@nyx5/nyx5 0.6.0 → 0.8.0

package/src/puentes/mcp-remoto.js

@@ -0,0 +1,71 @@
+// Nyx5/1 — Puente MCP remoto: el mismo conjunto de herramientas, por Streamable HTTP en /mcp.
+//
+// Es lo que deja a cualquier Claude (claude.ai en el navegador, Desktop, el teléfono) usar Nyx5
+// agregando una URL, sin instalar nada. Cada llamada llega con un token OAuth que apunta a un
+// subagente delegado cuya llave guarda la casa (ver src/puentes/oauth.js); el puente arma ese
+// agente en el mismo proceso y ejecuta la herramienta con él. Nunca con la llave del dueño.
+//
+// Del transporte (MCP 2025-06-18 / 2025-11-25) se usa lo mínimo que un servidor de sólo
+// herramientas necesita: un POST por mensaje JSON-RPC, respuesta application/json, 202 para
+// notificaciones, 405 al GET (no hay flujo iniciado por el servidor) y sin sesión: cada petición
+// trae su token, así que no hay estado que perder entre instancias del edge.
+import { TOOLS, MENSAJERIA, llamar, instrucciones } from './herramientas.js';
+import { validarAcceso } from './oauth.js';
+import { VERSION } from '../version.js';
+
+export const VERSIONES = ['2025-11-25', '2025-06-18', '2025-03-26'];
+const HERRAMIENTAS = TOOLS.filter((t) => MENSAJERIA.has(t.name));
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);
+
+// Un Origin presente tiene que ser un origen real: el spec pide 403 ante uno inválido (protección
+// contra DNS rebinding). No se exige una lista cerrada: la protección de fondo es el token.
+function origenValido(o) {
+  try { const u = new URL(o); return u.protocol === 'https:' || (u.protocol === 'http:' && LOOPBACK.has(u.hostname)); }
+  catch { return false; }
+}
+
+export async function atenderMcp(est, rx) {
+  if (rx.method !== 'POST') return { status: 405, headers: { allow: 'POST' }, body: { reason: 'this MCP endpoint takes POST only; it does not open a server-initiated stream' } };
+  if (rx.headers.origin !== undefined && !origenValido(rx.headers.origin)) return { status: 403, body: { reason: 'invalid Origin header' } };
+  const acceso = await validarAcceso(est, rx);
+  if (!acceso.ok) return acceso.out;
+  const pv = rx.headers['mcp-protocol-version'];
+  if (pv && !VERSIONES.includes(pv)) return { status: 400, body: { jsonrpc: '2.0', id: null, error: { code: -32600, message: `unsupported MCP-Protocol-Version ${pv}; supported: ${VERSIONES.join(', ')}` } } };
+  const sub = acceso.token.sub;
+  if (!await est.remotoRate.allow(`mcp:${sub}`)) return { status: 429, headers: est._retryAfter(), body: { jsonrpc: '2.0', id: null, error: { code: -32000, message: 'too many requests; slow down' } } };
+
+  const msg = rx.body;
+  if (!msg || typeof msg !== 'object' || Array.isArray(msg)) return { status: 400, body: { jsonrpc: '2.0', id: null, error: { code: -32600, message: 'send exactly one JSON-RPC message per POST' } } };
+  // Notificación (sin id) o respuesta del cliente: se acepta y no se contesta nada.
+  if (msg.id === undefined || msg.id === null || typeof msg.method !== 'string') return { status: 202, contentType: 'application/json', body: '' };
+
+  const { id, method, params } = msg;
+  const ok = (result, extra = {}) => ({ status: 200, body: { jsonrpc: '2.0', id, result }, ...extra });
+  switch (method) {
+    case 'initialize': {
+      const pedida = params?.protocolVersion;
+      const propia = `${sub}@${est.domain}`;
+      const contactos = ((await est.store.getAgent(sub))?.inbox?.allowlist || []).filter((x) => x !== propia);
+      return ok({
+        protocolVersion: VERSIONES.includes(pedida) ? pedida : '2025-06-18',
+        capabilities: { tools: { listChanged: false } },
+        serverInfo: { name: 'nyx5', title: 'Nyx5', version: VERSION },
+        instructions: instrucciones({ remoto: true, address: propia, contactos }),
+      });
+    }
+    case 'ping': return ok({});
+    case 'tools/list': return ok({ tools: HERRAMIENTAS });
+    case 'tools/call': {
+      const agent = await est.agenteDeBoveda(sub);
+      if (!agent) return (await validarAcceso(est, { headers: {} })).out;
+      let result;
+      // Un error de la herramienta vuelve como resultado con isError (el modelo puede corregirse),
+      // no como error del protocolo (spec 2025-11-25).
+      try { result = await llamar(agent, params?.name, params?.arguments || {}, { permitidas: MENSAJERIA, esperaMaxS: 90 }); }
+      catch (e) { result = { content: [{ type: 'text', text: `error: ${e.message}` }], isError: true }; }
+      // kick: lo que la herramienta dejó en la cola sale ya, no en el próximo minuto del cron.
+      return ok(result, { kick: true });
+    }
+    default: return { status: 200, body: { jsonrpc: '2.0', id, error: { code: -32601, message: `method not supported: ${method}` } } };
+  }
+}

package/src/puentes/mcp.js

@@ -6,113 +6,19 @@
 
 import readline from 'node:readline';
 import { Agent } from '../correo/agente.js';
+import { TOOLS, llamar, INSTRUCCIONES } from './herramientas.js';
+import { VERSION } from '../version.js';
 
-// La versión la dice el paquete, no un literal: un servidor que reporta una versión que no es
-// la suya hace imposible depurar "en qué versión pasó esto". Si no se puede leer, se declara
-// desconocida en vez de inventar un número.
-let VERSION = '0.0.0-unknown';
-try {
-  const { readFileSync } = await import('node:fs');
-  VERSION = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version || VERSION;
-} catch {}
+export { TOOLS };
 
 const PROTOCOL = '2025-06-18';
 const SUPPORTED = new Set(['2025-06-18', '2025-03-26']);
 
-const TOOLS = [
-  { name: 'nyx5_send', description: 'Delegate a task to another agent even if it is switched off: it waits in their mailbox and their reply reaches you signed when they answer. Use it when you need someone to do something and do not know whether they are available now. The recipient verifies it is really you, and nobody else can read the content (encrypted).',
-    inputSchema: { type: 'object', required: ['to', 'body'], properties: {
-      to: { type: 'array', items: { type: 'string' }, description: 'Direcciones destino, ej. ["asistente@beta.local"]' },
-      body: { description: 'Contenido: texto o JSON' },
-      type: { type: 'string', enum: ['message', 'task', 'result', 'receipt', 'intro'], default: 'message' },
-      thread: { type: 'string' }, in_reply_to: { type: 'string' },
-      aval: { type: 'object', description: 'para entrar a un buzón con lista blanca sin estar en ella: { voucher, bond } de un tercero de la allowlist que te respaldó con una fianza', properties: { voucher: { type: 'string' }, bond: { type: 'string' } } },
-      encrypt: { type: 'boolean', default: true } } } },
-  { name: 'nyx5_inbox', description: 'What others sent you while you were not looking. Every envelope arrives with a verified signature (you know who really sent it) and comes decrypted. Check it when you start and before treating anything as unanswered: a reply may have landed between sessions.',
-    inputSchema: { type: 'object', properties: { limit: { type: 'integer', default: 20 } } } },
-  { name: 'nyx5_ack', description: 'Close the envelopes in your mailbox that you already handled so they stop coming back. Use it after acting on a message; what you acknowledge stays in the record.',
-    inputSchema: { type: 'object', required: ['ids'], properties: { ids: { type: 'array', items: { type: 'string' } } } } },
-  { name: 'nyx5_resolve', description: 'Check who an address really is before trusting it: returns their card, certified by their domain (verified identity, what they can do, how they charge). Use it before sending anything sensitive or paying them.',
-    inputSchema: { type: 'object', required: ['address'], properties: { address: { type: 'string' } } } },
-  { name: 'nyx5_outbox', description: 'What happened to the signed envelopes you sent: delivered, retrying, or bounced with the reason. Use it when you are unsure whether your message arrived; the estafeta records every attempt.',
-    inputSchema: { type: 'object', properties: {} } },
-  { name: 'nyx5_directory', description: 'Which agents a house offers and what each one does, every card certified by the domain. Use it when you are looking for a provider inside a house you already know.',
-    inputSchema: { type: 'object', properties: { house: { type: 'string' }, capability: { type: 'string' }, accepts: { type: 'string' }, q: { type: 'string' }, limit: { type: 'integer' } } } },
-  { name: 'nyx5_search', description: 'Find an agent that does what you need in any house, not just yours. Use it when you know nobody who solves your problem. The index answers signed and you verify the card before trusting: it is a hint, not an authority.',
-    inputSchema: { type: 'object', required: ['index'], properties: { index: { type: 'string', description: 'dominio de la casa del índice, o URL' }, q: { type: 'string' }, capability: { type: 'string' }, accepts: { type: 'string' }, house: { type: 'string' }, limit: { type: 'integer' } } } },
-  // ----- Libro -----
-  { name: 'nyx5_quote', description: 'Offer another agent a service with a price and the exact condition that must be met to get paid. In escrow the payment is held until the proof passes. Use it to sell something with an agreement that carries weight, not a spoken promise.',
-    inputSchema: { type: 'object', required: ['to', 'price', 'concept'], properties: {
-      to: { type: 'string' }, contract: { type: 'string', enum: ['spot', 'escrow', 'metered'], default: 'spot' },
-      price: { type: 'integer', description: 'tokens, entero' }, concept: { type: 'string' },
-      terms: { type: 'object', description: 'criterio de aceptación, plazo, scope del mandato, etc.' },
-      arbiter: { type: 'string' }, expires: { type: 'string', description: 'ISO-8601' },
-      referrer: { type: 'object', description: 'comisión de referido: { address, share } en basis points; la paga el vendedor de su parte, el comprador paga igual', properties: { address: { type: 'string' }, share: { type: 'integer' } } } } } },
-  { name: 'nyx5_accept', description: 'Accept an offer and commit the payment. In escrow the money is held: the seller does not get paid until they deliver and meet the condition. You receive a signed receipt that no party can deny later.',
-    inputSchema: { type: 'object', required: ['quote'], properties: { quote: { type: 'object' } } } },
-  { name: 'nyx5_libro', description: 'Move a deal forward in the ledger, leaving a signed and irreversible entry at every step: deliver, release the payment if the proof passed, refund if it failed, back a claim with money (you lose it if you lied), or delegate spending with a cap. ops: deliver {contract, evidence_sha256}, release {contract}, refund {contract}, bond {amount, claim, verifier}, forfeit {contract, reason}, mandate {grantee, cap, scope, expires, parent}, charge {mandate, amount, concept}, revoke {mandate}, balance, statement {limit}, contract {contract}. The answer arrives as a signed receipt in your mailbox.',
-    inputSchema: { type: 'object', required: ['op'], properties: { house: { type: 'string', description: 'dominio de la casa; por defecto el propio' }, op: { type: 'string' }, args: { type: 'object' } } } },
-  { name: 'nyx5_balance', description: 'How much you hold, which contracts and which spending permissions are active. Check it before committing a payment. A direct read authenticated with your signature, without going through the mail.',
-    inputSchema: { type: 'object', properties: { house: { type: 'string' } } } },
-  { name: 'nyx5_remind', description: 'Leave yourself a message that reaches you in the future, in your own mailbox, encrypted. Use it when a task must be picked up in hours or days and your session will end before then: your future self finds the context with the full thread, without depending on anyone waking you.',
-    inputSchema: { type: 'object', required: ['cuando', 'body'], properties: { cuando: { type: 'string', description: 'ISO-8601: cuándo debe llegarte' }, body: { description: 'lo que tu yo futuro necesita saber' }, thread: { type: 'string' } } } },
-  { name: 'nyx5_contract', description: 'The state and full history of a deal you are party to: every step with its hash and its signature. Use it to see where an escrow or a bond stands.',
-    inputSchema: { type: 'object', required: ['contract'], properties: { house: { type: 'string' }, contract: { type: 'string' } } } },
-  { name: 'nyx5_historial', description: 'The reputation of an agent is its ledger: deliveries accepted against returned, bonds standing against forfeited, with amounts. Check it before hiring a stranger. Every point of it cost tokens and is tied to a verified delivery, so it cannot be inflated by talking; with no record it returns null (nothing yet, not perfect).',
-    inputSchema: { type: 'object', properties: { address: { type: 'string', description: 'a quién mirar; por defecto, tú mismo' } } } },
-  { name: 'nyx5_tareas', description: 'Paid work a house publishes that you can take right now: what to do, what it pays, and the deterministic check it will be verified with. Use it when you just joined and have no record yet, or when you need tokens to back your own claims with a bond.',
-    inputSchema: { type: 'object', properties: { house: { type: 'string' } } } },
-  { name: 'nyx5_tomar', description: 'Take a published task: the house holds the payment in a signed entry before you work, and releases it on its own when the deterministic check passes. If it fails, it is refunded and stays in your record. Use it to earn your first tokens; terms are copied from the catalogue and are not negotiable.',
-    inputSchema: { type: 'object', required: ['id'], properties: { id: { type: 'string', description: 'id de la tarea, de nyx5_tareas' }, house: { type: 'string' } } } },
-  { name: 'nyx5_email', description: 'Write by email to a human who is not on Nyx5 yet. Use it when the recipient has no agent address: their reply comes back to your mailbox (Reply-To). It enters unsigned, marked as not verified, never disguised; when they want the real thing, they register.',
-    inputSchema: { type: 'object', required: ['to', 'body'], properties: { to: { type: 'string', description: 'dirección de correo, ej. persona@gmail.com' }, subject: { type: 'string' }, body: { description: 'el texto del correo' } } } },
-];
-
 export async function runMcpServer({ agentFile, hosts = {} }) {
   const agent = await Agent.load(agentFile, { hosts });
   const out = (msg) => process.stdout.write(JSON.stringify(msg) + '\n');
   const text = (v) => ({ content: [{ type: 'text', text: typeof v === 'string' ? v : JSON.stringify(v, null, 2) }] });
-
-  async function call(name, args = {}) {
-    switch (name) {
-      case 'nyx5_send': { const r = await agent.send({ to: args.to, body: args.body, type: args.type, thread: args.thread, inReplyTo: args.in_reply_to, encrypt: args.encrypt ?? true, extensions: args.aval ? { 'urn:nyx5:ext:aval': args.aval } : undefined }); return text({ id: r.id, jobs: r.jobs }); }
-      case 'nyx5_inbox': {
-        const msgs = await agent.inbox({ limit: args.limit ?? 20 });
-        const opened = [];
-        for (const m of msgs) { try { opened.push(await agent.open(m.envelope)); } catch (e) { opened.push({ id: m.envelope.id, from: m.envelope.from, error: e.message }); } }
-        return text(opened.map(({ sender, ...o }) => o));
-      }
-      case 'nyx5_ack': return text({ acked: await agent.ack(args.ids) });
-      case 'nyx5_resolve': { const { _domain, ...card } = await agent.resolver.agentCard(args.address); return text(card); }
-      case 'nyx5_outbox': return text(await agent.outbox());
-      case 'nyx5_directory': return text(await agent.directory(args.house, args));
-      case 'nyx5_search': return text(await agent.search(args.index, args));
-      case 'nyx5_quote': { const r = await agent.quote({ to: args.to, contract: args.contract, price: args.price, concept: args.concept, terms: args.terms, arbiter: args.arbiter, expires: args.expires, referrer: args.referrer }); return text({ id: r.id, quote_id: r.quote.id, contract: r.quote.contract, price: r.quote.price }); }
-      case 'nyx5_accept': { const r = await agent.accept(args.quote); return text({ id: r.id, note: 'el recibo de libro@ llegará al buzón (nyx5_inbox)' }); }
-      case 'nyx5_libro': { const r = await agent.libroOp(args.house || agent.domain, { op: args.op, ...(args.args || {}) }); return text({ id: r.id, note: 'la respuesta llega como recibo de libro@ al buzón' }); }
-      case 'nyx5_balance': return text(await agent.balance(args.house));
-      case 'nyx5_remind': { const r = await agent.recordar({ cuando: args.cuando, body: args.body, thread: args.thread }); return text({ id: r.id, note: `te llegará a tu buzón el ${args.cuando}` }); }
-      case 'nyx5_historial': return text(await agent.historial(args.address || agent.address));
-      case 'nyx5_tareas': {
-        const dc = await agent.resolver.domainCard(args.house || agent.domain);
-        const res = await agent.fetch(`${dc._estafeta}/tareas`);
-        const j = await res.json();
-        if (!res.ok) return text({ error: j.reason || `HTTP ${res.status}` });
-        return text(j);
-      }
-      case 'nyx5_tomar': {
-        const dc = await agent.resolver.domainCard(args.house || agent.domain);
-        const j = await (await agent.fetch(`${dc._estafeta}/tareas`)).json();
-        const t = (j.tasks || j.tareas || []).find((x) => x.id === args.id);
-        if (!t) return text({ error: `no task with id ${args.id}`, available: (j.tasks || j.tareas || []).map((x) => x.id) });
-        const enviada = await agent.quote({ to: (j.desk || j.mostrador), contract: 'escrow', price: t.price, concept: t.concept, arbiter: (j.arbiter || j.arbitro), terms: t.terms });
-        return text({ enviada: enviada.id, tarea: t.id, price: t.price, siguiente: 'si hay cupo, el contrato te llega al buzón (nyx5_inbox); al terminar, nyx5_libro op=deliver' });
-      }
-      case 'nyx5_email': { const r = await agent.email({ to: args.to, subject: args.subject, body: args.body }); return text(r); }
-      case 'nyx5_contract': return text(await agent.contract(args.house || agent.domain, args.contract));
-      default: return { ...text(`herramienta desconocida: ${name}`), isError: true };
-    }
-  }
+  const call = (name, args) => llamar(agent, name, args);
 
   const rl = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });
   for await (const line of rl) {
@@ -123,7 +29,7 @@ export async function runMcpServer({ agentFile, hosts = {} }) {
     if (method === 'notifications/initialized' || method?.startsWith('notifications/')) continue;
     try {
       let result;
-      if (method === 'initialize') result = { protocolVersion: SUPPORTED.has(params?.protocolVersion) ? params.protocolVersion : PROTOCOL, capabilities: { tools: { listChanged: false } }, serverInfo: { name: 'nyx5', version: VERSION }, instructions: `Nyx5 gives an agent three things it has no other way of getting: an address of its own, a mailbox that holds while it is off, and a ledger where an agreement carries weight (payment is held until the proof passes; a false claim forfeits its bond). Use it to reach an agent that may not be available now, to find someone who does X in any house, or to close a deal that must be worth more than a promise. Before trusting a stranger, read their record: it is a query on the ledger, so every point of it cost tokens. Every message is signed and every movement of money leaves a receipt no party can deny.` };
+      if (method === 'initialize') result = { protocolVersion: SUPPORTED.has(params?.protocolVersion) ? params.protocolVersion : PROTOCOL, capabilities: { tools: { listChanged: false } }, serverInfo: { name: 'nyx5', version: VERSION }, instructions: INSTRUCCIONES };
       else if (method === 'ping') result = {};
       else if (method === 'tools/list') result = { tools: TOOLS };
       else if (method === 'tools/call') { try { result = await call(params?.name, params?.arguments); } catch (e) { result = { ...text(`error: ${e.message}`), isError: true }; } }

package/src/puentes/oauth.js

@@ -0,0 +1,361 @@
+// Nyx5/1 — Servidor de autorización OAuth 2.1 para el conector MCP remoto.
+//
+// Para qué existe: que el Claude de un teléfono (claude.ai web, Desktop, móvil) use Nyx5 sin
+// instalar nada y SIN copiar la llave de nadie. El dueño autoriza desde su navegador, donde vive su
+// llave raíz, y esa llave firma una delegación para un SUBAGENTE: claude.<dueño>@<casa>. La casa
+// guarda la llave de ese subagente, y sólo la de ese, cifrada en la bóveda. El subagente:
+//   - sólo manda y lee mensajes: no opera el Libro ni paga estampillas (scope.messages_only);
+//   - vence (30 días) y el dueño lo revoca desde su teléfono cuando quiera;
+//   - lo declara en su tarjeta (custody.keys = house): quien le escribe sabe que la casa puede leer
+//     lo que le llega, porque la casa tiene su llave.
+// Aprobado por Nicholas el 10-sep-2026 con esos tres límites.
+//
+// Lo que se cumple del spec (MCP 2025-06-18 y 2025-11-25) y de lo que Claude exige en la práctica:
+//   RFC 9728 metadatos del recurso · RFC 8414 metadatos del servidor · RFC 7591 registro dinámico
+//   PKCE S256 obligatorio · RFC 8707 `resource` amarrado al token · refresh con rotación (Claude es
+//   cliente público) · /oauth/token acepta form-urlencoded · errores RFC 6749 (`invalid_grant`).
+import { createHash, randomBytes } from 'node:crypto';
+import { b64u, generateKeys, verifyObject } from '../nucleo/crypto.js';
+import { parseAddress } from '../correo/resolver.js';
+
+export const ALCANCE = 'messages';
+const DIA = 86_400_000;
+const sha = (s) => createHash('sha256').update(String(s)).digest('hex');
+const aleatorio = () => b64u(randomBytes(32));
+const s256 = (verifier) => b64u(createHash('sha256').update(String(verifier)).digest());
+const iso = (t = Date.now()) => new Date(t).toISOString();
+const err = (status, error, error_description) => ({ status, body: { error, error_description } });
+
+export function urlsDe(est, ruta = '/mcp') {
+  const base = est.publicUrl.replace(/\/+$/, '');
+  return { base, recurso: `${base}${ruta}`, prm: `${base}/.well-known/oauth-protected-resource${ruta}` };
+}
+// Una invitación viaja DENTRO de la URL del conector: /mcp/i/<código>. Claude la devuelve sola como
+// `resource` al pedir autorización, así que la pantalla de consentimiento sabe quién invitó sin
+// depender de lo que haya guardado el navegador (en iPhone, la ventana de autorización y Safari
+// pueden no compartir almacenamiento). La URL sigue siendo el conector de la persona para siempre,
+// aunque la invitación ya se haya usado: el código sólo decide el prellenado, no el acceso.
+export const RUTA_INVITACION = /^\/mcp\/i\/([A-Za-z0-9_-]{16,64})$/;
+
+export function metadatosRecurso(est, ruta = '/mcp') {
+  const { base, recurso } = urlsDe(est, ruta);
+  return { resource: recurso, authorization_servers: [base], bearer_methods_supported: ['header'], scopes_supported: [ALCANCE], resource_name: `Nyx5 (${est.domain})`, resource_documentation: `${base}/spec` };
+}
+
+export function metadatosServidor(est) {
+  const { base } = urlsDe(est);
+  return {
+    issuer: base,
+    authorization_endpoint: `${base}/oauth/authorize`,
+    token_endpoint: `${base}/oauth/token`,
+    registration_endpoint: `${base}/oauth/register`,
+    response_types_supported: ['code'],
+    grant_types_supported: ['authorization_code', 'refresh_token'],
+    code_challenge_methods_supported: ['S256'],
+    token_endpoint_auth_methods_supported: ['none'],
+    scopes_supported: [ALCANCE, 'offline_access'],
+    service_documentation: `${base}/spec`,
+  };
+}
+
+// ---------- URIs de retorno ----------
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);
+function redirectValida(u) {
+  let x; try { x = new URL(u); } catch { return false; }
+  if (x.hash) return false;
+  if (x.protocol === 'https:') return true;
+  return x.protocol === 'http:' && LOOPBACK.has(x.hostname);
+}
+// Exacta, salvo en loopback: ahí el puerto lo elige el cliente en cada sesión (RFC 8252 §7.3), y
+// Claude Code declara http://localhost/callback sin puerto.
+function coincideRedirect(registradas, pedida) {
+  if (registradas.includes(pedida)) return true;
+  let p; try { p = new URL(pedida); } catch { return false; }
+  if (p.protocol !== 'http:' || !LOOPBACK.has(p.hostname)) return false;
+  return registradas.some((r) => {
+    try { const u = new URL(r); return u.protocol === 'http:' && u.hostname === p.hostname && u.pathname === p.pathname && u.search === p.search; }
+    catch { return false; }
+  });
+}
+
+function normalizarUrl(u) {
+  try { const x = new URL(u); if (x.hash) return null; return `${x.protocol.toLowerCase()}//${x.host.toLowerCase()}${x.pathname.replace(/\/+$/, '')}${x.search}`; }
+  catch { return null; }
+}
+// La ruta de NUESTRO recurso a la que apunta una URL (el conector, el de una invitación, o la casa
+// misma), o null si no es nuestra. El token vale sólo para nuestros recursos (RFC 8707).
+export function rutaDeRecurso(est, r) {
+  const n = normalizarUrl(r);
+  const b = normalizarUrl(urlsDe(est).base);
+  if (!n || !b) return null;
+  if (n === b) return '/mcp';
+  if (!n.startsWith(`${b}/`)) return null;
+  const ruta = n.slice(b.length);
+  return ruta === '/mcp' || RUTA_INVITACION.test(ruta) ? ruta : null;
+}
+export function recursoValido(est, r) {
+  if (r == null || r === '') return true;
+  return rutaDeRecurso(est, r) !== null;
+}
+
+// ---------- registro dinámico de clientes (RFC 7591) ----------
+export async function registrar(est, body, ip) {
+  if (!await est.remotoRate.allow(`dcr:${ip || 'x'}`)) return err(429, 'invalid_client_metadata', 'too many client registrations from this address; try again in a minute');
+  const b = body && typeof body === 'object' ? body : {};
+  const uris = b.redirect_uris;
+  if (!Array.isArray(uris) || !uris.length || uris.length > 5 || !uris.every((u) => typeof u === 'string' && u.length <= 512 && redirectValida(u))) {
+    return err(400, 'invalid_redirect_uri', 'redirect_uris: 1 to 5 URIs, https or loopback http, without fragment');
+  }
+  const grants = b.grant_types ?? ['authorization_code', 'refresh_token'];
+  if (!Array.isArray(grants) || !grants.every((g) => g === 'authorization_code' || g === 'refresh_token')) return err(400, 'invalid_client_metadata', 'grant_types: only authorization_code and refresh_token');
+  const respuestas = b.response_types ?? ['code'];
+  if (!Array.isArray(respuestas) || respuestas.some((r) => r !== 'code')) return err(400, 'invalid_client_metadata', 'response_types: only code');
+  const nombre = typeof b.client_name === 'string' ? b.client_name.replace(/[\u0000-\u001f<>"]/g, '').trim().slice(0, 80) : '';
+  const cliente = {
+    client_id: `nyx5c_${aleatorio()}`,
+    client_id_issued_at: Math.floor(Date.now() / 1000),
+    redirect_uris: uris,
+    grant_types: grants,
+    response_types: ['code'],
+    // Siempre público: Claude se registra así y PKCE es lo que protege el canje.
+    token_endpoint_auth_method: 'none',
+    ...(nombre ? { client_name: nombre } : {}),
+  };
+  await est.store.kvPut('cliente', cliente.client_id, cliente, Date.now() + 90 * DIA);
+  return { status: 201, body: cliente };
+}
+
+// ---------- la solicitud de autorización ----------
+async function validarPedido(est, q) {
+  const g = (k) => { const v = q instanceof URLSearchParams ? q.get(k) : q?.[k]; return typeof v === 'string' ? v : null; };
+  const client_id = g('client_id');
+  const cliente = client_id ? await est.store.kvGet('cliente', client_id) : null;
+  if (!cliente) return { ok: false, redirigible: false, error: 'invalid_client', description: 'unknown client_id: register the client first' };
+  let redirect_uri = g('redirect_uri');
+  if (!redirect_uri && cliente.redirect_uris.length === 1) redirect_uri = cliente.redirect_uris[0];
+  if (!redirect_uri || !coincideRedirect(cliente.redirect_uris, redirect_uri)) return { ok: false, redirigible: false, error: 'invalid_request', description: 'redirect_uri does not match any registered for this client' };
+  const state = g('state');
+  const pedido = { client_id, cliente, redirect_uri, state: state && state.length <= 1024 ? state : null };
+  const mal = (error, description) => ({ ok: false, redirigible: true, error, description, pedido });
+  if (g('response_type') !== 'code') return mal('unsupported_response_type', 'only response_type=code');
+  const reto = g('code_challenge');
+  if (!reto || !/^[A-Za-z0-9_-]{43,128}$/.test(reto) || g('code_challenge_method') !== 'S256') return mal('invalid_request', 'PKCE with code_challenge_method=S256 is required');
+  const resource = g('resource');
+  if (!recursoValido(est, resource)) return mal('invalid_target', `this server only issues tokens for ${urlsDe(est).recurso}`);
+  // Una invitación vigente y sin usar prellena la pantalla. Sale del recurso, no del navegador.
+  let invitacion = null;
+  const mi = RUTA_INVITACION.exec(resource ? rutaDeRecurso(est, resource) || '' : '');
+  if (mi) { const inv = await est.store.kvGet('invitacion', mi[1]); if (inv && !inv.used_by) invitacion = inv; }
+  return { ok: true, pedido: { ...pedido, code_challenge: reto, resource: resource || urlsDe(est).recurso, scope: ALCANCE, invitacion } };
+}
+
+const escapar = (s) => String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+function paginaError(texto) {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Nyx5 · authorization</title><style>body{font:16px/1.5 -apple-system,system-ui,sans-serif;max-width:480px;margin:3rem auto;padding:0 1.2rem;color:#1A1712}h1{font-family:Georgia,serif;font-weight:400}</style></head><body><h1>This authorization cannot continue</h1><p>${escapar(texto)}</p><p>Go back to Claude and add the connector again.</p></body></html>`;
+}
+function volver(redirect_uri, params) {
+  const u = new URL(redirect_uri);
+  for (const [k, v] of Object.entries(params)) if (v != null) u.searchParams.set(k, v);
+  return { status: 302, headers: { location: u.toString() }, contentType: 'text/plain; charset=utf-8', body: '' };
+}
+
+// El nombre que sugiere una invitación se mira AL MOSTRAR, no al crearla: puede tomarse entre medio.
+// Defecto real (11-sep-2026): la invitación de la Pauli prellenaba "pauli", que existía desde el 7-sep,
+// y su primer toque en "Connect" iba a rebotar con "that name is taken".
+async function sugerible(est, hint) {
+  return hint && (await est.nombreDisponible(hint)) ? hint : null;
+}
+
+// GET /oauth/authorize: la pantalla de consentimiento es la misma app, en modo "autorizar". La
+// solicitud llega VALIDADA a la página: el navegador nunca decide a qué URI se redirige.
+export async function paginaAutorizar(est, query, appHtml) {
+  const v = await validarPedido(est, query);
+  if (!v.ok && !v.redirigible) return { status: 400, contentType: 'text/html; charset=utf-8', body: paginaError(v.description) };
+  if (!v.ok) return volver(v.pedido.redirect_uri, { error: v.error, error_description: v.description, state: v.pedido.state });
+  const p = v.pedido;
+  const destino = new URL(p.redirect_uri);
+  const datos = {
+    client_id: p.client_id, redirect_uri: p.redirect_uri, state: p.state, code_challenge: p.code_challenge, resource: p.resource,
+    client_name: p.cliente.client_name || null, redirect_host: destino.host,
+    // El spec pide mostrar con claridad a dónde vuelve el permiso, y advertir si es sólo loopback.
+    loopback: LOOPBACK.has(destino.hostname), house: est.domain, days: est.remoto.dias,
+    invite: p.invitacion ? { inviter: p.invitacion.inviter, inviter_claude: p.invitacion.inviter_claude || null, contacts: p.invitacion.contacts || [], name_hint: await sugerible(est, p.invitacion.name_hint) } : null,
+  };
+  const inyectado = `<script>window.NYX5_OAUTH=${JSON.stringify(datos).replace(/</g, '\\u003c')}</script>`;
+  return { status: 200, contentType: 'text/html; charset=utf-8', body: appHtml.replace('<!--OAUTH-->', inyectado) };
+}
+
+const nombreSub = (raiz) => { const n = `claude.${raiz}`; return n.length <= 64 ? n : null; };
+const DOMINIO = /^(?=.{1,253}$)([a-z0-9-]{1,63}\.)+[a-z]{2,63}$/;
+function listaDeEscritura(entrada, dueno, propia) {
+  if (entrada === 'open') return null;
+  const lista = new Set([dueno, propia]);
+  for (const x of (Array.isArray(entrada) ? entrada : []).slice(0, 50)) {
+    const v = String(x || '').trim().toLowerCase();
+    if (!v) continue;
+    if (v.includes('@')) { try { parseAddress(v); } catch { throw Object.assign(new Error(`not a valid address: ${v}`), { status: 400 }); } lista.add(v); }
+    else if (DOMINIO.test(v)) lista.add(v);
+    else throw Object.assign(new Error(`not an address or a domain: ${v}`), { status: 400 });
+  }
+  return [...lista];
+}
+
+// POST /oauth/prepare (firmado por la llave raíz del dueño): la casa entrega la llave PÚBLICA del
+// subagente para que el navegador firme la delegación. Si ese Claude ya existe y está vigente, se
+// reusa: autorizar desde otro dispositivo no debe cambiarle la identidad a tu Claude.
+export async function preparar(est, rx) {
+  const who = await est._authenticate(rx, rx.path);
+  if (who.record.delegation) return { status: 403, body: { reason: 'a delegated address cannot authorize another one; use your own address' } };
+  const v = await validarPedido(est, rx.body || {});
+  if (!v.ok) return { status: 400, body: { reason: v.description } };
+  const sub = nombreSub(who.local);
+  if (!sub) return { status: 400, body: { reason: 'your address is too long to hold a Claude subaddress' } };
+  let keys = await est.llavesDeBoveda(sub);
+  if (!keys) {
+    const pend = await est.store.kvGet('pendiente', sub);
+    if (pend) { try { keys = est.boveda.abrir(pend.sellado, sub); } catch { keys = null; } }
+    if (!keys) {
+      keys = generateKeys();
+      await est.store.kvPut('pendiente', sub, { sellado: est.boveda.sellar(keys, sub), root: who.address }, Date.now() + 15 * 60_000);
+    }
+  }
+  return {
+    status: 200,
+    body: {
+      address: `${sub}@${est.domain}`, sig: keys.sig, enc: keys.enc, parent: who.address,
+      scope: { messages_only: true }, valid_until: iso(Date.now() + est.remoto.dias * DIA),
+      client_name: v.pedido.cliente.client_name || null, redirect_host: new URL(v.pedido.redirect_uri).host,
+    },
+  };
+}
+
+// POST /oauth/approve (firmado por la llave raíz): la delegación que firmó el navegador se inscribe,
+// la llave del subagente pasa de "pendiente" a la bóveda, y sale el código de un uso.
+export async function aprobar(est, rx) {
+  const who = await est._authenticate(rx, rx.path);
+  if (who.record.delegation) return { status: 403, body: { reason: 'a delegated address cannot authorize another one; use your own address' } };
+  const b = rx.body || {};
+  const v = await validarPedido(est, b);
+  if (!v.ok) return { status: 400, body: { reason: v.description } };
+  const sub = nombreSub(who.local);
+  const address = `${sub}@${est.domain}`;
+  let keys = await est.llavesDeBoveda(sub);
+  let dePendiente = false;
+  if (!keys) {
+    const pend = await est.store.kvGet('pendiente', sub);
+    if (pend) { try { keys = est.boveda.abrir(pend.sellado, sub); dePendiente = true; } catch { keys = null; } }
+  }
+  if (!keys) return { status: 400, body: { reason: 'this authorization expired; add the connector again from Claude' } };
+  // La delegación la firma el navegador del dueño con su llave raíz. La casa no puede fabricarla.
+  const d = b.delegation;
+  if (!d || d.by !== who.address || d.address !== address || d.sig !== keys.sig || d.scope?.messages_only !== true || !verifyObject(d, who.record.sig)) {
+    return { status: 400, body: { reason: 'the delegation must be signed by your own key, for this address and this key, and limited to messages' } };
+  }
+  const tope = Date.now() + est.remoto.dias * DIA + 5 * 60_000;
+  if (!d.valid_until || Number.isNaN(Date.parse(d.valid_until)) || Date.parse(d.valid_until) > tope || Date.parse(d.valid_until) < Date.now()) {
+    return { status: 400, body: { reason: `valid_until must be in the future and at most ${est.remoto.dias} days away` } };
+  }
+  let allowlist = listaDeEscritura(b.allowlist, who.address, address);
+  // Reconectar no borra contactos (12-sep-2026). La pantalla viene marcada en "sólo tú", y quien
+  // reconectaba su Claude perdía a quienes podían escribirle: a Basti le habría cortado las respuestas
+  // del agente de Sigo. Si ya había una lista viva, se suma a la nueva; "cualquiera" sigue abierto.
+  const previo = await est.store.getAgent(sub);
+  if (allowlist && previo?.inbox?.policy === 'allowlist' && !previo.revoked) allowlist = [...new Set([...allowlist, ...(previo.inbox.allowlist || [])])];
+  // Invitación: se toma en UN paso (dos aprobaciones simultáneas no la usan las dos) y sus contactos
+  // entran a la lista. Quién invitó lo dice la casa, no el navegador.
+  let inv = v.pedido.invitacion ? await est.store.kvTake('invitacion', v.pedido.invitacion.code) : null;
+  if (inv && inv.inviter === who.address) { await est.store.kvPut('invitacion', inv.code, inv, Date.parse(inv.expires)); inv = null; }
+  if (inv && allowlist) allowlist = [...new Set([...allowlist, inv.inviter, ...(inv.inviter_claude ? [inv.inviter_claude] : []), ...(inv.contacts || [])])];
+  const card = await est.registerAgent({
+    local: sub, sig: keys.sig, enc: keys.enc, delegation: d, valid_until: d.valid_until,
+    capabilities: { accepts: ['text/plain', 'application/json'] },
+    inbox: allowlist ? { policy: 'allowlist', allowlist } : { policy: 'open' },
+    custody: { keys: 'house', via: 'oauth', since: iso() },
+  });
+  await est.store.kvPut('boveda', sub, { sellado: est.boveda.sellar(keys, sub), root: who.address, since: iso() });
+  if (dePendiente) await est.store.kvDelete('pendiente', sub);
+  if (inv) {
+    // El contacto queda en los dos sentidos: el Claude de quien invitó acepta al nuevo. Sin esto, la
+    // primera respuesta del Claude invitado rebotaba contra la lista del que invitó.
+    await est.store.kvPut('invitacion', inv.code, { ...inv, used_by: who.address, used_at: iso(), claude: address }, Date.now() + 30 * DIA);
+    for (const c of [inv.inviter_claude, ...(inv.contacts || [])].filter(Boolean)) await est.agregarContactos(parseAddress(c).local, [address, who.address]);
+    await est._evento('invitation_accepted', who.address, { by: inv.inviter });
+  }
+  const code = aleatorio();
+  const p = v.pedido;
+  await est.store.kvPut('codigo', sha(code), { client_id: p.client_id, redirect_uri: p.redirect_uri, code_challenge: p.code_challenge, resource: p.resource, scope: p.scope, sub, root: who.address }, Date.now() + 5 * 60_000);
+  await est._evento('connector_authorized', who.address, { client: p.cliente.client_name || null, open: !allowlist });
+  // Embudo (NX-801), etapa 3: el Claude del dueño quedó conectado. `code` enlaza este recorrido con
+  // el `open_invite` del enlace que lo trajo (y con su fuente); sin invitación, ambos van en null.
+  await est._evento('claude_connected', who.address, { invited_by: inv?.inviter || null, code: inv?.code || null });
+  const u = new URL(p.redirect_uri);
+  u.searchParams.set('code', code);
+  if (p.state) u.searchParams.set('state', p.state);
+  return { status: 200, body: { redirect: u.toString(), address: card.address, invited_by: inv?.inviter || null } };
+}
+
+// ---------- /oauth/token ----------
+async function vigente(est, sub) {
+  const card = await est.store.getAgent(sub);
+  if (!card || card.revoked || (card.valid_until && Date.parse(card.valid_until) <= Date.now())) return null;
+  if (!(await est.store.kvGet('boveda', sub))) return null;
+  return card;
+}
+
+async function emitir(est, base, cliente) {
+  const card = await vigente(est, base.sub);
+  if (!card) return err(400, 'invalid_grant', 'this Claude address was revoked or expired; authorize the connector again');
+  const acceso = aleatorio(), refresco = aleatorio();
+  const doc = { sub: base.sub, root: base.root, client_id: base.client_id, resource: base.resource, scope: ALCANCE };
+  const hasta = Math.min(Date.now() + est.remoto.refrescoMs, card.valid_until ? Date.parse(card.valid_until) : Infinity);
+  await est.store.kvPut('acceso', sha(acceso), doc, Date.now() + est.remoto.accesoS * 1000);
+  await est.store.kvPut('refresco', sha(refresco), doc, hasta);
+  // El cliente vive mientras se usa: uno que refresca no debe vencer a los 90 días de registrado.
+  await est.store.kvPut('cliente', cliente.client_id, cliente, Date.now() + 90 * DIA);
+  return { status: 200, headers: { pragma: 'no-cache' }, body: { access_token: acceso, token_type: 'Bearer', expires_in: est.remoto.accesoS, refresh_token: refresco, scope: ALCANCE } };
+}
+
+export async function token(est, body) {
+  const b = body && typeof body === 'object' ? body : {};
+  const cliente = typeof b.client_id === 'string' ? await est.store.kvGet('cliente', b.client_id) : null;
+  if (b.grant_type === 'authorization_code') {
+    if (!cliente) return err(401, 'invalid_client', 'unknown client_id');
+    if (!b.code || !b.code_verifier) return err(400, 'invalid_request', 'code and code_verifier are required');
+    const c = await est.store.kvTake('codigo', sha(b.code)); // un solo uso
+    if (!c) return err(400, 'invalid_grant', 'the code is invalid, expired or already used');
+    if (c.client_id !== b.client_id) return err(400, 'invalid_grant', 'the code was issued to another client');
+    if (b.redirect_uri && b.redirect_uri !== c.redirect_uri) return err(400, 'invalid_grant', 'redirect_uri does not match the authorization request');
+    if (s256(b.code_verifier) !== c.code_challenge) return err(400, 'invalid_grant', 'PKCE verification failed');
+    if (b.resource && !recursoValido(est, b.resource)) return err(400, 'invalid_target', 'token requested for another resource');
+    return emitir(est, c, cliente);
+  }
+  if (b.grant_type === 'refresh_token') {
+    if (!cliente) return err(401, 'invalid_client', 'unknown client_id');
+    // Rotación: el refresco viejo muere en el mismo paso en que nace el nuevo.
+    const r = b.refresh_token ? await est.store.kvTake('refresco', sha(b.refresh_token)) : null;
+    if (!r || r.client_id !== b.client_id) return err(400, 'invalid_grant', 'the refresh token is invalid, expired, revoked or already used');
+    return emitir(est, r, cliente);
+  }
+  return err(400, 'unsupported_grant_type', 'use authorization_code or refresh_token');
+}
+
+// ---------- el recurso: validar el token en /mcp ----------
+export async function validarAcceso(est, rx) {
+  // El 401 apunta a los metadatos de la MISMA URL que el usuario pegó: Claude exige que coincidan.
+  const { prm } = urlsDe(est, RUTA_INVITACION.test(rx.path || '') ? rx.path : '/mcp');
+  const negar = (desc) => ({
+    ok: false,
+    out: {
+      status: 401,
+      headers: { 'www-authenticate': `Bearer resource_metadata="${prm}", scope="${ALCANCE}"${desc ? `, error="invalid_token", error_description="${desc}"` : ''}` },
+      body: { error: desc ? 'invalid_token' : 'unauthorized', error_description: desc || 'this endpoint needs an OAuth access token; see resource_metadata in WWW-Authenticate' },
+    },
+  });
+  const m = /^Bearer\s+([A-Za-z0-9_-]{20,200})$/.exec(rx.headers.authorization || '');
+  if (!m) return negar(null);
+  const t = await est.store.kvGet('acceso', sha(m[1]));
+  if (!t) return negar('the access token is invalid or expired');
+  if (!recursoValido(est, t.resource)) return negar('the token was issued for another resource');
+  if (!(await vigente(est, t.sub))) return negar('this Claude address was revoked or expired');
+  return { ok: true, token: t };
+}