@reticlehq/server 2.0.0

package/dist/license/license.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Enterprise license-key verification + the assertEnterprise gate. ENTERPRISE CODE (Reticle Enterprise
+ * License — see ./LICENSE), not the FSL that covers the rest of the server.
+ *
+ * Offline + no phone-home (preserves the no-telemetry brand): a key is a signed payload Reticle issues
+ * with its private key; this verifies it against the issuer's PUBLIC key with Ed25519. Dev/eval is a
+ * no-op (requireLicense:false) so the gate never gets in a contributor's way; only a production-mode
+ * caller with requireLicense:true must present a valid, unexpired key. The clock is injected (rule 7).
+ *
+ * Rules for this directory: the free server must never import from ee/; ee/ depends only on protocol +
+ * node + zod. This file imports neither server core nor any sibling outside ee/.
+ */
+import { type KeyObject } from 'node:crypto';
+import { z } from 'zod';
+/** Outcome of verifying a license key. */
+export declare const LicenseStatus: {
+    readonly VALID: "valid";
+    readonly MISSING: "missing";
+    readonly MALFORMED: "malformed";
+    readonly BAD_SIGNATURE: "bad-signature";
+    readonly EXPIRED: "expired";
+};
+export type LicenseStatus = (typeof LicenseStatus)[keyof typeof LicenseStatus];
+/** The signed claims inside a key. `exp` is epoch ms; `features` (optional) scopes which ee features unlock. */
+declare const LicensePayloadSchema: z.ZodObject<{
+    org: z.ZodString;
+    plan: z.ZodString;
+    exp: z.ZodNumber;
+    features: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    org: string;
+    plan: string;
+    exp: number;
+    features?: string[] | undefined;
+}, {
+    org: string;
+    plan: string;
+    exp: number;
+    features?: string[] | undefined;
+}>;
+export type LicensePayload = z.infer<typeof LicensePayloadSchema>;
+type LicenseCheck = {
+    status: typeof LicenseStatus.VALID;
+    payload: LicensePayload;
+} | {
+    status: Exclude<LicenseStatus, typeof LicenseStatus.VALID>;
+};
+/** Sign a payload into a license key — the ISSUER side (Reticle's private key). Exposed for the issuer tool + tests. */
+export declare function signLicenseKey(payload: LicensePayload, privateKey: KeyObject): string;
+/** Verify a key against the issuer public key. Never throws — returns a structured status. */
+export declare function verifyLicenseKey(key: string | undefined, publicKey: KeyObject, now: number): LicenseCheck;
+/** Thrown when a production-mode enterprise feature is used without a valid license. */
+export declare class EnterpriseLicenseError extends Error {
+    readonly feature: string;
+    readonly reason: string;
+    constructor(feature: string, reason: string);
+}
+/** Context for the gate. requireLicense:false ⇒ dev/eval no-op. publicKey injectable for tests. */
+export interface GateContext {
+    requireLicense: boolean;
+    now: () => number;
+    key?: string;
+    publicKey?: KeyObject;
+}
+/**
+ * Gate an enterprise feature. No-op in dev/eval (requireLicense:false). In production it throws
+ * EnterpriseLicenseError unless a valid, unexpired key that covers `feature` is present.
+ */
+export declare function assertEnterprise(feature: string, ctx: GateContext): void;
+/** Env names that carry the activation: the operator's key, and the issuer public key baked at release. */
+export declare const LICENSE_KEY_ENV = "RETICLE_LICENSE_KEY";
+export declare const LICENSE_PUBLIC_KEY_ENV = "RETICLE_LICENSE_PUBLIC_KEY";
+/**
+ * Issuer public key COMPILED INTO the build. Empty in the source tree; the release pipeline replaces
+ * this literal with the real spki PEM. Baking it (rather than only reading env) is what makes the
+ * enterprise gate fail closed: a self-hosted operator can no longer disable enforcement by simply
+ * never setting RETICLE_LICENSE_PUBLIC_KEY, because the baked key takes precedence. The public key is
+ * safe to ship openly — it can only verify licenses, never mint them (that needs the private key).
+ */
+export declare const BAKED_ISSUER_PUBLIC_KEY_PEM = "";
+/**
+ * Resolve the issuer public-key PEM enforcement uses: the baked-in release key wins, so it can't be
+ * turned off from the environment. Only when nothing is baked (dev/repo) does the env var apply — that
+ * env path is the test/self-eval escape hatch, not the production switch.
+ */
+export declare function resolveIssuerPublicKeyPem(env: NodeJS.ProcessEnv, baked?: string): string | undefined;
+/** The human-facing state of enterprise activation on this machine (what `reticle license status` shows). */
+interface LicenseReport {
+    status: 'active' | 'missing' | 'invalid' | 'expired' | 'eval';
+    org?: string;
+    plan?: string;
+    expiresAt?: number;
+    features?: string[];
+    detail: string;
+}
+/**
+ * Resolve activation entirely from the environment — the install mechanism: the release bakes the
+ * issuer public key, the operator sets RETICLE_LICENSE_KEY. No public key configured ⇒ evaluation mode
+ * (enterprise features run free, dev/test only). Offline, no phone-home.
+ */
+export declare function describeLicense(now: number, env?: NodeJS.ProcessEnv, baked?: string): LicenseReport;
+/**
+ * Gate an enterprise feature using env-resolved activation. Enforcement is ON only when the issuer
+ * public key is configured (i.e. a real release); without it (dev/repo) features run free in eval mode.
+ */
+export declare function assertEnterpriseFromEnv(feature: string, now: number, env?: NodeJS.ProcessEnv, baked?: string): void;
+export {};
+//# sourceMappingURL=license.d.ts.map

package/dist/license/license.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../../src/license/license.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAuD,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAClG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,0CAA0C;AAC1C,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE/E,gHAAgH;AAChH,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;EAKxB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,KAAK,YAAY,GACb;IAAE,MAAM,EAAE,OAAO,aAAa,CAAC,KAAK,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GAC/D;IAAE,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;CAAE,CAAC;AAKnE,wHAAwH;AACxH,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,GAAG,MAAM,CAIrF;AAED,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,MAAM,GACV,YAAY,CAqCd;AAED,wFAAwF;AACxF,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAQ5C;AAED,mGAAmG;AACnG,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,OAAO,CAAC;IACxB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAaD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CAaxE;AAED,2GAA2G;AAC3G,eAAO,MAAM,eAAe,wBAAwB,CAAC;AACrD,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,KAAK,GAAE,MAAoC,GAC1C,MAAM,GAAG,SAAS,CAIpB;AAED,6GAA6G;AAC7G,UAAU,aAAa;IACrB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAWD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE,MAAoC,GAC1C,aAAa,CAqCf;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE,MAAoC,GAC1C,IAAI,CASN"}

package/dist/license/license.js

@@ -0,0 +1,203 @@
+/**
+ * Enterprise license-key verification + the assertEnterprise gate. ENTERPRISE CODE (Reticle Enterprise
+ * License — see ./LICENSE), not the FSL that covers the rest of the server.
+ *
+ * Offline + no phone-home (preserves the no-telemetry brand): a key is a signed payload Reticle issues
+ * with its private key; this verifies it against the issuer's PUBLIC key with Ed25519. Dev/eval is a
+ * no-op (requireLicense:false) so the gate never gets in a contributor's way; only a production-mode
+ * caller with requireLicense:true must present a valid, unexpired key. The clock is injected (rule 7).
+ *
+ * Rules for this directory: the free server must never import from ee/; ee/ depends only on protocol +
+ * node + zod. This file imports neither server core nor any sibling outside ee/.
+ */
+import { createPublicKey, sign as edSign, verify as edVerify } from 'node:crypto';
+import { z } from 'zod';
+/** Outcome of verifying a license key. */
+export const LicenseStatus = {
+    VALID: 'valid',
+    MISSING: 'missing',
+    MALFORMED: 'malformed',
+    BAD_SIGNATURE: 'bad-signature',
+    EXPIRED: 'expired',
+};
+/** The signed claims inside a key. `exp` is epoch ms; `features` (optional) scopes which ee features unlock. */
+const LicensePayloadSchema = z.object({
+    org: z.string(),
+    plan: z.string(),
+    exp: z.number(),
+    features: z.array(z.string()).optional(),
+});
+/** A key is `base64url(payloadJson).base64url(ed25519Signature)`. */
+const KEY_SEP = '.';
+/** Sign a payload into a license key — the ISSUER side (Reticle's private key). Exposed for the issuer tool + tests. */
+export function signLicenseKey(payload, privateKey) {
+    const json = JSON.stringify(payload);
+    const sig = edSign(null, Buffer.from(json, 'utf8'), privateKey);
+    return `${Buffer.from(json, 'utf8').toString('base64url')}${KEY_SEP}${sig.toString('base64url')}`;
+}
+/** Verify a key against the issuer public key. Never throws — returns a structured status. */
+export function verifyLicenseKey(key, publicKey, now) {
+    if (key === undefined || key.length === 0)
+        return { status: LicenseStatus.MISSING };
+    const parts = key.split(KEY_SEP);
+    if (parts.length !== 2 ||
+        parts[0] === undefined ||
+        parts[1] === undefined ||
+        parts[0].length === 0) {
+        return { status: LicenseStatus.MALFORMED };
+    }
+    let json;
+    let payload;
+    try {
+        json = Buffer.from(parts[0], 'base64url').toString('utf8');
+        const parsed = LicensePayloadSchema.safeParse(JSON.parse(json));
+        if (!parsed.success)
+            return { status: LicenseStatus.MALFORMED };
+        payload = parsed.data;
+    }
+    catch {
+        return { status: LicenseStatus.MALFORMED };
+    }
+    let signatureOk = false;
+    try {
+        signatureOk = edVerify(null, Buffer.from(json, 'utf8'), publicKey, Buffer.from(parts[1], 'base64url'));
+    }
+    catch {
+        return { status: LicenseStatus.BAD_SIGNATURE };
+    }
+    if (!signatureOk)
+        return { status: LicenseStatus.BAD_SIGNATURE };
+    if (payload.exp <= now)
+        return { status: LicenseStatus.EXPIRED };
+    return { status: LicenseStatus.VALID, payload };
+}
+/** Thrown when a production-mode enterprise feature is used without a valid license. */
+export class EnterpriseLicenseError extends Error {
+    feature;
+    reason;
+    constructor(feature, reason) {
+        super(`Reticle Enterprise feature "${feature}" requires a valid license (${reason}). Contact hey@reticle.ai.`);
+        this.name = 'EnterpriseLicenseError';
+        this.feature = feature;
+        this.reason = reason;
+    }
+}
+/** The issuer public key from the environment (set at release / by the operator); undefined if unset. */
+function issuerPublicKey() {
+    const pem = process.env['RETICLE_LICENSE_PUBLIC_KEY'];
+    if (pem === undefined || pem.length === 0)
+        return undefined;
+    try {
+        return createPublicKey(pem);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Gate an enterprise feature. No-op in dev/eval (requireLicense:false). In production it throws
+ * EnterpriseLicenseError unless a valid, unexpired key that covers `feature` is present.
+ */
+export function assertEnterprise(feature, ctx) {
+    if (!ctx.requireLicense)
+        return;
+    const publicKey = ctx.publicKey ?? issuerPublicKey();
+    if (publicKey === undefined)
+        throw new EnterpriseLicenseError(feature, 'no-issuer-key');
+    const check = verifyLicenseKey(ctx.key, publicKey, ctx.now());
+    if (check.status !== LicenseStatus.VALID)
+        throw new EnterpriseLicenseError(feature, check.status);
+    const { features } = check.payload;
+    if (features !== undefined && !features.includes(feature)) {
+        throw new EnterpriseLicenseError(feature, 'feature-not-licensed');
+    }
+}
+/** Env names that carry the activation: the operator's key, and the issuer public key baked at release. */
+export const LICENSE_KEY_ENV = 'RETICLE_LICENSE_KEY';
+export const LICENSE_PUBLIC_KEY_ENV = 'RETICLE_LICENSE_PUBLIC_KEY';
+/**
+ * Issuer public key COMPILED INTO the build. Empty in the source tree; the release pipeline replaces
+ * this literal with the real spki PEM. Baking it (rather than only reading env) is what makes the
+ * enterprise gate fail closed: a self-hosted operator can no longer disable enforcement by simply
+ * never setting RETICLE_LICENSE_PUBLIC_KEY, because the baked key takes precedence. The public key is
+ * safe to ship openly — it can only verify licenses, never mint them (that needs the private key).
+ */
+export const BAKED_ISSUER_PUBLIC_KEY_PEM = '';
+/**
+ * Resolve the issuer public-key PEM enforcement uses: the baked-in release key wins, so it can't be
+ * turned off from the environment. Only when nothing is baked (dev/repo) does the env var apply — that
+ * env path is the test/self-eval escape hatch, not the production switch.
+ */
+export function resolveIssuerPublicKeyPem(env, baked = BAKED_ISSUER_PUBLIC_KEY_PEM) {
+    if (baked.length > 0)
+        return baked;
+    const envPem = env[LICENSE_PUBLIC_KEY_ENV];
+    return envPem !== undefined && envPem.length > 0 ? envPem : undefined;
+}
+function loadPublicKey(pem) {
+    if (pem === undefined || pem.length === 0)
+        return undefined;
+    try {
+        return createPublicKey(pem);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Resolve activation entirely from the environment — the install mechanism: the release bakes the
+ * issuer public key, the operator sets RETICLE_LICENSE_KEY. No public key configured ⇒ evaluation mode
+ * (enterprise features run free, dev/test only). Offline, no phone-home.
+ */
+export function describeLicense(now, env = process.env, baked = BAKED_ISSUER_PUBLIC_KEY_PEM) {
+    const pem = resolveIssuerPublicKeyPem(env, baked);
+    if (pem === undefined || pem.length === 0) {
+        return {
+            status: 'eval',
+            detail: 'evaluation mode — enterprise features run free (no issuer key configured)',
+        };
+    }
+    const publicKey = loadPublicKey(pem);
+    if (publicKey === undefined)
+        return { status: 'invalid', detail: `${LICENSE_PUBLIC_KEY_ENV} is not a valid public key` };
+    const check = verifyLicenseKey(env[LICENSE_KEY_ENV], publicKey, now);
+    if (check.status === LicenseStatus.VALID) {
+        const { org, plan, exp, features } = check.payload;
+        return {
+            status: 'active',
+            org,
+            plan,
+            expiresAt: exp,
+            ...(features !== undefined ? { features } : {}),
+            detail: `licensed to ${org} (${plan}), expires ${new Date(exp).toISOString()}`,
+        };
+    }
+    if (check.status === LicenseStatus.MISSING) {
+        return {
+            status: 'missing',
+            detail: `set ${LICENSE_KEY_ENV} to activate enterprise features in production`,
+        };
+    }
+    if (check.status === LicenseStatus.EXPIRED) {
+        return {
+            status: 'expired',
+            detail: 'license expired — renew to keep using enterprise features',
+        };
+    }
+    return { status: 'invalid', detail: `license key rejected (${check.status})` };
+}
+/**
+ * Gate an enterprise feature using env-resolved activation. Enforcement is ON only when the issuer
+ * public key is configured (i.e. a real release); without it (dev/repo) features run free in eval mode.
+ */
+export function assertEnterpriseFromEnv(feature, now, env = process.env, baked = BAKED_ISSUER_PUBLIC_KEY_PEM) {
+    const publicKey = loadPublicKey(resolveIssuerPublicKeyPem(env, baked));
+    const key = env[LICENSE_KEY_ENV];
+    assertEnterprise(feature, {
+        requireLicense: publicKey !== undefined,
+        now: () => now,
+        ...(key !== undefined ? { key } : {}),
+        ...(publicKey !== undefined ? { publicKey } : {}),
+    });
+}
+//# sourceMappingURL=license.js.map

package/dist/license/license.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.js","sourceRoot":"","sources":["../../src/license/license.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,eAAe,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,IAAI,QAAQ,EAAkB,MAAM,aAAa,CAAC;AAClG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,0CAA0C;AAC1C,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,aAAa,EAAE,eAAe;IAC9B,OAAO,EAAE,SAAS;CACV,CAAC;AAGX,gHAAgH;AAChH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAOH,qEAAqE;AACrE,MAAM,OAAO,GAAG,GAAG,CAAC;AAEpB,wHAAwH;AACxH,MAAM,UAAU,cAAc,CAAC,OAAuB,EAAE,UAAqB;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IAChE,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACpG,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAC9B,GAAuB,EACvB,SAAoB,EACpB,GAAW;IAEX,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC;IACpF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QACtB,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QACtB,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EACrB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,CAAC;QAChE,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,QAAQ,CACpB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EACzB,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CACnC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,aAAa,EAAE,CAAC;IACjE,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC;IACjE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,wFAAwF;AACxF,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,OAAO,CAAS;IAChB,MAAM,CAAS;IACxB,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CACH,+BAA+B,OAAO,+BAA+B,MAAM,4BAA4B,CACxG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAUD,yGAAyG;AACzG,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACtD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,GAAgB;IAChE,IAAI,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO;IAEhC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,eAAe,EAAE,CAAC;IACrD,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,IAAI,sBAAsB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAExF,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,KAAK;QAAE,MAAM,IAAI,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAElG,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,sBAAsB,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AACrD,MAAM,CAAC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAsB,EACtB,QAAgB,2BAA2B;IAE3C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC3C,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAYD,SAAS,aAAa,CAAC,GAAuB;IAC5C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,MAAyB,OAAO,CAAC,GAAG,EACpC,QAAgB,2BAA2B;IAE3C,MAAM,GAAG,GAAG,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,2EAA2E;SACpF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,KAAK,SAAS;QACzB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,sBAAsB,4BAA4B,EAAE,CAAC;IAE9F,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;QACnD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,GAAG;YACH,IAAI;YACJ,SAAS,EAAE,GAAG;YACd,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,MAAM,EAAE,eAAe,GAAG,KAAK,IAAI,cAAc,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;SAC/E,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,OAAO,eAAe,gDAAgD;SAC/E,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,2DAA2D;SACpE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,GAAW,EACX,MAAyB,OAAO,CAAC,GAAG,EACpC,QAAgB,2BAA2B;IAE3C,MAAM,SAAS,GAAG,aAAa,CAAC,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACjC,gBAAgB,CAAC,OAAO,EAAE;QACxB,cAAc,EAAE,SAAS,KAAK,SAAS;QACvC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG;QACd,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;AACL,CAAC"}

package/dist/log.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Structured logging to stderr. stdout is reserved for the MCP stdio transport — never
+ * write logs there.
+ */
+export declare function log(event: string, fields?: Record<string, unknown>): void;
+//# sourceMappingURL=log.d.ts.map

package/dist/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,IAAI,CAG7E"}

package/dist/log.js

@@ -0,0 +1,9 @@
+/**
+ * Structured logging to stderr. stdout is reserved for the MCP stdio transport — never
+ * write logs there.
+ */
+export function log(event, fields = {}) {
+    const line = JSON.stringify({ event, ...fields });
+    process.stderr.write(`${line}\n`);
+}
+//# sourceMappingURL=log.js.map

package/dist/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,SAAkC,EAAE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC"}

package/dist/mcp-proxy.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Returns true if something is already listening on the reticle port.
+ * Uses a plain TCP probe so we don't create a side-effectful SSE session
+ * inside the daemon just to check reachability.
+ */
+export declare function probeDaemon(port: number): Promise<boolean>;
+/** Poll until the daemon's HTTP port accepts connections or the deadline is reached. */
+export declare function waitForDaemon(port: number): Promise<void>;
+/**
+ * Bridge stdio ↔ SSE: connects to the running daemon's MCP endpoint and forwards
+ * Claude Code's stdin/stdout JSON-RPC through it. Never resolves — runs until
+ * stdin closes or the SSE stream ends (at which point the process exits so
+ * Claude Code restarts the proxy fresh).
+ */
+export declare function startMcpProxy(port: number): Promise<never>;
+//# sourceMappingURL=mcp-proxy.d.ts.map

package/dist/mcp-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-proxy.d.ts","sourceRoot":"","sources":["../src/mcp-proxy.ts"],"names":[],"mappings":"AAuBA;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAe1D;AAED,wFAAwF;AACxF,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU/D;AAiCD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAuF1D"}

package/dist/mcp-proxy.js

@@ -0,0 +1,168 @@
+import * as http from 'node:http';
+import * as net from 'node:net';
+import { LOOPBACK_HOST } from '@reticlehq/core';
+import { MCP_SSE_PATH } from './http-server.js';
+import { log } from './log.js';
+const DEFAULT_DAEMON_READY_TIMEOUT_MS = 10_000;
+/**
+ * How long to wait for the spawned daemon's port to accept connections before giving up. The default
+ * suits a normal machine; a slow CI/VM (heavy headless-browser launch) can raise it via the
+ * RETICLE_DAEMON_READY_TIMEOUT_MS env var. Invalid/absent values fall back to the default.
+ */
+const envDaemonReadyTimeoutMs = Number(process.env['RETICLE_DAEMON_READY_TIMEOUT_MS']);
+const DAEMON_READY_TIMEOUT_MS = Number.isFinite(envDaemonReadyTimeoutMs) && envDaemonReadyTimeoutMs > 0
+    ? envDaemonReadyTimeoutMs
+    : DEFAULT_DAEMON_READY_TIMEOUT_MS;
+const DAEMON_POLL_INTERVAL_MS = 100;
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Returns true if something is already listening on the reticle port.
+ * Uses a plain TCP probe so we don't create a side-effectful SSE session
+ * inside the daemon just to check reachability.
+ */
+export function probeDaemon(port) {
+    return new Promise((resolve) => {
+        const socket = new net.Socket();
+        socket.setTimeout(500);
+        socket.on('connect', () => {
+            socket.destroy();
+            resolve(true);
+        });
+        socket.on('error', () => resolve(false));
+        socket.on('timeout', () => {
+            socket.destroy();
+            resolve(false);
+        });
+        socket.connect(port, LOOPBACK_HOST);
+    });
+}
+/** Poll until the daemon's HTTP port accepts connections or the deadline is reached. */
+export async function waitForDaemon(port) {
+    const deadline = Date.now() + DAEMON_READY_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+        const reachable = await probeDaemon(port);
+        if (reachable)
+            return;
+        await delay(DAEMON_POLL_INTERVAL_MS);
+    }
+    throw new Error(`reticle daemon did not become ready on port ${port} within ${DAEMON_READY_TIMEOUT_MS}ms`);
+}
+function postToSession(url, body) {
+    return new Promise((resolve) => {
+        const parsed = new URL(url);
+        const bodyBuf = Buffer.from(body, 'utf8');
+        const options = {
+            host: parsed.hostname,
+            port: parsed.port !== '' ? parseInt(parsed.port, 10) : 80,
+            path: `${parsed.pathname}${parsed.search}`,
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Content-Length': bodyBuf.byteLength,
+            },
+        };
+        const req = http.request(options, (res) => {
+            res.resume(); // drain so the socket is reused
+            resolve();
+        });
+        req.on('error', (err) => {
+            log('reticle_mcp_proxy_post_error', { error: err.message });
+            resolve();
+        });
+        req.write(bodyBuf);
+        req.end();
+    });
+}
+function buildSessionUrl(rawData, port) {
+    return rawData.startsWith('/') ? `http://${LOOPBACK_HOST}:${port}${rawData}` : rawData;
+}
+/**
+ * Bridge stdio ↔ SSE: connects to the running daemon's MCP endpoint and forwards
+ * Claude Code's stdin/stdout JSON-RPC through it. Never resolves — runs until
+ * stdin closes or the SSE stream ends (at which point the process exits so
+ * Claude Code restarts the proxy fresh).
+ */
+export function startMcpProxy(port) {
+    return new Promise((_resolve, reject) => {
+        let postUrl = null;
+        const stdinQueue = [];
+        // ── SSE reader ──────────────────────────────────────────────────────────
+        const req = http.get({ host: LOOPBACK_HOST, port, path: MCP_SSE_PATH }, (res) => {
+            res.setEncoding('utf8');
+            let sseBuffer = '';
+            let currentEvent = '';
+            let currentData = '';
+            res.on('data', (chunk) => {
+                sseBuffer += chunk;
+                // Normalise CRLF/CR so the line splitter only needs to handle \n
+                const normalised = sseBuffer.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+                const lines = normalised.split('\n');
+                sseBuffer = lines.pop() ?? '';
+                for (const line of lines) {
+                    if (line === '') {
+                        // Blank line → dispatch accumulated event
+                        if (currentData !== '') {
+                            onSseEvent(currentEvent !== '' ? currentEvent : 'message', currentData, port);
+                        }
+                        currentEvent = '';
+                        currentData = '';
+                    }
+                    else if (line.startsWith('event:')) {
+                        currentEvent = line.slice(6).trim();
+                    }
+                    else if (line.startsWith('data:')) {
+                        const val = line.slice(5).trim();
+                        currentData = currentData !== '' ? `${currentData}\n${val}` : val;
+                    }
+                    // id:/retry:/comment lines are ignored — not needed for the MCP bridge
+                }
+            });
+            res.on('end', () => {
+                log('reticle_mcp_proxy_sse_ended', { port });
+                process.exit(0);
+            });
+            res.on('error', (err) => {
+                log('reticle_mcp_proxy_sse_error', { error: err.message });
+                process.exit(1);
+            });
+        });
+        req.on('error', (err) => reject(err));
+        function onSseEvent(event, data, p) {
+            if (event === 'endpoint') {
+                const url = buildSessionUrl(data, p);
+                postUrl = url;
+                // Flush messages that arrived before the session URL was known
+                for (const queued of stdinQueue.splice(0)) {
+                    void postToSession(url, queued);
+                }
+                return;
+            }
+            if (event === 'message') {
+                process.stdout.write(`${data}\n`);
+            }
+        }
+        // ── stdin reader ─────────────────────────────────────────────────────────
+        process.stdin.setEncoding('utf8');
+        let stdinBuffer = '';
+        process.stdin.on('data', (chunk) => {
+            stdinBuffer += chunk;
+            const lines = stdinBuffer.split('\n');
+            stdinBuffer = lines.pop() ?? '';
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (trimmed === '')
+                    continue;
+                if (postUrl === null) {
+                    stdinQueue.push(trimmed);
+                }
+                else {
+                    void postToSession(postUrl, trimmed);
+                }
+            }
+        });
+        process.stdin.on('end', () => process.exit(0));
+    });
+}
+//# sourceMappingURL=mcp-proxy.js.map

package/dist/mcp-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-proxy.js","sourceRoot":"","sources":["../src/mcp-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAC/C;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;AACvF,MAAM,uBAAuB,GAC3B,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,uBAAuB,GAAG,CAAC;IACrE,CAAC,CAAC,uBAAuB;IACzB,CAAC,CAAC,+BAA+B,CAAC;AACtC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,SAAS;YAAE,OAAO;QACtB,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,WAAW,uBAAuB,IAAI,CAC1F,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,IAAY;IAC9C,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAwB;YACnC,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;YACzD,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,OAAO,CAAC,UAAU;aACrC;SACF,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,gCAAgC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtB,GAAG,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,IAAY;IACpD,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,aAAa,IAAI,IAAI,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACzF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,2EAA2E;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC9E,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAExB,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,IAAI,YAAY,GAAG,EAAE,CAAC;YACtB,IAAI,WAAW,GAAG,EAAE,CAAC;YAErB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,SAAS,IAAI,KAAK,CAAC;gBACnB,iEAAiE;gBACjE,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACzE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrC,SAAS,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;gBAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;wBAChB,0CAA0C;wBAC1C,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;4BACvB,UAAU,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;wBAChF,CAAC;wBACD,YAAY,GAAG,EAAE,CAAC;wBAClB,WAAW,GAAG,EAAE,CAAC;oBACnB,CAAC;yBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACrC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBACtC,CAAC;yBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;wBACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;wBACjC,WAAW,GAAG,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;oBACpE,CAAC;oBACD,uEAAuE;gBACzE,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,GAAG,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACtB,GAAG,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAEtC,SAAS,UAAU,CAAC,KAAa,EAAE,IAAY,EAAE,CAAS;YACxD,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACrC,OAAO,GAAG,GAAG,CAAC;gBACd,+DAA+D;gBAC/D,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1C,KAAK,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAClC,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,WAAW,GAAG,EAAE,CAAC;QAErB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,WAAW,IAAI,KAAK,CAAC;YACrB,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,WAAW,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,OAAO,KAAK,EAAE;oBAAE,SAAS;gBAC7B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,KAAK,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/mcp.d.ts

@@ -0,0 +1,14 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { type ToolDeps } from './tools/tools.js';
+import { type ToolProfile } from './tools/profiles.js';
+/**
+ * Serialize a tool result to the MCP `text` content block. The agent consumes this text — the
+ * typed contract travels separately as `structuredContent`, unchanged by encoding — so the text
+ * is compact JSON (no indentation) by default: pretty-printing spends a whitespace token on every
+ * field of every line, ~40% overhead on the structured payloads that dominate Reticle's cost, for
+ * readability only a human re-reading a raw transcript would notice. Opt into the older indented
+ * form with `RETICLE_ENCODING=pretty`; `RETICLE_ENCODING=toon` is the even-denser tabular encoding.
+ */
+export declare function encodeResult(result: unknown, encoding: string): string;
+export declare function createMcpServer(deps: ToolDeps, profile?: ToolProfile): McpServer;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,OAAO,EAAS,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAA6B,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAwClF;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKtE;AAuBD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,QAAQ,EACd,OAAO,GAAE,WAAiC,GACzC,SAAS,CAgDX"}