@privos_ai/app-server 0.1.0

package/dist/protocol/logging.d.ts

@@ -0,0 +1,16 @@
+export interface RedactedLogFields {
+    method?: string;
+    toolName?: string;
+    id?: string | number | null;
+    durationMs?: number;
+    resultBytes?: number;
+    errorCode?: number;
+    identityState?: string;
+    transport?: string;
+    traceId?: string;
+    warning?: string;
+}
+/** Safe summary for logs — never include tokens, mail bodies, or secrets. */
+export declare function summarizeForLog(fields: RedactedLogFields): Record<string, unknown>;
+export declare function estimateJsonBytes(value: unknown): number;
+//# sourceMappingURL=logging.d.ts.map

package/dist/protocol/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../src/protocol/logging.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMlF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMxD"}

package/dist/protocol/logging.js

@@ -0,0 +1,18 @@
+/** Safe summary for logs — never include tokens, mail bodies, or secrets. */
+export function summarizeForLog(fields) {
+    const out = {};
+    for (const [key, value] of Object.entries(fields)) {
+        if (value !== undefined)
+            out[key] = value;
+    }
+    return out;
+}
+export function estimateJsonBytes(value) {
+    try {
+        return Buffer.byteLength(JSON.stringify(value), 'utf8');
+    }
+    catch {
+        return -1;
+    }
+}
+//# sourceMappingURL=logging.js.map

package/dist/protocol/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../../src/protocol/logging.ts"],"names":[],"mappings":"AAaA,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,MAAyB;IACxD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC/C,IAAI,CAAC;QACJ,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,CAAC,CAAC;IACX,CAAC;AACF,CAAC"}

package/dist/protocol/types.d.ts

@@ -0,0 +1,54 @@
+/** JSON-RPC 2.0 id. Explicit `null` is distinct from a missing id property. */
+export type JsonRpcId = string | number | null;
+export interface JsonRpcErrorObject {
+    code: number;
+    message: string;
+    data?: unknown;
+}
+export interface McpRequest {
+    jsonrpc: '2.0';
+    id: JsonRpcId;
+    method: string;
+    params?: unknown;
+}
+export interface McpNotification {
+    jsonrpc: '2.0';
+    method: string;
+    params?: unknown;
+}
+export interface McpResultResponse {
+    jsonrpc: '2.0';
+    id: JsonRpcId;
+    result: unknown;
+}
+export interface McpErrorResponse {
+    jsonrpc: '2.0';
+    id: JsonRpcId;
+    error: JsonRpcErrorObject;
+}
+export type McpResponse = McpResultResponse | McpErrorResponse;
+/** Application-facing request — runtime already handled initialize / notifications. */
+export type ApplicationMcpMethod = 'tools/list' | 'tools/call' | 'resources/read' | (string & {});
+export interface ApplicationMcpRequest {
+    jsonrpc: '2.0';
+    id: JsonRpcId;
+    method: ApplicationMcpMethod;
+    params?: unknown;
+}
+export type ParsedInbound = {
+    kind: 'request';
+    message: McpRequest;
+} | {
+    kind: 'notification';
+    message: McpNotification;
+} | {
+    kind: 'response';
+    message: Record<string, unknown>;
+} | {
+    kind: 'invalid';
+    error: JsonRpcErrorObject;
+    id: JsonRpcId | undefined;
+};
+export declare function hasOwnId(value: object): boolean;
+export declare function isJsonRpcId(value: unknown): value is JsonRpcId;
+//# sourceMappingURL=types.d.ts.map

package/dist/protocol/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/protocol/types.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AAE/C,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,kBAAkB,CAAC;CAC1B;AAED,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAE/D,uFAAuF;AACvF,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,YAAY,GAAG,gBAAgB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElG,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,aAAa,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;IAAC,EAAE,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAE7E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D"}

package/dist/protocol/types.js

@@ -0,0 +1,7 @@
+export function hasOwnId(value) {
+    return Object.prototype.hasOwnProperty.call(value, 'id');
+}
+export function isJsonRpcId(value) {
+    return value === null || typeof value === 'string' || typeof value === 'number';
+}
+//# sourceMappingURL=types.js.map

package/dist/protocol/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/protocol/types.ts"],"names":[],"mappings":"AAoDA,MAAM,UAAU,QAAQ,CAAC,KAAa;IACrC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACzC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AACjF,CAAC"}

package/dist/relay/message-adapter.d.ts

@@ -0,0 +1,9 @@
+import type { RawData } from 'ws';
+export declare class MessageTooLargeError extends Error {
+    readonly bytes: number;
+    readonly maxBytes: number;
+    constructor(bytes: number, maxBytes: number);
+}
+/** Convert ws RawData to UTF-8 text with a hard size limit. */
+export declare function rawDataToText(data: RawData, maxMessageBytes?: number): string;
+//# sourceMappingURL=message-adapter.d.ts.map

package/dist/relay/message-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-adapter.d.ts","sourceRoot":"","sources":["../../src/relay/message-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAIlC,qBAAa,oBAAqB,SAAQ,KAAK;aAClB,KAAK,EAAE,MAAM;aAAkB,QAAQ,EAAE,MAAM;gBAA/C,KAAK,EAAE,MAAM,EAAkB,QAAQ,EAAE,MAAM;CAI3E;AAED,+DAA+D;AAC/D,wBAAgB,aAAa,CAC5B,IAAI,EAAE,OAAO,EACb,eAAe,SAA4B,GACzC,MAAM,CAgBR"}

package/dist/relay/message-adapter.js

@@ -0,0 +1,32 @@
+const DEFAULT_MAX_MESSAGE_BYTES = 8 * 1024 * 1024;
+export class MessageTooLargeError extends Error {
+    bytes;
+    maxBytes;
+    constructor(bytes, maxBytes) {
+        super(`WebSocket message exceeds maxMessageBytes (${bytes} > ${maxBytes})`);
+        this.bytes = bytes;
+        this.maxBytes = maxBytes;
+        this.name = 'MessageTooLargeError';
+    }
+}
+/** Convert ws RawData to UTF-8 text with a hard size limit. */
+export function rawDataToText(data, maxMessageBytes = DEFAULT_MAX_MESSAGE_BYTES) {
+    let buf;
+    if (Buffer.isBuffer(data)) {
+        buf = data;
+    }
+    else if (data instanceof ArrayBuffer) {
+        buf = Buffer.from(data);
+    }
+    else if (Array.isArray(data)) {
+        buf = Buffer.concat(data);
+    }
+    else {
+        buf = Buffer.from(String(data));
+    }
+    if (buf.byteLength > maxMessageBytes) {
+        throw new MessageTooLargeError(buf.byteLength, maxMessageBytes);
+    }
+    return buf.toString('utf8');
+}
+//# sourceMappingURL=message-adapter.js.map

package/dist/relay/message-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-adapter.js","sourceRoot":"","sources":["../../src/relay/message-adapter.ts"],"names":[],"mappings":"AAEA,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAElD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAClB;IAA+B;IAA3D,YAA4B,KAAa,EAAkB,QAAgB;QAC1E,KAAK,CAAC,8CAA8C,KAAK,MAAM,QAAQ,GAAG,CAAC,CAAC;QADjD,UAAK,GAAL,KAAK,CAAQ;QAAkB,aAAQ,GAAR,QAAQ,CAAQ;QAE1E,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACpC,CAAC;CACD;AAED,+DAA+D;AAC/D,MAAM,UAAU,aAAa,CAC5B,IAAa,EACb,eAAe,GAAG,yBAAyB;IAE3C,IAAI,GAAW,CAAC;IAChB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,GAAG,GAAG,IAAI,CAAC;IACZ,CAAC;SAAM,IAAI,IAAI,YAAY,WAAW,EAAE,CAAC;QACxC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;SAAM,CAAC;QACP,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC"}

package/dist/relay/relay-client.d.ts

@@ -0,0 +1,63 @@
+import WebSocket from 'ws';
+import { type AppDescriptor } from '../app-descriptor.js';
+import type { AuthOptions } from '../auth/user-token.js';
+import { AppServerRuntime, type AppErrorMapper, type AppMcpHandler, type AppServerRuntimeOptions, type CallerCredentialExtractor, type RelayCallerAuthSurface, type RuntimeLimits, type UiResourceProvider } from '../runtime.js';
+export interface PairAppMeta {
+    name: string;
+    description?: string;
+    version?: string;
+    icon?: string;
+    scopes?: string[];
+}
+export interface PairingResult {
+    privosUrl: string;
+    clientId: string;
+    clientSecret: string;
+    mcpAppId?: string;
+}
+export interface RelayClientOptions {
+    privosUrl: string;
+    clientId: string;
+    clientSecret: string;
+    descriptor: AppDescriptor | (() => AppDescriptor | Promise<AppDescriptor>);
+    handler: AppMcpHandler;
+    ui?: UiResourceProvider;
+    auth?: AuthOptions;
+    mapAppError?: AppErrorMapper;
+    limits?: RuntimeLimits;
+    logger?: AppServerRuntimeOptions['logger'];
+    /**
+     * Extract credentials from reserved Relay auth surface only (`_meta` / `meta`).
+     * Never receives `params` / `arguments`.
+     */
+    extractCallerCredential?: CallerCredentialExtractor<RelayCallerAuthSurface>;
+    oauthTimeoutMs?: number;
+    /** Timeout waiting for WebSocket `open` after create (default 15s). */
+    openHandshakeTimeoutMs?: number;
+    /** Injected for tests. */
+    fetchImpl?: typeof fetch;
+    WebSocketImpl?: typeof WebSocket;
+    runtime?: AppServerRuntime;
+}
+export interface RelayHandle {
+    /** Stop reconnecting and close the active socket. */
+    stop(): Promise<void>;
+    /** Resolves when the first successful connection opens (or rejects if stopped first). */
+    whenConnected(): Promise<void>;
+}
+/**
+ * Pair with Privos using a one-time pairing URL.
+ * Does not persist credentials — caller is responsible for saving them.
+ */
+export declare function pairOverWebSocket(pairUrl: string, appMeta: PairAppMeta, WebSocketImpl?: typeof WebSocket, options?: {
+    timeoutMs?: number;
+}): Promise<PairingResult>;
+export declare function pairFromDescriptor(pairUrl: string, descriptor: AppDescriptor, WebSocketImpl?: typeof WebSocket, options?: {
+    timeoutMs?: number;
+}): Promise<PairingResult>;
+/**
+ * Connect to PrivOS relay WebSocket with exponential backoff, token refresh,
+ * single reconnect timer, and explicit stop().
+ */
+export declare function connectRelay(opts: RelayClientOptions): RelayHandle;
+//# sourceMappingURL=relay-client.d.ts.map

package/dist/relay/relay-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-client.d.ts","sourceRoot":"","sources":["../../src/relay/relay-client.ts"],"names":[],"mappings":"AAAA,OAAO,SAA2B,MAAM,IAAI,CAAC;AAE7C,OAAO,EAEN,KAAK,aAAa,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,OAAO,EACN,gBAAgB,EAIhB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,MAAM,eAAe,CAAC;AAGvB,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAOD,MAAM,WAAW,kBAAkB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,aAAa,GAAG,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3E,OAAO,EAAE,aAAa,CAAC;IACvB,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACxB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C;;;OAGG;IACH,uBAAuB,CAAC,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0BAA0B;IAC1B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,SAAS,CAAC;IACjC,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC3B,qDAAqD;IACrD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,yFAAyF;IACzF,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,WAAW,EACpB,aAAa,GAAE,OAAO,SAAqB,EAC3C,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B,OAAO,CAAC,aAAa,CAAC,CA+GxB;AAED,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,aAAa,EACzB,aAAa,CAAC,EAAE,OAAO,SAAS,EAChC,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B,OAAO,CAAC,aAAa,CAAC,CAOxB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,GAAG,WAAW,CA0WlE"}