@aopslabs/aops 0.2.0

package/dist/utils/chatv3-session-store.js

@@ -0,0 +1,185 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import fsSync from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { getAopsCliConfigFilePath } from './config.js';
+import { decryptWithPassword, encryptWithPassword, } from './password-crypto.js';
+const STORE_FILENAME = 'chatv3-sessions.json';
+const SECRET_FILENAME = 'chatv3-session.key';
+function normalizeNonEmpty(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed ? trimmed : undefined;
+}
+function baseDirFromConfig() {
+    if (normalizeNonEmpty(process.env.AOPS_CLI_CONFIG_PATH) || normalizeNonEmpty(process.env.AGENT_OPS_CONFIG_PATH)) {
+        return path.dirname(getAopsCliConfigFilePath());
+    }
+    return path.join(os.homedir(), '.aops');
+}
+export function resolveChatv3SessionStorePath(explicitPath) {
+    return path.resolve(normalizeNonEmpty(explicitPath) ??
+        normalizeNonEmpty(process.env.AOPS_CHATV3_SESSION_STORE_PATH) ??
+        path.join(baseDirFromConfig(), STORE_FILENAME));
+}
+function resolveChatv3SessionSecretPath() {
+    return path.join(baseDirFromConfig(), SECRET_FILENAME);
+}
+async function ensureDir(filePath) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+}
+async function enforceOwnerOnlyFileMode(filePath) {
+    if (process.platform === 'win32')
+        return;
+    await fs.chmod(filePath, 0o600);
+}
+async function readStore(storePath) {
+    try {
+        const raw = await fs.readFile(storePath, 'utf8');
+        const parsed = JSON.parse(raw);
+        return {
+            version: 1,
+            sessions: parsed && typeof parsed.sessions === 'object' && parsed.sessions ? parsed.sessions : {},
+        };
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return { version: 1, sessions: {} };
+        }
+        throw error;
+    }
+}
+async function writeStore(storePath, store) {
+    await ensureDir(storePath);
+    await fs.writeFile(storePath, `${JSON.stringify(store, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await enforceOwnerOnlyFileMode(storePath);
+}
+async function resolveSessionSecret() {
+    const envSecret = normalizeNonEmpty(process.env.AOPS_CHATV3_SESSION_SECRET) ??
+        normalizeNonEmpty(process.env.AOPS_MCP_TOKEN_SECRET) ??
+        normalizeNonEmpty(process.env.AOPS_MCP_CONFIG_SECRET);
+    if (envSecret)
+        return envSecret;
+    const secretPath = resolveChatv3SessionSecretPath();
+    try {
+        const raw = await fs.readFile(secretPath, 'utf8');
+        const secret = normalizeNonEmpty(raw);
+        if (secret) {
+            await enforceOwnerOnlyFileMode(secretPath);
+            return secret;
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    const secret = crypto.randomBytes(32).toString('base64');
+    await ensureDir(secretPath);
+    await fs.writeFile(secretPath, `${secret}\n`, { encoding: 'utf8', mode: 0o600 });
+    await enforceOwnerOnlyFileMode(secretPath);
+    return secret;
+}
+function encodeEncryptedPayload(payload) {
+    return Buffer.from(JSON.stringify(payload), 'utf8').toString('base64');
+}
+function decodeEncryptedPayload(value) {
+    return JSON.parse(Buffer.from(value, 'base64').toString('utf8'));
+}
+async function encryptSecret(value) {
+    const { payload } = await encryptWithPassword(value, await resolveSessionSecret());
+    return encodeEncryptedPayload(payload);
+}
+async function decryptSecret(value) {
+    return decryptWithPassword(decodeEncryptedPayload(value), await resolveSessionSecret());
+}
+async function encryptEpochKeys(keys) {
+    if (!keys || keys.length === 0)
+        return undefined;
+    return Promise.all(keys.map(async ({ rawEpochKey, ...rest }) => ({
+        ...rest,
+        rawEpochKeyEnc: await encryptSecret(rawEpochKey),
+    })));
+}
+async function decryptEpochKeys(keys) {
+    if (!keys || keys.length === 0)
+        return undefined;
+    return Promise.all(keys.map(async ({ rawEpochKeyEnc, ...rest }) => ({
+        ...rest,
+        rawEpochKey: await decryptSecret(rawEpochKeyEnc),
+    })));
+}
+export async function saveChatv3Session(input, secrets, options = {}) {
+    const storePath = resolveChatv3SessionStorePath(options.storePath);
+    const store = await readStore(storePath);
+    const existing = store.sessions[input.id];
+    const now = new Date().toISOString();
+    const wrapSecretEnc = secrets.wrapSecret ? await encryptSecret(secrets.wrapSecret) : undefined;
+    const epochKeysEnc = await encryptEpochKeys(secrets.epochKeys);
+    const record = {
+        version: 1,
+        ...input,
+        rooms: input.rooms,
+        createdAt: input.createdAt ?? existing?.createdAt ?? now,
+        updatedAt: input.updatedAt ?? now,
+        memberTokenEnc: await encryptSecret(secrets.memberToken),
+        ...(wrapSecretEnc ? { wrapSecretEnc } : {}),
+        ...(epochKeysEnc ? { epochKeysEnc } : {}),
+    };
+    store.sessions[input.id] = record;
+    await writeStore(storePath, store);
+    return record;
+}
+export async function loadChatv3Session(id, options = {}) {
+    const store = await readStore(resolveChatv3SessionStorePath(options.storePath));
+    const record = store.sessions[id];
+    if (!record)
+        throw new Error(`ChatV3 session not found: ${id}`);
+    return {
+        record,
+        secrets: {
+            memberToken: await decryptSecret(record.memberTokenEnc),
+            wrapSecret: record.wrapSecretEnc ? await decryptSecret(record.wrapSecretEnc) : undefined,
+            epochKeys: await decryptEpochKeys(record.epochKeysEnc),
+        },
+    };
+}
+export async function getChatv3SessionRecord(id, options = {}) {
+    const store = await readStore(resolveChatv3SessionStorePath(options.storePath));
+    return store.sessions[id] ?? null;
+}
+export async function listChatv3SessionRecords(options = {}) {
+    const store = await readStore(resolveChatv3SessionStorePath(options.storePath));
+    return Object.values(store.sessions).sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+}
+export async function deleteChatv3Session(id, options = {}) {
+    const storePath = resolveChatv3SessionStorePath(options.storePath);
+    const store = await readStore(storePath);
+    const existed = Boolean(store.sessions[id]);
+    delete store.sessions[id];
+    await writeStore(storePath, store);
+    return existed;
+}
+export function summarizeChatv3Session(record) {
+    return {
+        id: record.id,
+        serverBaseUrl: record.serverBaseUrl,
+        handle: record.handle,
+        channel: record.channel,
+        keyId: record.keyId,
+        activeRoomId: record.activeRoomId,
+        rooms: record.rooms,
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+        encryptionMode: record.channel.encryptionMode ?? (record.wrapSecretEnc ? 'e2e' : 'server-encrypted'),
+        epochKeyCount: record.epochKeysEnc?.length ?? 0,
+        secretStorage: 'encrypted-at-rest',
+    };
+}
+export async function readChatv3SessionStoreRaw(options = {}) {
+    const storePath = resolveChatv3SessionStorePath(options.storePath);
+    if (!fsSync.existsSync(storePath))
+        return '';
+    return fs.readFile(storePath, 'utf8');
+}

package/dist/utils/command.js

@@ -0,0 +1,67 @@
+export function normalizeNonEmpty(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+export function compactPayload(input) {
+    const payload = {};
+    Object.entries(input).forEach(([key, value]) => {
+        if (value === undefined)
+            return;
+        if (typeof value === 'string' && value.trim().length === 0)
+            return;
+        if (Array.isArray(value) && value.length === 0)
+            return;
+        payload[key] = value;
+    });
+    return payload;
+}
+export function printJsonResponse(params) {
+    console.log(JSON.stringify({
+        status: params.status,
+        result: params.result ?? null,
+        rawText: params.rawText,
+    }, null, 2));
+}
+function hasLongOption(cmd, flags) {
+    const longFlag = flags
+        .split(/[ ,|]+/)
+        .map((token) => token.trim())
+        .find((token) => token.startsWith('--'));
+    if (!longFlag)
+        return false;
+    return cmd.options.some((option) => option.long === longFlag);
+}
+function addOptionIfMissing(cmd, flags, description, parser) {
+    if (hasLongOption(cmd, flags))
+        return cmd;
+    if (parser) {
+        cmd.option(flags, description, parser);
+    }
+    else {
+        cmd.option(flags, description);
+    }
+    return cmd;
+}
+export function applyCommonOptions(cmd, config = {}) {
+    const { withAuth = true, withProject = false, withYes = true, withJson = true } = config;
+    addOptionIfMissing(cmd, '--api-base-url <url>', 'API base URL (default: AOPS_API_BASE_URL or http://localhost:5900)');
+    void withAuth;
+    addOptionIfMissing(cmd, '--timeout-ms <ms>', 'Request timeout in milliseconds', (v) => Number.parseInt(String(v), 10));
+    if (withProject) {
+        addOptionIfMissing(cmd, '--project-id <id>', 'Project id');
+        addOptionIfMissing(cmd, '--project-name <name>', 'Project name');
+        addOptionIfMissing(cmd, '--project-slug <slug>', 'Project slug (resolved server-side to a project id)');
+    }
+    if (withYes) {
+        addOptionIfMissing(cmd, '--yes', 'Non-interactive (fail if required args are missing)');
+    }
+    if (withJson) {
+        addOptionIfMissing(cmd, '--json', 'Output JSON only');
+    }
+    return cmd;
+}
+export function isUuidLike(value) {
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+}

package/dist/utils/community-host-runtime.js

@@ -0,0 +1,376 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { compareCanonicalText } from '@aopslabs/artifact-trust-contracts';
+const HOST_REGISTRATION_KIND = 'aops-host-registration';
+const HOST_REGISTRATION_VERSION = '1';
+const HOST_REGISTRATIONS_DIRNAME = 'host-registrations';
+const AOPS_SQLITE_FILENAME = 'aops.aops.sqlite';
+const AOPS_SERVER_ENV_FILENAME = 'aops.server.env';
+const HOST_LOG_LEVELS = new Set(['debug', 'info', 'warn', 'error', 'fatal']);
+const ALWAYS_PATH_KEYS = new Set([
+    'workspaceRoot', 'cliDistEntry', 'cliSrcEntry', 'cliCwd', 'dcmManifestPath',
+    'routesManifestPath', 'operationsManifestPath', 'metadataPath', 'manifestPath',
+    'registrationPath',
+]);
+const MAYBE_PATH_LIST_KEYS = new Set([
+    'allowlist', 'toolingModuleCandidates', 'pluginModuleCandidates',
+    'cliCommandCandidates', 'manifestFileCandidates',
+]);
+const FORBIDDEN_KEYS = new Set(['__proto__', 'prototype', 'constructor']);
+function nonEmpty(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed || undefined;
+}
+function dataRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function cloneJsonData(value, depth = 0) {
+    if (depth > 64)
+        throw new Error('community_host_registration_json_depth_exceeded');
+    if (value === null || typeof value === 'string' || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (Array.isArray(value)) {
+        if (value.length > 10_000)
+            throw new Error('community_host_registration_json_array_too_large');
+        return value.map((item) => cloneJsonData(item, depth + 1));
+    }
+    if (!value || typeof value !== 'object')
+        throw new Error('community_host_registration_json_value_invalid');
+    const output = Object.create(null);
+    for (const [key, item] of Object.entries(value)) {
+        if (FORBIDDEN_KEYS.has(key))
+            throw new Error('community_host_registration_json_key_forbidden:' + key);
+        output[key] = cloneJsonData(item, depth + 1);
+    }
+    return output;
+}
+function normalizedDomain(value) {
+    const domain = nonEmpty(value)?.toLowerCase() ?? '';
+    if (!/^[a-z0-9][a-z0-9._-]*$/.test(domain))
+        throw new Error('host_registration_domain_invalid');
+    return domain;
+}
+function stringList(value) {
+    if (!Array.isArray(value))
+        return [];
+    return [...new Set(value.map(nonEmpty).filter((item) => Boolean(item)))];
+}
+function assertRegistrationEntries(manifest) {
+    const runtimeEnv = dataRecord(dataRecord(manifest.runtime).env);
+    const hasEntries = ['manifestProviders', 'plugins', 'sources'].some((key) => Array.isArray(manifest[key]) && manifest[key].length > 0) || Object.keys(runtimeEnv).length > 0;
+    if (!hasEntries)
+        throw new Error('host_registration_entries_required:' + manifest.domain);
+}
+export function normalizeHostRegistrationManifest(input) {
+    const raw = cloneJsonData(dataRecord(input));
+    const kind = nonEmpty(raw.kind) ?? HOST_REGISTRATION_KIND;
+    const registrationVersion = nonEmpty(raw.registrationVersion) ?? HOST_REGISTRATION_VERSION;
+    if (kind !== HOST_REGISTRATION_KIND)
+        throw new Error('host_registration_kind_invalid');
+    if (registrationVersion !== HOST_REGISTRATION_VERSION)
+        throw new Error('host_registration_version_invalid');
+    const manifest = {
+        ...raw,
+        kind,
+        registrationVersion,
+        domain: normalizedDomain(raw.domain),
+        ...(nonEmpty(raw.displayName) ? { displayName: nonEmpty(raw.displayName) } : {}),
+        ...(nonEmpty(raw.packageName) ? { packageName: nonEmpty(raw.packageName) } : {}),
+        ...(nonEmpty(raw.description) ? { description: nonEmpty(raw.description) } : {}),
+        ...(nonEmpty(raw.baseDir) ? { baseDir: nonEmpty(raw.baseDir) } : {}),
+        ...(stringList(raw.notes).length > 0 ? { notes: stringList(raw.notes) } : {}),
+    };
+    assertRegistrationEntries(manifest);
+    return manifest;
+}
+function isWindowsAbsolute(value) {
+    return /^[A-Za-z]:[\\/]/.test(value) || value.startsWith('\\\\');
+}
+function isPackageSpecifier(value) {
+    if (!value || value.startsWith('.') || value.startsWith('/') || isWindowsAbsolute(value))
+        return false;
+    if (value.includes('\\'))
+        return false;
+    return value.startsWith('@') ? /^@[^/]+\/[^/]+(?:\/[^/]+)*$/.test(value) : /^[a-z0-9][a-z0-9._-]*$/i.test(value);
+}
+function materializePath(value, baseDir) {
+    const expanded = value === '~'
+        ? os.homedir()
+        : value.startsWith('~/') || value.startsWith('~\\')
+            ? path.join(os.homedir(), value.slice(2))
+            : value;
+    if (expanded.startsWith('file://') || expanded.includes('\${'))
+        return expanded;
+    return path.resolve(baseDir, expanded);
+}
+function materializeMaybePath(value, baseDir) {
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.startsWith('file://') || trimmed.includes('\${'))
+        return trimmed;
+    if (isPackageSpecifier(trimmed))
+        return trimmed;
+    if (trimmed.startsWith('.') || trimmed.startsWith('~') || path.isAbsolute(trimmed) || isWindowsAbsolute(trimmed)) {
+        return materializePath(trimmed, baseDir);
+    }
+    return path.extname(trimmed) || trimmed.includes('/') || trimmed.includes('\\')
+        ? materializePath(trimmed, baseDir)
+        : trimmed;
+}
+function materializeValues(value, key, baseDir) {
+    if (typeof value === 'string') {
+        if (ALWAYS_PATH_KEYS.has(key))
+            return materializePath(value, baseDir);
+        if (key === 'module')
+            return materializeMaybePath(value, baseDir);
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => (MAYBE_PATH_LIST_KEYS.has(key) && typeof item === 'string'
+            ? materializeMaybePath(item, baseDir)
+            : materializeValues(item, '', baseDir)));
+    }
+    if (!value || typeof value !== 'object')
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([childKey, item]) => [
+        childKey,
+        materializeValues(item, childKey, baseDir),
+    ]));
+}
+export function materializeHostRegistrationManifest(manifest, sourceBaseDir) {
+    const normalized = normalizeHostRegistrationManifest(manifest);
+    const baseDir = normalized.baseDir
+        ? materializePath(String(normalized.baseDir), sourceBaseDir)
+        : path.resolve(sourceBaseDir);
+    return normalizeHostRegistrationManifest({
+        ...materializeValues(normalized, '', baseDir),
+        baseDir,
+    });
+}
+export function resolveAopsConfigDir(processEnv = process.env) {
+    const configured = nonEmpty(processEnv.AOPS_CLI_CONFIG_PATH) ?? nonEmpty(processEnv.AGENT_OPS_CONFIG_PATH);
+    if (!configured)
+        return path.join(os.homedir(), '.aops');
+    if (process.platform !== 'win32' && isWindowsAbsolute(configured))
+        return path.join(os.homedir(), '.aops');
+    const resolved = path.resolve(configured);
+    return resolved.toLowerCase().endsWith('.json') ? path.dirname(resolved) : resolved;
+}
+export function getHostRegistrationsDir(options = {}) {
+    const configured = nonEmpty(options.registrationsDir)
+        ?? nonEmpty(options.processEnv?.AOPS_HOST_REGISTRATIONS_DIR)
+        ?? nonEmpty(process.env.AOPS_HOST_REGISTRATIONS_DIR);
+    return configured
+        ? path.resolve(configured)
+        : path.join(resolveAopsConfigDir(options.processEnv), HOST_REGISTRATIONS_DIRNAME);
+}
+function registrationFilePath(domain, options) {
+    return path.join(getHostRegistrationsDir(options), normalizedDomain(domain) + '.json');
+}
+export function writeHostRegistration(manifest, options = {}) {
+    const normalized = normalizeHostRegistrationManifest(manifest);
+    const filePath = registrationFilePath(normalized.domain, options);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const temporary = filePath + '.' + process.pid + '.tmp';
+    try {
+        fs.writeFileSync(temporary, JSON.stringify(normalized, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+        fs.renameSync(temporary, filePath);
+    }
+    finally {
+        fs.rmSync(temporary, { force: true });
+    }
+    return filePath;
+}
+export function listInstalledHostRegistrations(options = {}) {
+    const registrationsDir = getHostRegistrationsDir(options);
+    if (!fs.existsSync(registrationsDir))
+        return [];
+    return fs.readdirSync(registrationsDir)
+        .filter((entry) => entry.toLowerCase().endsWith('.json'))
+        .sort()
+        .map((entry) => {
+        const filePath = path.join(registrationsDir, entry);
+        const stats = fs.lstatSync(filePath);
+        if (!stats.isFile() || stats.isSymbolicLink())
+            throw new Error('host_registration_registry_file_invalid:' + filePath);
+        const manifest = normalizeHostRegistrationManifest(JSON.parse(fs.readFileSync(filePath, 'utf8')));
+        return {
+            domain: manifest.domain,
+            filePath,
+            manifest: normalizeHostRegistrationManifest({
+                ...manifest,
+                provenance: { ...dataRecord(manifest.provenance), source: filePath, sourceType: 'registry' },
+            }),
+        };
+    });
+}
+export function unregisterHostRegistration(domain, options = {}) {
+    const filePath = registrationFilePath(domain, options);
+    if (!fs.existsSync(filePath))
+        return false;
+    const stats = fs.lstatSync(filePath);
+    if (!stats.isFile() || stats.isSymbolicLink())
+        throw new Error('host_registration_registry_file_invalid:' + filePath);
+    fs.unlinkSync(filePath);
+    return true;
+}
+function mergeBy(items, incoming, key) {
+    const values = new Map();
+    for (const item of incoming)
+        values.set(String(item[key] ?? ''), item);
+    for (const item of items)
+        values.set(String(item[key] ?? ''), item);
+    return [...values.values()]
+        .filter((item) => nonEmpty(item[key]))
+        .sort((a, b) => compareCanonicalText(String(a[key]), String(b[key])));
+}
+export function mergeHostRegistrationsIntoConfig(baseConfig, registrations) {
+    let runtimeEnv = {};
+    let allowlist = [];
+    let strictAllowlist = false;
+    let tolerantBootstrap = false;
+    let providers = [];
+    let sources = [];
+    let plugins = [];
+    for (const registration of registrations.map(normalizeHostRegistrationManifest)) {
+        runtimeEnv = { ...runtimeEnv, ...dataRecord(dataRecord(registration.runtime).env) };
+        const loader = dataRecord(registration.pluginLoader);
+        allowlist = [...new Set([...allowlist, ...stringList(loader.allowlist), ...(registration.plugins ?? []).map((item) => nonEmpty(item.module)).filter(Boolean)])];
+        strictAllowlist ||= loader.strictAllowlist === true;
+        tolerantBootstrap ||= loader.tolerantBootstrap === true;
+        providers = mergeBy(providers, registration.manifestProviders ?? [], 'id');
+        sources = mergeBy(sources, registration.sources ?? [], 'id');
+        plugins = mergeBy(plugins, registration.plugins ?? [], 'domain');
+    }
+    const baseRuntime = dataRecord(baseConfig.runtime);
+    const baseLoader = dataRecord(baseConfig.pluginLoader);
+    const baseGateway = dataRecord(baseConfig.agentGateway);
+    const baseCatalog = dataRecord(baseGateway.catalog);
+    return {
+        runtime: { ...baseRuntime, env: { ...runtimeEnv, ...dataRecord(baseRuntime.env) } },
+        pluginLoader: {
+            allowlist: [...new Set([...allowlist, ...stringList(baseLoader.allowlist)])],
+            strictAllowlist: baseLoader.strictAllowlist ?? strictAllowlist,
+            tolerantBootstrap: baseLoader.tolerantBootstrap ?? tolerantBootstrap,
+        },
+        agentGateway: providers.length > 0 || sources.length > 0 || Object.keys(baseGateway).length > 0 ? {
+            ...baseGateway,
+            enabled: baseGateway.enabled ?? true,
+            includeLocal: baseGateway.includeLocal ?? true,
+            sources: mergeBy(baseGateway.sources ?? [], sources, 'id'),
+            catalog: {
+                ...baseCatalog,
+                enabled: baseCatalog.enabled ?? true,
+                manifestProviders: mergeBy(baseCatalog.manifestProviders ?? [], providers, 'id'),
+            },
+        } : undefined,
+        plugins: mergeBy(baseConfig.plugins ?? [], plugins, 'domain'),
+    };
+}
+function normalizeLogLevel(value) {
+    const normalized = nonEmpty(value)?.toLowerCase();
+    return normalized && HOST_LOG_LEVELS.has(normalized) ? normalized : undefined;
+}
+function stripQuotes(value) {
+    return value.length >= 2 && ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'")))
+        ? value.slice(1, -1)
+        : value;
+}
+function parseEnv(content) {
+    const assignments = {};
+    for (const rawLine of content.split(/\r?\n/)) {
+        const match = rawLine.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)\s*$/);
+        if (match)
+            assignments[match[1]] = stripQuotes(String(match[2]).trim());
+    }
+    return assignments;
+}
+function quoteEnv(value) {
+    return /^[A-Za-z0-9_./:@%+=,-]+$/.test(value) ? value : JSON.stringify(value);
+}
+export function isSqliteRepoUrl(repoUrl) {
+    const value = repoUrl.trim().toLowerCase();
+    return value === ':memory:' || value.startsWith('sqlite:') || value.startsWith('file:') || /\.(?:db|sqlite|sqlite3)$/.test(value);
+}
+export function inferAopsRepoDialect(repoUrl) {
+    return isSqliteRepoUrl(repoUrl) ? 'sqlite' : 'pg';
+}
+export function getAopsRuntimeConfigDir(processEnv = process.env) {
+    const explicit = nonEmpty(processEnv.AOPS_CLI_CONFIG_PATH) ?? nonEmpty(processEnv.AGENT_OPS_CONFIG_PATH);
+    return !explicit && processEnv.NODE_ENV === 'test'
+        ? path.resolve(process.cwd(), '.tmp', 'aops-runtime-test-config')
+        : resolveAopsConfigDir(processEnv);
+}
+export function getAopsServerEnvPath(processEnv = process.env) {
+    return path.resolve(getAopsRuntimeConfigDir(processEnv), AOPS_SERVER_ENV_FILENAME);
+}
+export function readAopsServerEnvConfig(processEnv = process.env, explicitPath) {
+    const envPath = explicitPath ? path.resolve(explicitPath) : getAopsServerEnvPath(processEnv);
+    if (!fs.existsSync(envPath))
+        return { path: envPath, exists: false, assignments: {}, repoUrl: null, repoDialect: null, redactedRepoUrl: null, hostSettings: { logLevel: null } };
+    const assignments = parseEnv(fs.readFileSync(envPath, 'utf8'));
+    const repoUrl = nonEmpty(assignments.AOPS_REPO_URL) ?? nonEmpty(assignments.AOPS_PG_URL) ?? nonEmpty(assignments.AOPS_SQLITE_URL) ?? null;
+    let redactedRepoUrl = repoUrl;
+    try {
+        if (repoUrl) {
+            const parsed = new URL(repoUrl);
+            if (parsed.password)
+                parsed.password = '***';
+            redactedRepoUrl = parsed.toString();
+        }
+    }
+    catch { }
+    return { path: envPath, exists: true, assignments, repoUrl, repoDialect: repoUrl ? inferAopsRepoDialect(repoUrl) : null, redactedRepoUrl, hostSettings: { logLevel: normalizeLogLevel(assignments.AOPS_LOG_LEVEL) ?? normalizeLogLevel(assignments.LOG_LEVEL) ?? null } };
+}
+export function writeAopsServerEnvConfig(patch, processEnv = process.env, explicitPath) {
+    const current = readAopsServerEnvConfig(processEnv, explicitPath);
+    const next = { ...current.assignments };
+    if (patch.repoUrl !== undefined) {
+        const repoUrl = nonEmpty(patch.repoUrl);
+        delete next.AOPS_REPO_URL;
+        delete next.AOPS_PG_URL;
+        delete next.AOPS_SQLITE_URL;
+        if (repoUrl) {
+            next.AOPS_REPO_URL = repoUrl;
+            next[inferAopsRepoDialect(repoUrl) === 'sqlite' ? 'AOPS_SQLITE_URL' : 'AOPS_PG_URL'] = repoUrl;
+        }
+    }
+    if (patch.logLevel !== undefined) {
+        const level = normalizeLogLevel(patch.logLevel);
+        if (level)
+            next.AOPS_LOG_LEVEL = level;
+        else
+            delete next.AOPS_LOG_LEVEL;
+    }
+    const managed = new Set(['AOPS_REPO_URL', 'AOPS_PG_URL', 'AOPS_SQLITE_URL', 'AOPS_LOG_LEVEL']);
+    const existingLines = current.exists ? fs.readFileSync(current.path, 'utf8').split(/\r?\n/) : [];
+    const touched = new Set();
+    const lines = existingLines.map((line) => {
+        const match = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)\s*$/);
+        if (!match || !managed.has(match[1]))
+            return line;
+        touched.add(match[1]);
+        return next[match[1]] ? match[1] + '=' + quoteEnv(next[match[1]]) : '';
+    });
+    for (const key of managed)
+        if (next[key] && !touched.has(key))
+            lines.push(key + '=' + quoteEnv(next[key]));
+    fs.mkdirSync(path.dirname(current.path), { recursive: true });
+    fs.writeFileSync(current.path, lines.filter((line, index, all) => line || all[index - 1]).join('\n').trimEnd() + '\n', { mode: 0o600 });
+    try {
+        fs.chmodSync(current.path, 0o600);
+    }
+    catch { }
+    return readAopsServerEnvConfig(processEnv, current.path);
+}
+export function getDefaultAopsSqlitePath(processEnv = process.env) {
+    return path.resolve(getAopsRuntimeConfigDir(processEnv), AOPS_SQLITE_FILENAME);
+}
+export function getDefaultAopsSqliteRepoUrl(processEnv = process.env) {
+    return pathToFileURL(getDefaultAopsSqlitePath(processEnv)).href;
+}