@embassys/ambassador 0.0.0 → 0.2.6

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 a2adev contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,4 +1,70 @@
 # Embassys Ambassador
 
-This `0.0.0` package is an inert placeholder used to configure npm trusted
-publishing. Install a later release to use Embassys Ambassador.
+Embassys Ambassador is a local bridge between an agent and the Embassys REST
+service. It exposes authenticated MCP tools to the agent and delivers incoming
+messages either to a webhook or directly to a local agent over ACP v1.
+
+The accepted package and command are:
+
+```text
+@embassys/ambassador
+ambassador start --local-token-env=<environment-variable>
+```
+
+Delivery is resolved through the MCP registration flow and a fixed capability
+registry. OpenClaw, Hermes, Codex, Claude Code, and Gemini CLI support both
+modes, so Ambassador asks their users to choose direct or webhook and presents
+direct as the default. Codex uses the existing
+`@agentclientprotocol/codex-acp` adapter, Claude Code uses
+`@agentclientprotocol/claude-agent-acp`, and Gemini CLI uses native ACP. A known
+direct-only profile would proceed without a delivery question. Unknown or
+incomplete profiles are rejected; the model cannot select an agent, command,
+or adapter. Webhook mode sends the complete message to a user-approved URL.
+Direct mode starts a gateway-managed ACP agent session. There is no agent
+selector or webhook URL on `start`.
+
+The central integration uses the unversioned REST API at
+`https://mcp.embassys.ai`. Verification binds the central token to an
+Ambassador-owned P-256 key. Protected requests use Bearer authorization plus a
+separate DPoP proof. Ambassador does not use the central MCP endpoint.
+
+## Implementation status
+
+The REST and DPoP integration and deterministic Ambassador delivery cutover
+are implemented. The live-central qualification with real Codex passed. The
+user approved publication of `@embassys/ambassador@0.2.6` before the remaining
+real-agent matrix is complete. That one-release exception is recorded in
+[ADR 0015](docs/adr/0015-npm-distribution.md); the outstanding qualification
+work remains visible in the [implementation plan](docs/implementation-plan.md).
+
+## Development
+
+Use Node.js 24 and the pnpm version recorded in `package.json`.
+
+```text
+pnpm install --frozen-lockfile
+pnpm check
+```
+
+CI uses a mock webhook receiver and mock ACP v1 agent for deterministic
+delivery tests. Opt-in local qualification covers all five supported agents in
+both delivery modes.
+
+## Documentation
+
+- [Documentation map](docs/README.md)
+- [Product and architecture](docs/product-vision-and-architecture.md)
+- [Target protocol](docs/protocol.md)
+- [Current work](docs/implementation-plan.md)
+- [Architecture decisions](docs/adr/README.md)
+- [Qualification strategy](docs/qualification.md)
+- [Codex setup](docs/getting-started-codex.md)
+- [Claude Code setup](docs/getting-started-claude.md)
+- [Gemini CLI setup](docs/getting-started-gemini.md)
+- [Hermes setup](docs/getting-started-hermes.md)
+- [OpenClaw setup](docs/getting-started-openclaw.md)
+- [Central service follow-ups](docs/central-follow-ups.md)
+
+## License
+
+MIT

package/dist/agent-capabilities.d.ts

@@ -0,0 +1,35 @@
+export type DeliveryMode = "direct" | "webhook";
+export type McpConfigurationBehavior = "provider_config" | "session";
+export interface AgentClientInfo {
+    readonly name: string;
+    readonly version: string;
+}
+export interface DirectAgentCapability {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly agentInfo: {
+        readonly name: string;
+        readonly versions: readonly string[];
+    };
+    readonly mcp: McpConfigurationBehavior;
+    readonly environment: readonly string[];
+}
+export interface AgentCapability {
+    readonly kind: string;
+    readonly displayName: string;
+    readonly enabled: boolean;
+    readonly aliases: readonly AgentClientInfo[];
+    readonly modes: readonly DeliveryMode[];
+    readonly direct?: DirectAgentCapability;
+    readonly qualificationCases: readonly string[];
+}
+export type AgentCapabilityResolution = {
+    readonly status: "matched";
+    readonly profile: AgentCapability;
+} | {
+    readonly status: "unsupported";
+};
+export declare const PRODUCTION_AGENT_CAPABILITIES: readonly AgentCapability[];
+export declare function isCompleteAgentCapability(value: AgentCapability): boolean;
+export declare function resolveAgentCapability(clientInfo: AgentClientInfo | undefined, registry?: readonly AgentCapability[]): AgentCapabilityResolution;
+export declare function capabilityForKind(kind: string, registry?: readonly AgentCapability[]): AgentCapability | undefined;

package/dist/agent-capabilities.js

@@ -0,0 +1,221 @@
+const BOUNDED_METADATA = /^[\x20-\x7e]{1,128}$/u;
+const KIND = /^[a-z][a-z0-9-]{0,63}$/u;
+const ENVIRONMENT_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+export const PRODUCTION_AGENT_CAPABILITIES = [
+    {
+        kind: "openclaw",
+        displayName: "OpenClaw",
+        enabled: true,
+        aliases: [{ name: "openclaw-bundle-mcp", version: "0.0.0" }],
+        modes: ["direct", "webhook"],
+        direct: {
+            command: "openclaw",
+            args: ["acp"],
+            agentInfo: { name: "openclaw-acp", versions: ["2026.8.1"] },
+            mcp: "provider_config",
+            environment: [
+                "HOME",
+                "LANG",
+                "LC_ALL",
+                "NODE_EXTRA_CA_CERTS",
+                "PATH",
+                "SSL_CERT_DIR",
+                "SSL_CERT_FILE",
+                "TMPDIR",
+                "USERPROFILE",
+                "XDG_CONFIG_HOME",
+                "XDG_DATA_HOME",
+                "XDG_STATE_HOME",
+            ],
+        },
+        qualificationCases: ["openclaw-webhook", "openclaw-direct"],
+    },
+    {
+        kind: "hermes",
+        displayName: "Hermes",
+        enabled: true,
+        aliases: [{ name: "mcp", version: "0.1.0" }],
+        modes: ["direct", "webhook"],
+        direct: {
+            command: "hermes-acp",
+            args: [],
+            agentInfo: { name: "hermes-agent", versions: ["0.21.0"] },
+            mcp: "session",
+            environment: [
+                "HOME",
+                "LANG",
+                "LC_ALL",
+                "PATH",
+                "SSL_CERT_DIR",
+                "SSL_CERT_FILE",
+                "TMPDIR",
+                "USERPROFILE",
+                "XDG_CACHE_HOME",
+                "XDG_CONFIG_HOME",
+                "XDG_DATA_HOME",
+                "XDG_STATE_HOME",
+            ],
+        },
+        qualificationCases: ["hermes-webhook", "hermes-direct"],
+    },
+    {
+        kind: "codex",
+        displayName: "Codex",
+        enabled: true,
+        aliases: [
+            { name: "codex-mcp-client", version: "0.149.0" },
+            { name: "codex-mcp-client", version: "0.152.1" },
+        ],
+        modes: ["direct", "webhook"],
+        direct: {
+            command: "codex-acp",
+            args: [],
+            agentInfo: { name: "@agentclientprotocol/codex-acp", versions: ["1.8.0"] },
+            mcp: "session",
+            environment: [
+                "CODEX_API_KEY",
+                "HOME",
+                "LANG",
+                "LC_ALL",
+                "NODE_EXTRA_CA_CERTS",
+                "OPENAI_API_KEY",
+                "PATH",
+                "SSL_CERT_DIR",
+                "SSL_CERT_FILE",
+                "TMPDIR",
+                "USERPROFILE",
+                "XDG_CONFIG_HOME",
+                "XDG_DATA_HOME",
+                "XDG_RUNTIME_DIR",
+                "XDG_STATE_HOME",
+            ],
+        },
+        qualificationCases: ["codex-webhook", "codex-direct"],
+    },
+    {
+        kind: "claude",
+        displayName: "Claude Code",
+        enabled: true,
+        aliases: [
+            { name: "claude-code", version: "2.1.257" },
+            { name: "claude-code", version: "2.1.258" },
+        ],
+        modes: ["direct", "webhook"],
+        direct: {
+            command: "claude-agent-acp",
+            args: [],
+            agentInfo: { name: "@agentclientprotocol/claude-agent-acp", versions: ["0.73.0"] },
+            mcp: "session",
+            environment: [
+                "ANTHROPIC_API_KEY",
+                "ANTHROPIC_AUTH_TOKEN",
+                "CLAUDE_CODE_OAUTH_TOKEN",
+                "HOME",
+                "LANG",
+                "LC_ALL",
+                "NODE_EXTRA_CA_CERTS",
+                "PATH",
+                "SSL_CERT_DIR",
+                "SSL_CERT_FILE",
+                "TMPDIR",
+                "USERPROFILE",
+                "XDG_CONFIG_HOME",
+                "XDG_DATA_HOME",
+                "XDG_STATE_HOME",
+            ],
+        },
+        qualificationCases: ["claude-webhook", "claude-direct"],
+    },
+    {
+        kind: "gemini",
+        displayName: "Gemini CLI",
+        enabled: true,
+        aliases: [{ name: "gemini-cli-mcp-client", version: "0.58.0" }],
+        modes: ["direct", "webhook"],
+        direct: {
+            command: "gemini",
+            args: ["--acp"],
+            agentInfo: { name: "gemini-cli", versions: ["0.58.0"] },
+            mcp: "session",
+            environment: [
+                "GEMINI_API_KEY",
+                "GOOGLE_API_KEY",
+                "GOOGLE_CLOUD_LOCATION",
+                "GOOGLE_CLOUD_PROJECT",
+                "GOOGLE_GENAI_USE_VERTEXAI",
+                "HOME",
+                "LANG",
+                "LC_ALL",
+                "NODE_EXTRA_CA_CERTS",
+                "PATH",
+                "SSL_CERT_DIR",
+                "SSL_CERT_FILE",
+                "TMPDIR",
+                "USERPROFILE",
+                "XDG_CONFIG_HOME",
+                "XDG_DATA_HOME",
+                "XDG_STATE_HOME",
+            ],
+        },
+        qualificationCases: ["gemini-webhook", "gemini-direct"],
+    },
+];
+function unique(values) {
+    return new Set(values).size === values.length;
+}
+function completeDirect(value) {
+    return (value !== undefined &&
+        BOUNDED_METADATA.test(value.command) &&
+        value.args.length <= 16 &&
+        value.args.every((argument) => BOUNDED_METADATA.test(argument)) &&
+        BOUNDED_METADATA.test(value.agentInfo.name) &&
+        value.agentInfo.versions.length > 0 &&
+        value.agentInfo.versions.length <= 16 &&
+        value.agentInfo.versions.every((version) => BOUNDED_METADATA.test(version)) &&
+        unique(value.agentInfo.versions) &&
+        (value.mcp === "provider_config" || value.mcp === "session") &&
+        value.environment.length <= 32 &&
+        value.environment.every((name) => ENVIRONMENT_NAME.test(name)) &&
+        unique(value.environment));
+}
+export function isCompleteAgentCapability(value) {
+    if (!KIND.test(value.kind) ||
+        !BOUNDED_METADATA.test(value.displayName) ||
+        value.aliases.length === 0 ||
+        value.aliases.length > 16 ||
+        value.modes.length === 0 ||
+        value.modes.length > 2 ||
+        !unique(value.modes) ||
+        value.qualificationCases.length === 0 ||
+        value.qualificationCases.length > 16 ||
+        !value.qualificationCases.every((item) => BOUNDED_METADATA.test(item)) ||
+        !unique(value.qualificationCases)) {
+        return false;
+    }
+    const aliases = value.aliases.map(({ name, version }) => `${name}\u0000${version}`);
+    if (!unique(aliases) ||
+        !value.aliases.every(({ name, version }) => BOUNDED_METADATA.test(name) && BOUNDED_METADATA.test(version))) {
+        return false;
+    }
+    if (value.modes.some((mode) => mode !== "direct" && mode !== "webhook"))
+        return false;
+    return value.modes.includes("direct") ? completeDirect(value.direct) : value.direct === undefined;
+}
+function boundedClientInfo(value) {
+    return (value !== undefined && BOUNDED_METADATA.test(value.name) && BOUNDED_METADATA.test(value.version));
+}
+export function resolveAgentCapability(clientInfo, registry = PRODUCTION_AGENT_CAPABILITIES) {
+    if (!boundedClientInfo(clientInfo))
+        return { status: "unsupported" };
+    const matches = registry.filter((profile) => profile.enabled &&
+        isCompleteAgentCapability(profile) &&
+        profile.aliases.some((alias) => alias.name === clientInfo.name && alias.version === clientInfo.version));
+    return matches.length === 1 && matches[0] !== undefined
+        ? { status: "matched", profile: matches[0] }
+        : { status: "unsupported" };
+}
+export function capabilityForKind(kind, registry = PRODUCTION_AGENT_CAPABILITIES) {
+    const matches = registry.filter((profile) => profile.kind === kind && profile.enabled && isCompleteAgentCapability(profile));
+    return matches.length === 1 ? matches[0] : undefined;
+}
+//# sourceMappingURL=agent-capabilities.js.map

package/dist/agent-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-capabilities.js","sourceRoot":"","sources":["../src/agent-capabilities.ts"],"names":[],"mappings":"AAiCA,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACjD,MAAM,IAAI,GAAG,yBAAyB,CAAC;AACvC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAErD,MAAM,CAAC,MAAM,6BAA6B,GAA+B;IACvE;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,UAAU;QACvB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC5D,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC5B,MAAM,EAAE;YACN,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,SAAS,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE;YAC3D,GAAG,EAAE,iBAAiB;YACtB,WAAW,EAAE;gBACX,MAAM;gBACN,MAAM;gBACN,QAAQ;gBACR,qBAAqB;gBACrB,MAAM;gBACN,cAAc;gBACd,eAAe;gBACf,QAAQ;gBACR,aAAa;gBACb,iBAAiB;gBACjB,eAAe;gBACf,gBAAgB;aACjB;SACF;QACD,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,iBAAiB,CAAC;KAC5D;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,QAAQ;QACrB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC5C,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC5B,MAAM,EAAE;YACN,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,EAAE;YACR,SAAS,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;YACzD,GAAG,EAAE,SAAS;YACd,WAAW,EAAE;gBACX,MAAM;gBACN,MAAM;gBACN,QAAQ;gBACR,MAAM;gBACN,cAAc;gBACd,eAAe;gBACf,QAAQ;gBACR,aAAa;gBACb,gBAAgB;gBAChB,iBAAiB;gBACjB,eAAe;gBACf,gBAAgB;aACjB;SACF;QACD,kBAAkB,EAAE,CAAC,gBAAgB,EAAE,eAAe,CAAC;KACxD;IACD;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,OAAO;QACpB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE;YAChD,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE;SACjD;QACD,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC5B,MAAM,EAAE;YACN,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,EAAE;YACR,SAAS,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE;YAC1E,GAAG,EAAE,SAAS;YACd,WAAW,EAAE;gBACX,eAAe;gBACf,MAAM;gBACN,MAAM;gBACN,QAAQ;gBACR,qBAAqB;gBACrB,gBAAgB;gBAChB,MAAM;gBACN,cAAc;gBACd,eAAe;gBACf,QAAQ;gBACR,aAAa;gBACb,iBAAiB;gBACjB,eAAe;gBACf,iBAAiB;gBACjB,gBAAgB;aACjB;SACF;QACD,kBAAkB,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC;KACtD;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,aAAa;QAC1B,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;YAC3C,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;SAC5C;QACD,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC5B,MAAM,EAAE;YACN,OAAO,EAAE,kBAAkB;YAC3B,IAAI,EAAE,EAAE;YACR,SAAS,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;YAClF,GAAG,EAAE,SAAS;YACd,WAAW,EAAE;gBACX,mBAAmB;gBACnB,sBAAsB;gBACtB,yBAAyB;gBACzB,MAAM;gBACN,MAAM;gBACN,QAAQ;gBACR,qBAAqB;gBACrB,MAAM;gBACN,cAAc;gBACd,eAAe;gBACf,QAAQ;gBACR,aAAa;gBACb,iBAAiB;gBACjB,eAAe;gBACf,gBAAgB;aACjB;SACF;QACD,kBAAkB,EAAE,CAAC,gBAAgB,EAAE,eAAe,CAAC;KACxD;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,YAAY;QACzB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/D,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC5B,MAAM,EAAE;YACN,OAAO,EAAE,QAAQ;YACjB,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;YACvD,GAAG,EAAE,SAAS;YACd,WAAW,EAAE;gBACX,gBAAgB;gBAChB,gBAAgB;gBAChB,uBAAuB;gBACvB,sBAAsB;gBACtB,2BAA2B;gBAC3B,MAAM;gBACN,MAAM;gBACN,QAAQ;gBACR,qBAAqB;gBACrB,MAAM;gBACN,cAAc;gBACd,eAAe;gBACf,QAAQ;gBACR,aAAa;gBACb,iBAAiB;gBACjB,eAAe;gBACf,gBAAgB;aACjB;SACF;QACD,kBAAkB,EAAE,CAAC,gBAAgB,EAAE,eAAe,CAAC;KACxD;CACO,CAAC;AAEX,SAAS,MAAM,CAAC,MAAyB;IACvC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,KAAwC;IAC9D,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE;QACvB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/D,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;QAC3C,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACnC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE;QACrC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3E,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;QAChC,CAAC,KAAK,CAAC,GAAG,KAAK,iBAAiB,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC;QAC5D,KAAK,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE;QAC9B,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAsB;IAC9D,IACE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACtB,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACzC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE;QACzB,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QACxB,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;QACrC,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,EAAE;QACpC,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EACjC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,SAAS,OAAO,EAAE,CAAC,CAAC;IACpF,IACE,CAAC,MAAM,CAAC,OAAO,CAAC;QAChB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAClB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CACrF,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;AACpG,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAkC;IAC3D,OAAO,CACL,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CACjG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,UAAuC,EACvC,QAAQ,GAA+B,6BAA6B;IAEpE,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAC7B,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,OAAO;QACf,yBAAyB,CAAC,OAAO,CAAC;QAClC,OAAO,CAAC,OAAO,CAAC,IAAI,CAClB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAClF,CACJ,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;QACrD,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE;QAC5C,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,QAAQ,GAA+B,6BAA6B;IAEpE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAC7B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAC5F,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}

package/dist/ambassador-options.d.ts

@@ -0,0 +1,9 @@
+export declare class AmbassadorOptionsError extends Error {
+    readonly exitCode: 2 | 4;
+    constructor(exitCode: 2 | 4);
+}
+export interface AmbassadorStartOptions {
+    readonly localTokenEnv: string;
+}
+export declare function parseAmbassadorStartOptions(args: readonly string[]): AmbassadorStartOptions;
+export declare function resolveLocalToken(environment: NodeJS.ProcessEnv, variableName: string): string;

package/dist/ambassador-options.js

@@ -0,0 +1,31 @@
+export class AmbassadorOptionsError extends Error {
+    exitCode;
+    constructor(exitCode) {
+        super(exitCode === 2 ? "Invalid command or arguments" : "Invalid local token");
+        this.name = "AmbassadorOptionsError";
+        this.exitCode = exitCode;
+    }
+}
+const ENVIRONMENT_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+const GENERATED_LOCAL_TOKEN = /^[0-9a-f]{48}$/u;
+const OPTION_PREFIX = "--local-token-env=";
+export function parseAmbassadorStartOptions(args) {
+    if (args.length !== 2 || args[0] !== "start")
+        throw new AmbassadorOptionsError(2);
+    const option = args[1];
+    if (option === undefined || !option.startsWith(OPTION_PREFIX)) {
+        throw new AmbassadorOptionsError(2);
+    }
+    const localTokenEnv = option.slice(OPTION_PREFIX.length);
+    if (!ENVIRONMENT_NAME.test(localTokenEnv))
+        throw new AmbassadorOptionsError(2);
+    return { localTokenEnv };
+}
+export function resolveLocalToken(environment, variableName) {
+    const value = environment[variableName];
+    if (value === undefined || !GENERATED_LOCAL_TOKEN.test(value)) {
+        throw new AmbassadorOptionsError(4);
+    }
+    return value;
+}
+//# sourceMappingURL=ambassador-options.js.map

package/dist/ambassador-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ambassador-options.js","sourceRoot":"","sources":["../src/ambassador-options.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,QAAQ,CAAQ;IAEzB,YAAY,QAAe;QACzB,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;QAC/E,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAMD,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AACrD,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAChD,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAE3C,MAAM,UAAU,2BAA2B,CAAC,IAAuB;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,MAAM,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,EAAE,aAAa,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,WAA8B,EAAE,YAAoB;IACpF,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/central-credential.d.ts

@@ -0,0 +1,41 @@
+import { type KeyObject } from "node:crypto";
+export interface CentralPublicJwk {
+    readonly kty: "EC";
+    readonly crv: "P-256";
+    readonly x: string;
+    readonly y: string;
+}
+export interface CentralCredentialRecord {
+    readonly credential_format: 1;
+    readonly access_token: string;
+    readonly dpop_private_key_pkcs8: string;
+}
+export interface CentralTokenClaims {
+    readonly subject: string;
+    readonly email: string;
+    readonly issuedAt: number;
+    readonly expiresAt: number;
+    readonly keyThumbprint: string;
+}
+export interface LoadedCentralCredential {
+    readonly record: CentralCredentialRecord;
+    readonly serialized: string;
+    readonly privateKey: KeyObject;
+    readonly publicJwk: CentralPublicJwk;
+    readonly keyThumbprint: string;
+    readonly token: CentralTokenClaims;
+}
+export interface CentralKeyMaterial {
+    readonly privateKey: KeyObject;
+    readonly privateKeyPkcs8: string;
+    readonly publicJwk: CentralPublicJwk;
+    readonly thumbprint: string;
+}
+export declare class CentralCredentialError extends Error {
+    constructor();
+}
+export declare function exactCentralPublicJwk(value: unknown): CentralPublicJwk;
+export declare function centralJwkThumbprint(jwk: CentralPublicJwk): string;
+export declare function serializeCentralCredential(record: CentralCredentialRecord): string;
+export declare function parseCentralCredential(value: string | CentralCredentialRecord | unknown, nowSeconds?: () => number): LoadedCentralCredential;
+export declare function createCentralCredentialRecord(accessToken: string, key: CentralKeyMaterial): CentralCredentialRecord;