sealbridge 0.0.1 → 0.2.0

package/dist/packages/runtime/dist/mcp-server.js

@@ -0,0 +1,647 @@
+// SPDX-License-Identifier: Apache-2.0
+import { createSignedAgentCard, createInviteToken, createRevocationNotice, digest, parseAndVerifyInviteToken, resolveDid, validateRelayEndpointUrl, verifySignedAgentCard, } from '../../core/dist/index.js';
+import { RevocationRegistry } from '../../core/dist/index.js';
+import { verifyAudit } from '../../ledger/dist/index.js';
+import { HttpRelayClient } from '../../relay/dist/index.js';
+import { mcpTools } from './mcp-tool-catalog.js';
+import { InteractiveCliApprovalProvider, PolicyAutoApprovalProvider, WebhookApprovalProvider, assertApprovalWebhookUrl, } from './approval-providers.js';
+import { RequesterClient } from './session.js';
+import { validateSessionTimeouts } from './session-timeouts.js';
+class RpcError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+const PROTOCOL_VERSION = '2024-11-05';
+const OUTBOUND_REASON = 'outbound delegation to a remote Sealbridge worker';
+/**
+ * Guidance MCP clients place ahead of the tool catalog. Keep the workflow,
+ * the sibling-tool split, and the outbound security boundary in this text.
+ */
+const SERVER_INSTRUCTIONS = "This server delegates JSON tasks to remote Sealbridge workers over an encrypted Blind Relay and checks the bilateral audit trail. Call acp_discover_workers or start from an acp-invite, mint one with acp_create_invite when you are the worker owner, then use acp_delegate_task for one worker or acp_delegate_multi for race or quorum. Use acp_verify_audit_bundle with an anchor or expected tail fields when truncation must be ruled out, and use acp_revoke_token with acp_inspect_revocations to record and read local invite or capability revocation. Delegation signs with this process's Ed25519 owner key, and task input is transmitted externally only after allowedWorkerDids, allowedRelayUrls, and the approval provider or webhook allow the dial. Verify and inspect stay on this machine, discover only reads a relay directory, and revoke does not push a notice to a worker. Do not put secrets in arguments: delegation is synchronous and returns the verified result in that same call.";
+function rpcError(id, code, message) {
+    return { jsonrpc: '2.0', id: (id ?? null), error: { code, message } };
+}
+function toolResult(value, isError = false) {
+    const result = {
+        content: [{ type: 'text', text: JSON.stringify(value) }],
+        isError,
+    };
+    // Success payloads are also exposed as structuredContent for outputSchema.
+    // Failures stay in content text so they are not validated as the success schema.
+    if (!isError && value && typeof value === 'object' && !Array.isArray(value))
+        result.structuredContent = value;
+    return result;
+}
+function taskTimeouts(args) {
+    const options = {};
+    for (const key of ['executionTimeoutMs', 'taskTimeoutMs', 'waitTimeoutMs', 'connectTimeoutMs',
+        'transportIdleTimeoutMs', 'heartbeatIntervalMs']) {
+        if (args[key] !== undefined) {
+            if (typeof args[key] !== 'number')
+                throw new RpcError(-32602, 'Invalid timeout: ' + key);
+            options[key] = args[key];
+        }
+    }
+    validateSessionTimeouts(options);
+    return options;
+}
+function asRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new RpcError(-32602, 'Invalid params');
+    return value;
+}
+/** Origin plus pathname, without a trailing slash. Query and fragment are dropped. */
+export function normalizeMcpRelayUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error('MCP_RELAY_NOT_ALLOWED');
+    }
+    return url.origin + url.pathname.replace(/\/+$/, '');
+}
+function workerAllowlist(dids) {
+    if (dids === undefined)
+        return undefined;
+    if (!Array.isArray(dids))
+        throw new Error('INVALID_WORKER_DID');
+    const allow = new Set();
+    for (const did of dids) {
+        if (typeof did !== 'string')
+            throw new Error('INVALID_WORKER_DID');
+        const trimmed = did.trim();
+        try {
+            resolveDid(trimmed);
+        }
+        catch {
+            throw new Error('INVALID_WORKER_DID');
+        }
+        allow.add(trimmed);
+    }
+    return allow;
+}
+function relayAllowlist(urls, allowPrivateRelay) {
+    if (urls === undefined)
+        return undefined;
+    if (!Array.isArray(urls))
+        throw new Error('INVALID_RELAY_URL');
+    const allow = new Set();
+    for (const entry of urls) {
+        if (typeof entry !== 'string')
+            throw new Error('INVALID_RELAY_URL');
+        const trimmed = entry.trim();
+        validateRelayEndpointUrl(trimmed, { allowPrivateRelay });
+        allow.add(normalizeMcpRelayUrl(trimmed));
+    }
+    return allow;
+}
+function selectApproval(options) {
+    if (options.approvalProvider)
+        return options.approvalProvider;
+    if (options.approvalWebhookUrl) {
+        return new WebhookApprovalProvider(options.owner, {
+            url: options.approvalWebhookUrl,
+            fetch: options.approvalWebhookFetcher,
+            response: 'owner-decision',
+        });
+    }
+    if (options.requireInteractiveApproval) {
+        return new InteractiveCliApprovalProvider(options.owner, {
+            input: options.approvalInput,
+            output: options.approvalOutput,
+        });
+    }
+    return new PolicyAutoApprovalProvider(options.owner);
+}
+/** Dependency-free MCP server for ACP delegation, discovery, audit verification, and revocation. */
+export class AcpMcpServer {
+    options;
+    revocation;
+    allowedWorkers;
+    allowedRelays;
+    approval;
+    framed;
+    constructor(options) {
+        this.options = options;
+        this.revocation = options.revocation ?? new RevocationRegistry();
+        this.allowedWorkers = workerAllowlist(options.allowedWorkerDids);
+        this.allowedRelays = relayAllowlist(options.allowedRelayUrls, options.allowPrivateRelay);
+        if (options.approvalWebhookUrl)
+            assertApprovalWebhookUrl(options.approvalWebhookUrl);
+        this.approval = selectApproval(options);
+    }
+    async handle(message) {
+        if (!message || typeof message !== 'object' || Array.isArray(message))
+            return rpcError(null, -32600, 'Invalid Request');
+        const request = message;
+        const hasId = Object.hasOwn(message, 'id');
+        const id = hasId ? request.id : null;
+        if (request.jsonrpc !== '2.0' || typeof request.method !== 'string') {
+            if (!hasId)
+                return undefined;
+            return rpcError(id, -32600, 'Invalid Request');
+        }
+        try {
+            const result = await this.dispatch(request.method, request.params);
+            if (!hasId)
+                return undefined;
+            return { jsonrpc: '2.0', id: id, result };
+        }
+        catch (error) {
+            if (!hasId)
+                return undefined;
+            const code = error instanceof RpcError ? error.code : -32603;
+            const messageText = error instanceof Error ? error.message : String(error);
+            return rpcError(id, code, messageText);
+        }
+    }
+    /** Read newline-delimited JSON or Content-Length frames and answer in the same framing. */
+    async serve(input, output) {
+        let buffer = Buffer.alloc(0);
+        for await (const chunk of input) {
+            const next = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            buffer = Buffer.concat([buffer, next]);
+            buffer = await this.drain(buffer, output);
+        }
+    }
+    async drain(buffer, output) {
+        let rest = buffer;
+        while (rest.length > 0) {
+            if (this.framed === undefined) {
+                const preview = rest.toString('utf8');
+                if (preview.startsWith('Content-Length'))
+                    this.framed = true;
+                else if (preview.trimStart().startsWith('{') || preview.includes('\n'))
+                    this.framed = false;
+                else
+                    break;
+            }
+            if (this.framed) {
+                const headerEnd = rest.indexOf('\r\n\r\n');
+                if (headerEnd < 0)
+                    break;
+                const header = rest.subarray(0, headerEnd).toString('utf8');
+                const match = /Content-Length:\s*(\d+)/i.exec(header);
+                if (!match)
+                    throw new Error('INVALID_FRAMING');
+                const length = Number(match[1]);
+                const start = headerEnd + 4;
+                if (rest.length < start + length)
+                    break;
+                const body = rest.subarray(start, start + length).toString('utf8');
+                rest = rest.subarray(start + length);
+                await this.reply(output, body);
+            }
+            else {
+                const newline = rest.indexOf(0x0a);
+                if (newline < 0)
+                    break;
+                const line = rest.subarray(0, newline).toString('utf8').replace(/\r$/, '');
+                rest = rest.subarray(newline + 1);
+                if (line.trim())
+                    await this.reply(output, line);
+            }
+        }
+        return rest;
+    }
+    async reply(output, body) {
+        let message;
+        try {
+            message = JSON.parse(body);
+        }
+        catch {
+            this.write(output, rpcError(null, -32700, 'Parse error'));
+            return;
+        }
+        const response = await this.handle(message);
+        if (response !== undefined)
+            this.write(output, response);
+    }
+    write(output, value) {
+        const json = JSON.stringify(value);
+        if (this.framed)
+            output.write('Content-Length: ' + Buffer.byteLength(json) + '\r\n\r\n' + json);
+        else
+            output.write(json + '\n');
+    }
+    async dispatch(method, params) {
+        if (method === 'initialize') {
+            return {
+                protocolVersion: PROTOCOL_VERSION,
+                capabilities: { tools: { listChanged: false } },
+                serverInfo: { name: 'sealbridge-mcp-server', version: '0.2.0' },
+                instructions: SERVER_INSTRUCTIONS,
+            };
+        }
+        if (method === 'notifications/initialized')
+            return {};
+        if (method === 'ping')
+            return {};
+        if (method === 'tools/list')
+            return { tools: mcpTools };
+        if (method === 'tools/call')
+            return this.toolsCall(params);
+        throw new RpcError(-32601, 'Method not found');
+    }
+    async toolsCall(params) {
+        const body = asRecord(params);
+        const name = body.name;
+        if (typeof name !== 'string')
+            throw new RpcError(-32602, 'Invalid params');
+        const args = body.arguments === undefined ? {} : asRecord(body.arguments);
+        try {
+            const value = await this.callTool(name, args);
+            return toolResult(value, false);
+        }
+        catch (error) {
+            if (error instanceof RpcError)
+                throw error;
+            return toolResult({ error: error instanceof Error ? error.message : String(error) }, true);
+        }
+    }
+    async callTool(name, args) {
+        if (name === 'acp_delegate_task')
+            return this.delegateTask(args);
+        if (name === 'acp_delegate_multi')
+            return this.delegateMulti(args);
+        if (name === 'acp_verify_audit_bundle')
+            return this.verifyBundle(args);
+        if (name === 'acp_create_invite')
+            return this.createInvite(args);
+        if (name === 'acp_revoke_token')
+            return this.revokeToken(args);
+        if (name === 'acp_discover_workers')
+            return this.discoverWorkers(args);
+        if (name === 'acp_inspect_revocations')
+            return this.inspectRevocations(args);
+        throw new RpcError(-32602, 'Unknown tool');
+    }
+    client(relay) {
+        const selected = relay ?? this.options.relay;
+        if (!selected)
+            throw new Error('RELAY_REQUIRED');
+        return new RequesterClient({
+            owner: this.options.owner,
+            relay: selected,
+            approvalProvider: this.approval,
+            allowPrivateRelay: this.options.allowPrivateRelay,
+        });
+    }
+    isInvite(value) {
+        return value.startsWith('acp-invite:') || value.startsWith('acp:');
+    }
+    parseInvite(token) {
+        return parseAndVerifyInviteToken(token, Date.now(), {
+            allowPrivateRelay: this.options.allowPrivateRelay,
+        });
+    }
+    /** Reject unlisted workers before any relay dial. */
+    assertWorker(invite, workerDid) {
+        if (!this.allowedWorkers)
+            return;
+        if (invite) {
+            if (this.allowedWorkers.has(invite.agentDid) || this.allowedWorkers.has(invite.ownerDid))
+                return;
+            throw new Error('MCP_WORKER_NOT_ALLOWED');
+        }
+        if (typeof workerDid === 'string' && this.allowedWorkers.has(workerDid))
+            return;
+        throw new Error('MCP_WORKER_NOT_ALLOWED');
+    }
+    /**
+     * Reject unlisted or switched relay URLs before any relay dial.
+     * Explicit tool URLs are dial targets. Invite URLs are outbound destinations
+     * even when the configured transport is what would be dialed.
+     */
+    assertRelays(explicit, inviteUrls) {
+        const configured = typeof this.options.relay === 'string' ? this.options.relay : undefined;
+        const outbound = [...explicit, ...inviteUrls];
+        if (configured)
+            outbound.push(configured);
+        if (this.allowedRelays) {
+            for (const url of outbound) {
+                if (!this.allowedRelays.has(normalizeMcpRelayUrl(url)))
+                    throw new Error('MCP_RELAY_NOT_ALLOWED');
+            }
+            return;
+        }
+        if (this.options.allowAnyRelay)
+            return;
+        if (configured) {
+            const expected = normalizeMcpRelayUrl(configured);
+            for (const url of [...explicit, ...inviteUrls]) {
+                if (normalizeMcpRelayUrl(url) !== expected)
+                    throw new Error('MCP_RELAY_NOT_ALLOWED');
+            }
+            return;
+        }
+        if (this.options.relay && explicit.length > 0)
+            throw new Error('MCP_RELAY_NOT_ALLOWED');
+    }
+    outboundApprovalRequired() {
+        if (this.options.approvalProvider)
+            return !(this.options.approvalProvider instanceof PolicyAutoApprovalProvider);
+        return Boolean(this.options.approvalWebhookUrl || this.options.requireInteractiveApproval);
+    }
+    /** Ask the configured provider before task input is written to the relay. */
+    async approveOutbound(summary) {
+        if (!this.outboundApprovalRequired())
+            return;
+        const taskId = 'task_mcp_' + digest(summary).slice(7, 23);
+        const receipt = await this.approval.approve({
+            taskId,
+            gate: 'external_side_effect',
+            target: summary,
+            details: { reason: OUTBOUND_REASON },
+        });
+        if (receipt.payload.decision !== 'APPROVED')
+            throw new Error('APPROVAL_REJECTED');
+    }
+    async delegateTask(args) {
+        const to = typeof args.inviteToken === 'string' ? args.inviteToken : args.workerDid;
+        if (typeof to !== 'string' || typeof args.title !== 'string')
+            throw new RpcError(-32602, 'Invalid params');
+        const invite = this.isInvite(to) ? this.parseInvite(to) : undefined;
+        const explicitRelay = typeof args.relayUrl === 'string' ? args.relayUrl : undefined;
+        this.assertWorker(invite, invite ? undefined : to);
+        this.assertRelays(explicitRelay ? [explicitRelay] : [], invite ? [invite.relayUrl] : []);
+        const relay = explicitRelay ?? this.options.relay;
+        await this.approveOutbound({
+            title: args.title,
+            description: typeof args.description === 'string' ? args.description : '',
+            input: (args.input ?? null),
+            workers: [
+                {
+                    workerDid: invite?.agentDid ?? to,
+                    agentDid: invite?.agentDid ?? null,
+                    ownerDid: invite?.ownerDid ?? null,
+                },
+            ],
+            relayUrls: this.relayList(explicitRelay ? [explicitRelay] : [], invite ? [invite.relayUrl] : []),
+        });
+        const request = {
+            ...taskTimeouts(args),
+            to,
+            relay,
+            title: args.title,
+            description: typeof args.description === 'string' ? args.description : '',
+            input: (args.input ?? null),
+            outputSchema: args.outputSchema,
+            budget: args.budget,
+            minimumIsolationLevel: typeof args.minimumIsolationLevel === 'string' ? args.minimumIsolationLevel : undefined,
+        };
+        const result = await this.client(relay).delegate(request);
+        const report = verifyAudit(result.bundle);
+        return {
+            taskId: result.taskId,
+            status: result.state,
+            deliverable: result.deliverable,
+            auditBundle: {
+                valid: report.valid,
+                status: report.status,
+                count: result.bundle.entries.length,
+                head: result.bundle.checkpoint.actor.payload.head,
+                taskId: result.taskId,
+            },
+        };
+    }
+    async delegateMulti(args) {
+        if (!Array.isArray(args.workers) || (args.mode !== 'race' && args.mode !== 'quorum'))
+            throw new RpcError(-32602, 'Invalid params');
+        if (typeof args.title !== 'string')
+            throw new RpcError(-32602, 'Invalid params');
+        const relay = typeof args.relayUrl === 'string' ? args.relayUrl : undefined;
+        const explicitRelays = [];
+        if (relay)
+            explicitRelays.push(relay);
+        const inviteUrls = [];
+        const described = [];
+        const workers = args.workers.map((worker) => {
+            const item = asRecord(worker);
+            if (typeof item.workerDid !== 'string')
+                throw new RpcError(-32602, 'Invalid params');
+            const inviteToken = typeof item.inviteToken === 'string' ? item.inviteToken : undefined;
+            const invite = inviteToken ? this.parseInvite(inviteToken) : undefined;
+            this.assertWorker(invite, item.workerDid);
+            if (typeof item.relayUrl === 'string')
+                explicitRelays.push(item.relayUrl);
+            if (invite)
+                inviteUrls.push(invite.relayUrl);
+            described.push({
+                workerDid: invite?.agentDid ?? item.workerDid,
+                agentDid: invite?.agentDid ?? null,
+                ownerDid: invite?.ownerDid ?? null,
+            });
+            return {
+                workerDid: item.workerDid,
+                inviteToken,
+                relayUrl: typeof item.relayUrl === 'string' ? item.relayUrl : relay,
+            };
+        });
+        this.assertRelays(explicitRelays, inviteUrls);
+        await this.approveOutbound({
+            title: args.title,
+            description: typeof args.description === 'string' ? args.description : '',
+            input: (args.input ?? null),
+            mode: args.mode,
+            workers: described,
+            relayUrls: this.relayList(explicitRelays, inviteUrls),
+        });
+        const quorumSize = args.quorumSize === undefined
+            ? undefined
+            : typeof args.quorumSize === 'number'
+                ? args.quorumSize
+                : Number.NaN;
+        const request = {
+            ...taskTimeouts(args),
+            workers,
+            mode: args.mode,
+            quorumSize,
+            title: args.title,
+            description: typeof args.description === 'string' ? args.description : '',
+            input: (args.input ?? null),
+            outputSchema: args.outputSchema,
+            budget: args.budget,
+            minimumIsolationLevel: typeof args.minimumIsolationLevel === 'string' ? args.minimumIsolationLevel : undefined,
+        };
+        const result = await this.client(relay ?? this.options.relay).delegateMulti(request);
+        return {
+            mode: result.mode,
+            status: result.status,
+            deliverable: result.deliverable,
+            outputDigest: result.outputDigest,
+            taskIds: result.taskIds,
+            winners: result.winners,
+            cancelled: result.cancelled,
+            auditBundles: result.receipts.map((receipt) => ({
+                workerDid: receipt.workerDid,
+                taskId: receipt.taskId,
+                outputDigest: receipt.outputDigest,
+                valid: verifyAudit(receipt.bundle).valid,
+                count: receipt.bundle.entries.length,
+                head: receipt.bundle.checkpoint.actor.payload.head,
+            })),
+        };
+    }
+    relayList(explicit, inviteUrls) {
+        const urls = [...explicit, ...inviteUrls];
+        if (typeof this.options.relay === 'string')
+            urls.push(this.options.relay);
+        return urls;
+    }
+    verifyBundle(args) {
+        const bundle = args.bundle;
+        if (!bundle || typeof bundle !== 'object' || Array.isArray(bundle))
+            throw new RpcError(-32602, 'Invalid params');
+        const options = {};
+        let anchored = false;
+        if (args.anchor !== undefined) {
+            if (!args.anchor || typeof args.anchor !== 'object' || Array.isArray(args.anchor))
+                throw new RpcError(-32602, 'Invalid params');
+            const anchor = args.anchor;
+            // The legacy anchor object still pins taskId and actors, as before.
+            options.trustAnchor = anchor;
+            options.taskId = typeof anchor.taskId === 'string' ? anchor.taskId : '';
+            options.actors =
+                Array.isArray(anchor.actors) && anchor.actors.length === 2
+                    ? anchor.actors
+                    : ['', ''];
+            if (typeof anchor.head === 'string')
+                options.head = anchor.head;
+            anchored = true;
+        }
+        if (args.expectedFinalState !== undefined) {
+            if (typeof args.expectedFinalState !== 'string' || args.expectedFinalState.length === 0)
+                throw new RpcError(-32602, 'Invalid params');
+            options.expectedFinalState = args.expectedFinalState;
+            anchored = true;
+        }
+        if (args.expectedLastEntryHash !== undefined) {
+            if (typeof args.expectedLastEntryHash !== 'string' || args.expectedLastEntryHash.length === 0)
+                throw new RpcError(-32602, 'Invalid params');
+            options.expectedLastEntryHash = args.expectedLastEntryHash;
+            anchored = true;
+        }
+        if (args.expectedEntryCount !== undefined) {
+            if (typeof args.expectedEntryCount !== 'number' ||
+                !Number.isSafeInteger(args.expectedEntryCount) ||
+                args.expectedEntryCount < 0)
+                throw new RpcError(-32602, 'Invalid params');
+            options.expectedEntryCount = args.expectedEntryCount;
+            anchored = true;
+        }
+        const report = verifyAudit(bundle, anchored ? options : undefined);
+        return report;
+    }
+    createInvite(args) {
+        if (typeof args.relayUrl !== 'string')
+            throw new RpcError(-32602, 'Invalid params');
+        const agentDid = typeof args.agentDid === 'string' ? args.agentDid : this.options.owner.did;
+        const card = createSignedAgentCard({
+            name: typeof args.name === 'string' ? args.name : (this.options.name ?? 'Sealbridge Worker'),
+            agentDid,
+            relayEndpoint: args.relayUrl,
+            skills: [{ id: 'json-task', name: 'JSON task' }],
+        }, this.options.owner, agentDid === this.options.owner.did ? undefined : this.options.agentKey);
+        const inviteOptions = {
+            agentCard: card,
+        };
+        if (args.expiresInSeconds !== undefined) {
+            if (typeof args.expiresInSeconds !== 'number')
+                throw new Error('INVALID_INVITE_EXPIRY');
+            inviteOptions.expiresInSeconds = args.expiresInSeconds;
+        }
+        return {
+            inviteToken: createInviteToken(inviteOptions, this.options.owner),
+        };
+    }
+    revokeToken(args) {
+        if ((args.targetType !== 'invite' && args.targetType !== 'capability') ||
+            typeof args.targetId !== 'string' ||
+            typeof args.reason !== 'string')
+            throw new RpcError(-32602, 'Invalid params');
+        const notice = createRevocationNotice({ targetType: args.targetType, targetId: args.targetId, reason: args.reason }, this.options.owner);
+        this.revocation.revoke(notice);
+        return { notice: notice };
+    }
+    async discoverWorkers(args) {
+        if (args.relayUrl !== undefined && typeof args.relayUrl !== 'string')
+            throw new RpcError(-32602, 'Invalid params');
+        const explicitRelay = typeof args.relayUrl === 'string' ? args.relayUrl : undefined;
+        this.assertRelays(explicitRelay ? [explicitRelay] : [], []);
+        const selected = explicitRelay ?? this.options.relay;
+        if (!selected)
+            throw new Error('RELAY_REQUIRED');
+        if (typeof selected === 'string')
+            validateRelayEndpointUrl(selected, { allowPrivateRelay: this.options.allowPrivateRelay });
+        const transport = typeof selected === 'string'
+            ? new HttpRelayClient(selected, { allowPrivateRelay: this.options.allowPrivateRelay })
+            : selected;
+        if (!transport.discover)
+            throw new Error('DISCOVERY_UNAVAILABLE');
+        const rawCards = await transport.discover();
+        if (!Array.isArray(rawCards))
+            throw new Error('INVALID_AGENT_CARD');
+        const now = Date.now();
+        const cards = rawCards.filter((card) => verifySignedAgentCard(card, now));
+        return {
+            relayUrl: typeof selected === 'string' ? selected : null,
+            count: cards.length,
+            workers: cards.map((card) => {
+                const worker = {
+                    name: card.payload.name,
+                    description: card.payload.description,
+                    ownerDid: card.payload.ownerDid,
+                    agentDid: card.payload.agentDid,
+                    relayEndpoint: card.payload.relayEndpoint,
+                    expiresAt: card.payload.expiresAt,
+                    version: card.payload.version,
+                    costModes: card.payload.costModes,
+                    skills: card.payload.skills.map((skill) => {
+                        const item = { id: skill.id, name: skill.name };
+                        if (typeof skill.description === 'string')
+                            item.description = skill.description;
+                        return item;
+                    }),
+                    signerDid: card.signature.signerDid,
+                    signedAt: card.signature.signedAt,
+                    signature: card.signature,
+                };
+                if (card.payload.agentDelegation)
+                    worker.agentDelegation = card.payload.agentDelegation;
+                return worker;
+            }),
+        };
+    }
+    inspectRevocations(args) {
+        const hasType = args.targetType !== undefined;
+        const hasId = args.targetId !== undefined;
+        if (hasId && !hasType)
+            throw new RpcError(-32602, 'Invalid params');
+        if (hasType && args.targetType !== 'invite' && args.targetType !== 'capability')
+            throw new RpcError(-32602, 'Invalid params');
+        if (hasId && (typeof args.targetId !== 'string' || args.targetId.length === 0))
+            throw new RpcError(-32602, 'Invalid params');
+        const targetType = hasType ? args.targetType : undefined;
+        const targetId = hasId ? args.targetId : undefined;
+        const notices = this.revocation.exportNotices().filter((notice) => {
+            if (targetType && notice.payload.targetType !== targetType)
+                return false;
+            if (targetId !== undefined && notice.payload.targetId !== targetId)
+                return false;
+            return true;
+        });
+        const result = {
+            count: notices.length,
+            notices: notices,
+        };
+        if (targetType && targetId !== undefined)
+            result.revoked = this.revocation.isRevoked(targetType, targetId);
+        return result;
+    }
+}
+//# sourceMappingURL=mcp-server.js.map