@agentlogin/mcp 0.0.0-stage → 0.2.0-beta.1

package/dist/catalog.d.ts

@@ -0,0 +1,365 @@
+import { z } from 'zod';
+export declare const CatalogSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    kind: z.ZodEnum<{
+        applications: "applications";
+        providers: "providers";
+    }>;
+    updatedAt: z.ZodString;
+    entries: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodLiteral<"provider">;
+        issuer: z.ZodString;
+        handleDomains: z.ZodArray<z.ZodString>;
+        protocol: z.ZodOptional<z.ZodLiteral<"agent-login">>;
+        specRevision: z.ZodString;
+        evidence: z.ZodArray<z.ZodObject<{
+            protocol: z.ZodOptional<z.ZodLiteral<"agent-login">>;
+            revision: z.ZodString;
+            kind: z.ZodEnum<{
+                domain_control: "domain_control";
+                protocol_test: "protocol_test";
+                independent_interop: "independent_interop";
+                operational_review: "operational_review";
+            }>;
+            url: z.ZodString;
+            observedAt: z.ZodString;
+            expiresAt: z.ZodString;
+            reviewer: z.ZodString;
+        }, z.core.$strict>>;
+        id: z.ZodString;
+        name: z.ZodString;
+        operator: z.ZodString;
+        homepage: z.ZodString;
+        status: z.ZodEnum<{
+            candidate: "candidate";
+            reviewed: "reviewed";
+            suspended: "suspended";
+        }>;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        protocol: z.ZodLiteral<"agentid">;
+        protocolReference: z.ZodString;
+        evidence: z.ZodArray<z.ZodObject<{
+            protocol: z.ZodLiteral<"agentid">;
+            reference: z.ZodString;
+            kind: z.ZodEnum<{
+                domain_control: "domain_control";
+                protocol_test: "protocol_test";
+                independent_interop: "independent_interop";
+                operational_review: "operational_review";
+            }>;
+            url: z.ZodString;
+            observedAt: z.ZodString;
+            expiresAt: z.ZodString;
+            reviewer: z.ZodString;
+        }, z.core.$strict>>;
+        kind: z.ZodLiteral<"provider">;
+        issuer: z.ZodString;
+        handleDomains: z.ZodArray<z.ZodString>;
+        id: z.ZodString;
+        name: z.ZodString;
+        operator: z.ZodString;
+        homepage: z.ZodString;
+        status: z.ZodEnum<{
+            candidate: "candidate";
+            reviewed: "reviewed";
+            suspended: "suspended";
+        }>;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        clientType: z.ZodDefault<z.ZodLiteral<"open">>;
+        clientId: z.ZodString;
+        kind: z.ZodLiteral<"application">;
+        initiateLoginUri: z.ZodString;
+        protocol: z.ZodOptional<z.ZodLiteral<"agent-login">>;
+        specRevision: z.ZodString;
+        evidence: z.ZodArray<z.ZodObject<{
+            protocol: z.ZodOptional<z.ZodLiteral<"agent-login">>;
+            revision: z.ZodString;
+            kind: z.ZodEnum<{
+                domain_control: "domain_control";
+                protocol_test: "protocol_test";
+                independent_interop: "independent_interop";
+                operational_review: "operational_review";
+            }>;
+            url: z.ZodString;
+            observedAt: z.ZodString;
+            expiresAt: z.ZodString;
+            reviewer: z.ZodString;
+        }, z.core.$strict>>;
+        id: z.ZodString;
+        name: z.ZodString;
+        operator: z.ZodString;
+        homepage: z.ZodString;
+        status: z.ZodEnum<{
+            candidate: "candidate";
+            reviewed: "reviewed";
+            suspended: "suspended";
+        }>;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        clientType: z.ZodLiteral<"registered">;
+        clientId: z.ZodString;
+        issuer: z.ZodString;
+        kind: z.ZodLiteral<"application">;
+        initiateLoginUri: z.ZodString;
+        protocol: z.ZodOptional<z.ZodLiteral<"agent-login">>;
+        specRevision: z.ZodString;
+        evidence: z.ZodArray<z.ZodObject<{
+            protocol: z.ZodOptional<z.ZodLiteral<"agent-login">>;
+            revision: z.ZodString;
+            kind: z.ZodEnum<{
+                domain_control: "domain_control";
+                protocol_test: "protocol_test";
+                independent_interop: "independent_interop";
+                operational_review: "operational_review";
+            }>;
+            url: z.ZodString;
+            observedAt: z.ZodString;
+            expiresAt: z.ZodString;
+            reviewer: z.ZodString;
+        }, z.core.$strict>>;
+        id: z.ZodString;
+        name: z.ZodString;
+        operator: z.ZodString;
+        homepage: z.ZodString;
+        status: z.ZodEnum<{
+            candidate: "candidate";
+            reviewed: "reviewed";
+            suspended: "suspended";
+        }>;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>]>>;
+}, z.core.$strict>;
+export type Catalog = z.infer<typeof CatalogSchema>;
+/** Editor schema; protocol URL and cross-record checks remain in CatalogSchema. */
+export declare function catalogJsonSchema(): z.core.ZodStandardJSONSchemaPayload<z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    kind: z.ZodEnum<{
+        applications: "applications";
+        providers: "providers";
+    }>;
+    updatedAt: z.ZodString;
+    entries: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodLiteral<"provider">;
+        issuer: z.ZodString;
+        handleDomains: z.ZodArray<z.ZodString>;
+        protocol: z.ZodOptional<z.ZodLiteral<"agent-login">>;
+        specRevision: z.ZodString;
+        evidence: z.ZodArray<z.ZodObject<{
+            protocol: z.ZodOptional<z.ZodLiteral<"agent-login">>;
+            revision: z.ZodString;
+            kind: z.ZodEnum<{
+                domain_control: "domain_control";
+                protocol_test: "protocol_test";
+                independent_interop: "independent_interop";
+                operational_review: "operational_review";
+            }>;
+            url: z.ZodString;
+            observedAt: z.ZodString;
+            expiresAt: z.ZodString;
+            reviewer: z.ZodString;
+        }, z.core.$strict>>;
+        id: z.ZodString;
+        name: z.ZodString;
+        operator: z.ZodString;
+        homepage: z.ZodString;
+        status: z.ZodEnum<{
+            candidate: "candidate";
+            reviewed: "reviewed";
+            suspended: "suspended";
+        }>;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        protocol: z.ZodLiteral<"agentid">;
+        protocolReference: z.ZodString;
+        evidence: z.ZodArray<z.ZodObject<{
+            protocol: z.ZodLiteral<"agentid">;
+            reference: z.ZodString;
+            kind: z.ZodEnum<{
+                domain_control: "domain_control";
+                protocol_test: "protocol_test";
+                independent_interop: "independent_interop";
+                operational_review: "operational_review";
+            }>;
+            url: z.ZodString;
+            observedAt: z.ZodString;
+            expiresAt: z.ZodString;
+            reviewer: z.ZodString;
+        }, z.core.$strict>>;
+        kind: z.ZodLiteral<"provider">;
+        issuer: z.ZodString;
+        handleDomains: z.ZodArray<z.ZodString>;
+        id: z.ZodString;
+        name: z.ZodString;
+        operator: z.ZodString;
+        homepage: z.ZodString;
+        status: z.ZodEnum<{
+            candidate: "candidate";
+            reviewed: "reviewed";
+            suspended: "suspended";
+        }>;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        clientType: z.ZodDefault<z.ZodLiteral<"open">>;
+        clientId: z.ZodString;
+        kind: z.ZodLiteral<"application">;
+        initiateLoginUri: z.ZodString;
+        protocol: z.ZodOptional<z.ZodLiteral<"agent-login">>;
+        specRevision: z.ZodString;
+        evidence: z.ZodArray<z.ZodObject<{
+            protocol: z.ZodOptional<z.ZodLiteral<"agent-login">>;
+            revision: z.ZodString;
+            kind: z.ZodEnum<{
+                domain_control: "domain_control";
+                protocol_test: "protocol_test";
+                independent_interop: "independent_interop";
+                operational_review: "operational_review";
+            }>;
+            url: z.ZodString;
+            observedAt: z.ZodString;
+            expiresAt: z.ZodString;
+            reviewer: z.ZodString;
+        }, z.core.$strict>>;
+        id: z.ZodString;
+        name: z.ZodString;
+        operator: z.ZodString;
+        homepage: z.ZodString;
+        status: z.ZodEnum<{
+            candidate: "candidate";
+            reviewed: "reviewed";
+            suspended: "suspended";
+        }>;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        clientType: z.ZodLiteral<"registered">;
+        clientId: z.ZodString;
+        issuer: z.ZodString;
+        kind: z.ZodLiteral<"application">;
+        initiateLoginUri: z.ZodString;
+        protocol: z.ZodOptional<z.ZodLiteral<"agent-login">>;
+        specRevision: z.ZodString;
+        evidence: z.ZodArray<z.ZodObject<{
+            protocol: z.ZodOptional<z.ZodLiteral<"agent-login">>;
+            revision: z.ZodString;
+            kind: z.ZodEnum<{
+                domain_control: "domain_control";
+                protocol_test: "protocol_test";
+                independent_interop: "independent_interop";
+                operational_review: "operational_review";
+            }>;
+            url: z.ZodString;
+            observedAt: z.ZodString;
+            expiresAt: z.ZodString;
+            reviewer: z.ZodString;
+        }, z.core.$strict>>;
+        id: z.ZodString;
+        name: z.ZodString;
+        operator: z.ZodString;
+        homepage: z.ZodString;
+        status: z.ZodEnum<{
+            candidate: "candidate";
+            reviewed: "reviewed";
+            suspended: "suspended";
+        }>;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>]>>;
+}, z.core.$strict>>;
+export declare function readCatalog(file: string): Catalog;
+/** Listings are information, never automatic enrollment, endpoint pinning or issuer acceptance. */
+export declare function catalogView(catalogs: Catalog[], now?: number): ({
+    protocol: "agent-login" | "agentid";
+    effectiveStatus: string;
+    automaticTrust: boolean;
+    kind: "provider";
+    issuer: string;
+    handleDomains: string[];
+    specRevision: string;
+    evidence: {
+        revision: string;
+        kind: "domain_control" | "protocol_test" | "independent_interop" | "operational_review";
+        url: string;
+        observedAt: string;
+        expiresAt: string;
+        reviewer: string;
+        protocol?: "agent-login" | undefined;
+    }[];
+    id: string;
+    name: string;
+    operator: string;
+    homepage: string;
+    status: "candidate" | "reviewed" | "suspended";
+    updatedAt: string;
+} | {
+    protocol: "agent-login" | "agentid";
+    effectiveStatus: string;
+    automaticTrust: boolean;
+    protocolReference: string;
+    evidence: {
+        protocol: "agentid";
+        reference: string;
+        kind: "domain_control" | "protocol_test" | "independent_interop" | "operational_review";
+        url: string;
+        observedAt: string;
+        expiresAt: string;
+        reviewer: string;
+    }[];
+    kind: "provider";
+    issuer: string;
+    handleDomains: string[];
+    id: string;
+    name: string;
+    operator: string;
+    homepage: string;
+    status: "candidate" | "reviewed" | "suspended";
+    updatedAt: string;
+} | {
+    protocol: "agent-login" | "agentid";
+    effectiveStatus: string;
+    automaticTrust: boolean;
+    clientType: "open";
+    clientId: string;
+    kind: "application";
+    initiateLoginUri: string;
+    specRevision: string;
+    evidence: {
+        revision: string;
+        kind: "domain_control" | "protocol_test" | "independent_interop" | "operational_review";
+        url: string;
+        observedAt: string;
+        expiresAt: string;
+        reviewer: string;
+        protocol?: "agent-login" | undefined;
+    }[];
+    id: string;
+    name: string;
+    operator: string;
+    homepage: string;
+    status: "candidate" | "reviewed" | "suspended";
+    updatedAt: string;
+} | {
+    protocol: "agent-login" | "agentid";
+    effectiveStatus: string;
+    automaticTrust: boolean;
+    clientType: "registered";
+    clientId: string;
+    issuer: string;
+    kind: "application";
+    initiateLoginUri: string;
+    specRevision: string;
+    evidence: {
+        revision: string;
+        kind: "domain_control" | "protocol_test" | "independent_interop" | "operational_review";
+        url: string;
+        observedAt: string;
+        expiresAt: string;
+        reviewer: string;
+        protocol?: "agent-login" | undefined;
+    }[];
+    id: string;
+    name: string;
+    operator: string;
+    homepage: string;
+    status: "candidate" | "reviewed" | "suspended";
+    updatedAt: string;
+})[];

package/dist/catalog.js

@@ -0,0 +1,126 @@
+import { readFileSync } from 'node:fs';
+import { isIP } from 'node:net';
+import { z } from 'zod';
+import { identifier } from './config.js';
+function httpsUrl(value) {
+    try {
+        const u = new URL(value);
+        if (u.protocol !== 'https:' || !/^https:\/\/[^/?#]+(?:[/?#]|$)/i.test(value) || u.username || u.password || value.includes('#') || /[\\\x00-\x20\x7f]/.test(value) || /^https:\/\/[^/?#]*@/i.test(value))
+            return;
+        return u;
+    }
+    catch {
+        return;
+    }
+}
+// z.string().url() trims inputs; identifiers here must retain exact string identity.
+const https = z.string().refine((value) => Boolean(httpsUrl(value)), 'Use HTTPS without credentials or a fragment').meta({ format: 'uri' });
+const issuerIdentifier = https.refine((value) => !value.includes('?'), 'Issuer identifiers cannot contain a query');
+const openClientId = https.refine((value) => {
+    const u = httpsUrl(value);
+    const path = /^https:\/\/[^/?#]+(\/[^?#]*)/i.exec(value)?.[1];
+    return Boolean(u && !isIP(u.hostname.replace(/^\[|\]$/g, '')) && path &&
+        !path.split('/').some((segment) => /^(?:\.|%2e){1,2}$/i.test(segment)));
+}, 'Use a Client ID Metadata Document URL with a domain and a path, without dot path segments');
+const instant = z.string().datetime({ offset: true });
+const evidenceFields = {
+    kind: z.enum(['domain_control', 'protocol_test', 'independent_interop', 'operational_review']),
+    url: https,
+    observedAt: instant,
+    expiresAt: instant,
+    reviewer: z.string().min(1).max(200),
+};
+const evidenceDates = (e) => Date.parse(e.observedAt) < Date.parse(e.expiresAt);
+const coreEvidence = z.object({
+    ...evidenceFields,
+    protocol: z.literal('agent-login').optional(),
+    revision: z.string().regex(/^[a-f0-9]{40}$/),
+}).strict().refine(evidenceDates, 'Evidence expiry must follow observation');
+const agentIdEvidence = z.object({
+    ...evidenceFields,
+    protocol: z.literal('agentid'),
+    reference: https,
+}).strict().refine(evidenceDates, 'Evidence expiry must follow observation');
+const common = {
+    id: identifier,
+    name: z.string().min(1).max(128),
+    operator: z.string().min(1).max(200),
+    homepage: https,
+    status: z.enum(['candidate', 'reviewed', 'suspended']),
+    updatedAt: instant,
+};
+const coreFields = {
+    ...common,
+    // Legacy records omit protocol; that continues to mean Agent Login Core.
+    protocol: z.literal('agent-login').optional(),
+    specRevision: z.string().regex(/^[a-f0-9]{40}$/),
+    evidence: z.array(coreEvidence).max(20),
+};
+const providerFields = {
+    kind: z.literal('provider'), issuer: issuerIdentifier,
+    handleDomains: z.array(z.string().regex(/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/)).min(1).max(128),
+};
+const provider = z.object({ ...coreFields, ...providerFields }).strict();
+const agentIdProvider = z.object({
+    ...common, ...providerFields,
+    protocol: z.literal('agentid'),
+    protocolReference: https,
+    evidence: z.array(agentIdEvidence).max(20),
+}).strict();
+const applicationFields = { ...coreFields, kind: z.literal('application'), initiateLoginUri: https };
+const openApplication = z.object({ ...applicationFields, clientType: z.literal('open').default('open'), clientId: openClientId }).strict();
+const registeredApplication = z.object({
+    ...applicationFields,
+    clientType: z.literal('registered'),
+    clientId: z.string().min(1).max(2048).regex(/^[\x20-\x7e]+$/, 'Use the exact opaque registered client identifier'),
+    issuer: issuerIdentifier,
+}).strict();
+export const CatalogSchema = z.object({
+    version: z.literal(1),
+    kind: z.enum(['providers', 'applications']),
+    updatedAt: instant,
+    entries: z.array(z.union([provider, agentIdProvider, openApplication, registeredApplication])).max(10_000),
+}).strict().superRefine((c, ctx) => {
+    const ids = new Set();
+    const subjects = new Set();
+    for (const [index, e] of c.entries.entries()) {
+        const issue = (message) => ctx.addIssue({ code: 'custom', path: ['entries', index], message });
+        if ((c.kind === 'providers') !== (e.kind === 'provider'))
+            issue('Catalog kind does not match entry');
+        const subject = e.kind === 'provider' ? JSON.stringify(['provider', e.issuer])
+            : e.clientType === 'registered' ? JSON.stringify(['registered', e.issuer, e.clientId])
+                : JSON.stringify(['open', e.clientId]);
+        if (ids.has(e.id) || subjects.has(subject))
+            issue('Duplicate identifier or subject');
+        ids.add(e.id);
+        subjects.add(subject);
+        if (e.protocol === 'agentid') {
+            if (e.evidence.some((v) => v.reference !== e.protocolReference))
+                issue('AgentID evidence must refer to the listed protocol reference');
+        }
+        else if (e.evidence.some((v) => v.revision !== e.specRevision))
+            issue('Evidence must refer to the listed specification revision');
+        if (e.status === 'reviewed' && !['domain_control', 'protocol_test'].every((kind) => e.evidence.some((v) => v.kind === kind)))
+            issue('Reviewed entries require domain-control and protocol-test evidence');
+    }
+});
+/** Editor schema; protocol URL and cross-record checks remain in CatalogSchema. */
+export function catalogJsonSchema() {
+    return z.toJSONSchema(CatalogSchema, { io: 'input' });
+}
+export function readCatalog(file) {
+    const data = readFileSync(file);
+    if (data.length > 2 * 1024 * 1024)
+        throw new Error('Catalog exceeds 2 MiB');
+    return CatalogSchema.parse(JSON.parse(data.toString('utf8')));
+}
+/** Listings are information, never automatic enrollment, endpoint pinning or issuer acceptance. */
+export function catalogView(catalogs, now = Date.now()) {
+    return catalogs.flatMap((catalog) => catalog.entries.map((entry) => ({
+        ...entry,
+        protocol: entry.protocol ?? 'agent-login',
+        effectiveStatus: entry.status === 'reviewed' && entry.evidence.some((e) => Date.parse(e.observedAt) > now || Date.parse(e.expiresAt) <= now) ? 'review_expired' : entry.status,
+        automaticTrust: false,
+    })));
+}
+//# sourceMappingURL=catalog.js.map

package/dist/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO;QACjN,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;AACrB,CAAC;AACD,qFAAqF;AACrF,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,6CAA6C,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5I,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,2CAA2C,CAAC,CAAC;AACpH,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;IAC1C,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI;QACnE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC,EAAE,2FAA2F,CAAC,CAAC;AAChG,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,MAAM,cAAc,GAAG;IACrB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,eAAe,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAC9F,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,OAAO;IACnB,SAAS,EAAE,OAAO;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACrC,CAAC;AACF,MAAM,aAAa,GAAG,CAAC,CAA4C,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC3H,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,GAAG,cAAc;IACjB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,yCAAyC,CAAC,CAAC;AAC7E,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,GAAG,cAAc;IACjB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC9B,SAAS,EAAE,KAAK;CACjB,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,yCAAyC,CAAC,CAAC;AAC7E,MAAM,MAAM,GAAG;IACb,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,QAAQ,EAAE,KAAK;IACf,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACtD,SAAS,EAAE,OAAO;CACnB,CAAC;AACF,MAAM,UAAU,GAAG;IACjB,GAAG,MAAM;IACT,yEAAyE;IACzE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC7C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAChD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACxC,CAAC;AACF,MAAM,cAAc,GAAG;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,gBAAgB;IACrD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC9I,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzE,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,GAAG,MAAM,EAAE,GAAG,cAAc;IAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC9B,iBAAiB,EAAE,KAAK;IACxB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,iBAAiB,GAAG,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;AACrG,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3I,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,iBAAiB;IACpB,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,gBAAgB,EAAE,mDAAmD,CAAC;IAClH,MAAM,EAAE,gBAAgB;CACzB,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC3C,SAAS,EAAE,OAAO;IAClB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;CAC3G,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACjC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvG,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;YAAE,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACrG,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACtF,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,iBAAiB,CAAC;gBAAE,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACzI,CAAC;aAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,YAAY,CAAC;YAAE,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACpI,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAAE,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAC5M,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,mFAAmF;AACnF,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC5E,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,WAAW,CAAC,QAAmB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC/D,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnE,GAAG,KAAK;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,aAAa;QACzC,eAAe,EAAE,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM;QAC9K,cAAc,EAAE,KAAK;KACtB,CAAC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1 @@
+export declare function main(args?: string[]): Promise<void>;

package/dist/cli.js

@@ -0,0 +1,48 @@
+import { serveStdio } from '@modelcontextprotocol/server/stdio';
+import { readPrivateConfig } from './config.js';
+import { readCatalog, catalogView } from './catalog.js';
+import { LoginRuntime } from './runtime.js';
+import { createServer } from './server.js';
+import { acquireStateLease } from './private-state.js';
+export async function main(args = process.argv.slice(2)) {
+    if (args.includes('--help')) {
+        process.stdout.write('Usage: agentlogin-mcp [--config /absolute/config.json]\n       agentlogin-mcp --check-config /absolute/config.json\n       agentlogin-mcp --check-catalog /absolute/catalog.json\n\nThe local stdio helper uses AGENTLOGIN_MCP_CONFIG when --config is absent.\nIt never reads credentials from tool arguments.\n');
+        return;
+    }
+    try {
+        if (args[0] === '--check-catalog' && args.length === 2) {
+            const catalog = readCatalog(args[1]);
+            process.stdout.write(JSON.stringify({ valid: true, kind: catalog.kind, entries: catalogView([catalog]).length }) + '\n');
+            return;
+        }
+        const checking = args[0] === '--check-config';
+        if (args.length && !((args[0] === '--config' || checking) && args.length === 2))
+            throw new Error('Invalid arguments; use --help');
+        const file = args[1] ?? process.env.AGENTLOGIN_MCP_CONFIG;
+        if (!file)
+            throw new Error('Set AGENTLOGIN_MCP_CONFIG to an operator-owned config file; see --help');
+        const config = readPrivateConfig(file);
+        const runtime = new LoginRuntime(config);
+        if (checking) {
+            process.stdout.write('Configuration valid. No network requests made.\n');
+            return;
+        }
+        const release = acquireStateLease(config.stateDirectory);
+        const handle = serveStdio(() => {
+            const server = createServer(runtime);
+            // Closing the local host ends pending work too. Release only as this process exits;
+            // another helper must never overlap a still-running background sign-in.
+            server.server.onclose = () => { release(); process.exit(0); };
+            return server;
+        });
+        process.once('exit', release);
+        for (const signal of ['SIGTERM', 'SIGINT'])
+            process.once(signal, () => { void handle.close().finally(() => { release(); process.exit(0); }); });
+    }
+    catch {
+        // Config validation may include a mistakenly pasted secret. Never print exception values.
+        process.stderr.write('agentlogin-mcp: configuration or startup failed. Check the private config, catalog schemas, and state-directory lock; use --help.\n');
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mTAAmT,CAAC,CAAC;QAC1U,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,iBAAiB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAAC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACpO,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC;QAC9C,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAClI,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAC1D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnG,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACrC,oFAAoF;YACpF,wEAAwE;YACxE,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAU;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3J,CAAC;IAAC,MAAM,CAAC;QACP,0FAA0F;QAC1F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qIAAqI,CAAC,CAAC;QAC5J,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+export declare const identifier: z.ZodString;
+export declare const ConfigSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    stateDirectory: z.ZodString;
+    developmentLoopback: z.ZodDefault<z.ZodBoolean>;
+    signInTimeoutSeconds: z.ZodDefault<z.ZodNumber>;
+    identities: z.ZodRecord<z.ZodString, z.ZodObject<{
+        handle: z.ZodString;
+        issuer: z.ZodOptional<z.ZodString>;
+        ownerPortal: z.ZodOptional<z.ZodString>;
+        ownerApprovalPath: z.ZodOptional<z.ZodString>;
+        enrollmentEndpoint: z.ZodOptional<z.ZodString>;
+        enrollmentCredentialEnv: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    applications: z.ZodRecord<z.ZodString, z.ZodObject<{
+        name: z.ZodString;
+        origin: z.ZodString;
+        loginPath: z.ZodString;
+        sessionCheck: z.ZodObject<{
+            path: z.ZodString;
+            handlePointer: z.ZodString;
+            issuerPointer: z.ZodString;
+            subjectPointer: z.ZodString;
+        }, z.core.$strict>;
+        logoutPath: z.ZodOptional<z.ZodString>;
+        operations: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+            description: z.ZodString;
+            method: z.ZodEnum<{
+                GET: "GET";
+                POST: "POST";
+                PUT: "PUT";
+                PATCH: "PATCH";
+                DELETE: "DELETE";
+            }>;
+            path: z.ZodString;
+            inputFields: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            queryFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            output: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+    catalogFiles: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type Config = z.infer<typeof ConfigSchema>;
+export type Application = Config['applications'][string];
+export type Identity = Config['identities'][string];
+export declare function checkedUrl(value: string, developmentLoopback?: boolean): URL;
+export declare function parseConfig(value: unknown): Config;
+export declare const sensitiveName: (name: string) => boolean;
+/** Open first and inspect the descriptor, so replacement with a symbolic link cannot race validation. */
+export declare function readPrivateConfig(file: string): Config;
+export declare function atPointer(value: unknown, pointer: string): unknown;