toolroll 0.9.104 → 0.9.105

package/dist/mcp-core.d.ts

@@ -1,110 +0,0 @@
-import { type GatewayToolName } from "./contracts/gateway-tools.js";
-import type { Store } from "./store.js";
-import { type VerifiedCoordinator } from "./coordinator.js";
-export declare const MODERN = "2026-07-28";
-export declare const LEGACY = "2025-11-25";
-/** The modern revision namespaces its per-request metadata. */
-export declare const META_VERSION = "io.modelcontextprotocol/protocolVersion";
-export declare const META_SERVER = "io.modelcontextprotocol/serverInfo";
-export declare const META_CAPABILITIES = "io.modelcontextprotocol/clientCapabilities";
-/** The revision's own error code for an unsupported protocol version. */
-export declare const UNSUPPORTED_VERSION = -32022;
-export declare const MAX_REQUEST: number;
-export declare const MAX_DEPTH = 32;
-export type Json = null | boolean | number | string | Json[] | {
-    [key: string]: Json;
-};
-export declare function depthOf(value: unknown): number;
-/** One handler per tool; its input is GATEWAY_TOOL_INPUTS[name]
- * (src/contracts/gateway-tools.ts) — THE source for parsing and inputSchema.
- * Output is built field-by-field; spreading a database row into a result is
- * forbidden in this module (arch-tested). */
-export type ToolContext = {
-    store: Store;
-    who: VerifiedCoordinator;
-    /** The installation's enrolled repos (repos.json), when the launcher
-     * knows them — list_repos answers allowlist ∩ enrolled. null = the
-     * launcher could not read the registry; the allowlist alone answers. */
-    enrolled: readonly string[] | null;
-    /** The raw credential, per-SERVER closure state — never module state:
-     * two serveMcp instances in one process must not cross credentials
-     * (implementation review, finding 5). Filing re-authenticates with it
-     * inside its own transaction. */
-    token: string;
-    now: Date;
-    /** Decisions this connection read with get_decision — propose_answer needs one. */
-    readDecisions: Set<number>;
-    /** Where evidence lives, when the launcher knows — get_task reads a scout's report from here. */
-    evidenceRoot?: string;
-};
-export type Answer = {
-    ok: true;
-    body: Json;
-} | {
-    ok: false;
-    message: string;
-};
-type Tool = {
-    name: GatewayToolName;
-    description: string;
-    inputSchema: Json;
-    handle: (ctx: ToolContext, args: Record<string, unknown>) => Answer;
-};
-/** The gateway's tools in tools/list order, each inputSchema derived from its contract. */
-export declare const TOOLS: Tool[];
-/** The tools/list payload for a registry. No outputSchema: MCP output schemas describe structuredContent, and these
- * tools return text content only (round-2 finding 1). */
-export declare const toolsPayload: (tools: readonly {
-    name: string;
-    description: string;
-    inputSchema: Json;
-}[]) => {
-    tools: Json;
-};
-/** A modern result is schema-complete; a cacheable one (tools/list, discover) carries `ttlMs: 0` and the narrowest scope. */
-export declare function shapeResult(era: "modern" | "legacy", result: Record<string, Json>, cacheable: boolean): Record<string, Json>;
-/** One JSON-RPC message, read and checked before any method applies. */
-export type ReadMessage = {
-    ok: true;
-    hasId: boolean;
-    id: Json;
-    method: string;
-    params: Record<string, unknown>;
-    meta: Record<string, unknown>;
-} | {
-    ok: false;
-    id: Json;
-    code: number;
-    message: string;
-};
-/** Read one message's text: size, JSON, no batching, depth, `jsonrpc`, and the id rules. A notification is the message
- * that carries NO id — the method name never decides (round-3 finding 3). MCP RequestId is a string or an INTEGER
- * (round-2 finding 2): floats, null, and object shapes refuse wherever an id appears. */
-export declare function readMessage(text: string): ReadMessage;
-/** ClientCapabilities is an OBJECT shape (round-3 finding 5): an array is not a capabilities declaration. */
-export declare const capabilitiesShape: (value: unknown) => boolean;
-/** What a tools/call came to: a JSON-RPC error (`fatal` = the stdio server must exit after it) or a tool result. */
-export type CallOutcome = {
-    kind: "error";
-    code: number;
-    message: string;
-    fatal: boolean;
-} | {
-    kind: "result";
-    result: Record<string, Json>;
-};
-/** The `arguments` of a call: only an ABSENT value defaults to empty (round-3 finding 2), and the root is an object
- * BEFORE any schema applies (round-2 finding 2): 42 or false never passes an empty schema. */
-export declare function callArguments(params: Record<string, unknown>): Record<string, unknown> | null;
-/** A handler's answer as a tools/call result: a refusal is `isError`, never a protocol error. */
-export declare function answerResult(answered: Answer): Record<string, Json>;
-/**
- * One coordinator tools/call. ONE snapshot per call (review finding 3): the version check, the credential re-read, and
- * every data read share a transaction, so a concurrent migration cannot slip between them; filing's own BEGIN IMMEDIATE
- * reenters this one. tools/list visibility is presentation — authorization happens HERE, on every call, against the
- * live credential row.
- */
-export declare function callCoordinatorTool(call: Omit<ToolContext, "who" | "now"> & {
-    clock: () => Date;
-}, params: Record<string, unknown>): CallOutcome;
-export {};

package/dist/mcp-http.d.ts

@@ -1,32 +0,0 @@
-/**
- * The MCP gateway over streamable HTTP, served at /mcp by the console (serve.ts). Stateless: one JSON-RPC message per
- * POST, answered with one JSON body (a notification gets 202 and no body); there is no session and no event stream.
- * The modern revision carries its version in `_meta` as on stdio; a handshake-era client may initialize, and because
- * nothing is kept between requests its tools work without the stdio lifecycle.
- *
- * Every POST signs in again. The caller is a coordinator credential (the coordinator registry, exactly as on stdio) or
- * a person's own API token `so_…` (mcp-person.ts: their role, project grants and token scope). A password
- * (`name:password`) and cookies sign in nothing here, a request carrying a browser Origin is refused, and the console's
- * Host check runs before this route. A revoked or expired token answers 401 on its next request.
- */
-import type { IncomingMessage, ServerResponse } from "node:http";
-import type { Store } from "./store.js";
-import { type Person, type RunOperateAs } from "./mcp-person.js";
-import { type Admission } from "./request-budget.js";
-export type McpHttpOptions = {
-    store: Store;
-    clock: () => Date;
-    /** The enrolled projects: a coordinator's list_repos answers allowlist ∩ enrolled. */
-    enrolled: () => readonly string[] | null;
-    evidenceRoot?: string;
-    /** The console's own sign-in for an `so_` bearer: the address's tries, expiry, revocation, a removed account. */
-    signedIn: (request: IncomingMessage) => boolean;
-    /** Where an MCP client finds how to sign in (mcp-oauth.ts), named on a 401; null when this address offers none. */
-    resourceMetadata?: (request: IncomingMessage) => string | null;
-    /** Runs a person's command on the server (operate.ts); resolved from operate.ts when not injected. */
-    runAs?: RunOperateAs;
-    /** A person token's request budget (request-budget.ts), charged once per request before its body is read. */
-    admit?: (person: Person) => Admission;
-    requestBudgetClock?: () => number;
-};
-export declare function createMcpHttp(options: McpHttpOptions): (request: IncomingMessage, response: ServerResponse) => Promise<void>;

package/dist/mcp-oauth.d.ts

@@ -1,92 +0,0 @@
-/**
- * MCP sign-in: OAuth 2.1 for /mcp, as the MCP authorization spec describes, so an engineer's MCP client connects
- * without a pasted token. This console is both the authorization server and the protected resource.
- *
- *   /mcp's 401 names /.well-known/oauth-protected-resource/mcp (RFC 9728), which names this console's
- *   /.well-known/oauth-authorization-server (RFC 8414). A client registers itself (RFC 7591, public clients only),
- *   sends the person to /oauth/authorize with a S256 PKCE challenge and resource=<origin>/mcp, and trades the code
- *   at /oauth/token for a short-lived access token and a refresh secret that rotates on every use.
- *
- * The person signs in with the console's own sign-in (password or identity provider, unchanged), then consents on
- * one page: read or act, and which of their projects, confirmed with their password or a fresh provider check, the
- * same step-up as making an API token. Nothing is granted without that form, its session CSRF value and a same-site
- * post.
- *
- * A grant is an ordinary API token (api-tokens.ts): its access token is `so_<id>_<secret>`, it is listed and revoked
- * with every other token (console Sessions & tokens, `toolroll tokens`), and /mcp runs it through the same person
- * path. Its v113 binding (store.oauthGrant) adds what an ordinary token doesn't have: it works only at /mcp, its
- * access secret lasts an hour, it is tied to the account generation that consented, and it reaches only the projects
- * chosen (still intersected with the person's live access on every call). Only hashes are kept: of codes, access
- * secrets and refresh secrets. Approvals, people and policy are never reachable: those have no tool and no scope.
- */
-import type { IncomingMessage, ServerResponse } from "node:http";
-import type { Store } from "./store.js";
-import { type Admission } from "./request-budget.js";
-/** How long each piece lives. A code is spent at once; a grant ends after 30 days and the person consents again. */
-export declare const OAUTH_TIMES: {
-    readonly requestMs: number;
-    readonly codeMs: 60000;
-    readonly accessSeconds: 3600;
-    readonly grantDays: 30;
-};
-/** The most sign-ins waiting at once, and registered clients kept. */
-export declare const OAUTH_LIMITS: {
-    readonly requests: 200;
-    readonly requestsPerSource: 20;
-    readonly clients: 500;
-    readonly clientsPerSource: 20;
-};
-export declare const OAUTH_SCOPES: readonly ["read", "act"];
-export declare const RESOURCE_PATH = "/mcp";
-export declare const resourceMetadataUrl: (origin: string) => string;
-/**
- * Whether an API token may sign in to this request's path now. An ordinary token: yes (its own checks are elsewhere).
- * An MCP sign-in's token: only at /mcp, only while its access secret is fresh and the account is at the generation
- * that consented.
- */
-export declare function oauthTokenAllowed(store: Store, tokenId: string, path: string, now: Date): boolean;
-/** The projects an MCP sign-in's token was granted (the person's live access still applies), or null for an ordinary token. */
-export declare const oauthProjects: (store: Store, tokenId: string) => string[] | null;
-export type OAuthSession = {
-    name: string;
-    role: "approver" | "viewer";
-    csrf: string;
-    /** The account's credential generation this session signed in under: a code is never issued under another. */
-    generation: number;
-    /** Signed in with an identity provider: its name, and whether an explicit re-check made on request awaits one step-up. */
-    sso: {
-        label: string;
-        fresh: boolean;
-    } | null;
-};
-export type OAuthHttpOptions = {
-    store: Store;
-    clock: () => Date;
-    /** This console's canonical origin for the request (the https public address, or this computer's loopback one); null: no sign-in here. */
-    originOf: (request: IncomingMessage) => string | null;
-    /** Trusted direct peer, or the last hop appended by the console's loopback proxy (native IPv6 counted by its /64). */
-    requesterKey: (request: IncomingMessage) => string;
-    /** The browser session signed in by cookie, or null. A bearer never consents. */
-    session: (request: IncomingMessage) => OAuthSession | null;
-    /** A posted form came from a page of this console (its Origin, or Referer, names an allowed host). */
-    sameSite: (request: IncomingMessage) => boolean;
-    /** The step-up, proved at the moment of consent on this request's live session: the person's password, or (empty)
-     * an explicit identity-provider re-check, spent by this consent. */
-    confirm: (request: IncomingMessage, session: OAuthSession, typed: string) => boolean;
-    /** The projects this person may choose: each a project the server knows that they can use now. */
-    projectsFor: (account: string) => string[];
-    /** Easy-start C2: the consent post presents the session's browser mutation key (absent: not required). */
-    keyed?: (request: IncomingMessage, form: URLSearchParams) => boolean;
-    /** Easy-start C2: whether the consent page carries the key fill (its one nonce'd script). */
-    keyFill?: () => boolean;
-    /** The token exchange's budget by source (request-budget.ts): charged once per request, before its body is read or any code or refresh secret is spent. */
-    admitToken?: (request: IncomingMessage) => Admission;
-};
-/**
- * A redirect a client may register: https anywhere, or http on 127.0.0.1 / [::1] (RFC 8252 §7.3), with no
- * credentials or fragment.
- */
-export declare function redirectAllowed(value: string): boolean;
-/** A redirect matches a registered one exactly; on a loopback http address any port does (RFC 8252 §7.3). */
-export declare function redirectMatches(presented: string, registered: readonly string[]): string | null;
-export declare function createOAuthHttp(options: OAuthHttpOptions): (request: IncomingMessage, response: ServerResponse, url: URL) => Promise<boolean>;

package/dist/mcp-person.d.ts

@@ -1,22 +0,0 @@
-import { type PersonToolName } from "./contracts/gateway-tools.js";
-import { type CallOutcome, type Json } from "./mcp-core.js";
-import type { Store } from "./store.js";
-import type { Principal } from "./operate.js";
-/** The shared remote seam (operate.ts): who runs a command on the server, and the runner itself. Type-only, so a
- * change to either breaks this build instead of drifting; the value is loaded lazily (operate.ts imports serve.ts). */
-export type { Principal } from "./operate.js";
-export type RunOperateAs = typeof import("./operate.js").runOperateAs;
-/** A signed-in person: the principal the command runs as, and what their account may do. */
-export type Person = {
-    principal: Principal;
-    role: "approver" | "viewer";
-    tokenName: string;
-};
-/** What this person may call: every read, and the acts only on an act token of an account that acts. */
-export declare function personTools(person: Person): {
-    name: PersonToolName;
-    description: string;
-    inputSchema: Json;
-}[];
-/** One person tools/call: read by its schema, checked against the person, then run as the command it names. */
-export declare function callPersonTool(person: Person, store: Store, runAs: RunOperateAs, params: Record<string, unknown>): Promise<CallOutcome>;

package/dist/mcp.d.ts

@@ -1,20 +0,0 @@
-import type { Store } from "./store.js";
-export { LEGACY, META_CAPABILITIES, META_SERVER, META_VERSION, MODERN, UNSUPPORTED_VERSION } from "./mcp-core.js";
-export type McpIo = {
-    onLine: (handler: (line: string) => void) => void;
-    onEof: (handler: () => void) => void;
-    write: (line: string) => void;
-    log: (line: string) => void;
-    exit: (code: number) => void;
-};
-export type McpOutcome = {
-    ok: true;
-} | {
-    ok: false;
-    reason: "unauthenticated" | "revoked" | "schema";
-    message: string;
-};
-/** Serve until EOF. The store is already open through the non-migrating
- * door; the token was startup-verified by the caller (and dies here again
- * if it does not hold). */
-export declare function serveMcp(store: Store, token: string, io: McpIo, clock?: () => Date, enrolled?: readonly string[] | null, evidenceRoot?: string): McpOutcome;