@wix/pathgrade 1.0.25 → 1.0.26

package/dist/internal/direct-mcp-v2/cursor-profile.js

@@ -0,0 +1,79 @@
+import { access, realpath } from 'node:fs/promises';
+import { delimiter, isAbsolute, join } from 'node:path';
+import { constants } from 'node:fs';
+export const CURSOR_DIRECT_MCP_NORMALIZED_HANDSHAKE = {
+    normalizerVersion: 'pathgrade-acp-v1-capabilities-v1',
+    provider: 'cursor',
+    protocolVersion: 1,
+    httpMcp: true,
+    sessionClose: false,
+};
+/** Reviewed macOS arm64 pin captured by RFC 0006. Other platforms fail closed. */
+export const CURSOR_DIRECT_MCP_DARWIN_ARM64_PROFILE = {
+    format: 'pathgrade-direct-mcp-runtime-profile-v1',
+    provider: 'cursor',
+    platform: 'darwin',
+    architecture: 'arm64',
+    controlPlane: 'acp-v1',
+    command: {
+        absolutePath: '/Users/nadavlac/.local/share/cursor-agent/versions/2026.06.26-7079533/cursor-agent',
+        args: ['acp'],
+        versionArgs: ['--version'],
+    },
+    expectedVersion: '2026.06.26-7079533',
+    artifacts: [
+        {
+            label: 'cursor-wrapper',
+            absolutePath: '/Users/nadavlac/.local/share/cursor-agent/versions/2026.06.26-7079533/cursor-agent',
+            sha256: 'b7babf47d8b1eee28ac27a74affa02a559bb38103a6e71fbb1f120805d51fedf',
+        },
+        {
+            label: 'cursor-index',
+            absolutePath: '/Users/nadavlac/.local/share/cursor-agent/versions/2026.06.26-7079533/index.js',
+            sha256: '80eca3cae34cd9af1ee63cdf962eaad42d2a720a2268866e6467aca1b5ab5de0',
+        },
+        {
+            label: 'cursor-node',
+            absolutePath: '/Users/nadavlac/.local/share/cursor-agent/versions/2026.06.26-7079533/node',
+            sha256: '336b5b3ebc5deb86df842102b20b6e4761605b7a667823e68dda7761b91a161b',
+        },
+    ],
+    requiredCapabilities: { streamableHttp: true, controlPlaneHeaders: true, cancellation: 'session-cancel' },
+    profileFingerprint: 'e75d2763766bf6b2ab9005bd1ebaf252a207c8c3a63481484b007d81edebb818',
+    runtimeCapabilityFingerprint: '75d455ba86260766996f533485c54657764095af306e72a4f4616b759eedf59b',
+};
+/** Code-owned portable identity for the Cursor ACP author-session slice. */
+export const CURSOR_ACP_AUTHOR_DARWIN_ARM64_LOCK = {
+    format: 'pathgrade-direct-mcp-runtime-lock-v1',
+    provider: 'cursor',
+    platform: 'darwin',
+    architecture: 'arm64',
+    controlPlane: 'acp-v1',
+    version: '2026.06.26-7079533',
+    commandArtifact: 'cursor-wrapper',
+    args: ['acp'],
+    versionArgs: ['--version'],
+    artifacts: [
+        { id: 'cursor-wrapper', relativePath: 'cursor-agent', sha256: 'b7babf47d8b1eee28ac27a74affa02a559bb38103a6e71fbb1f120805d51fedf' },
+        { id: 'cursor-index', relativePath: 'index.js', sha256: '80eca3cae34cd9af1ee63cdf962eaad42d2a720a2268866e6467aca1b5ab5de0' },
+        { id: 'cursor-node', relativePath: 'node', sha256: '336b5b3ebc5deb86df842102b20b6e4761605b7a667823e68dda7761b91a161b' },
+    ],
+    capabilities: { streamableHttp: true, controlPlaneHeaders: true, cancellation: 'session-cancel' },
+    normalizedHandshakeSha256: '75d455ba86260766996f533485c54657764095af306e72a4f4616b759eedf59b',
+};
+/** Resolve ordinary Cursor command discovery before exact lock admission. */
+export async function resolveCursorExecutable(environment, command = 'cursor-agent') {
+    const candidates = isAbsolute(command)
+        ? [command]
+        : (environment.PATH ?? '').split(delimiter).filter(Boolean).map((directory) => join(directory, command));
+    for (const candidate of candidates) {
+        try {
+            await access(candidate, constants.X_OK);
+            return await realpath(candidate);
+        }
+        catch {
+            // Continue through the same PATH order used by the ordinary Cursor command.
+        }
+    }
+    throw new Error(`RUNTIME_NOT_ADMITTED: Cursor executable ${command} was not found on PATH`);
+}

package/dist/internal/direct-mcp-v2/evidence.d.ts

@@ -0,0 +1,50 @@
+import type { EvidenceEnvelope, JsonValue, ProviderCorroboration, ScenarioArtifact, ScenarioEvidence } from './types.js';
+export declare function valueMac(key: Uint8Array, value: unknown): string;
+export declare class PrivateReplayVault {
+    private readonly encryptionKey;
+    private readonly entries;
+    private nextReference;
+    private disposed;
+    constructor(encryptionKey?: Buffer);
+    store(value: JsonValue): string;
+    resolve(reference: string): JsonValue;
+    exportEncrypted(): Readonly<Record<string, {
+        iv: string;
+        authTag: string;
+        ciphertext: string;
+    }>>;
+    dispose(): void;
+    private assertOpen;
+}
+export declare class EvidenceLedger {
+    private readonly trialId;
+    private readonly artifactDigest;
+    private readonly envelopes;
+    constructor(trialId: string, artifactDigest: string);
+    append(turnId: string, payload: ScenarioEvidence): EvidenceEnvelope;
+    events(): readonly EvidenceEnvelope[];
+}
+export declare function verifyEvidenceChain(envelopes: readonly EvidenceEnvelope[], artifactDigest?: string): {
+    ok: true;
+    finalEventHash: string | null;
+} | {
+    ok: false;
+    index: number;
+    reason: string;
+};
+export type ReplayResult = {
+    ok: true;
+    finalState: string;
+    poisoned: boolean;
+    finalEventHash: string | null;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function replayPrivateEvidence(options: {
+    artifact: ScenarioArtifact;
+    evidence: readonly EvidenceEnvelope[];
+    vault: PrivateReplayVault;
+    macKey: Uint8Array;
+    providerCorroboration?: readonly ProviderCorroboration[];
+}): ReplayResult;

package/dist/internal/direct-mcp-v2/evidence.js

@@ -0,0 +1,147 @@
+/* oxlint-disable anti-slop/no-unknown-parameters, anti-slop/no-runtime-typeof -- Canonical MAC input and decrypted JSON are validated at this cryptographic replay boundary. */
+import { createCipheriv, createDecipheriv, createHmac, randomBytes } from 'node:crypto';
+import { canonicalJson, parseStrictJson, sha256Canonical } from './json.js';
+import { matchExpression } from './compiler.js';
+export function valueMac(key, value) {
+    return createHmac('sha256', key).update(canonicalJson(value)).digest('hex');
+}
+export class PrivateReplayVault {
+    encryptionKey;
+    entries = new Map();
+    nextReference = 1;
+    disposed = false;
+    constructor(encryptionKey = randomBytes(32)) {
+        this.encryptionKey = encryptionKey;
+        if (encryptionKey.byteLength !== 32)
+            throw new TypeError('replay encryption key must be 32 bytes');
+    }
+    store(value) {
+        this.assertOpen();
+        const reference = `request-${this.nextReference++}`;
+        const iv = randomBytes(12);
+        const cipher = createCipheriv('aes-256-gcm', this.encryptionKey, iv);
+        const ciphertext = Buffer.concat([cipher.update(canonicalJson(value), 'utf8'), cipher.final()]);
+        this.entries.set(reference, { iv: iv.toString('base64url'), authTag: cipher.getAuthTag().toString('base64url'), ciphertext: ciphertext.toString('base64url') });
+        return reference;
+    }
+    resolve(reference) {
+        this.assertOpen();
+        const entry = this.entries.get(reference);
+        if (!entry)
+            throw new Error(`unknown replay reference: ${reference}`);
+        const decipher = createDecipheriv('aes-256-gcm', this.encryptionKey, Buffer.from(entry.iv, 'base64url'));
+        decipher.setAuthTag(Buffer.from(entry.authTag, 'base64url'));
+        return parseStrictJson(Buffer.concat([decipher.update(Buffer.from(entry.ciphertext, 'base64url')), decipher.final()]).toString('utf8'));
+    }
+    exportEncrypted() {
+        this.assertOpen();
+        return Object.fromEntries(this.entries);
+    }
+    dispose() {
+        if (this.disposed)
+            return;
+        this.encryptionKey.fill(0);
+        this.entries.clear();
+        this.disposed = true;
+    }
+    assertOpen() {
+        if (this.disposed)
+            throw new Error('replay vault is disposed');
+    }
+}
+export class EvidenceLedger {
+    trialId;
+    artifactDigest;
+    envelopes = [];
+    constructor(trialId, artifactDigest) {
+        this.trialId = trialId;
+        this.artifactDigest = artifactDigest;
+    }
+    append(turnId, payload) {
+        const seq = this.envelopes.length + 1;
+        const previousEventHash = this.envelopes.at(-1)?.eventHash ?? null;
+        const withoutHash = { trialId: this.trialId, turnId, seq, previousEventHash, artifactDigest: this.artifactDigest, payload };
+        const envelope = { ...withoutHash, eventHash: sha256Canonical(withoutHash) };
+        this.envelopes.push(envelope);
+        return envelope;
+    }
+    events() { return this.envelopes; }
+}
+export function verifyEvidenceChain(envelopes, artifactDigest) {
+    let previousEventHash = null;
+    for (const [index, envelope] of envelopes.entries()) {
+        if (envelope.seq !== index + 1)
+            return { ok: false, index, reason: 'non-contiguous sequence' };
+        if (envelope.previousEventHash !== previousEventHash)
+            return { ok: false, index, reason: 'previousEventHash mismatch' };
+        if (artifactDigest !== undefined && envelope.artifactDigest !== artifactDigest)
+            return { ok: false, index, reason: 'artifactDigest mismatch' };
+        const { eventHash, ...withoutHash } = envelope;
+        if (sha256Canonical(withoutHash) !== eventHash)
+            return { ok: false, index, reason: 'eventHash mismatch' };
+        previousEventHash = eventHash;
+    }
+    return { ok: true, finalEventHash: previousEventHash };
+}
+function selectCase(artifact, state, serverId, toolId, args) {
+    const tool = artifact.canonicalIr.states[state]?.tools[`${serverId}/${toolId}`];
+    if (!tool)
+        return { outcome: 'no-match' };
+    const matches = tool.cases.filter((scenarioCase) => matchExpression(args, scenarioCase.when));
+    if (matches.length > 1)
+        return { outcome: 'ambiguous' };
+    if (matches.length === 0)
+        return { outcome: 'no-match', rejection: tool.otherwise };
+    return { outcome: 'matched', scenarioCase: matches[0] };
+}
+export function replayPrivateEvidence(options) {
+    const chain = verifyEvidenceChain(options.evidence, options.artifact.artifactDigest);
+    if (!chain.ok)
+        return { ok: false, reason: `evidence chain: ${chain.reason}` };
+    let state = options.artifact.canonicalIr.initialState;
+    let poisoned = false;
+    const invocations = new Map();
+    for (const envelope of options.evidence) {
+        const payload = envelope.payload;
+        if (payload.type === 'mcp.invocation') {
+            let raw;
+            try {
+                raw = options.vault.resolve(payload.replayRequestRef);
+            }
+            catch (error) {
+                return { ok: false, reason: `replay vault: ${error instanceof Error ? error.message : String(error)}` };
+            }
+            if (raw === null || Array.isArray(raw) || typeof raw !== 'object')
+                return { ok: false, reason: `replay request ${payload.replayRequestRef} is not an object` };
+            if (valueMac(options.macKey, raw) !== payload.argsMac)
+                return { ok: false, reason: `argument MAC mismatch for ${payload.invocationId}` };
+            invocations.set(payload.invocationId, { args: raw, selected: selectCase(options.artifact, state, payload.serverId, payload.toolId, raw) });
+        }
+        else if (payload.type === 'mcp.decision') {
+            const invocation = invocations.get(payload.invocationId);
+            if (!invocation || invocation.selected.outcome !== payload.outcome)
+                return { ok: false, reason: `decision mismatch for ${payload.invocationId}` };
+            if (payload.outcome === 'matched' && invocation.selected.scenarioCase?.id !== payload.caseId)
+                return { ok: false, reason: `case mismatch for ${payload.invocationId}` };
+        }
+        else if (payload.type === 'mcp.commit') {
+            const invocation = invocations.get(payload.invocationId);
+            if (!invocation || invocation.selected.outcome !== 'matched')
+                return { ok: false, reason: `commit without matched invocation ${payload.invocationId}` };
+            const scenarioCase = invocation.selected.scenarioCase;
+            if (payload.stateBefore !== state)
+                return { ok: false, reason: `stateBefore mismatch for ${payload.invocationId}` };
+            const expectedAfter = scenarioCase.transition?.to ?? state;
+            if (payload.stateAfter !== expectedAfter || valueMac(options.macKey, scenarioCase.outcome) !== payload.outcomeMac)
+                return { ok: false, reason: `commit outcome mismatch for ${payload.invocationId}` };
+            state = expectedAfter;
+        }
+        else if (payload.type === 'domain.poisoned') {
+            poisoned = true;
+        }
+        else if (payload.type === 'turn.finalized' && payload.state !== undefined && payload.state !== state) {
+            return { ok: false, reason: 'finalized state mismatch' };
+        }
+    }
+    return { ok: true, finalState: state, poisoned, finalEventHash: chain.finalEventHash };
+}

package/dist/internal/direct-mcp-v2/host-reducer.d.ts

@@ -0,0 +1,61 @@
+import { EvidenceLedger, PrivateReplayVault } from './evidence.js';
+import type { JsonObject, ProviderId, ScenarioArtifact, ScenarioCase } from './types.js';
+export type TrialPhase = 'NEW' | 'COMPILED' | 'ADMITTED' | 'READY' | 'ACTIVE' | 'FENCING' | 'QUIESCING' | 'POISONED' | 'DISPOSING' | 'DISPOSED';
+export type InvocationPhase = 'RECEIVED' | 'MATCHED' | 'PREPARED' | 'COMMITTED' | 'DELIVERED' | 'REJECTED' | 'ABORTED' | 'DELIVERY_UNKNOWN';
+export type HostResult<T = undefined> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    code: string;
+    message?: string;
+    invocationId?: string;
+    issues?: {
+        instancePointer: string;
+        schemaPointer: string;
+        keyword: string;
+    }[];
+};
+export declare class ScenarioHostReducer {
+    readonly trialId: string;
+    readonly artifact: ScenarioArtifact;
+    private readonly macKey;
+    phase: TrialPhase;
+    state: string;
+    epoch: number;
+    turnId?: string;
+    readonly ledger: EvidenceLedger;
+    readonly replayVault: PrivateReplayVault;
+    private readonly validators;
+    private readonly invocations;
+    private receivedSeq;
+    private committedSeq;
+    private providerTerminal;
+    private finalizedTurnIds;
+    constructor(trialId: string, artifact: ScenarioArtifact, macKey: Uint8Array, replayVault?: PrivateReplayVault);
+    markCompiled(): void;
+    markAdmitted(): void;
+    markReady(): void;
+    beginTurn(turnId: string, provider: ProviderId): void;
+    receive(serverId: string, toolId: string, args: JsonObject): HostResult<{
+        invocationId: string;
+    }>;
+    match(invocationId: string): HostResult<{
+        outcome: ScenarioCase['outcome'];
+    }>;
+    prepare(invocationId: string): HostResult;
+    commit(invocationId: string): HostResult<{
+        committedSeq: number;
+        outcome: ScenarioCase['outcome'];
+    }>;
+    delivery(invocationId: string, status: 'response-written' | 'cancelled' | 'unknown'): HostResult;
+    fence(): void;
+    abortUncommitted(reason?: string): void;
+    observeProviderTerminal(): void;
+    finalize(status: 'settled' | 'cancelled-clean' | 'poisoned', reason?: string): boolean;
+    dispose(): void;
+    activeInvocationCount(): number;
+    private transition;
+    private requireInvocation;
+    private poison;
+}

package/dist/internal/direct-mcp-v2/host-reducer.js

@@ -0,0 +1,214 @@
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import { matchExpression } from './compiler.js';
+import { EvidenceLedger, PrivateReplayVault, valueMac } from './evidence.js';
+export class ScenarioHostReducer {
+    trialId;
+    artifact;
+    macKey;
+    phase = 'NEW';
+    state;
+    epoch = 0;
+    turnId;
+    ledger;
+    replayVault;
+    validators = new Map();
+    invocations = new Map();
+    receivedSeq = 0;
+    committedSeq = 0;
+    providerTerminal = false;
+    finalizedTurnIds = new Set();
+    constructor(trialId, artifact, macKey, replayVault = new PrivateReplayVault()) {
+        this.trialId = trialId;
+        this.artifact = artifact;
+        this.macKey = macKey;
+        this.state = artifact.canonicalIr.initialState;
+        this.ledger = new EvidenceLedger(trialId, artifact.artifactDigest);
+        this.replayVault = replayVault;
+        const ajv = new Ajv2020({ allErrors: true, strict: true, validateFormats: false });
+        for (const [serverId, server] of Object.entries(artifact.canonicalIr.servers)) {
+            for (const [toolId, tool] of Object.entries(server.tools))
+                this.validators.set(`${serverId}/${toolId}`, ajv.compile(tool.inputSchema));
+        }
+    }
+    markCompiled() { this.transition('NEW', 'COMPILED'); }
+    markAdmitted() { this.transition('COMPILED', 'ADMITTED'); }
+    markReady() { this.transition('ADMITTED', 'READY'); }
+    beginTurn(turnId, provider) {
+        if (this.phase !== 'READY')
+            throw new Error(`cannot begin turn from ${this.phase}`);
+        if (this.finalizedTurnIds.has(turnId) || turnId.length === 0)
+            throw new Error('turnId must be unique and non-empty');
+        this.epoch += 1;
+        this.turnId = turnId;
+        this.providerTerminal = false;
+        this.phase = 'ACTIVE';
+        this.ledger.append(turnId, { type: 'turn.begun', epoch: this.epoch, provider });
+    }
+    receive(serverId, toolId, args) {
+        if (this.phase !== 'ACTIVE' || !this.turnId)
+            return { ok: false, code: 'TURN_NOT_ACTIVE' };
+        const tool = this.artifact.canonicalIr.states[this.state]?.tools[`${serverId}/${toolId}`];
+        if (!tool)
+            return { ok: false, code: 'SCENARIO_NO_MATCH' };
+        const invocationId = `invocation-${++this.receivedSeq}`;
+        const active = [...this.invocations.values()].filter((entry) => !['DELIVERED', 'REJECTED', 'ABORTED'].includes(entry.phase));
+        const replayRequestRef = this.replayVault.store(args);
+        const invocation = { id: invocationId, receivedSeq: this.receivedSeq, turnId: this.turnId, epoch: this.epoch, serverId, toolId, args, phase: 'RECEIVED', effectful: tool.effectful, stateBefore: this.state };
+        this.invocations.set(invocationId, invocation);
+        this.ledger.append(this.turnId, { type: 'mcp.invocation', invocationId, receivedSeq: invocation.receivedSeq, turnEpoch: invocation.epoch, serverId, toolId, argsMac: valueMac(this.macKey, args), replayRequestRef, snapshotSeq: this.committedSeq, stateBefore: this.state });
+        if (active.length > 0 && (tool.effectful || active.some((entry) => entry.effectful))) {
+            const ids = [...active.map((entry) => entry.id), invocationId].sort();
+            for (const entry of active)
+                if (entry.phase !== 'COMMITTED')
+                    entry.phase = 'ABORTED';
+            invocation.phase = 'ABORTED';
+            this.phase = 'POISONED';
+            this.ledger.append(this.turnId, { type: 'domain.poisoned', reason: 'concurrent-effect', invocationIds: ids });
+            return { ok: false, code: 'SCENARIO_CONCURRENT_EFFECT', invocationId };
+        }
+        return { ok: true, value: { invocationId } };
+    }
+    match(invocationId) {
+        const invocation = this.requireInvocation(invocationId, 'RECEIVED');
+        const validator = this.validators.get(`${invocation.serverId}/${invocation.toolId}`);
+        if (!validator(invocation.args)) {
+            invocation.phase = 'REJECTED';
+            return { ok: false, code: 'SCENARIO_INVALID_ARGUMENTS', invocationId, issues: (validator.errors ?? []).map((error) => ({ instancePointer: error.instancePath, schemaPointer: error.schemaPath, keyword: error.keyword })) };
+        }
+        const table = this.artifact.canonicalIr.states[this.state].tools[`${invocation.serverId}/${invocation.toolId}`];
+        const matches = table.cases.filter((scenarioCase) => matchExpression(invocation.args, scenarioCase.when));
+        if (matches.length > 1) {
+            invocation.phase = 'REJECTED';
+            this.ledger.append(invocation.turnId, { type: 'mcp.decision', invocationId, authority: 'scenario-host', outcome: 'ambiguous' });
+            this.poison('ambiguous-decision', [invocationId]);
+            return { ok: false, code: 'SCENARIO_AMBIGUOUS', invocationId };
+        }
+        if (matches.length === 0) {
+            invocation.phase = 'REJECTED';
+            this.ledger.append(invocation.turnId, { type: 'mcp.decision', invocationId, authority: 'scenario-host', outcome: 'no-match' });
+            return { ok: false, code: table.otherwise.code, message: table.otherwise.message, invocationId };
+        }
+        invocation.selected = matches[0];
+        invocation.phase = 'MATCHED';
+        this.ledger.append(invocation.turnId, { type: 'mcp.decision', invocationId, authority: 'scenario-host', outcome: 'matched', caseId: matches[0].id });
+        if (matches[0].outcome.kind === 'tool-error') {
+            invocation.phase = 'REJECTED';
+            return { ok: true, value: { outcome: matches[0].outcome } };
+        }
+        return { ok: true, value: { outcome: matches[0].outcome } };
+    }
+    prepare(invocationId) {
+        const invocation = this.requireInvocation(invocationId, 'MATCHED');
+        if (invocation.selected?.outcome.kind !== 'success')
+            return { ok: false, code: 'SCENARIO_NO_MATCH', invocationId };
+        invocation.phase = 'PREPARED';
+        this.ledger.append(invocation.turnId, { type: 'mcp.prepared', invocationId, turnEpoch: invocation.epoch });
+        return { ok: true, value: undefined };
+    }
+    commit(invocationId) {
+        const current = this.invocations.get(invocationId);
+        if (current?.phase === 'ABORTED')
+            return { ok: false, code: 'SCENARIO_CANCELLED', invocationId };
+        const invocation = this.requireInvocation(invocationId, 'PREPARED');
+        if (this.phase !== 'ACTIVE' || invocation.epoch !== this.epoch || invocation.turnId !== this.turnId) {
+            invocation.phase = 'ABORTED';
+            this.ledger.append(invocation.turnId, { type: 'mcp.abort', invocationId, phase: 'prepared', reason: 'stale-turn-epoch' });
+            return { ok: false, code: 'STALE_TURN_EPOCH', invocationId };
+        }
+        if (this.state !== invocation.stateBefore) {
+            this.poison('commit-state-cas-failed', [invocationId]);
+            return { ok: false, code: 'SCENARIO_CONCURRENT_EFFECT', invocationId };
+        }
+        const selected = invocation.selected;
+        const stateAfter = selected.transition?.to ?? this.state;
+        this.state = stateAfter;
+        invocation.phase = 'COMMITTED';
+        this.committedSeq += 1;
+        this.ledger.append(invocation.turnId, { type: 'mcp.commit', invocationId, committedEpoch: invocation.epoch, stateBefore: invocation.stateBefore, stateAfter, outcomeMac: valueMac(this.macKey, selected.outcome) });
+        return { ok: true, value: { committedSeq: this.committedSeq, outcome: selected.outcome } };
+    }
+    delivery(invocationId, status) {
+        const invocation = this.requireInvocation(invocationId, 'COMMITTED');
+        invocation.phase = status === 'unknown' ? 'DELIVERY_UNKNOWN' : 'DELIVERED';
+        this.ledger.append(invocation.turnId, { type: 'mcp.delivery', invocationId, status });
+        if (status === 'unknown') {
+            this.poison('delivery-unknown', [invocationId]);
+            return { ok: false, code: 'SCENARIO_DELIVERY_UNKNOWN', invocationId };
+        }
+        return { ok: true, value: undefined };
+    }
+    fence() {
+        if (this.phase !== 'ACTIVE' || !this.turnId)
+            throw new Error(`cannot fence from ${this.phase}`);
+        const previousEpoch = this.epoch;
+        this.epoch += 1;
+        this.phase = 'FENCING';
+        this.ledger.append(this.turnId, { type: 'turn.fenced', previousEpoch, nextEpoch: this.epoch });
+    }
+    abortUncommitted(reason = 'cancelled') {
+        if (this.phase !== 'FENCING' && this.phase !== 'POISONED')
+            throw new Error(`cannot abort from ${this.phase}`);
+        for (const invocation of this.invocations.values()) {
+            if (invocation.turnId !== this.turnId || !['RECEIVED', 'MATCHED', 'PREPARED'].includes(invocation.phase))
+                continue;
+            const phase = invocation.phase === 'RECEIVED' ? 'received' : invocation.phase === 'MATCHED' ? 'matched' : 'prepared';
+            invocation.phase = 'ABORTED';
+            this.ledger.append(invocation.turnId, { type: 'mcp.abort', invocationId: invocation.id, phase, reason });
+        }
+        if (this.phase === 'FENCING')
+            this.phase = 'QUIESCING';
+    }
+    observeProviderTerminal() { this.providerTerminal = true; }
+    finalize(status, reason) {
+        if (!this.turnId || this.finalizedTurnIds.has(this.turnId))
+            return false;
+        const active = [...this.invocations.values()].some((entry) => entry.turnId === this.turnId && !['DELIVERED', 'REJECTED', 'ABORTED', 'DELIVERY_UNKNOWN'].includes(entry.phase));
+        if (status === 'cancelled-clean' && (!this.providerTerminal || active || this.phase !== 'QUIESCING'))
+            throw new Error('cancellation cannot finalize before provider terminal and host quiescence');
+        if (status === 'settled' && (active || this.phase !== 'ACTIVE'))
+            throw new Error('turn is not settled');
+        if (this.phase === 'POISONED')
+            status = 'poisoned';
+        this.finalizedTurnIds.add(this.turnId);
+        if (reason)
+            this.ledger.append(this.turnId, { type: 'turn.finalized', status, reason, state: this.state });
+        else
+            this.ledger.append(this.turnId, { type: 'turn.finalized', status, state: this.state });
+        if (status !== 'poisoned')
+            this.phase = 'READY';
+        else
+            this.phase = 'POISONED';
+        return true;
+    }
+    dispose() {
+        if (this.phase === 'DISPOSED')
+            return;
+        if (this.phase === 'ACTIVE')
+            this.fence();
+        if (this.phase === 'FENCING')
+            this.abortUncommitted('dispose');
+        this.phase = 'DISPOSING';
+        this.invocations.clear();
+        this.phase = 'DISPOSED';
+    }
+    activeInvocationCount() {
+        return [...this.invocations.values()].filter((entry) => !['DELIVERED', 'REJECTED', 'ABORTED', 'DELIVERY_UNKNOWN'].includes(entry.phase)).length;
+    }
+    transition(from, to) {
+        if (this.phase !== from)
+            throw new Error(`expected ${from}, got ${this.phase}`);
+        this.phase = to;
+    }
+    requireInvocation(id, phase) {
+        const invocation = this.invocations.get(id);
+        if (!invocation || invocation.phase !== phase)
+            throw new Error(`invocation ${id} is not ${phase}`);
+        return invocation;
+    }
+    poison(reason, invocationIds) {
+        if (!this.turnId || this.phase === 'POISONED')
+            return;
+        this.phase = 'POISONED';
+        this.ledger.append(this.turnId, { type: 'domain.poisoned', reason, invocationIds: [...invocationIds].sort() });
+    }
+}

package/dist/internal/direct-mcp-v2/json.d.ts

@@ -0,0 +1,9 @@
+import type { JsonValue } from './types.js';
+export declare function assertJsonValue(value: unknown, path?: string, ancestors?: Set<object>): asserts value is JsonValue;
+export declare function canonicalJson(value: unknown): string;
+export declare function sha256Canonical(value: unknown): string;
+export declare function escapePointerToken(token: string): string;
+export declare function parsePointer(pointer: string): string[];
+export declare const MISSING: unique symbol;
+export declare function resolvePointer(value: JsonValue, pointer: string): JsonValue | typeof MISSING;
+export declare function parseStrictJson(text: string): JsonValue;