hoi4-agent-tools 0.0.0-bootstrap.1 → 0.1.2

package/dist/hoi4_agent_tools/mcp/security/auth.js

@@ -0,0 +1,234 @@
+import { compareCodeUnits } from '../../core/canonical.js';
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { ServiceError } from '../../core/result.js';
+export class HttpAuthError extends ServiceError {
+    status;
+    bearerError;
+    requiredScopes;
+    constructor(status, code, message, bearerError, requiredScopes) {
+        super(code, message);
+        this.status = status;
+        this.bearerError = bearerError;
+        this.requiredScopes = requiredScopes;
+    }
+}
+const jwks = new Map();
+const scopeTokenPattern = /^[\x21\x23-\x5B\x5D-\x7E]+$/u;
+function normalizedScopes(scopes) {
+    const normalized = [...new Set(scopes)];
+    if (normalized.some((scope) => !scopeTokenPattern.test(scope))) {
+        throw new ServiceError('HTTP_SCOPE_INVALID', 'OAuth scopes must use the RFC 6750 scope syntax');
+    }
+    return normalized;
+}
+function bearer(header, requiredScopes) {
+    if (header === undefined || !/^Bearer\s+/iu.test(header)) {
+        throw new HttpAuthError(401, 'AUTH_REQUIRED', 'A bearer token is required', undefined, requiredScopes);
+    }
+    const token = header.replace(/^Bearer\s+/iu, '').trim();
+    if (token.length === 0 || token.length > 16_384) {
+        throw new HttpAuthError(401, 'AUTH_INVALID', 'Bearer token is invalid', 'invalid_token', requiredScopes);
+    }
+    return token;
+}
+function equalSecret(left, right) {
+    const leftBytes = Buffer.from(left, 'utf8');
+    const rightBytes = Buffer.from(right, 'utf8');
+    return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+function credentialId(token) {
+    return `sha256:${createHash('sha256').update(token, 'utf8').digest('hex')}`;
+}
+function tokenScopes(payload) {
+    const scope = payload.scope;
+    const scp = payload.scp;
+    if (typeof scope === 'string')
+        return normalizedScopes(scope.split(/\s+/u).filter(Boolean));
+    if (Array.isArray(scp) && scp.every((value) => typeof value === 'string')) {
+        return normalizedScopes(scp);
+    }
+    return [];
+}
+function requireScopes(actual, required) {
+    const normalizedRequired = normalizedScopes(required);
+    const missing = normalizedRequired.filter((scope) => !actual.includes(scope));
+    if (missing.length === 0)
+        return;
+    throw new HttpAuthError(403, 'AUTH_SCOPE_INSUFFICIENT', 'Bearer token lacks a required scope', 'insufficient_scope', normalizedRequired);
+}
+function defaultRequiredScopes(configuration) {
+    return normalizedScopes(configuration.http.oauth?.requiredScopes ?? ['hoi4:read']);
+}
+function validateStaticTokenSecrets(configuration) {
+    const fingerprints = new Set();
+    for (const configured of configuration.http.tokens) {
+        const secret = process.env[configured.tokenEnv];
+        if (secret === undefined || secret.length < 32) {
+            throw new ServiceError('HTTP_STATIC_TOKEN_INVALID', 'Every configured static-token environment variable must contain at least 32 characters');
+        }
+        const fingerprint = createHash('sha256').update(secret, 'utf8').digest('hex');
+        if (fingerprints.has(fingerprint)) {
+            throw new ServiceError('HTTP_STATIC_TOKEN_DUPLICATE', 'Configured static bearer tokens must have distinct secret values');
+        }
+        fingerprints.add(fingerprint);
+    }
+}
+export async function authenticate(authorization, configuration, requiredScopes = defaultRequiredScopes(configuration)) {
+    const normalizedRequiredScopes = normalizedScopes(requiredScopes);
+    const token = bearer(authorization, normalizedRequiredScopes);
+    const presentedCredentialId = credentialId(token);
+    const oauth = configuration.http.oauth;
+    if (oauth !== undefined) {
+        let remote = jwks.get(oauth.jwksUri);
+        if (remote === undefined) {
+            remote = createRemoteJWKSet(new URL(oauth.jwksUri), {
+                timeoutDuration: 5_000,
+                cooldownDuration: 30_000,
+            });
+            jwks.set(oauth.jwksUri, remote);
+        }
+        try {
+            const { payload } = await jwtVerify(token, remote, {
+                issuer: oauth.issuer,
+                audience: oauth.audience,
+                algorithms: oauth.algorithms,
+                clockTolerance: 5,
+            });
+            if (typeof payload.sub !== 'string' || payload.sub.length === 0) {
+                throw new Error('Token subject is missing');
+            }
+            if (typeof payload.exp !== 'number' || !Number.isFinite(payload.exp)) {
+                throw new Error('Token expiration is missing');
+            }
+            if (payload.exp * 1000 <= Date.now()) {
+                throw new Error('Token has expired');
+            }
+            if (!configuration.http.principals.some(({ principal }) => principal === payload.sub)) {
+                throw new HttpAuthError(403, 'AUTH_PRINCIPAL_FORBIDDEN', 'Bearer-token subject is not an allowlisted principal', undefined, normalizedRequiredScopes);
+            }
+            const scopes = tokenScopes(payload);
+            requireScopes(scopes, normalizedRequiredScopes);
+            return {
+                principal: payload.sub,
+                clientId: typeof payload.client_id === 'string'
+                    ? payload.client_id
+                    : typeof payload.azp === 'string'
+                        ? payload.azp
+                        : presentedCredentialId,
+                credentialId: presentedCredentialId,
+                scopes,
+                expiresAt: payload.exp,
+            };
+        }
+        catch (error) {
+            if (error instanceof HttpAuthError)
+                throw error;
+            throw new HttpAuthError(401, 'AUTH_INVALID', 'Bearer token verification failed', 'invalid_token', normalizedRequiredScopes);
+        }
+    }
+    for (const configured of configuration.http.tokens) {
+        const secret = process.env[configured.tokenEnv];
+        if (secret === undefined || secret.length < 32)
+            continue;
+        if (equalSecret(token, secret)) {
+            const principal = {
+                principal: configured.principal,
+                clientId: configured.principal,
+                credentialId: presentedCredentialId,
+                scopes: [
+                    'hoi4:read',
+                    ...(configuration.writePolicy === 'transactions' ? ['hoi4:write'] : []),
+                ],
+            };
+            requireScopes(principal.scopes, normalizedRequiredScopes);
+            return principal;
+        }
+    }
+    throw new HttpAuthError(401, 'AUTH_INVALID', 'Bearer token verification failed', 'invalid_token', normalizedRequiredScopes);
+}
+export function protectedResourceMetadataUrl(configuration) {
+    if (configuration.http.oauth === undefined || configuration.http.publicUrl === undefined) {
+        return undefined;
+    }
+    return new URL('/.well-known/oauth-protected-resource/mcp', configuration.http.publicUrl).href;
+}
+export function bearerChallenge(configuration, error) {
+    const parameters = [];
+    if (error.bearerError !== undefined)
+        parameters.push(`error="${error.bearerError}"`);
+    const scopes = normalizedScopes(error.requiredScopes);
+    if (scopes.length > 0)
+        parameters.push(`scope="${scopes.join(' ')}"`);
+    const resourceMetadata = protectedResourceMetadataUrl(configuration);
+    if (resourceMetadata !== undefined) {
+        parameters.push(`resource_metadata="${resourceMetadata}"`);
+    }
+    return `Bearer${parameters.length === 0 ? '' : ` ${parameters.join(', ')}`}`;
+}
+export function isLoopbackHost(host) {
+    const normalized = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+    return normalized === '127.0.0.1' || normalized === 'localhost' || normalized === '::1';
+}
+export function validateHttpDeployment(configuration) {
+    const http = configuration.http;
+    void defaultRequiredScopes(configuration);
+    if (http.oauth === undefined && http.tokens.length === 0) {
+        throw new ServiceError('HTTP_AUTH_NOT_CONFIGURED', 'Streamable HTTP requires authentication');
+    }
+    const publicUrl = http.publicUrl === undefined ? undefined : new URL(http.publicUrl);
+    if (http.oauth !== undefined && publicUrl === undefined) {
+        throw new ServiceError('HTTP_OAUTH_PUBLIC_URL_REQUIRED', 'OAuth Streamable HTTP requires a canonical publicUrl for Protected Resource Metadata');
+    }
+    if (publicUrl !== undefined &&
+        (!['http:', 'https:'].includes(publicUrl.protocol) ||
+            !['/', '/mcp'].includes(publicUrl.pathname) ||
+            publicUrl.username.length > 0 ||
+            publicUrl.password.length > 0 ||
+            publicUrl.search.length > 0 ||
+            publicUrl.hash.length > 0)) {
+        throw new ServiceError('HTTP_PUBLIC_URL_INVALID', 'Streamable HTTP publicUrl must be an HTTP(S) origin or exact /mcp endpoint without credentials, a query, or a fragment');
+    }
+    const publiclyExposed = !isLoopbackHost(http.host) || (publicUrl !== undefined && !isLoopbackHost(publicUrl.hostname));
+    if (!publiclyExposed) {
+        if (http.oauth !== undefined && http.principals.length === 0) {
+            throw new ServiceError('HTTP_PRINCIPAL_ALLOWLIST_REQUIRED', 'OAuth Streamable HTTP requires an explicit principal allowlist');
+        }
+        validateStaticTokenSecrets(configuration);
+        return;
+    }
+    if (http.oauth === undefined) {
+        throw new ServiceError('HTTP_PUBLIC_OAUTH_REQUIRED', 'Non-loopback HTTP requires OAuth/OIDC JWT verification; static tokens are loopback-only');
+    }
+    if (publicUrl?.protocol !== 'https:') {
+        throw new ServiceError('HTTP_PUBLIC_HTTPS_REQUIRED', 'Non-loopback HTTP requires an HTTPS publicUrl');
+    }
+    const authorizationUrls = [
+        http.oauth.issuer,
+        http.oauth.jwksUri,
+        ...http.oauth.authorizationServers,
+    ];
+    if (authorizationUrls.some((url) => new URL(url).protocol !== 'https:')) {
+        throw new ServiceError('HTTP_PUBLIC_OAUTH_HTTPS_REQUIRED', 'Non-loopback OAuth issuer, JWKS, and authorization server URLs must use HTTPS');
+    }
+    if (http.allowedOrigins.length === 0) {
+        throw new ServiceError('HTTP_ORIGIN_ALLOWLIST_REQUIRED', 'Non-loopback HTTP requires allowed origins');
+    }
+    if (http.principals.length === 0) {
+        throw new ServiceError('HTTP_PRINCIPAL_ALLOWLIST_REQUIRED', 'OAuth Streamable HTTP requires an explicit principal allowlist');
+    }
+}
+export function protectedResourceMetadata(configuration) {
+    const oauth = configuration.http.oauth;
+    if (oauth === undefined || configuration.http.publicUrl === undefined) {
+        throw new ServiceError('HTTP_OAUTH_NOT_CONFIGURED', 'OAuth metadata is not configured');
+    }
+    return {
+        resource: new URL('/mcp', configuration.http.publicUrl).href,
+        authorization_servers: oauth.authorizationServers,
+        bearer_methods_supported: ['header'],
+        scopes_supported: [...new Set([...oauth.requiredScopes, 'hoi4:write'])].sort((left, right) => compareCodeUnits(left, right)),
+        resource_name: 'HOI4 Agent Tools',
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/hoi4_agent_tools/mcp/security/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../src/hoi4_agent_tools/mcp/security/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAapD,MAAM,OAAO,aAAc,SAAQ,YAAY;IAE3B;IAGA;IACA;IALlB,YACkB,MAAiB,EACjC,IAAY,EACZ,OAAe,EACC,WAAwC,EACxC,cAAiC;QAEjD,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QANL,WAAM,GAAN,MAAM,CAAW;QAGjB,gBAAW,GAAX,WAAW,CAA6B;QACxC,mBAAc,GAAd,cAAc,CAAmB;IAGnD,CAAC;CACF;AAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiD,CAAC;AACtE,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AAEzD,SAAS,gBAAgB,CAAC,MAAyB;IACjD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,iDAAiD,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,MAAM,CAAC,MAA0B,EAAE,cAAiC;IAC3E,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,cAAc,CACf,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAChD,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,cAAc,EACd,yBAAyB,EACzB,eAAe,EACf,cAAc,CACf,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,OAAgC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5F,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC1E,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,MAAyB,EAAE,QAA2B;IAC3E,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,yBAAyB,EACzB,qCAAqC,EACrC,oBAAoB,EACpB,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,aAAkC;IAC/D,OAAO,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,0BAA0B,CAAC,aAAkC;IACpE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,UAAU,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,YAAY,CACpB,2BAA2B,EAC3B,wFAAwF,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAiC,EACjC,aAAkC,EAClC,iBAAoC,qBAAqB,CAAC,aAAa,CAAC;IAExE,MAAM,wBAAwB,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;IAC9D,MAAM,qBAAqB,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;IACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;gBAClD,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,MAAM;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;gBACjD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,cAAc,EAAE,CAAC;aAClB,CAAC,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,SAAS,KAAK,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtF,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,0BAA0B,EAC1B,sDAAsD,EACtD,SAAS,EACT,wBAAwB,CACzB,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACpC,aAAa,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;YAChD,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,GAAG;gBACtB,QAAQ,EACN,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;oBACnC,CAAC,CAAC,OAAO,CAAC,SAAS;oBACnB,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;wBAC/B,CAAC,CAAC,OAAO,CAAC,GAAG;wBACb,CAAC,CAAC,qBAAqB;gBAC7B,YAAY,EAAE,qBAAqB;gBACnC,MAAM;gBACN,SAAS,EAAE,OAAO,CAAC,GAAG;aACvB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,aAAa;gBAAE,MAAM,KAAK,CAAC;YAChD,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,cAAc,EACd,kCAAkC,EAClC,eAAe,EACf,wBAAwB,CACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;YAAE,SAAS;QACzD,IAAI,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG;gBAChB,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,QAAQ,EAAE,UAAU,CAAC,SAAS;gBAC9B,YAAY,EAAE,qBAAqB;gBACnC,MAAM,EAAE;oBACN,WAAW;oBACX,GAAG,CAAC,aAAa,CAAC,WAAW,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxE;aACF,CAAC;YACF,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;YAC1D,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,cAAc,EACd,kCAAkC,EAClC,eAAe,EACf,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,aAAkC;IAElC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACzF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,2CAA2C,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,aAAkC,EAClC,KAA4D;IAE5D,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,aAAa,CAAC,CAAC;IACrE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,UAAU,CAAC,IAAI,CAAC,sBAAsB,gBAAgB,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,aAAkC;IACvE,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;IAChC,KAAK,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CAAC,0BAA0B,EAAE,yCAAyC,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,YAAY,CACpB,gCAAgC,EAChC,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,IACE,SAAS,KAAK,SAAS;QACvB,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;YAChD,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC3C,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC7B,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC7B,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAC5B,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,yBAAyB,EACzB,wHAAwH,CACzH,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GACnB,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjG,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,YAAY,CACpB,mCAAmC,EACnC,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,0BAA0B,CAAC,aAAa,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG;QACxB,IAAI,CAAC,KAAK,CAAC,MAAM;QACjB,IAAI,CAAC,KAAK,CAAC,OAAO;QAClB,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB;KACnC,CAAC;IACF,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,YAAY,CACpB,kCAAkC,EAClC,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,YAAY,CACpB,gCAAgC,EAChC,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,YAAY,CACpB,mCAAmC,EACnC,gEAAgE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,aAAkC;IAElC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;IACvC,IAAI,KAAK,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,kCAAkC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI;QAC5D,qBAAqB,EAAE,KAAK,CAAC,oBAAoB;QACjD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,gBAAgB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC3F,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAC9B;QACD,aAAa,EAAE,kBAAkB;KAClC,CAAC;AACJ,CAAC"}

package/dist/hoi4_agent_tools/mcp/server/base-tools.d.ts

@@ -0,0 +1,35 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { CoreEngine, WorkspaceStatus } from '../../core/engine.js';
+import type { TransactionManifest } from '../../core/transactions.js';
+export interface ServerContext {
+    principal?: string;
+    scopes?: readonly string[];
+}
+export declare function requireServerScope(context: ServerContext, scope: string): void;
+export declare function transactionResourceLink(manifest: TransactionManifest): {
+    uri: string;
+    name: string;
+    mimeType: string;
+    description: string;
+};
+export declare function compactWorkspaceStatus(status: WorkspaceStatus): {
+    replacePathCount: number;
+    replacePaths: string[];
+    replacePathsTruncated: boolean;
+    replacementOwners: {
+        pathCount: number;
+        paths: string[];
+        pathsTruncated: boolean;
+        rootKind: string;
+        loadOrder: number;
+    }[];
+    id: string;
+    name: string;
+    kind: string;
+    writeEnabled: boolean;
+    rootKinds: string[];
+    dependencyCount: number;
+    generatedDirectory: ".hoi4-agent";
+};
+export declare function registerBaseTools(server: McpServer, engine: CoreEngine, context: ServerContext): void;
+//# sourceMappingURL=base-tools.d.ts.map

package/dist/hoi4_agent_tools/mcp/server/base-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-tools.d.ts","sourceRoot":"","sources":["../../../../src/hoi4_agent_tools/mcp/server/base-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMzE,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAuJtE,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAM9E;AAqGD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,mBAAmB;;;;;EAOpE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,eAAe;;;;;;;;;;;;;;;;;;EAa7D;AAkKD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,aAAa,GACrB,IAAI,CAmmBN"}