@cldmv/gh-broker 0.8.0 → 0.10.0

package/src/catalog.ts

@@ -1,182 +0,0 @@
-/**
- *
- *	@Project: @cldmv/gh-broker
- *	@Filename: /src/catalog.ts
- *	@Date: 2026-07-07T00:24:51-07:00 (1783409091)
- *	@Author: Nate Corcoran <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-10-31T12:12:11-07:00 (1793473931)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- *
- */
-
-import type { Tool } from "@modelcontextprotocol/sdk/types.js";
-import type { Config, SecretStore } from "./types.ts";
-import type { UpstreamPool } from "./upstream.ts";
-// DEFERRED: link_issue (addClosingIssueReference) is App-token-only and not wired in — see docs.
-// import { LINK_ISSUE_SCHEMA } from "./verbs/link_issue.ts";
-import { RESOLVE_REVIEW_THREAD_SCHEMA, REPLY_REVIEW_THREAD_SCHEMA } from "./verbs/review_thread.ts";
-import { REPORT_UNLABELED_SCHEMA } from "./verbs/report_unlabeled.ts";
-import { REPORT_SECURITY_ALERTS_SCHEMA } from "./verbs/report_security_alerts.ts";
-import { REPORT_RELEASE_PRS_SCHEMA } from "./verbs/report_release_prs.ts";
-import { ISSUE_LABELS_SCHEMA } from "./verbs/issue_labels.ts";
-import { REPORT_CI_STATUS_SCHEMA } from "./verbs/report_ci_status.ts";
-import { NPM_SCAFFOLD_SCHEMA } from "./verbs/npm_scaffold.ts";
-import { unavailableReason } from "./availability.ts";
-import { GHCR_CATALOG } from "./verbs/ghcr_push.ts";
-
-/**
- * Build the advertised tool list ONCE at startup. Proxied tools carry their real
- * schemas fetched from the hosted MCP (tool schemas are owner-independent, so any
- * valid read token works — we use the first configured owner's read PAT). Custom
- * verbs carry local schemas. Only allowlisted tools appear; nothing else is
- * advertised (and, per the router, nothing else is executable either).
- *
- * If the upstream fetch fails (network/token), we advertise minimal schemas rather
- * than fail startup — the daemon still serves and calls still route correctly.
- */
-export async function buildCatalog(config: Config, secrets: SecretStore, upstream: UpstreamPool): Promise<Tool[]> {
-	const upstreamByName = new Map<string, Tool>();
-	// Whether the upstream tool list was actually fetched. If it wasn't (network/token), we must NOT drop
-	// allowlisted tools — we fall back to minimal schemas so the daemon still serves + routes. But if the
-	// fetch DID succeed, a tool missing from it genuinely isn't served by this upstream (wrong toolset /
-	// renamed), so advertising a minimal-schema stub only defers the failure to call time (the confusing
-	// "could not determine repo owner" → "unknown tool" pair) — better to skip it and say why at startup.
-	let upstreamFetched = false;
-	const firstOwner = Object.values(config.owners)[0];
-	if (firstOwner) {
-		try {
-			const token = secrets.resolve(firstOwner.read);
-			// Never let a slow/unreachable upstream hang startup — fall back to minimal schemas.
-			const timeoutMs = Number(process.env.GH_BROKER_CATALOG_TIMEOUT_MS ?? 10000);
-			const tools = await Promise.race([
-				upstream.listToolsFor(token),
-				new Promise<never>((_, rej) => setTimeout(() => rej(new Error(`timed out after ${timeoutMs}ms`)), timeoutMs).unref())
-			]);
-			for (const t of tools) upstreamByName.set(t.name, t);
-			upstreamFetched = true;
-		} catch (err) {
-			console.error(`catalog: could not fetch upstream tool schemas (${(err as Error).message}) — advertising minimal schemas`);
-		}
-	}
-
-	const tools: Tool[] = [];
-	for (const rule of config.tools) {
-		const unavailable = unavailableReason(rule, config, secrets);
-		if (unavailable) {
-			console.error(`catalog: "${rule.name}" is not exposed: ${unavailable}`);
-			continue;
-		}
-		if (rule.custom) {
-			// DEFERRED: link_issue (App-token-only addClosingIssueReference) is not wired in — see docs.
-			// Intentionally not advertised even if an allowlist entry is added; re-enable by restoring
-			// this branch + the import above + the router dispatch case, then config.app + installationId.
-			if (rule.name === "resolve_review_thread") {
-				tools.push({
-					name: "resolve_review_thread",
-					description:
-						"Resolve (or unresolve) a pull-request review thread — e.g. mark a Copilot review comment resolved once addressed. Takes the thread node id from pull_request_read get_review_comments. Runs on the write PAT (Pull requests: write).",
-					inputSchema: RESOLVE_REVIEW_THREAD_SCHEMA
-				});
-			} else if (rule.name === "reply_review_thread") {
-				tools.push({
-					name: "reply_review_thread",
-					description:
-						"Post a reply inside a pull-request review thread — e.g. respond to a Copilot review comment. Takes the thread node id from pull_request_read get_review_comments. Runs on the write PAT (Pull requests: write).",
-					inputSchema: REPLY_REVIEW_THREAD_SCHEMA
-				});
-			} else if (rule.name === "issue_labels") {
-				tools.push({
-					name: "issue_labels",
-					description:
-						'Edit the labels on one issue or PR without touching any other label on it. add / remove take one label or several (combinable in one call); swap { prefix, to } removes every label starting with prefix and adds to (e.g. prefix "status: ", to "status: verified"); set replaces the whole set and only as an explicit choice. Labels already present (add) or absent (remove) are no-ops. A label name to add that does not exist in the repo refuses the call and changes nothing, unless create_missing is true. Returns the resulting label set plus what was added, removed and created. Runs on the write PAT (Issues: write).',
-					inputSchema: ISSUE_LABELS_SCHEMA
-				});
-			} else if (rule.name === "npm_scaffold") {
-				tools.push({
-					name: "npm_scaffold",
-					description:
-						"Create a new npm package and register its GitHub Actions trusted publisher, so the repo's publish workflow can release it through OIDC from then on. Publishes a broker-built placeholder (0.0.0-stage, no code) and never publishes a version of an existing package. Every npm write needs its own one-time password from the user, so it takes two calls: the first publishes the placeholder and returns status needs_otp; ask the user for the next code and call again to add the trusted publisher. Ask for each code right before the call. A refused or expired code also returns needs_otp with the remaining steps. Checks first that the repo's package.json names the package and that the workflow file exists. Uses the broker's npm token (no 2FA bypass) and the read PAT.",
-					inputSchema: NPM_SCAFFOLD_SCHEMA
-				});
-			} else if (rule.name === "report_unlabeled") {
-				tools.push({
-					name: "report_unlabeled",
-					description:
-						"Report issues and/or PRs with no labels, for one repo or every non-archived repo an owner has. Bounded by maxRepos/perRepoLimit/maxApiCalls; returns truncated:true (with a reason) instead of failing outright if a cap or GitHub's rate limit is hit mid-scan. Runs on the read PAT.",
-					inputSchema: REPORT_UNLABELED_SCHEMA
-				});
-			} else if (rule.name === "report_security_alerts") {
-				tools.push({
-					name: "report_security_alerts",
-					description:
-						"Report every open Dependabot, code-scanning (CodeQL) and secret-scanning alert, for one repo or across every repo an owner has. Reads the org-level endpoints in a handful of calls and falls back to a per-repo sweep for any alert type the token can't read org-wide. Alert state tracks the default branch. Secret values are never returned. Bounded by maxRepos/alertLimit/maxApiCalls; returns truncated:true (with a reason) instead of failing outright if a cap or GitHub's rate limit is hit. Runs on the read PAT.",
-					inputSchema: REPORT_SECURITY_ALERTS_SCHEMA
-				});
-			} else if (rule.name === "report_release_prs") {
-				tools.push({
-					name: "report_release_prs",
-					description:
-						"Report every open release PR (label `release`: next→master and hotfixes→master) for one repo or across every repo an owner has, and whether each one's per-version changelog file (docs/changelog[s]/v<major>/vX.Y.Z.md) is already on the release branch. Status per PR: ready, needs-changelog, or unknown-version (title has no `release: vX.Y.Z`). Use during mass updates to find which repos need a changelog. One search call plus two calls per release PR found; returns truncated:true with a reason if a cap or GitHub's rate limit is hit. Runs on the read PAT.",
-					inputSchema: REPORT_RELEASE_PRS_SCHEMA
-				});
-			} else if (rule.name === "report_ci_status") {
-				tools.push({
-					name: "report_ci_status",
-					description:
-						"Report CI health for a PR, or every open PR in a repo, at a chosen verbosity: 0 counts only, 1 adds which run/job failed, 2 adds which step failed, 3 adds a tail of the failing job's log. Detail beyond tier 0 is only fetched for runs that are actually failing. Runs on the read PAT.",
-					inputSchema: REPORT_CI_STATUS_SCHEMA
-				});
-			} else if (GHCR_CATALOG[rule.name]) {
-				tools.push({ name: rule.name, ...GHCR_CATALOG[rule.name]! });
-			}
-			continue;
-		}
-		const up = upstreamByName.get(rule.name);
-		if (!up && upstreamFetched) {
-			// Reachable upstream that doesn't expose this tool → it would 32602 at call time. Skip + warn.
-			console.error(`catalog: allowlisted tool "${rule.name}" is NOT exposed by the upstream (${config.upstream}) — skipping it. Check the tool name or the upstream toolset (e.g. use /mcp/x/all for non-default toolsets like labels).`);
-			continue;
-		}
-		const base = up ?? { name: rule.name, description: `(${rule.mode}) proxied to the GitHub MCP`, inputSchema: { type: "object" } };
-		if (rule.augment && rule.name === "pull_request_read") {
-			// Layer gh-broker's own extension params onto the real upstream schema — the
-			// forwarded call still needs pull_request_read's actual params (method,
-			// pullNumber, ...); this ADDS to that, it doesn't replace it. See router.ts's
-			// dispatchAugmented for why gh-broker can extend a proxied tool's contract.
-			const baseSchema = base.inputSchema as { properties?: Record<string, unknown>; [k: string]: unknown };
-			tools.push({
-				...base,
-				description: `${base.description} gh-broker extension: with method "get", pass "ciVerbosity" (0-3) to also compute CI status for the PR's current head — 0 counts only, 1 adds which run/job failed, 2 adds which step failed, 3 adds a tail of the failing job's log; "logLines" tunes tier 3's tail length.`,
-				inputSchema: {
-					...baseSchema,
-					type: "object",
-					properties: {
-						...(baseSchema.properties ?? {}),
-						ciVerbosity: { type: "number", enum: [0, 1, 2, 3], description: 'gh-broker extension: also compute CI status at this verbosity (method "get" only)' },
-						logLines: { type: "number", description: "gh-broker extension: tier-3 log tail length" }
-					}
-				}
-			});
-			continue;
-		}
-		if (rule.name === "issue_write") {
-			// issue_write's `labels` REPLACES the issue's whole label set — the trap behind
-			// CLDMV/gh-broker#117. Say so where the agent reads the tool, and point at the verb
-			// that edits labels one at a time when it is allowlisted.
-			const pointer = config.tools.some((t) => t.name === "issue_labels" && t.custom)
-				? " To add, remove or swap individual labels, use issue_labels instead."
-				: " Read the current labels first and pass the full set you want to keep.";
-			tools.push({
-				...base,
-				description: `${base.description ?? ""} WARNING (gh-broker): "labels" REPLACES the issue's whole label set — every label not listed is removed.${pointer}`.trim()
-			});
-			continue;
-		}
-		tools.push(base);
-	}
-	return tools;
-}

package/src/config.ts

@@ -1,157 +0,0 @@
-/**
- *
- *	@Project: @cldmv/gh-broker
- *	@Filename: /src/config.ts
- *	@Date: 2026-07-07T00:24:51-07:00 (1783409091)
- *	@Author: Nate Corcoran <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-10-31T11:23:22-07:00 (1793471002)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- *
- */
-
-import { readFileSync } from "node:fs";
-import type { Config, Mode, ToolRule } from "./types.ts";
-import { parseGhcrConfig } from "./verbs/ghcr/config.ts";
-
-const MODES: readonly Mode[] = ["read", "write"];
-
-/** Load and validate the JSON config. Throws with a precise message on any problem. */
-export function loadConfig(path: string): Config {
-	let raw: unknown;
-	try {
-		raw = JSON.parse(readFileSync(path, "utf8"));
-	} catch (err) {
-		throw new Error(`config: cannot read/parse ${path}: ${(err as Error).message}`);
-	}
-	if (typeof raw !== "object" || raw === null) throw new Error("config: root must be an object");
-	const c = raw as Record<string, unknown>;
-
-	if (typeof c.listen !== "string" || !c.listen.startsWith("unix:")) {
-		throw new Error('config.listen: must be a "unix:<path>" string');
-	}
-	if (typeof c.upstream !== "string" || !/^https?:\/\//.test(c.upstream)) {
-		throw new Error("config.upstream: must be an http(s) URL");
-	}
-	if (!Array.isArray(c.tools) || c.tools.length === 0) {
-		throw new Error("config.tools: must be a non-empty array");
-	}
-
-	const seen = new Set<string>();
-	const tools: ToolRule[] = c.tools.map((t, i) => {
-		const o = t as Record<string, unknown>;
-		if (typeof o.name !== "string" || !o.name) throw new Error(`config.tools[${i}].name: required`);
-		if (!MODES.includes(o.mode as Mode)) throw new Error(`config.tools[${i}].mode: must be read|write`);
-		if (seen.has(o.name)) throw new Error(`config.tools: duplicate tool "${o.name}"`);
-		seen.add(o.name);
-		const custom = o.custom === true;
-		const augment = o.augment === true;
-		if (custom && augment) throw new Error(`config.tools[${i}] ("${o.name}"): custom and augment are mutually exclusive`);
-		return { name: o.name, mode: o.mode as Mode, custom, augment };
-	});
-
-	if (typeof c.owners !== "object" || c.owners === null) throw new Error("config.owners: must be an object");
-	const owners: Config["owners"] = {};
-	for (const [owner, v] of Object.entries(c.owners as Record<string, unknown>)) {
-		const o = v as Record<string, unknown>;
-		if (typeof o.read !== "string" || typeof o.write !== "string") {
-			throw new Error(`config.owners.${owner}: needs "read" and "write" credential refs`);
-		}
-		if (o.installationId !== undefined && typeof o.installationId !== "number") {
-			throw new Error(`config.owners.${owner}.installationId: must be a number`);
-		}
-		owners[owner.toLowerCase()] = {
-			read: o.read,
-			write: o.write,
-			...(typeof o.installationId === "number" ? { installationId: o.installationId } : {})
-		};
-	}
-	if (Object.keys(owners).length === 0) throw new Error("config.owners: at least one owner required");
-
-	let defaultOwner: string | undefined;
-	if (c.defaultOwner !== undefined) {
-		if (typeof c.defaultOwner !== "string" || !c.defaultOwner) {
-			throw new Error("config.defaultOwner: must be a non-empty string naming a configured owner");
-		}
-		defaultOwner = c.defaultOwner.toLowerCase();
-		if (!owners[defaultOwner]) {
-			throw new Error(`config.defaultOwner "${c.defaultOwner}" is not a key of config.owners`);
-		}
-	}
-
-	let app: Config["app"];
-	if (c.app !== undefined) {
-		const a = c.app as Record<string, unknown>;
-		if (typeof a.appId !== "number") throw new Error("config.app.appId: must be a number");
-		if (typeof a.privateKey !== "string") throw new Error('config.app.privateKey: must be a "cred:<name>" ref');
-		app = { appId: a.appId, privateKey: a.privateKey };
-	}
-
-	let secrets: Config["secrets"];
-	if (c.secrets !== undefined) {
-		if (typeof c.secrets !== "object" || c.secrets === null || Array.isArray(c.secrets)) throw new Error("config.secrets: must be an object");
-		const s = c.secrets as Record<string, unknown>;
-		if (s.provider !== undefined && s.provider !== "file" && s.provider !== "systemd-creds") {
-			throw new Error('config.secrets.provider: must be "systemd-creds" or "file"');
-		}
-		// Reject an empty path: resolveSecretsPath treats a falsy explicit path as
-		// "not provided" and falls back to env/default, so "" would be silently ignored.
-		if (s.path !== undefined && (typeof s.path !== "string" || s.path.length === 0)) {
-			throw new Error("config.secrets.path: must be a non-empty string");
-		}
-		// path only means anything to the file provider; the systemd-creds provider
-		// (the default) reads $CREDENTIALS_DIRECTORY and would silently ignore it.
-		// Reject the combination so an operator can't think a file path is in effect.
-		if (s.path !== undefined && (s.provider ?? "systemd-creds") !== "file") {
-			throw new Error('config.secrets.path is only used by the "file" provider — set provider to "file" or remove path');
-		}
-		secrets = {
-			...(s.provider === "file" || s.provider === "systemd-creds" ? { provider: s.provider } : {}),
-			...(typeof s.path === "string" ? { path: s.path } : {})
-		};
-	}
-
-	let npm: Config["npm"];
-	if (c.npm !== undefined) {
-		if (typeof c.npm !== "object" || c.npm === null || Array.isArray(c.npm)) throw new Error("config.npm: must be an object");
-		const n = c.npm as Record<string, unknown>;
-		if (typeof n.token !== "string" || !n.token.startsWith("cred:")) throw new Error('config.npm.token: must be a "cred:<name>" ref');
-		if (!Array.isArray(n.scopes) || n.scopes.length === 0) throw new Error('config.npm.scopes: must be a non-empty array of scopes, e.g. ["@cldmv"]');
-		const scopes = n.scopes.map((s, i) => {
-			if (typeof s !== "string" || !/^@[a-z0-9][a-z0-9._~-]*$/.test(s)) throw new Error(`config.npm.scopes[${i}]: must be a lowercase npm scope like "@cldmv"`);
-			return s;
-		});
-		if (n.registry !== undefined && (typeof n.registry !== "string" || !/^https:\/\//.test(n.registry))) {
-			throw new Error("config.npm.registry: must be an https URL");
-		}
-		if (n.tokenOrgs !== undefined && (!Array.isArray(n.tokenOrgs) || !n.tokenOrgs.every((o) => typeof o === "string" && /^[a-z0-9][a-z0-9._~-]*$/.test(o)))) {
-			throw new Error('config.npm.tokenOrgs: must be an array of lowercase npm org names, e.g. ["cldmv"]');
-		}
-		npm = {
-			token: n.token,
-			scopes,
-			...(typeof n.registry === "string" ? { registry: n.registry } : {}),
-			...(Array.isArray(n.tokenOrgs) ? { tokenOrgs: n.tokenOrgs as string[] } : {})
-		};
-	}
-
-	return {
-		listen: c.listen,
-		upstream: c.upstream,
-		tools,
-		owners,
-		...(app ? { app } : {}),
-		...(secrets ? { secrets } : {}),
-		...(defaultOwner ? { defaultOwner } : {}),
-		...(npm ? { npm } : {}),
-		...(c.ghcr !== undefined ? { ghcr: parseGhcrConfig(c.ghcr) } : {})
-	};
-}
-
-/** Build a name→rule index for O(1) allowlist checks. */
-export function indexTools(tools: ToolRule[]): Map<string, ToolRule> {
-	return new Map(tools.map((t) => [t.name, t]));
-}

package/src/index.ts

@@ -1,107 +0,0 @@
-/**
- *
- *	@Project: @cldmv/gh-broker
- *	@Filename: /src/index.ts
- *	@Date: 2026-07-07T00:24:51-07:00 (1783409091)
- *	@Author: Nate Corcoran <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-10-02T11:30:58-07:00 (1790965858)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- *
- */
-
-import { loadConfig } from "./config.ts";
-import { loadSecretStore } from "./secrets.ts";
-import { UpstreamPool } from "./upstream.ts";
-import { Router } from "./router.ts";
-import { AppAuth } from "./appauth.ts";
-import { buildCatalog } from "./catalog.ts";
-import { startServer } from "./server.ts";
-import { resolveConfigPath } from "./paths.ts";
-
-function argConfig(): string {
-	const i = process.argv.indexOf("--config");
-	if (i >= 0) {
-		// Fail fast on `--config` with no value (or a flag as the "value") rather than
-		// silently falling back to env/default and hiding the operator's mistake.
-		const explicit = process.argv[i + 1];
-		if (!explicit || explicit.startsWith("-")) throw new Error("--config requires a path argument");
-		return resolveConfigPath(explicit);
-	}
-	return resolveConfigPath(undefined);
-}
-
-async function main(): Promise<void> {
-	const configPath = argConfig();
-
-	// --print-paths: emit the resolved config + secrets paths and exit. The
-	// installer uses this so there is one path resolver (src/paths.ts), no drift.
-	// Honor a deployed config's secrets.path override when the config already exists
-	// (upgrades); fall back to the default when it doesn't (first install) or is
-	// unparseable — this must not require a valid config to run.
-	if (process.argv.includes("--print-paths")) {
-		const { resolveSecretsPath } = await import("./paths.ts");
-		let secretsOverride: string | undefined;
-		try {
-			secretsOverride = loadConfig(configPath).secrets?.path;
-		} catch {
-			secretsOverride = undefined;
-		}
-		console.log(JSON.stringify({ config: configPath, secrets: resolveSecretsPath(secretsOverride) }));
-		return;
-	}
-
-	const config = loadConfig(configPath);
-
-	// --check: validate the config parses (and, where possible, that credentials
-	// resolve), then exit WITHOUT starting the server. The installer runs this to
-	// fail an install/upgrade early. The file provider validates here; the
-	// systemd-creds provider can only resolve under systemd (needs
-	// $CREDENTIALS_DIRECTORY), so it's checked at service start / by the smoke test.
-	if (process.argv.includes("--check")) {
-		const provider = config.secrets?.provider ?? "systemd-creds";
-		// Truthy, not just "defined": the systemd-creds store treats an empty
-		// $CREDENTIALS_DIRECTORY as unset (if (!dir)), so --check must too — otherwise
-		// it would attempt secret resolution and fail where it should report unchecked.
-		const secretsChecked = provider === "file" || Boolean(process.env.CREDENTIALS_DIRECTORY);
-		if (secretsChecked) loadSecretStore(config);
-		console.log(JSON.stringify({ event: "config-ok", config: configPath, provider, secretsChecked, owners: Object.keys(config.owners), tools: config.tools.length }));
-		return;
-	}
-
-	const secrets = loadSecretStore(config); // eagerly validates every referenced credential
-	const upstream = new UpstreamPool(config);
-
-	// Optional GitHub App (for link_issue). Non-fatal: a misconfigured App disables
-	// link_issue but never takes down the read/write path.
-	let appAuth: AppAuth | undefined;
-	if (config.app) {
-		try {
-			appAuth = new AppAuth(config, secrets);
-		} catch (err) {
-			console.error(`gh-broker: app-auth disabled (link_issue unavailable): ${(err as Error).message}`);
-		}
-	}
-
-	const router = new Router(config, secrets, upstream, appAuth);
-	const catalog = await buildCatalog(config, secrets, upstream);
-	await startServer(config, router, catalog);
-	console.log(
-		JSON.stringify({
-			ts: new Date().toISOString(),
-			event: "listening",
-			listen: config.listen,
-			owners: Object.keys(config.owners),
-			app: appAuth ? "enabled" : "none",
-			tools: catalog.map((t) => t.name)
-		})
-	);
-}
-
-main().catch((err: unknown) => {
-	console.error(`gh-broker: fatal: ${(err as Error).message}`);
-	process.exit(1);
-});

package/src/paths.ts

@@ -1,60 +0,0 @@
-/**
- *
- *	@Project: @cldmv/gh-broker
- *	@Filename: /src/paths.ts
- *	@Date: 2026-09-06T10:05:35-07:00 (1788714335)
- *	@Author: Nate Corcoran <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-10-02T11:30:58-07:00 (1790965858)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- *
- */
-
-import { platform, env } from "node:process";
-import { join } from "node:path";
-
-/**
- * Platform-neutral path resolution for the config and secrets files.
- *
- * Nothing is hardcoded to /etc. Both files resolve through the same order:
- *   1. an explicit path (a `--config` flag, or GH_BROKER_CONFIG / GH_BROKER_SECRETS),
- *   2. the platform's system config dir (below),
- *   3. the packaged default under that dir.
- *
- * Only the Linux defaults are exercised today; the macOS/Windows entries are
- * wired so a later port is a table entry, not surgery. See docs/deploy-architecture.md.
- */
-
-/** The system-wide config directory for the current platform (env-overridable). */
-export function configDir(): string {
-	const override = env.GH_BROKER_CONFIG_DIR;
-	if (override) return override;
-	switch (platform) {
-		case "darwin":
-			return "/Library/Application Support/gh-broker";
-		case "win32":
-			return join(env.ProgramData ?? "C:\\ProgramData", "gh-broker");
-		default: // linux and other unixes
-			return "/etc/gh-broker";
-	}
-}
-
-/**
- * Resolve the config file path: an explicit argument (from `--config`) wins,
- * then GH_BROKER_CONFIG, then `<configDir>/config.json`.
- */
-export function resolveConfigPath(explicit?: string): string {
-	if (explicit) return explicit;
-	if (env.GH_BROKER_CONFIG) return env.GH_BROKER_CONFIG;
-	return join(configDir(), "config.json");
-}
-
-/** Resolve the secrets file path: an explicit argument wins, then GH_BROKER_SECRETS, then `<configDir>/secrets.json`. */
-export function resolveSecretsPath(explicit?: string): string {
-	if (explicit) return explicit;
-	if (env.GH_BROKER_SECRETS) return env.GH_BROKER_SECRETS;
-	return join(configDir(), "secrets.json");
-}