@willjackson/claude-code-bridge 0.6.2 → 0.7.0

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 import { z } from 'zod';
 import pino from 'pino';
+import * as tls from 'tls';
+import { IncomingMessage } from 'http';
 
 /**
  * Protocol definitions for Claude Code Bridge
@@ -516,6 +518,142 @@ declare function safeDeserializeMessage(json: string): z.SafeParseSuccess<{
     error: z.ZodError<any>;
 };
 
+/**
+ * Transport layer interface and types for Claude Code Bridge
+ * Defines the abstract transport interface for communication between bridge instances
+ */
+
+/**
+ * Represents the current state of a transport connection
+ */
+declare enum ConnectionState {
+    /** Not connected to any peer */
+    DISCONNECTED = "DISCONNECTED",
+    /** Currently attempting to establish connection */
+    CONNECTING = "CONNECTING",
+    /** Successfully connected and ready for communication */
+    CONNECTED = "CONNECTED",
+    /** Connection lost, attempting to reconnect */
+    RECONNECTING = "RECONNECTING"
+}
+/**
+ * TLS configuration for secure connections
+ */
+interface TLSConfig$2 {
+    /** Path to certificate PEM file (for server) */
+    cert?: string;
+    /** Path to private key PEM file (for server) */
+    key?: string;
+    /** Path to CA certificate PEM file (for client to verify server, or server to verify client) */
+    ca?: string;
+    /** Whether to reject unauthorized certificates (default: true) */
+    rejectUnauthorized?: boolean;
+    /** Passphrase for encrypted private key */
+    passphrase?: string;
+}
+/**
+ * Authentication type
+ */
+type AuthType$2 = 'none' | 'token' | 'password' | 'ip' | 'combined';
+/**
+ * Authentication configuration for transport connections
+ */
+interface AuthConfig$2 {
+    /** Authentication type */
+    type: AuthType$2;
+    /** Authentication token (for type: 'token' or 'combined') */
+    token?: string;
+    /** Authentication password (for type: 'password' or 'combined') */
+    password?: string;
+    /** Allowed IP addresses/ranges in CIDR notation (for type: 'ip' or 'combined') */
+    allowedIps?: string[];
+    /** If true, ALL configured methods must pass; if false, ANY passing method is sufficient */
+    requireAll?: boolean;
+}
+/**
+ * Configuration for establishing a transport connection
+ */
+interface ConnectionConfig {
+    /** Full WebSocket URL (e.g., ws://localhost:8765 or wss://localhost:8765) */
+    url?: string;
+    /** Host to connect to (used if url is not provided) */
+    host?: string;
+    /** Port to connect to (used if url is not provided) */
+    port?: number;
+    /** Enable automatic reconnection on disconnect */
+    reconnect?: boolean;
+    /** Interval between reconnection attempts in milliseconds */
+    reconnectInterval?: number;
+    /** Maximum number of reconnection attempts before giving up */
+    maxReconnectAttempts?: number;
+    /** Authentication configuration */
+    auth?: AuthConfig$2;
+    /** TLS configuration for secure connections */
+    tls?: TLSConfig$2;
+}
+/**
+ * Handler for incoming messages
+ */
+type MessageHandler = (message: BridgeMessage) => void;
+/**
+ * Handler for disconnect events
+ */
+type DisconnectHandler = () => void;
+/**
+ * Handler for error events
+ */
+type ErrorHandler = (error: Error) => void;
+/**
+ * Abstract transport interface for bridge communication
+ * Implementations handle the actual network protocol (WebSocket, TCP, etc.)
+ */
+interface Transport {
+    /**
+     * Establish connection to a remote peer
+     * @param config Connection configuration
+     * @returns Promise that resolves when connection is established
+     * @throws Error if connection fails
+     */
+    connect(config: ConnectionConfig): Promise<void>;
+    /**
+     * Cleanly close the current connection
+     * @returns Promise that resolves when disconnection is complete
+     */
+    disconnect(): Promise<void>;
+    /**
+     * Send a message to the connected peer
+     * @param message The message to send
+     * @returns Promise that resolves when message is sent
+     * @throws Error if not connected and message cannot be queued
+     */
+    send(message: BridgeMessage): Promise<void>;
+    /**
+     * Register a handler for incoming messages
+     * @param handler Function to call when a message is received
+     */
+    onMessage(handler: MessageHandler): void;
+    /**
+     * Register a handler for disconnect events
+     * @param handler Function to call when connection is lost
+     */
+    onDisconnect(handler: DisconnectHandler): void;
+    /**
+     * Register a handler for error events
+     * @param handler Function to call when an error occurs
+     */
+    onError(handler: ErrorHandler): void;
+    /**
+     * Check if the transport is currently connected
+     * @returns true if connected, false otherwise
+     */
+    isConnected(): boolean;
+    /**
+     * Get the current connection state
+     * @returns The current ConnectionState
+     */
+    getState(): ConnectionState;
+}
+
 /**
  * Bridge Core - Main orchestration class for Claude Code Bridge
  * Handles peer connections, message routing, and lifecycle management
@@ -525,8 +663,9 @@ declare function safeDeserializeMessage(json: string): z.SafeParseSuccess<{
  * Bridge operation mode
  * - 'host': Listen for incoming connections, sends commands via MCP
  * - 'client': Connect to host, receives and executes commands
+ * - 'peer': Bidirectional mode - can both listen and connect
  */
-type BridgeMode = 'host' | 'client';
+type BridgeMode = 'host' | 'client' | 'peer';
 /**
  * Configuration for the bridge's listening server
  */
@@ -535,17 +674,25 @@ interface BridgeListenConfig {
     port: number;
     /** Host to bind to (default: 0.0.0.0) */
     host?: string;
+    /** TLS configuration for secure connections */
+    tls?: TLSConfig$2;
+    /** Authentication configuration */
+    auth?: AuthConfig$2;
 }
 /**
  * Configuration for connecting to a remote bridge
  */
 interface BridgeConnectConfig {
-    /** Full WebSocket URL (e.g., ws://localhost:8765) */
+    /** Full WebSocket URL (e.g., ws://localhost:8765 or wss://localhost:8765) */
     url?: string;
     /** Use host.docker.internal for container-to-host connection */
     hostGateway?: boolean;
     /** Port to connect to (used if url is not provided) */
     port?: number;
+    /** TLS configuration for secure connections */
+    tls?: TLSConfig$2;
+    /** Authentication configuration */
+    auth?: AuthConfig$2;
 }
 /**
  * Context sharing configuration
@@ -623,9 +770,11 @@ type ContextRequestedHandler = (query: string, peerId: string) => FileChunk[] |
 declare class Bridge {
     private config;
     private server;
+    private httpsServer;
     private clientTransport;
     private peers;
     private started;
+    private authenticator;
     private peerConnectedHandlers;
     private peerDisconnectedHandlers;
     private messageReceivedHandlers;
@@ -648,6 +797,7 @@ declare class Bridge {
      * Start the bridge based on configured mode
      * - 'host': Starts WebSocket server, sends commands via MCP
      * - 'client': Connects to host, receives and executes commands
+     * - 'peer': Starts server (if listen configured) and connects to remote (if connect configured)
      */
     start(): Promise<void>;
     /**
@@ -744,8 +894,15 @@ declare class Bridge {
     stopAutoSync(): void;
     /**
      * Start the WebSocket server
+     * If TLS is configured, starts an HTTPS server with WebSocket upgrade
+     * If auth is configured, validates connections before accepting
      */
     private startServer;
+    /**
+     * Verify client connection for authentication
+     * Used as WebSocketServer verifyClient callback
+     */
+    private verifyClient;
     /**
      * Handle a new incoming connection
      */
@@ -1053,115 +1210,6 @@ declare class ContextManager {
     private truncateContent;
 }
 
-/**
- * Transport layer interface and types for Claude Code Bridge
- * Defines the abstract transport interface for communication between bridge instances
- */
-
-/**
- * Represents the current state of a transport connection
- */
-declare enum ConnectionState {
-    /** Not connected to any peer */
-    DISCONNECTED = "DISCONNECTED",
-    /** Currently attempting to establish connection */
-    CONNECTING = "CONNECTING",
-    /** Successfully connected and ready for communication */
-    CONNECTED = "CONNECTED",
-    /** Connection lost, attempting to reconnect */
-    RECONNECTING = "RECONNECTING"
-}
-/**
- * Authentication configuration for transport connections
- */
-interface AuthConfig {
-    /** Authentication type */
-    type: 'token' | 'none';
-    /** Authentication token (required if type is 'token') */
-    token?: string;
-}
-/**
- * Configuration for establishing a transport connection
- */
-interface ConnectionConfig {
-    /** Full WebSocket URL (e.g., ws://localhost:8765) */
-    url?: string;
-    /** Host to connect to (used if url is not provided) */
-    host?: string;
-    /** Port to connect to (used if url is not provided) */
-    port?: number;
-    /** Enable automatic reconnection on disconnect */
-    reconnect?: boolean;
-    /** Interval between reconnection attempts in milliseconds */
-    reconnectInterval?: number;
-    /** Maximum number of reconnection attempts before giving up */
-    maxReconnectAttempts?: number;
-    /** Authentication configuration */
-    auth?: AuthConfig;
-}
-/**
- * Handler for incoming messages
- */
-type MessageHandler = (message: BridgeMessage) => void;
-/**
- * Handler for disconnect events
- */
-type DisconnectHandler = () => void;
-/**
- * Handler for error events
- */
-type ErrorHandler = (error: Error) => void;
-/**
- * Abstract transport interface for bridge communication
- * Implementations handle the actual network protocol (WebSocket, TCP, etc.)
- */
-interface Transport {
-    /**
-     * Establish connection to a remote peer
-     * @param config Connection configuration
-     * @returns Promise that resolves when connection is established
-     * @throws Error if connection fails
-     */
-    connect(config: ConnectionConfig): Promise<void>;
-    /**
-     * Cleanly close the current connection
-     * @returns Promise that resolves when disconnection is complete
-     */
-    disconnect(): Promise<void>;
-    /**
-     * Send a message to the connected peer
-     * @param message The message to send
-     * @returns Promise that resolves when message is sent
-     * @throws Error if not connected and message cannot be queued
-     */
-    send(message: BridgeMessage): Promise<void>;
-    /**
-     * Register a handler for incoming messages
-     * @param handler Function to call when a message is received
-     */
-    onMessage(handler: MessageHandler): void;
-    /**
-     * Register a handler for disconnect events
-     * @param handler Function to call when connection is lost
-     */
-    onDisconnect(handler: DisconnectHandler): void;
-    /**
-     * Register a handler for error events
-     * @param handler Function to call when an error occurs
-     */
-    onError(handler: ErrorHandler): void;
-    /**
-     * Check if the transport is currently connected
-     * @returns true if connected, false otherwise
-     */
-    isConnected(): boolean;
-    /**
-     * Get the current connection state
-     * @returns The current ConnectionState
-     */
-    getState(): ConnectionState;
-}
-
 /**
  * WebSocket Transport implementation for Claude Code Bridge
  * Provides WebSocket-based communication between bridge instances
@@ -1189,8 +1237,17 @@ declare class WebSocketTransport implements Transport {
     private reconnectingHandlers;
     /**
      * Build the WebSocket URL from the connection configuration
+     * Uses wss:// if TLS is configured, ws:// otherwise
      */
     private buildUrl;
+    /**
+     * Build WebSocket options including TLS and auth configuration
+     */
+    private buildWsOptions;
+    /**
+     * Build URL with auth query parameters (fallback for servers that don't support headers)
+     */
+    private buildUrlWithAuth;
     /**
      * Establish connection to a remote peer
      */
@@ -1356,12 +1413,50 @@ declare function createLogger(name: string, level?: LogLevel): Logger;
  */
 declare function createChildLogger(parent: Logger, bindings: Record<string, unknown>): Logger;
 
+/**
+ * TLS configuration for secure connections
+ */
+interface TLSConfig$1 {
+    /** Path to certificate PEM file */
+    cert?: string;
+    /** Path to private key PEM file */
+    key?: string;
+    /** Path to CA certificate PEM file */
+    ca?: string;
+    /** Whether to reject unauthorized certificates (default: true) */
+    rejectUnauthorized?: boolean;
+    /** Passphrase for encrypted private key */
+    passphrase?: string;
+}
+/**
+ * Authentication type
+ */
+type AuthType$1 = 'none' | 'token' | 'password' | 'ip' | 'combined';
+/**
+ * Authentication configuration
+ */
+interface AuthConfig$1 {
+    /** Authentication type */
+    type: AuthType$1;
+    /** Authentication token */
+    token?: string;
+    /** Authentication password */
+    password?: string;
+    /** Allowed IP addresses/ranges in CIDR notation */
+    allowedIps?: string[];
+    /** If true, ALL configured methods must pass; if false, ANY passing method is sufficient */
+    requireAll?: boolean;
+}
 /**
  * Configuration for the bridge's listening socket
  */
 interface ListenConfig {
     port: number;
     host: string;
+    /** TLS configuration for secure connections */
+    tls?: TLSConfig$1;
+    /** Authentication configuration */
+    auth?: AuthConfig$1;
 }
 /**
  * Configuration for connecting to a remote bridge
@@ -1370,6 +1465,10 @@ interface ConnectConfig {
     url?: string;
     hostGateway?: boolean;
     port?: number;
+    /** TLS configuration for secure connections */
+    tls?: TLSConfig$1;
+    /** Authentication configuration */
+    auth?: AuthConfig$1;
 }
 /**
  * Configuration for context sharing behavior
@@ -1603,6 +1702,212 @@ declare function wrapError(error: unknown, context: string): BridgeError;
  */
 declare function isErrorCode(error: unknown, code: ErrorCode): boolean;
 
+/**
+ * TLS utilities for Claude Code Bridge
+ * Handles loading and validating TLS certificates for secure WebSocket connections
+ */
+
+/**
+ * TLS configuration for secure connections
+ */
+interface TLSConfig {
+    /** Path to certificate PEM file */
+    cert?: string;
+    /** Path to private key PEM file */
+    key?: string;
+    /** Path to CA certificate PEM file (for verifying client certs or self-signed server certs) */
+    ca?: string;
+    /** Whether to reject unauthorized certificates (default: true) */
+    rejectUnauthorized?: boolean;
+    /** Passphrase for encrypted private key */
+    passphrase?: string;
+}
+/**
+ * Result of TLS configuration validation
+ */
+interface TLSValidationResult {
+    /** Whether the configuration is valid */
+    valid: boolean;
+    /** List of validation errors */
+    errors: string[];
+    /** List of validation warnings */
+    warnings: string[];
+}
+/**
+ * Loaded TLS options ready for use with https/tls modules
+ */
+interface LoadedTLSOptions {
+    /** Certificate content */
+    cert?: string | Buffer;
+    /** Private key content */
+    key?: string | Buffer;
+    /** CA certificate content */
+    ca?: string | Buffer;
+    /** Whether to reject unauthorized certificates */
+    rejectUnauthorized?: boolean;
+    /** Passphrase for encrypted private key */
+    passphrase?: string;
+}
+/**
+ * Load TLS certificates from file paths
+ * @param config - TLS configuration with file paths
+ * @returns TLS options ready for use with https/tls modules
+ * @throws Error if required certificates cannot be loaded
+ */
+declare function loadCertificates(config: TLSConfig): Promise<LoadedTLSOptions>;
+/**
+ * Synchronous version of loadCertificates
+ * @param config - TLS configuration with file paths
+ * @returns TLS options ready for use with https/tls modules
+ * @throws Error if required certificates cannot be loaded
+ */
+declare function loadCertificatesSync(config: TLSConfig): LoadedTLSOptions;
+/**
+ * Validate TLS configuration
+ * @param config - TLS configuration to validate
+ * @returns Validation result with errors and warnings
+ */
+declare function validateTLSConfig(config: TLSConfig): TLSValidationResult;
+/**
+ * Check if TLS is enabled in the configuration
+ * @param config - TLS configuration to check
+ * @returns true if TLS should be enabled (cert and key both provided)
+ */
+declare function isTLSEnabled(config?: TLSConfig): boolean;
+/**
+ * Create TLS secure context options for Node.js tls module
+ * @param loaded - Loaded TLS options
+ * @returns Options for tls.createSecureContext
+ */
+declare function createSecureContextOptions(loaded: LoadedTLSOptions): tls.SecureContextOptions;
+
+/**
+ * Authentication utilities for Claude Code Bridge
+ * Handles token, password, and IP-based authentication for WebSocket connections
+ */
+
+/**
+ * Authentication type
+ */
+type AuthType = 'none' | 'token' | 'password' | 'ip' | 'combined';
+/**
+ * Authentication configuration
+ */
+interface AuthConfig {
+    /** Authentication type */
+    type: AuthType;
+    /** Authentication token (for type: 'token' or 'combined') */
+    token?: string;
+    /** Authentication password (for type: 'password' or 'combined') */
+    password?: string;
+    /** Allowed IP addresses/ranges in CIDR notation (for type: 'ip' or 'combined') */
+    allowedIps?: string[];
+    /** If true, ALL configured methods must pass; if false, ANY passing method is sufficient */
+    requireAll?: boolean;
+}
+/**
+ * Authentication result
+ */
+interface AuthResult {
+    /** Whether authentication succeeded */
+    success: boolean;
+    /** Error message if authentication failed */
+    error?: string;
+    /** Which authentication method succeeded (if any) */
+    method?: 'token' | 'password' | 'ip';
+    /** Client IP address */
+    clientIp?: string;
+}
+/**
+ * Credentials extracted from a request
+ */
+interface ExtractedCredentials {
+    /** Token from query string or Authorization header */
+    token?: string;
+    /** Password from query string or header */
+    password?: string;
+    /** Client IP address */
+    clientIp: string;
+}
+/**
+ * Check if an IP address matches any of the allowed ranges
+ * @param clientIp - The IP address to check
+ * @param allowedCidrs - Array of CIDR ranges
+ * @returns true if the IP matches any range
+ */
+declare function validateIp(clientIp: string, allowedCidrs: string[]): boolean;
+/**
+ * Validate a token using timing-safe comparison
+ * @param provided - The provided token
+ * @param expected - The expected token
+ * @returns true if tokens match
+ */
+declare function validateToken(provided: string | undefined, expected: string): boolean;
+/**
+ * Validate a password using timing-safe comparison
+ * @param provided - The provided password
+ * @param expected - The expected password
+ * @returns true if passwords match
+ */
+declare function validatePassword(provided: string | undefined, expected: string): boolean;
+/**
+ * Extract credentials from an HTTP request
+ * Looks for token/password in query parameters and Authorization header
+ */
+declare function extractCredentials(request: IncomingMessage): ExtractedCredentials;
+/**
+ * Authenticator class for validating connection requests
+ */
+declare class Authenticator {
+    private config;
+    /**
+     * Create a new Authenticator
+     * @param config - Authentication configuration
+     */
+    constructor(config: AuthConfig);
+    /**
+     * Authenticate a request
+     * @param request - The incoming HTTP request (WebSocket upgrade request)
+     * @returns Authentication result
+     */
+    authenticate(request: IncomingMessage): AuthResult;
+    /**
+     * Authenticate with extracted credentials
+     * @param credentials - The extracted credentials
+     * @returns Authentication result
+     */
+    authenticateWithCredentials(credentials: ExtractedCredentials): AuthResult;
+    /**
+     * Get the configured authentication type
+     */
+    getType(): AuthType;
+    /**
+     * Check if authentication is required
+     */
+    isRequired(): boolean;
+}
+/**
+ * Create an AuthConfig from CLI options
+ * @param options - CLI options object
+ * @returns AuthConfig
+ */
+declare function createAuthConfigFromOptions(options: {
+    authToken?: string;
+    authPassword?: string;
+    authIp?: string[];
+    authRequireAll?: boolean;
+}): AuthConfig;
+/**
+ * Validate an AuthConfig
+ * @param config - AuthConfig to validate
+ * @returns Validation result with errors and warnings
+ */
+declare function validateAuthConfig(config: AuthConfig): {
+    valid: boolean;
+    errors: string[];
+    warnings: string[];
+};
+
 /**
  * MCP Server for Claude Code Bridge
  * Exposes bridge functionality as MCP tools for Claude Code integration
@@ -1619,6 +1924,10 @@ interface McpServerConfig {
     instanceName?: string;
     /** Task timeout in milliseconds */
     taskTimeout?: number;
+    /** TLS configuration for secure connections */
+    tls?: TLSConfig$2;
+    /** Authentication configuration */
+    auth?: AuthConfig$2;
 }
 /**
  * MCP Server that exposes bridge functionality as tools
@@ -1687,4 +1996,4 @@ declare function createToolHandlers(bridge: Bridge): Record<string, (args: Recor
  */
 declare const VERSION = "0.1.0";
 
-export { type Artifact, ArtifactSchema, Bridge, type BridgeConfig$1 as BridgeConfig, type BridgeConnectConfig, BridgeError, BridgeLifecycleError, type BridgeListenConfig, BridgeMcpServer, type BridgeMessage, BridgeMessageSchema, type BridgeMode, type BuildDirectoryTreeOptions, ConfigurationError, type ConnectConfig, type ConnectionConfig, ConnectionError, ConnectionState, type Context, type ContextDelta, ContextError, ContextManager, type ContextManagerOptions, type ContextReceivedHandler, type ContextRequestedHandler, ContextSchema, type ContextSharingConfig$1 as ContextSharingConfig, DEFAULT_CONFIG, type DirectoryTree, DirectoryTreeSchema, type ErrorCode, ErrorCodes, type FileChange, type FileChunk, FileChunkSchema, type InteractionConfig, type ListenConfig, type LogLevel, type Logger, type McpServerConfig, type MessageReceivedHandler, MessageType, type NotificationData, type PeerConnectedHandler, type PeerDisconnectedHandler, PeerError, type PeerInfo, type ProjectSnapshot, ProtocolError, TOOL_DEFINITIONS, TaskError, type TaskReceivedHandler, type TaskRequest, TaskRequestSchema, type TaskResult, TaskResultSchema, type ToolDefinition, type ToolResponse, type Transport, type BridgeConfig as UtilsBridgeConfig, type ContextSharingConfig as UtilsContextSharingConfig, VERSION, WebSocketTransport, buildDirectoryTree, createChildLogger, createContextRequestMessage, createContextSyncMessage, createLogger, createMessage, createNotificationMessage, createTaskDelegateMessage, createTaskResponseMessage, createToolHandlers, createTransport, deserializeMessage, estimateTokens, formatErrorForLogging, isErrorCode, loadConfig, loadConfigSync, mergeConfig, safeDeserializeMessage, safeValidateMessage, serializeMessage, startMcpServer, truncateToTokenLimit, validateMessage, wrapError };
+export { type Artifact, ArtifactSchema, type AuthConfig, type AuthResult, type AuthType, Authenticator, Bridge, type BridgeConfig$1 as BridgeConfig, type BridgeConnectConfig, BridgeError, BridgeLifecycleError, type BridgeListenConfig, BridgeMcpServer, type BridgeMessage, BridgeMessageSchema, type BridgeMode, type BuildDirectoryTreeOptions, ConfigurationError, type ConnectConfig, type ConnectionConfig, ConnectionError, ConnectionState, type Context, type ContextDelta, ContextError, ContextManager, type ContextManagerOptions, type ContextReceivedHandler, type ContextRequestedHandler, ContextSchema, type ContextSharingConfig$1 as ContextSharingConfig, DEFAULT_CONFIG, type DirectoryTree, DirectoryTreeSchema, type ErrorCode, ErrorCodes, type ExtractedCredentials, type FileChange, type FileChunk, FileChunkSchema, type InteractionConfig, type ListenConfig, type LoadedTLSOptions, type LogLevel, type Logger, type McpServerConfig, type MessageReceivedHandler, MessageType, type NotificationData, type PeerConnectedHandler, type PeerDisconnectedHandler, PeerError, type PeerInfo, type ProjectSnapshot, ProtocolError, type TLSConfig, type TLSValidationResult, TOOL_DEFINITIONS, TaskError, type TaskReceivedHandler, type TaskRequest, TaskRequestSchema, type TaskResult, TaskResultSchema, type ToolDefinition, type ToolResponse, type Transport, type BridgeConfig as UtilsBridgeConfig, type ContextSharingConfig as UtilsContextSharingConfig, VERSION, WebSocketTransport, buildDirectoryTree, createAuthConfigFromOptions, createChildLogger, createContextRequestMessage, createContextSyncMessage, createLogger, createMessage, createNotificationMessage, createSecureContextOptions, createTaskDelegateMessage, createTaskResponseMessage, createToolHandlers, createTransport, deserializeMessage, estimateTokens, extractCredentials, formatErrorForLogging, isErrorCode, isTLSEnabled, loadCertificates, loadCertificatesSync, loadConfig, loadConfigSync, mergeConfig, safeDeserializeMessage, safeValidateMessage, serializeMessage, startMcpServer, truncateToTokenLimit, validateAuthConfig, validateIp, validateMessage, validatePassword, validateTLSConfig, validateToken, wrapError };