@multiagentcoordinationprotocol/mcp 0.2.0 → 0.3.0

package/dist/gate/approval.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Runs the MACP session that decides one gated tool call.
+ *
+ * The gate is the session's initiator and its only committer. In Quorum it
+ * sends one ApprovalRequest and is not itself a participant (the runtime lets
+ * only the initiator request approval; ballots come from the declared
+ * participants). In Decision it must be a participant to send its Proposal,
+ * so it is added as the first participant, but it never votes and is not
+ * counted. Either way the gate watches the session's stream and commits as
+ * soon as the outcome is settled: positive once the approvers' first ballots
+ * reach the rule's threshold, negative once they no longer can.
+ *
+ * What approvers see on the wire (intent, request fields, commitment action
+ * and scope) is pinned by `contract/gate/session.json`, shared with the
+ * Python macp-mcp, so a session opened by either gate looks identical.
+ */
+import { type BridgeClient } from '../bridge';
+import type { Settings } from '../config';
+import { type GateMode, type GateRule } from './config';
+import { type GateTemplate } from './contract';
+/** Decision-mode proposal id: one gated call per session. */
+export declare const GATE_PROPOSAL_ID = "call";
+export declare const GATE_ACTION_APPROVE = "macp.gate.approve";
+export declare const GATE_ACTION_DENY = "macp.gate.deny";
+/** How long past `ttl_ms` the gate waits for the runtime before cancelling the session itself. */
+export declare const GATE_GRACE_MS = 5000;
+/** How often the gate re-checks the session state while no envelope arrives. */
+export declare const GATE_POLL_MS = 500;
+export type GateOutcome = 'approve' | 'deny';
+/** The settled session behind a gated call (`_meta["io.multiagentcoordinationprotocol/commitment"]`). */
+export interface GateCommitment {
+    session_id: string;
+    mode: GateMode;
+    outcome: GateOutcome;
+    commitment_hash: string;
+}
+/** A gated call that cannot go ahead. `code` is a registry error code; the tool error text is `"<code>: <message>"`. */
+export declare class GateRefusal extends Error {
+    readonly code: 'POLICY_DENIED' | 'SESSION_NOT_OPEN' | 'INVALID_ARGUMENT';
+    readonly sessionId: string;
+    constructor(code: 'POLICY_DENIED' | 'SESSION_NOT_OPEN' | 'INVALID_ARGUMENT', message: string, sessionId: string);
+}
+/** A refusal whose `"<code>: <message>"` text is exactly the rendered `session.json` template. */
+export declare function refusal(template: GateTemplate, vars: Record<string, string>, sessionId?: string): GateRefusal;
+export interface GatedCall {
+    server: string;
+    tool: string;
+    /** JCS preimage of {"arguments","server","tool"}. */
+    preimage: string;
+    contextId: string;
+}
+/** Whether the approvers' ballots settle the call: approve at the bar, deny once it is out of reach. */
+export declare function settle(approvals: number, cast: number, approvers: number, required: number): GateOutcome | undefined;
+export declare class GateApprover {
+    private readonly client;
+    private readonly settings;
+    private readonly clock;
+    constructor(client: BridgeClient, settings: Settings, clock?: () => number);
+    /** Open a session for `call` under `rule` and wait for it to settle. */
+    decide(rule: GateRule, call: GatedCall): Promise<GateCommitment>;
+    private state;
+    private cancel;
+    private watch;
+}
+/** The refusal for a settled `deny`. */
+export declare function denied(commitment: GateCommitment, tool: string): GateRefusal;

package/dist/gate/approval.js

@@ -0,0 +1,202 @@
+"use strict";
+/**
+ * Runs the MACP session that decides one gated tool call.
+ *
+ * The gate is the session's initiator and its only committer. In Quorum it
+ * sends one ApprovalRequest and is not itself a participant (the runtime lets
+ * only the initiator request approval; ballots come from the declared
+ * participants). In Decision it must be a participant to send its Proposal,
+ * so it is added as the first participant, but it never votes and is not
+ * counted. Either way the gate watches the session's stream and commits as
+ * soon as the outcome is settled: positive once the approvers' first ballots
+ * reach the rule's threshold, negative once they no longer can.
+ *
+ * What approvers see on the wire (intent, request fields, commitment action
+ * and scope) is pinned by `contract/gate/session.json`, shared with the
+ * Python macp-mcp, so a session opened by either gate looks identical.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GateApprover = exports.GateRefusal = exports.GATE_POLL_MS = exports.GATE_GRACE_MS = exports.GATE_ACTION_DENY = exports.GATE_ACTION_APPROVE = exports.GATE_PROPOSAL_ID = void 0;
+exports.refusal = refusal;
+exports.settle = settle;
+exports.denied = denied;
+const macp_sdk_typescript_1 = require("macp-sdk-typescript");
+const bridge_1 = require("../bridge");
+const config_1 = require("./config");
+const contract_1 = require("./contract");
+/** Decision-mode proposal id: one gated call per session. */
+exports.GATE_PROPOSAL_ID = 'call';
+exports.GATE_ACTION_APPROVE = 'macp.gate.approve';
+exports.GATE_ACTION_DENY = 'macp.gate.deny';
+/** How long past `ttl_ms` the gate waits for the runtime before cancelling the session itself. */
+exports.GATE_GRACE_MS = 5_000;
+/** How often the gate re-checks the session state while no envelope arrives. */
+exports.GATE_POLL_MS = 500;
+/** A gated call that cannot go ahead. `code` is a registry error code; the tool error text is `"<code>: <message>"`. */
+class GateRefusal extends Error {
+    code;
+    sessionId;
+    constructor(code, message, sessionId) {
+        super(message);
+        this.code = code;
+        this.sessionId = sessionId;
+        this.name = 'GateRefusal';
+    }
+}
+exports.GateRefusal = GateRefusal;
+/** A refusal whose `"<code>: <message>"` text is exactly the rendered `session.json` template. */
+function refusal(template, vars, sessionId = '') {
+    const text = (0, contract_1.renderRefusal)(template, vars);
+    const at = text.indexOf(': ');
+    return new GateRefusal(text.slice(0, at), text.slice(at + 2), sessionId);
+}
+/** Whether the approvers' ballots settle the call: approve at the bar, deny once it is out of reach. */
+function settle(approvals, cast, approvers, required) {
+    if (approvals >= required)
+        return 'approve';
+    if (approvals + (approvers - cast) < required)
+        return 'deny';
+    return undefined;
+}
+function tracker(projection, client, rule, ballots, isApprove) {
+    const approvers = new Set(rule.participants);
+    return {
+        apply: (envelope) => projection.applyEnvelope(envelope, client.protoRegistry),
+        outcome: () => {
+            // The first ballot per approver counts (session.json): the runtime rejects a second one, and
+            // the SDK projections, keyed by sender, keep the first ballot either way.
+            const counted = [...ballots()].filter((b) => approvers.has(b.sender));
+            const approvals = counted.filter(isApprove).length;
+            return settle(approvals, counted.length, approvers.size, (0, config_1.requiredApprovals)(rule));
+        },
+    };
+}
+class GateApprover {
+    client;
+    settings;
+    clock;
+    constructor(client, settings, clock = Date.now) {
+        this.client = client;
+        this.settings = settings;
+        this.clock = clock;
+    }
+    /** Open a session for `call` under `rule` and wait for it to settle. */
+    async decide(rule, call) {
+        const client = this.client;
+        const options = rule.policy_version ? { policyVersion: rule.policy_version } : {};
+        const ttlMs = rule.ttl_ms ?? config_1.GATE_DEFAULT_TTL_MS;
+        const intent = `Approve MCP tool call ${call.server}/${call.tool}`;
+        const deadline = this.clock() + ttlMs + exports.GATE_GRACE_MS;
+        let session;
+        let track;
+        if (rule.mode === macp_sdk_typescript_1.MODE_QUORUM) {
+            const quorum = new macp_sdk_typescript_1.QuorumSession(client, options);
+            await quorum.start({ intent, participants: rule.participants, ttlMs, contextId: call.contextId });
+            await quorum.requestApproval({
+                requestId: call.contextId,
+                action: `tools/call:${call.tool}`,
+                summary: `${call.server}/${call.tool}`,
+                details: Buffer.from(call.preimage, 'utf8'),
+                requiredApprovals: (0, config_1.requiredApprovals)(rule),
+            });
+            const projection = new macp_sdk_typescript_1.QuorumProjection();
+            track = tracker(projection, this.client, rule, () => projection.ballots.get(call.contextId)?.values() ?? [], (b) => b.vote === 'approve');
+            session = quorum;
+        }
+        else {
+            const decision = new macp_sdk_typescript_1.DecisionSession(client, options);
+            const participants = [this.settings.agentId, ...rule.participants];
+            await decision.start({ intent, participants, ttlMs, contextId: call.contextId });
+            await decision.propose({
+                proposalId: exports.GATE_PROPOSAL_ID,
+                option: `tools/call:${call.tool}`,
+                rationale: call.preimage,
+            });
+            const projection = new macp_sdk_typescript_1.DecisionProjection();
+            track = tracker(projection, this.client, rule, () => projection.votes.get(exports.GATE_PROPOSAL_ID)?.values() ?? [], (v) => v.vote.toUpperCase() === 'APPROVE');
+            session = decision;
+        }
+        return this.watch(session, rule.mode, track, call, deadline);
+    }
+    async state(sessionId) {
+        return (0, bridge_1.stateName)((await this.client.getSession(sessionId)).metadata.state);
+    }
+    async cancel(session, reason) {
+        try {
+            await session.cancel(reason);
+        }
+        catch {
+            // Best effort: the session may already have ended.
+        }
+    }
+    async watch(session, mode, track, call, deadline) {
+        const sessionId = session.sessionId;
+        const notOpen = (state) => refusal('not_open', { session_id: sessionId, state, tool: call.tool }, sessionId);
+        const stream = this.client.openStream();
+        let committing = false;
+        try {
+            await stream.sendSubscribe(sessionId, 0);
+            for (;;) {
+                let envelope = null;
+                try {
+                    envelope = await stream.read(exports.GATE_POLL_MS);
+                }
+                catch (err) {
+                    if (!(err instanceof macp_sdk_typescript_1.MacpTimeoutError))
+                        throw err;
+                }
+                if (!envelope) {
+                    const state = await this.state(sessionId);
+                    if (state !== 'OPEN')
+                        throw notOpen(state);
+                    if (this.clock() >= deadline) {
+                        await this.cancel(session, 'gate deadline passed without a commitment');
+                        throw notOpen(await this.state(sessionId));
+                    }
+                    continue;
+                }
+                if (envelope.sessionId !== sessionId)
+                    continue;
+                track.apply(envelope);
+                if (envelope.messageType === 'Commitment') {
+                    const payload = (0, bridge_1.decodeCommitment)(this.client, Buffer.from(envelope.payload));
+                    const outcome = payload.outcomePositive ? 'approve' : 'deny';
+                    return { session_id: sessionId, mode, outcome, commitment_hash: (0, macp_sdk_typescript_1.commitmentHash)(payload) };
+                }
+                const outcome = committing ? undefined : track.outcome();
+                if (!outcome)
+                    continue;
+                committing = true;
+                try {
+                    await session.commit({
+                        action: outcome === 'approve' ? exports.GATE_ACTION_APPROVE : exports.GATE_ACTION_DENY,
+                        authorityScope: `tools/call:${call.server}/${call.tool}`,
+                        reason: outcome === 'approve' ? 'approvals reached the threshold' : 'the threshold can no longer be reached',
+                        outcomePositive: outcome === 'approve',
+                    });
+                }
+                catch (err) {
+                    if (!(err instanceof macp_sdk_typescript_1.MacpAckError))
+                        throw err;
+                    if (err.failure.code === 'SESSION_NOT_OPEN')
+                        throw notOpen(await this.state(sessionId));
+                    if (err.failure.code === 'POLICY_DENIED') {
+                        // A bound RFC-MACP-0012 policy refused the commitment.
+                        await this.cancel(session, 'commitment refused by the session policy');
+                        throw refusal('policy_denied', { runtime_message: err.failure.message }, sessionId);
+                    }
+                    throw err;
+                }
+                // The Commitment arrives on the stream; the hash is taken from it there.
+            }
+        }
+        finally {
+            stream.close();
+        }
+    }
+}
+exports.GateApprover = GateApprover;
+/** The refusal for a settled `deny`. */
+function denied(commitment, tool) {
+    return refusal('denied', { tool, session_id: commitment.session_id }, commitment.session_id);
+}

package/dist/gate/cli.d.ts

@@ -0,0 +1,14 @@
+/** `macp-mcp gate --policy <gate.json> --upstream <command> [args...]` (flags pinned by `contract/gate/cli.json`). */
+import { type Settings } from '../config';
+export interface GateArgs {
+    policy: string;
+    upstream: {
+        command: string;
+        args: string[];
+    };
+}
+/** Parse the arguments after `gate`. `--upstream` takes the rest of argv as the upstream's command line. */
+export declare function parseGateArgs(argv: string[]): GateArgs;
+/** The upstream's environment: the gate's own, minus the gate's MACP credential. */
+export declare function upstreamEnv(env?: NodeJS.ProcessEnv): Record<string, string>;
+export declare function runGate(argv: string[], settings: Settings): Promise<void>;

package/dist/gate/cli.js

@@ -0,0 +1,71 @@
+"use strict";
+/** `macp-mcp gate --policy <gate.json> --upstream <command> [args...]` (flags pinned by `contract/gate/cli.json`). */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseGateArgs = parseGateArgs;
+exports.upstreamEnv = upstreamEnv;
+exports.runGate = runGate;
+const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
+const stdio_js_1 = require("@modelcontextprotocol/sdk/client/stdio.js");
+const stdio_js_2 = require("@modelcontextprotocol/sdk/server/stdio.js");
+const bridge_1 = require("../bridge");
+const config_1 = require("../config");
+const version_1 = require("../version");
+const approval_1 = require("./approval");
+const config_2 = require("./config");
+const proxy_1 = require("./proxy");
+/** Parse the arguments after `gate`. `--upstream` takes the rest of argv as the upstream's command line. */
+function parseGateArgs(argv) {
+    let policy;
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--upstream') {
+            const [command, ...args] = argv.slice(i + 1);
+            if (!command)
+                throw new config_1.ConfigError('--upstream needs a command');
+            if (!policy)
+                throw new config_1.ConfigError('--policy <gate.json> is required');
+            return { policy, upstream: { command, args } };
+        }
+        if (arg === '--policy') {
+            policy = argv[++i];
+            if (!policy)
+                throw new config_1.ConfigError('--policy needs a file');
+        }
+        else if (arg.startsWith('--policy=')) {
+            policy = arg.slice('--policy='.length);
+        }
+        else {
+            throw new config_1.ConfigError(`unknown gate argument '${arg}'`);
+        }
+    }
+    throw new config_1.ConfigError('--upstream <command> [args...] is required');
+}
+/** The upstream's environment: the gate's own, minus the gate's MACP credential. */
+function upstreamEnv(env = process.env) {
+    const out = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (value !== undefined && key !== 'MACP_AUTH_TOKEN')
+            out[key] = value;
+    }
+    return out;
+}
+async function runGate(argv, settings) {
+    const args = parseGateArgs(argv);
+    const config = (0, config_2.loadGateConfig)(args.policy, settings.agentId);
+    process.stderr.write(`macp-mcp gate: server=${config.server} rules=${config.rules.length} upstream=${args.upstream.command}\n`);
+    const upstream = new index_js_1.Client({ name: 'macp-mcp-gate', version: version_1.VERSION });
+    await upstream.connect(new stdio_js_1.StdioClientTransport({
+        command: args.upstream.command,
+        args: args.upstream.args,
+        env: upstreamEnv(),
+        stderr: 'inherit',
+    }));
+    const client = (0, bridge_1.defaultClientFactory)(settings);
+    const server = (0, proxy_1.buildGateServer)({ config, upstream, approver: new approval_1.GateApprover(client, settings) });
+    const transport = new stdio_js_2.StdioServerTransport();
+    transport.onclose = () => {
+        client.close();
+        void upstream.close();
+    };
+    await server.connect(transport);
+}

package/dist/gate/config.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The gate policy file (`gate.json`): which upstream tool calls need a MACP
+ * session's approval, and how that session is run. Validated against
+ * `contract/gate/gate.schema.json`, shared byte-for-byte with the Python
+ * macp-mcp.
+ */
+import type { MODE_DECISION, MODE_QUORUM } from 'macp-sdk-typescript';
+export type GateMode = typeof MODE_QUORUM | typeof MODE_DECISION;
+export interface GateRule {
+    /** Exact tool name, or a glob where `*` matches any run of characters and `?` one character. */
+    tool: string;
+    mode: GateMode;
+    /** The approvers. */
+    participants: string[];
+    /** Approvals needed; defaults to a strict majority of `participants`. */
+    threshold?: number;
+    ttl_ms?: number;
+    policy_version?: string;
+}
+export interface GateConfig {
+    version: 1;
+    /** The upstream's name, bound into every gated call's context_id. */
+    server: string;
+    rules: GateRule[];
+}
+/** `ttl_ms` when a rule omits it. */
+export declare const GATE_DEFAULT_TTL_MS = 300000;
+/**
+ * Validate a parsed gate policy for the gate acting as `agentId`, beyond the
+ * schema: participants are unique, never the gate itself (it initiates and
+ * commits, it does not approve), and `threshold` is within 1..=participants.
+ */
+export declare function parseGateConfig(raw: unknown, agentId: string): GateConfig;
+export declare function loadGateConfig(file: string, agentId: string): GateConfig;
+/** The first rule whose `tool` matches, or undefined (the call passes through). */
+export declare function matchRule(config: GateConfig, tool: string): GateRule | undefined;
+/** Approvals a rule needs: its `threshold`, else a strict majority of its approvers. */
+export declare function requiredApprovals(rule: GateRule): number;

package/dist/gate/config.js

@@ -0,0 +1,111 @@
+"use strict";
+/**
+ * The gate policy file (`gate.json`): which upstream tool calls need a MACP
+ * session's approval, and how that session is run. Validated against
+ * `contract/gate/gate.schema.json`, shared byte-for-byte with the Python
+ * macp-mcp.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GATE_DEFAULT_TTL_MS = void 0;
+exports.parseGateConfig = parseGateConfig;
+exports.loadGateConfig = loadGateConfig;
+exports.matchRule = matchRule;
+exports.requiredApprovals = requiredApprovals;
+const fs = __importStar(require("node:fs"));
+const _2020_1 = __importDefault(require("ajv/dist/2020"));
+const config_1 = require("../config");
+const contract_1 = require("./contract");
+/** `ttl_ms` when a rule omits it. */
+exports.GATE_DEFAULT_TTL_MS = 300_000;
+/**
+ * Validate a parsed gate policy for the gate acting as `agentId`, beyond the
+ * schema: participants are unique, never the gate itself (it initiates and
+ * commits, it does not approve), and `threshold` is within 1..=participants.
+ */
+function parseGateConfig(raw, agentId) {
+    const ajv = new _2020_1.default({ strict: false, allErrors: true });
+    const validate = ajv.compile((0, contract_1.loadGateSchema)());
+    if (!validate(raw))
+        throw new config_1.ConfigError(`invalid gate policy: ${ajv.errorsText(validate.errors, { dataVar: 'gate' })}`);
+    const config = raw;
+    for (const [i, rule] of config.rules.entries()) {
+        const n = new Set(rule.participants).size;
+        if (n !== rule.participants.length)
+            throw new config_1.ConfigError(`invalid gate policy: rules[${i}] repeats a participant`);
+        if (rule.participants.includes(agentId)) {
+            throw new config_1.ConfigError(`invalid gate policy: rules[${i}].participants includes the gate's own agent id '${agentId}'`);
+        }
+        if (rule.threshold !== undefined && rule.threshold > n) {
+            throw new config_1.ConfigError(`invalid gate policy: rules[${i}].threshold ${rule.threshold} exceeds ${n} participants`);
+        }
+    }
+    return config;
+}
+function loadGateConfig(file, agentId) {
+    let text;
+    try {
+        text = fs.readFileSync(file, 'utf8');
+    }
+    catch (err) {
+        throw new config_1.ConfigError(`cannot read gate policy '${file}': ${err.message}`);
+    }
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (err) {
+        throw new config_1.ConfigError(`gate policy '${file}' is not JSON: ${err.message}`);
+    }
+    return parseGateConfig(raw, agentId);
+}
+function globToRegExp(glob) {
+    const body = glob
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*/g, '.*')
+        .replace(/\?/g, '.');
+    return new RegExp(`^${body}$`, 's');
+}
+/** The first rule whose `tool` matches, or undefined (the call passes through). */
+function matchRule(config, tool) {
+    return config.rules.find((rule) => rule.tool === tool || globToRegExp(rule.tool).test(tool));
+}
+/** Approvals a rule needs: its `threshold`, else a strict majority of its approvers. */
+function requiredApprovals(rule) {
+    return rule.threshold ?? Math.floor(rule.participants.length / 2) + 1;
+}

package/dist/gate/context-id.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The JCS (RFC 8785) form of `{"arguments", "server", "tool"}` for one call.
+ * Approvers see it on the wire (ApprovalRequest.details / Proposal.rationale)
+ * and can recompute the context_id from it.
+ */
+export declare function gatePreimage(server: string, tool: string, args: Record<string, unknown> | undefined): string;
+/** SessionStartPayload.context_id for one call: `sha256:` + lowercase hex SHA-256 of {@link gatePreimage}. */
+export declare function gateContextId(server: string, tool: string, args: Record<string, unknown> | undefined): string;
+export declare function contextIdOf(preimage: string): string;

package/dist/gate/context-id.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gatePreimage = gatePreimage;
+exports.gateContextId = gateContextId;
+exports.contextIdOf = contextIdOf;
+const node_crypto_1 = require("node:crypto");
+const jcs_1 = require("./jcs");
+/**
+ * The JCS (RFC 8785) form of `{"arguments", "server", "tool"}` for one call.
+ * Approvers see it on the wire (ApprovalRequest.details / Proposal.rationale)
+ * and can recompute the context_id from it.
+ */
+function gatePreimage(server, tool, args) {
+    return (0, jcs_1.canonicalize)({ arguments: args ?? {}, server, tool });
+}
+/** SessionStartPayload.context_id for one call: `sha256:` + lowercase hex SHA-256 of {@link gatePreimage}. */
+function gateContextId(server, tool, args) {
+    return contextIdOf(gatePreimage(server, tool, args));
+}
+function contextIdOf(preimage) {
+    return `sha256:${(0, node_crypto_1.createHash)('sha256').update(preimage, 'utf8').digest('hex')}`;
+}

package/dist/gate/contract.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The gate's shared contract (`contract/gate/`), vendored byte-for-byte from
+ * multiagentcoordinationprotocol/macp-mcp like `contract/tools.json`;
+ * `make verify-contract` fails on drift.
+ */
+/** Resolves from both `src/gate/` and `dist/gate/`. */
+export declare const GATE_CONTRACT_DIR: string;
+export declare function loadGateSchema(): object;
+export type GateTemplate = 'denied' | 'policy_denied' | 'not_open' | 'unsafe_integer';
+/** The server identity pinned by `cli.json`. */
+export declare const GATE_SERVER: {
+    name: string;
+    instructions: string;
+};
+/**
+ * Renders a `session.json` refusal template: each `{name}` is replaced
+ * literally, with no other formatting, as the contract requires.
+ */
+export declare function renderRefusal(template: GateTemplate, vars: Record<string, string>): string;

package/dist/gate/contract.js

@@ -0,0 +1,64 @@
+"use strict";
+/**
+ * The gate's shared contract (`contract/gate/`), vendored byte-for-byte from
+ * multiagentcoordinationprotocol/macp-mcp like `contract/tools.json`;
+ * `make verify-contract` fails on drift.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GATE_SERVER = exports.GATE_CONTRACT_DIR = void 0;
+exports.loadGateSchema = loadGateSchema;
+exports.renderRefusal = renderRefusal;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+/** Resolves from both `src/gate/` and `dist/gate/`. */
+exports.GATE_CONTRACT_DIR = path.join(__dirname, '..', '..', 'contract', 'gate');
+function loadGateSchema() {
+    return JSON.parse(fs.readFileSync(path.join(exports.GATE_CONTRACT_DIR, 'gate.schema.json'), 'utf8'));
+}
+function readContract(name) {
+    return JSON.parse(fs.readFileSync(path.join(exports.GATE_CONTRACT_DIR, name), 'utf8'));
+}
+const SESSION = readContract('session.json');
+const CLI = readContract('cli.json');
+/** The server identity pinned by `cli.json`. */
+exports.GATE_SERVER = CLI.server;
+/**
+ * Renders a `session.json` refusal template: each `{name}` is replaced
+ * literally, with no other formatting, as the contract requires.
+ */
+function renderRefusal(template, vars) {
+    return SESSION.refusals.templates[template].replace(/\{([a-z_]+)\}/g, (whole, key) => vars[key] ?? whole);
+}

package/dist/gate/jcs.d.ts

@@ -0,0 +1,18 @@
+/**
+ * RFC 8785 JSON Canonicalization Scheme (JCS) for the gate's context_id.
+ *
+ * JCS is defined on top of ECMAScript's own JSON serialization: strings and
+ * numbers are emitted exactly as `JSON.stringify` emits them (RFC 8785 §3.2.2),
+ * and object members are sorted by their names' UTF-16 code units (§3.2.3),
+ * which is what the default `Array.prototype.sort` comparison does.
+ */
+export declare class CanonicalizationError extends Error {
+    constructor(message: string);
+}
+export declare function canonicalize(value: unknown): string;
+/**
+ * Whether `value` holds, at any depth, an integral number outside ±(2^53−1).
+ * Such a number has no canonical form: JSON.parse may already have rounded it,
+ * so an approver would sign off on a value other than the one forwarded.
+ */
+export declare function hasUnsafeInteger(value: unknown): boolean;