wicked-crew 0.7.40 → 0.7.45

package/dist/mcp/classify.d.ts

@@ -0,0 +1,45 @@
+/**
+ * MCP tool identity and class (DES-MCP-TOOLS-001 §4.2, §5).
+ *
+ * - The SUBJECT is the policy token a tool is judged by: `mcp:<server>/<tool>`. A server name
+ *   never contains `/`, so the first `/` after `mcp:` always splits it.
+ * - The CLASS comes from the tool's own `tools/list` annotations, never from a carrier (F-2):
+ *   an operator override wins; else `read` when `readOnlyHint === true`; else `destructive` when
+ *   `destructiveHint !== false` (the MCP spec default); else `write`. A tool with NO annotations
+ *   is `write` (D-4).
+ * - The SCHEMA HASH covers everything a policy or an operator approved: description, input and
+ *   output schema, annotations, and a `rest` tool's request mapping. Any change sends the tool back to unregistered (D-5) until it
+ *   is previewed and saved again.
+ */
+import type { McpRestMapping, McpToolAnnotations, McpToolClass } from '../core/types.js';
+/** A server name: a lowercase token that is safe inside `mcp:<server>/<tool>` and a keychain account. */
+export declare const MCP_SERVER_NAME_RE: RegExp;
+export declare function mcpSubject(server: string, tool: string): string;
+/** `mcp:<server>/<tool>` → its parts, or `null` for anything else. */
+export declare function parseMcpSubject(subject: string): {
+    server: string;
+    tool: string;
+} | null;
+/**
+ * The class `tools/list` annotations imply (§4.2), exactly as the engine's `mcp_gate::classify`
+ * derives it (`tests/mcp-policies.test.ts` pins the two against each other): `null` annotations, or
+ * annotations carrying neither `readOnlyHint` nor `destructiveHint`, = none declared = `write` (D-4).
+ */
+export declare function deriveToolClass(annotations: McpToolAnnotations | null): McpToolClass;
+/** The class a policy sees: the operator's override when set, else the derived one. */
+export declare function effectiveToolClass(derived: McpToolClass, override: McpToolClass | null): McpToolClass;
+/** JSON with object keys sorted at every depth, so a hash never depends on key order. */
+export declare function canonicalJson(value: unknown): string;
+export declare function sha256Hex(text: string): string;
+/** The fields of a listed tool the schema hash covers. */
+export interface HashedToolShape {
+    name: string;
+    description: string | null;
+    inputSchema: Record<string, unknown> | null;
+    outputSchema: Record<string, unknown> | null;
+    annotations: McpToolAnnotations | null;
+    /** A `rest` tool's request mapping: part of what was approved, so a changed mapping re-registers. */
+    rest?: McpRestMapping | null;
+}
+export declare function toolSchemaHash(tool: HashedToolShape): string;
+//# sourceMappingURL=classify.d.ts.map

package/dist/mcp/classify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/mcp/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEzF,yGAAyG;AACzG,eAAO,MAAM,kBAAkB,QAA+B,CAAC;AAE/D,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQxF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI,GAAG,YAAY,CAMpF;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI,GAAG,YAAY,CAErG;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAcD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,qGAAqG;IACrG,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;CAC9B;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAY5D"}

package/dist/mcp/classify.js

@@ -0,0 +1,83 @@
+/**
+ * MCP tool identity and class (DES-MCP-TOOLS-001 §4.2, §5).
+ *
+ * - The SUBJECT is the policy token a tool is judged by: `mcp:<server>/<tool>`. A server name
+ *   never contains `/`, so the first `/` after `mcp:` always splits it.
+ * - The CLASS comes from the tool's own `tools/list` annotations, never from a carrier (F-2):
+ *   an operator override wins; else `read` when `readOnlyHint === true`; else `destructive` when
+ *   `destructiveHint !== false` (the MCP spec default); else `write`. A tool with NO annotations
+ *   is `write` (D-4).
+ * - The SCHEMA HASH covers everything a policy or an operator approved: description, input and
+ *   output schema, annotations, and a `rest` tool's request mapping. Any change sends the tool back to unregistered (D-5) until it
+ *   is previewed and saved again.
+ */
+import { createHash } from 'node:crypto';
+/** A server name: a lowercase token that is safe inside `mcp:<server>/<tool>` and a keychain account. */
+export const MCP_SERVER_NAME_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/;
+export function mcpSubject(server, tool) {
+    return `mcp:${server}/${tool}`;
+}
+/** `mcp:<server>/<tool>` → its parts, or `null` for anything else. */
+export function parseMcpSubject(subject) {
+    if (!subject.startsWith('mcp:'))
+        return null;
+    const rest = subject.slice(4);
+    const slash = rest.indexOf('/');
+    if (slash <= 0 || slash === rest.length - 1)
+        return null;
+    const server = rest.slice(0, slash);
+    if (!MCP_SERVER_NAME_RE.test(server))
+        return null;
+    return { server, tool: rest.slice(slash + 1) };
+}
+/**
+ * The class `tools/list` annotations imply (§4.2), exactly as the engine's `mcp_gate::classify`
+ * derives it (`tests/mcp-policies.test.ts` pins the two against each other): `null` annotations, or
+ * annotations carrying neither `readOnlyHint` nor `destructiveHint`, = none declared = `write` (D-4).
+ */
+export function deriveToolClass(annotations) {
+    if (annotations === null)
+        return 'write';
+    if (annotations.readOnlyHint === true)
+        return 'read';
+    if (annotations.readOnlyHint === undefined && annotations.destructiveHint === undefined)
+        return 'write';
+    if (annotations.destructiveHint !== false)
+        return 'destructive';
+    return 'write';
+}
+/** The class a policy sees: the operator's override when set, else the derived one. */
+export function effectiveToolClass(derived, override) {
+    return override ?? derived;
+}
+/** JSON with object keys sorted at every depth, so a hash never depends on key order. */
+export function canonicalJson(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            out[key] = sortKeys(value[key]);
+        }
+        return out;
+    }
+    return value;
+}
+export function sha256Hex(text) {
+    return createHash('sha256').update(text, 'utf8').digest('hex');
+}
+export function toolSchemaHash(tool) {
+    return sha256Hex(canonicalJson({
+        name: tool.name,
+        description: tool.description,
+        inputSchema: tool.inputSchema,
+        outputSchema: tool.outputSchema,
+        annotations: tool.annotations,
+        // Only when present, so an MCP tool's hash is what it was before REST upstreams existed.
+        ...(tool.rest != null ? { rest: tool.rest } : {}),
+    }));
+}
+//# sourceMappingURL=classify.js.map

package/dist/mcp/classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/mcp/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,yGAAyG;AACzG,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAE/D,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,IAAY;IACrD,OAAO,OAAO,MAAM,IAAI,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,WAAsC;IACpE,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACzC,IAAI,WAAW,CAAC,YAAY,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACrD,IAAI,WAAW,CAAC,YAAY,KAAK,SAAS,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACxG,IAAI,WAAW,CAAC,eAAe,KAAK,KAAK;QAAE,OAAO,aAAa,CAAC;IAChE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,OAAqB,EAAE,QAA6B;IACrF,OAAO,QAAQ,IAAI,OAAO,CAAC;AAC7B,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAaD,MAAM,UAAU,cAAc,CAAC,IAAqB;IAClD,OAAO,SAAS,CACd,aAAa,CAAC;QACZ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yFAAyF;QACzF,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/mcp/discovery.d.ts

@@ -0,0 +1,24 @@
+/**
+ * "Discovered, not managed" (DES-MCP-TOOLS-001 §7, §8 `GET /mcp/servers`): the MCP servers the
+ * CLIs on this machine are configured with, by NAME only.
+ *
+ * - Read-only. Each CLI's own config file is parsed and only the server names leave this module:
+ *   never a command, URL, header or env value, because those are where a pasted token lives.
+ * - Two origins. `operator`: the CLI's default home under the operator's home dir. `worker`: each
+ *   seat's own root under the worker home, `<worker home>/<cli>` and every instance root
+ *   `<worker home>/<cli>-<n>` (the layout of wicked-apps-core `seat_config_for_seat`, core#591). A worker-home server is invariant I1's finding: no wicked-handed native MCP
+ *   server may sit in a worker home, so studio lists these in red.
+ * - A file that is absent or does not parse contributes nothing; discovery never fails a request.
+ */
+import type { McpDiscoveredServer } from '../core/types.js';
+/** `[mcp_servers.<id>]` table headers in a codex `config.toml` (bare or quoted ids; sub-tables folded). */
+export declare function codexServerNames(text: string): string[];
+export interface DiscoveryRoots {
+    /** The operator's home dir. */
+    home: string;
+    /** The worker home (`WICKED_WORKER_HOME`); `null` = none configured. */
+    workerHome: string | null;
+}
+/** Every server name configured in a CLI home; `managed` is set by the caller against the registry. */
+export declare function discoverMcpServers(roots: DiscoveryRoots, managed: ReadonlySet<string>): McpDiscoveredServer[];
+//# sourceMappingURL=discovery.d.ts.map

package/dist/mcp/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/mcp/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAgB5D,2GAA2G;AAC3G,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAOvD;AA8BD,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAUD,uGAAuG;AACvG,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,mBAAmB,EAAE,CAa7G"}

package/dist/mcp/discovery.js

@@ -0,0 +1,78 @@
+/**
+ * "Discovered, not managed" (DES-MCP-TOOLS-001 §7, §8 `GET /mcp/servers`): the MCP servers the
+ * CLIs on this machine are configured with, by NAME only.
+ *
+ * - Read-only. Each CLI's own config file is parsed and only the server names leave this module:
+ *   never a command, URL, header or env value, because those are where a pasted token lives.
+ * - Two origins. `operator`: the CLI's default home under the operator's home dir. `worker`: each
+ *   seat's own root under the worker home, `<worker home>/<cli>` and every instance root
+ *   `<worker home>/<cli>-<n>` (the layout of wicked-apps-core `seat_config_for_seat`, core#591). A worker-home server is invariant I1's finding: no wicked-handed native MCP
+ *   server may sit in a worker home, so studio lists these in red.
+ * - A file that is absent or does not parse contributes nothing; discovery never fails a request.
+ */
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+/** Keys of a JSON object at `path`, or `[]`. */
+function jsonKeys(...path) {
+    return (text) => {
+        let node = JSON.parse(text);
+        for (const key of path) {
+            if (node === null || typeof node !== 'object' || Array.isArray(node))
+                return [];
+            node = node[key];
+        }
+        return node !== null && typeof node === 'object' && !Array.isArray(node) ? Object.keys(node) : [];
+    };
+}
+/** `[mcp_servers.<id>]` table headers in a codex `config.toml` (bare or quoted ids; sub-tables folded). */
+export function codexServerNames(text) {
+    const names = new Set();
+    // The id must be followed by the table's end or a sub-table dot: a torn header names nothing.
+    const re = /^\s*\[\s*mcp_servers\.(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9_-]+))\s*[.\]]/gm;
+    for (let m = re.exec(text); m !== null; m = re.exec(text))
+        names.add(m[1] ?? m[2] ?? m[3] ?? '');
+    names.delete('');
+    return [...names];
+}
+const SOURCES = [
+    { cli: 'claude', operator: '.claude.json', worker: '.claude.json', parse: jsonKeys('mcpServers') },
+    { cli: 'codex', operator: '.codex/config.toml', worker: 'config.toml', parse: codexServerNames },
+    { cli: 'copilot', operator: '.copilot/mcp-config.json', worker: 'mcp-config.json', parse: jsonKeys('mcpServers') },
+    { cli: 'opencode', operator: '.config/opencode/opencode.json', worker: 'config/opencode/opencode.json', parse: jsonKeys('mcp') },
+    { cli: 'agy', operator: '.gemini/config/mcp_config.json', worker: '.gemini/config/mcp_config.json', parse: jsonKeys('mcpServers') },
+];
+/** A seat's root dirs in the worker home: `<cli>`, and each instance root `<cli>-<n>` (core#591). */
+function seatRoots(workerHome, cli) {
+    let entries;
+    try {
+        entries = readdirSync(workerHome);
+    }
+    catch {
+        return [];
+    }
+    return entries.filter((e) => e === cli || (e.startsWith(`${cli}-`) && /^[A-Za-z0-9_]+$/.test(e.slice(cli.length + 1)))).sort();
+}
+function namesIn(file, parse) {
+    try {
+        return parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        return [];
+    }
+}
+/** Every server name configured in a CLI home; `managed` is set by the caller against the registry. */
+export function discoverMcpServers(roots, managed) {
+    const out = [];
+    for (const src of SOURCES) {
+        for (const name of namesIn(join(roots.home, src.operator), src.parse)) {
+            out.push({ name, cli: src.cli, origin: 'operator', source: `~/${src.operator}`, managed: managed.has(name) });
+        }
+        for (const seat of roots.workerHome === null ? [] : seatRoots(roots.workerHome, src.cli)) {
+            for (const name of namesIn(join(roots.workerHome, seat, src.worker), src.parse)) {
+                out.push({ name, cli: src.cli, origin: 'worker', source: `<worker home>/${seat}/${src.worker}`, managed: managed.has(name) });
+            }
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=discovery.js.map

package/dist/mcp/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/mcp/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAMjC,gDAAgD;AAChD,SAAS,QAAQ,CAAC,GAAG,IAAc;IACjC,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,IAAI,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAC;YAChF,IAAI,GAAI,IAAgC,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpG,CAAC,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,8FAA8F;IAC9F,MAAM,EAAE,GAAG,0EAA0E,CAAC;IACtF,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAWD,MAAM,OAAO,GAA0B;IACrC,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE;IAClG,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAChG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,0BAA0B,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE;IAClH,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,gCAAgC,EAAE,MAAM,EAAE,+BAA+B,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE;IAChI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,gCAAgC,EAAE,MAAM,EAAE,gCAAgC,EAAE,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE;CACpI,CAAC;AAEF,qGAAqG;AACrG,SAAS,SAAS,CAAC,UAAkB,EAAE,GAAW;IAChD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjI,CAAC;AASD,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa;IAC1C,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,kBAAkB,CAAC,KAAqB,EAAE,OAA4B;IACpF,MAAM,GAAG,GAA0B,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACzF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAoB,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1F,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChI,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/mcp/invoke.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Invoke one tool on one upstream MCP server (DES-MCP-TOOLS-001 §6 step 6).
+ *
+ * - One connection per call: connect, `tools/call`, close. The upstream is reached exactly as the
+ *   registry's probe reaches it (`transportFor`: the SDK's safe env for stdio plus the ONE variable
+ *   the secret is injected into, or the one auth header for http), so the secret is resolved and
+ *   injected here and nowhere else.
+ * - Bounded: connect and call share one deadline; a hung upstream is closed and the call fails
+ *   with the error class `timeout`.
+ * - Every failure is classified ({@link classifyUpstreamError}) so the broker can decide whether a
+ *   retry is allowed (step 7: transport errors, 429 and 5xx only) and what the call record says.
+ *
+ * A `rest` upstream is not an MCP server: its tools are single HTTP requests (`rest.ts`).
+ *
+ * The result is returned RAW: the broker scrubs it (D-2) before anything else sees it.
+ */
+import type { McpRestMapping } from '../core/types.js';
+import { type McpUpstreamConfig } from './probe.js';
+import { UpstreamCallError } from './upstream-error.js';
+/** The default per-call deadline (connect + call). */
+export declare const MCP_CALL_TIMEOUT_MS = 30000;
+export { UpstreamCallError, type UpstreamErrorClass } from './upstream-error.js';
+/** A `tools/call` result as the upstream sent it (`content`, `structuredContent?`, `isError?`, ...). */
+export type UpstreamToolResult = Record<string, unknown>;
+export type Invoker = (config: McpUpstreamConfig, secret: string | null, tool: string, args: Record<string, unknown>, timeoutMs: number, 
+/** A `rest` tool's request mapping (slice S5a); `null` for an MCP server's tool. */
+rest?: McpRestMapping | null) => Promise<UpstreamToolResult>;
+/**
+ * Classify a failure: transport errors (the connection could not be made or closed under the
+ * call), HTTP 429 and 5xx are retryable; a timeout, any other HTTP status and a JSON-RPC error the
+ * server answered are not.
+ */
+export declare function classifyUpstreamError(err: unknown): UpstreamCallError;
+/** The real invoker. */
+export declare const invokeMcpTool: Invoker;
+//# sourceMappingURL=invoke.d.ts.map

package/dist/mcp/invoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invoke.d.ts","sourceRoot":"","sources":["../../src/mcp/invoke.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAE1C,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,wGAAwG;AACxG,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEzD,MAAM,MAAM,OAAO,GAAG,CACpB,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,EAAE,MAAM;AACjB,oFAAoF;AACpF,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI,KACzB,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEjC;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,iBAAiB,CAarE;AAED,wBAAwB;AACxB,eAAO,MAAM,aAAa,EAAE,OA8B3B,CAAC"}

package/dist/mcp/invoke.js

@@ -0,0 +1,80 @@
+/**
+ * Invoke one tool on one upstream MCP server (DES-MCP-TOOLS-001 §6 step 6).
+ *
+ * - One connection per call: connect, `tools/call`, close. The upstream is reached exactly as the
+ *   registry's probe reaches it (`transportFor`: the SDK's safe env for stdio plus the ONE variable
+ *   the secret is injected into, or the one auth header for http), so the secret is resolved and
+ *   injected here and nowhere else.
+ * - Bounded: connect and call share one deadline; a hung upstream is closed and the call fails
+ *   with the error class `timeout`.
+ * - Every failure is classified ({@link classifyUpstreamError}) so the broker can decide whether a
+ *   retry is allowed (step 7: transport errors, 429 and 5xx only) and what the call record says.
+ *
+ * A `rest` upstream is not an MCP server: its tools are single HTTP requests (`rest.ts`).
+ *
+ * The result is returned RAW: the broker scrubs it (D-2) before anything else sees it.
+ */
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPError } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';
+import { transportFor } from './probe.js';
+import { invokeRestTool } from './rest.js';
+import { UpstreamCallError } from './upstream-error.js';
+/** The default per-call deadline (connect + call). */
+export const MCP_CALL_TIMEOUT_MS = 30_000;
+export { UpstreamCallError } from './upstream-error.js';
+/**
+ * Classify a failure: transport errors (the connection could not be made or closed under the
+ * call), HTTP 429 and 5xx are retryable; a timeout, any other HTTP status and a JSON-RPC error the
+ * server answered are not.
+ */
+export function classifyUpstreamError(err) {
+    if (err instanceof UpstreamCallError)
+        return err;
+    const message = err instanceof Error ? err.message : String(err);
+    if (err instanceof StreamableHTTPError) {
+        const status = typeof err.code === 'number' ? err.code : 0;
+        return new UpstreamCallError('http', status === 429 || status >= 500, message);
+    }
+    if (err instanceof McpError) {
+        if (err.code === ErrorCode.ConnectionClosed)
+            return new UpstreamCallError('transport', true, message);
+        if (err.code === ErrorCode.RequestTimeout)
+            return new UpstreamCallError('timeout', false, message);
+        return new UpstreamCallError('protocol', false, message);
+    }
+    return new UpstreamCallError('transport', true, message);
+}
+/** The real invoker. */
+export const invokeMcpTool = async (config, secret, tool, args, timeoutMs, rest = null) => {
+    if (config.kind === 'rest') {
+        // A REST tool is one pinned HTTP request, built from its allowlisted arguments (I6).
+        if (rest === null)
+            throw new UpstreamCallError('protocol', false, `${tool} has no REST mapping; test and save the server again`);
+        return invokeRestTool(config, secret, rest, args, timeoutMs);
+    }
+    const { transport, stderrTail } = transportFor(config, secret);
+    const client = new Client({ name: 'wicked-crew-mcp-broker', version: '1' }, { capabilities: {} });
+    let timer;
+    const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new UpstreamCallError('timeout', false, `timed out after ${Math.round(timeoutMs / 1000)} s`)), timeoutMs);
+    });
+    const work = (async () => {
+        await client.connect(transport);
+        return (await client.callTool({ name: tool, arguments: args }, undefined, { timeout: timeoutMs }));
+    })();
+    try {
+        return await Promise.race([work, deadline]);
+    }
+    catch (err) {
+        work.catch(() => undefined);
+        const classified = classifyUpstreamError(err);
+        const tail = stderrTail().trim();
+        throw tail === '' ? classified : new UpstreamCallError(classified.errorClass, classified.retryable, `${classified.message}; stderr: ${tail}`);
+    }
+    finally {
+        clearTimeout(timer);
+        await client.close().catch(() => undefined);
+    }
+};
+//# sourceMappingURL=invoke.js.map

package/dist/mcp/invoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invoke.js","sourceRoot":"","sources":["../../src/mcp/invoke.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AACzF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,YAAY,EAA0B,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,sDAAsD;AACtD,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C,OAAO,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAC;AAejF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,GAAG,YAAY,iBAAiB;QAAE,OAAO,GAAG,CAAC;IACjD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,IAAI,iBAAiB,CAAC,MAAM,EAAE,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,OAAO,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,IAAI,KAAM,SAAS,CAAC,gBAA2B;YAAE,OAAO,IAAI,iBAAiB,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAClH,IAAI,GAAG,CAAC,IAAI,KAAM,SAAS,CAAC,cAAyB;YAAE,OAAO,IAAI,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/G,OAAO,IAAI,iBAAiB,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,MAAM,aAAa,GAAY,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE;IACjG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,qFAAqF;QACrF,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,sDAAsD,CAAC,CAAC;QACjI,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IAClG,IAAI,KAAiC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,mBAAmB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAC1G,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,KAAK,IAAiC,EAAE;QACpD,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAuB,CAAC;IAC3H,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,EAAE,GAAG,UAAU,CAAC,OAAO,aAAa,IAAI,EAAE,CAAC,CAAC;IAChJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC,CAAC"}

package/dist/mcp/policies.d.ts

@@ -0,0 +1,110 @@
+/**
+ * MCP policies: the preview matrix and the approvals (DES-MCP-TOOLS-001 §4.5, §4.7, §8; slice S6).
+ *
+ * - **Preview.** `preview` answers what a call to each tool WOULD get, per phase role × seat × run
+ *   mode, under the policies in the store right now. It is the engine's own evaluation
+ *   (`Core.previewMcpCalls`, the same `evaluate` the broker's `evaluateMcpCall` runs) over
+ *   synthetic unit cells, and nothing is recorded. `previewUnsaved` does the same for a server
+ *   that is being added, judged as if it were saved now.
+ * - **Approvals.** An approval is an audited policy edit, never a grant. It adds a token to the
+ *   `excludes` of the ledger rules the `mcp-defaults` pack ships: `MCP-FIRST-USE` (the first use
+ *   of a server asks in every mode) and `MCP-POSTURE-WRITE` (balanced mode asks for a write until
+ *   the tool is approved). Approving a SERVER (`mcp:<server>`) approves its first use only, so its
+ *   write tools still ask in balanced mode, one by one (§4.5: a server-level grant would hide the
+ *   destructive tools behind the one read the operator tried). Approving a TOOL
+ *   (`mcp:<server>/<tool>`) approves that tool's first use and its writes. Revoking removes the
+ *   token from both. An approval never lifts an engine gate (D-1, D-5) or an explicit deny:
+ *   deny dominates in the engine.
+ * - **Withdrawal.** A saved tool whose schema changed, and a removed server, lose their approvals,
+ *   so the next call asks again (operator decision 1: first use asks, "and again when a tool's
+ *   schema changes"). A server-wide approval cannot exclude one tool, so a changed tool withdraws
+ *   the server's approval too: the server asks again on its next first use.
+ *
+ * Ledger edits are read-modify-write of one rule, so they are serialized here.
+ */
+import type { ConformanceRule, McpApprovalsResponse, McpPhaseRole, McpPolicyPreviewResponse, McpPreviewTool, McpRunMode, McpUpstreamKind } from '../core/types.js';
+import { McpRegistryError, type McpRegistry } from './registry.js';
+/**
+ * A ledger edit that failed part-way. `changed` names the rules still changed after the rollback
+ * (empty when the rollback restored them all); the route audits those before answering 502.
+ */
+export declare class McpLedgerEditError extends McpRegistryError {
+    readonly changed: string[];
+    constructor(changed: string[], message: string);
+}
+/** The first-use approvals ledger (the engine reads its `excludes`, active or retired). */
+export declare const FIRST_USE_LEDGER = "MCP-FIRST-USE";
+/** The balanced-mode write approvals ledger. */
+export declare const WRITE_LEDGER = "MCP-POSTURE-WRITE";
+/** The six seats a governed unit can run on; the matrix has one column per seat. */
+export declare const MCP_PREVIEW_SEATS: readonly ["claude", "codex", "opencode", "copilot", "pi", "agy"];
+export declare const MCP_PREVIEW_ROLES: readonly McpPhaseRole[];
+export declare const MCP_RUN_MODES: readonly McpRunMode[];
+/** The engine seam this module needs: the rule store and the preview binding. */
+export interface McpPolicyEngine {
+    listRules(): Promise<ConformanceRule[]>;
+    upsertRule(rule: ConformanceRule): Promise<void>;
+    /** `Core.previewMcpCalls`: `{calls, cells}` → `[{subject, cells}]` as JSON. */
+    previewCalls(requestJson: string): Promise<string>;
+}
+export interface McpPolicyQuery {
+    subject?: string | undefined;
+    server?: string | undefined;
+    phaseRole?: McpPhaseRole | undefined;
+    seat?: string | undefined;
+    mode?: McpRunMode | undefined;
+    phaseId?: string | undefined;
+}
+/** `mcp:<server>` or `mcp:<server>/<tool>` → its parts, or `null`. */
+export declare function parseApprovalSubject(subject: string): {
+    server: string;
+    tool: string | null;
+} | null;
+export declare class McpPolicies {
+    private readonly registry;
+    private readonly engine;
+    private chain;
+    constructor(registry: McpRegistry, engine: McpPolicyEngine);
+    preview(query: McpPolicyQuery): Promise<McpPolicyPreviewResponse>;
+    /**
+     * The matrix for a server that is being added (`POST /mcp/servers/preview`): every tool judged
+     * as if the preview were saved now, so the operator sees what would run, ask or be denied.
+     */
+    previewUnsaved(server: {
+        name: string;
+        kind: McpUpstreamKind;
+    }, tools: McpPreviewTool[]): Promise<McpPolicyPreviewResponse>;
+    approvals(): Promise<McpApprovalsResponse>;
+    /** Approve a subject (a server: first use; a tool: first use and writes). Answers the rule ids that changed. */
+    approve(subject: string): Promise<string[]>;
+    /** Revoke a subject's approval from both ledgers. 404 when neither holds it. */
+    revoke(subject: string): Promise<string[]>;
+    /** Remove every listed token from both ledgers (revoke, a changed schema, a removed server). */
+    withdraw(tokens: readonly string[]): Promise<string[]>;
+    /**
+     * The approval tokens saving `next` over the registered server of the same name withdraws: each
+     * tool whose saved schema changed, and the server's own token when any did (a server-wide
+     * approval cannot leave one tool out). Empty for a new server or an unchanged one.
+     */
+    withdrawnBySave(next: {
+        name: string;
+        tools: ReadonlyArray<{
+            name: string;
+            schemaHash: string;
+        }>;
+    }): Promise<string[]>;
+    /** Every approval token that names `server` (the server's own and each of its tools'). */
+    tokensOf(server: string): Promise<string[]>;
+    private cells;
+    private axes;
+    private judge;
+    private ledgers;
+    private approvalOf;
+    /**
+     * Apply `next` to both ledgers' `excludes`, serialized. `next` answers the new list or `null` for
+     * no change. A missing ledger refuses the edit: the pack is seeded at boot, so its absence means
+     * the store is not the engine's (fail closed, nothing half-written).
+     */
+    private edit;
+}
+//# sourceMappingURL=policies.d.ts.map

package/dist/mcp/policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../../src/mcp/policies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EACV,eAAe,EAEf,oBAAoB,EAKpB,YAAY,EAEZ,wBAAwB,EACxB,cAAc,EACd,UAAU,EAKV,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAEnE;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,gBAAgB;IAEpD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE;gBAAjB,OAAO,EAAE,MAAM,EAAE,EAC1B,OAAO,EAAE,MAAM;CAIlB;AAED,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAChD,gDAAgD;AAChD,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAEhD,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,kEAAmE,CAAC;AAClG,eAAO,MAAM,iBAAiB,EAAE,SAAS,YAAY,EAAsC,CAAC;AAC5F,eAAO,MAAM,aAAa,EAAE,SAAS,UAAU,EAAsC,CAAC;AAEtF,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,UAAU,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,+EAA+E;IAC/E,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,SAAS,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AA0BD,sEAAsE;AACtE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAOpG;AAmBD,qBAAa,WAAW;IAIpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJzB,OAAO,CAAC,KAAK,CAAuC;gBAGjC,QAAQ,EAAE,WAAW,EACrB,MAAM,EAAE,eAAe;IAKpC,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA6CvE;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,eAAe,CAAA;KAAE,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAgC3H,SAAS,IAAI,OAAO,CAAC,oBAAoB,CAAC;IAwBhD,gHAAgH;IAC1G,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBjD,gFAAgF;IAC1E,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAOhD,gGAAgG;IAC1F,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAU5D;;;;OAIG;IACG,eAAe,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,aAAa,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAqB5H,0FAA0F;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAOjD,OAAO,CAAC,KAAK;IAWb,OAAO,CAAC,IAAI;YAUE,KAAK;YAkCL,OAAO;IAerB,OAAO,CAAC,UAAU;IAOlB;;;;OAIG;IACH,OAAO,CAAC,IAAI;CA0Cb"}