refactor(core): migrate to Bun and converge acquisition policies and Agent boundaries

apps/server/src/modules/mcp/index.ts

@@ -1,5 +1,5 @@
 import { featureManifest } from "@umt/contracts";
-import denoJson from "../../../deno.json" with { type: "json" };
+import packageJson from "../../../package.json" with { type: "json" };
 import type { ServerModule } from "../types.ts";
 import { createMcpConfigStore } from "./config-store.ts";
 import { registerMcpRoutes } from "./routes.ts";
@@ -20,7 +20,7 @@ export function createMcpModule(opts: { version?: string } = {}): ServerModule &
       registerMcpRoutes(app, ctx, {
         table,
         config: createMcpConfigStore(() => ctx.db),
-        version: opts.version ?? denoJson.version,
+        version: opts.version ?? packageJson.version,
       });
     },
     registerTasks() {},

apps/server/src/modules/mcp/sessions.ts

@@ -3,6 +3,7 @@ import type { Server } from "@modelcontextprotocol/sdk/server/index.js";
 // @ts-types="@modelcontextprotocol/sdk/server/webStandardStreamableHttp"
 import type { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import type { McpSessionInfo } from "@umt/contracts";
+import { runtimeUnrefTimer } from "@umt/runtime";
 
 // MCP 会话表(进程内):会话与建立它的 API Key 绑定,换 Key 复用会话一律拒绝。
 // 空闲超时回收;每个 Key 的会话数与每分钟工具调用数有上限。
@@ -128,6 +129,6 @@ export class McpSessionTable {
     this.timer = setInterval(() => void this.sweep(), 60_000);
     // 不因为回收定时器挂住进程退出
     (this.timer as unknown as { unref?: () => void }).unref?.();
-    if (typeof Deno !== "undefined") Deno.unrefTimer(this.timer as unknown as number);
+    runtimeUnrefTimer(this.timer as unknown as number);
   }
 }

apps/server/src/modules/mcp/stats.ts

@@ -13,7 +13,7 @@ import {
 } from "@umt/contracts";
 import { type DB, type Kysely, sql } from "@umt/db";
 import { z } from "zod";
-import { GRANT_ACTIONS } from "../agent/authorize.ts";
+import { GRANT_ACTIONS } from "../../authorization/grants.ts";
 import type { SettingsReader } from "../types.ts";
 
 // 能力调用统计与能力清单。统计口径是 audit_event(registry.invoke 每次调用都写一条,含只读能力与拒绝);