@ferrule-io/ok-fine 0.0.0-stage → 0.3.7

package/dist/cli-options.js

@@ -0,0 +1,99 @@
+import { join, resolve } from "node:path";
+import { parseArgs } from "node:util";
+export const USAGE = `Usage: ok-fine [stdio|serve] [options]
+
+Commands:
+  stdio (default)          Serve MCP over stdin/stdout for one local client
+  serve                    Serve MCP and the REST API over HTTP
+
+Options:
+  --data-dir <path>        Knowledge repository location (DATA_DIR, default ~/.ok-fine)
+  --remote <url>           Git remote to sync with, using your git credentials (GIT_REMOTE_URL)
+  --branch <name>          Git branch (GIT_BRANCH, default main)
+  --sync-interval <sec>    Periodic sync interval, 0 disables (GIT_SYNC_INTERVAL_SECONDS, default 60)
+  --log-level <level>      fatal|error|warn|info|debug|trace|silent (LOG_LEVEL, default info)
+  -h, --help               Show this help
+  -v, --version            Print the version
+
+serve options:
+  --port <port>            PORT, default 8080
+  --host <addr>            HOST, default 127.0.0.1
+  --public-base-url <url>  PUBLIC_BASE_URL, default http://localhost:<port>
+  --no-auth                AUTH_MODE=none: no authentication, every caller is admin; localhost only
+
+Every variable in https://github.com/ferrule-io/ok-fine/wiki/Configuration also works; flags win.
+`;
+const FLAG_ENV = {
+    "data-dir": "DATA_DIR",
+    remote: "GIT_REMOTE_URL",
+    branch: "GIT_BRANCH",
+    "sync-interval": "GIT_SYNC_INTERVAL_SECONDS",
+    "log-level": "LOG_LEVEL",
+    port: "PORT",
+    host: "HOST",
+    "public-base-url": "PUBLIC_BASE_URL",
+};
+const SERVE_ONLY_FLAGS = ["port", "host", "public-base-url", "no-auth"];
+/** Pure: maps argv and the process env to a command and the env its config loader reads. Throws on bad usage. */
+export function parseCli(argv, env, homeDir) {
+    // --help/--version win over everything else, including unknown flags and bad commands.
+    const flags = argv.includes("--") ? argv.slice(0, argv.indexOf("--")) : argv;
+    if (flags.includes("--help") || flags.includes("-h"))
+        return { command: "help", env };
+    if (flags.includes("--version") || flags.includes("-v"))
+        return { command: "version", env };
+    const { values, positionals } = parseArgs({
+        args: argv,
+        allowPositionals: true,
+        strict: true,
+        options: {
+            "data-dir": { type: "string" },
+            remote: { type: "string" },
+            branch: { type: "string" },
+            "sync-interval": { type: "string" },
+            "log-level": { type: "string" },
+            port: { type: "string" },
+            host: { type: "string" },
+            "public-base-url": { type: "string" },
+            "no-auth": { type: "boolean" },
+        },
+    });
+    let command;
+    if (positionals.length === 0 || (positionals.length === 1 && positionals[0] === "stdio")) {
+        command = "stdio";
+    }
+    else if (positionals.length === 1 && positionals[0] === "serve") {
+        command = "serve";
+    }
+    else {
+        throw new Error(`unknown command "${positionals.join(" ")}"`);
+    }
+    if (command === "stdio") {
+        for (const name of SERVE_ONLY_FLAGS) {
+            if (values[name] !== undefined)
+                throw new Error(`--${name} only applies to "ok-fine serve"`);
+        }
+    }
+    const flagEnv = {};
+    for (const [flag, envName] of Object.entries(FLAG_ENV)) {
+        const value = values[flag];
+        if (typeof value === "string")
+            flagEnv[envName] = value;
+    }
+    const dataDirFlag = values["data-dir"];
+    if (dataDirFlag !== undefined) {
+        const expanded = dataDirFlag === "~" ? homeDir : dataDirFlag.startsWith("~/") ? join(homeDir, dataDirFlag.slice(2)) : dataDirFlag;
+        flagEnv.DATA_DIR = resolve(expanded);
+    }
+    if (values["no-auth"])
+        flagEnv.AUTH_MODE = "none";
+    const defaults = { DATA_DIR: join(homeDir, ".ok-fine") };
+    if (command === "serve")
+        defaults.HOST = "127.0.0.1";
+    const merged = { ...defaults, ...env, ...flagEnv };
+    if (command === "serve" && merged.PUBLIC_BASE_URL === undefined) {
+        merged.PUBLIC_BASE_URL = `http://localhost:${merged.PORT ?? "8080"}`;
+    }
+    return { command, env: merged };
+}
+//# sourceMappingURL=cli-options.js.map

package/dist/cli.js

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+import { execFile } from "node:child_process";
+import { homedir } from "node:os";
+import { pino } from "pino";
+import { parseCli, USAGE } from "./cli-options.js";
+import { loadConfig, loadStorageConfig } from "./config.js";
+import { lockDataDir } from "./data-dir-lock.js";
+import { startServer, startStdioServer } from "./server.js";
+import { VERSION } from "./version.js";
+const message = (err) => (err instanceof Error ? err.message : String(err));
+/** `git config user.email` in the launch directory; null when unset or git is unavailable. Not `Git`: it forces ok-fine's own email. */
+function localGitEmail(env) {
+    const { promise, resolve } = Promise.withResolvers();
+    execFile("git", ["config", "user.email"], { env }, (error, stdout) => {
+        const email = String(stdout).trim();
+        resolve(error || email.length === 0 ? null : email);
+    });
+    return promise;
+}
+/** Runs `close` once on the first trigger, then exits. */
+function shutdownOnce(close, onError) {
+    let shuttingDown = false;
+    return () => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        close().then(() => process.exit(0), (err) => {
+            onError(err);
+            process.exit(1);
+        });
+    };
+}
+let inv;
+try {
+    inv = parseCli(process.argv.slice(2), process.env, homedir());
+}
+catch (err) {
+    console.error(`${message(err)}\nRun "ok-fine --help" for usage.`);
+    process.exit(2);
+}
+if (inv.command === "help") {
+    process.stdout.write(USAGE);
+    process.exit(0);
+}
+if (inv.command === "version") {
+    process.stdout.write(`${VERSION}\n`);
+    process.exit(0);
+}
+if (inv.command === "stdio") {
+    let config;
+    try {
+        config = loadStorageConfig(inv.env, { inheritGitEnv: true });
+    }
+    catch (err) {
+        console.error(message(err));
+        process.exit(1);
+    }
+    // stdout carries JSON-RPC only; every log line goes to stderr.
+    const log = pino({ level: config.logLevel }, pino.destination({ dest: 2, sync: true }));
+    try {
+        const release = await lockDataDir(config.dataDir);
+        process.once("exit", release);
+    }
+    catch (err) {
+        log.error(message(err));
+        process.exit(1);
+    }
+    const identity = await localGitEmail(inv.env);
+    log.info({ dataDir: config.dataDir, identity }, "serving MCP over stdio");
+    let server;
+    try {
+        server = await startStdioServer(config, { log, identity });
+    }
+    catch (err) {
+        log.error({ err }, "ok-fine failed to start");
+        process.exit(1);
+    }
+    const shutdown = shutdownOnce(() => server.close(), (err) => log.error({ err }, "shutdown failed"));
+    void server.done.then(shutdown);
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
+}
+else {
+    let config;
+    try {
+        config = loadConfig(inv.env, { inheritGitEnv: true });
+    }
+    catch (err) {
+        console.error(message(err));
+        process.exit(1);
+    }
+    try {
+        const release = await lockDataDir(config.dataDir);
+        process.once("exit", release);
+    }
+    catch (err) {
+        console.error(message(err));
+        process.exit(1);
+    }
+    let server;
+    try {
+        server = await startServer(config);
+    }
+    catch (err) {
+        console.error("ok-fine failed to start:", err);
+        process.exit(1);
+    }
+    const shutdown = shutdownOnce(() => {
+        server.app.log.info("shutting down");
+        return server.close();
+    }, (err) => server.app.log.error({ err }, "shutdown failed"));
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
+}
+//# sourceMappingURL=cli.js.map

package/dist/config.js

@@ -0,0 +1,320 @@
+import { isIPv4 } from "node:net";
+import { z } from "zod";
+/** A whole-string decimal integer env var (rejects `8080junk`, `1x`, `1.5`, and blanks). */
+function intEnv(name, fallback, min, max = Number.MAX_SAFE_INTEGER) {
+    return z
+        .string()
+        .default(fallback)
+        .refine((v) => /^\d+$/.test(v), { message: `${name} must be a whole decimal integer` })
+        .transform(Number)
+        .pipe(z.number().int().min(min, `${name} must be >= ${min}`).max(max, `${name} must be <= ${max}`));
+}
+/** An optional whole-string decimal integer env var; unset or empty string evaluates to undefined. */
+function optionalIntEnv(name, min, max = Number.MAX_SAFE_INTEGER) {
+    return z
+        .string()
+        .optional()
+        .transform((v) => (v === undefined || v === "" ? undefined : v))
+        .pipe(z
+        .string()
+        .refine((v) => /^\d+$/.test(v), { message: `${name} must be a whole decimal integer` })
+        .transform(Number)
+        .pipe(z.number().int().min(min, `${name} must be >= ${min}`).max(max, `${name} must be <= ${max}`))
+        .optional());
+}
+function httpUrl(value) {
+    try {
+        const u = new URL(value);
+        return u.protocol === "http:" || u.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+function isLoopbackHost(host) {
+    const normalized = host.trim().toLowerCase();
+    if (normalized === "localhost" || normalized === "::1" || normalized === "[::1]") {
+        return true;
+    }
+    if (isIPv4(normalized)) {
+        const octets = normalized.split(".");
+        if (octets[0] === "127") {
+            return true;
+        }
+    }
+    return false;
+}
+function parseTrustProxy(val) {
+    if (val === undefined || val === "") {
+        return "loopback,linklocal,uniquelocal";
+    }
+    const trimmed = val.trim();
+    if (trimmed === "true")
+        return true;
+    if (trimmed === "false")
+        return false;
+    if (/^\d+$/.test(trimmed)) {
+        return Number.parseInt(trimmed, 10);
+    }
+    return trimmed;
+}
+function parseList(val) {
+    if (!val)
+        return [];
+    return val
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+const storageEnvShape = {
+    LOG_LEVEL: z.enum(["fatal", "error", "warn", "info", "debug", "trace", "silent"]).default("info"),
+    DATA_DIR: z
+        .string()
+        .default("/data")
+        .refine((v) => v.startsWith("/"), "DATA_DIR must be an absolute path"),
+    GIT_BRANCH: z.string().default("main"),
+    GIT_REMOTE_URL: z.string().optional(),
+    GIT_SYNC_INTERVAL_SECONDS: intEnv("GIT_SYNC_INTERVAL_SECONDS", "60", 0),
+    GIT_SSH_KEY_PATH: z.string().optional(),
+    GIT_SSH_KNOWN_HOSTS_PATH: z.string().optional(),
+    GIT_HTTP_USERNAME: z.string().optional(),
+    GIT_HTTP_PASSWORD: z.string().optional(),
+    MAX_FILE_BYTES: intEnv("MAX_FILE_BYTES", "1048576", 1),
+    MAX_ARCHIVE_BYTES: intEnv("MAX_ARCHIVE_BYTES", "52428800", 1),
+    DEFAULT_STALE_AFTER_DAYS: optionalIntEnv("DEFAULT_STALE_AFTER_DAYS", 1, 36500),
+};
+const httpEnvShape = {
+    AUTH_MODE: z.enum(["oidc", "none"], "AUTH_MODE must be oidc or none").default("oidc"),
+    PORT: intEnv("PORT", "8080", 0, 65535),
+    HOST: z.string().default("0.0.0.0"),
+    PUBLIC_BASE_URL: z
+        .string({ message: "PUBLIC_BASE_URL is required" })
+        .refine(httpUrl, "PUBLIC_BASE_URL must be a valid http or https URL"),
+    OAUTH_ISSUER: z.string().optional(),
+    OAUTH_AUDIENCE: z.string().optional(),
+    OAUTH_JWKS_URI: z.string().optional(),
+    OAUTH_SCOPE_READ: z.string().default("okf:read"),
+    OAUTH_SCOPE_WRITE: z.string().default("okf:write"),
+    OAUTH_SCOPE_ADMIN: z.string().default("okf:admin"),
+    OAUTH_IDENTITY_CLAIMS: z.string().default("email,preferred_username,sub"),
+    OAUTH_ALLOW_INSECURE_ISSUER: z.string().optional(),
+    OAUTH_ALLOWED_SUBJECTS: z.string().optional(),
+    OAUTH_ALLOWED_EMAILS: z.string().optional(),
+    OAUTH_REQUIRED_GROUPS: z.string().optional(),
+    OAUTH_GROUPS_CLAIM: z.string().default("groups"),
+    OAUTH_ALLOWED_CLIENT_IDS: z.string().optional(),
+    ALLOW_UNAUTHENTICATED_NETWORK: z.string().optional(),
+    TRUST_PROXY: z.string().optional(),
+    OAUTH_UI_CLIENT_ID: z.string().optional(),
+};
+function isValidGitRemoteUrl(url) {
+    if (url.startsWith("/") || url.startsWith("https://") || url.startsWith("ssh://") || url.startsWith("file://")) {
+        return true;
+    }
+    if (!url.includes("://")) {
+        const at = url.indexOf("@");
+        const colon = url.indexOf(":");
+        if (at !== -1 && colon !== -1 && at < colon) {
+            const slash = url.indexOf("/");
+            return slash === -1 || slash > colon;
+        }
+    }
+    return false;
+}
+function refineGitCredentials(data, ctx) {
+    if (!data || typeof data !== "object")
+        return;
+    if (Boolean(data.GIT_HTTP_USERNAME) !== Boolean(data.GIT_HTTP_PASSWORD)) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["GIT_HTTP_USERNAME"],
+            message: "GIT_HTTP_USERNAME and GIT_HTTP_PASSWORD must be provided together or neither",
+        });
+    }
+    if (data.GIT_REMOTE_URL !== undefined && !isValidGitRemoteUrl(data.GIT_REMOTE_URL)) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["GIT_REMOTE_URL"],
+            message: "GIT_REMOTE_URL must be https://, ssh://, user@host:path, file:// or an absolute path",
+        });
+    }
+    if (data.GIT_SSH_KEY_PATH?.trim() && !data.GIT_SSH_KNOWN_HOSTS_PATH?.trim()) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["GIT_SSH_KNOWN_HOSTS_PATH"],
+            message: "GIT_SSH_KNOWN_HOSTS_PATH is required when GIT_SSH_KEY_PATH is set",
+        });
+    }
+}
+const rawEnvSchema = z.object({ ...httpEnvShape, ...storageEnvShape }).superRefine((data, ctx) => {
+    if (!data || typeof data !== "object")
+        return;
+    refineGitCredentials(data, ctx);
+    if (data.AUTH_MODE === "none") {
+        const isLoopback = isLoopbackHost(data.HOST ?? "0.0.0.0");
+        const allowUnauthenticated = data.ALLOW_UNAUTHENTICATED_NETWORK === "true";
+        if (!isLoopback && !allowUnauthenticated) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["HOST"],
+                message: "AUTH_MODE=none requires a loopback HOST (127.0.0.0/8, ::1, localhost); set ALLOW_UNAUTHENTICATED_NETWORK=true only behind a loopback-only port mapping",
+            });
+        }
+    }
+    if (data.ALLOW_UNAUTHENTICATED_NETWORK !== undefined &&
+        data.ALLOW_UNAUTHENTICATED_NETWORK !== "true" &&
+        data.ALLOW_UNAUTHENTICATED_NETWORK !== "false") {
+        ctx.addIssue({
+            code: "custom",
+            path: ["ALLOW_UNAUTHENTICATED_NETWORK"],
+            message: "ALLOW_UNAUTHENTICATED_NETWORK must be true or false",
+        });
+    }
+    if (data.AUTH_MODE === "oidc") {
+        if (data.OAUTH_ISSUER === undefined) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["OAUTH_ISSUER"],
+                message: "OAUTH_ISSUER is required",
+            });
+        }
+        else if (!httpUrl(data.OAUTH_ISSUER)) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["OAUTH_ISSUER"],
+                message: "OAUTH_ISSUER must be a valid URL",
+            });
+        }
+        if (data.OAUTH_JWKS_URI !== undefined) {
+            if (!httpUrl(data.OAUTH_JWKS_URI)) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: ["OAUTH_JWKS_URI"],
+                    message: "OAUTH_JWKS_URI must be a valid URL",
+                });
+            }
+            else {
+                try {
+                    const parsed = new URL(data.OAUTH_JWKS_URI);
+                    if (parsed.protocol !== "https:" && data.OAUTH_ALLOW_INSECURE_ISSUER !== "true") {
+                        ctx.addIssue({
+                            code: "custom",
+                            path: ["OAUTH_JWKS_URI"],
+                            message: "OAUTH_JWKS_URI must be https unless OAUTH_ALLOW_INSECURE_ISSUER=true",
+                        });
+                    }
+                }
+                catch {
+                    // Handled by httpUrl
+                }
+            }
+        }
+        if (data.OAUTH_ALLOW_INSECURE_ISSUER !== undefined &&
+            data.OAUTH_ALLOW_INSECURE_ISSUER !== "true" &&
+            data.OAUTH_ALLOW_INSECURE_ISSUER !== "false") {
+            ctx.addIssue({
+                code: "custom",
+                path: ["OAUTH_ALLOW_INSECURE_ISSUER"],
+                message: "OAUTH_ALLOW_INSECURE_ISSUER must be true or false",
+            });
+        }
+    }
+}, { when: () => true });
+const storageEnvSchema = z.object(storageEnvShape).superRefine(refineGitCredentials, { when: () => true });
+function formatConfigError(error) {
+    const errorMessages = error.issues.map((issue) => `${issue.path.join(".") || "config"}: ${issue.message}`);
+    return new Error(`Configuration errors:\n  ${errorMessages.join("\n  ")}`);
+}
+function storageFromRaw(raw, env, options) {
+    return {
+        logLevel: raw.LOG_LEVEL,
+        dataDir: raw.DATA_DIR,
+        gitBranch: raw.GIT_BRANCH,
+        gitRemoteUrl: raw.GIT_REMOTE_URL,
+        gitSyncIntervalSeconds: raw.GIT_SYNC_INTERVAL_SECONDS,
+        gitSshKeyPath: raw.GIT_SSH_KEY_PATH,
+        gitSshKnownHostsPath: raw.GIT_SSH_KNOWN_HOSTS_PATH,
+        gitHttpUsername: raw.GIT_HTTP_USERNAME,
+        gitHttpPassword: raw.GIT_HTTP_PASSWORD,
+        ...(options.inheritGitEnv
+            ? {
+                gitHostEnv: Object.fromEntries(Object.entries(env).filter((e) => e[1] !== undefined)),
+            }
+            : {}),
+        maxFileBytes: raw.MAX_FILE_BYTES,
+        maxArchiveBytes: raw.MAX_ARCHIVE_BYTES,
+        defaultStaleAfterDays: raw.DEFAULT_STALE_AFTER_DAYS,
+    };
+}
+/** Storage-only settings for the stdio transport: needs neither PUBLIC_BASE_URL nor OAUTH_*. */
+export function loadStorageConfig(env, options = {}) {
+    const result = storageEnvSchema.safeParse(env);
+    if (!result.success)
+        throw formatConfigError(result.error);
+    return storageFromRaw(result.data, env, options);
+}
+export function loadConfig(env = process.env, options = {}) {
+    const result = rawEnvSchema.safeParse(env);
+    if (!result.success)
+        throw formatConfigError(result.error);
+    const raw = result.data;
+    const publicBaseUrl = raw.PUBLIC_BASE_URL.replace(/\/+$/, "");
+    const trustProxy = parseTrustProxy(raw.TRUST_PROXY);
+    const allowUnauthenticatedNetwork = raw.ALLOW_UNAUTHENTICATED_NETWORK === "true";
+    let auth;
+    if (raw.AUTH_MODE === "none") {
+        auth = { mode: "none" };
+    }
+    else {
+        if (raw.OAUTH_ISSUER === undefined) {
+            throw new Error("OAUTH_ISSUER is required when AUTH_MODE is oidc");
+        }
+        let oauthAudiences;
+        if (raw.OAUTH_AUDIENCE && raw.OAUTH_AUDIENCE.trim().length > 0) {
+            oauthAudiences = raw.OAUTH_AUDIENCE.split(",")
+                .map((s) => s.trim())
+                .filter((s) => s.length > 0);
+        }
+        else {
+            oauthAudiences = [`${publicBaseUrl}/mcp`];
+        }
+        const identityClaims = raw.OAUTH_IDENTITY_CLAIMS.split(",")
+            .map((s) => s.trim())
+            .filter((s) => s.length > 0);
+        const allowInsecureIssuer = raw.OAUTH_ALLOW_INSECURE_ISSUER === "true";
+        const uiClientId = raw.OAUTH_UI_CLIENT_ID?.trim();
+        const groupsClaim = raw.OAUTH_GROUPS_CLAIM && raw.OAUTH_GROUPS_CLAIM.trim().length > 0 ? raw.OAUTH_GROUPS_CLAIM.trim() : "groups";
+        const access = {
+            allowedSubjects: parseList(raw.OAUTH_ALLOWED_SUBJECTS),
+            allowedEmails: parseList(raw.OAUTH_ALLOWED_EMAILS).map((s) => s.toLowerCase()),
+            requiredGroups: parseList(raw.OAUTH_REQUIRED_GROUPS),
+            groupsClaim,
+            allowedClientIds: parseList(raw.OAUTH_ALLOWED_CLIENT_IDS),
+        };
+        auth = {
+            mode: "oidc",
+            issuer: raw.OAUTH_ISSUER,
+            audiences: oauthAudiences,
+            ...(raw.OAUTH_JWKS_URI === undefined ? {} : { jwksUri: raw.OAUTH_JWKS_URI }),
+            identityClaims,
+            allowInsecureIssuer,
+            access,
+            ...(uiClientId ? { uiClientId } : {}),
+        };
+    }
+    return {
+        ...storageFromRaw(raw, env, options),
+        port: raw.PORT,
+        host: raw.HOST,
+        publicBaseUrl,
+        auth,
+        scopeNames: {
+            read: raw.OAUTH_SCOPE_READ,
+            write: raw.OAUTH_SCOPE_WRITE,
+            admin: raw.OAUTH_SCOPE_ADMIN,
+        },
+        allowUnauthenticatedNetwork,
+        trustProxy,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/data-dir-lock.js

@@ -0,0 +1,60 @@
+import { readFileSync, unlinkSync } from "node:fs";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+function errorCode(err) {
+    return err?.code;
+}
+function isRunning(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return errorCode(err) === "EPERM";
+    }
+}
+/**
+ * Takes the exclusive per-data-dir lock for a local CLI process; a lock left by a dead process is taken over.
+ * Returns a synchronous release, safe to call from `process.on("exit")`.
+ */
+export async function lockDataDir(dataDir) {
+    await mkdir(dataDir, { recursive: true });
+    const lockPath = join(dataDir, "ok-fine.lock");
+    const pid = String(process.pid);
+    let holder = "unknown";
+    for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+            await writeFile(lockPath, `${pid}\n`, { flag: "wx" });
+            return () => {
+                try {
+                    if (readFileSync(lockPath, "utf8").trim() === pid)
+                        unlinkSync(lockPath);
+                }
+                catch (err) {
+                    if (errorCode(err) !== "ENOENT")
+                        throw err;
+                }
+            };
+        }
+        catch (err) {
+            if (errorCode(err) !== "EEXIST")
+                throw err;
+        }
+        let content;
+        try {
+            content = (await readFile(lockPath, "utf8")).trim();
+        }
+        catch (err) {
+            if (errorCode(err) === "ENOENT")
+                continue;
+            throw err;
+        }
+        holder = content || "unknown";
+        const holderPid = Number.parseInt(content, 10);
+        if (Number.isInteger(holderPid) && holderPid > 0 && holderPid !== process.pid && isRunning(holderPid))
+            break;
+        await rm(lockPath, { force: true });
+    }
+    throw new Error(`ok-fine is already running on ${dataDir} (pid ${holder}). One process serves a data directory: connect more clients to \`ok-fine serve\` over HTTP, or pass a different --data-dir. If no ok-fine process is running, delete ${lockPath}.`);
+}
+//# sourceMappingURL=data-dir-lock.js.map

package/dist/errors.js

@@ -0,0 +1,13 @@
+export class OkfError extends Error {
+    code;
+    status;
+    details;
+    constructor(code, status, message, details) {
+        super(message);
+        this.name = "OkfError";
+        this.code = code;
+        this.status = status;
+        this.details = details;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/http/mcp-route.js

@@ -0,0 +1,32 @@
+const DROPPED_HEADERS = {
+    host: true,
+    "content-length": true,
+    "transfer-encoding": true,
+    connection: true,
+};
+export function registerMcpRoute(app, mcpFetch, publicBaseUrl) {
+    app.route({
+        method: ["GET", "POST", "DELETE"],
+        url: "/mcp",
+        config: { permission: "read" },
+        handler: async (req, reply) => {
+            const headers = new Headers();
+            for (const [name, value] of Object.entries(req.headers)) {
+                if (value === undefined || DROPPED_HEADERS[name])
+                    continue;
+                headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+            }
+            const request = new Request(new URL(req.url, publicBaseUrl), {
+                method: req.method,
+                headers,
+                body: req.method === "POST" ? JSON.stringify(req.body) : undefined,
+            });
+            const response = await mcpFetch(request, {
+                authInfo: req.authInfo ?? undefined,
+                parsedBody: req.method === "POST" ? req.body : undefined,
+            });
+            return reply.send(response);
+        },
+    });
+}
+//# sourceMappingURL=mcp-route.js.map