@trusty-squire/mcp 1.1.13 → 1.1.14-rc.10

package/dist/bot/broker/identity-lane.d.ts

@@ -0,0 +1,3 @@
+/** Probe + OAuth coordination shares one broker-process resource. */
+export declare function withBrokerIdentityLane<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T>;
+//# sourceMappingURL=identity-lane.d.ts.map

package/dist/bot/broker/identity-lane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-lane.d.ts","sourceRoot":"","sources":["../../../src/bot/broker/identity-lane.ts"],"names":[],"mappings":"AAGA,qEAAqE;AACrE,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,CAAC,CAAC,CAQZ"}

package/dist/bot/broker/identity-lane.js

@@ -0,0 +1,15 @@
+import { randomUUID } from "node:crypto";
+import { ScopeScheduler } from "./scheduler.js";
+const scheduler = new ScopeScheduler();
+/** Probe + OAuth coordination shares one broker-process resource. */
+export async function withBrokerIdentityLane(operation, signal) {
+    const owner = randomUUID();
+    await scheduler.reserve(owner, ["identity"], signal);
+    try {
+        return await operation();
+    }
+    finally {
+        scheduler.release(owner);
+    }
+}
+//# sourceMappingURL=identity-lane.js.map

package/dist/bot/broker/identity-lane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-lane.js","sourceRoot":"","sources":["../../../src/bot/broker/identity-lane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,MAAM,SAAS,GAAG,IAAI,cAAc,EAAE,CAAC;AACvC,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA2B,EAC3B,MAAoB;IAEpB,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/dist/bot/broker/lineage.d.ts

@@ -0,0 +1,3 @@
+export declare function forwarderId(credential: string): string;
+export declare function requireLineageCredential(): string;
+//# sourceMappingURL=lineage.d.ts.map

package/dist/bot/broker/lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lineage.d.ts","sourceRoot":"","sources":["../../../src/bot/broker/lineage.ts"],"names":[],"mappings":"AAKA,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CASjD"}

package/dist/bot/broker/lineage.js

@@ -0,0 +1,16 @@
+import { createHash } from "node:crypto";
+import { BrokerRefusal } from "./scheduler.js";
+const CREDENTIAL = /^[A-Za-z0-9_-]{43,128}$/;
+export function forwarderId(credential) {
+    if (!CREDENTIAL.test(credential))
+        throw new BrokerRefusal("forwarder_credential_invalid", "Forwarder lineage credential must be an unguessable base64url secret");
+    return createHash("sha256").update(credential).digest("hex");
+}
+export function requireLineageCredential() {
+    const credential = process.env.TRUSTY_SQUIRE_FORWARDER_CREDENTIAL;
+    if (credential === undefined)
+        throw new BrokerRefusal("forwarder_credential_required", "Set a stable forwarder lineage credential before using the broker");
+    forwarderId(credential);
+    return credential;
+}
+//# sourceMappingURL=lineage.js.map

package/dist/bot/broker/lineage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lineage.js","sourceRoot":"","sources":["../../../src/bot/broker/lineage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAE7C,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9B,MAAM,IAAI,aAAa,CACrB,8BAA8B,EAC9B,sEAAsE,CACvE,CAAC;IACJ,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;IAClE,IAAI,UAAU,KAAK,SAAS;QAC1B,MAAM,IAAI,aAAa,CACrB,+BAA+B,EAC/B,mEAAmE,CACpE,CAAC;IACJ,WAAW,CAAC,UAAU,CAAC,CAAC;IACxB,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/bot/broker/maintenance.d.ts

@@ -0,0 +1,4 @@
+/** Connect retains the maintenance connection throughout the existing plain,
+ * no-CDP login lifecycle. It never opens a second automated browser. */
+export declare function withBrokerMaintenance<T>(operation: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=maintenance.d.ts.map

package/dist/bot/broker/maintenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance.d.ts","sourceRoot":"","sources":["../../../src/bot/broker/maintenance.ts"],"names":[],"mappings":"AAOA;wEACwE;AACxE,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CA+CtF"}

package/dist/bot/broker/maintenance.js

@@ -0,0 +1,49 @@
+import { lstat } from "node:fs/promises";
+import { randomBytes } from "node:crypto";
+import { createSessionGuard } from "../../session-guard.js";
+import { BrokerClient } from "./transport.js";
+import { BrokerRefusal } from "./scheduler.js";
+import { reclaimDeadBrokerEndpoint } from "./discovery.js";
+/** Connect retains the maintenance connection throughout the existing plain,
+ * no-CDP login lifecycle. It never opens a second automated browser. */
+export async function withBrokerMaintenance(operation) {
+    const path = process.env.TRUSTY_SQUIRE_BROKER_SOCKET;
+    if (path === undefined ||
+        !(await lstat(path).then(() => true, () => false)))
+        return await operation();
+    const session = await createSessionGuard().bind();
+    if (session?.agent_session_token === undefined)
+        throw new BrokerRefusal("unauthorized", "Broker maintenance requires the enrolled account");
+    let client;
+    try {
+        client = await BrokerClient.connect(path, session.agent_session_token, randomBytes(32).toString("base64url"));
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ECONNREFUSED" && code !== "broker_lost")
+            throw error;
+        await reclaimDeadBrokerEndpoint(path);
+        return await operation();
+    }
+    let ready = false;
+    try {
+        const deadline = Date.now() + 120000;
+        do {
+            const result = (await client.call("maintenance", {}));
+            if (result.state === "ready") {
+                ready = true;
+                break;
+            }
+            await new Promise((resolve) => setTimeout(resolve, 500));
+        } while (Date.now() < deadline);
+        if (!ready)
+            throw new BrokerRefusal("maintenance", "Active workflows or payment outcomes still own the browser; finish them before reconnecting");
+        return await operation();
+    }
+    finally {
+        if (ready)
+            await client.call("resume", {}).catch(() => undefined);
+        await client.close();
+    }
+}
+//# sourceMappingURL=maintenance.js.map

package/dist/bot/broker/maintenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance.js","sourceRoot":"","sources":["../../../src/bot/broker/maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE3D;wEACwE;AACxE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAI,SAA2B;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACrD,IACE,IAAI,KAAK,SAAS;QAClB,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CACtB,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;QAEF,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,OAAO,EAAE,mBAAmB,KAAK,SAAS;QAC5C,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,kDAAkD,CAAC,CAAC;IAC9F,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CACjC,IAAI,EACJ,OAAO,CAAC,mBAAmB,EAC3B,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CACtC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,aAAa;YAAE,MAAM,KAAK,CAAC;QACnE,MAAM,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACrC,GAAG,CAAC;YACF,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAsB,CAAC;YAC3E,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC7B,KAAK,GAAG,IAAI,CAAC;gBACb,MAAM;YACR,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3D,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE;QAChC,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,aAAa,CACrB,aAAa,EACb,6FAA6F,CAC9F,CAAC;QACJ,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/bot/broker/operator.d.ts

@@ -0,0 +1,48 @@
+import type { AuthorizedPreDispatchFailure, DispatchJournal, ReconciledDispatchOutcome } from "./dispatch-journal.js";
+import { type ApiClientConfig } from "../../api-client.js";
+import { BrokerAuthority, type BrokerPrincipal, type TabCapability } from "./authority.js";
+import type { BrokerTransportPort } from "./transport.js";
+export declare function reconciliationOutcome(operation: string, result: unknown): ReconciledDispatchOutcome;
+export declare function brokerCommandMutates(name: string, args: Record<string, unknown>): boolean;
+/** Existing handlers and per-session payment state run unchanged INSIDE the
+ * broker. Every MCP connection gets its own pinned API client and capability. */
+export declare class OperatorBroker implements BrokerTransportPort {
+    private readonly config;
+    private readonly journal?;
+    private readonly legacyPreDispatchAuthorization?;
+    readonly authority: BrokerAuthority;
+    private readonly apis;
+    private readonly inputBindingKeys;
+    private readonly tools;
+    private token;
+    constructor(config: ApiClientConfig & {
+        accountId: string;
+    }, cellId: string, journal?: DispatchJournal | undefined, legacyPreDispatchAuthorization?: AuthorizedPreDispatchFailure | undefined);
+    refreshCredentials(session: {
+        account_id?: string;
+        agent_session_token?: string;
+    }): void;
+    authenticate(token: string, agentId?: string, lineageCredential?: string, supervisor?: boolean): Promise<Omit<BrokerPrincipal, "clientId"> | null>;
+    private inputHash;
+    connected(principal: BrokerPrincipal): Promise<void> | void;
+    call(principal: BrokerPrincipal, method: string, params: Record<string, unknown>, requestId: string): Promise<unknown>;
+    recover(principal: BrokerPrincipal, params: Record<string, unknown>): Promise<{
+        requestId: string;
+        capability?: TabCapability;
+        result: {
+            reconciliation: ReconciledDispatchOutcome & {
+                request_id: string;
+                operation: string;
+            };
+        } | Record<string, unknown>;
+    } | null>;
+    reclaim(principal: BrokerPrincipal): Promise<{
+        capabilities: TabCapability[];
+    }>;
+    confirmStartDelivery(principal: BrokerPrincipal, params: Record<string, unknown>): Promise<void>;
+    reap(now?: number): Promise<void>;
+    acknowledge(principal: BrokerPrincipal, requestId: string): Promise<void>;
+    canContinuePaymentStatus(principal: BrokerPrincipal, params: Record<string, unknown>): Promise<boolean>;
+    disconnect(principal: BrokerPrincipal, explicit?: boolean): Promise<void>;
+}
+//# sourceMappingURL=operator.d.ts.map

package/dist/bot/broker/operator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../../src/bot/broker/operator.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,4BAA4B,EAC5B,eAAe,EACf,yBAAyB,EAC1B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAatE,OAAO,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAwF1D,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,OAAO,GACd,yBAAyB,CAmB3B;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAKzF;AAED;iFACiF;AACjF,qBAAa,cAAe,YAAW,mBAAmB;IAOtD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAC;IATlD,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuB;IAC7C,OAAO,CAAC,KAAK,CAAS;gBAEH,MAAM,EAAE,eAAe,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,EAChE,MAAM,EAAE,MAAM,EACG,OAAO,CAAC,EAAE,eAAe,YAAA,EACzB,8BAA8B,CAAC,EAAE,4BAA4B,YAAA;IAYhF,kBAAkB,CAAC,OAAO,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAUlF,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,EAChB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,UAAU,UAAQ,GACjB,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;IAiBpD,OAAO,CAAC,SAAS;IAOjB,SAAS,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAIrD,IAAI,CACR,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;IAmRb,OAAO,CACX,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;QACT,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,aAAa,CAAC;QAC3B,MAAM,EACF;YACE,cAAc,EAAE,yBAAyB,GAAG;gBAAE,UAAU,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAA;aAAE,CAAC;SACvF,GACD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC7B,GAAG,IAAI,CAAC;IAmFH,OAAO,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;IAG/E,oBAAoB,CACxB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,IAAI,CAAC;IAMV,IAAI,CAAC,GAAG,SAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAWrC,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzE,wBAAwB,CAC5B,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,OAAO,CAAC;IAsBb,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAa9E"}