gemi 0.113.0 → 0.115.0

package/dist/services/mcp/McpRegistry.d.ts

@@ -1,4 +1,7 @@
 import type { ToolContext } from "../../ai/Agent";
+import type { User } from "../../auth/types";
+import type { ProgressSink } from "../../http/modelOriginated";
+import { type SafeFetchOptions } from "../../http/safeFetch";
 import { ToolError } from "../../ai/redact";
 import { type AnySchema, type Schema } from "../../ai/Schema";
 import type { RouteSource } from "../../http/ApiRouter";
@@ -17,25 +20,103 @@ import type { ApiRouteDispatcher, DispatchCredentials } from "../router/ApiRoute
  * That producer *does* read ambient state, since a run no longer carries a
  * request (see `AgentContext`), and the boundary is what keeps that from
  * mattering here: the registry is handed a caller and dispatches as that
- * caller, so a second producer — a job, a test, v2's remote client — supplies
- * one however it likes, and a run with no ambient request is refused by
- * `toAgentTools` before the registry is reached rather than dispatching as
+ * caller, so a second producer — a job, a test, the remote transport —
+ * supplies one however it likes, and a run with no ambient request is refused
+ * by `toAgentTools` before the registry is reached rather than dispatching as
  * nobody.
  * The call is dispatched with that request's credentials, so it runs as that
  * user, through that route's middleware.
  *
- * `remote` is v2's MCP client with a bearer token. It is typed so the seam
- * exists and every entry point already takes it; each of them refuses it,
- * because a token resolver is what makes it safe and there is none yet.
- * Reading the caller from `RequestContext` instead would have been shorter,
- * and would have left v2 a registry that only works inside a gemi request.
+ * `remote` is an MCP client over HTTP (#762). `req` is its request to the MCP
+ * endpoint, and `principal` is what a caller resolver made of the credential
+ * it carried — an OAuth access token or an app API key — after verifying it.
+ * Nothing of the request's own credentials is forwarded: the call is
+ * dispatched as `principal.user`, set on the route's request context before
+ * its middleware runs, so `auth`, policies and the route's own checks decide
+ * exactly as they would for that user's direct request. See
+ * `ApiRouteDispatcher.dispatchAs`'s `identity`.
  */
 export type McpCaller = {
     kind: "local";
     req: HttpRequest<any, any>;
 } | {
     kind: "remote";
-    token: string;
+    req: HttpRequest<any, any>;
+    principal: McpRemotePrincipal;
+};
+/**
+ * A remote caller, as a resolver verified it.
+ *
+ * Built only by a resolver, from a credential it checked — never from what a
+ * client says about itself.
+ */
+export type McpRemotePrincipal = {
+    /** The user every call runs as. */
+    user: User;
+    /** Which resolver vouched for the credential: `"oauth"`, `"api-key"`, or an app's own. */
+    via: string;
+    /**
+     * A stable id for the credential: the OAuth grant, the API key. Not the
+     * secret itself. Keys the rate-limit budget the caller's tool calls spend,
+     * and is what a log line names.
+     */
+    id: string;
+    /** The scopes the credential carries. Decides which tools the caller sees. */
+    scopes: readonly string[];
+    /** The OAuth client the token was issued to, when there is one. */
+    clientId?: string;
+};
+/**
+ * One scope a remote credential can carry, as an `McpRouter` declares it: the
+ * tools it reaches, by tag and by name, and the sentence a consent screen
+ * shows for it.
+ */
+export type McpScope = {
+    /** What a user is agreeing to, in their words: "Read and edit your site's pages". */
+    description: string;
+    /** Every tool carrying one of these tags. */
+    tags?: readonly string[];
+    /** These tools, by name. */
+    names?: readonly string[];
+};
+/**
+ * The scope a router without `scopes` gets: every tool it declares. A router
+ * that wants a credential to reach only some of them declares its own.
+ */
+export declare const DEFAULT_MCP_SCOPE = "mcp";
+/** How a remote caller's file arguments are read. */
+export type McpRemoteFileOptions = {
+    /** The largest file accepted, in bytes, decoded. Default 10 MiB. */
+    maxBytes?: number;
+    /**
+     * Lets a remote caller name a file by an `https` URL, fetched through
+     * `safeFetch` — public addresses only, no credentials sent, bounded in size
+     * and time. Off by default: a URL argument makes the server fetch whatever
+     * the model was steered to name. `true` takes `safeFetch`'s defaults; an
+     * object is passed to it (`allow` a list of hosts, say), with `maxSize`
+     * capped at `maxBytes`.
+     */
+    fetchUrls?: boolean | SafeFetchOptions;
+};
+/** What `McpRegistry` takes beside the router and the dispatcher. */
+export type McpRegistryOptions = {
+    /** Remote callers' file arguments. See `McpRemoteFileOptions`. */
+    files?: McpRemoteFileOptions;
+};
+/** What `execute` takes beside the call itself. */
+export type McpExecuteOptions = {
+    /**
+     * That the user approved this call, for a tool with `requiresApproval`.
+     * The remote transport sets it after an elicitation the user accepted; a
+     * remote call to such a tool without it is refused, so a transport that
+     * forgot to ask fails closed. Local calls are approved by the agent loop
+     * before `execute` is reached, and ignore it.
+     */
+    approved?: boolean;
+    /** Aborts the dispatched route: its `req.signal`. The client went away, or cancelled. */
+    signal?: AbortSignal;
+    /** Receives the route's `req.reportProgress` reports. */
+    progress?: ProgressSink;
 };
 /**
  * One tool call, as the app's hooks see it: who is calling, the request their
@@ -43,13 +124,14 @@ export type McpCaller = {
  * agent run makes — the run's tool context.
  *
  * `req` is `caller.req`, repeated so a hook that only wants the request does
- * not have to narrow the caller. `ctx` is absent when `McpRegistry.execute` is
- * called without one (a test, a script dispatching a tool directly).
+ * not have to narrow the caller. For a remote caller it is the request to the
+ * MCP endpoint, run inside a request context whose user is
+ * `caller.principal.user`, so `req.ctx().user` names the same user for both
+ * callers. `ctx` is absent for a remote caller, and when `McpRegistry.execute`
+ * is called without one (a test, a script dispatching a tool directly).
  */
 export type McpCallContext = {
-    caller: Extract<McpCaller, {
-        kind: "local";
-    }>;
+    caller: McpCaller;
     req: HttpRequest<any, any>;
     tool: McpToolDescriptor;
     input: Record<string, unknown>;
@@ -61,18 +143,26 @@ export type McpCallContext = {
  */
 export type McpCredentials = DispatchCredentials;
 /**
- * MCP's tool annotations, from the verb. They drive confirmation prompts in
- * remote clients, which is why they are set now rather than when v2 lands:
- * every app would otherwise have to revisit its MCP file to get them.
+ * MCP's tool annotations. They drive confirmation prompts in remote clients,
+ * which is why they are set from v1 on rather than when the remote caller
+ * lands: every app would otherwise have to revisit its MCP file to get them.
  *
- * Only what the verb says is set. POST and PATCH carry nothing, and MCP's
+ * The verb sets the defaults, and only what it says: GET is read-only, DELETE
+ * destructive, PUT idempotent. POST and PATCH carry nothing, and MCP's
  * defaults for an unannotated tool — not read-only, possibly destructive — are
- * the honest answer for them.
+ * the honest answer for them. A route meta's `annotations` overrides them hint
+ * by hint (#760), `false` included.
+ *
+ * `destructiveHint` and `idempotentHint` only mean something for a tool that
+ * is not read-only, so a tool left read-only with either set is refused at
+ * boot: one of the two is a mistake, and a client would read the wrong one.
  */
 export type McpToolAnnotations = {
-    readOnlyHint?: true;
-    destructiveHint?: true;
-    idempotentHint?: true;
+    readOnlyHint?: boolean;
+    destructiveHint?: boolean;
+    idempotentHint?: boolean;
+    /** Whether the tool reaches beyond the app's own data — a third-party API, the web. */
+    openWorldHint?: boolean;
 };
 /**
  * One tool, described without committing to who consumes it.
@@ -103,7 +193,9 @@ export interface McpToolDescriptor {
      * as `outputSchema`.
      */
     readonly outputSchema?: AnySchema;
-    readonly annotations: McpToolAnnotations;
+    /** The meta's `title`: a name for a client to show. Absent when it declares none. */
+    readonly title?: string;
+    readonly annotations: Readonly<McpToolAnnotations>;
     readonly tags: readonly string[];
     readonly requiresApproval: boolean;
     /** The controller method mounted at the route, when there is one (#502). */
@@ -129,6 +221,15 @@ export declare class McpToolError extends ToolError {
     readonly status?: number;
     constructor(message: string, status?: number);
 }
+/**
+ * A remote call the transport must not run as asked: a tool the caller cannot
+ * see, or one that needs the user's approval and does not have it. Not a
+ * `ToolError` — it is the transport's to handle, not the model's to read.
+ */
+export declare class McpCallRefusedError extends Error {
+    readonly reason: "unknown-tool" | "approval-required";
+    constructor(message: string, reason: "unknown-tool" | "approval-required");
+}
 /**
  * The tools an app's `McpRouter` declares, resolved against the api route
  * table, and the one place a call to them is dispatched.
@@ -156,19 +257,44 @@ export declare class McpRegistry<R extends McpRouter<any> = McpRouter<any>> {
      */
     readonly __router?: R;
     private readonly plans;
-    constructor(router: McpRouter<any>, dispatcher: Pick<ApiRouteDispatcher, "flatRoutes" | "dispatchAs" | "getRouteHandlerAndParams">);
+    /** Each scope, resolved to the names of the tools it reaches. */
+    private readonly scopeTools;
+    private readonly files;
+    constructor(router: McpRouter<any>, dispatcher: Pick<ApiRouteDispatcher, "flatRoutes" | "dispatchAs" | "getRouteHandlerAndParams">, options?: McpRegistryOptions);
     /**
-     * The tools `caller` may see. v1 has only local callers, and every declared
-     * tool is visible to every one of them; `filter` is taken now so the shape
-     * v2's per-token visibility needs is the shape callers already use.
+     * The tools `caller` may see, narrowed by `filter`.
+     *
+     * A local caller sees every declared tool. A remote one sees the tools a
+     * scope it carries reaches, as it can call them (see `Plan.remote`): a
+     * credential that carries no scope sees nothing, and a tool no scope reaches
+     * is never listed remotely. Visibility is checked again by `execute`, so a
+     * client naming a tool it was not shown gets what it would for a tool that
+     * does not exist.
      */
     list(caller: McpCaller, filter?: McpToolFilter): McpToolDescriptor[];
     /**
      * The same listing without a caller, for a projection built once before any
-     * caller exists — `toAgentTools`. It is not per-caller visibility, and a v2
+     * caller exists — `toAgentTools`. It is not per-caller visibility, and a
      * remote listing must go through `list`.
      */
     descriptors(filter?: McpToolFilter): McpToolDescriptor[];
+    /** The largest file a remote caller may send, in bytes. */
+    get maxFileBytes(): number;
+    /**
+     * The scopes a remote credential can carry, with what each one is for —
+     * what a consent screen lists and the authorization server advertises. The
+     * router's `scopes`, or `DEFAULT_MCP_SCOPE` reaching every tool when it
+     * declares none.
+     */
+    scopes(): {
+        name: string;
+        description: string;
+    }[];
+    /**
+     * The scopes that reach the tool `name`: what a client missing all of them
+     * has to ask for. Empty for a tool no scope reaches, or none by that name.
+     */
+    scopesFor(name: string): string[];
     /**
      * Calls the tool `name` as `caller`, and answers the route's JSON.
      *
@@ -183,6 +309,12 @@ export declare class McpRegistry<R extends McpRouter<any> = McpRouter<any>> {
      * Nothing here reads an attachment any other way — the store has no
      * unscoped lookup, and this must not become one.
      *
+     * A remote caller has neither a tool context nor attachments. It is held to
+     * the tools its scopes reach, and to `requiresApproval` (see
+     * `McpExecuteOptions.approved`): either refusal is an
+     * `McpCallRefusedError`, for the transport. Its files arrive in the
+     * arguments, as base64 or — when the app allows it — an `https` URL.
+     *
      * A 2xx answers its JSON, or its text, cut at `MAX_RESULT_BODY`; a body
      * that is neither — a file a route serves — is described, not shown. A tool
      * whose meta has a `result` or an `output` answers its JSON put through
@@ -194,10 +326,39 @@ export declare class McpRegistry<R extends McpRouter<any> = McpRouter<any>> {
      * message is not something to hand a model that may be steered by whoever
      * wrote the document it is reading.
      */
-    execute(caller: McpCaller, name: string, args: unknown, ctx?: ToolContext): Promise<unknown>;
+    execute(caller: McpCaller, name: string, args: unknown, ctx?: ToolContext, options?: McpExecuteOptions): Promise<unknown>;
     private plan;
+    /**
+     * What a remote caller sends for a file field: `{ name, mimeType, data }`,
+     * or `{ name, mimeType, url }` when the app fetches URLs.
+     *
+     * Built by hand, as `combineSchemas` is, rather than with `s`: `s` writes
+     * the strict structured-output form, where an optional field is a required
+     * one that may be `null`, and an MCP client validating its arguments
+     * against that would demand `data` and `url` both. Exactly one of the two is
+     * checked when the file is read (`remoteFile`), where the refusal can say
+     * so.
+     */
+    private remoteFileSchema;
     private fillPath;
     private formData;
+    /**
+     * A remote caller's file argument, as a `File`: its base64 `data` decoded,
+     * or its `url` fetched through `safeFetch` when the app allows that. Every
+     * refusal is the model's to read and correct — a file too large, data that
+     * is not base64, a URL that is not `https` or not reachable — since it is
+     * about what the model sent, not about the server.
+     */
+    private remoteFile;
+    /** Whether a remote principal carries a scope that reaches the tool `name`. */
+    private grants;
+    /**
+     * The router's `scopes`, each resolved to tool names once, at boot. A tag or
+     * name no tool has is refused, since it is a typo that would leave a scope
+     * reaching less than its description promises; so is a scope that reaches
+     * nothing, and a name a scope token cannot be.
+     */
+    private resolveScopes;
     /**
      * A 2xx put through the meta's `result` and `output`, for a tool that has
      * either.

package/dist/services/mcp/McpRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"McpRegistry.d.ts","sourceRoot":"","sources":["../../../services/mcp/McpRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAK,KAAK,SAAS,EAAmB,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAEV,SAAS,EAKT,SAAS,EACV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAE5F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9C,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,CAAC,EAAE,WAAW,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,cAAc,CAAC,EAAE,IAAI,CAAC;CACvB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,YAAa,SAAQ,SAAS;IAGvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;gBADxB,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM;CAK3B;AAwCD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,WAAW,CAAC,CAAC,SAAS,SAAS,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC;IAc9D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAd7B,MAAM,CAAC,KAAK,SAAgB;IAE5B;;;;;OAKG;IACH,SAAiB,QAAQ,CAAC,EAAE,CAAC,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA2B;gBAG9B,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,EACtB,UAAU,EAAE,IAAI,CAC/B,kBAAkB,EAClB,YAAY,GAAG,YAAY,GAAG,0BAA0B,CACzD;IAOH;;;;OAIG;IACH,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,iBAAiB,EAAE;IAKpE;;;;OAIG;IACH,WAAW,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,iBAAiB,EAAE;IAUxD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,OAAO,CACX,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,GAAG,CAAC,EAAE,WAAW,GAChB,OAAO,CAAC,OAAO,CAAC;IAqEnB,OAAO,CAAC,IAAI;YA0JE,QAAQ;YAuCR,QAAQ;IAmCtB;;;;;;;;;;;;;;OAcG;YACW,OAAO;IAgDrB;;;;;;;;;;OAUG;YACW,IAAI;CAcnB"}
+{"version":3,"file":"McpRegistry.d.ts","sourceRoot":"","sources":["../../../services/mcp/McpRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAK,KAAK,SAAS,EAAmB,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAEV,SAAS,EAKT,SAAS,EACV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,kBAAkB,EAElB,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAAC,SAAS,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAElF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,mCAAmC;IACnC,IAAI,EAAE,IAAI,CAAC;IACX,0FAA0F;IAC1F,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,qFAAqF;IACrF,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,4BAA4B;IAC5B,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAKvC,qDAAqD;AACrD,MAAM,MAAM,oBAAoB,GAAG;IACjC,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC;CACxC,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,kEAAkE;IAClE,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,mDAAmD;AACnD,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,SAAS,CAAC;IAClB,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,CAAC,EAAE,WAAW,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,uFAAuF;IACvF,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC;IAClC,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,YAAa,SAAQ,SAAS;IAGvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;gBADxB,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM;CAK3B;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,mBAAmB;gBADrD,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,cAAc,GAAG,mBAAmB;CAKxD;AAgDD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,WAAW,CAAC,CAAC,SAAS,SAAS,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC;IAiB9D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAjB7B,MAAM,CAAC,KAAK,SAAgB;IAE5B;;;;;OAKG;IACH,SAAiB,QAAQ,CAAC,EAAE,CAAC,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA2B;IACjD,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkE;IAC7F,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuD;gBAG1D,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,EACtB,UAAU,EAAE,IAAI,CAC/B,kBAAkB,EAClB,YAAY,GAAG,YAAY,GAAG,0BAA0B,CACzD,EACD,OAAO,GAAE,kBAAuB;IASlC;;;;;;;;;OASG;IACH,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,iBAAiB,EAAE;IAWpE;;;;OAIG;IACH,WAAW,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,iBAAiB,EAAE;IAQxD,2DAA2D;IAC3D,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;;;OAKG;IACH,MAAM,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE;IAIjD;;;OAGG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAIjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACG,OAAO,CACX,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,GAAG,CAAC,EAAE,WAAW,EACjB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC;IAkHnB,OAAO,CAAC,IAAI;IAkLZ;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;YA+DV,QAAQ;YAuCR,QAAQ;IA6CtB;;;;;;OAMG;YACW,UAAU;IAgExB,+EAA+E;IAC/E,OAAO,CAAC,MAAM;IAOd;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAuCrB;;;;;;;;;;;;;;OAcG;YACW,OAAO;IAgDrB;;;;;;;;;;OAUG;YACW,IAAI;CAcnB"}

package/dist/services/mcp/http/McpHttpServer.d.ts

@@ -0,0 +1,153 @@
+import { type NonceStore } from "../../../ai/store/Nonces";
+import { type McpRegistry } from "../McpRegistry";
+import { type McpCallerResolver } from "./callers";
+/**
+ * `route.mcp.remote`: the MCP endpoint remote clients connect to (#762).
+ */
+export type McpRemoteHttpConfig = {
+    /**
+     * Off unless `true`. The endpoint is not mounted, and nothing below is
+     * read, until an app turns it on.
+     */
+    enabled?: boolean;
+    /**
+     * The endpoint's canonical URL, like `"https://example.com/mcp"`: where it
+     * is served (its path), which host it answers on, and the OAuth `resource`
+     * tokens must be issued for. `https`, or `http` on localhost. Required when
+     * `enabled`.
+     */
+    url?: string;
+    /**
+     * Who may call: tried in order, and at least one is required — the boot is
+     * refused without one, since an endpoint that resolves nobody would be
+     * either useless or, worse, open. See `McpCallerResolver`,
+     * `McpOAuthServer` and `McpApiKeyResolver`.
+     */
+    resolvers?: McpCallerResolver[];
+    /**
+     * Browser origins allowed to call the endpoint, besides its own. A request
+     * with any other `Origin` is refused with 403 — what keeps a page the user
+     * visits, or a DNS-rebound host, from talking to it. Requests without an
+     * `Origin` (every non-browser client) are not affected.
+     */
+    allowedOrigins?: readonly string[];
+    /**
+     * Each remote credential's budget at the endpoint, per `window` seconds:
+     * every JSON-RPC request counts once. Default 600 per 60 s. `false` turns
+     * it off. Tool calls also spend their routes' own `rate-limit` budgets,
+     * keyed on the credential.
+     */
+    rateLimit?: {
+        limit: number;
+        window: number;
+    } | false;
+    /** The largest request body accepted, in bytes. Default: room for one file of `files.maxBytes` as base64, plus 1 MiB. */
+    maxBodyBytes?: number;
+    /** What `initialize` and `server/discover` say about the server. */
+    server?: {
+        name?: string;
+        version?: string;
+        instructions?: string;
+    };
+    /**
+     * Where single-use approvals are spent. The default remembers them in
+     * this process, which is right for one instance; with several, use a shared
+     * store (`RedisNonceStore`), or an approval answered to one instance could
+     * be replayed to another within its ten minutes.
+     */
+    nonces?: NonceStore;
+    /** How long a legacy client waits to answer an approval prompt, in ms. Default 10 minutes. */
+    approvalTimeoutMs?: number;
+};
+/**
+ * The MCP endpoint: Streamable HTTP, for remote MCP clients (#762).
+ *
+ * One URL, POST only. It serves both eras of the protocol (see
+ * `./protocol.ts`): a modern client is served statelessly, and a legacy one
+ * through a session opened by `initialize`. Every request is authenticated —
+ * there is no unauthenticated method — by the configured resolvers, and
+ * every tool call is handed to `McpRegistry.execute` as a remote caller, so
+ * the route's middleware is the only authorization, exactly as for the
+ * user's own request.
+ *
+ * Mounted by `App.fetch` ahead of routing when `route.mcp.remote.enabled`.
+ */
+export declare class McpHttpServer {
+    private readonly registry;
+    static token: string;
+    readonly endpoint: URL;
+    private readonly resolvers;
+    private readonly context;
+    private readonly allowedOrigins;
+    private readonly rateLimit;
+    private readonly maxBodyBytes;
+    private readonly serverInfo;
+    private readonly instructions?;
+    private readonly nonces;
+    private readonly approvalTimeoutMs;
+    /** Legacy elicitations waiting for the client's answer, by the request id they were sent under. */
+    private readonly pending;
+    /** Legacy calls in flight, so `notifications/cancelled` can stop one. */
+    private readonly inflight;
+    constructor(registry: McpRegistry, config: McpRemoteHttpConfig);
+    /** The endpoint's URL as a resource identifier: no trailing slash, no query. */
+    get resource(): string;
+    /**
+     * Answers a request that is the endpoint's, or one of its resolvers' (OAuth
+     * metadata and endpoints), and `null` for anything else.
+     *
+     * Only on the configured host. The name a client used is compared, not
+     * trusted: a DNS-rebinding page reaches this server under its own host name,
+     * and is answered by the app's ordinary routes, never by this.
+     */
+    handle(req: Request): Promise<Response | null>;
+    private post;
+    private dispatch;
+    private modern;
+    private legacy;
+    private complete;
+    private initialize;
+    /**
+     * The legacy session a request names, verified and bound to the credential
+     * it was opened under. A session id is not a credential — every request is
+     * authenticated on its own — but one opened under somebody else's token is
+     * refused all the same (404, which tells the client to start over), so a
+     * session id handed to a victim cannot carry the attacker's negotiation
+     * into the victim's calls.
+     */
+    private session;
+    private checkModernHeaders;
+    private callTool;
+    private toolResult;
+    /**
+     * Asks the user whether a `requiresApproval` tool may run, and answers
+     * either that it may (`approved`) or the result to send instead.
+     *
+     * Modern clients are asked statelessly: the call is answered
+     * `input_required` with an elicitation and a signed `requestState` bound to
+     * the credential, the tool, a digest of the arguments and ten minutes; the
+     * retry carries the user's answer and the state back, and the state is
+     * spent so the same approval cannot run the call twice. Legacy clients are
+     * asked on the call's own stream and the call waits for the answer.
+     *
+     * A client that cannot ask is refused: the call does not run unapproved.
+     */
+    private approval;
+    private spendNonce;
+    /**
+     * Runs `handler` and answers its result: as one JSON response, or — when
+     * the client asked for progress, or a legacy approval has to be asked on
+     * the way — as an SSE stream that ends with it. Closing the stream cancels
+     * the call.
+     */
+    private respond;
+    private unauthorized;
+    /**
+     * Counts a credential that was refused, per client address: 30 a minute,
+     * then 429. Keys are not guessable, but every guess is a store lookup, and
+     * the budget keeps a flood of them from becoming one.
+     */
+    private failedAttempt;
+    private spend;
+}
+//# sourceMappingURL=McpHttpServer.d.ts.map

package/dist/services/mcp/http/McpHttpServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpHttpServer.d.ts","sourceRoot":"","sources":["../../../../services/mcp/http/McpHttpServer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAK7E,OAAO,EAIL,KAAK,WAAW,EAGjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAe,KAAK,iBAAiB,EAA0B,MAAM,WAAW,CAAC;AAuBxF;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAChC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IACtD,yHAAyH;IACzH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE;;;;;OAKG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,8FAA8F;IAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AA6CF;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAa;IAsBtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IArB3B,MAAM,CAAC,KAAK,SAAqB;IAEjC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAc;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4C;IACtE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoC;IAC/D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAGpB;IACJ,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;gBAG5C,QAAQ,EAAE,WAAW,EACtC,MAAM,EAAE,mBAAmB;IA+C7B,gFAAgF;IAChF,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;;;;;OAOG;IACG,MAAM,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAwCtC,IAAI;YA8DJ,QAAQ;YA8FR,MAAM;YAwBN,MAAM;IAapB,OAAO,CAAC,QAAQ;IAQhB,OAAO,CAAC,UAAU;IA6BlB;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO;IAiBf,OAAO,CAAC,kBAAkB;YAkCZ,QAAQ;IA0DtB,OAAO,CAAC,UAAU;IAIlB;;;;;;;;;;;;OAYG;YACW,QAAQ;YAyFR,UAAU;IAaxB;;;;;OAKG;YACW,OAAO;IA4CrB,OAAO,CAAC,YAAY;IAapB;;;;OAIG;YACW,aAAa;YAMb,KAAK;CAKpB"}

package/dist/services/mcp/http/callers.d.ts

@@ -0,0 +1,131 @@
+import type { User } from "../../../auth/types";
+import type { McpRegistry, McpRemotePrincipal } from "../McpRegistry";
+/**
+ * What a caller resolver is told about the server it resolves for.
+ */
+export type McpResolveContext = {
+    /**
+     * The MCP endpoint's canonical URL, from config — the OAuth `resource` and
+     * the audience a token must have been issued for. Never read off the
+     * request: a `Host` header is the client's to write.
+     */
+    resource: string;
+    /** The tools, and the scopes that reach them. */
+    registry: McpRegistry;
+};
+/**
+ * What a resolver made of a request's credential.
+ *
+ * `invalid_token` answers 401: missing, malformed, expired, revoked, or
+ * issued for another audience. The description is sent to the client in the
+ * `WWW-Authenticate` header, so it says what is wrong with the credential and
+ * never anything about the user or the store.
+ */
+export type McpResolution = {
+    ok: true;
+    principal: McpRemotePrincipal;
+} | {
+    ok: false;
+    error: "invalid_token";
+    description: string;
+};
+/**
+ * Turns the credential on a request to the MCP endpoint into a principal: the
+ * user every tool call runs as, and the scopes that decide which tools they
+ * see. The transport refuses to start without one, and the request is
+ * answered 401 unless one of them resolves it.
+ *
+ * Resolvers are asked in order. One that answers `null` does not recognise the
+ * credential (or there is none) and the next is asked; one that answers a
+ * refusal ends the request, so a token one resolver issued and revoked cannot
+ * be retried against another.
+ *
+ * A resolver builds the principal from a credential it *verified* — looked up,
+ * checked against its audience and expiry — and never from anything else the
+ * request says. The principal's user is put on every dispatched route's
+ * request context as a signed-in user would be; a resolver that believed a
+ * header would sign anybody in as anybody.
+ */
+export interface McpCallerResolver {
+    /** Recorded as `principal.via`, and `req.mcpGrant().via`. */
+    readonly name: string;
+    resolve(req: Request, context: McpResolveContext): Promise<McpResolution | null>;
+    /**
+     * The `WWW-Authenticate` value for a request no resolver claimed, so a
+     * client knows how to get a credential. The first resolver that has one is
+     * used.
+     */
+    challenge?(context: McpResolveContext, options?: {
+        scope?: string[];
+    }): string | null;
+    /**
+     * HTTP endpoints of the resolver's own — an OAuth authorization server's
+     * metadata, registration, authorize and token endpoints. Asked before the
+     * MCP endpoint, for every request to the configured origin. `null` passes.
+     */
+    handle?(req: Request, context: McpResolveContext): Promise<Response | null>;
+    /** Called once, when the transport is built: a place to refuse a bad config at boot. */
+    boot?(context: McpResolveContext): void;
+}
+/** The bearer token on a request, or `null`. Never anything from the query string. */
+export declare function bearerToken(req: Request): string | null;
+/** What `McpApiKeyResolver`'s `verify` answers for a key it knows. */
+export type McpApiKey = {
+    /** The user the key acts as. */
+    user: User;
+    /** The key's own id (a row id), never the key: it keys rate limits and logs. */
+    id: string;
+    /** The scopes the key carries; see `McpRouter.scopes`. */
+    scopes: readonly string[];
+};
+export type McpApiKeyResolverOptions = {
+    /**
+     * The prefix every key of this app starts with, like `"kyte_mcp_"`.
+     * Required: a bearer token without it is left for the next resolver (an
+     * OAuth access token), and a key is never looked up by a resolver that did
+     * not issue it. Also what makes a leaked key recognisable to a secret
+     * scanner.
+     */
+    prefix: string;
+    /**
+     * Looks the key up. Store keys hashed — `McpApiKeyResolver.hash(key)` — and
+     * look up by the hash, so a database read is not a list of working keys.
+     * Answer `null` for an unknown, expired or revoked key.
+     */
+    verify(key: string, req: Request): Promise<McpApiKey | null>;
+};
+/**
+ * Remote callers authenticated by an API key the app issued: a user creates
+ * one in the app's settings and pastes it into an MCP client as a bearer
+ * token. Simpler than OAuth, for clients configured by hand (Claude Code,
+ * scripts); a hosted client such as Claude.ai's connectors uses OAuth.
+ *
+ * ```ts
+ * remote: {
+ *   enabled: true,
+ *   url: "https://example.com/mcp",
+ *   resolvers: [
+ *     new McpApiKeyResolver({
+ *       prefix: "ex_mcp_",
+ *       verify: async (key) => {
+ *         const row = await ApiKey.findFirst({ where: { hash: McpApiKeyResolver.hash(key), revokedAt: null }, include: { user: true } });
+ *         return row && { user: row.user, id: row.publicId, scopes: row.scopes };
+ *       },
+ *     }),
+ *   ],
+ * }
+ * ```
+ */
+export declare class McpApiKeyResolver implements McpCallerResolver {
+    private readonly options;
+    readonly name = "api-key";
+    constructor(options: McpApiKeyResolverOptions);
+    /** A new key: the prefix and 32 random bytes, base64url. Show it once, store its hash. */
+    static generate(prefix: string): string;
+    /** What to store for a key and look it up by: SHA-256, hex. */
+    static hash(key: string): string;
+    /** Compares two hashes without leaking where they differ. */
+    static hashesMatch(a: string, b: string): boolean;
+    resolve(req: Request): Promise<McpResolution | null>;
+}
+//# sourceMappingURL=callers.d.ts.map

package/dist/services/mcp/http/callers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callers.d.ts","sourceRoot":"","sources":["../../../../services/mcp/http/callers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEtE;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,QAAQ,EAAE,WAAW,CAAC;CACvB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,kBAAkB,CAAA;CAAE,GAC3C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACjF;;;;OAIG;IACH,SAAS,CAAC,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,MAAM,GAAG,IAAI,CAAC;IACtF;;;;OAIG;IACH,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC5E,wFAAwF;IACxF,IAAI,CAAC,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACzC;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAKvD;AAED,sEAAsE;AACtE,MAAM,MAAM,SAAS,GAAG;IACtB,gCAAgC;IAChC,IAAI,EAAE,IAAI,CAAC;IACX,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAC;IACX,0DAA0D;IAC1D,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,iBAAkB,YAAW,iBAAiB;IAG7C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,QAAQ,CAAC,IAAI,aAAa;gBAEG,OAAO,EAAE,wBAAwB;IAW9D,0FAA0F;IAC1F,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAIvC,+DAA+D;IAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAIhC,6DAA6D;IAC7D,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO;IAM3C,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAiB3D"}

package/dist/services/mcp/http/limits.d.ts

@@ -0,0 +1,11 @@
+export type Budget = {
+    limit: number;
+    window: number;
+};
+/**
+ * Spends one unit of `key`'s budget with the app's `RateLimiter`. Answers
+ * `null` when it fits, or the seconds to wait when it does not. No limiter
+ * bound (a kernel without the provider) means no limit.
+ */
+export declare function overBudget(key: string, budget: Budget): Promise<number | null>;
+//# sourceMappingURL=limits.d.ts.map

package/dist/services/mcp/http/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../../../services/mcp/http/limits.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKpF"}