@ambitresearch/genie 1.3.1

package/dist/auth/oidc/verifier.js

@@ -0,0 +1,145 @@
+/**
+ * OIDC relying-party token verification (DRO-276 / M5-04).
+ *
+ * Complements `../oauth/*` (M5-01's self-issued authorization server): this
+ * module lets genie ALSO act as an OIDC *relying party* against an adopter's
+ * own external Identity Provider (Keycloak, Okta, Auth0, Authentik, etc.),
+ * validating a bearer token that IdP issued rather than one genie minted
+ * itself. The provider must expose OIDC discovery/JWKS, issue signed JWT
+ * access tokens for the genie resource/API using the RFC 9068 `typ: at+jwt`
+ * discriminator, and map group membership into a `groups` claim. Opaque
+ * access tokens and OIDC ID tokens are not supported. Verification checks the
+ * signature plus exact `iss`, configured `aud`, required RFC 9068 claims, and
+ * token type before enforcing group membership.
+ *
+ * Configuration is opt-in via env, mirroring `resolveOAuthSigningKey`'s
+ * "refuse to run without it" posture for `../oauth/config.ts`:
+ *   - GENIE_OIDC_ISSUER   — the provider's issuer URL (used to derive its
+ *     `/.well-known/openid-configuration` + JWKS endpoint).
+ *   - GENIE_OIDC_AUDIENCE — the resource/API identifier expected in the
+ *     access token's `aud` claim.
+ * Both must be non-empty for OIDC RP mode to activate. When neither variable
+ * is present the feature is disabled; a partial or empty configuration is a
+ * startup error so an intended auth gate cannot fail open.
+ */
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { isIP } from "node:net";
+import { enforceGroupAccess, REQUIRED_GROUP } from "./group-policy.js";
+export class MissingOidcConfigError extends Error {
+}
+/** Read {@link OidcVerifierConfig} from env. A missing or empty issuer or
+ *  audience is invalid once either OIDC variable is present. */
+export function resolveOidcConfig(env = process.env) {
+    const issuer = env.GENIE_OIDC_ISSUER;
+    const audience = env.GENIE_OIDC_AUDIENCE;
+    if (!issuer || !audience) {
+        throw new MissingOidcConfigError("GENIE_OIDC_ISSUER and GENIE_OIDC_AUDIENCE must both be set to enable OIDC relying-party mode.");
+    }
+    return { issuer, audience, requiredGroup: env.GENIE_OIDC_REQUIRED_GROUP || REQUIRED_GROUP };
+}
+const DEFAULT_DISCOVERY_TIMEOUT_MS = 10_000;
+function isLoopbackHostname(hostname) {
+    const normalized = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    return (normalized === "localhost" ||
+        normalized.endsWith(".localhost") ||
+        (isIP(normalized) === 4 && normalized.split(".")[0] === "127") ||
+        normalized === "::1" ||
+        normalized === "0:0:0:0:0:0:0:1" ||
+        normalized === "::ffff:127.0.0.1");
+}
+function requireSecureOidcUrl(value, label, allowPlaintextLoopback) {
+    const url = new URL(value);
+    if (url.username || url.password || url.hash || (label === "issuer" && url.search)) {
+        throw new Error(`OIDC ${label} must not contain credentials, a fragment, or an issuer query.`);
+    }
+    const allowedDevelopmentUrl = allowPlaintextLoopback && url.protocol === "http:" && isLoopbackHostname(url.hostname);
+    if (url.protocol !== "https:" && !allowedDevelopmentUrl) {
+        throw new Error(`OIDC ${label} must use HTTPS unless it is a loopback development URL.`);
+    }
+    return url;
+}
+function enforceAccessTokenClaimTypes(claims) {
+    for (const claim of ["sub", "client_id", "jti"]) {
+        if (typeof claims[claim] !== "string") {
+            throw new Error(`OIDC access token claim "${claim}" must be a string.`);
+        }
+    }
+}
+/** Fetch `${issuer}/.well-known/openid-configuration` and return its
+ *  `jwks_uri` using the RFC 8414 / OIDC Discovery 1.0 endpoint required by
+ *  this integration. */
+async function discoverJwksUri(discoveryIssuer, expectedIssuer, timeoutMs, allowPlaintextLoopback) {
+    const discoveryUrl = `${discoveryIssuer}/.well-known/openid-configuration`;
+    const signal = AbortSignal.timeout(timeoutMs);
+    let res;
+    try {
+        res = await fetch(discoveryUrl, { signal, redirect: "manual" });
+    }
+    catch (error) {
+        if (signal.aborted) {
+            throw new Error(`OIDC discovery timed out after ${timeoutMs} ms: GET ${discoveryUrl}`, {
+                cause: error,
+            });
+        }
+        throw error;
+    }
+    if (!res.ok) {
+        throw new Error(`OIDC discovery failed: GET ${discoveryUrl} -> ${res.status}`);
+    }
+    const doc = (await res.json());
+    if (doc.issuer !== expectedIssuer) {
+        throw new Error(`OIDC discovery issuer mismatch: expected ${expectedIssuer}, received ${String(doc.issuer)}.`);
+    }
+    if (!doc.jwks_uri) {
+        throw new Error(`OIDC discovery document at ${discoveryUrl} is missing jwks_uri.`);
+    }
+    requireSecureOidcUrl(doc.jwks_uri, "jwks_uri", allowPlaintextLoopback);
+    return doc.jwks_uri;
+}
+/**
+ * Build a verifier bound to a live provider's JWKS. The provider's `jwks_uri`
+ * is resolved once via OIDC discovery; the returned JWK set is fetched lazily
+ * and cached across calls by `jose`'s `createRemoteJWKSet` (in-flight
+ * de-duplication + background re-fetch on unknown `kid` — no manual caching
+ * needed here).
+ */
+export async function createOidcVerifier(config) {
+    const issuer = config.issuer;
+    const issuerUrl = requireSecureOidcUrl(issuer, "issuer", true);
+    const allowPlaintextLoopback = issuerUrl.protocol === "http:";
+    const discoveryIssuer = issuer.endsWith("/") ? issuer.slice(0, -1) : issuer;
+    const discoveryTimeoutMs = config.discoveryTimeoutMs ?? DEFAULT_DISCOVERY_TIMEOUT_MS;
+    if (!Number.isFinite(discoveryTimeoutMs) || discoveryTimeoutMs <= 0) {
+        throw new Error("discoveryTimeoutMs must be a positive finite number.");
+    }
+    const jwksUri = await discoverJwksUri(discoveryIssuer, issuer, discoveryTimeoutMs, allowPlaintextLoopback);
+    const jwks = createRemoteJWKSet(new URL(jwksUri));
+    const requiredGroup = config.requiredGroup ?? REQUIRED_GROUP;
+    return {
+        issuer,
+        audience: config.audience,
+        requiredGroup,
+        async verify(token) {
+            const { payload } = await jwtVerify(token, jwks, {
+                issuer,
+                audience: config.audience,
+                typ: "at+jwt",
+                requiredClaims: ["exp", "sub", "client_id", "iat", "jti"],
+            });
+            const claims = payload;
+            enforceAccessTokenClaimTypes(claims);
+            enforceGroupAccess(claims, requiredGroup);
+            return claims;
+        },
+    };
+}
+/** Same as {@link createOidcVerifier}, but returns `undefined` only when both
+ *  OIDC variables are absent. Partial or explicitly empty configuration is a
+ *  startup error. */
+export async function tryCreateOidcVerifier(env = process.env) {
+    if (env.GENIE_OIDC_ISSUER === undefined && env.GENIE_OIDC_AUDIENCE === undefined) {
+        return undefined;
+    }
+    return createOidcVerifier(resolveOidcConfig(env));
+}
+//# sourceMappingURL=verifier.js.map

package/dist/auth/oidc/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/auth/oidc/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEvE,MAAM,OAAO,sBAAuB,SAAQ,KAAK;CAAG;AA2BpD;gEACgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,sBAAsB,CAC9B,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,CAAC,yBAAyB,IAAI,cAAc,EAAE,CAAC;AAC9F,CAAC;AAQD,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAE5C,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,OAAO,CACL,UAAU,KAAK,WAAW;QAC1B,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;QAC9D,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,iBAAiB;QAChC,UAAU,KAAK,kBAAkB,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAa,EACb,KAA4B,EAC5B,sBAA+B;IAE/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,gEAAgE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,qBAAqB,GACzB,sBAAsB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzF,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,0DAA0D,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,4BAA4B,CAAC,MAAkB;IACtD,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAU,EAAE,CAAC;QACzD,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,qBAAqB,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;wBAEwB;AACxB,KAAK,UAAU,eAAe,CAC5B,eAAuB,EACvB,cAAsB,EACtB,SAAiB,EACjB,sBAA+B;IAE/B,MAAM,YAAY,GAAG,GAAG,eAAe,mCAAmC,CAAC;IAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,SAAS,YAAY,YAAY,EAAE,EAAE;gBACrF,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,YAAY,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;IACxD,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,4CAA4C,cAAc,cAAc,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,8BAA8B,YAAY,uBAAuB,CAAC,CAAC;IACrF,CAAC;IACD,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAA0B;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,sBAAsB,GAAG,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC9D,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;IACrF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,eAAe,CACnC,eAAe,EACf,MAAM,EACN,kBAAkB,EAClB,sBAAsB,CACvB,CAAC;IACF,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,cAAc,CAAC;IAE7D,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa;QACb,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,MAAM;gBACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,EAAE,QAAQ;gBACb,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC;aAC1D,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAqB,CAAC;YACrC,4BAA4B,CAAC,MAAM,CAAC,CAAC;YACrC,kBAAkB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAC1C,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;qBAEqB;AACrB,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,GAAG,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,kBAAkB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/auth/token-cli.d.ts

@@ -0,0 +1,9 @@
+export interface TokenCliResult {
+    /** Text to print to stdout. */
+    output: string;
+    /** Process exit code the caller should use. */
+    exitCode: number;
+}
+/** Run `genie token <subcommand> ...args`. Never calls process.exit. */
+export declare function runTokenCli(argv: string[]): Promise<TokenCliResult>;
+//# sourceMappingURL=token-cli.d.ts.map

package/dist/auth/token-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cli.d.ts","sourceRoot":"","sources":["../../src/auth/token-cli.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAsCD,wEAAwE;AACxE,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAwDzE"}

package/dist/auth/token-cli.js

@@ -0,0 +1,98 @@
+/**
+ * `genie token` admin CLI (M5-02, DRO-274).
+ *
+ * Subcommands:
+ *   genie token create [--sub <id>] [--scope read] [--scope write]
+ *   genie token list
+ *   genie token revoke <prefix>
+ *
+ * Kept a plain argv-in/stdout-out module (no process.exit calls) so cli.ts
+ * can unit-test it and control the process lifecycle itself.
+ */
+import { createToken, listTokens, revokeToken } from "./bearer.js";
+const TOKEN_HELP = `genie token — manage static Bearer tokens (M5-02)
+
+Usage:
+  genie token create [--sub <id>] [--scope read] [--scope write]
+  genie token list
+  genie token revoke <prefix>
+
+Notes:
+  - "create" prints the plaintext token exactly once. It is not recoverable
+    afterward — only its SHA-256 hash is stored.
+  - "--scope" may be passed multiple times; defaults to "read" if omitted.
+  - "revoke <prefix>" matches any token whose printed prefix starts with
+    <prefix> (the value shown by "genie token list").`;
+function parseScopes(argv) {
+    const scopes = [];
+    let sub;
+    const rest = [];
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === undefined)
+            continue;
+        if (arg === "--scope") {
+            const value = argv[++i];
+            if (value !== "read" && value !== "write") {
+                throw new Error(`--scope must be "read" or "write", got: ${value ?? "<missing>"}`);
+            }
+            scopes.push(value);
+        }
+        else if (arg === "--sub") {
+            sub = argv[++i];
+        }
+        else {
+            rest.push(arg);
+        }
+    }
+    return { scopes, sub, rest };
+}
+/** Run `genie token <subcommand> ...args`. Never calls process.exit. */
+export async function runTokenCli(argv) {
+    const [subcommand, ...rest] = argv;
+    if (subcommand === undefined || subcommand === "-h" || subcommand === "--help") {
+        return { output: TOKEN_HELP + "\n", exitCode: 0 };
+    }
+    if (subcommand === "create") {
+        const { scopes, sub } = parseScopes(rest);
+        const { token, record } = await createToken({
+            sub: sub ?? "default",
+            scopes: scopes.length > 0 ? scopes : undefined,
+        });
+        const lines = [
+            `Token created (shown once — copy it now, it cannot be displayed again):`,
+            "",
+            `  ${token}`,
+            "",
+            `  sub:    ${record.sub}`,
+            `  scopes: ${record.scopes.join(", ")}`,
+            `  prefix: ${record.prefix}`,
+            "",
+        ];
+        return { output: lines.join("\n"), exitCode: 0 };
+    }
+    if (subcommand === "list") {
+        const tokens = await listTokens();
+        if (tokens.length === 0) {
+            return { output: "No tokens.\n", exitCode: 0 };
+        }
+        const lines = tokens.map((t) => `${t.prefix}...  hash=${t.hash}  sub=${t.sub}  scopes=${t.scopes.join(",")}  createdAt=${t.createdAt}  lastUsedAt=${t.lastUsedAt ?? "never"}`);
+        return { output: lines.join("\n") + "\n", exitCode: 0 };
+    }
+    if (subcommand === "revoke") {
+        const prefix = rest[0];
+        if (prefix === undefined || prefix.trim() === "") {
+            return { output: "genie token revoke: missing <prefix> argument.\n", exitCode: 1 };
+        }
+        const removed = await revokeToken(prefix);
+        if (removed === 0) {
+            return { output: `No token found matching prefix "${prefix}".\n`, exitCode: 1 };
+        }
+        return { output: `Revoked ${removed} token(s) matching prefix "${prefix}".\n`, exitCode: 0 };
+    }
+    return {
+        output: `genie token: unknown subcommand "${subcommand}".\n\n${TOKEN_HELP}\n`,
+        exitCode: 1,
+    };
+}
+//# sourceMappingURL=token-cli.js.map

package/dist/auth/token-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cli.js","sourceRoot":"","sources":["../../src/auth/token-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAmB,MAAM,aAAa,CAAC;AASpF,MAAM,UAAU,GAAG;;;;;;;;;;;;sDAYmC,CAAC;AAEvD,SAAS,WAAW,CAAC,IAAc;IACjC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,GAAuB,CAAC;IAC5B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACxB,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,2CAA2C,KAAK,IAAI,WAAW,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAc;IAC9C,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAEnC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC/E,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC;YAC1C,GAAG,EAAE,GAAG,IAAI,SAAS;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC/C,CAAC,CAAC;QACH,MAAM,KAAK,GAAG;YACZ,yEAAyE;YACzE,EAAE;YACF,KAAK,KAAK,EAAE;YACZ,EAAE;YACF,aAAa,MAAM,CAAC,GAAG,EAAE;YACzB,aAAa,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACvC,aAAa,MAAM,CAAC,MAAM,EAAE;YAC5B,EAAE;SACH,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CACtB,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,SAAS,gBAClG,CAAC,CAAC,UAAU,IAAI,OAClB,EAAE,CACL,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC1D,CAAC;IAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,OAAO,EAAE,MAAM,EAAE,kDAAkD,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,mCAAmC,MAAM,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,OAAO,8BAA8B,MAAM,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC/F,CAAC;IAED,OAAO;QACL,MAAM,EAAE,oCAAoC,UAAU,SAAS,UAAU,IAAI;QAC7E,QAAQ,EAAE,CAAC;KACZ,CAAC;AACJ,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,149 @@
+#!/usr/bin/env node
+import { createServer, SERVER_INFO } from "./server.js";
+import { resolvePreviewLocality, resolveTransport, startTransport } from "./transport.js";
+import { runTokenCli } from "./auth/token-cli.js";
+import { createRedactingLogger } from "./config/redact.js";
+import { auditLoadedSecrets, loadSecrets } from "./config/secrets.js";
+/** Minimal flag parser — no dependency needed for M0's tiny surface. */
+function parseArgs(argv) {
+    const out = { help: false, version: false };
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        switch (arg) {
+            case "--transport":
+                out.transport = argv[++i];
+                break;
+            case "--port":
+                out.port = Number(argv[++i]);
+                break;
+            case "--host":
+                out.host = argv[++i];
+                break;
+            case "--require-bearer-auth":
+                out.requireBearerAuth = true;
+                break;
+            case "--preview-locality": {
+                const value = argv[++i];
+                if (value === undefined || value.trim() === "" || value.startsWith("-")) {
+                    throw new Error("--preview-locality requires a value: local or remote.");
+                }
+                out.previewLocality = value;
+                break;
+            }
+            case "--secrets-from": {
+                const value = argv[++i];
+                if (value === undefined || value.trim() === "" || value.startsWith("-")) {
+                    throw new Error("--secrets-from requires a path, e.g. a mounted Docker secret.");
+                }
+                out.secretsFrom = value;
+                break;
+            }
+            case "-h":
+            case "--help":
+                out.help = true;
+                break;
+            case "-v":
+            case "--version":
+                out.version = true;
+                break;
+            default:
+                // ignore unknown flags for forward-compat
+                break;
+        }
+    }
+    return out;
+}
+const HELP = `genie — harness-agnostic MCP server for AI UI-component generation
+
+Usage: genie [options]
+       genie token <create|list|revoke> [args]   Manage static Bearer tokens
+
+Options:
+  --transport <stdio|http>   Transport to use (default: auto-detect by TTY)
+  --port <n>                 HTTP port (default: 3000)
+  --host <addr>              HTTP host (default: 127.0.0.1)
+  --preview-locality <mode>  Preview reachability: local or remote
+  --require-bearer-auth      Require Authorization: Bearer <token> on /mcp (HTTP only)
+  --secrets-from <path>      Read secrets from an owner-only KEY=VALUE file
+                             (e.g. a mounted container secret), overriding env
+  -v, --version              Print version and exit
+  -h, --help                 Show this help
+
+Env:
+  MCP_TRANSPORT              Same as --transport
+  GENIE_PREVIEW_LOCALITY     Same as --preview-locality
+  GENIE_REQUIRE_BEARER_AUTH  Same as --require-bearer-auth ("1"/"true")
+  GENIE_HOME                 Root for persisted state, incl. auth/tokens.json
+  GENIE_KITS_ROOT            Directory where kit tools read/write UI kits
+  GENIE_PROJECTS_ROOT        Directory where create_project writes project roots
+  GENIE_LLM_API_KEY          Required secret — LLM endpoint API key
+  OAUTH_HS256_KEY            Required secret — HS256 signing key for OAuth tokens
+  GENIE_GIT_TOKEN            Optional secret — git host API token
+  OAUTH_CLIENT_SECRET        Optional secret — OAuth confidential client secret
+
+This scaffold build boots, speaks MCP, and registers ping plus M1 tools:
+kit listing, kit creation, file listing, file reading, validation, and project
+create/list/get/delete.`;
+function resolveRequireBearerAuth(flag) {
+    if (flag)
+        return true;
+    const env = (process.env.GENIE_REQUIRE_BEARER_AUTH ?? "").trim().toLowerCase();
+    return env === "1" || env === "true";
+}
+let logger;
+async function main() {
+    const argv = process.argv.slice(2);
+    if (argv[0] === "token") {
+        const result = await runTokenCli(argv.slice(1));
+        process.stdout.write(result.output);
+        process.exitCode = result.exitCode;
+        return;
+    }
+    const args = parseArgs(argv);
+    if (args.help) {
+        process.stdout.write(HELP + "\n");
+        return;
+    }
+    if (args.version) {
+        process.stdout.write(`${SERVER_INFO.name} ${SERVER_INFO.version}\n`);
+        return;
+    }
+    const loadedSecrets = loadSecrets({ secretsFromPath: args.secretsFrom });
+    logger = createRedactingLogger(loadedSecrets);
+    auditLoadedSecrets(loadedSecrets, (line) => logger?.info(JSON.parse(line)));
+    const transportKind = resolveTransport(args.transport);
+    const host = args.host ?? "127.0.0.1";
+    const previewLocality = resolvePreviewLocality(transportKind, args.previewLocality);
+    const requireBearerAuth = resolveRequireBearerAuth(args.requireBearerAuth);
+    const createConfiguredServer = () => createServer({ transportKind, previewLocality });
+    const server = createConfiguredServer();
+    // Test-only hook (M5-13 / DRO-285 AC4): when set, register N additional
+    // no-op tools on the SAME server instance this CLI starts over its real
+    // transport, so the harness smoke suites can probe `tools/list` over the
+    // exact transport a harness config launches — not an in-memory stand-in.
+    // Never set in production; intentionally undocumented outside test code.
+    const extraToolCount = Number(process.env.GENIE_TEST_EXTRA_TOOLS ?? "0");
+    if (Number.isFinite(extraToolCount) && extraToolCount > 0) {
+        for (let i = 0; i < extraToolCount; i++) {
+            server.registerTool(`dummy_tool_${i}`, { title: `Dummy ${i}`, description: "Harness smoke-test filler tool.", inputSchema: {} }, () => ({ content: [{ type: "text", text: "dummy" }] }));
+        }
+    }
+    await startTransport(server, {
+        kind: transportKind,
+        port: args.port,
+        host,
+        ...(transportKind === "http"
+            ? { serverFactory: createConfiguredServer, requireBearerAuth }
+            : {}),
+    });
+}
+main().catch((err) => {
+    if (logger) {
+        logger.fatal({ err }, "genie fatal");
+    }
+    else {
+        process.stderr.write(`genie: fatal: ${err instanceof Error ? err.message : String(err)}\n`);
+    }
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEtE,wEAAwE;AACxE,SAAS,SAAS,CAAC,IAAc;IAU/B,MAAM,GAAG,GAAiC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,aAAa;gBAChB,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1B,MAAM;YACR,KAAK,QAAQ;gBACX,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7B,MAAM;YACR,KAAK,QAAQ;gBACX,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrB,MAAM;YACR,KAAK,uBAAuB;gBAC1B,GAAG,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBAC7B,MAAM;YACR,KAAK,oBAAoB,CAAC,CAAC,CAAC;gBAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBAC3E,CAAC;gBACD,GAAG,CAAC,eAAe,GAAG,KAAK,CAAC;gBAC5B,MAAM;YACR,CAAC;YACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBACnF,CAAC;gBACD,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC;gBACxB,MAAM;YACR,CAAC;YACD,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,MAAM;YACR,KAAK,IAAI,CAAC;YACV,KAAK,WAAW;gBACd,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;gBACnB,MAAM;YACR;gBACE,0CAA0C;gBAC1C,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA8BW,CAAC;AAEzB,SAAS,wBAAwB,CAAC,IAAc;IAC9C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/E,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,MAAM,CAAC;AACvC,CAAC;AAED,IAAI,MAA0B,CAAC;AAE/B,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACnC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE7B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,IAAI,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,WAAW,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzE,MAAM,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAC9C,kBAAkB,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE5E,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,eAAe,GAAG,sBAAsB,CAAC,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACpF,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3E,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAC;IAExC,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,GAAG,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,YAAY,CACjB,cAAc,CAAC,EAAE,EACjB,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE,WAAW,EAAE,EAAE,EAAE,EACxF,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,cAAc,CAAC,MAAM,EAAE;QAC3B,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI;QACJ,GAAG,CAAC,aAAa,KAAK,MAAM;YAC1B,CAAC,CAAC,EAAE,aAAa,EAAE,sBAAsB,EAAE,iBAAiB,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/config/redact.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Log redaction (M5-03 / DRO-275, AC4).
+ *
+ * The configured pino logger combines path-based redaction for known secret
+ * keys with value-based scrubbing for arbitrary fields and message strings.
+ */
+import { type DestinationStream, type Logger } from "pino";
+import { type LoadedSecret } from "./secrets.js";
+/** Censor string substituted for any redacted value (AC4). */
+export declare const REDACTED = "****";
+/** Pino paths that are always redacted, regardless of their values. */
+export declare const redactOptions: {
+    paths: string[];
+    censor: string;
+};
+/** Replace every occurrence of each configured secret value in text. */
+export declare function redactSecretValues(text: string, secrets: readonly LoadedSecret[]): string;
+/** Create the server logger with pino path and configured-value redaction. */
+export declare function createRedactingLogger(secrets: readonly LoadedSecret[], destination?: DestinationStream): Logger;
+//# sourceMappingURL=redact.d.ts.map

package/dist/config/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/config/redact.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAa,EAAE,KAAK,iBAAiB,EAAE,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC;AAEjE,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAErE,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,SAAS,CAAC;AAE/B,uEAAuE;AACvE,eAAO,MAAM,aAAa;;;CASzB,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,CAMzF;AAyCD,8EAA8E;AAC9E,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,WAAW,GAAE,iBAA6D,GACzE,MAAM,CAcR"}

package/dist/config/redact.js

@@ -0,0 +1,77 @@
+/**
+ * Log redaction (M5-03 / DRO-275, AC4).
+ *
+ * The configured pino logger combines path-based redaction for known secret
+ * keys with value-based scrubbing for arbitrary fields and message strings.
+ */
+import pino, {} from "pino";
+import { SECRET_DEFINITIONS } from "./secrets.js";
+/** Censor string substituted for any redacted value (AC4). */
+export const REDACTED = "****";
+/** Pino paths that are always redacted, regardless of their values. */
+export const redactOptions = {
+    paths: [
+        ...SECRET_DEFINITIONS.map((definition) => definition.key),
+        ...SECRET_DEFINITIONS.map((definition) => `*.${definition.key}`),
+        ...SECRET_DEFINITIONS.map((definition) => `env.${definition.key}`),
+        "req.headers.authorization",
+        "*.req.headers.authorization",
+    ],
+    censor: REDACTED,
+};
+/** Replace every occurrence of each configured secret value in text. */
+export function redactSecretValues(text, secrets) {
+    let redacted = text;
+    for (const { value } of secrets) {
+        redacted = redacted.split(value).join(REDACTED);
+    }
+    return redacted;
+}
+function redactLogValue(value, secrets, seen) {
+    if (typeof value === "string")
+        return redactSecretValues(value, secrets);
+    if (value === null || typeof value !== "object")
+        return value;
+    const existing = seen.get(value);
+    if (existing !== undefined)
+        return existing;
+    if (value instanceof Error) {
+        const redactedError = {
+            type: value.name,
+            message: redactSecretValues(value.message, secrets),
+            stack: value.stack ? redactSecretValues(value.stack, secrets) : undefined,
+        };
+        seen.set(value, redactedError);
+        for (const [key, nestedValue] of Object.entries(value)) {
+            redactedError[key] = redactLogValue(nestedValue, secrets, seen);
+        }
+        return redactedError;
+    }
+    if (Array.isArray(value)) {
+        const redactedArray = [];
+        seen.set(value, redactedArray);
+        for (const item of value)
+            redactedArray.push(redactLogValue(item, secrets, seen));
+        return redactedArray;
+    }
+    const redactedObject = {};
+    seen.set(value, redactedObject);
+    for (const [key, nestedValue] of Object.entries(value)) {
+        redactedObject[key] = redactLogValue(nestedValue, secrets, seen);
+    }
+    return redactedObject;
+}
+/** Create the server logger with pino path and configured-value redaction. */
+export function createRedactingLogger(secrets, destination = pino.destination({ dest: 2, sync: true })) {
+    return pino({
+        redact: redactOptions,
+        hooks: {
+            logMethod(args, method) {
+                const seen = new WeakMap();
+                const redactedArgs = args.map((arg) => redactLogValue(arg, secrets, seen));
+                method.apply(this, redactedArgs);
+            },
+        },
+    }, destination);
+}
+//# sourceMappingURL=redact.js.map

package/dist/config/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/config/redact.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,IAAI,EAAE,EAAuC,MAAM,MAAM,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAqB,MAAM,cAAc,CAAC;AAErE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE/B,uEAAuE;AACvE,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,KAAK,EAAE;QACL,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzD,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC;QAChE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC;QAClE,2BAA2B;QAC3B,6BAA6B;KAC9B;IACD,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,OAAgC;IAC/E,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QAChC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,OAAgC,EAChC,IAA8B;IAE9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE9D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAE5C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,aAAa,GAA4B;YAC7C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;YACnD,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;SAC1E,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,aAAa,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,aAAa,GAAc,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAClF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,cAAc,GAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,cAAc,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CACnC,OAAgC,EAChC,cAAiC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAE1E,OAAO,IAAI,CACT;QACE,MAAM,EAAE,aAAa;QACrB,KAAK,EAAE;YACL,SAAS,CAAC,IAAI,EAAE,MAAM;gBACpB,MAAM,IAAI,GAAG,IAAI,OAAO,EAAmB,CAAC;gBAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAgB,CAAC;gBAC1F,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACnC,CAAC;SACF;KACF,EACD,WAAW,CACZ,CAAC;AACJ,CAAC"}

package/dist/config/secrets.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Secret loading (M5-03 / DRO-275) — no plaintext secrets at rest.
+ *
+ * Every secret genie uses is read only from env vars or, when
+ * `--secrets-from <path>` is passed (e.g. a mounted Docker/Kubernetes
+ * secret), from an owner-only `KEY=VALUE`-per-line file at that path (AC6).
+ * Files with group/other permission bits are rejected before reading. Nothing
+ * secret is ever hardcoded, and this module never writes a secret value to
+ * disk, argv, or a log line.
+ *
+ * Bootstrap contract (AC2): `loadSecrets()` throws `SecretValidationError`
+ * with one message per problem when any *required* secret is:
+ *   - missing (unset, and absent from a `--secrets-from` file if provided);
+ *   - shorter than its required minimum length;
+ *   - present verbatim anywhere in `process.argv` (a value passed as a CLI
+ *     flag is visible to `ps`/shell history on every other local user, so a
+ *     secret leaking into argv is treated as fatal, not just discouraged).
+ *
+ * AC3: `auditLoadedSecrets` logs which secret *names* were loaded (never
+ * values) as a single structured line on process.stderr, mirroring the
+ * stdout-is-JSON-RPC convention documented in `llm/client.ts`.
+ */
+/** Every secret env var genie recognises, and whether it's required to boot. */
+export declare const SECRET_DEFINITIONS: readonly [{
+    readonly key: "GENIE_LLM_API_KEY";
+    readonly required: true;
+    readonly minLength: 16;
+}, {
+    readonly key: "OAUTH_HS256_KEY";
+    readonly required: true;
+    readonly minLength: 32;
+}, {
+    readonly key: "GENIE_GIT_TOKEN";
+    readonly required: false;
+    readonly minLength: 0;
+}, {
+    readonly key: "OAUTH_CLIENT_SECRET";
+    readonly required: false;
+    readonly minLength: 0;
+}];
+/** Union of every secret key name genie knows about. */
+export type SecretKey = (typeof SECRET_DEFINITIONS)[number]["key"];
+/** Minimum acceptable length for a required secret value (AC2). */
+export declare const MIN_SECRET_LENGTH = 16;
+/**
+ * Thrown by `loadSecrets` when bootstrap validation fails. Aggregates every
+ * problem found (not just the first) so a misconfigured deployment gets the
+ * full picture in one failure rather than fixing issues one at a time.
+ */
+export declare class SecretValidationError extends Error {
+    readonly problems: readonly string[];
+    constructor(problems: readonly string[]);
+}
+/**
+ * Parse a `KEY=VALUE`-per-line secrets file (AC6), e.g. a mounted secret
+ * mounted at `/run/secrets/genie`. Blank lines and `#`-prefixed comments are
+ * skipped. Values are not trimmed of surrounding quotes — the file is
+ * expected to hold raw values, matching Docker/Kubernetes secret conventions
+ * (unlike a shell-sourced `.env`, no quoting/escaping is applied).
+ */
+export declare function parseSecretsFile(contents: string): Record<string, string>;
+/** A loaded secret: its name and value, never logged together (AC3). */
+export interface LoadedSecret {
+    key: SecretKey;
+    value: string;
+}
+export interface LoadSecretsOptions {
+    /** Environment to read from. Defaults to `process.env`. */
+    env?: NodeJS.ProcessEnv;
+    /** argv to scan for leaked secret values. Defaults to `process.argv`. */
+    argv?: readonly string[];
+    /**
+     * Path to a `KEY=VALUE` secrets file (e.g. `--secrets-from`, AC6). When
+     * given, values from this file take precedence over env for the same key.
+     */
+    secretsFromPath?: string;
+    /** Injectable file reader, for tests. Defaults to `node:fs`'s `readFileSync`. */
+    readFile?: (path: string) => string;
+    /** Injectable file stat, for testing mounted-secret permissions. */
+    statFile?: (path: string) => {
+        mode: number;
+    };
+}
+/**
+ * Load and validate every known secret (AC1/AC2). Reads from env only,
+ * optionally overlaid by a `--secrets-from` file (AC6). Throws
+ * `SecretValidationError` if any *required* secret is missing, too short, or
+ * leaked into argv verbatim.
+ *
+ * Returns only the secrets that were actually present (optional secrets are
+ * omitted when unset) so callers can distinguish "not configured" from "".
+ */
+export declare function loadSecrets(options?: LoadSecretsOptions): LoadedSecret[];
+/**
+ * Log which secrets were loaded — key names only, never values — as a single
+ * structured line on stderr (stdout is the JSON-RPC stream on the stdio
+ * transport; see `llm/client.ts` for the same convention).
+ */
+export declare function auditLoadedSecrets(loaded: readonly LoadedSecret[], write?: (line: string) => void): void;
+//# sourceMappingURL=secrets.d.ts.map