@opendatalabs/personal-server-ts-core 1.16.1 → 1.17.0

package/dist/mcp/server.d.ts

@@ -13,11 +13,14 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { McpConnectionRecord } from "./types.js";
 import type { McpDataReadClient } from "./read-client.js";
+import { type PersonalServerReadReporterDeps } from "../api/index.js";
 import type { McpActivityRecorder, McpActivityStatus } from "./activity.js";
 export interface HandleMcpRequestOptions {
     connection: McpConnectionRecord;
     readClient: McpDataReadClient;
     activityRecorder?: McpActivityRecorder;
+    /** Emits one access record per denied data tool call; see reportToolDenial. */
+    reporterDeps?: PersonalServerReadReporterDeps;
     serverName?: string;
     serverVersion?: string;
 }
@@ -49,5 +52,19 @@ export declare function createMcpServerForConnection(options: HandleMcpRequestOp
  * Returns a Web `Response` suitable to send back to the client.
  */
 export declare function handleMcpStreamableHttpRequest(request: Request, options: HandleMcpRequestOptions): Promise<Response>;
+/**
+ * True when every JSON-RPC message in `body` is one this file can answer
+ * without the owner's data — see `HANDSHAKE_METHODS`. A batch qualifies only
+ * as a whole, so a tool call travelling with a handshake still reaches the
+ * owner's server.
+ */
+export declare function isMcpHandshake(body: unknown): boolean;
+/**
+ * Answer a handshake request from the static tool table. Same server identity,
+ * same registered surface and same transport as the full engine, so the bytes
+ * match what a dispatched call returns; the tool handlers are unreachable
+ * because no handshake method invokes one.
+ */
+export declare function handleMcpHandshake(request: Request): Promise<Response>;
 export {};
 //# sourceMappingURL=server.d.ts.map

package/dist/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,SAAS,EAEV,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAO1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAM5E,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,mBAAmB,CAAC;IAChC,UAAU,EAAE,iBAAiB,CAAC;IAC9B,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAgJD,UAAU,sBAAsB;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,UAAU,qBAAsB,SAAQ,sBAAsB;IAC5D,MAAM,EAAE,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAC9C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA+DD;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,uBAAuB,GAC/B;IACD,MAAM,EAAE,SAAS,CAAC;IAClB,uBAAuB,CACrB,QAAQ,CAAC,EAAE,IAAI,CACb,qBAAqB,EACrB,QAAQ,GAAG,WAAW,GAAG,cAAc,CACxC,GACA,IAAI,CAAC;CACT,CA4HA;AAED;;;;;GAKG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,QAAQ,CAAC,CAuBnB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,SAAS,EAEV,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAQ1D,OAAO,EAGL,KAAK,8BAA8B,EACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAM5E,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,mBAAmB,CAAC;IAChC,UAAU,EAAE,iBAAiB,CAAC;IAC9B,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,8BAA8B,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAuQD,UAAU,sBAAsB;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,UAAU,qBAAsB,SAAQ,sBAAsB;IAC5D,MAAM,EAAE,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAC9C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAwED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,uBAAuB,GAC/B;IACD,MAAM,EAAE,SAAS,CAAC;IAClB,uBAAuB,CACrB,QAAQ,CAAC,EAAE,IAAI,CACb,qBAAqB,EACrB,QAAQ,GAAG,WAAW,GAAG,cAAc,CACxC,GACA,IAAI,CAAC;CACT,CAoHA;AAED;;;;;GAKG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,QAAQ,CAAC,CAsBnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAarD;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA6B5E"}

package/dist/mcp/server.js

@@ -12,10 +12,30 @@
  */
 import { McpServer, ResourceTemplate, } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { MAX_MCP_TOOL_TIMEOUT_MS, MCP_TOOLS, } from "./tools.js";
+import { MAX_MCP_TOOL_TIMEOUT_MS, MCP_TOOLS, resolveGrantForScope, } from "./tools.js";
+import { READ_FULFILLMENT_NONE, reportPersonalServerReadDenial, } from "../api/index.js";
 import { RAW_SCOPE_RESOURCE_TEMPLATES, readRawScopeResource, } from "./resources.js";
 const DEFAULT_SERVER_NAME = "vana-personal-server-mcp";
 const DEFAULT_SERVER_VERSION = "0.0.1";
+/** Stateless: no MCP session id is issued and POST answers with JSON, not SSE. */
+const TRANSPORT_OPTIONS = {
+    sessionIdGenerator: undefined,
+    enableJsonResponse: true,
+};
+/** Methods whose answer is the same for every connection: the tool table is a
+ * static constant and no session is retained. e.g. a fresh remote connector
+ * probes with initialize + notifications/initialized + tools/list. */
+const HANDSHAKE_METHODS = new Set([
+    "initialize",
+    "notifications/initialized",
+    "ping",
+    "tools/list",
+]);
+const RAW_SCOPE_RESOURCE_CONFIG = {
+    title: "Raw scope file",
+    description: "Original binary/unstructured file bytes for an approved Vana scope.",
+    mimeType: "application/octet-stream",
+};
 const DEFAULT_MCP_TOOL_TIMEOUT_MS = 30_000;
 const MCP_TOOL_TIMEOUT_GRACE_MS = 1_000;
 const QUERY_PREVIEW_CHARS = 120;
@@ -79,6 +99,88 @@ function buildActivityStartParams(tool, args) {
     }
     return params;
 }
+/**
+ * Tools that reach the owner's data. Only these produce access records — the
+ * discovery tools (`list_granted_*`, `request_scope_access`) touch none.
+ */
+const DATA_TOOLS = new Set([
+    "get_scope_file",
+    "list_scope_blocks",
+    "read_scope",
+    "search_personal_context",
+]);
+/**
+ * Tool error codes that mean "the read was refused", as opposed to a failure
+ * (timeout, storage error). Only these are worth an access record: they are
+ * decisions about the grantee's access, not incidents.
+ */
+const DENY_CODES = new Set([
+    "payment_required",
+    "scope_deleted",
+    "scope_not_granted",
+    "unauthorized",
+]);
+const PAYMENT_REQUIRED_CODE = "payment_required";
+/**
+ * Extract the deny code from a tool result, or undefined when the call was
+ * served or failed for a non-deny reason. `read_scope` signals a chargeable
+ * scope with a top-level `payment_required: true` rather than an error code.
+ */
+function denyCode(result) {
+    if (!result.isError)
+        return undefined;
+    const first = result.content[0];
+    if (first?.type !== "text")
+        return undefined;
+    let body;
+    try {
+        body = JSON.parse(first.text);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof body.error === "string" && DENY_CODES.has(body.error)) {
+        return body.error;
+    }
+    return body[PAYMENT_REQUIRED_CODE] === true
+        ? PAYMENT_REQUIRED_CODE
+        : undefined;
+}
+/**
+ * One access record per denied data tool call. Fire-and-forget by contract:
+ * the tool result is already computed and is returned regardless.
+ */
+function reportToolDenial(options, tool, args, result) {
+    if (!options.reporterDeps || !DATA_TOOLS.has(tool))
+        return;
+    const reason = denyCode(result);
+    if (!reason)
+        return;
+    // The denied scope, if the call named one; a multi-scope search records the
+    // first, since the owner's decision is one record per tool call.
+    const scope = buildActivityStartParams(tool, args).scopes?.[0] ?? READ_FULFILLMENT_NONE;
+    // A refusal is filed under the grant the call arrived on. A scope no grant
+    // covers has no grant of its own, but the connection's grant is the access
+    // relationship the owner's feed groups by — and the Gateway only stores a
+    // 32-byte grant id, so `READ_FULFILLMENT_NONE` here is refused on ingest and
+    // takes its whole batch down with it. A connection left with no grant at all
+    // has nothing to attribute the refusal to, so it reports nothing.
+    const grantId = resolveGrantForScope(options.connection, scope)?.grantId ??
+        options.connection.grants[0]?.grantId;
+    if (!grantId)
+        return;
+    reportPersonalServerReadDenial(options.reporterDeps, {
+        builder: options.connection.granteeAddress,
+        denyReason: reason,
+        grantId,
+        logId: crypto.randomUUID(),
+        outcome: "denied",
+        scope,
+        servedAt: new Date().toISOString(),
+        source: "mcp",
+        tool,
+    });
+}
 function extractActivityFinishParams(tool, result) {
     if (result.isError || result.content.length === 0) {
         try {
@@ -174,6 +276,14 @@ function markResponsePreparing(recorder, activityId, finish) {
         errorMessage: finish.errorMessage,
     });
 }
+/** What a client sees of a tool in `tools/list`: owner-independent metadata. */
+function toolConfig(tool) {
+    return {
+        title: tool.title,
+        description: tool.description,
+        inputSchema: tool.inputSchema,
+    };
+}
 /**
  * Build a fresh `McpServer` instance bound to a single connection + read
  * client. Tools delegate to `MCP_TOOLS` so the surface stays in one place.
@@ -190,11 +300,7 @@ export function createMcpServerForConnection(options) {
         activityRecorder: options.activityRecorder,
     };
     for (const tool of MCP_TOOLS) {
-        server.registerTool(tool.name, {
-            title: tool.title,
-            description: tool.description,
-            inputSchema: tool.inputSchema,
-        }, async (args) => {
+        server.registerTool(tool.name, toolConfig(tool), async (args) => {
             const recorder = options.activityRecorder;
             const activityId = recorder
                 ? recorder.start(buildActivityStartParams(tool.name, args))
@@ -203,6 +309,7 @@ export function createMcpServerForConnection(options) {
             try {
                 const timeoutMs = toolTimeoutMs(tool.name, args);
                 const result = await withToolTimeout(tool.handler(args, ctx), tool.name, timeoutMs);
+                reportToolDenial(options, tool.name, args, result);
                 if (activityId && recorder) {
                     const handlerDurationMs = Math.round(performance.now() - handlerStartedAt);
                     const payload = extractActivityFinishParams(tool.name, result);
@@ -257,11 +364,7 @@ export function createMcpServerForConnection(options) {
         });
     }
     RAW_SCOPE_RESOURCE_TEMPLATES.forEach((template, index) => {
-        server.registerResource(`raw-scope-file-${index}`, new ResourceTemplate(template, { list: undefined }), {
-            title: "Raw scope file",
-            description: "Original binary/unstructured file bytes for an approved Vana scope.",
-            mimeType: "application/octet-stream",
-        }, async (uri) => readRawScopeResource(uri, ctx));
+        server.registerResource(`raw-scope-file-${index}`, new ResourceTemplate(template, { list: undefined }), RAW_SCOPE_RESOURCE_CONFIG, async (uri) => readRawScopeResource(uri, ctx));
     });
     function finishPendingActivities(override) {
         for (const [activityId, finish] of pendingActivityFinishes) {
@@ -282,10 +385,7 @@ export function createMcpServerForConnection(options) {
  */
 export async function handleMcpStreamableHttpRequest(request, options) {
     const { server, finishPendingActivities } = createMcpServerForConnection(options);
-    const transport = new WebStandardStreamableHTTPServerTransport({
-        sessionIdGenerator: undefined,
-        enableJsonResponse: true,
-    });
+    const transport = new WebStandardStreamableHTTPServerTransport(TRANSPORT_OPTIONS);
     try {
         await server.connect(transport);
         const response = await transport.handleRequest(request);
@@ -304,4 +404,43 @@ export async function handleMcpStreamableHttpRequest(request, options) {
         await Promise.allSettled([transport.close(), server.close()]);
     }
 }
+/**
+ * True when every JSON-RPC message in `body` is one this file can answer
+ * without the owner's data — see `HANDSHAKE_METHODS`. A batch qualifies only
+ * as a whole, so a tool call travelling with a handshake still reaches the
+ * owner's server.
+ */
+export function isMcpHandshake(body) {
+    const messages = Array.isArray(body) ? body : [body];
+    return (messages.length > 0 &&
+        messages.every((message) => !!message &&
+            typeof message === "object" &&
+            HANDSHAKE_METHODS.has(message.method)));
+}
+/**
+ * Answer a handshake request from the static tool table. Same server identity,
+ * same registered surface and same transport as the full engine, so the bytes
+ * match what a dispatched call returns; the tool handlers are unreachable
+ * because no handshake method invokes one.
+ */
+export async function handleMcpHandshake(request) {
+    const server = new McpServer({
+        name: DEFAULT_SERVER_NAME,
+        version: DEFAULT_SERVER_VERSION,
+    });
+    const unreachable = () => {
+        throw new Error("Handshake server cannot serve data");
+    };
+    for (const tool of MCP_TOOLS)
+        server.registerTool(tool.name, toolConfig(tool), unreachable);
+    RAW_SCOPE_RESOURCE_TEMPLATES.forEach((template, index) => server.registerResource(`raw-scope-file-${index}`, new ResourceTemplate(template, { list: undefined }), RAW_SCOPE_RESOURCE_CONFIG, unreachable));
+    const transport = new WebStandardStreamableHTTPServerTransport(TRANSPORT_OPTIONS);
+    try {
+        await server.connect(transport);
+        return await transport.handleRequest(request);
+    }
+    finally {
+        await Promise.allSettled([transport.close(), server.close()]);
+    }
+}
 //# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,SAAS,EACT,gBAAgB,GACjB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAC;AAGzH,OAAO,EACL,uBAAuB,EACvB,SAAS,GAGV,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAUxB,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AACvD,MAAM,sBAAsB,GAAG,OAAO,CAAC;AACvC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAExC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC,MAAM,mBAAoB,SAAQ,KAAK;IAEnB;IACA;IAFlB,YACkB,IAAY,EACZ,SAAiB;QAEjC,KAAK,CAAC,GAAG,IAAI,oBAAoB,SAAS,IAAI,CAAC,CAAC;QAHhC,SAAI,GAAJ,IAAI,CAAQ;QACZ,cAAS,GAAT,SAAS,CAAQ;QAGjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,2BAA2B,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAA6B;IAChE,IACE,IAAI,KAAK,YAAY;QACrB,IAAI,KAAK,yBAAyB;QAClC,IAAI,KAAK,gBAAgB,EACzB,CAAC;QACD,OAAO,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,yBAAyB,CAAC;IACtE,CAAC;IACD,OAAO,2BAA2B,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAmB,EACnB,IAAY,EACZ,SAAiB;IAEjB,IAAI,OAAkD,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,OAAO;YACP,IAAI,OAAO,CAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBAClC,OAAO,GAAG,UAAU,CAClB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EACtD,SAAS,CACV,CAAC;YACJ,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,OAAO;YAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAY,EACZ,IAA6B;IAE7B,MAAM,MAAM,GAA+D;QACzE,IAAI;KACL,CAAC;IACF,IACE,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,gBAAgB,CAAC;QACpD,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAC9B,CAAC;QACD,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;QACvC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,MAAM,GAAI,IAAI,CAAC,MAAoB;iBACvC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;iBACjD,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,2BAA2B,CAClC,IAAY,EACZ,MAA8D;IAO9D,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,SAAS,GACb,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACrE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA4B,CAAC;YAC9D,OAAO;gBACL,SAAS,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAClE,YAAY,EACV,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aAC9D,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,SAAS,GACb,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACrE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA4B,CAAC;YAC9D,OAAO;gBACL,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;oBACtC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;oBACrB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;wBAC3B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;wBACrB,CAAC,CAAC,SAAS;gBACf,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;oBAC7C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM;oBAC3B,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,SAAS,GACb,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACrE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA4B,CAAC;YAC9D,OAAO;gBACL,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;oBACrC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;oBACpB,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAiBD,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;AAC9C,CAAC;AAED,SAAS,sBAAsB,CAAC,MAG/B;IACC,MAAM,SAAS,GACb,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7B,OAAO,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACb,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,sBAAsB,GAC1B,MAAM,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,OAAO;QACL,SAAS;QACT,GAAG,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,YAAY,EAAE,SAAS,GAAG,CAAC,sBAAsB,IAAI,CAAC,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAA6B;IAIrD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;aACpC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAA6B,EAC7B,UAAkB,EAClB,MAA6B;IAE7B,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE;QAC1B,KAAK,EAAE,oBAAoB;QAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QACrD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAgC;IAUhC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,mBAAmB;QAC/C,OAAO,EAAE,OAAO,CAAC,aAAa,IAAI,sBAAsB;KACzD,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzE,MAAM,GAAG,GAAmB;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,EACD,KAAK,EAAE,IAA6B,EAAE,EAAE;YACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAC1C,MAAM,UAAU,GAAG,QAAQ;gBACzB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC3D,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACjD,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,IAAI,CAAC,OAAO,CAAC,IAA+B,EAAE,GAAG,CAAC,EAClD,IAAI,CAAC,IAAI,EACT,SAAS,CACV,CAAC;gBACF,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;oBAC3B,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAClC,WAAW,CAAC,GAAG,EAAE,GAAG,gBAAgB,CACrC,CAAC;oBACF,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAC/D,MAAM,MAAM,GAA0B;wBACpC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;wBAC/C,iBAAiB;wBACjB,GAAG,sBAAsB,CAAC,MAAM,CAAC;wBACjC,GAAG,OAAO;qBACX,CAAC;oBACF,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;oBACpD,uBAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAClD,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;oBACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC;wBAC9B,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;qBACzB,CAAC,CAAC;oBACH,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;wBAC3B,MAAM,MAAM,GAA0B;4BACpC,MAAM,EAAE,WAAW;4BACnB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAC3B,WAAW,CAAC,GAAG,EAAE,GAAG,gBAAgB,CACrC;4BACD,GAAG,sBAAsB,CAAC,MAAM,CAAC;4BACjC,SAAS,EAAE,cAAc;4BACzB,YAAY,EAAE,GAAG,CAAC,OAAO;yBAC1B,CAAC;wBACF,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;wBACpD,uBAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;oBAClD,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,MAAM,MAAM,GAAG,gBAAgB,CAAC;oBAC9B,KAAK,EAAE,oBAAoB;oBAC3B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBAC1D,CAAC,CAAC;gBACH,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;oBAC3B,MAAM,MAAM,GAA0B;wBACpC,MAAM,EAAE,QAAQ;wBAChB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAC3B,WAAW,CAAC,GAAG,EAAE,GAAG,gBAAgB,CACrC;wBACD,GAAG,sBAAsB,CAAC,MAAM,CAAC;wBACjC,SAAS,EAAE,oBAAoB;wBAC/B,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBAC/D,CAAC;oBACF,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;oBACpD,uBAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAClD,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QACvD,MAAM,CAAC,gBAAgB,CACrB,kBAAkB,KAAK,EAAE,EACzB,IAAI,gBAAgB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EACnD;YACE,KAAK,EAAE,gBAAgB;YACvB,WAAW,EACT,qEAAqE;YACvE,QAAQ,EAAE,0BAA0B;SACrC,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAC9C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,SAAS,uBAAuB,CAC9B,QAGC;QAED,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;YAC3D,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,EAAE;gBAC3C,GAAG,MAAM;gBACT,GAAG,QAAQ;aACZ,CAAC,CAAC;YACH,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAgB,EAChB,OAAgC;IAEhC,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,GACvC,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;QAC7D,kBAAkB,EAAE,SAAS;QAC7B,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACxD,uBAAuB,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uBAAuB,CAAC;YACtB,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,iBAAiB;YAC5B,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,SAAS,EACT,gBAAgB,GACjB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAC;AAGzH,OAAO,EACL,uBAAuB,EACvB,SAAS,EACT,oBAAoB,GAGrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qBAAqB,EACrB,8BAA8B,GAE/B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAYxB,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AACvD,MAAM,sBAAsB,GAAG,OAAO,CAAC;AACvC,kFAAkF;AAClF,MAAM,iBAAiB,GAAG;IACxB,kBAAkB,EAAE,SAAS;IAC7B,kBAAkB,EAAE,IAAI;CAChB,CAAC;AACX;;sEAEsE;AACtE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,YAAY;IACZ,2BAA2B;IAC3B,MAAM;IACN,YAAY;CACb,CAAC,CAAC;AACH,MAAM,yBAAyB,GAAG;IAChC,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,qEAAqE;IACvE,QAAQ,EAAE,0BAA0B;CAC5B,CAAC;AACX,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAExC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC,MAAM,mBAAoB,SAAQ,KAAK;IAEnB;IACA;IAFlB,YACkB,IAAY,EACZ,SAAiB;QAEjC,KAAK,CAAC,GAAG,IAAI,oBAAoB,SAAS,IAAI,CAAC,CAAC;QAHhC,SAAI,GAAJ,IAAI,CAAQ;QACZ,cAAS,GAAT,SAAS,CAAQ;QAGjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,2BAA2B,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAA6B;IAChE,IACE,IAAI,KAAK,YAAY;QACrB,IAAI,KAAK,yBAAyB;QAClC,IAAI,KAAK,gBAAgB,EACzB,CAAC;QACD,OAAO,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,yBAAyB,CAAC;IACtE,CAAC;IACD,OAAO,2BAA2B,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAmB,EACnB,IAAY,EACZ,SAAiB;IAEjB,IAAI,OAAkD,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,OAAO;YACP,IAAI,OAAO,CAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBAClC,OAAO,GAAG,UAAU,CAClB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EACtD,SAAS,CACV,CAAC;YACJ,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,OAAO;YAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAY,EACZ,IAA6B;IAE7B,MAAM,MAAM,GAA+D;QACzE,IAAI;KACL,CAAC;IACF,IACE,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,gBAAgB,CAAC;QACpD,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAC9B,CAAC;QACD,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;QACvC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,MAAM,GAAI,IAAI,CAAC,MAAoB;iBACvC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;iBACjD,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,gBAAgB;IAChB,mBAAmB;IACnB,YAAY;IACZ,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,kBAAkB;IAClB,eAAe;IACf,mBAAmB;IACnB,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAEjD;;;;GAIG;AACH,SAAS,QAAQ,CAAC,MAGjB;IACC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAEtC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,KAAK,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAE7C,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,IAAI;QACzC,CAAC,CAAC,qBAAqB;QACvB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,OAAgC,EAChC,IAAY,EACZ,IAA6B,EAC7B,MAA8D;IAE9D,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IAE3D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,KAAK,GACT,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC;IAE5E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,OAAO,GACX,oBAAoB,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,OAAO;QACxD,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,8BAA8B,CAAC,OAAO,CAAC,YAAY,EAAE;QACnD,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,cAAc;QAC1C,UAAU,EAAE,MAAM;QAClB,OAAO;QACP,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;QAC1B,OAAO,EAAE,QAAQ;QACjB,KAAK;QACL,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,MAAM,EAAE,KAAK;QACb,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,SAAS,2BAA2B,CAClC,IAAY,EACZ,MAA8D;IAO9D,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,SAAS,GACb,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACrE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA4B,CAAC;YAC9D,OAAO;gBACL,SAAS,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAClE,YAAY,EACV,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aAC9D,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,SAAS,GACb,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACrE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA4B,CAAC;YAC9D,OAAO;gBACL,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;oBACtC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;oBACrB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;wBAC3B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;wBACrB,CAAC,CAAC,SAAS;gBACf,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;oBAC7C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM;oBAC3B,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,SAAS,GACb,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACrE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA4B,CAAC;YAC9D,OAAO;gBACL,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;oBACrC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;oBACpB,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAiBD,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;AAC9C,CAAC;AAED,SAAS,sBAAsB,CAAC,MAG/B;IACC,MAAM,SAAS,GACb,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7B,OAAO,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACb,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,sBAAsB,GAC1B,MAAM,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,OAAO;QACL,SAAS;QACT,GAAG,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,YAAY,EAAE,SAAS,GAAG,CAAC,sBAAsB,IAAI,CAAC,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAA6B;IAIrD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;aACpC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAA6B,EAC7B,UAAkB,EAClB,MAA6B;IAE7B,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE;QAC1B,KAAK,EAAE,oBAAoB;QAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QACrD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,IAAgC;IAClD,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAgC;IAUhC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,mBAAmB;QAC/C,OAAO,EAAE,OAAO,CAAC,aAAa,IAAI,sBAAsB;KACzD,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzE,MAAM,GAAG,GAAmB;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT,UAAU,CAAC,IAAI,CAAC,EAChB,KAAK,EAAE,IAA6B,EAAE,EAAE;YACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAC1C,MAAM,UAAU,GAAG,QAAQ;gBACzB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC3D,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACjD,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,IAAI,CAAC,OAAO,CAAC,IAA+B,EAAE,GAAG,CAAC,EAClD,IAAI,CAAC,IAAI,EACT,SAAS,CACV,CAAC;gBACF,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBACnD,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;oBAC3B,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAClC,WAAW,CAAC,GAAG,EAAE,GAAG,gBAAgB,CACrC,CAAC;oBACF,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAC/D,MAAM,MAAM,GAA0B;wBACpC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;wBAC/C,iBAAiB;wBACjB,GAAG,sBAAsB,CAAC,MAAM,CAAC;wBACjC,GAAG,OAAO;qBACX,CAAC;oBACF,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;oBACpD,uBAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAClD,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;oBACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC;wBAC9B,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;qBACzB,CAAC,CAAC;oBACH,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;wBAC3B,MAAM,MAAM,GAA0B;4BACpC,MAAM,EAAE,WAAW;4BACnB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAC3B,WAAW,CAAC,GAAG,EAAE,GAAG,gBAAgB,CACrC;4BACD,GAAG,sBAAsB,CAAC,MAAM,CAAC;4BACjC,SAAS,EAAE,cAAc;4BACzB,YAAY,EAAE,GAAG,CAAC,OAAO;yBAC1B,CAAC;wBACF,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;wBACpD,uBAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;oBAClD,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,MAAM,MAAM,GAAG,gBAAgB,CAAC;oBAC9B,KAAK,EAAE,oBAAoB;oBAC3B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBAC1D,CAAC,CAAC;gBACH,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;oBAC3B,MAAM,MAAM,GAA0B;wBACpC,MAAM,EAAE,QAAQ;wBAChB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAC3B,WAAW,CAAC,GAAG,EAAE,GAAG,gBAAgB,CACrC;wBACD,GAAG,sBAAsB,CAAC,MAAM,CAAC;wBACjC,SAAS,EAAE,oBAAoB;wBAC/B,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBAC/D,CAAC;oBACF,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;oBACpD,uBAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAClD,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QACvD,MAAM,CAAC,gBAAgB,CACrB,kBAAkB,KAAK,EAAE,EACzB,IAAI,gBAAgB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EACnD,yBAAyB,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAC9C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,SAAS,uBAAuB,CAC9B,QAGC;QAED,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;YAC3D,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,EAAE;gBAC3C,GAAG,MAAM;gBACT,GAAG,QAAQ;aACZ,CAAC,CAAC;YACH,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAgB,EAChB,OAAgC;IAEhC,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,GACvC,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAC5D,iBAAiB,CAClB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACxD,uBAAuB,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uBAAuB,CAAC;YACtB,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,iBAAiB;YAC5B,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,CACL,QAAQ,CAAC,MAAM,GAAG,CAAC;QACnB,QAAQ,CAAC,KAAK,CACZ,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,CAAC,OAAO;YACT,OAAO,OAAO,KAAK,QAAQ;YAC3B,iBAAiB,CAAC,GAAG,CAClB,OAAgC,CAAC,MAAgB,CACnD,CACJ,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAgB;IACvD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,sBAAsB;KAChC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,SAAS;QAC1B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;IAChE,4BAA4B,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CACvD,MAAM,CAAC,gBAAgB,CACrB,kBAAkB,KAAK,EAAE,EACzB,IAAI,gBAAgB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EACnD,yBAAyB,EACzB,WAAW,CACZ,CACF,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAC5D,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/mcp/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/mcp/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAEV,kBAAkB,EAElB,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AAEpB,wBAAgB,gCAAgC,IAAI,kBAAkB,CA2CrE;AAED,wBAAgB,wCAAwC,IAAI,0BAA0B,CAiDrF"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/mcp/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAEV,kBAAkB,EAElB,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AAGpB,wBAAgB,gCAAgC,IAAI,kBAAkB,CAqDrE;AAED,wBAAgB,wCAAwC,IAAI,0BAA0B,CAiDrF"}

package/dist/mcp/store.js

@@ -7,6 +7,7 @@
  * `packages/lite/src/mcp-store.ts` (not part of this change set yet) — that
  * adapter mirrors `createIndexedDbPsLiteTokenStore()`.
  */
+import { isMcpTokenExpired, matchesMcpRefreshHash } from "./token-expiry.js";
 export function createInMemoryMcpConnectionStore() {
     const byId = new Map();
     const byTokenHash = new Map(); // tokenHash → id
@@ -34,8 +35,16 @@ export function createInMemoryMcpConnectionStore() {
                 return null;
             if (record.status !== "approved")
                 return null;
+            if (isMcpTokenExpired(record))
+                return null;
             return { ...record };
         },
+        async getByRefreshTokenHash(refreshTokenHash) {
+            // Scanned, not indexed: a presented token may match either the current
+            // or the rotated-out hash, and a store holds a handful of connections.
+            const record = Array.from(byId.values()).find((candidate) => matchesMcpRefreshHash(candidate, refreshTokenHash));
+            return record ? { ...record } : null;
+        },
         async update(id, patch) {
             const record = byId.get(id);
             if (!record)

package/dist/mcp/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/mcp/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,MAAM,UAAU,gCAAgC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAA+B,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,iBAAiB;IAEhE,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YACnC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,KAAK,CAAC,IAAI;YACR,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,SAAS;YAC5B,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC9C,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC5D,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACrC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACvC,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACtB,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuC,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,8BAA8B;IAE5E,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,qBAAqB;YACvC,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACjD,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,IACE,KAAK,CAAC,qBAAqB;gBAC3B,KAAK,CAAC,qBAAqB,KAAK,MAAM,CAAC,qBAAqB,EAC5D,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACtB,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;QACxB,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,MAAM,EAAE,qBAAqB,EAAE,CAAC;gBAClC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/mcp/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE7E,MAAM,UAAU,gCAAgC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAA+B,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,iBAAiB;IAEhE,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YACnC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,KAAK,CAAC,IAAI;YACR,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,SAAS;YAC5B,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC9C,IAAI,iBAAiB,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3C,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,gBAAgB;YAC1C,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC1D,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CACnD,CAAC;YACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC5D,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACrC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACvC,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACtB,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuC,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,8BAA8B;IAE5E,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,qBAAqB;YACvC,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACjD,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,IACE,KAAK,CAAC,qBAAqB;gBAC3B,KAAK,CAAC,qBAAqB,KAAK,MAAM,CAAC,qBAAqB,EAC5D,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACtB,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;QACxB,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,MAAM,EAAE,qBAAqB,EAAE,CAAC;gBAClC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/mcp/token-expiry.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Lifetime and lookup policy for the two MCP OAuth credentials — one policy,
+ * shared by every store that resolves a token, so the fleet and local paths
+ * cannot diverge.
+ */
+import type { McpConnectionRecord } from "./types.js";
+/**
+ * 1 h. Short because the bearer is replayable and the store cannot revoke an
+ * already-issued one; the refresh grant below is what keeps the owner from
+ * re-consenting hourly.
+ */
+export declare const MCP_TOKEN_TTL_MS: number;
+/**
+ * 7 d. The refresh token is single-use and rotates on every exchange, so its
+ * lifetime bounds how long a connection survives without the owner touching
+ * it — not how long a leaked credential is usable. A week keeps an abandoned
+ * connection from lingering a month; an owner who uses the connection weekly
+ * never re-consents.
+ */
+export declare const MCP_REFRESH_TTL_MS: number;
+/** ISO expiry for an access token minted at `nowMs`. */
+export declare function mcpTokenExpiry(nowMs: number): string;
+/** ISO expiry for a refresh token minted at `nowMs`. */
+export declare function mcpRefreshExpiry(nowMs: number): string;
+/**
+ * Fail closed. A record written before `tokenExpiresAt` existed carries no
+ * proven lifetime, so it reads as expired: connections issued before this
+ * change need one re-consent rather than living forever.
+ */
+export declare function isMcpTokenExpired(record: Pick<McpConnectionRecord, "tokenExpiresAt">, nowMs?: number): boolean;
+/** Fail closed, same rule: no proven lifetime means no refresh. */
+export declare function isMcpRefreshExpired(record: Pick<McpConnectionRecord, "refreshExpiresAt">, nowMs?: number): boolean;
+/**
+ * True when `hash` is this record's current or rotated-out refresh hash. Every
+ * store resolves a refresh token through this one predicate.
+ */
+export declare function matchesMcpRefreshHash(record: Pick<McpConnectionRecord, "refreshTokenHash" | "previousRefreshTokenHash">, hash: string): boolean;
+//# sourceMappingURL=token-expiry.d.ts.map

package/dist/mcp/token-expiry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-expiry.d.ts","sourceRoot":"","sources":["../../src/mcp/token-expiry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAiB,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAA0B,CAAC;AAE1D,wDAAwD;AACxD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,EACnD,KAAK,GAAE,MAAmB,GACzB,OAAO,CAET;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,EACrD,KAAK,GAAE,MAAmB,GACzB,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,IAAI,CACV,mBAAmB,EACnB,kBAAkB,GAAG,0BAA0B,CAChD,EACD,IAAI,EAAE,MAAM,GACX,OAAO,CAMT"}

package/dist/mcp/token-expiry.js

@@ -0,0 +1,55 @@
+/**
+ * Lifetime and lookup policy for the two MCP OAuth credentials — one policy,
+ * shared by every store that resolves a token, so the fleet and local paths
+ * cannot diverge.
+ */
+/**
+ * 1 h. Short because the bearer is replayable and the store cannot revoke an
+ * already-issued one; the refresh grant below is what keeps the owner from
+ * re-consenting hourly.
+ */
+export const MCP_TOKEN_TTL_MS = 60 * 60 * 1000;
+/**
+ * 7 d. The refresh token is single-use and rotates on every exchange, so its
+ * lifetime bounds how long a connection survives without the owner touching
+ * it — not how long a leaked credential is usable. A week keeps an abandoned
+ * connection from lingering a month; an owner who uses the connection weekly
+ * never re-consents.
+ */
+export const MCP_REFRESH_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+/** ISO expiry for an access token minted at `nowMs`. */
+export function mcpTokenExpiry(nowMs) {
+    return new Date(nowMs + MCP_TOKEN_TTL_MS).toISOString();
+}
+/** ISO expiry for a refresh token minted at `nowMs`. */
+export function mcpRefreshExpiry(nowMs) {
+    return new Date(nowMs + MCP_REFRESH_TTL_MS).toISOString();
+}
+/**
+ * Fail closed. A record written before `tokenExpiresAt` existed carries no
+ * proven lifetime, so it reads as expired: connections issued before this
+ * change need one re-consent rather than living forever.
+ */
+export function isMcpTokenExpired(record, nowMs = Date.now()) {
+    return isExpired(record.tokenExpiresAt, nowMs);
+}
+/** Fail closed, same rule: no proven lifetime means no refresh. */
+export function isMcpRefreshExpired(record, nowMs = Date.now()) {
+    return isExpired(record.refreshExpiresAt, nowMs);
+}
+/**
+ * True when `hash` is this record's current or rotated-out refresh hash. Every
+ * store resolves a refresh token through this one predicate.
+ */
+export function matchesMcpRefreshHash(record, hash) {
+    if (!hash)
+        return false;
+    return (record.refreshTokenHash === hash || record.previousRefreshTokenHash === hash);
+}
+function isExpired(expiresAt, nowMs) {
+    if (!expiresAt)
+        return true;
+    const expiry = Date.parse(expiresAt);
+    return !Number.isFinite(expiry) || expiry <= nowMs;
+}
+//# sourceMappingURL=token-expiry.js.map

package/dist/mcp/token-expiry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-expiry.js","sourceRoot":"","sources":["../../src/mcp/token-expiry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1D,wDAAwD;AACxD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,IAAI,IAAI,CAAC,KAAK,GAAG,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1D,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,IAAI,IAAI,CAAC,KAAK,GAAG,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAmD,EACnD,QAAgB,IAAI,CAAC,GAAG,EAAE;IAE1B,OAAO,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CACjC,MAAqD,EACrD,QAAgB,IAAI,CAAC,GAAG,EAAE;IAE1B,OAAO,SAAS,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAGC,EACD,IAAY;IAEZ,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAExB,OAAO,CACL,MAAM,CAAC,gBAAgB,KAAK,IAAI,IAAI,MAAM,CAAC,wBAAwB,KAAK,IAAI,CAC7E,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,SAA6B,EAAE,KAAa;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,KAAK,CAAC;AACrD,CAAC"}

package/dist/mcp/tools.d.ts

@@ -66,5 +66,19 @@ export interface McpToolDefinition {
  * results plus nextSearchCursor" path the tools implement.
  */
 export declare const MAX_MCP_TOOL_TIMEOUT_MS = 90000;
+/**
+ * Resolve a concrete requested scope to a covering grant id from the
+ * connection's approved grants. A scope is "covered" when an approved grant's
+ * scopes either contains the exact scope or contains a wildcard like
+ * `instagram.*` that matches a concrete child scope like `instagram.profile`.
+ *
+ * Mirrors `scopeCoveredByGrant` semantics from `policy/data-read.ts` so the
+ * tool surface never offers Claude a scope its grant won't actually pass
+ * server-side.
+ */
+export declare function resolveGrantForScope(connection: McpConnectionRecord, scope: string): {
+    grantId: string;
+    scopes: string[];
+} | null;
 export declare const MCP_TOOLS: readonly McpToolDefinition[];
 //# sourceMappingURL=tools.d.ts.map

package/dist/mcp/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AASzD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,mBAAmB,CAAC;IAChC,UAAU,EAAE,iBAAiB,CAAC;IAC9B,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;CACxC;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,GACD;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QACR,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;CACH,CAAC;AAEN,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAG5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;AAE7D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,OAAO,CACL,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3B;AAiGD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AA4iD9C,eAAO,MAAM,SAAS,EAAE,SAAS,iBAAiB,EAQxC,CAAC"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AASzD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,mBAAmB,CAAC;IAChC,UAAU,EAAE,iBAAiB,CAAC;IAC9B,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;CACxC;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,GACD;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QACR,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;CACH,CAAC;AAEN,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAG5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;AAE7D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,OAAO,CACL,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3B;AAqGD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAuD9C;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,mBAAmB,EAC/B,KAAK,EAAE,MAAM,GACZ;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAkB9C;AAw9CD,eAAO,MAAM,SAAS,EAAE,SAAS,iBAAiB,EAQxC,CAAC"}

package/dist/mcp/tools.js

@@ -14,6 +14,9 @@ import { McpDataReadError } from "./read-client.js";
 import { MiniSearchIndex } from "./search/index.js";
 import { MAX_SELECTED_BLOCK_IDS } from "../storage/blocks/index.js";
 import { rawScopeFileInputSchema, rawScopeMetadata, rawScopeResourceUri, } from "./resources.js";
+/** Tool names the read path stamps onto access records. */
+const READ_SCOPE_TOOL = "read_scope";
+const SEARCH_PERSONAL_CONTEXT_TOOL = "search_personal_context";
 const STRUCTURED_CONTENT_TEXT_LIMIT_BYTES = 64 * 1024;
 const resultTextEncoder = new TextEncoder();
 /**
@@ -178,7 +181,7 @@ class OperationTimeoutError extends Error {
  * tool surface never offers Claude a scope its grant won't actually pass
  * server-side.
  */
-function resolveGrantForScope(connection, scope) {
+export function resolveGrantForScope(connection, scope) {
     for (const grant of connection.grants) {
         for (const granted of grant.scopes) {
             if (granted === scope) {
@@ -563,7 +566,7 @@ const requestScopeAccess = {
     },
 };
 const readScope = {
-    name: "read_scope",
+    name: READ_SCOPE_TOOL,
     title: "Read scope",
     description: "Read approved scope blocks. Pass blockIds to fetch exact blocks; otherwise page with nextCursor.",
     inputSchema: {
@@ -642,6 +645,7 @@ const readScope = {
                 cursor,
                 maxBytes,
                 payment,
+                tool: READ_SCOPE_TOOL,
                 ...(blockIds.length > 0 ? { blockIds } : {}),
             }), timeoutMs, `read blocks for ${scope}`);
             const nextCursor = result.nextCursor ?? null;
@@ -845,7 +849,7 @@ function decodeSearchCursor(raw) {
     }
 }
 const searchPersonalContext = {
-    name: "search_personal_context",
+    name: SEARCH_PERSONAL_CONTEXT_TOOL,
     title: "Search personal context",
     description: "Search approved scopes. Omit scopes for default sweep; name scopes for targeted search. Continue with nextSearchCursor. Free discovery/preview — it does not settle payments; chargeable scopes are returned in paymentRequiredScopes, fetch those via read_scope with a `payment` proof.",
     inputSchema: {
@@ -1010,6 +1014,7 @@ const searchPersonalContext = {
                         grantId: grant.grantId,
                         cursor,
                         maxBytes,
+                        tool: SEARCH_PERSONAL_CONTEXT_TOOL,
                     }), perScopeTimeoutMs, `read blocks for ${scope}`);
                     const pageText = blockPageSearchText(result.blocks);
                     const { documents, textById } = blockPageSearchDocuments(scope, result.blocks);