@1mcp/agent 0.34.4 → 0.35.0-beta.1

package/build/domains/preset/tagAuthoring.js

@@ -0,0 +1,94 @@
+export function buildTagAuthoringQuery(states, strategy) {
+    const included = selectedTags(states, 'include');
+    const excluded = selectedTags(states, 'exclude');
+    const clauses = [];
+    if (included.length === 1)
+        clauses.push({ tag: included[0] });
+    if (included.length > 1)
+        clauses.push({ [strategy === 'or' ? '$or' : '$and']: included.map((tag) => ({ tag })) });
+    clauses.push(...excluded.map((tag) => ({ $not: { tag } })));
+    if (clauses.length === 0)
+        return {};
+    if (clauses.length === 1)
+        return clauses[0];
+    return { $and: clauses };
+}
+export function evaluateTagAuthoringQuery(query, tags) {
+    if (query.tag)
+        return tags.includes(query.tag);
+    if (query.$or)
+        return query.$or.some((clause) => evaluateTagAuthoringQuery(clause, tags));
+    if (query.$and)
+        return query.$and.every((clause) => evaluateTagAuthoringQuery(clause, tags));
+    if (query.$not)
+        return !evaluateTagAuthoringQuery(query.$not, tags);
+    if (query.$in)
+        return query.$in.some((tag) => tags.includes(tag));
+    return false;
+}
+export function parseTagAuthoringQuery(query) {
+    const states = {};
+    const parsed = parseRoot(query, states);
+    return parsed ? { strategy: parsed, states } : null;
+}
+function parseRoot(query, states) {
+    if (typeof query.tag === 'string' && Object.keys(query).length === 1) {
+        states[query.tag] = 'include';
+        return 'or';
+    }
+    if (query.$not && Object.keys(query).length === 1 && readSingleTag(query.$not)) {
+        states[readSingleTag(query.$not)] = 'exclude';
+        return 'or';
+    }
+    if (query.$or && Object.keys(query).length === 1 && readIncludedTags(query.$or, states))
+        return 'or';
+    if (query.$and && Object.keys(query).length === 1) {
+        const clauses = query.$and;
+        const inclusionClauses = clauses.filter((clause) => clause.tag || clause.$or || clause.$and);
+        const exclusionClauses = clauses.filter((clause) => clause.$not);
+        if (clauses.length !== inclusionClauses.length + exclusionClauses.length)
+            return null;
+        let strategy = 'and';
+        if (inclusionClauses.length > 1) {
+            if (!readIncludedTags(inclusionClauses, states))
+                return null;
+        }
+        else {
+            const includeClause = inclusionClauses[0];
+            if (includeClause?.tag)
+                states[includeClause.tag] = 'include';
+            else if (includeClause?.$or && readIncludedTags(includeClause.$or, states))
+                strategy = 'or';
+            else if (includeClause?.$and && readIncludedTags(includeClause.$and, states))
+                strategy = 'and';
+            else if (includeClause)
+                return null;
+        }
+        for (const clause of exclusionClauses) {
+            const tag = clause.$not ? readSingleTag(clause.$not) : null;
+            if (!tag)
+                return null;
+            states[tag] = 'exclude';
+        }
+        return strategy;
+    }
+    return Object.keys(query).length === 0 ? 'or' : null;
+}
+function readIncludedTags(clauses, states) {
+    for (const clause of clauses) {
+        const tag = readSingleTag(clause);
+        if (!tag)
+            return false;
+        states[tag] = 'include';
+    }
+    return true;
+}
+function readSingleTag(query) {
+    return typeof query.tag === 'string' && Object.keys(query).length === 1 ? query.tag : null;
+}
+function selectedTags(states, state) {
+    return Object.entries(states)
+        .filter(([, value]) => value === state)
+        .map(([tag]) => tag);
+}
+//# sourceMappingURL=tagAuthoring.js.map

package/build/domains/preset/tagAuthoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tagAuthoring.js","sourceRoot":"","sources":["../../../src/domains/preset/tagAuthoring.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,sBAAsB,CAAC,MAAyC,EAAE,QAAsB;IACtG,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,OAAO,GAAe,EAAE,CAAC;IAE/B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAClH,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAE5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAe,EAAE,IAAc;IACvE,IAAI,KAAK,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1F,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7F,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,CAAC,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAe;IACpD,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,KAAe,EAAE,MAAyC;IAC3E,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,GAAG,SAAS,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACrG,IAAI,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7F,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACtF,IAAI,QAAQ,GAAiB,KAAK,CAAC;QACnC,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,aAAa,EAAE,GAAG;gBAAE,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;iBACzD,IAAI,aAAa,EAAE,GAAG,IAAI,gBAAgB,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAC;iBACvF,IAAI,aAAa,EAAE,IAAI,IAAI,gBAAgB,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,QAAQ,GAAG,KAAK,CAAC;iBAC1F,IAAI,aAAa;gBAAE,OAAO,IAAI,CAAC;QACtC,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5D,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;QAC1B,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAmB,EAAE,MAAyC;IACtF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAe;IACpC,OAAO,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7F,CAAC;AAED,SAAS,YAAY,CAAC,MAAyC,EAAE,KAAwB;IACvF,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC"}

package/build/domains/runtime-targets/runtimeIdentityVerification.d.ts

@@ -0,0 +1,51 @@
+import type { RuntimeTargetObservedIdentity, StoredRuntimeTarget } from './runtimeTargetStore.js';
+export interface RuntimeTargetTlsOptions {
+    caFile?: string;
+    insecureSkipVerify?: boolean;
+}
+export interface RuntimeIdentityFetchResponse {
+    ok: boolean;
+    status: number;
+    headers?: {
+        get: (name: string) => string | null;
+    };
+    json: () => Promise<unknown>;
+    text?: () => Promise<string>;
+}
+export interface RuntimeIdentityFetchInit {
+    method?: string;
+    headers?: Record<string, string>;
+    credentials?: 'omit';
+    redirect?: 'follow' | 'error' | 'manual';
+    signal?: AbortSignal;
+    tls?: RuntimeTargetTlsOptions;
+    maxBodyBytes?: number;
+}
+export type RuntimeIdentityFetch = (url: string, init: RuntimeIdentityFetchInit) => Promise<RuntimeIdentityFetchResponse>;
+export interface RuntimeIdentityWarning {
+    code: 'warning_external_url_mismatch';
+    message: string;
+}
+export interface VerifiedRuntimeIdentity {
+    identity: RuntimeTargetObservedIdentity;
+    warnings: RuntimeIdentityWarning[];
+}
+export declare class RuntimeTargetIdentityError extends Error {
+    readonly code: string;
+    readonly recoveryCommand?: string | undefined;
+    constructor(code: string, message: string, recoveryCommand?: string | undefined);
+}
+export declare function fetchRuntimeIdentity(baseUrl: string, options?: {
+    fetch?: RuntimeIdentityFetch;
+} & RuntimeTargetTlsOptions): Promise<RuntimeTargetObservedIdentity>;
+export declare function verifyRuntimeIdentityForTarget(input: {
+    target: Pick<StoredRuntimeTarget, 'name' | 'url' | 'observedIdentity' | 'caFile' | 'insecureSkipVerify'>;
+    fetch?: RuntimeIdentityFetch;
+}): Promise<VerifiedRuntimeIdentity>;
+export declare function verifyNamedRemoteTargetAttachment(input: {
+    target: Pick<StoredRuntimeTarget, 'name' | 'url' | 'observedIdentity' | 'caFile' | 'insecureSkipVerify' | 'insecureTlsConfirmationRequired'>;
+    fetch?: RuntimeIdentityFetch;
+    onCredentialUseReady?: (identity: RuntimeTargetObservedIdentity) => void;
+}): Promise<VerifiedRuntimeIdentity>;
+export declare function fetchRuntimeTargetUrl(url: string, init?: RuntimeIdentityFetchInit): Promise<RuntimeIdentityFetchResponse>;
+//# sourceMappingURL=runtimeIdentityVerification.d.ts.map

package/build/domains/runtime-targets/runtimeIdentityVerification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeIdentityVerification.d.ts","sourceRoot":"","sources":["../../../src/domains/runtime-targets/runtimeIdentityVerification.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAMlG,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE;QAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACnD,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IACzC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,uBAAuB,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,oBAAoB,GAAG,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,wBAAwB,KAC3B,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAE3C,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,+BAA+B,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,6BAA6B,CAAC;IACxC,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACpC;AAED,qBAAa,0BAA2B,SAAQ,KAAK;aAEjC,IAAI,EAAE,MAAM;aAEZ,eAAe,CAAC,EAAE,MAAM;gBAFxB,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,eAAe,CAAC,EAAE,MAAM,YAAA;CAK3C;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAAG,uBAA4B,GACvE,OAAO,CAAC,6BAA6B,CAAC,CA0BxC;AAED,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,MAAM,GAAG,KAAK,GAAG,kBAAkB,GAAG,QAAQ,GAAG,oBAAoB,CAAC,CAAC;IACzG,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAoBnC;AAED,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,MAAM,EAAE,IAAI,CACV,mBAAmB,EACnB,MAAM,GAAG,KAAK,GAAG,kBAAkB,GAAG,QAAQ,GAAG,oBAAoB,GAAG,iCAAiC,CAC1G,CAAC;IACF,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,6BAA6B,KAAK,IAAI,CAAC;CAC1E,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAWnC;AAED,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,4BAA4B,CAAC,CAcvC"}

package/build/domains/runtime-targets/runtimeIdentityVerification.js

@@ -0,0 +1,258 @@
+import fs from 'node:fs';
+import http from 'node:http';
+import https from 'node:https';
+const RUNTIME_IDENTITY_PATH = '/.well-known/1mcp/runtime-identity';
+const DEFAULT_RUNTIME_IDENTITY_TIMEOUT_MS = 5_000;
+const DEFAULT_RUNTIME_IDENTITY_MAX_BODY_BYTES = 128 * 1024;
+export class RuntimeTargetIdentityError extends Error {
+    code;
+    recoveryCommand;
+    constructor(code, message, recoveryCommand) {
+        super(message);
+        this.code = code;
+        this.recoveryCommand = recoveryCommand;
+        this.name = 'RuntimeTargetIdentityError';
+    }
+}
+export async function fetchRuntimeIdentity(baseUrl, options = {}) {
+    const fetchImpl = options.fetch ?? fetchRuntimeTargetUrl;
+    const tls = normalizeTlsOptions(options);
+    const response = await fetchImpl(new URL(RUNTIME_IDENTITY_PATH, baseUrl).toString(), {
+        method: 'GET',
+        headers: { Accept: 'application/json' },
+        credentials: 'omit',
+        signal: createRuntimeIdentityTimeoutSignal(),
+        maxBodyBytes: DEFAULT_RUNTIME_IDENTITY_MAX_BODY_BYTES,
+        ...(tls ? { tls } : {}),
+    });
+    if (!response.ok) {
+        throw new RuntimeTargetIdentityError('identity_unreachable', `Runtime identity endpoint returned HTTP ${response.status}`);
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        throw new RuntimeTargetIdentityError('identity_invalid', 'Runtime identity endpoint did not return JSON');
+    }
+    return parseRuntimeIdentity(body);
+}
+export async function verifyRuntimeIdentityForTarget(input) {
+    const identity = await fetchRuntimeIdentity(input.target.url, {
+        fetch: input.fetch,
+        caFile: input.target.caFile,
+        insecureSkipVerify: input.target.insecureSkipVerify,
+    });
+    const expectedRuntimeScopeId = input.target.observedIdentity?.runtimeScopeId;
+    if (expectedRuntimeScopeId && expectedRuntimeScopeId !== identity.runtimeScopeId) {
+        throw new RuntimeTargetIdentityError('identity_runtime_scope_mismatch', 'Runtime target identity changed; refusing to use stored credentials', `1mcp target add ${input.target.name} ${input.target.url} --replace --accept-new-identity`);
+    }
+    return {
+        identity,
+        warnings: externalUrlWarnings(input.target.url, identity),
+    };
+}
+export async function verifyNamedRemoteTargetAttachment(input) {
+    if (input.target.insecureTlsConfirmationRequired) {
+        throw new RuntimeTargetIdentityError('target_insecure_tls_confirmation_required', 'Runtime target uses imported insecure TLS metadata and requires confirmation before credentialed attach', `1mcp target verify ${input.target.name} --accept-insecure-tls`);
+    }
+    const result = await verifyRuntimeIdentityForTarget({ target: input.target, fetch: input.fetch });
+    input.onCredentialUseReady?.(result.identity);
+    return result;
+}
+export async function fetchRuntimeTargetUrl(url, init = {}) {
+    if (hasTlsBehavior(init.tls)) {
+        return nodeFetchRuntimeTargetUrl(url, init);
+    }
+    if (typeof globalThis.fetch === 'function') {
+        const { tls: _tls, maxBodyBytes: _maxBodyBytes, ...fetchInit } = init;
+        const response = await globalThis.fetch(url, fetchInit);
+        return init.maxBodyBytes === undefined
+            ? response
+            : boundedFetchResponse(response, init.maxBodyBytes);
+    }
+    return nodeFetchRuntimeTargetUrl(url, init);
+}
+async function nodeFetchRuntimeTargetUrl(url, init) {
+    const parsed = new URL(url);
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new RuntimeTargetIdentityError('identity_url_invalid', 'Runtime target URL must use http or https');
+    }
+    const requestOptions = {
+        method: init.method ?? 'GET',
+        headers: init.headers,
+        signal: init.signal,
+    };
+    if (parsed.protocol === 'https:') {
+        if (init.tls?.caFile) {
+            requestOptions.ca = readCaFile(init.tls.caFile);
+        }
+        if (init.tls?.insecureSkipVerify) {
+            requestOptions.rejectUnauthorized = false;
+        }
+    }
+    const client = parsed.protocol === 'https:' ? https : http;
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const request = client.request(parsed, requestOptions, (response) => {
+            const chunks = [];
+            let receivedBytes = 0;
+            response.on('data', (chunk) => {
+                if (settled) {
+                    return;
+                }
+                const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                receivedBytes += buffer.byteLength;
+                if (receivedBytes > (init.maxBodyBytes ?? DEFAULT_RUNTIME_IDENTITY_MAX_BODY_BYTES)) {
+                    settled = true;
+                    request.destroy();
+                    reject(new RuntimeTargetIdentityError('identity_response_too_large', 'Runtime identity endpoint response exceeded the maximum size'));
+                    return;
+                }
+                chunks.push(buffer);
+            });
+            response.on('end', () => {
+                if (settled) {
+                    return;
+                }
+                settled = true;
+                resolve(bufferedResponse(response.statusCode ?? 0, response.headers, Buffer.concat(chunks)));
+            });
+        });
+        request.on('error', (error) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            reject(error);
+        });
+        request.end();
+    });
+}
+function bufferedResponse(status, headers, body) {
+    return {
+        ok: status >= 200 && status < 300,
+        status,
+        headers: {
+            get: (name) => {
+                const value = headers[name.toLowerCase()];
+                return Array.isArray(value) ? value.join(', ') : (value ?? null);
+            },
+        },
+        json: async () => JSON.parse(body.toString('utf8')),
+        text: async () => body.toString('utf8'),
+    };
+}
+async function boundedFetchResponse(response, maxBodyBytes) {
+    const body = await readBoundedFetchBody(response, maxBodyBytes);
+    return {
+        ok: response.ok,
+        status: response.status,
+        headers: {
+            get: (name) => response.headers.get(name),
+        },
+        json: async () => JSON.parse(body.toString('utf8')),
+        text: async () => body.toString('utf8'),
+    };
+}
+async function readBoundedFetchBody(response, maxBodyBytes) {
+    if (!response.body) {
+        const body = Buffer.from(await response.arrayBuffer());
+        if (body.byteLength > maxBodyBytes) {
+            throwResponseTooLarge();
+        }
+        return body;
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let receivedBytes = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done) {
+                return Buffer.concat(chunks);
+            }
+            const chunk = Buffer.from(value);
+            receivedBytes += chunk.byteLength;
+            if (receivedBytes > maxBodyBytes) {
+                await reader.cancel();
+                throwResponseTooLarge();
+            }
+            chunks.push(chunk);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+function throwResponseTooLarge() {
+    throw new RuntimeTargetIdentityError('identity_response_too_large', 'Runtime identity endpoint response exceeded the maximum size');
+}
+function readCaFile(caFile) {
+    try {
+        return fs.readFileSync(caFile);
+    }
+    catch {
+        throw new RuntimeTargetIdentityError('target_ca_file_unreadable', `Runtime target CA bundle path "${caFile}" could not be read`);
+    }
+}
+function hasTlsBehavior(tls) {
+    return Boolean(tls?.caFile || tls?.insecureSkipVerify);
+}
+function normalizeTlsOptions(tls) {
+    const normalized = omitUndefined({
+        caFile: tls.caFile,
+        insecureSkipVerify: tls.insecureSkipVerify,
+    });
+    return hasTlsBehavior(normalized) ? normalized : undefined;
+}
+function createRuntimeIdentityTimeoutSignal() {
+    return typeof AbortSignal.timeout === 'function'
+        ? AbortSignal.timeout(DEFAULT_RUNTIME_IDENTITY_TIMEOUT_MS)
+        : undefined;
+}
+function parseRuntimeIdentity(body) {
+    if (!isRecord(body)) {
+        throw new RuntimeTargetIdentityError('identity_invalid', 'Runtime identity response must be an object');
+    }
+    const identity = {
+        identityProtocolVersion: body.identityProtocolVersion,
+        runtimeScopeId: body.runtimeScopeId,
+        externalUrl: body.externalUrl,
+        runtimeVersion: body.runtimeVersion,
+        serverTime: body.serverTime,
+    };
+    if (identity.identityProtocolVersion !== '1' ||
+        typeof identity.runtimeScopeId !== 'string' ||
+        identity.runtimeScopeId.length === 0 ||
+        typeof identity.externalUrl !== 'string' ||
+        identity.externalUrl.length === 0 ||
+        typeof identity.runtimeVersion !== 'string' ||
+        identity.runtimeVersion.length === 0) {
+        throw new RuntimeTargetIdentityError('identity_invalid', 'Runtime identity response is missing required fields');
+    }
+    return {
+        identityProtocolVersion: '1',
+        runtimeScopeId: identity.runtimeScopeId,
+        externalUrl: identity.externalUrl,
+        runtimeVersion: identity.runtimeVersion,
+        serverTime: typeof identity.serverTime === 'string' ? identity.serverTime : undefined,
+    };
+}
+function externalUrlWarnings(configuredUrl, identity) {
+    return configuredUrl.replace(/\/$/, '') === identity.externalUrl.replace(/\/$/, '')
+        ? []
+        : [
+            {
+                code: 'warning_external_url_mismatch',
+                message: `Runtime identity externalUrl "${identity.externalUrl}" differs from configured URL "${configuredUrl}"`,
+            },
+        ];
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function omitUndefined(value) {
+    return Object.fromEntries(Object.entries(value).filter(([, entryValue]) => entryValue !== undefined));
+}
+//# sourceMappingURL=runtimeIdentityVerification.js.map

package/build/domains/runtime-targets/runtimeIdentityVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeIdentityVerification.js","sourceRoot":"","sources":["../../../src/domains/runtime-targets/runtimeIdentityVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAI/B,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AACnE,MAAM,mCAAmC,GAAG,KAAK,CAAC;AAClD,MAAM,uCAAuC,GAAG,GAAG,GAAG,IAAI,CAAC;AAwC3D,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAEjC;IAEA;IAHlB,YACkB,IAAY,EAC5B,OAAe,EACC,eAAwB;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAQ;QAEZ,oBAAe,GAAf,eAAe,CAAS;QAGxC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,UAAsE,EAAE;IAExE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,qBAAqB,CAAC;IACzD,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QACnF,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,kCAAkC,EAAE;QAC5C,YAAY,EAAE,uCAAuC;QACrD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,0BAA0B,CAClC,sBAAsB,EACtB,2CAA2C,QAAQ,CAAC,MAAM,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,EAAE,+CAA+C,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAGpD;IACC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;QAC5D,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;QAC3B,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,kBAAkB;KACpD,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAE7E,IAAI,sBAAsB,IAAI,sBAAsB,KAAK,QAAQ,CAAC,cAAc,EAAE,CAAC;QACjF,MAAM,IAAI,0BAA0B,CAClC,iCAAiC,EACjC,qEAAqE,EACrE,mBAAmB,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,kCAAkC,CAC3F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAOvD;IACC,IAAI,KAAK,CAAC,MAAM,CAAC,+BAA+B,EAAE,CAAC;QACjD,MAAM,IAAI,0BAA0B,CAClC,2CAA2C,EAC3C,yGAAyG,EACzG,sBAAsB,KAAK,CAAC,MAAM,CAAC,IAAI,wBAAwB,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAClG,KAAK,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAW,EACX,OAAiC,EAAE;IAEnC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,SAAwB,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,YAAY,KAAK,SAAS;YACpC,CAAC,CAAE,QAAyC;YAC5C,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,GAAW,EACX,IAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,0BAA0B,CAAC,sBAAsB,EAAE,2CAA2C,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,cAAc,GAAyB;QAC3C,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;QAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;YACrB,cAAc,CAAC,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC;YACjC,cAAc,CAAC,kBAAkB,GAAG,KAAK,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE;YAClE,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;gBAC7C,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnE,aAAa,IAAI,MAAM,CAAC,UAAU,CAAC;gBACnC,IAAI,aAAa,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,uCAAuC,CAAC,EAAE,CAAC;oBACnF,OAAO,GAAG,IAAI,CAAC;oBACf,OAAO,CAAC,OAAO,EAAE,CAAC;oBAClB,MAAM,CACJ,IAAI,0BAA0B,CAC5B,6BAA6B,EAC7B,8DAA8D,CAC/D,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACtB,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC/F,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAc,EACd,OAAiC,EACjC,IAAY;IAEZ,OAAO;QACL,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QACjC,MAAM;QACN,OAAO,EAAE;YACP,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE;gBACpB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;YACnE,CAAC;SACF;QACD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY;QAC9D,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,QAAkB,EAAE,YAAoB;IAC1E,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE;YACP,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;SAClD;QACD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY;QAC9D,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,QAAkB,EAAE,YAAoB;IAC1E,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,UAAU,GAAG,YAAY,EAAE,CAAC;YACnC,qBAAqB,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;YAClC,IAAI,aAAa,GAAG,YAAY,EAAE,CAAC;gBACjC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,qBAAqB,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,IAAI,0BAA0B,CAClC,6BAA6B,EAC7B,8DAA8D,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0BAA0B,CAClC,2BAA2B,EAC3B,kCAAkC,MAAM,qBAAqB,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAwC;IAC9D,OAAO,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA4B;IACvD,MAAM,UAAU,GAAG,aAAa,CAAC;QAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;KAC3C,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,kCAAkC;IACzC,OAAO,OAAO,WAAW,CAAC,OAAO,KAAK,UAAU;QAC9C,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,mCAAmC,CAAC;QAC1D,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAa;IACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,EAAE,6CAA6C,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,QAAQ,GAAG;QACf,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;IAEF,IACE,QAAQ,CAAC,uBAAuB,KAAK,GAAG;QACxC,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ;QAC3C,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QACpC,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;QACxC,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QACjC,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ;QAC3C,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EACpC,CAAC;QACD,MAAM,IAAI,0BAA0B,CAAC,kBAAkB,EAAE,sDAAsD,CAAC,CAAC;IACnH,CAAC;IAED,OAAO;QACL,uBAAuB,EAAE,GAAG;QAC5B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,UAAU,EAAE,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KACtF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,aAAqB,EAAE,QAAuC;IACzF,OAAO,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACjF,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,iCAAiC,QAAQ,CAAC,WAAW,kCAAkC,aAAa,GAAG;aACjH;SACF,CAAC;AACR,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAoC,KAAQ;IAChE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,CAAM,CAAC;AAC7G,CAAC"}

package/build/domains/runtime-targets/runtimeTargetStore.d.ts

@@ -0,0 +1,222 @@
+export interface RuntimeTargetObservedIdentity {
+    identityProtocolVersion: '1';
+    runtimeScopeId: string;
+    externalUrl: string;
+    runtimeVersion: string;
+    serverTime?: string;
+}
+export interface RuntimeTargetStoreOptions {
+    storeDir?: string;
+    now?: () => Date;
+}
+export interface PrepareAddTargetInput {
+    name: string;
+    url: string;
+    displayName?: string;
+    caFile?: string;
+    insecureSkipVerify?: boolean;
+    use?: boolean;
+}
+export interface PreparedRuntimeTargetAdd {
+    name: string;
+    url: string;
+    displayName?: string;
+    caFile?: string;
+    insecureSkipVerify?: boolean;
+    use: boolean;
+}
+export interface RuntimeTargetCredentialReferences {
+    oauth?: unknown;
+    adminSession?: unknown;
+}
+export interface ReplaceVerifiedRuntimeTargetInput {
+    name: string;
+    url: string;
+    observedIdentity: RuntimeTargetObservedIdentity;
+    displayName?: string;
+    caFile?: string;
+    insecureSkipVerify?: boolean;
+    acceptNewIdentity?: boolean;
+}
+export interface UpdateObservedIdentityResult {
+    target: RuntimeTargetListEntry;
+    warnings: Array<{
+        code: 'warning_external_url_mismatch';
+        message: string;
+    }>;
+}
+export type RuntimeTargetIdentityVerifier = (context: {
+    targetName: string;
+    url: string;
+    caFile?: string;
+    insecureSkipVerify?: boolean;
+    storeLocked: boolean;
+}) => RuntimeTargetObservedIdentity | Promise<RuntimeTargetObservedIdentity>;
+export interface StoredRuntimeTarget {
+    name: string;
+    url: string;
+    displayName?: string;
+    caFile?: string;
+    insecureSkipVerify?: boolean;
+    insecureTlsConfirmationRequired?: boolean;
+    observedIdentity?: RuntimeTargetObservedIdentity;
+    lastVerifiedAt?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface RuntimeTargetListEntry {
+    name: string;
+    kind: 'local' | 'remote';
+    synthetic: boolean;
+    current: boolean;
+    url?: string;
+    displayName?: string;
+    caFile?: string;
+    insecureSkipVerify?: boolean;
+    insecureTlsConfirmationRequired?: boolean;
+    observedIdentity?: RuntimeTargetObservedIdentity;
+    lastVerifiedAt?: string;
+    verificationStatus: 'synthetic' | 'verified' | 'stale' | 'never-verified';
+    credentialReferences: {
+        oauth: boolean;
+        adminSession: boolean;
+    };
+}
+export interface RuntimeTargetUseResult {
+    target: RuntimeTargetListEntry;
+    warnings: Array<{
+        code: 'warning_target_stale' | 'warning_target_never_verified';
+        message: string;
+    }>;
+}
+export interface RuntimeTargetBundleEntry {
+    name: string;
+    url: string;
+    displayName?: string;
+    caFile?: string;
+    insecureSkipVerify?: boolean;
+    observedIdentity?: RuntimeTargetObservedIdentity;
+    lastVerifiedAt?: string;
+}
+export interface RuntimeTargetExportBundle {
+    targetBundleVersion: 1;
+    targets: RuntimeTargetBundleEntry[];
+}
+export interface RuntimeTargetImportAddition extends RuntimeTargetBundleEntry {
+}
+export interface RuntimeTargetImportWarning {
+    code: 'warning_missing_ca_file' | 'warning_insecure_tls_confirmation_required';
+    targetName: string;
+    message: string;
+}
+export interface RuntimeTargetImportValidationFact {
+    code: 'invalid_bundle_version' | 'invalid_bundle_schema' | 'invalid_target_entry' | 'invalid_target_name' | 'reserved_local_target' | 'duplicate_bundle_entry' | 'target_name_conflict' | 'invalid_url' | 'invalid_display_name' | 'invalid_tls_metadata' | 'invalid_observed_identity' | 'invalid_last_verified_at';
+    targetName?: string;
+    message: string;
+}
+export interface RuntimeTargetImportResult {
+    additions: RuntimeTargetImportAddition[];
+    validationFacts: RuntimeTargetImportValidationFact[];
+    warnings: RuntimeTargetImportWarning[];
+}
+export type RuntimeTargetInsecureTlsOperation = 'use' | 'verify' | 'credentialed-attach';
+export interface RuntimeTargetDoctorIssue {
+    code: 'metadata_parse_failed' | 'metadata_schema_invalid' | 'secrets_parse_failed' | 'secrets_schema_invalid' | 'current_context_missing' | 'reserved_local_stored_target' | 'orphaned_credentials' | 'secret_store_insecure_permissions';
+    targetName?: string;
+    message: string;
+}
+export interface RuntimeTargetDoctorRepair {
+    code: 'fixed_secret_store_permissions' | 'pruned_orphaned_credentials';
+    targetName?: string;
+    message: string;
+}
+export interface RuntimeTargetDoctorResult {
+    issues: RuntimeTargetDoctorIssue[];
+    repairs: RuntimeTargetDoctorRepair[];
+}
+export declare class RuntimeTargetStoreError extends Error {
+    readonly code: string;
+    readonly details?: unknown | undefined;
+    readonly recoveryCommand?: string | undefined;
+    constructor(code: string, message: string, details?: unknown | undefined, recoveryCommand?: string | undefined);
+}
+export declare class RuntimeTargetStore {
+    private static readonly activeLocks;
+    private readonly storeDir;
+    private readonly now;
+    static defaultStoreDir(): string;
+    constructor(options?: RuntimeTargetStoreOptions);
+    current(): RuntimeTargetListEntry;
+    resolveForConnection(name?: string): RuntimeTargetListEntry;
+    list(): RuntimeTargetListEntry[];
+    inspect(name: string): RuntimeTargetListEntry;
+    useTarget(name: string, options?: {
+        acceptInsecureTls?: boolean;
+    }): RuntimeTargetUseResult;
+    requireInsecureTlsConfirmation(input: {
+        name: string;
+        operation: RuntimeTargetInsecureTlsOperation;
+        acceptInsecureTls?: boolean;
+    }): RuntimeTargetListEntry;
+    deleteTarget(name: string, options?: {
+        force?: boolean;
+    }): void;
+    renameTarget(sourceName: string, destinationName: string): RuntimeTargetListEntry;
+    setCredentialReferences(name: string, runtimeScopeId: string, references: RuntimeTargetCredentialReferences): void;
+    setOAuthTokenReference(name: string, runtimeScopeId: string, oauth: unknown): void;
+    getOAuthTokenReference(name: string, runtimeScopeId: string): unknown | undefined;
+    clearOAuthTokenReference(name: string, runtimeScopeId: string): void;
+    clearLocalOAuthTokenReferences(): number;
+    clearLocalAdminSessionReferences(): number;
+    setAdminSessionReference(name: string, runtimeScopeId: string, adminSession: unknown): void;
+    getAdminSessionReference(name: string, runtimeScopeId: string): unknown | undefined;
+    clearAdminSessionReference(name: string, runtimeScopeId: string): void;
+    replaceVerifiedTarget(input: ReplaceVerifiedRuntimeTargetInput): RuntimeTargetListEntry;
+    updateObservedIdentityMetadata(name: string, observedIdentity: RuntimeTargetObservedIdentity): UpdateObservedIdentityResult;
+    prepareAddTarget(input: PrepareAddTargetInput): PreparedRuntimeTargetAdd;
+    commitVerifiedAdd(prepared: PreparedRuntimeTargetAdd, observedIdentity: RuntimeTargetObservedIdentity): RuntimeTargetListEntry;
+    addVerifiedTarget(input: PrepareAddTargetInput, verifier: RuntimeTargetIdentityVerifier): Promise<RuntimeTargetListEntry>;
+    exportTargetBundle(): RuntimeTargetExportBundle;
+    previewImportTargetBundle(bundle: unknown, options?: {
+        caFileExists?: (caFile: string) => boolean;
+    }): RuntimeTargetImportResult;
+    importTargetBundle(bundle: unknown, options?: {
+        caFileExists?: (caFile: string) => boolean;
+    }): RuntimeTargetImportResult;
+    doctor(options?: {
+        fixSecrets?: boolean;
+        pruneOrphans?: boolean;
+    }): RuntimeTargetDoctorResult;
+    private validateImportBundle;
+    private confirmInsecureTlsIfRequired;
+    private inspectMetadataFileForDoctor;
+    private inspectSecretsFileForDoctor;
+    private localEntry;
+    private toListEntry;
+    private verificationStatus;
+    private readMetadata;
+    private readSecretsForMetadataOnly;
+    private readSecretsForCredentialUse;
+    private readSecretsUnchecked;
+    private writeMetadata;
+    private writeSecrets;
+    private writeSecretsThenMetadata;
+    private withLock;
+    private acquireLock;
+    private metadataPath;
+    private secretsPath;
+    private lockPath;
+    private isLockedInThisProcess;
+    private clearLocalCredentialReferences;
+}
+export declare function validateRuntimeTargetName(name: string): string;
+export declare function normalizeDisplayName(displayName: string | undefined): string | undefined;
+export declare function assertRuntimeTargetConfigDirAllowed(input: {
+    command: 'target-store' | 'verify';
+    targetName: string;
+    configDir?: string;
+}): void;
+export declare function normalizeRuntimeTargetUrl(url: string, options?: {
+    allowInsecureHttp?: boolean;
+}): string;
+//# sourceMappingURL=runtimeTargetStore.d.ts.map