borgmcp-server 0.1.4 → 0.1.7

package/README.md

@@ -6,22 +6,43 @@ HTTPS.
 
 ## Release status
 
-The current public preview remains `borgmcp-server@0.1.1`, published on npm.
+The current public preview is `borgmcp-server@0.1.5`, published on npm.
 Versions `0.1.2` and `0.1.3` were not published; their immutable tags are
-internal failed-release evidence and are not installation or dogfood targets.
-The current source is the unpublished `0.1.4` release candidate. It retains the
-reviewed owner-enrollment, idempotent multi-cube creation, and stable prior-seat
-reattachment baseline, and adds managed role creation and updates, fail-closed
-setup reinitialization, opt-in redacted debug logging, live-safe invitation
-minting, and atomic cube-scoped invitations with enforced observer posture.
-The candidate consumes the audited exact `borgmcp-shared@0.3.0` registry
-release.
+preserved failed-release evidence and are not installation or dogfood targets.
+Version `0.1.5` includes the reviewed owner-enrollment, idempotent multi-cube
+creation, managed role administration, fail-closed setup reinitialization,
+redacted debug logging, and cube-scoped invitation baseline. Relative to
+`0.1.4`, it adds idempotent prior-seat reattachment, migrated cube-context and
+taxonomy routing, durable SSE replay and heartbeat delivery, fleet liveness
+signals, typed terminal drone eviction, and explicit manage-access denials for
+visible non-managing principals. The published `0.1.5` package consumes the
+audited exact `borgmcp-shared@0.4.0` registry release. Immutable `v0.1.6` failed
+safely before artifact upload or npm publication and is not an install target.
+Current source is the unpublished `borgmcp-server@0.1.7` recovery candidate and
+consumes the verified exact `borgmcp-shared@0.4.2` registry release. Version `0.1.5` remains the only
+current install target until the candidate passes exact-SHA review, immutable
+tag publication, and bounded registry verification.
 
 Setup prepares local identity and storage and prints one-time recovery and
 owner-enrollment secrets; it creates no cube. Version `0.1.1` completed the
 documented exact-source, tagged-artifact, and protected-publication gates.
-Version `0.1.4` has no tag or publication authorization until its exact merged
-source and tagged artifact complete the gates in `docs/releasing.md`.
+Version `0.1.5` completed a fresh exact-source, tagged-artifact, tokenless OIDC
+publication, provenance, signature, and attestation gate chain.
+
+## Repository topology
+
+Borg MCP's local/self-hosted product is split across three public repositories:
+
+- [`borg-mcp-client`](https://github.com/Byte-Ventures/borg-mcp-client) provides
+  the local MCP and command-line client.
+- [`borg-mcp-server`](https://github.com/Byte-Ventures/borg-mcp-server) is this
+  self-hosted coordination authority.
+- [`borg-mcp-shared`](https://github.com/Byte-Ventures/borg-mcp-shared) defines
+  the portable protocol contract and conformance suite used by both sides.
+
+The repositories release independently. Protocol changes land and pass portable
+conformance in `borg-mcp-shared` first; client and server then update to an exact,
+reviewed registry release. Neither consumer uses Git or SSH dependencies.
 
 ## Requirements
 

package/THIRD_PARTY_NOTICES.md

@@ -21,6 +21,7 @@ refer to each installed package for its complete license text.
 | `@peculiar/utils` | 2.0.3 | MIT |
 | `@peculiar/x509` | 1.14.3 | MIT |
 | `asn1js` | 3.0.10 | BSD-3-Clause |
+| `borgmcp-shared` | 0.4.2 | Apache-2.0 |
 | `bytestreamjs` | 2.0.1 | BSD-3-Clause |
 | `pkijs` | 3.4.0 | BSD-3-Clause |
 | `pvtsutils` | 1.3.6 | MIT |

package/dist/coordination-api.d.ts

@@ -8,6 +8,7 @@ export interface CoordinationRequest {
     readonly principal: Principal;
     readonly body?: unknown;
     readonly cursor?: string;
+    readonly since?: string;
     readonly signal: AbortSignal;
 }
 export interface CoordinationResponse {
@@ -17,7 +18,7 @@ export interface CoordinationResponse {
 }
 export declare class CoordinationApi {
     #private;
-    constructor(runtime: StoreRuntime, authority: CredentialAuthority, debugLogger?: DebugLogger);
+    constructor(runtime: StoreRuntime, authority: CredentialAuthority, debugLogger?: DebugLogger, streamHeartbeatMs?: number);
     armReplayTransition(): {
         readonly reached: Promise<void>;
         readonly release: () => void;