token's tenant), NOT a tenant field. No tenant field exists in the
+// schema: the source is created for the tenant of the relayed bearer token.
+import { z } from 'zod';
+import { contextSourcesPath, dispatchSource } from './shared.js';
+/** Origin of the source data (LEDGER ledger / BANK feed / GATEWAY / CUSTOM / FETCHER pull). */
+export const SOURCE_TYPES = [
+    'LEDGER',
+    'BANK',
+    'GATEWAY',
+    'CUSTOM',
+    'FETCHER',
+];
+/** Matching side this source feeds — the two sides reconciled against each other. */
+export const SOURCE_SIDES = ['LEFT', 'RIGHT'];
+/** Zod raw shape for `source_create` input — mirrors CreateSourceRequest. */
+export const createSourceInputShape = {
+    contextId: z
+        .string()
+        .min(1)
+        .describe('The reconciliation context id (UUID) the source belongs to. This is a ' +
+        'routing path param, not a tenant field — matcher validates the context ' +
+        "belongs to your token's tenant."),
+    name: z
+        .string()
+        .min(1)
+        .max(50)
+        .describe('Human-readable name of the source (1–50 chars).'),
+    type: z
+        .enum(SOURCE_TYPES)
+        .describe('Origin of the source data. LEDGER is the internal ledger; BANK is a bank ' +
+        'statement feed; GATEWAY is a payment gateway; CUSTOM is a bespoke feed; ' +
+        'FETCHER is a discovery-engine pull.'),
+    side: z
+        .enum(SOURCE_SIDES)
+        .describe('Matching side this source feeds. LEFT and RIGHT are the two sides ' +
+        'reconciled against each other.'),
+    config: z
+        .record(z.string(), z.unknown())
+        .describe('Source-specific configuration object (connection and parsing settings). ' +
+        'Its shape depends on the source type and is validated server-side.'),
+};
+/**
+ * Build the POST body from the input minus the path-only `contextId`. Only the
+ * CreateSourceRequest fields are sent; contextId travels in the path.
+ */
+export function buildCreateBody(args) {
+    const { contextId: _contextId, ...body } = args;
+    void _contextId;
+    return body;
+}
+/**
+ * Register `source_create`. Substitutes contextId into the path, builds the body
+ * from the remaining typed input, and dispatches a POST through the shared
+ * fail-closed relay; a matcher error surfaces via the shared toToolError (same
+ * shape as matcher_invoke).
+ */
+export function registerSourceCreateTool(server) {
+    server.registerTool('source_create', {
+        description: 'Create a reconciliation source under a context. Provide contextId ' +
+            '(UUID path param — not a tenant field), name (1–50), type ' +
+            '(LEDGER|BANK|GATEWAY|CUSTOM|FETCHER), side (LEFT|RIGHT), and a ' +
+            'type-specific config object (validated server-side). The source is ' +
+            "created for your token's tenant (no tenant field is accepted). Returns " +
+            'the created source, or a structured RFC 9457 error.',
+        inputSchema: createSourceInputShape,
+    }, async (args, extra) => {
+        return dispatchSource({
+            method: 'POST',
+            path: contextSourcesPath(args.contextId),
+            body: buildCreateBody(args),
+        }, extra);
+    });
+}
+//# sourceMappingURL=create.js.map

package/dist/tools/source/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../../src/tools/source/create.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,6EAA6E;AAC7E,gFAAgF;AAChF,mBAAmB;AACnB,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAE5E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEhE,+FAA+F;AAC/F,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,QAAQ;IACR,MAAM;IACN,SAAS;IACT,QAAQ;IACR,SAAS;CACD,CAAA;AAEV,qFAAqF;AACrF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAA;AAEtD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,wEAAwE;QACtE,yEAAyE;QACzE,iCAAiC,CACpC;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,YAAY,CAAC;SAClB,QAAQ,CACP,2EAA2E;QACzE,0EAA0E;QAC1E,qCAAqC,CACxC;IACH,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,YAAY,CAAC;SAClB,QAAQ,CACP,oEAAoE;QAClE,gCAAgC,CACnC;IACH,MAAM,EAAE,CAAC;SACN,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC/B,QAAQ,CACP,0EAA0E;QACxE,oEAAoE,CACvE;CACJ,CAAA;AAOD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAuB;IAEvB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;IAC/C,KAAK,UAAU,CAAA;IACf,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAiB;IACxD,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,WAAW,EACT,oEAAoE;YACpE,4DAA4D;YAC5D,iEAAiE;YACjE,qEAAqE;YACrE,yEAAyE;YACzE,qDAAqD;QACvD,WAAW,EAAE,sBAAsB;KACpC,EACD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpB,OAAO,cAAc,CACnB;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;YACxC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;SAC5B,EACD,KAAK,CACN,CAAA;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/tools/source/get.js

@@ -0,0 +1,41 @@
+// `source_get` — curated GET /v1/contexts/{contextId}/sources/{sourceId}.
+//
+// Reads one reconciliation source by id. Unlike fee-rules, sources keep the
+// contextId on single-resource ops, so both contextId and sourceId are path
+// params. The source must belong to a context owned by the relayed token's
+// tenant — matcher enforces that; no tenant field is accepted.
+import { z } from 'zod';
+import { contextSourcePath, dispatchSource } from './shared.js';
+/** Zod raw shape for `source_get` input — both path ids. */
+export const getSourceInputShape = {
+    contextId: z
+        .string()
+        .min(1)
+        .describe('The reconciliation context id (UUID). Routing path param, not a tenant ' +
+        'field.'),
+    sourceId: z
+        .string()
+        .min(1)
+        .describe('The reconciliation source id (UUID) to fetch.'),
+};
+/**
+ * Register `source_get`. Substitutes both ids into the path and dispatches a GET
+ * through the shared fail-closed relay; a matcher error (e.g. 404) surfaces via
+ * the shared toToolError.
+ */
+export function registerSourceGetTool(server) {
+    server.registerTool('source_get', {
+        description: 'Fetch a single reconciliation source by id (UUID) within a context. ' +
+            'Provide both contextId and sourceId (path params; contextId is not a ' +
+            "tenant field). The source must belong to your token's tenant. Returns " +
+            'the source, or a structured RFC 9457 error (e.g. 404 if it does not ' +
+            'exist or is not yours).',
+        inputSchema: getSourceInputShape,
+    }, async (args, extra) => {
+        return dispatchSource({
+            method: 'GET',
+            path: contextSourcePath(args.contextId, args.sourceId),
+        }, extra);
+    });
+}
+//# sourceMappingURL=get.js.map

package/dist/tools/source/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../src/tools/source/get.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,+DAA+D;AAE/D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE/D,4DAA4D;AAC5D,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yEAAyE;QACvE,QAAQ,CACX;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,+CAA+C,CAAC;CAC7D,CAAA;AAKD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAiB;IACrD,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,WAAW,EACT,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,sEAAsE;YACtE,yBAAyB;QAC3B,WAAW,EAAE,mBAAmB;KACjC,EACD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpB,OAAO,cAAc,CACnB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC;SACvD,EACD,KAAK,CACN,CAAA;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/tools/source/index.js

@@ -0,0 +1,22 @@
+// Curated source vertical (task 2.2.2): four typed tools over the matcher
+// reconciliation-source resource — create, list, get, update. (Delete was
+// removed when the matcher app replaced source hard-delete with the
+// archive/restore lifecycle; archive/restore remain reachable via the generic
+// invoke surface.) Sources are fully context-nested on every op (single-resource
+// ops keep contextId, unlike fee-rules). Each tool shares the fail-closed relay
+// (shared.ts) and the RFC 9457 → tool-error mapping (toToolError) with the
+// generic surface, so curated and generic map matcher errors identically. No
+// tool carries a tenant field; contextId is a routing path param matcher
+// validates against the relayed token's tenant.
+import { registerSourceCreateTool } from './create.js';
+import { registerSourceGetTool } from './get.js';
+import { registerSourceListTool } from './list.js';
+import { registerSourceUpdateTool } from './update.js';
+/** Register all four curated source tools on the given server. */
+export function registerSourceTools(server) {
+    registerSourceCreateTool(server);
+    registerSourceListTool(server);
+    registerSourceGetTool(server);
+    registerSourceUpdateTool(server);
+}
+//# sourceMappingURL=index.js.map

package/dist/tools/source/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/source/index.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,0EAA0E;AAC1E,oEAAoE;AACpE,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,2EAA2E;AAC3E,6EAA6E;AAC7E,yEAAyE;AACzE,gDAAgD;AAIhD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAEtD,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,wBAAwB,CAAC,MAAM,CAAC,CAAA;IAChC,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAC9B,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC7B,wBAAwB,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC"}

package/dist/tools/source/list.js

@@ -0,0 +1,72 @@
+// `source_list` — curated GET /v1/contexts/{contextId}/sources.
+//
+// Cursor-paginated list of a context's reconciliation sources, optionally
+// filtered by type. limit/cursor/type pass through untouched and matcher's
+// { items, nextCursor, ... } envelope is returned as-is — no auto-pagination
+// (the model re-calls with the returned cursor). The list is implicitly
+// tenant-scoped by the relayed token; contextId is a routing path param, not a
+// tenant field, and no tenant field is accepted.
+import { z } from 'zod';
+import { SOURCE_TYPES } from './create.js';
+import { contextSourcesPath, dispatchSource } from './shared.js';
+/** Zod raw shape for `source_list` input — contextId path + type filter + pagination. */
+export const listSourcesInputShape = {
+    contextId: z
+        .string()
+        .min(1)
+        .describe('The reconciliation context id (UUID) whose sources to list. Routing path ' +
+        'param, not a tenant field.'),
+    type: z
+        .enum(SOURCE_TYPES)
+        .optional()
+        .describe('Optional filter by source type (LEDGER|BANK|GATEWAY|CUSTOM|FETCHER).'),
+    limit: z
+        .number()
+        .int()
+        .min(1)
+        .max(200)
+        .optional()
+        .describe('Maximum number of records to return (1–200, default 20).'),
+    cursor: z
+        .string()
+        .optional()
+        .describe('Opaque pagination cursor from a prior response. Re-call with the ' +
+        'returned nextCursor to page forward (there is no auto-pagination).'),
+};
+/** Build the list query, omitting unset knobs so the request stays minimal. */
+function buildListQuery(args) {
+    const query = {};
+    if (args.type !== undefined) {
+        query.type = args.type;
+    }
+    if (args.limit !== undefined) {
+        query.limit = args.limit;
+    }
+    if (args.cursor !== undefined) {
+        query.cursor = args.cursor;
+    }
+    return Object.keys(query).length > 0 ? query : undefined;
+}
+/**
+ * Register `source_list`. Passes type/limit/cursor through and returns matcher's
+ * pagination envelope verbatim; a matcher error surfaces via the shared
+ * toToolError.
+ */
+export function registerSourceListTool(server) {
+    server.registerTool('source_list', {
+        description: "List the reconciliation sources under a context (cursor-paginated). " +
+            'Pass contextId (UUID path param — not a tenant field), and optionally ' +
+            'type (LEDGER|BANK|GATEWAY|CUSTOM|FETCHER), limit (1–200), and/or cursor. ' +
+            'The response carries { items, nextCursor } — paginate by re-calling ' +
+            'with the returned nextCursor. No tenant field is accepted.',
+        inputSchema: listSourcesInputShape,
+    }, async (args, extra) => {
+        const query = buildListQuery(args);
+        return dispatchSource({
+            method: 'GET',
+            path: contextSourcesPath(args.contextId),
+            ...(query !== undefined ? { query } : {}),
+        }, extra);
+    });
+}
+//# sourceMappingURL=list.js.map

package/dist/tools/source/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../src/tools/source/list.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,0EAA0E;AAC1E,2EAA2E;AAC3E,6EAA6E;AAC7E,wEAAwE;AACxE,+EAA+E;AAC/E,iDAAiD;AAEjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEhE,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,2EAA2E;QACzE,4BAA4B,CAC/B;IACH,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,YAAY,CAAC;SAClB,QAAQ,EAAE;SACV,QAAQ,CACP,sEAAsE,CACvE;IACH,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,mEAAmE;QACjE,oEAAoE,CACvE;CACJ,CAAA;AAKD,+EAA+E;AAC/E,SAAS,cAAc,CAAC,IAAsB;IAC5C,MAAM,KAAK,GAAoC,EAAE,CAAA;IACjD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACxB,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAiB;IACtD,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,WAAW,EACT,sEAAsE;YACtE,wEAAwE;YACxE,2EAA2E;YAC3E,sEAAsE;YACtE,4DAA4D;QAC9D,WAAW,EAAE,qBAAqB;KACnC,EACD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QAClC,OAAO,cAAc,CACnB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;YACxC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,EACD,KAAK,CACN,CAAA;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/tools/source/shared.js

@@ -0,0 +1,63 @@
+// Shared plumbing for the curated source tools.
+//
+// Sources are the data feeds bound to a reconciliation context. Unlike
+// fee-rules' hybrid path, EVERY source op is fully context-nested: create/list
+// hang off /v1/contexts/{contextId}/sources and get/update/delete off
+// /v1/contexts/{contextId}/sources/{sourceId} — single-resource ops KEEP the
+// contextId. This module factors the two path helpers plus the relay boilerplate
+// exactly once so the five tools stay thin (just "build the request") and so
+// curated + generic surfaces map matcher errors through the identical path
+// (toToolError).
+//
+// Security: the bearer token is never read here directly — requireMatcherClient
+// owns the request-scoped relay and fails closed when no usable credential was
+// provided. The contextId path param is a routing identifier (matcher validates
+// the context belongs to the relayed token's tenant); no tenant identifier is
+// ever read or injected, and no source tool input carries one.
+import { requireMatcherClient, UnauthenticatedError, } from '../../auth/request-token.js';
+import { isMatcherApiError, toToolError } from '../tool-error.js';
+/** Build the context-scoped sources collection path (create/list). */
+export function contextSourcesPath(contextId) {
+    return `/v1/contexts/${encodeURIComponent(contextId)}/sources`;
+}
+/** Build the single-source sub-path (get/update/delete) — both ids encoded. */
+export function contextSourcePath(contextId, sourceId) {
+    return `${contextSourcesPath(contextId)}/${encodeURIComponent(sourceId)}`;
+}
+/**
+ * Run one assembled request through the relay: fail-closed auth, dispatch, and
+ * RFC 9457 → tool-error mapping — identical to the generic invoke's dispatch so
+ * both surfaces produce the same structured error shape.
+ *
+ * `clientFor` is injectable for tests; production callers pass nothing and get
+ * the request-scoped, fail-closed `requireMatcherClient`.
+ */
+export async function dispatchSource(request, extra, clientFor = requireMatcherClient) {
+    let client;
+    try {
+        // Fail-closed on a missing / empty / non-Bearer credential.
+        client = clientFor(extra);
+    }
+    catch (err) {
+        if (err instanceof UnauthenticatedError) {
+            return { isError: true, content: [{ type: 'text', text: err.message }] };
+        }
+        throw err;
+    }
+    try {
+        const result = await client.request(request);
+        // Success → matcher's JSON returned as-is (incl. pagination envelopes and
+        // 204 → null for delete).
+        return { content: [{ type: 'text', text: JSON.stringify(result ?? null) }] };
+    }
+    catch (err) {
+        // RFC 9457 problem → the SHARED structured tool error (status/title/detail/
+        // code preserved). A non-matcher error is a bug, not a matcher failure, and
+        // is re-thrown rather than masqueraded as one.
+        if (isMatcherApiError(err)) {
+            return toToolError(err);
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=shared.js.map

package/dist/tools/source/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../src/tools/source/shared.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,uEAAuE;AACvE,+EAA+E;AAC/E,sEAAsE;AACtE,6EAA6E;AAC7E,iFAAiF;AACjF,6EAA6E;AAC7E,2EAA2E;AAC3E,iBAAiB;AACjB,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,+DAA+D;AAI/D,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GAErB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAEjE,sEAAsE;AACtE,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAA;AAChE,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,QAAgB;IACnE,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAA;AAC3E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAuB,EACvB,KAAmC,EACnC,YAAyD,oBAAoB;IAE7E,IAAI,MAAqB,CAAA;IACzB,IAAI,CAAC;QACH,4DAA4D;QAC5D,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAA;QAC1E,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC5C,0EAA0E;QAC1E,0BAA0B;QAC1B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,CAAA;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,4EAA4E;QAC5E,+CAA+C;QAC/C,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,WAAW,CAAC,GAAG,CAAC,CAAA;QACzB,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/tools/source/update.js

@@ -0,0 +1,73 @@
+// `source_update` — curated PATCH /v1/contexts/{contextId}/sources/{sourceId}.
+//
+// Partial update of a source's fields, mirroring the spec's UpdateSourceRequest.
+// All body fields are optional (PATCH semantics): name, type, side, config.
+// Both contextId and sourceId are path params (sources keep contextId on
+// single-resource ops); no tenant field is accepted (matcher scopes to the
+// relayed token's tenant).
+import { z } from 'zod';
+import { SOURCE_SIDES, SOURCE_TYPES } from './create.js';
+import { contextSourcePath, dispatchSource } from './shared.js';
+/** Zod raw shape for `source_update` input — path ids + optional body fields. */
+export const updateSourceInputShape = {
+    contextId: z
+        .string()
+        .min(1)
+        .describe('The reconciliation context id (UUID). Routing path param, not a tenant ' +
+        'field.'),
+    sourceId: z
+        .string()
+        .min(1)
+        .describe('The reconciliation source id (UUID) to update.'),
+    name: z
+        .string()
+        .min(1)
+        .max(50)
+        .optional()
+        .describe('New human-readable name of the source (1–50 chars).'),
+    type: z
+        .enum(SOURCE_TYPES)
+        .optional()
+        .describe('Origin of the source data (LEDGER|BANK|GATEWAY|CUSTOM|FETCHER).'),
+    side: z
+        .enum(SOURCE_SIDES)
+        .optional()
+        .describe('Matching side this source feeds (LEFT|RIGHT).'),
+    config: z
+        .record(z.string(), z.unknown())
+        .optional()
+        .describe('Source-specific configuration object (validated server-side).'),
+};
+/**
+ * Build the PATCH body from the input minus the path-only ids. Only the fields
+ * the caller actually set are sent — matcher treats absent fields as unchanged.
+ */
+export function buildUpdateBody(args) {
+    const { contextId: _contextId, sourceId: _sourceId, ...body } = args;
+    void _contextId;
+    void _sourceId;
+    return body;
+}
+/**
+ * Register `source_update`. Splits the path ids from the body fields, dispatches
+ * a PATCH through the shared fail-closed relay; a matcher error surfaces via the
+ * shared toToolError.
+ */
+export function registerSourceUpdateTool(server) {
+    server.registerTool('source_update', {
+        description: 'Update fields of a reconciliation source by id (UUID) within a context. ' +
+            'Provide contextId and sourceId (path params; contextId is not a tenant ' +
+            'field). All body fields are optional (PATCH): name (1–50), type ' +
+            '(LEDGER|BANK|GATEWAY|CUSTOM|FETCHER), side (LEFT|RIGHT), config. No ' +
+            'tenant field is accepted. Returns the updated source, or a structured ' +
+            'RFC 9457 error.',
+        inputSchema: updateSourceInputShape,
+    }, async (args, extra) => {
+        return dispatchSource({
+            method: 'PATCH',
+            path: contextSourcePath(args.contextId, args.sourceId),
+            body: buildUpdateBody(args),
+        }, extra);
+    });
+}
+//# sourceMappingURL=update.js.map

package/dist/tools/source/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../src/tools/source/update.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,yEAAyE;AACzE,2EAA2E;AAC3E,2BAA2B;AAE3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE/D,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yEAAyE;QACvE,QAAQ,CACX;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,gDAAgD,CAAC;IAC7D,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;IAClE,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,YAAY,CAAC;SAClB,QAAQ,EAAE;SACV,QAAQ,CACP,iEAAiE,CAClE;IACH,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,YAAY,CAAC;SAClB,QAAQ,EAAE;SACV,QAAQ,CAAC,+CAA+C,CAAC;IAC5D,MAAM,EAAE,CAAC;SACN,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC/B,QAAQ,EAAE;SACV,QAAQ,CACP,+DAA+D,CAChE;CACJ,CAAA;AAOD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAuB;IAEvB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;IACpE,KAAK,UAAU,CAAA;IACf,KAAK,SAAS,CAAA;IACd,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAiB;IACxD,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,WAAW,EACT,0EAA0E;YAC1E,yEAAyE;YACzE,kEAAkE;YAClE,sEAAsE;YACtE,wEAAwE;YACxE,iBAAiB;QACnB,WAAW,EAAE,sBAAsB;KACpC,EACD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpB,OAAO,cAAc,CACnB;YACE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC;YACtD,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;SAC5B,EACD,KAAK,CACN,CAAA;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/tools/tool-error.js

@@ -0,0 +1,74 @@
+// Shared error-mapping helper: RFC 9457 problem → structured MCP tool error.
+//
+// Both the generic `matcher_invoke` (task 1.2.3) and every curated tool (task
+// 1.3.2 onward) call `toToolError` so that a matcher failure renders the SAME
+// structured shape regardless of which surface produced it. Keeping this in one
+// place is what makes "curated and generic map errors identically" true rather
+// than aspirational.
+//
+// The mapping deliberately PRESERVES the problem's status/title/detail/code
+// rather than collapsing them into one human string — the model (and any UI on
+// top of it) can branch on `status`/`code` and surface `detail` verbatim. The
+// matcher's bearer token is never part of a MatcherApiError (see matcher/client.ts),
+// so nothing token-bearing can leak through here.
+import { MatcherApiError } from '../matcher/client.js';
+/** Guidance shown alongside `retryable: true` — the request can be retried as-is. */
+const GUIDANCE_RETRYABLE = 'matcher backend was unavailable/timed out; retry';
+/** Guidance shown alongside `retryable: false` — the request itself must change. */
+const GUIDANCE_NOT_RETRYABLE = 'fix the request';
+/**
+ * Classify a matcher HTTP status into a retryability hint. Backend
+ * unavailability/timeouts (any 5xx — including the synthetic 504 for transport
+ * failures — and 429 Too Many Requests) are retryable as-is; every other
+ * client-side 4xx is not (the caller must change the request first).
+ */
+function retryabilityFor(status) {
+    const retryable = status >= 500 || status === 429;
+    return {
+        retryable,
+        guidance: retryable ? GUIDANCE_RETRYABLE : GUIDANCE_NOT_RETRYABLE,
+    };
+}
+/**
+ * Map a `MatcherApiError` to an MCP tool error result (`isError: true`). The
+ * result carries two content blocks:
+ *   1. A one-line human summary (`status — title`) for quick reading.
+ *   2. The full structured problem as JSON, so a caller can branch on
+ *      `status`/`code` and read `detail`/`errors` without re-parsing a sentence.
+ *
+ * The problem is preserved, never swallowed into a generic "request failed".
+ */
+export function toToolError(err) {
+    const { status, problem } = err;
+    const { retryable, guidance } = retryabilityFor(status);
+    const payload = {
+        status,
+        ...(problem.title !== undefined ? { title: problem.title } : {}),
+        ...(problem.detail !== undefined ? { detail: problem.detail } : {}),
+        ...(problem.code !== undefined ? { code: problem.code } : {}),
+        ...(problem.type !== undefined ? { type: problem.type } : {}),
+        ...(problem.instance !== undefined ? { instance: problem.instance } : {}),
+        ...(problem.errors !== undefined ? { errors: problem.errors } : {}),
+        retryable,
+        guidance,
+    };
+    const summary = problem.title !== undefined
+        ? `matcher error ${status}: ${problem.title}`
+        : `matcher error ${status}`;
+    return {
+        isError: true,
+        content: [
+            { type: 'text', text: summary },
+            { type: 'text', text: JSON.stringify(payload) },
+        ],
+    };
+}
+/**
+ * Narrow an unknown thrown value to `MatcherApiError`. Lets callers route only
+ * matcher API failures through `toToolError` and re-throw anything else (a bug
+ * is not a matcher error and should not masquerade as one).
+ */
+export function isMatcherApiError(err) {
+    return err instanceof MatcherApiError;
+}
+//# sourceMappingURL=tool-error.js.map

package/dist/tools/tool-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-error.js","sourceRoot":"","sources":["../../src/tools/tool-error.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,qBAAqB;AACrB,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,qFAAqF;AACrF,kDAAkD;AAIlD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AA4BtD,qFAAqF;AACrF,MAAM,kBAAkB,GACtB,kDAAkD,CAAA;AACpD,oFAAoF;AACpF,MAAM,sBAAsB,GAAG,iBAAiB,CAAA;AAEhD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAc;IAIrC,MAAM,SAAS,GAAG,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,CAAA;IACjD,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,sBAAsB;KAClE,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAoB;IAC9C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAA;IAC/B,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACvD,MAAM,OAAO,GAAqB;QAChC,MAAM;QACN,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,SAAS;QACT,QAAQ;KACT,CAAA;IAED,MAAM,OAAO,GACX,OAAO,CAAC,KAAK,KAAK,SAAS;QACzB,CAAC,CAAC,iBAAiB,MAAM,KAAK,OAAO,CAAC,KAAK,EAAE;QAC7C,CAAC,CAAC,iBAAiB,MAAM,EAAE,CAAA;IAE/B,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;YAC/B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;SAChD;KACF,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,OAAO,GAAG,YAAY,eAAe,CAAA;AACvC,CAAC"}

package/dist/transport/body-limit.js

@@ -0,0 +1,82 @@
+// Inbound body-size guard + server-timeout constants for the HTTP transport.
+//
+// `transport/http.ts` currently reads the request body unbounded (every chunk
+// appended to an array). That is a trivial memory-exhaustion / DoS vector for a
+// network-reachable, credential-bearing relay. This module supplies a small,
+// pure, testable guard the body reader uses to bound the accumulated size, plus
+// the Node HTTP server timeout values integration applies in `createServer`.
+//
+// Token-relay rule: nothing here touches the `Authorization` header or any
+// request content beyond byte counts. `BodyTooLargeError` carries only sizes —
+// never any portion of the body or any token.
+/** Default cap when a config value is not threaded in (matches Config default). */
+export const DEFAULT_MAX_BODY_BYTES = 1_048_576; // 1 MiB
+/**
+ * How long the server waits for a complete request (ms) before aborting it.
+ * Set on the Node HTTP server in integration (`createServer`). Generous enough
+ * for a slow large-but-legal request, short enough to shed a stuck connection.
+ */
+export const REQUEST_TIMEOUT_MS = 60_000;
+/**
+ * How long the server waits for the complete request headers (ms). Must be less
+ * than `REQUEST_TIMEOUT_MS` (Node enforces this) so a Slowloris-style trickle of
+ * headers is dropped well before the overall request budget. Set on the Node
+ * HTTP server in integration.
+ */
+export const HEADERS_TIMEOUT_MS = 30_000;
+/**
+ * Thrown when accumulated inbound body bytes exceed the configured limit. Reads
+ * as HTTP 413 (Payload Too Large) to an operator. Carries only the limit and the
+ * observed size — never any body content and never a token.
+ */
+export class BodyTooLargeError extends Error {
+    /** HTTP status an operator should see — 413 Payload Too Large. */
+    status = 413;
+    /** The configured maximum, in bytes. */
+    limitBytes;
+    /** Bytes accumulated when the limit was first exceeded. */
+    observedBytes;
+    constructor(limitBytes, observedBytes) {
+        super(`request body exceeds the ${limitBytes}-byte limit ` +
+            `(received at least ${observedBytes} bytes)`);
+        this.name = 'BodyTooLargeError';
+        this.limitBytes = limitBytes;
+        this.observedBytes = observedBytes;
+    }
+}
+/**
+ * A running tally of inbound body bytes that fails closed once the limit is
+ * exceeded. The body reader calls `add(chunk.length)` for each chunk and stops
+ * (the guard throws) before appending an over-limit chunk to memory, so the
+ * relay never buffers more than `maxBodyBytes` (+ one chunk) of an attacker's
+ * payload.
+ *
+ * Pure and allocation-free beyond a single number — trivially unit-testable
+ * without a socket.
+ */
+export class BodySizeGuard {
+    maxBodyBytes;
+    total = 0;
+    constructor(maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {
+        if (!Number.isInteger(maxBodyBytes) || maxBodyBytes < 1) {
+            throw new Error(`invalid maxBodyBytes: ${maxBodyBytes} (expected a positive integer)`);
+        }
+        this.maxBodyBytes = maxBodyBytes;
+    }
+    /** Bytes accumulated so far. */
+    get bytes() {
+        return this.total;
+    }
+    /**
+     * Account for `chunkLength` more bytes. Throws `BodyTooLargeError` the moment
+     * the running total would exceed the limit — the caller must NOT have appended
+     * the chunk to its buffer yet, so the over-limit bytes are never retained.
+     */
+    add(chunkLength) {
+        this.total += chunkLength;
+        if (this.total > this.maxBodyBytes) {
+            throw new BodyTooLargeError(this.maxBodyBytes, this.total);
+        }
+    }
+}
+//# sourceMappingURL=body-limit.js.map

package/dist/transport/body-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-limit.js","sourceRoot":"","sources":["../../src/transport/body-limit.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAC7E,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,8CAA8C;AAE9C,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAA,CAAC,QAAQ;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAExC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAExC;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,kEAAkE;IACzD,MAAM,GAAG,GAAG,CAAA;IACrB,wCAAwC;IAC/B,UAAU,CAAQ;IAC3B,2DAA2D;IAClD,aAAa,CAAQ;IAE9B,YAAY,UAAkB,EAAE,aAAqB;QACnD,KAAK,CACH,4BAA4B,UAAU,cAAc;YAClD,sBAAsB,aAAa,SAAS,CAC/C,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,aAAa;IACP,YAAY,CAAQ;IAC7B,KAAK,GAAG,CAAC,CAAA;IAEjB,YAAY,eAAuB,sBAAsB;QACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,yBAAyB,YAAY,gCAAgC,CACtE,CAAA;QACH,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;IAClC,CAAC;IAED,gCAAgC;IAChC,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,WAAmB;QACrB,IAAI,CAAC,KAAK,IAAI,WAAW,CAAA;QACzB,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;CACF"}