@bjorntech/key-ferry 0.0.0-stage → 0.1.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 key-ferry contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,210 @@
-# Temporary Holding Version
+# @bjorntech/key-ferry
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Project-scoped Key Ferry credential proxy integration for OpenCode V2.
+
+## What it protects
+
+The native Effect 4 plugin owns a project-scoped Varlock proxy process and
+protects explicitly selected MCP servers:
+
+- Local MCP servers receive placeholder-backed environment mappings.
+- Remote API-key MCP servers use an authenticated, scoped loopback relay.
+  The relay forwards Streamable HTTP and legacy SSE through Varlock's HTTP
+  CONNECT proxy to the configured HTTPS endpoint.
+- Startup, refresh, missing-placeholder, relay, and sidecar failures fail
+  closed. There is no direct-transport fallback.
+- Unselected remote servers, including native OAuth servers, remain unchanged.
+
+The plugin never wraps OpenCode, mutates global `process.env`, or stores real
+secret values in OpenCode configuration. Public status, RPC, and TUI output
+never expose relay tokens, environment values, CA contents, or raw daemon
+output.
+
+This is scoped credential-proxy routing, not a full sandbox. Same-user
+processes can still access normal files, stores, and daemons. The remote relay
+controls its configured outbound path rather than relying on the MCP client to
+honor proxy environment variables, but response payloads are not guaranteed
+to have every secret scrubbed.
+Direct provider/API transport protection is not included.
+
+## Requirements
+
+- OpenCode V2 with native `@opencode/plugin/effect`
+- `@opencode/plugin` 2.0.30-compatible runtime
+- Effect 4.0.1-compatible runtime
+- Node.js 22 or newer
+- Varlock CLI 1.23.0 installed separately as `varlock`
+- An installed Varlock CLI and a configured Varlock environment/schema with the
+  secrets and proxy rules your MCP servers need
+- Configure secret sources and authentication following the
+  [Varlock documentation](https://varlock.dev/)
+
+Verification has been exercised with Node 24 and Bun 1.4.2, alongside the
+native OpenCode V2 package types and Effect 4.0.1.
+
+## Installation
+
+OpenCode installs configured npm plugins automatically. Add the package to the
+global OpenCode plugin configuration (normally `~/.config/opencode/opencode.jsonc`)
+and preserve any unrelated entries already there:
+
+```jsonc
+{
+  "plugins": [
+    {
+      "package": "@bjorntech/key-ferry@0.1.4",
+      "options": {
+        "enabled": true,
+        "requireStrictEgress": true,
+        "projectDirectory": ".",
+        "servers": {
+          "example-local-mcp": { "env": ["FAKE_API_KEY"] },
+          "example-remote-mcp": {
+            "remote": {
+              "headers": {
+                "Authorization": { "env": "REMOTE_API_KEY", "prefix": "Bearer " }
+              }
+            }
+          }
+        }
+      }
+    }
+  ]
+}
+```
+
+The package is configured globally, while `projectDirectory` and the selected
+server mappings determine which project context is protected. Unmapped MCP
+servers remain under native OpenCode behavior. A selected remote API-key server
+must explicitly set `oauth: false`; native OAuth remains unchanged for
+unselected servers.
+
+Install the Varlock CLI separately. A shared CLI installation is preferred over
+installing it in every project:
+
+```sh
+brew install dmno-dev/tap/varlock
+varlock --version
+```
+
+If Homebrew is unavailable, use the pinned Varlock 1.23.0 installer from the
+official Varlock source and ensure the resulting `varlock` executable is on
+`PATH`. The plugin does not install Varlock or unlock a secret store.
+
+The package's sibling `./tui` export is discovered automatically when the
+server plugin is loaded. Do not add a duplicate `cli.json` entry for an
+ordinary server-plugin installation. A global `cli.json` entry is only useful
+for a CLI-only deployment or a CLI connected to a remote OpenCode server that
+already loaded the server plugin.
+
+Set `projectDirectory` to the project root containing the schema, or to a
+central Varlock configuration directory such as `~/.config/key-ferry`. It does
+not need to be a Git repository. The plugin starts and owns its Varlock sidecar
+itself; do not wrap OpenCode or manually run `varlock proxy`.
+
+## Configuration
+
+Local mappings preserve the MCP command, cwd, and unrelated environment:
+
+```jsonc
+"example-local-mcp": {
+  "env": { "UPSTREAM_API_KEY": "FAKE_API_KEY" }
+}
+```
+
+Remote mappings map target HTTP headers to exact Varlock environment names.
+The string form is an environment reference, never a raw header value:
+
+```jsonc
+"example-remote-mcp": {
+  "remote": {
+    "headers": {
+      "Authorization": { "env": "REMOTE_API_KEY", "prefix": "Bearer " },
+      "X-Tenant": { "env": "REMOTE_TENANT", "suffix": "-synthetic" }
+    }
+  }
+}
+```
+
+Header names are validated for control, hop-by-hop, protocol, duplicate, and
+credential-confusion cases. The target URL comes from the native MCP remote
+configuration, not from the relay mapping. HTTPS credentials and fragments
+are rejected. Literal local/private IP targets are rejected unless the
+explicit `allowPrivateNetwork: true` policy is set. Normal corporate DNS
+names are not rejected merely because they may resolve internally.
+
+Use `examples/.env.schema` for synthetic strict-egress values only. Mark each
+remote upstream host with `@proxy(domain="...")` and keep
+`@proxyConfig={egress="strict"}`. Configure any secret source through Varlock;
+Key Ferry does not install Varlock, create its schema, or configure provider
+authentication. Never commit a real secret.
+
+## TUI commands
+
+| Palette command | Slash command | RPC |
+| --- | --- | --- |
+| `key-ferry.status` | `/key-ferry-status` | `status` |
+| `key-ferry.refresh` | `/key-ferry-refresh` | `refresh` |
+| `key-ferry.doctor` | `/key-ferry-doctor` | `doctor` |
+
+The rename is intentionally breaking for the 0.1.0 release: no `varlock-*`
+command aliases are retained.
+
+Refresh and doctor report safe lifecycle and remote-configuration diagnostics.
+They do not provide credential prompts or collect credentials. Doctor can
+reconcile or recreate unhealthy selected `oauth:false` remote relays after
+Varlock readiness succeeds, so authentication still depends on the configured
+Varlock context.
+
+## Transport and lifecycle limits
+
+The relay supports Streamable HTTP POST/GET/DELETE, streaming SSE, scoped
+loopback authentication, bounded request handling, and session URL rewriting
+for legacy SSE endpoints. Modern Streamable HTTP and legacy SSE responses are
+streamed through bounded framing; compressed or oversized traffic fails closed
+within the configured limits. A relay maintains at most 256 registered session
+routes; duplicate registrations do not consume capacity, and new routes are
+rejected after the cap. Native MCP session state is reset when Varlock refresh
+changes the manager generation or when the relay is replaced. Existing remote
+sessions must reconnect.
+
+Varlock's public CA is read at the IO boundary and trusted by the relay. The
+CA is not a secret, while raw secret values remain outside OpenCode. This is
+not a complete response-content scrubber and does not replace native OAuth.
+The public CA uses Varlock's required `0644` trust-material permissions.
+Cleanup is scoped to this project instance and never performs a global
+Varlock shutdown.
+
+The packed root, TUI, and relay import paths are verified together. No wrapper
+process is needed.
+
+## Verification
+
+```sh
+bun typecheck
+bun test
+bun run build
+```
+
+Coverage, formatter, and per-function CRAP-gate details are documented in
+[Quality checks](docs/quality.md).
+
+The two live Varlock tests are gated and skipped unless
+`VARLOCK_LIVE_BINARY` points to an absolute CLI path. It uses synthetic
+fixtures and isolated configuration. No per-test host credential or provider
+authentication is required. Run them explicitly with:
+
+```sh
+VARLOCK_LIVE_BINARY=/absolute/path/to/varlock bun test tests/varlock-live.test.ts
+VARLOCK_LIVE_BINARY=/absolute/path/to/varlock bun test tests/remote-varlock-live.test.ts
+```
+
+The normal suite and gated live fixtures are separate verification layers. Run
+the commands above as needed; do not treat the normal suite as
+certification of every external MCP provider, production deployment, or live
+OpenCode TUI session.
+
+See [Architecture](docs/architecture.md),
+[Troubleshooting](docs/troubleshooting.md), and
+[Quality checks](docs/quality.md),
+[the example configuration](examples/opencode.jsonc).

package/SECURITY.md

@@ -0,0 +1,87 @@
+# Security
+
+## Scope and security model
+
+This project provides a native OpenCode V2 Effect plugin with a project-scoped,
+owned Varlock CLI proxy sidecar. It is not a wrapper around all of OpenCode.
+Local MCP servers are mapped explicitly to proxy placeholders and are disabled
+until the sidecar is ready. Selected remote API-key MCP servers are instead
+rewritten at runtime to an authenticated, project-scoped loopback relay. The
+relay forwards Streamable HTTP and legacy SSE through Varlock's HTTP CONNECT
+proxy to the fixed HTTPS target. Both modes fail closed when startup, refresh,
+placeholder, relay, or sidecar health checks fail. Connections are scoped to
+the OpenCode location and project, not to individual sessions.
+
+The protocol exposes only an allowlisted, sanitized subset of Varlock status
+JSON through public RPC. Do not assume that Varlock CLI output is safe to
+publish: public CLI status may contain tokens. Full proxy environments may
+contain raw passthrough values, including transient values held in process
+memory, but this plugin permits only exact, placeholder-matched
+`placeholderOverrides` entries to cross its adapter boundary. Never log or
+publish a full environment map.
+
+Strict egress is required by the manager default and is schema-controlled. The
+local MCP path depends on the client honoring the supplied proxy environment;
+the plugin cannot force an arbitrary local client to use that route.
+The remote relay controls its configured outbound dispatcher instead of relying
+on that client behavior, but this is not a sandbox or a claim of universal
+network isolation. A same-user process may access configured secret stores,
+files, configuration, or daemons. Direct provider/API transports are not
+implemented. Unselected remote servers and native MCP OAuth handling remain
+unchanged; this project does not replace OAuth.
+
+Remote relay selection requires an explicit native `oauth: false` and exact
+header-to-environment mappings. OAuth-enabled or OAuth-default remote servers
+are disabled when selected for Varlock protection rather than silently
+downgraded or sent directly. The relay binds to loopback, authenticates every
+request with a scoped token, rejects unregistered downstream paths, and
+invalidates old capabilities on manager generation changes.
+
+Doctor rechecks Varlock readiness and can reconcile or recreate unhealthy
+selected `oauth:false` relays. It does not provide a credential prompt or
+replace native OAuth. Each relay caps registered session routes at 256;
+duplicates do not consume capacity and new routes are rejected after the cap.
+Relay TLS uses CONNECT and one verified `tls.connect` with the manager CA,
+target `servername`, and `rejectUnauthorized: true`; the custom HTTP agent
+returns that socket for HTTP framing. No global TLS flags are changed and
+certificate verification is not weakened. Compressed or oversized framing
+fails closed within configured limits.
+
+Remote target URLs must be HTTPS without credentials or fragments. Literal
+private/local targets require explicit `allowPrivateNetwork: true`; normal
+corporate DNS names are not rejected solely because they may resolve
+internally. The relay uses the configured target origin/path and never accepts
+an arbitrary destination from downstream MCP traffic.
+
+Varlock's public CA is trusted by the relay at the IO boundary, while raw
+secret values remain outside OpenCode. CA MITM support and response scrubbing
+have limitations; not every response payload is guaranteed scrubbed. Do not
+place secret values in logs, errors, RPC payloads, issue reports, or support output.
+The public CA file uses Varlock's required `0644` trust-material permissions;
+it is not a secret. Cleanup is scoped to resources acquired by this project
+instance and never invokes a global Varlock shutdown.
+The plugin does not mutate `process.env`.
+
+Native V2 types, mocks, package imports, and synthetic HTTPS/Varlock fixtures
+are covered by the project verification commands. Opt-in fixture results do not
+constitute production certification, compatibility with every external MCP
+provider, or a fully live OpenCode host/TUI session.
+
+## Reporting a vulnerability
+
+Report vulnerabilities through the repository's GitHub security reporting
+mechanism for `bjorntech/key-ferry`. Do not open a public issue for an
+unfixed vulnerability. Include reproduction steps and impact, but never
+include secret values, tokens, credentials, or complete sensitive output.
+
+The report should identify the affected version or commit and whether the
+issue involves the plugin, the Varlock CLI dependency, OpenCode, or an MCP
+server. Do not assume that a Varlock or OpenCode issue is fixed by this plugin.
+
+## Dependency and deployment guidance
+
+Use supported, pinned dependency versions and review changes to the OpenCode
+V2 plugin API, Effect 4, Bun, and the Varlock CLI before upgrading. Run the
+sidecar with the least privilege available to the project and user. Do not
+enable real secret-manager or network integration in automated tests unless a
+separate, explicitly controlled environment is being used.

package/dist/contracts.d.ts

@@ -0,0 +1,133 @@
+import { Context, Effect, Layer, Schema, Scope } from "effect";
+/**
+ * Effect-native contracts shared by the Key Ferry sidecar manager and OpenCode
+ * V2 adapters.
+ *
+ * Resolved environment values are an internal capability. They must never be
+ * returned by status, RPC, logs, or model-visible tool output.
+ */
+export type ProjectDirectory = string & {
+    readonly __projectDirectory: unique symbol;
+};
+export type ManagerPhase = "stopped" | "starting" | "ready" | "degraded" | "failed" | "stopping";
+export type VarlockErrorCode = "invalid_config" | "unavailable" | "start_failed" | "refresh_failed" | "not_ready" | "disposed" | "protocol_error" | "timeout";
+declare const VarlockError_base: Schema.Class<VarlockError, Schema.TaggedStruct<"Varlock.Error", {
+    readonly code: Schema.Literals<readonly ["invalid_config", "unavailable", "start_failed", "refresh_failed", "not_ready", "disposed", "protocol_error", "timeout"]>;
+    readonly message: Schema.String;
+    readonly retryable: Schema.Boolean;
+}>, import("effect/Cause").YieldableError>;
+/** Tagged and already-sanitized error safe for public diagnostics. */
+export declare class VarlockError extends VarlockError_base {
+}
+/** Safe to return from status RPCs or display to a user. */
+export interface SafeStatus {
+    readonly phase: ManagerPhase;
+    readonly projectDirectory: ProjectDirectory;
+    readonly generation: number;
+    readonly pid?: number;
+    readonly endpoint?: string;
+    readonly lastRefreshAt?: string;
+    readonly error?: VarlockError;
+    readonly diagnostics?: readonly SafeDiagnostic[];
+}
+/** Secret-free configuration diagnostics surfaced to RPC/TUI consumers. */
+export interface SafeDiagnostic {
+    readonly code: string;
+    readonly server: string;
+    readonly message: string;
+}
+/**
+ * Secret-bearing values are deliberately separate from SafeStatus. This type
+ * is for internal process/proxy wiring only and must not cross an RPC boundary.
+ */
+export type ResolvedEnvironment = Readonly<Record<string, string>>;
+/**
+ * A manager is location/project scoped. Every mutating operation is required
+ * to serialize against the manager's internal semaphore and to honor Effect
+ * interruption. Implementations must never mutate global process.env.
+ */
+export interface ProjectKeyFerryManagerService {
+    readonly status: Effect.Effect<SafeStatus>;
+    /** Start or reuse the manager-owned process, failing closed if not ready. */
+    readonly ensureStarted: Effect.Effect<SafeStatus, VarlockError>;
+    /** Internal-only environment capability for a child process or proxy. */
+    readonly environment: Effect.Effect<ResolvedEnvironment, VarlockError>;
+    /** Re-resolve and atomically apply values; failures leave the connection closed. */
+    readonly refresh: Effect.Effect<SafeStatus, VarlockError>;
+    /** Idempotent teardown of only the process and resources this manager owns. */
+    readonly dispose: Effect.Effect<void>;
+    /**
+     * Serializes lifecycle and refresh operations. Implementations should back
+     * this with an internal Semaphore and reject work after disposal.
+     */
+    readonly withExclusive: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+}
+declare const ProjectKeyFerryManager_base: Context.ServiceClass<ProjectKeyFerryManager, "key-ferry/ProjectKeyFerryManager", ProjectKeyFerryManagerService>;
+/** Native Effect service tag used by the manager and plugin layers. */
+export declare class ProjectKeyFerryManager extends ProjectKeyFerryManager_base {
+}
+export interface ProjectKeyFerryManagerOptions {
+    readonly projectDirectory: ProjectDirectory;
+    /** Stable diagnostic label only, never a credential or secret. */
+    readonly owner?: string;
+    /** Adapter-specific non-secret options, pending Varlock protocol finalization. */
+    readonly adapter?: Readonly<Record<string, unknown>>;
+    /** Optional explicit owned session identifier; omitted for owned-only MVP. */
+    readonly sessionID?: string;
+}
+/**
+ * A factory supplies a scoped Layer. The implementation should use
+ * Effect.acquireRelease for the owned process and register finalization in the
+ * caller's Scope. No daemon adoption or global stop operation is implied.
+ */
+export interface ProjectKeyFerryManagerFactory<R = never> {
+    readonly layer: (options: ProjectKeyFerryManagerOptions) => Layer.Layer<ProjectKeyFerryManager, VarlockError, R>;
+}
+/** Public plugin options. Values are configuration, never resolved secrets. */
+export interface KeyFerryPluginOptions {
+    readonly enabled?: boolean;
+    readonly projectDirectory?: string;
+    readonly adapter?: Readonly<Record<string, unknown>>;
+}
+/** Runtime service dependencies for an injectable process implementation. */
+export interface VarlockProcessService {
+    readonly spawn: (input: VarlockProcessSpawn) => Effect.Effect<VarlockProcessHandle, VarlockError>;
+    readonly send: (handle: VarlockProcessHandle, input: VarlockProcessCommand) => Effect.Effect<VarlockProcessResult, VarlockError>;
+    readonly stop: (handle: VarlockProcessHandle) => Effect.Effect<void, VarlockError>;
+}
+export interface VarlockProcessSpawn {
+    readonly command: readonly string[];
+    readonly cwd: ProjectDirectory;
+    readonly sessionID: string;
+    readonly allowReload: true;
+}
+export interface VarlockProcessHandle {
+    readonly pid: number;
+    readonly sessionID: string;
+    readonly ownershipID: string;
+}
+export type VarlockProcessCommand = {
+    readonly type: "status";
+} | {
+    readonly type: "environment";
+    readonly names: readonly string[];
+} | {
+    readonly type: "refresh";
+};
+export interface VarlockProcessResult {
+    /** Raw protocol data stays inside the Varlock adapter. */
+    readonly value: unknown;
+}
+declare const VarlockProcess_base: Context.ServiceClass<VarlockProcess, "key-ferry/VarlockProcess", VarlockProcessService>;
+export declare class VarlockProcess extends VarlockProcess_base {
+}
+/** Explicit brand constructor used at configuration boundaries. */
+export declare function projectDirectory(value: string): ProjectDirectory;
+/**
+ * A scoped layer must be provided under an Effect Scope. This alias documents
+ * the intended lifetime without forcing callers to expose implementation
+ * details or Promise wrappers.
+ */
+export type ScopedManagerLayer<R = never> = Layer.Layer<ProjectKeyFerryManager, VarlockError, R | Scope.Scope>;
+export {};
+//# sourceMappingURL=contracts.d.ts.map

package/dist/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAE/D;;;;;;GAMG;AAEH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAEvF,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEjG,MAAM,MAAM,gBAAgB,GACxB,gBAAgB,GAChB,aAAa,GACb,cAAc,GACd,gBAAgB,GAChB,WAAW,GACX,UAAU,GACV,gBAAgB,GAChB,SAAS,CAAC;;;;;;AAEd,sEAAsE;AACtE,qBAAa,YAAa,SAAQ,iBAahC;CAAG;AAEL,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAClD;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAE3C,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAEhE,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;IAEvE,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAE1D,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEtC;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;CAC7F;;AAED,uEAAuE;AACvE,qBAAa,sBAAuB,SAAQ,2BAGL;CAAG;AAE1C,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAC5C,kEAAkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,6BAA6B,CAAC,CAAC,GAAG,KAAK;IACtD,QAAQ,CAAC,KAAK,EAAE,CACd,OAAO,EAAE,6BAA6B,KACnC,KAAK,CAAC,KAAK,CAAC,sBAAsB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;CAC3D;AAED,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtD;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;IAClG,QAAQ,CAAC,IAAI,EAAE,CACb,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAEjC,MAAM,WAAW,oBAAoB;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;;AAED,qBAAa,cAAe,SAAQ,mBAEnC;CAAG;AAEJ,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAGhE;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,CAAC,CAAC,GAAG,KAAK,IAAI,KAAK,CAAC,KAAK,CACrD,sBAAsB,EACtB,YAAY,EACZ,CAAC,GAAG,KAAK,CAAC,KAAK,CAChB,CAAC"}

package/dist/contracts.js

@@ -0,0 +1,29 @@
+import { Context, Effect, Layer, Schema, Scope } from "effect";
+/** Tagged and already-sanitized error safe for public diagnostics. */
+export class VarlockError extends Schema.TaggedError()("Varlock.Error", {
+    code: Schema.Literals([
+        "invalid_config",
+        "unavailable",
+        "start_failed",
+        "refresh_failed",
+        "not_ready",
+        "disposed",
+        "protocol_error",
+        "timeout",
+    ]),
+    message: Schema.String,
+    retryable: Schema.Boolean,
+}) {
+}
+/** Native Effect service tag used by the manager and plugin layers. */
+export class ProjectKeyFerryManager extends Context.Service()("key-ferry/ProjectKeyFerryManager") {
+}
+export class VarlockProcess extends Context.Service()("key-ferry/VarlockProcess") {
+}
+/** Explicit brand constructor used at configuration boundaries. */
+export function projectDirectory(value) {
+    if (value.length === 0)
+        throw new TypeError("project directory must not be empty");
+    return value;
+}
+//# sourceMappingURL=contracts.js.map

package/dist/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAwB/D,sEAAsE;AACtE,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,eAAe,EAAE;IACpF,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC;QACpB,gBAAgB;QAChB,aAAa;QACb,cAAc;QACd,gBAAgB;QAChB,WAAW;QACX,UAAU;QACV,gBAAgB;QAChB,SAAS;KACD,CAAC;IACX,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,SAAS,EAAE,MAAM,CAAC,OAAO;CAC1B,CAAC;CAAG;AAsDL,uEAAuE;AACvE,MAAM,OAAO,sBAAuB,SAAQ,OAAO,CAAC,OAAO,EAGxD,CAAC,kCAAkC,CAAC;CAAG;AA+D1C,MAAM,OAAO,cAAe,SAAQ,OAAO,CAAC,OAAO,EAAyC,CAC1F,0BAA0B,CAC3B;CAAG;AAEJ,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IACnF,OAAO,KAAyB,CAAC;AACnC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+/** The native OpenCode V2 server plugin entrypoint. */
+declare const plugin: import("@opencode/plugin/effect/plugin").Plugin<import("effect/Scope").Scope>;
+export default plugin;
+export { makePlugin } from "./plugin.js";
+export { startRelay, RELAY_AUTH_HEADER, RelayError } from "./relay/index.js";
+export type { RelayConfig, RelayHandle, RelayHealth, RelayErrorCode } from "./relay/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,uDAAuD;AAIvD,QAAA,MAAM,MAAM,+EAAwD,CAAC;AAErE,eAAe,MAAM,CAAC;AAEtB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC7E,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,12 @@
+import { makePlugin } from "./plugin.js";
+import { startRelay } from "./relay/index.js";
+import { projectKeyFerryManagerFactory } from "./varlock/manager.js";
+/** The native OpenCode V2 server plugin entrypoint. */
+// The production entrypoint supplies the real CONNECT relay. Keeping the
+// factory injectable in makePlugin is useful for tests, but omitting it here
+// would silently disable every selected remote MCP server.
+const plugin = makePlugin(projectKeyFerryManagerFactory, startRelay);
+export default plugin;
+export { makePlugin } from "./plugin.js";
+export { startRelay, RELAY_AUTH_HEADER, RelayError } from "./relay/index.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AAErE,uDAAuD;AACvD,yEAAyE;AACzE,6EAA6E;AAC7E,2DAA2D;AAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,6BAA6B,EAAE,UAAU,CAAC,CAAC;AAErE,eAAe,MAAM,CAAC;AAEtB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/options.d.ts

@@ -0,0 +1,44 @@
+import type { ProjectDirectory, ProjectKeyFerryManagerOptions, KeyFerryPluginOptions } from "./contracts.js";
+export interface ServerProtectionInput {
+    /** Output environment name -> Varlock placeholder/environment key. */
+    readonly env: readonly string[] | Readonly<Record<string, string>>;
+}
+export interface RemoteHeaderMapping {
+    readonly env: string;
+    readonly prefix?: string;
+    readonly suffix?: string;
+}
+export interface RemoteServerProtectionInput {
+    readonly remote: {
+        readonly headers: Readonly<Record<string, string | RemoteHeaderMapping>>;
+    };
+}
+export type ServerProtection = Readonly<Record<string, string>> | RemoteServerProtectionInput;
+export interface VarlockAdapterOptions {
+    readonly command: readonly string[];
+    readonly startupTimeoutMs: number;
+    readonly commandTimeoutMs: number;
+    readonly reloadTimeoutMs: number;
+    readonly pollIntervalMs: number;
+    readonly requireStrictEgress: boolean;
+    readonly allowPrivateNetwork: boolean;
+    readonly servers: Readonly<Record<string, ServerProtection>>;
+    /** @deprecated Use reloadTimeoutMs. Kept as a non-enumerable compatibility view. */
+    readonly refreshTimeoutMs: number;
+}
+export interface ValidatedOptions {
+    readonly enabled: boolean;
+    readonly projectDirectory?: ProjectDirectory;
+    readonly adapter: VarlockAdapterOptions;
+    readonly manager: Omit<KeyFerryPluginOptions, "adapter"> & {
+        readonly adapter: VarlockAdapterOptions;
+    };
+}
+/**
+ * Decode untrusted OpenCode plugin options without touching process.env.
+ * `enabled: false` explicitly means no manager layer, MCP transform, or RPC
+ * is installed and existing MCP configuration is left untouched.
+ */
+export declare function parseOptions(raw: unknown, directory?: string): ValidatedOptions;
+export declare function managerOptions(options: ValidatedOptions, directory: string): ProjectKeyFerryManagerOptions;
+//# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,EACtB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,WAAW,qBAAqB;IACpC,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC;KAC1E,CAAC;CACH;AAED,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,2BAA2B,CAAC;AAE9F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC7D,oFAAoF;IACpF,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,SAAS,CAAC,GAAG;QACzD,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;KACzC,CAAC;CACH;AA6JD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAoH/E;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,gBAAgB,EACzB,SAAS,EAAE,MAAM,GAChB,6BAA6B,CA6B/B"}