@akira-tl/forgerelay 1.1.2 → 1.2.0

package/dist/runtime/config/external-mcp-auth-store.js

@@ -13,10 +13,7 @@ export class ExternalMcpCredentialStore {
         this.filePath = join(this.configDir, AUTH_FILE_NAME);
     }
     read(identity) {
-        const record = this.readFile().credentials[credentialKey(identity)];
-        if (!record || !sameIdentity(record.identity, identity))
-            return undefined;
-        return cloneRecord(record);
+        return findCredential(this.readFile(), identity);
     }
     inspect() {
         const exists = existsSync(this.filePath);
@@ -33,7 +30,7 @@ export class ExternalMcpCredentialStore {
                 revision: randomUUID(),
                 updatedAt: new Date().toISOString(),
             };
-            file.credentials[credentialKey(identity)] = written;
+            file.credentials[credentialKey(identity)] = persistedRecord(written);
         });
         return cloneRecord(written);
     }
@@ -41,11 +38,10 @@ export class ExternalMcpCredentialStore {
         let written;
         await this.updateFile((file) => {
             const key = credentialKey(identity);
-            const existing = file.credentials[key];
-            const current = existing && sameIdentity(existing.identity, identity) ? cloneRecord(existing) : undefined;
+            const current = findCredential(file, identity);
             const next = update(current);
             if (!next) {
-                delete file.credentials[key];
+                deleteMatchingCredentials(file, identity);
                 written = undefined;
                 return;
             }
@@ -56,19 +52,14 @@ export class ExternalMcpCredentialStore {
                 revision: randomUUID(),
                 updatedAt: new Date().toISOString(),
             };
-            file.credentials[key] = written;
+            file.credentials[key] = persistedRecord(written);
         });
         return written ? cloneRecord(written) : undefined;
     }
     async remove(identity) {
         let removed = false;
         await this.updateFile((file) => {
-            const key = credentialKey(identity);
-            const existing = file.credentials[key];
-            if (!existing || !sameIdentity(existing.identity, identity))
-                return;
-            delete file.credentials[key];
-            removed = true;
+            removed = deleteMatchingCredentials(file, identity);
         });
         return removed;
     }
@@ -101,10 +92,18 @@ export class ExternalMcpCredentialStore {
         }, { mode: 0o600 });
     }
 }
-export function externalMcpCredentialIdentity(source, server, projectRoot) {
-    return source === "project"
-        ? { kind: "project", server, projectRoot: resolve(projectRoot) }
-        : { kind: "global", server };
+export function externalMcpCredentialIdentity(source, server, project) {
+    if (source === "legacy" || source === "global")
+        return { kind: "global", server };
+    if (!project || typeof project === "string" || !project.id) {
+        throw new Error(`External MCP ${source} credential identity requires a Project ID.`);
+    }
+    return {
+        kind: "project",
+        server,
+        projectId: project.id,
+        ...(project.projectRoot ? { legacyProjectRoot: resolve(project.projectRoot) } : {}),
+    };
 }
 export function credentialKey(identity) {
     const normalized = normalizeIdentity(identity);
@@ -116,20 +115,85 @@ function credentialKeyHash(identity) {
     const normalized = normalizeIdentity(identity);
     const material = normalized.kind === "global"
         ? `global\0${normalized.server}`
-        : `project\0${normalized.projectRoot}\0${normalized.server}`;
+        : `project-id\0${normalized.projectId}\0${normalized.server}`;
     return createHash("sha256").update(material).digest("hex");
 }
+function legacyCredentialKey(server, projectRoot) {
+    const normalizedRoot = resolve(projectRoot);
+    const hash = createHash("sha256").update(`project\0${normalizedRoot}\0${server}`).digest("hex");
+    return `project:${hash}:${server}`;
+}
 function normalizeIdentity(identity) {
     return identity.kind === "project"
-        ? { kind: "project", server: identity.server, projectRoot: resolve(identity.projectRoot) }
+        ? {
+            kind: "project",
+            server: identity.server,
+            projectId: identity.projectId,
+            ...(identity.legacyProjectRoot ? { legacyProjectRoot: resolve(identity.legacyProjectRoot) } : {}),
+        }
         : { kind: "global", server: identity.server };
 }
-function sameIdentity(left, right) {
-    const a = normalizeIdentity(left);
-    const b = normalizeIdentity(right);
-    return a.kind === b.kind
-        && a.server === b.server
-        && (a.kind === "global" || (b.kind === "project" && a.projectRoot === b.projectRoot));
+function storedIdentity(identity) {
+    const normalized = normalizeIdentity(identity);
+    return normalized.kind === "project"
+        ? { kind: "project", server: normalized.server, projectId: normalized.projectId }
+        : normalized;
+}
+function persistedIdentityMatches(persisted, requested) {
+    const normalized = normalizeIdentity(requested);
+    if (normalized.kind === "global") {
+        return persisted.kind === "global" && persisted.server === normalized.server;
+    }
+    return persisted.kind === "project"
+        && "projectId" in persisted
+        && persisted.server === normalized.server
+        && persisted.projectId === normalized.projectId;
+}
+function legacyIdentityMatches(persisted, requested) {
+    return persisted.kind === "project"
+        && "projectRoot" in persisted
+        && persisted.server === requested.server
+        && requested.legacyProjectRoot !== undefined
+        && resolve(persisted.projectRoot) === resolve(requested.legacyProjectRoot);
+}
+function findCredential(file, identity) {
+    const normalized = normalizeIdentity(identity);
+    const primary = file.credentials[credentialKey(normalized)];
+    if (primary && persistedIdentityMatches(primary.identity, normalized)) {
+        return publicRecord(primary, normalized);
+    }
+    if (normalized.kind !== "project" || !normalized.legacyProjectRoot)
+        return undefined;
+    const legacy = file.credentials[legacyCredentialKey(normalized.server, normalized.legacyProjectRoot)];
+    if (!legacy || !legacyIdentityMatches(legacy.identity, normalized))
+        return undefined;
+    return publicRecord(legacy, normalized);
+}
+function deleteMatchingCredentials(file, identity) {
+    const normalized = normalizeIdentity(identity);
+    let removed = false;
+    const key = credentialKey(normalized);
+    const primary = file.credentials[key];
+    if (primary && persistedIdentityMatches(primary.identity, normalized)) {
+        delete file.credentials[key];
+        removed = true;
+    }
+    if (normalized.kind === "project" && normalized.legacyProjectRoot) {
+        const legacyKey = legacyCredentialKey(normalized.server, normalized.legacyProjectRoot);
+        const legacy = file.credentials[legacyKey];
+        if (legacy && legacyIdentityMatches(legacy.identity, normalized)) {
+            delete file.credentials[legacyKey];
+            removed = true;
+        }
+    }
+    return removed;
+}
+function persistedRecord(record) {
+    return { ...cloneRecord(record), identity: storedIdentity(record.identity) };
+}
+function publicRecord(record, identity) {
+    const { identity: _persistedIdentity, ...rest } = cloneRecord(record);
+    return { ...rest, identity: normalizeIdentity(identity) };
 }
 function emptyAuthFile() {
     return { version: AUTH_FILE_VERSION, credentials: {} };
@@ -167,7 +231,7 @@ function parseCredentialRecord(value, filePath) {
     }
     const reauthorization = parseReauthorization(value.reauthorization, filePath);
     return {
-        identity: normalizeIdentity(value.identity),
+        identity: normalizePersistedIdentity(value.identity),
         serverUrl: value.serverUrl,
         revision: value.revision,
         updatedAt: value.updatedAt,
@@ -205,7 +269,19 @@ function isCredentialIdentity(value) {
         return false;
     if (value.kind === "global")
         return true;
-    return value.kind === "project" && typeof value.projectRoot === "string" && Boolean(value.projectRoot);
+    if (value.kind !== "project")
+        return false;
+    const hasProjectId = typeof value.projectId === "string" && Boolean(value.projectId);
+    const hasProjectRoot = typeof value.projectRoot === "string" && Boolean(value.projectRoot);
+    return hasProjectId !== hasProjectRoot;
+}
+function normalizePersistedIdentity(identity) {
+    if (identity.kind === "global")
+        return { kind: "global", server: identity.server };
+    if ("projectId" in identity) {
+        return { kind: "project", server: identity.server, projectId: identity.projectId };
+    }
+    return { kind: "project", server: identity.server, projectRoot: resolve(identity.projectRoot) };
 }
 function cloneRecord(value) {
     return structuredClone(value);

package/dist/runtime/config/external-mcp-config.js

@@ -1,5 +1,44 @@
+import * as z from "zod/v4";
 const MCP_SERVER_NAME_PATTERN = /^[a-z][a-z0-9._-]{0,63}$/;
 const MAX_MCP_SERVERS = 32;
+const nonEmptyStringSchema = z.string().trim().min(1);
+const stringRecordSchema = z.record(z.string(), z.string());
+const httpUrlSchema = z.string().url().refine((value) => {
+    const protocol = new URL(value).protocol;
+    return protocol === "http:" || protocol === "https:";
+}, "URL must use http or https.");
+const clientMetadataUrlSchema = z.string().url().refine((value) => {
+    const parsed = new URL(value);
+    return parsed.protocol === "https:" && parsed.pathname !== "/";
+}, "clientMetadataUrl must use https and contain a non-root path.");
+const oauthSourceSchema = z.object({
+    clientMetadataUrl: clientMetadataUrlSchema,
+    callbackPort: z.number().int().min(1024).max(65535),
+}).strict();
+const stdioSourceSchema = z.object({
+    transport: z.literal("stdio"),
+    command: nonEmptyStringSchema,
+    args: z.array(z.string()).optional(),
+    env: stringRecordSchema.optional(),
+    cwd: nonEmptyStringSchema.optional(),
+    disabled: z.literal(false).optional(),
+}).strict();
+const httpSourceSchema = z.object({
+    transport: z.literal("streamable-http"),
+    url: httpUrlSchema,
+    headers: stringRecordSchema.optional(),
+    oauth: oauthSourceSchema.optional(),
+    disabled: z.literal(false).optional(),
+}).strict();
+const disabledSourceSchema = z.object({ disabled: z.literal(true) }).strict();
+export const externalMcpStandaloneServerSchema = z.union([
+    disabledSourceSchema,
+    stdioSourceSchema,
+    httpSourceSchema,
+]);
+export const externalMcpStandaloneServersSchema = z.record(z.string().regex(MCP_SERVER_NAME_PATTERN, "Use a lowercase stable server name."), externalMcpStandaloneServerSchema).refine((value) => Object.keys(value).length <= MAX_MCP_SERVERS, {
+    message: `servers may contain at most ${MAX_MCP_SERVERS} configured servers.`,
+});
 export function parseExternalMcpServers(value) {
     return parseServerRegistry(value, "mcpServers", false);
 }

package/dist/runtime/config/external-mcp-registry.js

@@ -1,48 +1,122 @@
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { parseExternalMcpStandaloneConfig, } from "./external-mcp-config.js";
-const MISSING_FINGERPRINT = "missing";
+import { externalMcpConfigDefinition } from "./definition/external-mcp.js";
+import { parseExternalMcpServers, parseExternalMcpStandaloneConfig, } from "./external-mcp-config.js";
+import { refreshLegacyUserConfigField } from "./resolution/project-sources.js";
+import { resolveConfigDomain } from "./resolution/resolver.js";
+import { ConfigSourceRuntime } from "./runtime/source-refresh.js";
+import { projectExecutionRequirement } from "../security/project-execution-trust.js";
+const CANONICAL_PRIORITY = 100;
+const LEGACY_PRIORITY = 0;
 const MAX_DIAGNOSTIC_LENGTH = 320;
+const LEGACY_DEPRECATION = {
+    since: "1.2.0",
+    removeIn: "1.4.0",
+    replacement: "mcp.json",
+};
 export class ExternalMcpConfigRegistry {
     configDir;
-    legacyServers;
+    environment;
+    sourceRuntime;
     onDiagnostic;
-    global;
-    projects = new Map();
     constructor(options) {
         this.configDir = resolve(options.configDir);
-        this.legacyServers = { ...(options.legacyServers ?? {}) };
+        this.environment = options.environment ?? process.env;
+        this.sourceRuntime = options.sourceRuntime ?? new ConfigSourceRuntime();
         this.onDiagnostic = options.onDiagnostic;
     }
-    resolve(workspaceRoot) {
-        const projectRoot = resolve(workspaceRoot);
-        const global = this.loadGlobalSource();
-        const projectPath = join(projectRoot, ".forgerelay", "mcp.json");
-        const project = this.loadDynamicSource("project", projectPath, this.projects.get(projectRoot));
-        this.projects.set(projectRoot, project);
-        return this.composeSnapshot(global, project);
+    resolve(project) {
+        const dynamicSources = this.projectSources(project.sharedConfigDir, project.localConfigDir);
+        return this.composeSnapshot(dynamicSources, this.composeResolution(dynamicSources), project.id);
     }
     resolveGlobal() {
-        return this.composeSnapshot(this.loadGlobalSource());
+        const dynamicSources = this.projectSources();
+        return this.composeSnapshot(dynamicSources, this.composeResolution(dynamicSources));
     }
-    loadGlobalSource() {
-        const globalPath = join(this.configDir, "mcp.json");
-        this.global = this.loadDynamicSource("global", globalPath, this.global);
-        return this.global;
+    /** Internal Config v2 inspection seam. Resolved values may contain secrets; callers must use provenance for display. */
+    resolveConfiguration(input = {}) {
+        const dynamicSources = this.projectSources(input.projectSharedConfigDir, input.projectLocalConfigDir);
+        return this.composeResolution(dynamicSources);
     }
-    composeSnapshot(global, project) {
-        const servers = { ...this.legacyServers };
-        const origins = Object.fromEntries(Object.keys(this.legacyServers).map((name) => [name, "legacy"]));
+    projectSources(projectSharedConfigDir, projectLocalConfigDir) {
+        return [
+            this.loadCanonicalSource("global", "user", join(this.configDir, "mcp.json")),
+            ...(projectSharedConfigDir
+                ? [this.loadCanonicalSource("project", "project", join(projectSharedConfigDir, "mcp.json"))]
+                : []),
+            ...(projectLocalConfigDir
+                ? [this.loadCanonicalSource("project-local", "project-local", join(projectLocalConfigDir, "mcp.json"))]
+                : []),
+        ];
+    }
+    composeResolution(dynamicSources) {
+        const sourceInputs = [];
+        const legacy = this.loadLegacyInlineSource();
+        if (legacy.source)
+            sourceInputs.push(legacy.source);
+        for (const dynamic of dynamicSources) {
+            const input = dynamicSourceInput(dynamic);
+            if (input)
+                sourceInputs.push(input);
+        }
+        const resolution = resolveConfigDomain({
+            definition: externalMcpConfigDefinition,
+            sources: sourceInputs,
+            environment: this.environment,
+        });
+        if (legacy.diagnostic)
+            resolution.diagnostics.push(legacy.diagnostic);
+        for (const dynamic of dynamicSources) {
+            if (!dynamic.diagnostic || !dynamic.status.usingLastKnownGood)
+                continue;
+            const source = dynamic.status.source;
+            if (source === "legacy")
+                continue;
+            resolution.diagnostics.push({
+                severity: "error",
+                code: dynamic.diagnostic.code,
+                source: {
+                    id: sourceId(source),
+                    scope: scopeForSource(source),
+                    kind: "file",
+                    location: dynamic.status.path,
+                    priority: CANONICAL_PRIORITY,
+                },
+                message: dynamic.diagnostic.message,
+                usingLastKnownGood: true,
+                diagnosticChanged: dynamic.diagnosticChanged,
+            });
+        }
+        return resolution;
+    }
+    composeSnapshot(dynamicSources, resolution, projectId) {
+        const normalized = normalizeResolvedServers(resolution);
+        const origins = {};
+        const executionRequirements = {};
         const masked = {};
-        applySource(servers, origins, masked, global.entries, "global");
-        if (project)
-            applySource(servers, origins, masked, project.entries, "project");
-        const diagnostics = [global.diagnostic, project?.diagnostic]
-            .filter((entry) => entry !== undefined);
+        for (const [entryName, entry] of Object.entries(resolution.entries)) {
+            if (!entryName.startsWith("servers."))
+                continue;
+            const name = entryName.slice("servers.".length);
+            const source = sourceFromId(entry.effective.source.id);
+            if (entry.tombstone) {
+                if (source !== "legacy")
+                    masked[name] = source;
+            }
+            else if (name in normalized) {
+                origins[name] = source;
+                const requirement = projectId ? projectExecutionRequirement({
+                    projectId, resolution, entryKey: entryName,
+                    display: { kind: "external-mcp", name },
+                }) : undefined;
+                if (requirement)
+                    executionRequirements[name] = requirement;
+            }
+        }
+        const diagnostics = mergeDiagnostics(resolution.diagnostics.map(configDiagnostic), []);
         return {
-            servers,
+            servers: normalized,
             origins,
+            executionRequirements,
             masked,
             sources: [
                 {
@@ -51,99 +125,203 @@ export class ExternalMcpConfigRegistry {
                     state: "valid",
                     usingLastKnownGood: false,
                 },
-                global.status,
-                ...(project ? [project.status] : []),
+                ...dynamicSources.map((source) => source.status),
             ],
             diagnostics,
         };
     }
-    loadDynamicSource(source, path, previous) {
-        let content;
-        try {
-            content = readFileSync(path, "utf8");
-        }
-        catch (error) {
-            if (isMissingFileError(error)) {
-                if (previous?.observedFingerprint === MISSING_FINGERPRINT)
-                    return previous;
+    loadLegacyInlineSource() {
+        const path = join(this.configDir, "config.json");
+        const refreshed = refreshLegacyUserConfigField({
+            sourceRuntime: this.sourceRuntime,
+            configDir: this.configDir,
+            field: "mcpServers",
+            parse: (value) => value === undefined ? undefined : parseExternalMcpServers(value),
+            invalidMessage: "Legacy inline External MCP configuration is invalid.",
+        });
+        if (refreshed.status.state === "missing")
+            return {};
+        const source = refreshed.value === undefined ? undefined : {
+            id: "legacy:user:mcpServers",
+            scope: "user",
+            kind: "file",
+            location: path,
+            priority: LEGACY_PRIORITY,
+            value: { servers: refreshed.value },
+            deprecation: LEGACY_DEPRECATION,
+        };
+        if (refreshed.status.state !== "invalid" || !refreshed.issue)
+            return source ? { source } : {};
+        if (refreshed.issueScope === "container")
+            return source ? { source } : {};
+        const diagnostic = {
+            severity: "error",
+            code: refreshed.issue.code,
+            source: source ? {
+                id: source.id,
+                scope: source.scope,
+                kind: source.kind,
+                ...(source.location ? { location: source.location } : {}),
+                priority: source.priority,
+            } : {
+                id: "legacy:user:mcpServers",
+                scope: "user",
+                kind: "file",
+                location: path,
+                priority: LEGACY_PRIORITY,
+            },
+            message: refreshed.issue.message,
+            usingLastKnownGood: refreshed.status.usingLastKnownGood,
+            diagnosticChanged: refreshed.status.diagnosticChanged,
+        };
+        if (refreshed.status.diagnosticChanged)
+            this.onDiagnostic?.(configDiagnostic(diagnostic));
+        if (source)
+            return { source, diagnostic };
+        return {
+            source: {
+                id: "legacy:user:mcpServers",
+                scope: "user",
+                kind: "file",
+                location: path,
+                priority: LEGACY_PRIORITY,
+                deprecation: LEGACY_DEPRECATION,
+                error: { code: refreshed.issue.code, message: refreshed.issue.message },
+            },
+        };
+    }
+    loadCanonicalSource(source, scope, path) {
+        const refreshed = this.sourceRuntime.refreshFile({
+            key: `external-mcp:${source}:${path}`,
+            path,
+            parse: (content) => JSON.parse(content),
+            parseIssue: {
+                code: "invalid_source",
+                message: "Configuration source is not valid JSON.",
+            },
+            readIssue: {
+                code: "invalid_source",
+                message: "Configuration source could not be read.",
+            },
+            validate: (value) => {
+                const validation = resolveConfigDomain({
+                    definition: externalMcpConfigDefinition,
+                    sources: [canonicalSourceInput(source, scope, path, value)],
+                    environment: this.environment,
+                });
+                const error = validation.diagnostics.find((diagnostic) => diagnostic.severity === "error");
+                if (!error)
+                    return undefined;
                 return {
-                    observedFingerprint: MISSING_FINGERPRINT,
-                    entries: {},
-                    hasLastKnownGood: true,
-                    status: {
-                        source,
-                        path,
-                        state: "missing",
-                        usingLastKnownGood: false,
-                    },
+                    code: error.code === "missing_environment" ? "missing_environment" : "invalid_source",
+                    message: error.message,
                 };
+            },
+        });
+        const diagnostic = refreshed.status.state === "invalid" && refreshed.issue
+            ? {
+                source,
+                path,
+                severity: "error",
+                code: refreshed.issue.code,
+                message: boundedDiagnosticMessage(refreshed.issue.message),
             }
-            const fingerprint = `read-error:${errorCode(error)}`;
-            if (previous?.observedFingerprint === fingerprint)
-                return previous;
-            return this.invalidSource(source, path, fingerprint, previous, error);
-        }
-        const fingerprint = createHash("sha256").update(content).digest("base64url");
-        if (previous?.observedFingerprint === fingerprint)
-            return previous;
-        let parsed;
-        try {
-            parsed = JSON.parse(content);
-        }
-        catch {
-            return this.invalidSource(source, path, fingerprint, previous, new Error("Invalid JSON syntax."));
-        }
-        try {
-            const entries = parseExternalMcpStandaloneConfig(parsed);
-            return {
-                observedFingerprint: fingerprint,
-                entries,
-                hasLastKnownGood: true,
-                status: {
-                    source,
-                    path,
-                    state: "valid",
-                    usingLastKnownGood: false,
-                },
-            };
-        }
-        catch (error) {
-            return this.invalidSource(source, path, fingerprint, previous, error);
-        }
-    }
-    invalidSource(source, path, observedFingerprint, previous, error) {
-        const diagnostic = {
-            source,
-            path,
-            message: boundedDiagnosticMessage(error),
-        };
-        this.onDiagnostic?.(diagnostic);
+            : undefined;
+        if (diagnostic && refreshed.status.diagnosticChanged)
+            this.onDiagnostic?.(diagnostic);
         return {
-            observedFingerprint,
-            entries: previous?.entries ?? {},
-            hasLastKnownGood: previous?.hasLastKnownGood ?? false,
+            ...(refreshed.value !== undefined ? { value: refreshed.value } : {}),
+            hasLastKnownGood: refreshed.status.usingLastKnownGood || refreshed.status.state === "valid",
             status: {
                 source,
                 path,
-                state: "invalid",
-                usingLastKnownGood: previous?.hasLastKnownGood === true,
+                state: refreshed.status.state,
+                usingLastKnownGood: refreshed.status.usingLastKnownGood,
             },
-            diagnostic,
+            diagnosticChanged: refreshed.status.diagnosticChanged,
+            ...(diagnostic ? { diagnostic } : {}),
         };
     }
 }
-function applySource(servers, origins, masked, entries, source) {
-    for (const [name, entry] of Object.entries(entries)) {
-        if ("disabled" in entry && entry.disabled === true) {
-            delete servers[name];
-            delete origins[name];
-            masked[name] = source;
-            continue;
-        }
-        servers[name] = entry;
-        origins[name] = source;
-        delete masked[name];
+function dynamicSourceInput(source) {
+    if (source.status.state === "missing")
+        return undefined;
+    const dynamicSource = source.status.source;
+    if (dynamicSource === "legacy")
+        throw new Error("Legacy External MCP configuration cannot be a dynamic source.");
+    const scope = scopeForSource(dynamicSource);
+    if (source.value) {
+        return canonicalSourceInput(dynamicSource, scope, source.status.path, source.value);
     }
+    return {
+        id: sourceId(dynamicSource),
+        scope,
+        kind: "file",
+        location: source.status.path,
+        priority: CANONICAL_PRIORITY,
+        shadowsLowerPriority: true,
+        error: {
+            code: source.diagnostic?.code === "missing_environment" ? "missing_environment" : "invalid_source",
+            message: source.diagnostic?.message ?? "External MCP configuration is invalid.",
+        },
+    };
+}
+function canonicalSourceInput(source, scope, path, value) {
+    return {
+        id: sourceId(source),
+        scope,
+        kind: "file",
+        location: path,
+        priority: CANONICAL_PRIORITY,
+        shadowsLowerPriority: true,
+        value,
+    };
+}
+function sourceId(source) {
+    return source === "global" ? "canonical:user:mcp" : `canonical:${source}:mcp`;
+}
+function sourceFromId(id) {
+    if (id === "legacy:user:mcpServers")
+        return "legacy";
+    if (id === "canonical:user:mcp")
+        return "global";
+    if (id === "canonical:project:mcp")
+        return "project";
+    if (id === "canonical:project-local:mcp")
+        return "project-local";
+    throw new Error(`Unknown External MCP resolver source: ${id}`);
+}
+function scopeForSource(source) {
+    if (source === "global")
+        return "user";
+    return source;
+}
+function normalizeResolvedServers(resolution) {
+    const raw = resolution.values.servers;
+    if (raw === undefined)
+        return {};
+    const parsed = parseExternalMcpStandaloneConfig({ servers: raw });
+    return Object.fromEntries(Object.entries(parsed)
+        .filter((entry) => !("disabled" in entry[1] && entry[1].disabled === true)));
+}
+function configDiagnostic(diagnostic) {
+    return {
+        source: sourceFromId(diagnostic.source.id),
+        path: diagnostic.source.location ?? diagnostic.source.id,
+        severity: diagnostic.severity === "error" ? "error" : "warning",
+        code: diagnostic.code,
+        message: boundedDiagnosticMessage(diagnostic.message),
+    };
+}
+function mergeDiagnostics(left, right) {
+    const seen = new Set();
+    return [...left, ...right].filter((diagnostic) => {
+        const key = `${diagnostic.source}\0${diagnostic.path}\0${diagnostic.code}\0${diagnostic.message}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
 }
 function boundedDiagnosticMessage(error) {
     const raw = error instanceof Error ? error.message : String(error);