@wenathlan/extension 1.1.54 → 1.1.56

package/README.md

@@ -2,11 +2,11 @@
 
 Devthink is a **consent-first browser-agent bridge** distributed as a TypeScript library and a Chromium Manifest V3 extension. It turns a user-provided browser objective into a bounded, reviewable plan. The user must start the active-tab session and approve the plan before any page action reaches the browser.
 
-Version: **1.1.54**. License: **GPL-3.0-only**. The repository is `wenathlan/extension`; the npm-compatible scoped package identifier is `@wenathlan/extension`.
+Version: **1.1.56**. License: **GPL-3.0-only**. The repository is `wenathlan/extension`; the npm-compatible scoped package identifier is `@wenathlan/extension`.
 
 ## What it does
 
-| Capability | Behavior in 1.1.54 |
+| Capability | Behavior in 1.1.56 |
 | --- | --- |
 | Active-tab session | The user starts a short-lived session for one HTTPS tab and one origin; the session records its origin grants. |
 | Page observation | The extension captures the complete semantic inventory: every interactive element, every form control, every select option and the full page text. |
@@ -27,7 +27,7 @@ Version: **1.1.54**. License: **GPL-3.0-only**. The repository is `wenathlan/ext
 | Workflow engine | Steps compose into workflows with consent: `composeworkflow` validates the name, version, granted HTTPS origins, steps and reusable blocks, expands every nested block before review so no step stays hidden, grades the record by its worst step and freezes it, `savetemplate` shares one reviewed step across workflows, `runworkflow` executes the expanded list one step at a time behind the live session, approved plan, origin grants and the explicit run review flag with a checkpoint after every completed step that survives service worker restarts, `dryrun` evaluates every step read only through per kind projections and refuses mutation steps without one, `delay` sleeps a seeded jitter window with long delays riding the alarms api when the browser exposes it, `waitelement` polls a selector until appearance, the reviewed timeout or a clean abort on tab navigation, `compute` evaluates expressions of arithmetic, comparison, logic, text, contains and length operators with operand coercion, and `extractvars` stores regex named captures as variables with the no match case reported honestly — typed scopes stack per block with shadowing, bindings link earlier outcomes to named variables, `${name}` interpolation substitutes scope values into targets, values and options, and 1.1.51 adds the control flow family: `condition` evaluates a reviewed boolean expression over the extracted values with no page side effect, `branch` chooses the first matching path by page state (pageurl, pagetitle and pageready) with a mandatory else path so every branch terminates, `loop`, `repeatuntil`, `whileloop` and `foreach` iterate lists, convergence conditions, bounded while conditions and matched elements rebinding the deep copied item and index variables per iteration inside user configured safety bounds with no code ceiling, `parallel` runs branches concurrently in isolated scopes that the join merges under the first, last or fail strategy over conflicting writes with cancel or continue on branch failure, and `trycatch` wraps fragile steps with a catch handler, rerun option, retry policy of user configured attempts over fixed or exponential seeded backoff and the reviewed error classes, and per step and per run timeout budgets whose aborts carry the cancelled error class — composition validates every control payload, collects every nested child step so no construct hides a step and grades the record by its worst child, single step execution runs one chosen step outside the run loop, pause, resume and cancel record their reasons, runlogs keep under the user configured retention with no code ceiling, control decisions persist for audit, and the manifest permissions stay unchanged. |
 | Triggers and scheduling | Reviewed workflows start themselves with consent: `visitrule` fires on navigations to reviewed HTTPS origins, `urlrule` matches glob patterns where `*` spans one path segment and `**` spans across segments with explicit ports honored, `menurule` binds a context menu entry, `keyrule` binds a keyboard shortcut command, `buttonrule` binds the toolbar button, `cronrule` schedules five field cron expressions with named weekdays and months and optional timezones resolved through the runtime database, `intervalrule` fires every reviewed period with a seeded jitter spread, `urllistrule` plans one run per url of a reviewed list, `webhookrule` verifies a shared secret over the entropy floor and a payload schema in constant time before anything persists, and `eventrule` subscribes to observed page events of the catalog (mutate, focus, banner, console, error, navigate) — every rule arms behind the explicit arm review that renders its match fields and bound workflow first, grades sensitive, and every launch re-passes the live session, approved plan and origin gates through the same run machinery as a reviewed runworkflow step with the triggering url, title and payload as seed variables; cooldown windows, interval periods with jitter and the fire record retention stay user choices with no code ceiling, the dedupe keeps one pending fire per rule while a run is active, the queue holds fires that arrive while the run is busy or the session is paused and drains in arrival order on resume, the manual run step preview renders every expanded step with its control summaries before confirmation, scheduling persists through chrome.storage and opportunistic wakes with the alarms api riding the browser only when exposed without a declared permission, and the manifest permissions stay unchanged. |
 | Workflow editor | Reviewed workflows get a visual home with consent: the canvas renders steps as nodes with typed binding sockets and blocks as containers with nested child steps, drag and drop snaps onto the reviewed grid and the nearest block column, the palette lists curated drop blocks across actions, control flow, waits, variables and triggers with search, the step library browses every reviewed kind grouped by category with its option schema, the step inspector edits options, bindings and nested params, the variable inspector lists scopes and values, the mini map projects the full canvas with click navigation and the zoom keeps step labels readable, undo and redo cover every canvas edit, and every save passes the editorsavegate of a live session, an approved plan, unique node ids, forward only edges and the full composeworkflow grammar so no editor artifact bypasses review — breakpoints mark any step for debug runs that pause before it and resume exactly there, version timelines carry change notes with diffs of added, removed and changed steps and rollbacks that grade unreviewed until the rollback review approves them, imports grade unreviewed until the import review approves the expanded step list, exports and share bundles ship as json or yaml with the export content review refusing any secret, token, api key, password or authorization field so secrets never leave the browser, background runs keep executing with the panel closed while every step checkpoints and every worker wake restores them through the same gates, the watchdog recovers stalled runs by the user configured retry, pause or cancel and reaps zombie runs of browser shutdowns with thresholds and windows as pure user choices with no code ceiling, run history keeps outcome, duration and trigger cause under a user configured retention, and per site overrides adjust only the reviewed knobs of loop bounds, step and run timeouts, element wait timeouts and delay bases per https origin pattern or subdomain glob — no new action kinds, the manifest permissions stay unchanged. |
-| Agent protocol | The browser becomes a tool server with consent: the mcp server of the 1.1.54 agent protocol lists every reviewed browser, workflow, memory and system tool over `tools/list` with its version, json schema inputs, risk grade and consent metadata, negotiates capabilities with any client the user pairs, frames messages in json rpc with newline delimited and http post envelopes, and answers parse, method, params, internal and consentrefused errors with their codes — read only tools run under the dryrun risk class once the session is approved while every tool with side effects executes exactly the approved plan step it names, so no paired client widens what the human approved; the stdio bridge relays frames for local client processes through the native messaging host manifest with restart on demand, the http listener binds localhost by default with any other bind graded sensitive behind the explicit remote review, the server starts only after the user enables it, and the bind, port, transports, frame size, queue depth and call retention all stay user configured with no code ceiling. |
+| Agent protocol | The browser becomes a tool server with consent: the mcp server of the agent protocol lists every reviewed browser, workflow, memory and system tool over `tools/list` with its version, json schema inputs, risk grade and full consent metadata, negotiates capabilities and the per client tool floor with any client the user pairs, frames messages in json rpc with newline delimited and http post envelopes, and answers parse, method, params, internal and consentrefused errors with their codes — read only tools run under the dryrun risk class once the session is approved while every tool with side effects executes exactly the approved plan step it names, so no paired client widens what the human approved; the stdio bridge relays frames for local client processes through the native messaging host manifest with restart on demand, the http listener binds localhost by default with any other bind graded sensitive behind the explicit remote review, the server starts only after the user enables it, and the bind, port, transports, frame size, queue depth and call retention all stay user configured with no code ceiling. Since 1.1.55 the stream http transport opens for remote clients behind the full remote gates: one time pairing codes exchanged for session tokens that persist only as sha-256 digests, token scopes per namespace, a client allowlist with grant history, tls required for any non localhost transport with user configured certificate fingerprints, an ordered frame intake where tls terminates before token verification and namespace checks run before consent checks, auth failures that answer with one fixed message leaking no pairing state, a user configured client ceiling, and approval gates that hold every sensitive remote call with its full arguments (secret fields redacted) until the user decides — refusing by default when the configurable window closes. |
 | Files and downloads | The agent moves bytes with review: `batchdownload` downloads reviewed url lists in waves under a user configured concurrent window with per file states and sequence suffixes for filename conflicts, `pausedownload` and `resumedownload` walk the queue through the downloads api, `verifydownload` compares state, size and checksum against reviewed expectations, `interceptmime` arms include, exclude and deny default mime filters that reroute matching downloads into quarantine, `exportnetlog` exports the step correlated network log with every header value redacted, `readclipboard` needs an approved single use consent prompt per read and never persists the payload text, `writeclipboard` writes reviewed text through the page bridge with payload hashes for audit, `copyscreen` copies the visible tab to the clipboard, `quarantinedownload` and `scanvirus` keep files outside the downloads folder until a clean scan verdict releases them, `namecaptures` stamps task, step and sequence filenames with per task counters, and `cleanupartifacts` sweeps artifacts by reviewed age and kind rules while keeping open review references. |
 | Datasets and exports | The agent turns pages into data with audit: `scrapetable` reads tables into normalized column keys with rowspan and colspan expansion and nested child datasets, `paginateextract` follows next controls while waiting for fresh rows, `mergepages` aligns columns across pages, `transformvalues` applies reviewed expressions with per rule error surfacing, `deduperows` deduplicates by reviewed keys, `stamplerows` stamps every row with its source url, timestamp and step ref, `previewgrid` previews the grid before export, `importcsv` parses quoted csv with column mappings for fill loops, `looprows` interpolates `{{column}}` row variables into the wrapped inner step, `exportcsv`, `exportjson` and `exportexcel` write checksummed artifacts into the task artifact store with provenance records, `copytable` uses the clipboard under the optional clipboardWrite capability, `pushsheets` pushes only to a reviewed HTTPS endpoint behind its origin grant and the explicit reviewed flag, `streamdisk` streams chunk by chunk with backpressure and a persisted resume state, `resumeextract` continues an interrupted extraction from its stored cursor, and `logprovenance` logs provenance for audit; exports refuse to leave local memory while the session origin grants do not cover the active origin. |
 | Tabs and windows command | The agent commands the whole browser surface with review: `querytabs` resolves reviewed url, title, id and pattern matchers against the live tab set, `closepattern` closes matching tabs only under the explicit reviewed flag, `pintab`, `mutetab`, `movetab`, `movetabwindow`, `duplicatetab`, `reloadtabs`, `discardtab`, `zoomin`, `zoomout` and `switchtab` mutate tabs, `grouptabs`, `colorgroup` and `collapsegroup` keep group registries, `savelayout` and `restorelayout` save and restore named tab layouts with window bounds, `snapshotsession` and `reopenrun` capture and reopen whole runs, `watchtab` observes title, activation and closure events, `findclones`, `searchtabs` and `listaudio` enumerate the surface read only, `badgetab` and `attachmeta` route task state per tab, and `maximizewindow`, `minimizewindow`, `restorewindow`, `focuswindow`, `scratchwindow` and `incognitowindow` command windows with incognito separated from grant inheritance. |
@@ -67,7 +67,7 @@ The endpoint field intentionally has no default URL. Enter a URL such as `https:
 
 ```json
 {
-  "version": "1.1.54",
+  "version": "1.1.56",
   "objective": "User supplied objective",
   "session": { "id": "uuid", "tabid": 1, "origin": "https://example.com" },
   "observation": { "schemaversion": 3, "url": "https://example.com/path", "interactive": [] },

package/dist/agentstream.d.ts

@@ -0,0 +1,155 @@
+import type { callcontext, cancelframe, capabilityset, eventkind, jsonrpcframe, progressnotice, promptdef, protocoleventsubscription, resourcewatch, samplingrequest, streamchunk } from "./types.js";
+/**
+ * Agent stream of the 1.1.56 agent protocol part three.
+ * Every subscription, resource, sampling, prompt, streaming, progress and cancellation concern lives in this file: the event subscriptions with their kinds and filters, the event notifications that push protocol events to matching subscribers, the resource watchers with their page state baselines and the page state deltas they deliver, the sampling callbacks that ask a client model for a completion behind its declared capabilities and the page content grant, the prompt defs exposed as callable tools with their template rendering, the stream chunks of progressive tool results, the progress notices of long tools with their cancel hints and the cancellation frames that abort an in flight tool call while preserving its partial result.
+ * The stream stays pure and consent-first: a subscription never widens what the session grants, a sampling prompt never leaves the browser with ungranted page content and a cancellation never bypasses the audit trail.
+ */
+/** The protocol event kinds a client may subscribe to; the callstarted kind mirrors every tool call including calls with side effects. */
+export declare const protocoleventkinds: eventkind[];
+/** The observation event kinds that stay read only: every kind except the callstarted mutation mirror. */
+export declare const readonlyeventkinds: eventkind[];
+/** Registers one client event subscription: the kinds validate against the protocol event kinds while an absent kinds list subscribes the read only observation kinds so a subscription never widens what the session grants. */
+export declare function subscriberegister(input: {
+    clientid: string;
+    kinds?: string[];
+    origin?: string;
+    tool?: string;
+    now: number;
+    id?: string;
+}): {
+    subscription?: protocoleventsubscription;
+    reason?: string;
+};
+/** Cancels one client event subscription; the record stays for the audit trail with its cancel time. */
+export declare function unsubscriberegister(subscriptions: protocoleventsubscription[], id: string, now: number): protocoleventsubscription[];
+/** Pushes one protocol event to every matching subscriber: active subscriptions whose kinds carry the event kind, whose origin filter matches when set and whose tool filter matches when set receive one notification frame; the delivery stamps the last delivery time. */
+export declare function notifyevent(input: {
+    subscriptions: protocoleventsubscription[];
+    kind: eventkind;
+    origin?: string;
+    tool?: string;
+    payload?: Record<string, unknown>;
+    now: number;
+}): {
+    deliveries: Array<{
+        subscriptionid: string;
+        clientid: string;
+        frame: jsonrpcframe;
+    }>;
+    subscriptions: protocoleventsubscription[];
+};
+/** Starts one page state watcher for a client: the resource names the watched page state and the baseline freezes the page state at watch time so later deltas compare against it. */
+export declare function watchresource(input: {
+    clientid: string;
+    resource: string;
+    state?: Record<string, unknown>;
+    now: number;
+    id?: string;
+}): {
+    watch?: resourcewatch;
+    reason?: string;
+};
+/** Cancels one page state watcher; the record stays for the audit trail with its cancel time. */
+export declare function unwatchresource(watches: resourcewatch[], id: string, now: number): resourcewatch[];
+/** Pushes the page state deltas of one resource to its active watchers: every changed key against the baseline lands in the delta, the baseline absorbs the new state and the delivery stamps the last delivery time. */
+export declare function notifyresource(input: {
+    watches: resourcewatch[];
+    resource: string;
+    state: Record<string, unknown>;
+    now: number;
+}): {
+    deliveries: Array<{
+        watchid: string;
+        clientid: string;
+        delta: Record<string, unknown>;
+    }>;
+    watches: resourcewatch[];
+};
+/** Sends one sampling callback to a client model: the client must have declared its sampling capability, the page content stays stripped unless the user granted it and the request records its provenance for the round trip. */
+export declare function requestsampling(input: {
+    clientid: string;
+    capabilities?: capabilityset;
+    prompt: string;
+    system?: string;
+    pagecontent?: string;
+    pagegrant?: boolean;
+    maxtokens?: number;
+    now: number;
+    id?: string;
+}): {
+    request?: samplingrequest;
+    reason?: string;
+};
+/** Completes one sampling round trip: the client answer closes the pending request with its provenance times while answered, refused and unknown requests stay untouched. */
+export declare function answersampling(input: {
+    requests: samplingrequest[];
+    id: string;
+    answer?: string;
+    refused?: boolean;
+    now: number;
+}): {
+    requests: samplingrequest[];
+    request?: samplingrequest;
+    reason?: string;
+};
+/** Lists the prompt defs the server exposes as callable tools: every prompt carries its name, description, declared arguments and render template. */
+export declare function listprompts(): promptdef[];
+/** Renders one prompt def with its arguments: every double braced placeholder substitutes its argument value while a required argument left empty keeps its placeholder so the review sees the gap. */
+export declare function renderprompt(prompt: promptdef, args: Record<string, unknown>): string;
+/** Calls one prompt: the render validates the declared arguments, substitutes the defaults the prompt reviewed and returns the rendered prompt with its arguments as one tool call the client dispatches behind the consent gates. */
+export declare function callprompt(input: {
+    name: string;
+    args?: Record<string, unknown>;
+    now?: number;
+}): {
+    toolcall?: {
+        name: string;
+        params: Record<string, unknown>;
+    };
+    rendered?: string;
+    reason?: string;
+};
+/** Emits one stream chunk of a progressive tool result: the sequence number orders the chunks while the done marker closes the stream. */
+export declare function streamchunkof(input: {
+    callid: string;
+    seq: number;
+    content: string;
+    done?: boolean;
+    now: number;
+}): streamchunk;
+/** Splits one tool result content into ordered stream chunks; the final chunk carries the done marker so the client reassembles the progressive result. */
+export declare function chunkcontent(input: {
+    callid: string;
+    content: string;
+    size?: number;
+    now: number;
+}): streamchunk[];
+/** Reassembles ordered stream chunks into the progressive result content they carry. */
+export declare function assemblechunks(chunks: streamchunk[]): string;
+/** Emits one progress notice of a long tool call: the percent, the plain language message and the cancel hint the panel renders. */
+export declare function notifyprogress(input: {
+    callid: string;
+    percent?: number;
+    message: string;
+    cancellable?: boolean;
+    now: number;
+}): progressnotice;
+/** Builds one cancellation frame that aborts an in flight tool call: the call id and the reason in plain language. */
+export declare function cancelframeof(input: {
+    callid: string;
+    reason?: string;
+    now: number;
+}): cancelframe;
+/** Aborts one in flight tool call on its cancellation frame: the call context turns cancelled with its end time while the partial result survives for the answer; a finished or unknown call reports why nothing aborted. */
+export declare function canceltool(input: {
+    contexts: callcontext[];
+    callid: string;
+    reason?: string;
+    partial?: callcontext["partial"];
+    now: number;
+}): {
+    contexts: callcontext[];
+    context?: callcontext;
+    reason?: string;
+};
+//# sourceMappingURL=agentstream.d.ts.map

package/dist/agentstream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentstream.d.ts","sourceRoot":"","sources":["../agentstream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,yBAAyB,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGtM;;;;GAIG;AAEH,0IAA0I;AAC1I,eAAO,MAAM,kBAAkB,EAAE,SAAS,EAA0G,CAAC;AAErJ,0GAA0G;AAC1G,eAAO,MAAM,kBAAkB,EAAE,SAAS,EAA2F,CAAC;AAEtI,iOAAiO;AACjO,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,YAAY,CAAC,EAAE,yBAAyB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CASxM;AAED,wGAAwG;AACxG,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,yBAAyB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,yBAAyB,EAAE,CAEpI;AAED,6QAA6Q;AAC7Q,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,aAAa,EAAE,yBAAyB,EAAE,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,KAAK,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,YAAY,CAAA;KAAE,CAAC,CAAC;IAAC,aAAa,EAAE,yBAAyB,EAAE,CAAA;CAAE,CAWxT;AAED,sLAAsL;AACtL,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,CAAC,EAAE,aAAa,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAIlL;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE,CAElG;AAED,yNAAyN;AACzN,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAA;CAAE,CAazP;AAED,kOAAkO;AAClO,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,CAAC,EAAE,eAAe,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CASnQ;AAED,6KAA6K;AAC7K,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAM/M;AAED,sJAAsJ;AACtJ,wBAAgB,WAAW,IAAI,SAAS,EAAE,CAMzC;AAED,uMAAuM;AACvM,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAMrF;AAED,sOAAsO;AACtO,wBAAgB,UAAU,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAkBtM;AAED,0IAA0I;AAC1I,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAE/H;AAED,2JAA2J;AAC3J,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,EAAE,CAMlH;AAED,wFAAwF;AACxF,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAE5D;AAED,oIAAoI;AACpI,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAE/I;AAED,sHAAsH;AACtH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAElG;AAED,6NAA6N;AAC7N,wBAAgB,UAAU,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAMlN"}

package/dist/approvalgate.d.ts

@@ -0,0 +1,39 @@
+import type { approvalrequest, approvalexec, clientidentity } from "./types.js";
+/**
+ * Approval gates of the 1.1.55 agent protocol part two.
+ * Every sensitive tool call a remote client raises lands behind a human approval gate in this file: the gate raise with the full call arguments, the client identity and the called tool in every prompt, the secret redaction of the fields the user marked secret, the approve and refuse resolution with its actor and latency record, and the timeout that refuses an unanswered gate by default.
+ * The gates never bypass review: an approved gate executes exactly the call it holds while refused and expired gates never execute anything.
+ */
+/** The documented default approval window of two minutes; any user configured window wins and an unanswered gate refuses by default. */
+export declare const defaultapprovalwindowms = 120000;
+/** Raises one approval gate for a sensitive tool call: the full call arguments, the reason in plain language, the fields the user marked secret and the timeout that refuses by default. */
+export declare function requireapproval(input: {
+    clientid: string;
+    tool: string;
+    reason: string;
+    params: Record<string, unknown>;
+    now: number;
+    timeout?: number;
+    secretfields?: string[];
+    id?: string;
+}): approvalrequest;
+/** Resolves one pending approval gate: the decision of the acting user closes the gate and returns the execution record with the latency from the raise; already closed gates stay untouched. */
+export declare function resolveapproval(input: {
+    requests: approvalrequest[];
+    id: string;
+    decision: "approved" | "refused";
+    actor: string;
+    now: number;
+}): {
+    requests: approvalrequest[];
+    exec?: approvalexec;
+};
+/** Expires every unanswered approval gate past its timeout window: the default disposition of an expired gate is refusal and the records stay for the audit trail. */
+export declare function expireapprovals(requests: approvalrequest[], now: number): approvalrequest[];
+/** Returns the pending and resolved gates of the approval view, newest raise first. */
+export declare function listapprovals(requests: approvalrequest[]): approvalrequest[];
+/** Redacts the call arguments of one approval prompt: every field the user marked secret carries its redaction marker while the rest of the arguments stay visible for review. */
+export declare function redactparams(params: Record<string, unknown>, secretfields: string[]): Record<string, unknown>;
+/** Builds the plain language approval prompt every gate surfaces: the client identity, the called tool, the reason and the full call arguments with the secret fields redacted. */
+export declare function approvalprompt(request: approvalrequest, identity?: clientidentity): string;
+//# sourceMappingURL=approvalgate.d.ts.map

package/dist/approvalgate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvalgate.d.ts","sourceRoot":"","sources":["../approvalgate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,eAAe,EAAiB,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAG/G;;;;GAIG;AAEH,wIAAwI;AACxI,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAE/C,4LAA4L;AAC5L,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,CAEhN;AAED,iMAAiM;AACjM,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,YAAY,CAAA;CAAE,CAMtM;AAED,sKAAsK;AACtK,wBAAgB,eAAe,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAE3F;AAED,uFAAuF;AACvF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,eAAe,EAAE,CAE5E;AAED,kLAAkL;AAClL,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI7G;AAED,mLAAmL;AACnL,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,cAAc,GAAG,MAAM,CAI1F"}

package/dist/clientauth.d.ts

@@ -0,0 +1,114 @@
+import type { allowlistentry, authchallenge, authmethod, clientidentity, pairingcode, sessiontoken, tlsconfig, tokenhash, toolnamespace } from "./types.js";
+/**
+ * Client auth of the 1.1.55 agent protocol part two.
+ * Every pairing, token, allowlist and handshake concern for remote clients lives in this file: the one time pairing codes with their single use state, the session tokens issued in exchange and stored only as sha-256 tokenhash values, the token verification on every frame with its scope limits and expiry, the client allowlist that refuses unknown fingerprints, the grant history of every scope change, the auth challenges with their single use nonces, the handshake completion that marks a client paired, the revocation that stays available to the user at any time, the token expiry that enforces the user configured lifetime and the auth failures that answer with one fixed json rpc message so the pairing state never leaks.
+ * The module stays pure: every value is a user choice with no code ceiling, and no endpoint, provider, certificate or key is ever hardcoded.
+ */
+/** The prefix every stored tokenhash carries so raw token values never persist. */
+export declare const tokenhashprefix = "sha256:";
+/** The documented default session token lifetime of one hour; any user configured window wins. */
+export declare const defaulttokenlifetimems = 3600000;
+/** The documented default pairing code window of five minutes; any user configured window wins. */
+export declare const defaultpairinglifetimems = 300000;
+/** The documented default auth challenge window of two minutes; any user configured window wins. */
+export declare const defaultchallengelifetimems = 120000;
+/** The fixed message every auth failure answers with; it names no client, token or pairing state so nothing leaks. */
+export declare const authrefusedmessage = "The remote frame failed its authentication handshake.";
+/** Digests one raw token into its stored tokenhash form: the sha-256 hex digest under the documented prefix, computed through the platform crypto seam so the raw value never persists. */
+export declare function tokenhashof(raw: string): Promise<tokenhash>;
+/** Issues one pairing code for a one time client pairing: the human copied code, the granted namespaces, the issue time and the user configured expiry window. */
+export declare function issuepairingcode(input: {
+    now: number;
+    scopes: toolnamespace[];
+    lifetime?: number;
+    code?: string;
+}): pairingcode;
+/** Exchanges one pairing code for its granted scopes: the code must match, stay pending and sit inside its window while a used or expired code never pairs a second client. */
+export declare function redeempairingcode(input: {
+    codes: pairingcode[];
+    code: string;
+    now: number;
+}): {
+    code?: pairingcode;
+    reason?: string;
+};
+/** Issues one session token for a paired client: the raw token leaves exactly once in the answer while the record persists only its tokenhash form, the scopes, the issue time and the user configured expiry. */
+export declare function issuetoken(input: {
+    clientid: string;
+    scopes: toolnamespace[];
+    now: number;
+    lifetime?: number;
+    id?: string;
+    raw?: string;
+}): Promise<{
+    token: sessiontoken;
+    raw: string;
+}>;
+/** Validates one session token on every frame: the digest of the presented raw token must match a stored, unrevoked, unexpired record; every failure answers with the fixed message so the pairing state never leaks. */
+export declare function verifytoken(input: {
+    tokens: sessiontoken[];
+    raw: string;
+    now: number;
+}): Promise<{
+    token?: sessiontoken;
+    reason?: string;
+}>;
+/** Revokes every session token of one client on demand; the revocation stays available to the user at any time and the records stay for the audit trail. */
+export declare function revokeclient(tokens: sessiontoken[], clientid: string, now: number): sessiontoken[];
+/** Enforces the configured token lifetime: tokens past their expiry leave the live set while their records stay for the audit trail. */
+export declare function expiretokens(input: {
+    tokens: sessiontoken[];
+    now: number;
+}): {
+    live: sessiontoken[];
+    expired: sessiontoken[];
+};
+/** Checks the client allowlist: a fingerprint must carry an entry and, when a namespace is asked, the entry must grant it. */
+export declare function checkallowlist(input: {
+    entries: allowlistentry[];
+    fingerprint: string;
+    namespace?: toolnamespace;
+}): {
+    allowed: boolean;
+    reason?: string;
+};
+/** Grants or updates one allowlist entry with its grant history: every scope change lands in the history with its actor and plain language change. */
+export declare function grantallowlistentry(input: {
+    entries: allowlistentry[];
+    identity: clientidentity;
+    namespaces: toolnamespace[];
+    actor: string;
+    now: number;
+}): allowlistentry[];
+/** Issues one auth challenge to a new client: the single use nonce, the method it authenticates and the user configured expiry window. */
+export declare function issuechallenge(input: {
+    method: authmethod;
+    now: number;
+    lifetime?: number;
+    nonce?: string;
+}): authchallenge;
+/** Completes the auth handshake: the echoed nonce must match the live challenge and the presented token must verify; success marks the client paired while every failure answers with the fixed message. */
+export declare function verifyauth(input: {
+    challenge: authchallenge;
+    nonce: string;
+    tokens: sessiontoken[];
+    rawtoken: string;
+    now: number;
+}): Promise<{
+    verified: boolean;
+    clientid?: string;
+    reason?: string;
+}>;
+/** Limits one tool call to the namespaces the token scopes grant: an unknown namespace fails fast while a known but ungranted namespace stays a consent refusal. */
+export declare function scopecheck(token: sessiontoken | undefined, namespace: toolnamespace | undefined): {
+    allowed: boolean;
+    fast?: boolean;
+    reason?: string;
+};
+/** Reports the tls termination state of one transport config for the remote status view: the mode, the certificate requirement and whether the peer was verified. */
+export declare function tlsstateof(tls: tlsconfig): {
+    mode: string;
+    certificaterequired: boolean;
+    verified: boolean;
+};
+//# sourceMappingURL=clientauth.d.ts.map

package/dist/clientauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientauth.d.ts","sourceRoot":"","sources":["../clientauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI5J;;;;GAIG;AAEH,mFAAmF;AACnF,eAAO,MAAM,eAAe,YAAY,CAAC;AAEzC,kGAAkG;AAClG,eAAO,MAAM,sBAAsB,UAAY,CAAC;AAEhD,mGAAmG;AACnG,eAAO,MAAM,wBAAwB,SAAU,CAAC;AAEhD,oGAAoG;AACpG,eAAO,MAAM,0BAA0B,SAAU,CAAC;AAElD,sHAAsH;AACtH,eAAO,MAAM,kBAAkB,0DAA0D,CAAC;AAE1F,2LAA2L;AAC3L,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAGjE;AAED,kKAAkK;AAClK,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAG/H;AAED,+KAA+K;AAC/K,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,CAAC,EAAE,WAAW,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAMrI;AAED,kNAAkN;AAClN,wBAAsB,UAAU,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAI/L;AAED,yNAAyN;AACzN,wBAAsB,WAAW,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,KAAK,CAAC,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAOjJ;AAED,4JAA4J;AAC5J,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE,CAElG;AAED,wIAAwI;AACxI,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAAC,OAAO,EAAE,YAAY,EAAE,CAAA;CAAE,CAG9H;AAED,8HAA8H;AAC9H,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAK1J;AAED,sJAAsJ;AACtJ,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,aAAa,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,EAAE,CAO7K;AAED,0IAA0I;AAC1I,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAE3H;AAED,4MAA4M;AAC5M,wBAAsB,UAAU,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAM9M;AAED,oKAAoK;AACpK,wBAAgB,UAAU,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,EAAE,SAAS,EAAE,aAAa,GAAG,SAAS,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAKvJ;AAED,qKAAqK;AACrK,wBAAgB,UAAU,CAAC,GAAG,EAAE,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAE5G"}

package/dist/httpstream.d.ts

@@ -0,0 +1,92 @@
+import type { allowlistentry, clientrecord, httpstreamconfig, mcpserverconfig, rpcerror, sessiontoken, streamchannel, tlsconfig } from "./types.js";
+/**
+ * Http stream transport of the 1.1.55 agent protocol part two.
+ * Every remote transport concern lives in this file: the http stream config with the posted json rpc endpoint and the server sent event channel paths, the stream channels the server keeps open for client streams, the heartbeat rhythm that keeps idle channels alive and closes dead ones, the tls termination that requires valid certificates before any remote traffic, the user configured client ceiling, the remote status report of endpoint, tls and client counts, and the ordered frame pipeline that terminates tls first, verifies the session token on every frame, checks the allowlist and runs the namespace scope check before any consent gate — auth failures answer with one fixed json rpc error so the pairing state never leaks.
+ * The transport stays honest: the browser runtime exposes no listening socket, so the frame intake rides the same seam as the stdio bridge while the endpoint, tls mode, heartbeat and ceiling all stay user configured with no code ceiling and no hardcoded endpoint or certificate.
+ */
+/** The documented default heartbeat interval of the event channels; any user configured rhythm wins. */
+export declare const defaultheartbeatms = 30000;
+/** The documented default idle window after which a silent channel counts as dead; any user configured window wins. */
+export declare const defaultidlewindowms = 90000;
+/** The documented default http stream config: the posted json rpc endpoint path, the server sent event channel path, tls off for the localhost default and the documented heartbeat rhythm. */
+export declare function defaulthttpstream(): httpstreamconfig;
+/** Opens one server sent event channel for a remote client stream: the open and first heartbeat times ride the record. */
+export declare function openstreamchannel(input: {
+    clientid: string;
+    now: number;
+    id?: string;
+}): streamchannel;
+/** Stamps one heartbeat on every open channel of a client so idle channels stay alive. */
+export declare function heartbeat(input: {
+    channels: streamchannel[];
+    clientid: string;
+    now: number;
+}): streamchannel[];
+/** Reports whether one channel stays live: an open channel inside its idle window counts as alive while closed channels and silent ones past the window count as dead. */
+export declare function channellive(channel: streamchannel, now: number, idlewindow?: number): boolean;
+/** Closes every dead channel: silent channels past the user configured idle window close while live channels stay open. */
+export declare function closeidlechannels(input: {
+    channels: streamchannel[];
+    now: number;
+    idlewindow?: number;
+}): streamchannel[];
+/** Terminates tls before any remote traffic: the off mode keeps the documented localhost default, the on mode negotiates while the required mode refuses any peer without a valid certificate that matches the user configured fingerprint. */
+export declare function starttls(input: {
+    config: tlsconfig;
+    presented?: {
+        fingerprint?: string;
+    };
+    now: number;
+}): {
+    tls: boolean;
+    verified: boolean;
+    reason?: string;
+};
+/** Enforces the user configured client ceiling: a configured maximum refuses connections past it while an absent value keeps the client count unbounded. */
+export declare function enforcemaxclients(input: {
+    clients: clientrecord[];
+    maxclients?: number;
+}): {
+    allowed: boolean;
+    reason?: string;
+};
+/** Reports the remote transport status: the advertised endpoint, the tls state, the client counts, the open and dead stream channels and the live token count. */
+export declare function listremotestatus(input: {
+    config: mcpserverconfig;
+    channels: streamchannel[];
+    clients: clientrecord[];
+    tokens: sessiontoken[];
+    now: number;
+}): {
+    endpoint: string;
+    tls: {
+        mode: string;
+        certificaterequired: boolean;
+        verified: boolean;
+    };
+    clients: number;
+    paired: number;
+    channelsopen: number;
+    channelsdead: number;
+    tokenslive: number;
+};
+/**
+ * Runs the ordered intake pipeline of one remote frame: tls terminates first, the session token verifies on every frame, the allowlist refuses unknown fingerprints and the namespace scope check runs before any consent gate so unknown tools fail fast.
+ * A clean frame returns the verified token; every failure returns its json rpc error while auth failures answer with the fixed message that leaks no pairing state.
+ */
+export declare function httpframepipeline(input: {
+    config: mcpserverconfig;
+    presented?: {
+        fingerprint?: string;
+    };
+    tokens: sessiontoken[];
+    rawtoken?: string;
+    allowlist: allowlistentry[];
+    fingerprint: string;
+    toolname?: string;
+    now: number;
+}): Promise<{
+    error?: rpcerror;
+    token?: sessiontoken;
+}>;
+//# sourceMappingURL=httpstream.d.ts.map

package/dist/httpstream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpstream.d.ts","sourceRoot":"","sources":["../httpstream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAiB,MAAM,YAAY,CAAC;AAKnK;;;;GAIG;AAEH,wGAAwG;AACxG,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC,uHAAuH;AACvH,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAE1C,+LAA+L;AAC/L,wBAAgB,iBAAiB,IAAI,gBAAgB,CAEpD;AAED,0HAA0H;AAC1H,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAEtG;AAOD,0FAA0F;AAC1F,wBAAgB,SAAS,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,EAAE,CAE9G;AAED,0KAA0K;AAC1K,wBAAgB,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAG7F;AAED,2HAA2H;AAC3H,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,EAAE,CAEzH;AAED,+OAA+O;AAC/O,wBAAgB,QAAQ,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAK9J;AAED,4JAA4J;AAC5J,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAKhI;AAED,kKAAkK;AAClK,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAC;IAAC,OAAO,EAAE,YAAY,EAAE,CAAC;IAAC,MAAM,EAAE,YAAY,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAM3V;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,SAAS,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,MAAM,EAAE,YAAY,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,cAAc,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,KAAK,CAAC,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,YAAY,CAAA;CAAE,CAAC,CAalS"}

package/dist/index.d.ts

@@ -1,8 +1,11 @@
+export * from "./approvalgate.js";
 export * from "./capture.js";
 export * from "./cdpbus.js";
+export * from "./clientauth.js";
 export * from "./controlflow.js";
 export * from "./emulation.js";
 export * from "./httpclient.js";
+export * from "./httpstream.js";
 export * from "./media.js";
 export * from "./memory.js";
 export * from "./mcpserver.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzW,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,SAAS,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,UAAU,EAAE,oBAAoB,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,SAAS,EAAE,sBAAsB,EAAE,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,UAAU,EAAE,sBAAsB,EAAE,UAAU,EAAE,SAAS,EAAE,mBAAmB,EAAE,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,uBAAuB,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACvkD,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzW,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,SAAS,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,UAAU,EAAE,oBAAoB,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,SAAS,EAAE,sBAAsB,EAAE,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,UAAU,EAAE,sBAAsB,EAAE,UAAU,EAAE,SAAS,EAAE,mBAAmB,EAAE,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,uBAAuB,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACvkD,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}