ftown 0.19.52 → 0.19.53

package/dist/mcp/relay-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"relay-handler.js","sourceRoot":"","sources":["../../src/mcp/relay-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,EACX,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,KAAa;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAGnB,CAAC;IACJ,OAAO,KAAK,EAAE,EAAU,EAAE,OAAgC,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrD,IACE,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;YACrC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAC/B,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAEtC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC;aACrC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;aAC/B,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW;gBACtC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM;YAC/B,IAAI,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,oBAAoB,IAAI,EAAE,EAAE,KAAK,EAAE;oBAChE,GAAG,OAAO;oBACV,SAAS,EAAE,IAAI,CAAC,GAAG,CACjB,IAAI,EACJ,IAAI,CAAC,GAAG,CACN,OAAO,CAAC,SAAS,EAChB,OAAO,CAAC,SAAoB,GAAG,IAAI,CAAC,GAAG,EAAE,CAC3C,CACF;iBACF,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM;oBAClD,MAAM,IAAI,UAAU,CAClB,oBAAoB,EACpB,mDAAmD,EACnD,OAAO,CAAC,MAAM,KAAK,KAAK,CACzB,CAAC;gBACJ,OAAO,EAAE,IAAI,EAAE,CAAC;YAClB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"relay-handler.js","sourceRoot":"","sources":["../../src/mcp/relay-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAc;IAC9D,OAAO,KAAK,EAAE,GAAW,EAAE,QAAiC,EAAkB,EAAE;QAC9E,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,yCAAyC,CAAC,CAAC;IACtF,CAAC,CAAC;AACJ,CAAC"}

package/dist/mcp/relay.d.ts

@@ -1,13 +1,13 @@
 import { type BridgeRequest } from "./fleet.js";
-/** One renewable owner-scoped relay connection per account, shared by all its MCP requests. */
+import { type McpRequestContext } from "./secure-client.js";
+/** Renewable routing connections carry ciphertext only; identities stay request-bound. */
 export declare class FleetRelay {
     private url;
     private tokenSecret;
     private clients;
     constructor(url: string, tokenSecret: string);
     private connection;
-    request(userId: string, machineId: string, request: BridgeRequest, signal?: AbortSignal): Promise<any>;
-    private unwrap;
-    private rpc;
+    request(userId: string, machineId: string, request: BridgeRequest, signal?: AbortSignal, context?: McpRequestContext): Promise<unknown>;
+    private exchange;
     close(): void;
 }

package/dist/mcp/relay.js

@@ -1,10 +1,10 @@
-import { randomUUID } from "node:crypto";
 import { Centrifuge } from "centrifuge";
 import WebSocket from "ws";
 import jwt from "jsonwebtoken";
 import { FleetError, requestSchema } from "./fleet.js";
-import { legacyRelayCommand } from "./legacy-relay.js";
-/** One renewable owner-scoped relay connection per account, shared by all its MCP requests. */
+import { parseSecureEnvelope } from "../security/crypto.js";
+import { SecureMcpClient } from "./secure-client.js";
+/** Renewable routing connections carry ciphertext only; identities stay request-bound. */
 export class FleetRelay {
     url;
     tokenSecret;
@@ -17,25 +17,18 @@ export class FleetRelay {
         const cached = this.clients.get(userId);
         if (cached)
             return cached;
-        const mint = () => jwt.sign({}, this.tokenSecret, {
-            subject: userId,
-            audience: "ftown:centrifugo",
-            expiresIn: "10m",
-        });
-        const client = new Centrifuge(this.url, {
-            websocket: WebSocket,
-            token: mint(),
-            getToken: async () => mint(),
-            timeout: 10000,
-        });
+        const mint = () => jwt.sign({}, this.tokenSecret, { subject: userId, audience: "ftown:centrifugo", expiresIn: "10m" });
+        const client = new Centrifuge(this.url, { websocket: WebSocket, token: mint(), getToken: async () => mint(), timeout: 10000 });
         const sub = client.newSubscription(`commands:rpc#${userId}`);
         const pending = new Map();
-        sub.on("publication", (ctx) => {
-            // Same fail-closed publisher check as the existing bridge transport.
-            if (ctx.info?.user !== userId || ctx.data?.type !== "command_response")
+        sub.on("publication", ctx => {
+            if (ctx.info?.user !== userId)
                 return;
-            const response = ctx.data.response;
-            pending.get(response?.requestId)?.(response);
+            try {
+                const packet = parseSecureEnvelope(ctx.data);
+                pending.get(packet.messageId)?.accept(packet);
+            }
+            catch { /* Plaintext/unknown/oversized traffic never enters the application. */ }
         });
         sub.subscribe();
         client.connect();
@@ -43,60 +36,21 @@ export class FleetRelay {
         this.clients.set(userId, entry);
         return entry;
     }
-    async request(userId, machineId, request, signal) {
-        request = requestSchema.parse(request);
-        const deadline = Date.now() + request.timeoutMs;
-        const mutation = request.method !== "GET";
-        const response = await this.rpc(userId, machineId, "mcp_request", {
-            request, expiresAt: deadline,
-        }, deadline, mutation, signal);
-        if (response.success)
-            return this.unwrap(response.data);
-        // Only this rejection proves the operation was not executed. Never fall
-        // back after a timeout, connection failure or ambiguous execution error.
-        if (response.error !== "Unknown command type: mcp_request")
-            throw new FleetError("bridge_error", "Bridge could not execute the relay request", mutation);
-        const lifecycle = request.method === "POST"
-            ? /^\/api\/sessions\/([a-zA-Z0-9_-]+)\/(stop|retry)$/.exec(request.path) : null;
-        const type = lifecycle ? `${lifecycle[2]}_session` : "bridge_exec";
-        const payload = lifecycle ? { sessionId: lifecycle[1] } : {
-            command: legacyRelayCommand(machineId, request, deadline),
-            timeout: Math.max(1, deadline - Date.now()),
-        };
-        const legacy = await this.rpc(userId, machineId, type, payload, deadline, mutation, signal);
-        if (!legacy.success) {
-            if (legacy.error === "bridge_exec disabled (FTOWN_DISABLE_BRIDGE_EXEC=1)")
-                throw new FleetError("bridge_upgrade_required", "Upgrade this bridge to enable native MCP support; legacy execution is disabled");
-            throw new FleetError("bridge_error", "Bridge rejected the compatibility request", mutation);
-        }
-        if (lifecycle)
-            return legacy.data;
-        if (legacy.data?.exitCode !== 0)
-            throw new FleetError("bridge_error", "Legacy bridge helper failed; check Node availability or upgrade this bridge", mutation);
-        let result;
-        try {
-            result = JSON.parse(legacy.data.stdout);
-        }
-        catch {
-            throw new FleetError("bridge_error", "Legacy bridge returned an invalid result", mutation);
-        }
-        return this.unwrap(result);
-    }
-    unwrap(result) {
-        if (result?.error)
-            throw new FleetError(result.error.code, result.error.message, result.error.outcomeUnknown, result.error.status);
-        return result?.data;
+    async request(userId, machineId, request, signal, context) {
+        if (!context)
+            throw new FleetError("approval_required", "An encrypted MCP grant is required");
+        const client = new SecureMcpClient(context, machineId, `commands:rpc#${userId}`, (packet, deadline, mutating, abort) => this.exchange(userId, packet, deadline, mutating, abort));
+        return client.request(requestSchema.parse(request), signal);
     }
-    async rpc(userId, machineId, type, payload, deadline, mutation, signal) {
+    async exchange(userId, packet, deadline, mutating, signal) {
         if (Date.now() >= deadline)
-            throw new FleetError("timeout", "Request expired before publication");
+            throw new FleetError("timeout", "Encrypted request expired before publication");
         if (signal?.aborted)
-            throw new FleetError("cancelled", "Relay request cancelled");
+            throw new FleetError("cancelled", "Encrypted request cancelled");
         const { sub, pending } = this.connection(userId);
-        const id = randomUUID();
+        const id = packet.messageId;
         return new Promise((resolve, reject) => {
-            let sent = false;
-            let settled = false;
+            let sent = false, settled = false;
             const finish = (error, value) => {
                 if (settled)
                     return;
@@ -106,37 +60,33 @@ export class FleetRelay {
                 signal?.removeEventListener("abort", cancel);
                 if (error)
                     reject(error);
-                else
+                else if (value)
                     resolve(value);
             };
-            const cancel = () => finish(new FleetError("cancelled", "Relay request cancelled", sent && mutation));
-            const timer = setTimeout(() => finish(new FleetError("timeout", "Bridge did not respond before the deadline", sent && mutation)), Math.max(1, deadline - Date.now()));
+            const cancel = () => finish(new FleetError("cancelled", "Encrypted relay request cancelled", sent && mutating));
+            const timer = setTimeout(() => finish(new FleetError("timeout", "Encrypted bridge did not respond before the deadline", sent && mutating)), Math.max(1, deadline - Date.now()));
             signal?.addEventListener("abort", cancel, { once: true });
             if (signal?.aborted) {
                 cancel();
                 return;
             }
-            pending.set(id, (response) => finish(undefined, response));
-            void sub
-                .ready(Math.max(1, deadline - Date.now()))
-                .then(async () => {
+            pending.set(id, { accept: value => {
+                    // Other concurrent gateways/endpoints can publish the same visible ID; only accept the exact route here.
+                    if (value.senderId === packet.recipientId && value.recipientId === packet.senderId && value.ownerId === packet.ownerId && value.bridgeId === packet.bridgeId && value.channel === packet.channel)
+                        finish(undefined, value);
+                }, reject: () => finish(new FleetError("connection_error", "Encrypted relay is closing", sent && mutating)) });
+            void sub.ready(Math.max(1, deadline - Date.now())).then(async () => {
                 if (settled)
                     return;
-                // No retries: publication failure may still mean the request was delivered.
                 sent = true;
-                await sub.publish({
-                    type,
-                    requestId: id,
-                    payload: { ...payload, bridgeId: machineId },
-                });
-            })
-                .catch(() => finish(new FleetError("connection_error", "Relay connection unavailable", sent && mutation)));
+                await sub.publish(packet);
+            }).catch(() => finish(new FleetError("connection_error", "Encrypted relay connection unavailable", sent && mutating)));
         });
     }
     close() {
         for (const entry of this.clients.values()) {
-            for (const finish of [...entry.pending.values()])
-                finish({ success: false });
+            for (const pending of [...entry.pending.values()])
+                pending.reject();
             entry.client.disconnect();
         }
         this.clients.clear();

package/dist/mcp/relay.js.map

@@ -1 +1 @@
-{"version":3,"file":"relay.js","sourceRoot":"","sources":["../../src/mcp/relay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAqB,MAAM,YAAY,CAAC;AAC3D,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,aAAa,EAAsB,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,+FAA+F;AAC/F,MAAM,OAAO,UAAU;IAUX;IACA;IAVF,OAAO,GAAG,IAAI,GAAG,EAOtB,CAAC;IACJ,YACU,GAAW,EACX,WAAmB;QADnB,QAAG,GAAH,GAAG,CAAQ;QACX,gBAAW,GAAX,WAAW,CAAQ;IAC1B,CAAC;IACI,UAAU,CAAC,MAAc;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE;YAC7B,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,kBAAkB;YAC5B,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QACL,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE;YACtC,SAAS,EAAE,SAAS;YACpB,KAAK,EAAE,IAAI,EAAE;YACb,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE;YAC5B,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;QACvD,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5B,qEAAqE;YACrE,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,kBAAkB;gBACpE,OAAO;YACT,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,OAAO,CACX,MAAc,EACd,SAAiB,EACjB,OAAsB,EACtB,MAAoB;QAEpB,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE;YAChE,OAAO,EAAE,SAAS,EAAE,QAAQ;SAC7B,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/B,IAAI,QAAQ,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxD,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,QAAQ,CAAC,KAAK,KAAK,mCAAmC;YACxD,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,4CAA4C,EAAE,QAAQ,CAAC,CAAC;QAC/F,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,KAAK,MAAM;YACzC,CAAC,CAAC,mDAAmD,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;QACnE,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACxD,OAAO,EAAE,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC;YACzD,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;SAC5C,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5F,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,MAAM,CAAC,KAAK,KAAK,oDAAoD;gBACvE,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,gFAAgF,CAAC,CAAC;YACpI,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,2CAA2C,EAAE,QAAQ,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,SAAS;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,KAAK,CAAC;YAC7B,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,6EAA6E,EAAE,QAAQ,CAAC,CAAC;QAChI,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAChD,MAAM,CAAC;YAAC,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,0CAA0C,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;QACrG,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACO,MAAM,CAAC,MAAW;QACxB,IAAI,MAAM,EAAE,KAAK;YACf,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClH,OAAO,MAAM,EAAE,IAAI,CAAC;IACtB,CAAC;IACO,KAAK,CAAC,GAAG,CACf,MAAc,EAAE,SAAiB,EAAE,IAAY,EAAE,OAAgC,EACjF,QAAgB,EAAE,QAAiB,EAAE,MAAoB;QAEzD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;QAClG,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;QAClF,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,KAAe,EAAE,KAAe,EAAE,EAAE;gBAClD,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACnB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;oBACpB,OAAO,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,GAAG,EAAE,CAClB,MAAM,CACJ,IAAI,UAAU,CACZ,WAAW,EACX,yBAAyB,EACzB,IAAI,IAAI,QAAQ,CACjB,CACF,CAAC;YACJ,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CACH,MAAM,CACJ,IAAI,UAAU,CACZ,SAAS,EACT,4CAA4C,EAC5C,IAAI,IAAI,QAAQ,CACjB,CACF,EACH,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CACnC,CAAC;YACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,EAAE,CAAC;gBACT,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3D,KAAK,GAAG;iBACL,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;iBACzC,IAAI,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,OAAO;oBAAE,OAAO;gBACpB,4EAA4E;gBAC5E,IAAI,GAAG,IAAI,CAAC;gBACZ,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,IAAI;oBACJ,SAAS,EAAE,EAAE;oBACb,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE;iBAC7C,CAAC,CAAC;YACL,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CACV,MAAM,CACJ,IAAI,UAAU,CACZ,kBAAkB,EAClB,8BAA8B,EAC9B,IAAI,IAAI,QAAQ,CACjB,CACF,CACF,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7E,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"relay.js","sourceRoot":"","sources":["../../src/mcp/relay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAqB,MAAM,YAAY,CAAC;AAC3D,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,aAAa,EAAsB,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAA0B,MAAM,oBAAoB,CAAC;AAE7E,0FAA0F;AAC1F,MAAM,OAAO,UAAU;IAED;IAAqB;IADjC,OAAO,GAAG,IAAI,GAAG,EAA6I,CAAC;IACvK,YAAoB,GAAW,EAAU,WAAmB;QAAxC,QAAG,GAAH,GAAG,CAAQ;QAAU,gBAAW,GAAX,WAAW,CAAQ;IAAG,CAAC;IACxD,UAAU,CAAC,MAAc;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACvH,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/H,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4E,CAAC;QACpG,GAAG,CAAC,EAAE,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE;YAC1B,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM;gBAAE,OAAO;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC,CAAC,uEAAuE,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,SAAS,EAAE,CAAC;QAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAsB,EAAE,MAAoB,EAAE,OAA2B;QACxH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,gBAAgB,MAAM,EAAE,EAC7E,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACnG,OAAO,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IACO,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,MAAsB,EAAE,QAAgB,EAAE,QAAiB,EAAE,MAAoB;QACtH,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,8CAA8C,CAAC,CAAC;QAC5G,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;QACtF,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;QAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,IAAI,GAAG,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC;YAClC,MAAM,MAAM,GAAG,CAAC,KAAkB,EAAE,KAAsB,EAAE,EAAE;gBAC5D,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACtG,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;qBAAM,IAAI,KAAK;oBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3D,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,WAAW,EAAE,mCAAmC,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC;YAChH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,SAAS,EAAE,sDAAsD,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAChL,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBAAC,MAAM,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;oBAChC,yGAAyG;oBACzG,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;wBAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBAC7N,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,kBAAkB,EAAE,4BAA4B,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/G,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBACjE,IAAI,OAAO;oBAAE,OAAO;gBACpB,IAAI,GAAG,IAAI,CAAC;gBACZ,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,kBAAkB,EAAE,wCAAwC,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACpE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/mcp/secure-client.d.ts

@@ -0,0 +1,23 @@
+import type { McpActionContext, SecureEnvelope } from '../security/protocol.js';
+import type { McpGrantIdentity } from './mcp-key-store.js';
+import { type BridgeRequest } from './fleet.js';
+export interface McpRequestContext {
+    grant: McpGrantIdentity;
+    action: McpActionContext;
+    revalidate?: () => Promise<void>;
+}
+export type SecureExchange = (envelope: SecureEnvelope, deadline: number, mutating: boolean, signal?: AbortSignal) => Promise<SecureEnvelope>;
+/** Both endpoint adapters use the same semantic allowlist. */
+export declare function isMcpMutation(request: Pick<BridgeRequest, 'method' | 'path'>): boolean;
+/** An immutable grant-bound endpoint; no state is shared across callers or grants. */
+export declare class SecureMcpClient {
+    private context;
+    private bridgeId;
+    private channel;
+    private exchange;
+    constructor(context: McpRequestContext, bridgeId: string, channel: string, exchange: SecureExchange);
+    private pin;
+    private header;
+    private send;
+    request(request: BridgeRequest, signal?: AbortSignal): Promise<unknown>;
+}

package/dist/mcp/secure-client.js

@@ -0,0 +1,124 @@
+import { randomBytes, randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { seal, open, SecurityError } from '../security/crypto.js';
+import { FleetError } from './fleet.js';
+import { classifyHttp } from '../security/bridge/permissions.js';
+/** Both endpoint adapters use the same semantic allowlist. */
+export function isMcpMutation(request) {
+    try {
+        return classifyHttp(request.method, request.path).mutating;
+    }
+    catch {
+        throw new FleetError('permission_denied', 'MCP request is outside the bridge semantic allowlist');
+    }
+}
+const responseSchema = z.object({ type: z.literal('application'), route: z.object({ kind: z.literal('response'), requestId: z.string() }).strict(), data: z.unknown(), mcp: z.unknown().nullable() }).strict();
+const welcomeSchema = z.object({ type: z.literal('welcome'), challenge: z.string(), receiverEpoch: z.string().regex(/^[A-Za-z0-9_-]{1,128}$/) }).strict();
+function json(bytes) {
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new SecurityError('invalid_envelope', 'Bridge returned an invalid encrypted response');
+    }
+}
+function applicationJson(value, depth = 0) {
+    if (depth > 32)
+        throw new FleetError('invalid_request', 'MCP request nesting exceeds the encrypted transport limit');
+    if (value === null || typeof value === 'boolean' || typeof value === 'string')
+        return value;
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (Array.isArray(value))
+        return value.map(item => applicationJson(item, depth + 1));
+    if (typeof value === 'object' && value !== null)
+        return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined).map(([key, item]) => [key, applicationJson(item, depth + 1)]));
+    throw new FleetError('invalid_request', 'MCP request must contain JSON values');
+}
+/** An immutable grant-bound endpoint; no state is shared across callers or grants. */
+export class SecureMcpClient {
+    context;
+    bridgeId;
+    channel;
+    exchange;
+    constructor(context, bridgeId, channel, exchange) {
+        this.context = context;
+        this.bridgeId = bridgeId;
+        this.channel = channel;
+        this.exchange = exchange;
+    }
+    pin() {
+        const pin = this.context.grant.bridges.find(candidate => candidate.bridgeId === this.bridgeId);
+        if (!pin || pin.endpoint.ownerId !== this.context.grant.ownerId || !pin.permissions.includes('read'))
+            throw new FleetError('approval_required', 'Bridge encryption approval is required; configure machine.id as the actual bridgeId and use label for aliases');
+        if (Date.parse(this.context.grant.activeExpiresAt) <= Date.now())
+            throw new FleetError('expired', 'Bridge encryption approval has expired');
+        return pin;
+    }
+    header(id, purpose, epoch, deadline) {
+        return {
+            type: 'ftown_encrypted', version: 1, senderId: this.context.grant.identity.endpoint.id,
+            recipientId: this.pin().endpoint.id, ownerId: this.context.grant.ownerId, bridgeId: this.bridgeId,
+            channel: this.channel, purpose, messageId: id, createdAt: Date.now(), expiresAt: Math.min(deadline, Date.now() + 120_000), receiverEpoch: epoch,
+        };
+    }
+    async send(header, value, mutating, deadline, signal) {
+        if (signal?.aborted || Date.now() >= deadline)
+            throw new FleetError('cancelled', 'Encrypted request cancelled before dispatch');
+        const packet = await seal(this.context.grant.identity, this.pin().endpoint, header, new TextEncoder().encode(JSON.stringify(value)));
+        const reply = await this.exchange(packet, deadline, mutating, signal);
+        if (reply.messageId !== header.messageId)
+            throw new FleetError('bridge_error', 'Bridge response correlation failed', mutating);
+        const expected = { ownerId: this.context.grant.ownerId, bridgeId: this.bridgeId, channel: this.channel, recipientId: this.context.grant.identity.endpoint.id, purpose: header.purpose === 'hello' ? 'welcome' : 'application' };
+        try {
+            return json(await open(this.context.grant.identity, this.pin().endpoint, reply, expected));
+        }
+        catch {
+            throw new FleetError('authentication_failed', 'Bridge encrypted response authentication failed', mutating);
+        }
+    }
+    async request(request, signal) {
+        await this.context.revalidate?.();
+        const deadline = Date.now() + request.timeoutMs;
+        const pin = this.pin();
+        const mutating = isMcpMutation(request);
+        if (mutating && (!pin.permissions.includes('control') || !this.context.grant.permissions.includes('control')))
+            throw new FleetError('permission_denied', 'This MCP grant cannot control the bridge');
+        const challenge = randomBytes(32).toString('base64url');
+        const hello = await this.send(this.header(randomUUID(), 'hello', null, deadline), { type: 'hello', challenge }, false, deadline, signal);
+        const welcome = welcomeSchema.safeParse(hello);
+        if (!welcome.success || welcome.data.challenge !== challenge)
+            throw new FleetError('authentication_failed', 'Bridge encryption handshake failed');
+        const activationId = randomUUID();
+        const activation = {
+            type: 'application', route: { kind: 'command', command: 'security_activate_mcp', requestId: activationId, sessionId: null },
+            data: { type: 'security_activate_mcp', requestId: activationId, payload: { bridgeId: this.bridgeId, grantId: this.context.grant.grantId } }, mcp: this.context.action,
+        };
+        const activated = responseSchema.safeParse(await this.send(this.header(activationId, 'application', welcome.data.receiverEpoch, deadline), activation, false, deadline, signal));
+        if (!activated.success || activated.data.route.requestId !== activationId)
+            throw new FleetError('bridge_error', 'Bridge activation response is invalid');
+        const activationResponse = z.object({ type: z.literal('command_response'), response: z.object({ requestId: z.literal(activationId), success: z.boolean(), error: z.string().optional(), data: z.unknown().optional() }) }).safeParse(activated.data.data);
+        if (!activationResponse.success || !activationResponse.data.response.success)
+            throw new FleetError('approval_required', 'Bridge MCP approval could not be activated');
+        await this.context.revalidate?.();
+        const requestId = randomUUID();
+        const application = {
+            type: 'application', route: { kind: 'http', requestId, method: request.method, path: request.path },
+            data: applicationJson({ timeoutMs: Math.max(1000, deadline - Date.now()), ...(request.body === undefined ? {} : { body: request.body }) }), mcp: this.context.action,
+        };
+        const result = responseSchema.safeParse(await this.send(this.header(requestId, 'application', welcome.data.receiverEpoch, deadline), application, mutating, deadline, signal));
+        if (!result.success || result.data.route.requestId !== requestId)
+            throw new FleetError('bridge_error', 'Bridge response is invalid', mutating);
+        const http = z.object({ status: z.number().int().min(100).max(599), body: z.unknown() }).strict().safeParse(result.data.data);
+        if (!http.success)
+            throw new FleetError('bridge_error', 'Bridge HTTP response is invalid', mutating);
+        if (http.data.status < 200 || http.data.status >= 300) {
+            const error = z.object({ code: z.string().optional(), outcomeUnknown: z.boolean().optional() }).passthrough().safeParse(http.data.body);
+            const allowed = ['unknown_session', 'invalid_cursor', 'unknown_attention', 'permission_denied', 'endpoint_revoked', 'upgrade_required', 'audit_unavailable', 'outcome_unknown'];
+            const code = error.success && error.data.code && allowed.includes(error.data.code) ? error.data.code : 'bridge_error';
+            throw new FleetError(code, 'Bridge rejected the encrypted request', mutating && (http.data.status >= 500 || (error.success && error.data.outcomeUnknown === true)), http.data.status);
+        }
+        return http.data.body;
+    }
+}
+//# sourceMappingURL=secure-client.js.map

package/dist/mcp/secure-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-client.js","sourceRoot":"","sources":["../../src/mcp/secure-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EAAE,UAAU,EAAsB,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAIjE,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAAC,OAA+C;IAC3E,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IAAC,CAAC;IACnE,MAAM,CAAC;QAAC,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,sDAAsD,CAAC,CAAC;IAAC,CAAC;AAC9G,CAAC;AACD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC/M,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1J,SAAS,IAAI,CAAC,KAAiB;IAC7B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAAC,CAAC;IACnF,MAAM,CAAC;QAAC,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,+CAA+C,CAAC,CAAC;IAAC,CAAC;AACzG,CAAC;AACD,SAAS,eAAe,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAChD,IAAI,KAAK,GAAG,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,2DAA2D,CAAC,CAAC;IACrH,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzM,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CAAC;AAClF,CAAC;AACD,sFAAsF;AACtF,MAAM,OAAO,eAAe;IACN;IAAoC;IAA0B;IAAyB;IAA3G,YAAoB,OAA0B,EAAU,QAAgB,EAAU,OAAe,EAAU,QAAwB;QAA/G,YAAO,GAAP,OAAO,CAAmB;QAAU,aAAQ,GAAR,QAAQ,CAAQ;QAAU,YAAO,GAAP,OAAO,CAAQ;QAAU,aAAQ,GAAR,QAAQ,CAAgB;IAAG,CAAC;IAC/H,GAAG;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/F,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,+GAA+G,CAAC,CAAC;QACjQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;QAC5I,OAAO,GAAG,CAAC;IACb,CAAC;IACO,MAAM,CAAC,EAAU,EAAE,OAAkC,EAAE,KAAoB,EAAE,QAAgB;QACnG,OAAO;YACL,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;YACtF,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACjG,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,aAAa,EAAE,KAAK;SAChJ,CAAC;IACJ,CAAC;IACO,KAAK,CAAC,IAAI,CAAC,MAAsB,EAAE,KAAc,EAAE,QAAiB,EAAE,QAAgB,EAAE,MAAoB;QAClH,IAAI,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,6CAA6C,CAAC,CAAC;QAChI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrI,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,oCAAoC,EAAE,QAAQ,CAAC,CAAC;QAC/H,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,aAAsB,EAAE,CAAC;QAClP,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QAAC,CAAC;QACnG,MAAM,CAAC;YAAC,MAAM,IAAI,UAAU,CAAC,uBAAuB,EAAE,iDAAiD,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;IACvH,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,OAAsB,EAAE,MAAoB;QACxD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,0CAA0C,CAAC,CAAC;QACrM,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzI,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,uBAAuB,EAAE,oCAAoC,CAAC,CAAC;QAClJ,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;QAClC,MAAM,UAAU,GAAsB;YACpC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE;YAC3H,IAAI,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;SACtK,CAAC;QACF,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACjL,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,YAAY;YAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,uCAAuC,CAAC,CAAC;QACzJ,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1P,IAAI,CAAC,kBAAkB,CAAC,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,4CAA4C,CAAC,CAAC;QACtK,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAsB;YACrC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;YACnG,IAAI,EAAE,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;SACrK,CAAC;QACF,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/K,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,4BAA4B,EAAE,QAAQ,CAAC,CAAC;QAC/I,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9H,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,iCAAiC,EAAE,QAAQ,CAAC,CAAC;QACrG,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxI,MAAM,OAAO,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;YAChL,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;YACtH,MAAM,IAAI,UAAU,CAAC,IAAI,EAAE,uCAAuC,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;CACF"}

package/dist/mcp/security-events.d.ts

@@ -0,0 +1,65 @@
+import type { Pool } from 'pg';
+import { z } from 'zod';
+import type { SecurityEvent, SecurityEventStatus, SecurityPage, SecurityPageQuery } from '../security/protocol.js';
+export declare const KNOWN_MCP_TOOLS: Set<string>;
+export declare const READ_MCP_TOOLS: Set<string>;
+declare const cursorSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    ownerId: z.ZodString;
+    bridgeId: z.ZodNullable<z.ZodString>;
+    afterAt: z.ZodString;
+    afterId: z.ZodString;
+    upperAt: z.ZodString;
+    upperId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    version: 1;
+    bridgeId: string | null;
+    ownerId: string;
+    afterAt: string;
+    afterId: string;
+    upperAt: string;
+    upperId: string;
+}, {
+    version: 1;
+    bridgeId: string | null;
+    ownerId: string;
+    afterAt: string;
+    afterId: string;
+    upperAt: string;
+    upperId: string;
+}>;
+export type SecurityQuery = (text: string, values: unknown[]) => Promise<unknown[]>;
+export interface SecurityOutcome {
+    status: Exclude<SecurityEventStatus, 'started'>;
+    errorCode: string | null;
+}
+export interface SecurityFinalizationState {
+    event: SecurityEvent;
+    finished: boolean;
+    finishing?: Promise<void>;
+}
+/** Concurrent close/send paths share one write; a failed write remains retryable. */
+export declare function finishSecurityEvent(audit: {
+    finish(event: SecurityEvent, outcome: SecurityOutcome): Promise<void>;
+} | undefined, state: SecurityFinalizationState, outcome: SecurityOutcome): Promise<void>;
+export declare function safeTool(value: unknown): string;
+export declare function safeFailureCode(value: unknown): string;
+export declare function securityOutcome(value: unknown): SecurityOutcome;
+export declare function validateSecurityEvent(value: unknown): SecurityEvent;
+export declare function encodeSecurityCursor(ownerId: string, bridgeId: string | undefined, last: SecurityEvent, first: SecurityEvent): string;
+export declare function decodeSecurityCursor(cursor: string, ownerId: string, bridgeId?: string): z.infer<typeof cursorSchema>;
+export declare function listSecurityPage(query: SecurityQuery, ownerId: string, page?: SecurityPageQuery): Promise<SecurityPage>;
+export declare class SecurityEventStore {
+    readonly pool: Pool;
+    private readonly runId;
+    private heartbeat?;
+    constructor(pool: Pool);
+    start(): Promise<void>;
+    private renew;
+    reconcile(): Promise<void>;
+    admit(input: SecurityEvent): Promise<void>;
+    finish(event: SecurityEvent, outcome: SecurityOutcome): Promise<void>;
+    list(ownerId: string, page?: SecurityPageQuery): Promise<SecurityPage>;
+    close(): Promise<void>;
+}
+export {};