@wardby/cli 0.7.0 → 0.8.0

package/dist/core/grants.d.ts

@@ -14,6 +14,7 @@ export declare const LEVELS: {
     readonly agent: readonly ["read", "execute", "write"];
     readonly tool: readonly ["read", "use", "write"];
     readonly budget_group: readonly ["read", "use", "write"];
+    readonly mcp_server: readonly ["read", "use", "write"];
 };
 export type ResourceType = keyof typeof LEVELS;
 export type Level<T extends ResourceType = ResourceType> = (typeof LEVELS)[T][number];
@@ -29,8 +30,9 @@ export declare const EVERYONE_MAX: {
     readonly agent: "write";
     readonly tool: "use";
     readonly budget_group: "use";
+    readonly mcp_server: "use";
 };
-/** Types grant_access/revoke_access accept today (Phase 1: agents only). */
+/** Types grant_access/revoke_access accept today: agents and MCP servers. */
 export declare const SHAREABLE_TYPES: readonly ResourceType[];
 export declare const EVERYONE_KEY = "everyone";
 export declare function principalGranteeKey(principalId: string): string;
@@ -74,7 +76,7 @@ export declare function canDelegate(db: GrantDb, parent: {
 }): Promise<boolean>;
 /** The create-data for an everyone grant (migration, import, CLI --public). */
 export declare function everyoneGrantData(type: ResourceType, resourceId: string, level: string, source: string): {
-    resourceType: "tool" | "agent" | "budget_group";
+    resourceType: "tool" | "agent" | "budget_group" | "mcp_server";
     resourceId: string;
     granteeKind: string;
     granteePrincipalId: null;
@@ -82,9 +84,32 @@ export declare function everyoneGrantData(type: ResourceType, resourceId: string
     level: string;
     source: string;
 };
+/**
+ * True when `ownerId` owns the MCP server or holds use (or higher) on it through a grant. An agent's MCP
+ * attachment is legitimate only while its owner can use the server: runs check it on load and on every
+ * call, and the cleanup paths (make_owner, adopt-public, prune-bindings, revoke_access and grant_access
+ * lowering a level) drop the attachments that fail it.
+ */
+export declare function ownerCanUseMcpServer(db: GrantDb, ownerId: string | null, server: {
+    id: string;
+    ownerId: string | null;
+}): Promise<boolean>;
+/** Keeps the items whose server the owner cannot use (see ownerCanUseMcpServer). */
+export declare function filterUnusableMcpServers<T extends {
+    server: {
+        id: string;
+        ownerId: string | null;
+    };
+}>(db: GrantDb, ownerOf: (item: T) => string | null, items: T[]): Promise<T[]>;
+/**
+ * After a grant on an MCP server is revoked or lowered: deletes the server's attachments whose agent owner
+ * can no longer use it (see ownerCanUseMcpServer), in the caller's transaction. The server owner's own
+ * agents are never touched. Returns how many were removed.
+ */
+export declare function pruneUnusableMcpAttachments(db: GrantDb & Pick<PrismaClient, "agentMcpServer">, serverId: string): Promise<number>;
 /** Every resource delete path calls this in the same transaction (no FK on resourceId). */
 export declare function deleteGrantsFor(db: GrantDb, type: ResourceType, resourceId: string): Promise<number>;
-type BindingDb = Pick<PrismaClient, "agentSecret" | "agentDatastore" | "agentRepository" | "agentSubAgent" | "agentTool" | "codingAgentProfile">;
+type BindingDb = Pick<PrismaClient, "agentSecret" | "agentDatastore" | "agentRepository" | "agentSubAgent" | "agentTool" | "codingAgentProfile" | "agentMcpServer">;
 /**
  * The owner-only bindings an agent holds, by kind (empty = none). An agent
  * may be public-write only while this is empty; binding a secret, datastore,

package/dist/core/grants.js

@@ -2,6 +2,7 @@ export const LEVELS = {
     agent: ["read", "execute", "write"],
     tool: ["read", "use", "write"],
     budget_group: ["read", "use", "write"],
+    mcp_server: ["read", "use", "write"],
 };
 /**
  * Highest level an "everyone" grant may carry. Agents may be public-write
@@ -10,9 +11,9 @@ export const LEVELS = {
  * the binding tools. Otherwise anyone could rewrite the prompt of an agent
  * that holds its owner's secrets.
  */
-export const EVERYONE_MAX = { agent: "write", tool: "use", budget_group: "use" };
-/** Types grant_access/revoke_access accept today (Phase 1: agents only). */
-export const SHAREABLE_TYPES = ["agent"];
+export const EVERYONE_MAX = { agent: "write", tool: "use", budget_group: "use", mcp_server: "use" };
+/** Types grant_access/revoke_access accept today: agents and MCP servers. */
+export const SHAREABLE_TYPES = ["agent", "mcp_server"];
 export const EVERYONE_KEY = "everyone";
 export function principalGranteeKey(principalId) {
     return `principal:${principalId}`;
@@ -119,6 +120,44 @@ export function everyoneGrantData(type, resourceId, level, source) {
         source,
     };
 }
+/**
+ * True when `ownerId` owns the MCP server or holds use (or higher) on it through a grant. An agent's MCP
+ * attachment is legitimate only while its owner can use the server: runs check it on load and on every
+ * call, and the cleanup paths (make_owner, adopt-public, prune-bindings, revoke_access and grant_access
+ * lowering a level) drop the attachments that fail it.
+ */
+export async function ownerCanUseMcpServer(db, ownerId, server) {
+    if (ownerId === null)
+        return false;
+    return atLeast("mcp_server", await effectiveAccess(db, "mcp_server", server, ownerId), "use");
+}
+/** Keeps the items whose server the owner cannot use (see ownerCanUseMcpServer). */
+export async function filterUnusableMcpServers(db, ownerOf, items) {
+    const unusable = [];
+    for (const item of items) {
+        if (!(await ownerCanUseMcpServer(db, ownerOf(item), item.server)))
+            unusable.push(item);
+    }
+    return unusable;
+}
+/**
+ * After a grant on an MCP server is revoked or lowered: deletes the server's attachments whose agent owner
+ * can no longer use it (see ownerCanUseMcpServer), in the caller's transaction. The server owner's own
+ * agents are never touched. Returns how many were removed.
+ */
+export async function pruneUnusableMcpAttachments(db, serverId) {
+    const rows = await db.agentMcpServer.findMany({
+        where: { serverId },
+        include: { server: { select: { id: true, ownerId: true } }, agent: { select: { ownerId: true } } },
+    });
+    const unusable = await filterUnusableMcpServers(db, (row) => row.agent.ownerId, rows);
+    if (unusable.length === 0)
+        return 0;
+    const { count } = await db.agentMcpServer.deleteMany({
+        where: { serverId, agentId: { in: unusable.map((row) => row.agentId) } },
+    });
+    return count;
+}
 /** Every resource delete path calls this in the same transaction (no FK on resourceId). */
 export async function deleteGrantsFor(db, type, resourceId) {
     const { count } = await db.resourceGrant.deleteMany({ where: { resourceType: type, resourceId } });
@@ -133,7 +172,7 @@ export async function deleteGrantsFor(db, type, resourceId) {
  * coding task.
  */
 export async function agentOwnerBindings(db, agentId) {
-    const [secrets, datastores, repositories, subagents, capabilityTools, codingProfiles] = await Promise.all([
+    const [secrets, datastores, repositories, subagents, capabilityTools, codingProfiles, mcpServers] = await Promise.all([
         db.agentSecret.count({ where: { agentId } }),
         db.agentDatastore.count({ where: { agentId } }),
         db.agentRepository.count({ where: { agentId } }),
@@ -153,6 +192,8 @@ export async function agentOwnerBindings(db, agentId) {
             },
         }),
         db.codingAgentProfile.count({ where: { agentId } }),
+        // A server's brokered secrets act for its owner on every call.
+        db.agentMcpServer.count({ where: { agentId } }),
     ]);
     return Object.entries({
         secrets,
@@ -161,6 +202,7 @@ export async function agentOwnerBindings(db, agentId) {
         "sub-agents": subagents,
         "tool capabilities": capabilityTools,
         "a coding repository": codingProfiles,
+        "MCP servers": mcpServers,
     })
         .filter(([, count]) => count > 0)
         .map(([kind]) => kind);

package/dist/core/host-events.js

@@ -6,6 +6,7 @@
  * docs/private/2026-09-25-code-review-host-design.md §6.3.
  */
 import { Prisma } from "#prisma";
+import { codeProviderOf, pullRequestWebUrl } from "../coding/code-host.js";
 import { linkedPullRequestAttribution, openingRunAttribution, resolveWorkItem, RESPONSE_PATH_SNAPSHOT_BUDGET, } from "./attribution.js";
 import { headStoppedAtBudget, pushingRunInFlight } from "./budget-stopped-head.js";
 import { checkContinuation, dispatchRun } from "./dispatch.js";
@@ -290,7 +291,7 @@ export function continuationHint(prNumber, runId) {
         `continued instead of opening a new one.]`);
 }
 const HINT_RUN_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
-const HINT_REPOSITORY = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+const HINT_REPOSITORY = /^(?:[a-z][a-z0-9-]{1,30}:)?[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
 /** One hint per open sibling (stored rows only; links built, ids re-validated), then the shared guidance. */
 export function siblingContinuationHints(siblings) {
     const lines = siblings
@@ -299,8 +300,11 @@ export function siblingContinuationHints(siblings) {
         Number.isSafeInteger(s.number) &&
         s.number > 0)
         .slice(0, MAX_SIBLING_HINTS)
-        .map((s) => `- ${s.repository}#${s.number} (https://github.com/${s.repository}/pull/${s.number}): to change it, ` +
-        `delegate to that repository's coding agent and ${continuePriorRunPhrase(s.openedByRunId)}.`);
+        .map((s) => {
+        const url = pullRequestWebUrl(codeProviderOf(s.repository), s.repository, s.number);
+        return (`- ${s.repository}#${s.number}${url ? ` (${url})` : ""}: to change it, ` +
+            `delegate to that repository's coding agent and ${continuePriorRunPhrase(s.openedByRunId)}.`);
+    });
     if (lines.length === 0)
         return undefined;
     return [

package/dist/core/host-status.js

@@ -1,7 +1,7 @@
 import { summarizeRegistryFetches, warningRefusals } from "../coding/registry/report.js";
 import { packageRefusalWording } from "../coding/registry/refusal-wording.js";
 import { isPackageAuditMode, packageAuditWording, summarizePackageAudit, } from "../coding/registry/audit-mode.js";
-import { CODING_CODE_PROVIDER } from "../coding/protocol.js";
+import { codeProviderOf } from "../coding/code-host.js";
 import { storedServiceNames } from "../coding/services/catalog.js";
 import { SERVICE_UNREADY_CATEGORY, serviceRefusalSentence, serviceUnreadySentence, } from "../coding/services/wording.js";
 import { PROTECTED_PATH_CATEGORY, PROTECTED_PATH_HOST_LINE } from "../coding/protected-path-wording.js";
@@ -71,7 +71,7 @@ export function pullRequestOutcome(result) {
         outcome: r.outcome,
         repository: r.repository,
         pullRequestNumber: r.pullRequestNumber,
-        codeProvider: CODING_CODE_PROVIDER,
+        codeProvider: codeProviderOf(r.repository),
         ...(typeof r.pullRequestUrl === "string" ? { pullRequestUrl: r.pullRequestUrl } : {}),
         ...failedCheckCount(r.tests),
     };

package/dist/core/issue-status.js

@@ -5,6 +5,7 @@
  * text. Best effort throughout: nothing here throws.
  */
 import { Prisma } from "#prisma";
+import { pullRequestWebUrl } from "../coding/code-host.js";
 import { projectOf, } from "../providers/issue-tracker/types.js";
 import { collectRunOutcome, fullReplyComments, fullReplyOf, isBlockedByRefusals, JIRA_REPLY_MAX_CHARS, outcomeBody, REPLY_MAX_PARTS, runLine, workingBody, } from "./host-status.js";
 import { continuedForAnotherIssue, recordPullRequests } from "./issue-bridge.js";
@@ -15,9 +16,9 @@ const ORPHAN_GRACE_MS = 2 * 60 * 1000;
 const ORPHAN_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 const ORPHAN_BATCH = 20;
 export function toJiraMarkdown(text) {
-    return text
-        .replace(/<sub>(.*?)<\/sub>/g, "_$1_")
-        .replace(/\b([\w.-]+\/[\w.-]+)#(\d+)\b/g, (_m, repo, n) => `[${repo}#${n}](https://github.com/${repo}/pull/${n})`);
+    return text.replace(/<sub>(.*?)<\/sub>/g, "_$1_").replace(
+    // With a `<provider>:` prefix it is a hosted repository, not a GitHub one: left as written.
+    /(\b[a-z][a-z0-9-]{1,30}:)?\b([\w.-]+\/[\w.-]+)#(\d+)\b/g, (match, prefix, repo, n) => prefix ? match : `[${repo}#${n}](${pullRequestWebUrl("github", repo, Number(n))})`);
 }
 export function issueStatusRow(event, runId, visibilityRole) {
     return { runId, provider: "jira", issueKey: event.issueKey, visibilityRole };

package/dist/core/mark-ready.d.ts

@@ -29,6 +29,6 @@ export interface MarkReadyDeps {
     hosts: ReviewHostRegistry | undefined;
     log?: Logger;
 }
-export declare function maybeMarkReady(deps: MarkReadyDeps, repository: string, prNumber: number, provider?: string): Promise<MarkReadyOutcome>;
+export declare function maybeMarkReady(deps: MarkReadyDeps, repository: string, prNumber: number, provider: string): Promise<MarkReadyOutcome>;
 /** After a reviewer run ends: evaluate the pull request it reviewed. Null when it reviewed none. */
 export declare function markReadyAfterRun(deps: MarkReadyDeps, runId: string): Promise<MarkReadyOutcome | null>;

package/dist/core/mark-ready.js

@@ -13,7 +13,7 @@ const CODING_RUN_SELECT = {
     run: { select: { agentId: true, parentRunId: true, status: true } },
 };
 const passed = (c) => c !== undefined && c.status === "completed" && c.conclusion === "success";
-export async function maybeMarkReady(deps, repository, prNumber, provider = "github") {
+export async function maybeMarkReady(deps, repository, prNumber, provider) {
     try {
         const host = deps.hosts?.[provider];
         if (!host?.pullRequestOrigin || !host.readOwnChecks || !host.readCi || !host.markReadyForReview)

package/dist/core/mcp-client/client.d.ts

@@ -0,0 +1,47 @@
+export interface McpHttpRequest {
+    method: "POST" | "DELETE";
+    headers: Record<string, string>;
+    body?: string;
+}
+export interface McpHttpResponse {
+    status: number;
+    /** Header names are lower-case. */
+    headers: Record<string, string>;
+    body: string;
+}
+/** The transport: in production brokeredFetch + safeFetch; in tests a fake. Throws only for network-level failures. */
+export type McpFetch = (request: McpHttpRequest, signal: AbortSignal) => Promise<McpHttpResponse>;
+export interface McpToolEntry {
+    name: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    annotations?: Record<string, unknown>;
+}
+export interface McpServerInfo {
+    name?: string;
+    version?: string;
+    protocolVersion: string;
+}
+export declare class McpClientError extends Error {
+    readonly code: "mcp_server_unreachable" | "mcp_server_auth_failed" | "mcp_server_error" | "mcp_call_timeout";
+    constructor(code: "mcp_server_unreachable" | "mcp_server_auth_failed" | "mcp_server_error" | "mcp_call_timeout", message: string);
+}
+export declare class McpHttpClient {
+    private readonly fetchImpl;
+    private readonly signal;
+    private nextId;
+    private sessionId;
+    private protocolVersion;
+    constructor(options: {
+        fetch: McpFetch;
+        signal: AbortSignal;
+    });
+    private headers;
+    /** One POST. Maps transport failures and HTTP errors to McpClientError; never puts a body or header value in a message. */
+    private post;
+    private request;
+    initialize(): Promise<McpServerInfo>;
+    listTools(): Promise<McpToolEntry[]>;
+    callTool(name: string, args: Record<string, unknown>): Promise<unknown>;
+    close(): Promise<void>;
+}

package/dist/core/mcp-client/client.js

@@ -0,0 +1,141 @@
+import { readFileSync } from "node:fs";
+import { MCP_PROTOCOL_VERSION, findResponse, hasServerRequest } from "./jsonrpc.js";
+/** The package version, sent as the client version (package.json sits three levels up from src/core/mcp-client and dist/core/mcp-client). */
+const CLIENT_VERSION = JSON.parse(readFileSync(new URL("../../../package.json", import.meta.url), "utf8")).version;
+const MAX_PAGES = 20;
+const MAX_TOOLS = 500;
+const MAX_ERROR_MESSAGE_CHARS = 500;
+export class McpClientError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "McpClientError";
+    }
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+export class McpHttpClient {
+    fetchImpl;
+    signal;
+    nextId = 1;
+    sessionId;
+    protocolVersion;
+    constructor(options) {
+        this.fetchImpl = options.fetch;
+        this.signal = options.signal;
+    }
+    headers() {
+        const headers = {
+            Accept: "application/json, text/event-stream",
+            "Content-Type": "application/json",
+        };
+        if (this.sessionId !== undefined)
+            headers["Mcp-Session-Id"] = this.sessionId;
+        if (this.protocolVersion !== undefined)
+            headers["MCP-Protocol-Version"] = this.protocolVersion;
+        return headers;
+    }
+    /** One POST. Maps transport failures and HTTP errors to McpClientError; never puts a body or header value in a message. */
+    async post(payload) {
+        let response;
+        try {
+            response = await this.fetchImpl({ method: "POST", headers: this.headers(), body: JSON.stringify({ jsonrpc: "2.0", ...payload }) }, this.signal);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : "";
+            if (this.signal.aborted || message.startsWith("fetch_cancelled_or_timeout")) {
+                throw new McpClientError("mcp_call_timeout", "The MCP server call timed out or was cancelled.");
+            }
+            throw new McpClientError("mcp_server_unreachable", "The MCP server could not be reached.");
+        }
+        if (response.status === 401 || response.status === 403) {
+            throw new McpClientError("mcp_server_auth_failed", `The MCP server refused the credentials (HTTP ${response.status}).`);
+        }
+        if (response.status < 200 || response.status >= 300) {
+            throw new McpClientError("mcp_server_error", `The MCP server answered with HTTP ${response.status}.`);
+        }
+        return response;
+    }
+    async request(method, params) {
+        const id = this.nextId++;
+        const response = await this.post({ id, method, params });
+        const contentType = response.headers["content-type"];
+        const found = findResponse(response.body, contentType, id);
+        if (found === undefined) {
+            if (hasServerRequest(response.body, contentType)) {
+                throw new McpClientError("mcp_server_error", "The MCP server asked for something Wardby doesn't support (sampling, elicitation or roots).");
+            }
+            throw new McpClientError("mcp_server_unreachable", "The MCP server sent no response to the request.");
+        }
+        // Any error member, even a malformed one ("error": null, a string), fails the call: never a TypeError.
+        const replyError = found.error;
+        if (replyError !== undefined) {
+            const text = isRecord(replyError) && typeof replyError.message === "string" ? replyError.message : "unknown error";
+            throw new McpClientError("mcp_server_error", `The MCP server returned an error: ${text.slice(0, MAX_ERROR_MESSAGE_CHARS)}`);
+        }
+        return { result: found.result, response };
+    }
+    async initialize() {
+        const { result, response } = await this.request("initialize", {
+            protocolVersion: MCP_PROTOCOL_VERSION,
+            capabilities: {},
+            clientInfo: { name: "wardby", version: CLIENT_VERSION },
+        });
+        const sessionId = response.headers["mcp-session-id"];
+        if (sessionId !== undefined && sessionId !== "")
+            this.sessionId = sessionId;
+        const body = isRecord(result) ? result : {};
+        const protocolVersion = typeof body.protocolVersion === "string" ? body.protocolVersion : MCP_PROTOCOL_VERSION;
+        this.protocolVersion = protocolVersion;
+        await this.post({ method: "notifications/initialized" });
+        const serverInfo = isRecord(body.serverInfo) ? body.serverInfo : {};
+        const info = { protocolVersion };
+        if (typeof serverInfo.name === "string")
+            info.name = serverInfo.name;
+        if (typeof serverInfo.version === "string")
+            info.version = serverInfo.version;
+        return info;
+    }
+    async listTools() {
+        const tools = [];
+        let cursor;
+        for (let page = 0; page < MAX_PAGES; page++) {
+            const { result } = await this.request("tools/list", cursor === undefined ? {} : { cursor });
+            const body = isRecord(result) ? result : {};
+            for (const entry of Array.isArray(body.tools) ? body.tools : []) {
+                if (!isRecord(entry) || typeof entry.name !== "string" || !isRecord(entry.inputSchema))
+                    continue;
+                const tool = {
+                    name: entry.name,
+                    description: typeof entry.description === "string" ? entry.description : "",
+                    inputSchema: entry.inputSchema,
+                };
+                if (isRecord(entry.annotations))
+                    tool.annotations = entry.annotations;
+                tools.push(tool);
+            }
+            if (tools.length >= MAX_TOOLS)
+                return tools.slice(0, MAX_TOOLS);
+            cursor = typeof body.nextCursor === "string" && body.nextCursor !== "" ? body.nextCursor : undefined;
+            if (cursor === undefined)
+                break;
+        }
+        return tools;
+    }
+    async callTool(name, args) {
+        const { result } = await this.request("tools/call", { name, arguments: args });
+        return result;
+    }
+    async close() {
+        if (this.sessionId === undefined)
+            return;
+        try {
+            await this.fetchImpl({ method: "DELETE", headers: this.headers() }, this.signal);
+        }
+        catch {
+            // Closing is best effort.
+        }
+    }
+}

package/dist/core/mcp-client/jsonrpc.d.ts

@@ -0,0 +1,15 @@
+/** JSON-RPC framing for MCP's Streamable HTTP transport: reads a JSON or SSE response body. */
+export declare const MCP_PROTOCOL_VERSION = "2025-06-18";
+export interface JsonRpcResponse {
+    id: number | string | null;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+}
+/** Finds the response to `id` in a JSON body or an SSE body. Ignores notifications and server requests. */
+export declare function findResponse(body: string, contentType: string | undefined, id: number): JsonRpcResponse | undefined;
+/** True when the body carried a server-to-client request (has `method` and `id`): we answer none of them. */
+export declare function hasServerRequest(body: string, contentType: string | undefined): boolean;

package/dist/core/mcp-client/jsonrpc.js

@@ -0,0 +1,54 @@
+/** JSON-RPC framing for MCP's Streamable HTTP transport: reads a JSON or SSE response body. */
+export const MCP_PROTOCOL_VERSION = "2025-06-18";
+/** Every JSON-RPC message in a body: a JSON value (object or batch array) or the `data:` frames of an SSE stream. */
+function messages(body, contentType) {
+    const parsed = [];
+    const isSse = (contentType ?? "").toLowerCase().includes("text/event-stream");
+    if (isSse) {
+        for (const frame of body.split(/\r?\n\r?\n/)) {
+            const data = frame
+                .split(/\r?\n/)
+                .filter((line) => line.startsWith("data:"))
+                .map((line) => {
+                const value = line.slice(5);
+                return value.startsWith(" ") ? value.slice(1) : value;
+            });
+            if (data.length === 0)
+                continue;
+            try {
+                parsed.push(JSON.parse(data.join("\n")));
+            }
+            catch {
+                // A malformed frame is skipped.
+            }
+        }
+    }
+    else {
+        try {
+            parsed.push(JSON.parse(body));
+        }
+        catch {
+            // Not JSON: no messages.
+        }
+    }
+    const out = [];
+    for (const value of parsed) {
+        for (const item of Array.isArray(value) ? value : [value]) {
+            if (item !== null && typeof item === "object" && !Array.isArray(item))
+                out.push(item);
+        }
+    }
+    return out;
+}
+/** Finds the response to `id` in a JSON body or an SSE body. Ignores notifications and server requests. */
+export function findResponse(body, contentType, id) {
+    for (const message of messages(body, contentType)) {
+        if (message.id === id && !("method" in message))
+            return message;
+    }
+    return undefined;
+}
+/** True when the body carried a server-to-client request (has `method` and `id`): we answer none of them. */
+export function hasServerRequest(body, contentType) {
+    return messages(body, contentType).some((message) => typeof message.method === "string" && message.id !== undefined && message.id !== null);
+}

package/dist/core/mcp-client/results.d.ts

@@ -0,0 +1,13 @@
+/** Turns an MCP CallToolResult into the string the model sees. */
+export declare const MCP_RESULT_MAX_CHARS = 100000;
+export interface ToolResultText {
+    /** The text the model sees: redacted, then capped at MCP_RESULT_MAX_CHARS. */
+    text: string;
+    /** True when the server reported an error or the result was unreadable. */
+    isError: boolean;
+}
+/**
+ * The model-facing text of a CallToolResult. `redact` runs on the assembled text before it is
+ * truncated, so a secret that straddles the cut is still matched whole.
+ */
+export declare function toolResultText(result: unknown, redact?: (text: string) => string): ToolResultText;

package/dist/core/mcp-client/results.js

@@ -0,0 +1,42 @@
+/** Turns an MCP CallToolResult into the string the model sees. */
+export const MCP_RESULT_MAX_CHARS = 100_000;
+function errorText(message) {
+    return JSON.stringify({ error: "mcp_server_error", message });
+}
+function truncate(text) {
+    if (text.length <= MCP_RESULT_MAX_CHARS)
+        return text;
+    return `${text.slice(0, MCP_RESULT_MAX_CHARS)}\n[truncated: ${text.length - MCP_RESULT_MAX_CHARS} characters omitted]`;
+}
+/**
+ * The model-facing text of a CallToolResult. `redact` runs on the assembled text before it is
+ * truncated, so a secret that straddles the cut is still matched whole.
+ */
+export function toolResultText(result, redact = (t) => t) {
+    if (result === null || typeof result !== "object" || Array.isArray(result)) {
+        return { text: errorText("The MCP server returned an unreadable result."), isError: true };
+    }
+    const r = result;
+    const parts = [];
+    let hasText = false;
+    for (const part of Array.isArray(r.content) ? r.content : []) {
+        if (part === null || typeof part !== "object")
+            continue;
+        const p = part;
+        if (p.type === "text" && typeof p.text === "string") {
+            hasText = true;
+            parts.push(p.text);
+        }
+        else if (typeof p.type === "string") {
+            parts.push(`[${p.type} omitted]`);
+        }
+    }
+    let text = parts.join("\n");
+    if (!hasText && r.structuredContent !== undefined && r.structuredContent !== null) {
+        text = JSON.stringify(r.structuredContent);
+    }
+    const safe = truncate(redact(text));
+    if (r.isError === true)
+        return { text: errorText(safe), isError: true };
+    return { text: safe, isError: false };
+}

package/dist/core/mcp-servers.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Remote MCP servers: the owner-side domain. Validates a server's URL and name, loads the owner's
+ * brokered secrets for it, builds the McpFetch that sends them (brokeredFetch over safeFetch), takes
+ * the redacted tool snapshot, and diffs snapshots. Secret values never leave this file in any output:
+ * snapshots are redacted by exact value (every encoded form) plus token shapes before they are returned.
+ */
+import type { PrismaClient } from "#prisma";
+import { type McpFetch, type McpServerInfo, type McpToolEntry } from "./mcp-client/client.js";
+import type { SecretsAccessor } from "./secrets.js";
+import type { Logger } from "./logger.js";
+import type { SecretCipher } from "../providers/secrets/types.js";
+import { safeFetch } from "../sandbox/safe-fetch.js";
+export declare class McpServerInputError extends Error {
+    constructor(message: string);
+}
+/** What the server's owner (or an admin) sees when a stored secret of the server can't be decrypted. */
+export declare const CREDENTIALS_UNAVAILABLE_MESSAGE = "The MCP server's credentials can't be decrypted on this server. Check that every Wardby process (control plane, scheduler, native gateway) uses the same SECRET_APP_KEY, or set the secret again.";
+/**
+ * A server's brokered secret exists but its stored value can't be decrypted (another
+ * SECRET_APP_KEY, a key-id mismatch, a corrupt ciphertext). Not an input problem: the message is
+ * fixed and never carries the cipher's error, the ciphertext or a value.
+ */
+export declare class McpCredentialsUnavailableError extends Error {
+    /** Empty while a server is being registered (it has no id yet). */
+    readonly serverId: string;
+    readonly serverName: string;
+    readonly secretName: string;
+    readonly code = "mcp_server_credentials_unavailable";
+    constructor(
+    /** Empty while a server is being registered (it has no id yet). */
+    serverId: string, serverName: string, secretName: string);
+}
+/** The one operator line for an undecryptable server secret: ids and names only, never the cipher's error text. */
+export declare function logCredentialsUnavailable(log: Pick<Logger, "warn">, error: McpCredentialsUnavailableError): void;
+export interface McpServerRow {
+    id: string;
+    ownerId: string;
+    name: string;
+    url: string;
+    secretNames: string[];
+}
+/** Validates a server URL: https, no userinfo, no fragment, default port; returns the normalised string. */
+export declare function normaliseServerUrl(raw: string): string;
+export declare function assertServerName(name: string): void;
+/** The tool name the model sees: `<server>__<tool>` with any other character mapped to `_`. */
+export declare function exposedToolName(serverName: string, toolName: string): string;
+/** A server's saved tool list (toolSnapshot); anything but an array reads as empty. */
+export declare function snapshotOf(server: {
+    toolSnapshot: unknown;
+}): McpToolEntry[];
+/** Exposed names of allowed tools; a name too long to expose is left out (refused at attach anyway). */
+export declare function exposedNames(serverName: string, allowedTools: readonly string[]): string[];
+/** Added, removed and changed (description or schema) tool names between two snapshots; order-independent. */
+export declare function diffSnapshots(before: McpToolEntry[], after: McpToolEntry[]): {
+    added: string[];
+    removed: string[];
+    changed: string[];
+};
+/** Redacts every secret value of this server (exact, every encoded and escaped form) plus token shapes. */
+export declare function redactForServer(text: string, values: string[]): string;
+/** The same error with its message redacted; an McpClientError keeps its code, any other keeps its name. */
+export declare function redactError(error: unknown, values: string[]): Error;
+type SecretDb = Pick<PrismaClient, "secret">;
+/**
+ * Loads the owner's secrets for the server; each must exist, be owned by ownerId, be brokered, and list
+ * the URL's host (McpServerInputError otherwise). A stored value that can't be decrypted throws
+ * McpCredentialsUnavailableError.
+ */
+export declare function loadServerSecrets(db: SecretDb, cipher: Pick<SecretCipher, "decrypt">, server: McpServerRow): Promise<{
+    accessor: SecretsAccessor;
+    values: string[];
+}>;
+/** The McpFetch for one server: brokeredFetch over safeFetch with the timeout and signal; text body, lower-case headers. */
+export declare function serverFetch(server: McpServerRow, accessor: SecretsAccessor, options: {
+    timeoutMs: number;
+    fetchImpl?: typeof safeFetch;
+}): McpFetch;
+/** initialize + listTools + close; the result is redacted (as JSON text) before it is returned. */
+export declare function fetchSnapshot(server: McpServerRow, deps: {
+    db: SecretDb;
+    cipher: Pick<SecretCipher, "decrypt">;
+    fetchImpl?: typeof safeFetch;
+    timeoutMs?: number;
+}): Promise<{
+    serverInfo: McpServerInfo;
+    tools: McpToolEntry[];
+}>;
+/** For the secret delete guard: names of the owner's MCP servers whose secretNames include the secret. */
+export declare function mcpServersUsingSecret(db: Pick<PrismaClient, "mcpServer">, ownerId: string, secretName: string): Promise<string[]>;
+export {};