git-doc-mcp 0.1.0

package/dist/secrets/manager.js

@@ -0,0 +1,94 @@
+/**
+ * Secret approval and scoping manager.
+ * @module secrets/manager
+ */
+import { normalizeScopes, validateUrlScope } from './patterns.js';
+/**
+ * Secrets manager handles secret approval and scoped access.
+ */
+export class SecretsManager {
+    approvedSecrets = new Map();
+    /**
+     * Approve a secret with its value and scope patterns.
+     */
+    approve(secret, value) {
+        this.approvedSecrets.set(secret.name, {
+            name: secret.name,
+            value,
+            scopes: normalizeScopes(secret.scope),
+        });
+    }
+    /**
+     * Check if a secret is approved.
+     */
+    isApproved(name) {
+        return this.approvedSecrets.has(name);
+    }
+    /**
+     * Get a secret value if approved and URL is in scope.
+     * @returns The secret value, or undefined if not approved or out of scope
+     */
+    getSecret(name, url) {
+        const secret = this.approvedSecrets.get(name);
+        if (!secret) {
+            return undefined;
+        }
+        // If URL provided, validate scope
+        if (url) {
+            try {
+                validateUrlScope(url, secret.scopes);
+            }
+            catch {
+                return undefined;
+            }
+        }
+        return secret.value;
+    }
+    /**
+     * Get all approved secrets for a specific URL.
+     * Only returns secrets whose scopes include the URL.
+     */
+    getSecretsForUrl(url) {
+        const result = {};
+        for (const [name, secret] of this.approvedSecrets) {
+            try {
+                validateUrlScope(url, secret.scopes);
+                result[name] = secret.value;
+            }
+            catch {
+                // Secret not in scope for this URL
+            }
+        }
+        return result;
+    }
+    /**
+     * Get all approved secrets (without scope validation).
+     * Use with caution - for passing to worker process only.
+     */
+    getAllSecrets() {
+        const result = {};
+        for (const [name, secret] of this.approvedSecrets) {
+            result[name] = secret.value;
+        }
+        return result;
+    }
+    /**
+     * Get scope patterns for a secret.
+     */
+    getScopes(name) {
+        return this.approvedSecrets.get(name)?.scopes;
+    }
+    /**
+     * Clear all approved secrets.
+     */
+    clear() {
+        this.approvedSecrets.clear();
+    }
+    /**
+     * List all approved secret names.
+     */
+    listApproved() {
+        return Array.from(this.approvedSecrets.keys());
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/secrets/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/secrets/manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAWlE;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,eAAe,GAAgC,IAAI,GAAG,EAAE,CAAC;IAEjE;;OAEG;IACH,OAAO,CAAC,MAAc,EAAE,KAAa;QACnC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;YACpC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK;YACL,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,IAAY;QACrB,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,IAAY,EAAE,GAAY;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,kCAAkC;QAClC,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,GAAW;QAC1B,MAAM,MAAM,GAA2B,EAAE,CAAC;QAE1C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,aAAa;QACX,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;CACF"}

package/dist/secrets/patterns.d.ts

@@ -0,0 +1,33 @@
+/**
+ * URL pattern matching for secret scopes.
+ * @module secrets/patterns
+ */
+/**
+ * Check if a URL matches a scope pattern.
+ *
+ * Pattern syntax:
+ * - `https://api.github.com/*` matches all paths under api.github.com
+ * - `https://api.github.com/repos/*` matches only /repos/* paths
+ * - `https://raw.githubusercontent.com` matches exact origin only
+ *
+ * Matching rules:
+ * - Pattern must match the FULL URL (origin + path)
+ * - `*` in path matches any path segment(s), including nested paths
+ * - No subdomain matching: `https://api.github.com/*` does NOT match `https://api.github.com.evil.com/`
+ * - Query strings and fragments are stripped before matching
+ */
+export declare function matchScopePattern(url: string, pattern: string): boolean;
+/**
+ * Check if a URL matches any of the scope patterns.
+ */
+export declare function matchAnyScopePattern(url: string, patterns: string[]): boolean;
+/**
+ * Validate that a URL is within the allowed scopes.
+ * @throws Error if URL doesn't match any scope
+ */
+export declare function validateUrlScope(url: string, patterns: string[]): void;
+/**
+ * Normalize scope patterns to an array.
+ */
+export declare function normalizeScopes(scopes: string | string[]): string[];
+//# sourceMappingURL=patterns.d.ts.map

package/dist/secrets/patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/secrets/patterns.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAkCvE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAE7E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAMtE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAEnE"}

package/dist/secrets/patterns.js

@@ -0,0 +1,71 @@
+/**
+ * URL pattern matching for secret scopes.
+ * @module secrets/patterns
+ */
+/**
+ * Check if a URL matches a scope pattern.
+ *
+ * Pattern syntax:
+ * - `https://api.github.com/*` matches all paths under api.github.com
+ * - `https://api.github.com/repos/*` matches only /repos/* paths
+ * - `https://raw.githubusercontent.com` matches exact origin only
+ *
+ * Matching rules:
+ * - Pattern must match the FULL URL (origin + path)
+ * - `*` in path matches any path segment(s), including nested paths
+ * - No subdomain matching: `https://api.github.com/*` does NOT match `https://api.github.com.evil.com/`
+ * - Query strings and fragments are stripped before matching
+ */
+export function matchScopePattern(url, pattern) {
+    try {
+        const urlObj = new URL(url);
+        // Strip query and fragment
+        urlObj.search = '';
+        urlObj.hash = '';
+        // Handle wildcard pattern
+        if (pattern.endsWith('/*')) {
+            const basePattern = pattern.slice(0, -2);
+            const patternObj = new URL(basePattern);
+            // Exact origin match required
+            if (urlObj.origin !== patternObj.origin) {
+                return false;
+            }
+            // Path must be exactly the base path or start with base path + '/'
+            // This prevents /repos-private matching a /repos/* scope
+            const basePath = patternObj.pathname;
+            if (basePath === '/') {
+                // Root wildcard (/*): matches any path on this origin
+                return true;
+            }
+            return urlObj.pathname === basePath || urlObj.pathname.startsWith(basePath + '/');
+        }
+        // Exact match (no wildcard)
+        const patternObj = new URL(pattern);
+        return urlObj.origin === patternObj.origin && urlObj.pathname === patternObj.pathname;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Check if a URL matches any of the scope patterns.
+ */
+export function matchAnyScopePattern(url, patterns) {
+    return patterns.some((pattern) => matchScopePattern(url, pattern));
+}
+/**
+ * Validate that a URL is within the allowed scopes.
+ * @throws Error if URL doesn't match any scope
+ */
+export function validateUrlScope(url, patterns) {
+    if (!matchAnyScopePattern(url, patterns)) {
+        throw new Error(`URL "${url}" is not within allowed scopes: ${patterns.join(', ')}`);
+    }
+}
+/**
+ * Normalize scope patterns to an array.
+ */
+export function normalizeScopes(scopes) {
+    return Array.isArray(scopes) ? scopes : [scopes];
+}
+//# sourceMappingURL=patterns.js.map

package/dist/secrets/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../src/secrets/patterns.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,OAAe;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5B,2BAA2B;QAC3B,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QAEjB,0BAA0B;QAC1B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YAExC,8BAA8B;YAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBACxC,OAAO,KAAK,CAAC;YACf,CAAC;YAED,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;YACrC,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACrB,sDAAsD;gBACtD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;QACpF,CAAC;QAED,4BAA4B;QAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,QAAkB;IAClE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,QAAkB;IAC9D,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,mCAAmC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB;IACvD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC"}

package/dist/server/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Server module - MCP server setup.
+ * @module server
+ */
+export * from './mcp.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,UAAU,CAAC"}

package/dist/server/index.js

@@ -0,0 +1,6 @@
+/**
+ * Server module - MCP server setup.
+ * @module server
+ */
+export * from './mcp.js';
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,UAAU,CAAC"}

package/dist/server/mcp.d.ts

@@ -0,0 +1,60 @@
+/**
+ * MCP server setup using @modelcontextprotocol/sdk.
+ * @module server/mcp
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { Manifest } from '../manifest/schema.js';
+/**
+ * Result from a prompt get handler, matching MCP GetPromptResult shape.
+ *
+ * For resource content, `resource.text` is required per MCP TextResourceContents.
+ * Use empty string if the resource text is not available at prompt resolution time.
+ */
+export interface PromptResult {
+    description?: string;
+    messages: Array<{
+        role: 'user' | 'assistant';
+        content: {
+            type: 'text';
+            text: string;
+        } | {
+            type: 'resource';
+            resource: {
+                uri: string;
+                text: string;
+                mimeType?: string;
+            };
+        };
+    }>;
+}
+/**
+ * MCP server options.
+ */
+export interface McpServerOptions {
+    manifest: Manifest;
+    /** Tool execution handler */
+    onToolCall: (name: string, input: unknown) => Promise<unknown>;
+    /** Resource read handler */
+    onResourceRead?: (uri: string) => Promise<string>;
+    /** Prompt get handler - returns structured messages matching MCP PromptMessage[] */
+    onPromptGet?: (name: string, args: Record<string, string>) => Promise<PromptResult>;
+}
+/**
+ * Create and configure MCP server from manifest.
+ */
+export declare function createMcpServer(options: McpServerOptions): McpServer;
+/**
+ * Convert JSON Schema to Zod schema.
+ * This is a simplified implementation for basic types.
+ */
+export declare function jsonSchemaToZod(schema: {
+    type: string;
+    properties?: Record<string, unknown>;
+    required?: string[];
+}): z.ZodObject<Record<string, z.ZodType>>;
+/**
+ * Start the MCP server with stdio transport.
+ */
+export declare function startMcpServer(server: McpServer): Promise<void>;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/server/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/server/mcp.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAA0B,MAAM,uBAAuB,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;QAC3B,OAAO,EACH;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,GAC9B;YAAE,IAAI,EAAE,UAAU,CAAC;YAAC,QAAQ,EAAE;gBAAE,GAAG,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAC;KACtF,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,4BAA4B;IAC5B,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,oFAAoF;IACpF,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CACrF;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAsCpE;AA8HD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CA4C3J;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrE"}

package/dist/server/mcp.js

@@ -0,0 +1,173 @@
+/**
+ * MCP server setup using @modelcontextprotocol/sdk.
+ * @module server/mcp
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { z } from 'zod';
+/**
+ * Create and configure MCP server from manifest.
+ */
+export function createMcpServer(options) {
+    const { manifest, onToolCall, onResourceRead, onPromptGet } = options;
+    // Build server options
+    const serverOptions = {
+        capabilities: {
+            tools: {},
+            resources: {},
+            prompts: {},
+        },
+        ...(manifest.instructions ? { instructions: manifest.instructions } : {}),
+    };
+    // Create server instance
+    const server = new McpServer({
+        name: manifest.name,
+        version: manifest.version,
+    }, serverOptions);
+    // Register tools
+    for (const tool of manifest.tools ?? []) {
+        registerTool(server, tool, onToolCall);
+    }
+    // Register resources
+    for (const resource of manifest.resources ?? []) {
+        registerResource(server, resource, onResourceRead);
+    }
+    // Register prompts
+    for (const prompt of manifest.prompts ?? []) {
+        registerPrompt(server, prompt, onPromptGet);
+    }
+    return server;
+}
+/**
+ * Register a tool with the MCP server.
+ */
+function registerTool(server, tool, onToolCall) {
+    // Convert JSON Schema to Zod schema
+    const zodSchema = jsonSchemaToZod(tool.inputSchema);
+    // Build tool options
+    const toolOptions = {
+        description: tool.description,
+        inputSchema: zodSchema,
+    };
+    if (tool.title) {
+        toolOptions.title = tool.title;
+    }
+    if (tool.annotations) {
+        toolOptions.annotations = tool.annotations;
+    }
+    server.registerTool(tool.name, toolOptions, async (input) => {
+        const result = await onToolCall(tool.name, input);
+        return result;
+    });
+}
+/**
+ * Register a resource with the MCP server.
+ */
+function registerResource(server, resource, onResourceRead) {
+    if (!onResourceRead)
+        return;
+    const resourceOptions = {};
+    if (resource.description) {
+        resourceOptions.description = resource.description;
+    }
+    if (resource.mimeType) {
+        resourceOptions.mimeType = resource.mimeType;
+    }
+    server.registerResource(resource.name, resource.uri, resourceOptions, async (uri) => {
+        const content = await onResourceRead(uri.href);
+        const contents = {
+            uri: uri.href,
+            text: content,
+        };
+        if (resource.mimeType) {
+            contents.mimeType = resource.mimeType;
+        }
+        return {
+            contents: [contents],
+        };
+    });
+}
+/**
+ * Register a prompt with the MCP server.
+ */
+function registerPrompt(server, prompt, onPromptGet) {
+    if (!onPromptGet)
+        return;
+    // Build Zod schema from prompt args
+    const argsSchemaRecord = {};
+    for (const arg of prompt.args ?? []) {
+        let schema = z.string();
+        if (arg.description) {
+            schema = schema.describe(arg.description);
+        }
+        if (!arg.required) {
+            schema = schema.optional();
+        }
+        argsSchemaRecord[arg.name] = schema;
+    }
+    server.registerPrompt(prompt.name, {
+        description: prompt.description,
+        ...(prompt.title ? { title: prompt.title } : {}),
+        ...(Object.keys(argsSchemaRecord).length > 0 ? { argsSchema: argsSchemaRecord } : {}),
+    }, async (args) => {
+        const result = await onPromptGet(prompt.name, args);
+        return {
+            ...(result.description ? { description: result.description } : {}),
+            messages: result.messages.map((msg) => ({
+                role: msg.role,
+                content: msg.content,
+            })),
+        };
+    });
+}
+/**
+ * Convert JSON Schema to Zod schema.
+ * This is a simplified implementation for basic types.
+ */
+export function jsonSchemaToZod(schema) {
+    const shape = {};
+    if (schema.type === 'object' && schema.properties) {
+        for (const [key, prop] of Object.entries(schema.properties)) {
+            const propSchema = prop;
+            let zodType;
+            switch (propSchema.type) {
+                case 'string':
+                    zodType = z.string();
+                    break;
+                case 'number':
+                case 'integer':
+                    zodType = z.number();
+                    break;
+                case 'boolean':
+                    zodType = z.boolean();
+                    break;
+                case 'array':
+                    zodType = z.array(z.unknown());
+                    break;
+                case 'object':
+                    zodType = z.record(z.unknown());
+                    break;
+                default:
+                    zodType = z.unknown();
+            }
+            if (propSchema.description) {
+                zodType = zodType.describe(propSchema.description);
+            }
+            // Check if required
+            const isRequired = schema.required?.includes(key);
+            if (!isRequired) {
+                zodType = zodType.optional();
+            }
+            shape[key] = zodType;
+        }
+    }
+    return z.object(shape);
+}
+/**
+ * Start the MCP server with stdio transport.
+ */
+export async function startMcpServer(server) {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+//# sourceMappingURL=mcp.js.map

package/dist/server/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/server/mcp.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgCxB;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAEtE,uBAAuB;IACvB,MAAM,aAAa,GAAG;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;SACZ;QACD,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;IAEF,yBAAyB;IACzB,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;QACE,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,EACD,aAAa,CACd,CAAC;IAEF,iBAAiB;IACjB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACxC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACzC,CAAC;IAED,qBAAqB;IACrB,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QAChD,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IACrD,CAAC;IAED,mBAAmB;IACnB,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC5C,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CACnB,MAAiB,EACjB,IAAU,EACV,UAA8D;IAE9D,oCAAoC;IACpC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEpD,qBAAqB;IACrB,MAAM,WAAW,GAKb;QACF,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,SAAS;KACvB,CAAC;IAEF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACjC,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,WAAW,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAC7C,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT,WAAW,EACX,KAAK,EAAE,KAAK,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,MAA4D,CAAC;IACtE,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CACvB,MAAiB,EACjB,QAAkB,EAClB,cAAiD;IAEjD,IAAI,CAAC,cAAc;QAAE,OAAO;IAE5B,MAAM,eAAe,GAGjB,EAAE,CAAC;IAEP,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,eAAe,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,eAAe,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC/C,CAAC;IAED,MAAM,CAAC,gBAAgB,CACrB,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,GAAG,EACZ,eAAe,EACf,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAqD;YACjE,GAAG,EAAE,GAAG,CAAC,IAAI;YACb,IAAI,EAAE,OAAO;SACd,CAAC;QACF,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACxC,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CACrB,MAAiB,EACjB,MAAc,EACd,WAAmF;IAEnF,IAAI,CAAC,WAAW;QAAE,OAAO;IAEzB,oCAAoC;IACpC,MAAM,gBAAgB,GAA8B,EAAE,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,MAAM,GAAc,CAAC,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,cAAc,CACnB,MAAM,CAAC,IAAI,EACX;QACE,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,IAA8B,CAAC,CAAC;QAC9E,OAAO;YACL,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACtC,IAAI,EAAE,GAAG,CAAC,IAA4B;gBACtC,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmF;IACjH,MAAM,KAAK,GAA8B,EAAE,CAAC;IAE5C,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5D,MAAM,UAAU,GAAG,IAA8C,CAAC;YAClE,IAAI,OAAkB,CAAC;YAEvB,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;gBACxB,KAAK,QAAQ;oBACX,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;oBACrB,MAAM;gBACR,KAAK,QAAQ,CAAC;gBACd,KAAK,SAAS;oBACZ,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;oBACrB,MAAM;gBACR,KAAK,SAAS;oBACZ,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;oBACtB,MAAM;gBACR,KAAK,OAAO;oBACV,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC/B,MAAM;gBACR,KAAK,QAAQ;oBACX,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;oBAChC,MAAM;gBACR;oBACE,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;YAED,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;gBAC3B,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACrD,CAAC;YAED,oBAAoB;YACpB,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC/B,CAAC;YAED,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAiB;IACpD,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/worker/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Worker module - process management and IPC protocol.
+ * @module worker
+ */
+export * from './process.js';
+export * from './protocol.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/worker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/worker/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}

package/dist/worker/index.js

@@ -0,0 +1,7 @@
+/**
+ * Worker module - process management and IPC protocol.
+ * @module worker
+ */
+export * from './process.js';
+export * from './protocol.js';
+//# sourceMappingURL=index.js.map

package/dist/worker/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/worker/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}

package/dist/worker/process.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Worker process manager.
+ * @module worker/process
+ */
+import { WorkerRequest, WorkerResponse } from './protocol.js';
+import type { AuditLogger } from '../audit/logger.js';
+/**
+ * Worker process options.
+ */
+export interface WorkerOptions {
+    /** Worker process timeout in ms (default: 60000) */
+    timeout?: number;
+    /** Maximum restart attempts (default: 2) */
+    maxRestarts?: number;
+    /** Logger function */
+    logger?: (level: string, message: string) => void;
+    /** Optional audit logger for forwarding worker audit events */
+    auditLogger?: AuditLogger;
+}
+/**
+ * Worker process manager.
+ * Handles spawning, communication, and lifecycle of worker processes.
+ */
+export declare class WorkerManager {
+    private worker;
+    private isHealthy;
+    private pendingRequests;
+    private buffer;
+    private options;
+    constructor(options?: WorkerOptions);
+    /**
+   * Spawn a new worker process.
+     */
+    private spawnWorker;
+    /**
+     * Handle stdout data from worker.
+     */
+    private handleStdout;
+    /**
+     * Handle a response from the worker.
+     */
+    private handleResponse;
+    /**
+     * Send a request to the worker.
+     */
+    private sendRequest;
+    /**
+     * Kill the worker process.
+     */
+    private killWorker;
+    /**
+     * Ping the worker to check if it's alive.
+     */
+    private pingWorker;
+    /**
+     * Execute an action in the worker.
+     */
+    executeAction(request: WorkerRequest): Promise<WorkerResponse>;
+    /**
+     * Shutdown the worker.
+     */
+    shutdown(): Promise<void>;
+}
+//# sourceMappingURL=process.d.ts.map

package/dist/worker/process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/worker/process.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAClD,+DAA+D;IAC/D,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAoBD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAA0C;IACxD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,eAAe,CAA0C;IACjE,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,OAAO,CAA+E;gBAElF,OAAO,GAAE,aAAkB;IAKvC;;OAEG;YACW,WAAW;IAwDzB;;OAEG;IACH,OAAO,CAAC,YAAY;IAcpB;;OAEG;IACH,OAAO,CAAC,cAAc;IAuBtB;;OAEG;IACH,OAAO,CAAC,WAAW;IAyBnB;;OAEG;IACH,OAAO,CAAC,UAAU;IAQlB;;OAEG;YACW,UAAU;IAYxB;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IA2BpE;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAkBhC"}