@imgly/codesign-mcp 0.1.5 → 0.1.6

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAErD;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,GAAiB,GACrB,MAAM,GAAG,SAAS,CAIpB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,IAAI,CAAC;AAE9C,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,yBAAyB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,EAAE,CAAC,EAAE,QAAQ,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,eAAe,CAAC;IAC3B,IAAI,EAAE;QACJ,IAAI,EAAE,aAAa,CAAC;QACpB,6DAA6D;QAC7D,MAAM,EAAE,MAAM,CAAC;QACf,uCAAuC;QACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAsBD,wBAAgB,UAAU,CAAC,GAAG,GAAE,GAAiB,GAAG,YAAY,CAqE/D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAErD;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,GAAiB,GACrB,MAAM,GAAG,SAAS,CAIpB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,IAAI,CAAC;AAE9C,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,yBAAyB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,EAAE,CAAC,EAAE,QAAQ,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,eAAe,CAAC;IAC3B,IAAI,EAAE;QACJ,IAAI,EAAE,aAAa,CAAC;QACpB,6DAA6D;QAC7D,MAAM,EAAE,MAAM,CAAC;QACf,uCAAuC;QACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAsBD,wBAAgB,UAAU,CAAC,GAAG,GAAE,GAAiB,GAAG,YAAY,CAoE/D;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,GAAiB,GAAG,OAAO,CAEtE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,CAKpE"}

package/dist/config.js

@@ -6,6 +6,8 @@
 // resolveSecret — the de-facto Docker/K8s secret standard. No secret is ever
 // logged or written; loadConfig only reads.
 import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join as joinPath } from 'node:path';
 /**
  * Resolve a secret: prefer `<NAME>_FILE` (trimmed file contents — secret files
  * end in a newline) and fall back to the plain `<NAME>` env var. A superset of
@@ -88,7 +90,6 @@ export function loadConfig(env = process.env) {
         maxEngines: intEnv(env, 'IMGLY_MAX_ENGINES', 8),
         idleTimeoutMs: intEnv(env, 'IMGLY_SESSION_IDLE_TIMEOUT', 900) * 1000,
         logLevel: env.IMGLY_LOG_LEVEL ?? 'info',
-        metricsEnabled: boolEnv(env, 'IMGLY_METRICS_ENABLED', false),
         workspace,
         auth,
         gateway
@@ -99,4 +100,22 @@ export function loadConfig(env = process.env) {
         cfg.publicBaseUrl = env.IMGLY_PUBLIC_BASE_URL.replace(/\/+$/, '');
     return cfg;
 }
+/**
+ * Local diagnostics file logging is ON by default so evidence exists before a
+ * user knows they hit a bug. Disable with IMGLY_DIAGNOSTICS_FILE=false (or 0).
+ */
+export function diagnosticsFileEnabled(env = process.env) {
+    return boolEnv(env, 'IMGLY_DIAGNOSTICS_FILE', true);
+}
+/**
+ * Where diagnostics NDJSON is written. Explicit IMGLY_DIAGNOSTICS_DIR wins;
+ * otherwise <workspaceRoot>/logs, where workspaceRoot mirrors the stdio default
+ * ($CODESIGN_WORKSPACE ?? ~/.codesign/workspace).
+ */
+export function resolveDiagnosticsDir(env = process.env) {
+    if (env.IMGLY_DIAGNOSTICS_DIR)
+        return env.IMGLY_DIAGNOSTICS_DIR;
+    const workspaceRoot = env.CODESIGN_WORKSPACE ?? joinPath(homedir(), '.codesign', 'workspace');
+    return joinPath(workspaceRoot, 'logs');
+}
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,8EAA8E;AAC9E,6EAA6E;AAC7E,4CAA4C;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAIvC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,MAAW,OAAO,CAAC,GAAG;IAEtB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IACrC,IAAI,QAAQ;QAAE,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAuDD,SAAS,UAAU,CAAC,GAAQ,EAAE,IAAY;IACxC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,MAAM,CAAC,GAAQ,EAAE,IAAY,EAAE,QAAgB;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,mBAAmB,CAAC,CAAC;IAC7E,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,OAAO,CAAC,GAAQ,EAAE,IAAY,EAAE,QAAiB;IACxD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAW,OAAO,CAAC,GAAG;IAC/C,MAAM,YAAY,GAAG,aAAa,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,oBAAoB,IAAI,QAAQ,CAAkB,CAAC;IACrE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ;QAC9D,MAAM,IAAI,KAAK,CACb,oEAAoE,IAAI,IAAI,CAC7E,CAAC;IAEJ,MAAM,IAAI,GAAyB;QACjC,IAAI;QACJ,MAAM,EAAE,GAAG,CAAC,2BAA2B,IAAI,gBAAgB;KAC5D,CAAC;IACF,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,uBAAuB,IAAI,OAAO,CAAqB,CAAC;IAC7E,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,IAAI;QACzC,MAAM,IAAI,KAAK,CACb,0DAA0D,OAAO,IAAI,CACtE,CAAC;IAEJ,IAAI,SAA0B,CAAC;IAC/B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,EAAE,GAAa;YACnB,MAAM,EAAE,UAAU,CAAC,GAAG,EAAE,2BAA2B,CAAC;YACpD,MAAM,EAAE,GAAG,CAAC,yBAAyB,IAAI,MAAM;SAChD,CAAC;QACF,IAAI,GAAG,CAAC,2BAA2B;YACjC,EAAE,CAAC,QAAQ,GAAG,GAAG,CAAC,2BAA2B,CAAC;QAChD,wEAAwE;QACxE,MAAM,WAAW,GAAG,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,eAAe,GAAG,aAAa,CACnC,sCAAsC,EACtC,GAAG,CACJ,CAAC;QACF,IAAI,WAAW;YAAE,EAAE,CAAC,WAAW,GAAG,WAAW,CAAC;QAC9C,IAAI,eAAe;YAAE,EAAE,CAAC,eAAe,GAAG,eAAe,CAAC;QAC1D,SAAS,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,UAAU;QAAE,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC;IAC5C,IAAI,GAAG,CAAC,sBAAsB;QAAE,OAAO,CAAC,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAE7E,MAAM,GAAG,GAAiB;QACxB,YAAY;QACZ,OAAO,EAAE,GAAG,CAAC,cAAc,IAAI,KAAK;QACpC,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/C,aAAa,EAAE,MAAM,CAAC,GAAG,EAAE,4BAA4B,EAAE,GAAG,CAAC,GAAG,IAAI;QACpE,QAAQ,EAAE,GAAG,CAAC,eAAe,IAAI,MAAM;QACvC,cAAc,EAAE,OAAO,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,CAAC;QAC5D,SAAS;QACT,IAAI;QACJ,OAAO;KACR,CAAC;IACF,IAAI,GAAG,CAAC,yBAAyB;QAC/B,GAAG,CAAC,iBAAiB,GAAG,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzE,CAAC,CAAC,IAAI,EAAE,CACT,CAAC;IACJ,IAAI,GAAG,CAAC,qBAAqB;QAC3B,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["// packages/codesign-mcp/src/config.ts\n//\n// The IMGLY_* configuration contract (spec §9.2). One image, switched purely\n// by runtime env. Non-secret knobs are plain env vars; the four secrets\n// (license, gateway key, two S3 keys) also accept the `*_FILE` convention via\n// resolveSecret — the de-facto Docker/K8s secret standard. No secret is ever\n// logged or written; loadConfig only reads.\nimport { readFileSync } from 'node:fs';\n\nexport type Env = Record<string, string | undefined>;\n\n/**\n * Resolve a secret: prefer `<NAME>_FILE` (trimmed file contents — secret files\n * end in a newline) and fall back to the plain `<NAME>` env var. A superset of\n * \"just env vars\": production mounts a file, local dev passes the raw value.\n */\nexport function resolveSecret(\n  name: string,\n  env: Env = process.env\n): string | undefined {\n  const filePath = env[`${name}_FILE`];\n  if (filePath) return readFileSync(filePath, 'utf8').trim();\n  return env[name];\n}\n\nexport type WorkspaceMode = 'header' | 'session' | 'single';\nexport type WorkspaceBackend = 'local' | 's3';\n\nexport interface S3Config {\n  bucket: string;\n  endpoint?: string;\n  region: string;\n  accessKeyId?: string;\n  secretAccessKey?: string;\n}\n\nexport interface WorkspaceConfig {\n  backend: WorkspaceBackend;\n  /** local backend only */\n  dir?: string;\n  /** s3 backend only */\n  s3?: S3Config;\n}\n\nexport interface ServerConfig {\n  cesdkLicense: string;\n  /**\n   * Build identity, surfaced as the MCP `serverInfo.version`. Lets a client\n   * (e.g. the deploy smoketest) detect a stale, not-yet-rolled-out container:\n   * the deploy injects the git SHA, the smoketest asserts the running server\n   * reports it. Default `'dev'` for local runs.\n   */\n  buildId: string;\n  port: number;\n  /** Max concurrent engines/sessions — the RAM cap (spec §9.2). */\n  maxEngines: number;\n  idleTimeoutMs: number;\n  logLevel: string;\n  /** Expose the perf metrics route + dashboard SPA. Default false. */\n  metricsEnabled: boolean;\n  workspace: WorkspaceConfig;\n  auth: {\n    mode: WorkspaceMode;\n    /** header carrying the trusted workspaceId (header mode). */\n    header: string;\n    /** fixed workspaceId (single mode). */\n    fixedWorkspaceId?: string;\n  };\n  gateway: { apiKey?: string; baseUrl?: string };\n  viewerCorsOrigins?: string[];\n  /**\n   * Public origin of this deployment (e.g. the Cloudflare Worker URL),\n   * no trailing slash. Used to build viewer URLs the MCP client's human can\n   * actually open. Absent → loopback URLs (local dev).\n   */\n  publicBaseUrl?: string;\n}\n\nfunction requireEnv(env: Env, name: string): string {\n  const v = env[name];\n  if (!v) throw new Error(`config: ${name} is required`);\n  return v;\n}\n\nfunction intEnv(env: Env, name: string, fallback: number): number {\n  const raw = env[name];\n  if (raw === undefined) return fallback;\n  const n = Number(raw);\n  if (!Number.isFinite(n)) throw new Error(`config: ${name} must be a number`);\n  return n;\n}\n\nfunction boolEnv(env: Env, name: string, fallback: boolean): boolean {\n  const raw = env[name];\n  if (raw === undefined) return fallback;\n  return raw === 'true' || raw === '1';\n}\n\nexport function loadConfig(env: Env = process.env): ServerConfig {\n  const cesdkLicense = resolveSecret('IMGLY_CESDK_LICENSE', env);\n  if (!cesdkLicense) throw new Error('config: IMGLY_CESDK_LICENSE is required');\n\n  const mode = (env.IMGLY_WORKSPACE_MODE ?? 'header') as WorkspaceMode;\n  if (mode !== 'header' && mode !== 'session' && mode !== 'single')\n    throw new Error(\n      `config: IMGLY_WORKSPACE_MODE must be header|session|single (got \"${mode}\")`\n    );\n\n  const auth: ServerConfig['auth'] = {\n    mode,\n    header: env.IMGLY_AUTH_WORKSPACE_HEADER ?? 'X-Workspace-Id'\n  };\n  if (mode === 'single') {\n    auth.fixedWorkspaceId = requireEnv(env, 'IMGLY_WORKSPACE_ID');\n  }\n\n  const backend = (env.IMGLY_WORKSPACE_BACKEND ?? 'local') as WorkspaceBackend;\n  if (backend !== 'local' && backend !== 's3')\n    throw new Error(\n      `config: IMGLY_WORKSPACE_BACKEND must be local|s3 (got \"${backend}\")`\n    );\n\n  let workspace: WorkspaceConfig;\n  if (backend === 's3') {\n    const s3: S3Config = {\n      bucket: requireEnv(env, 'IMGLY_WORKSPACE_S3_BUCKET'),\n      region: env.IMGLY_WORKSPACE_S3_REGION ?? 'auto'\n    };\n    if (env.IMGLY_WORKSPACE_S3_ENDPOINT)\n      s3.endpoint = env.IMGLY_WORKSPACE_S3_ENDPOINT;\n    // Keys are optional: absent -> AWS default credential chain (IAM role).\n    const accessKeyId = resolveSecret('IMGLY_WORKSPACE_S3_ACCESS_KEY_ID', env);\n    const secretAccessKey = resolveSecret(\n      'IMGLY_WORKSPACE_S3_SECRET_ACCESS_KEY',\n      env\n    );\n    if (accessKeyId) s3.accessKeyId = accessKeyId;\n    if (secretAccessKey) s3.secretAccessKey = secretAccessKey;\n    workspace = { backend, s3 };\n  } else {\n    workspace = { backend, dir: env.IMGLY_WORKSPACE_DIR ?? '/data' };\n  }\n\n  const gateway: ServerConfig['gateway'] = {};\n  const gatewayKey = resolveSecret('IMGLY_GATEWAY_API_KEY', env);\n  if (gatewayKey) gateway.apiKey = gatewayKey;\n  if (env.IMGLY_GATEWAY_BASE_URL) gateway.baseUrl = env.IMGLY_GATEWAY_BASE_URL;\n\n  const cfg: ServerConfig = {\n    cesdkLicense,\n    buildId: env.IMGLY_BUILD_ID ?? 'dev',\n    port: intEnv(env, 'PORT', 8080),\n    maxEngines: intEnv(env, 'IMGLY_MAX_ENGINES', 8),\n    idleTimeoutMs: intEnv(env, 'IMGLY_SESSION_IDLE_TIMEOUT', 900) * 1000,\n    logLevel: env.IMGLY_LOG_LEVEL ?? 'info',\n    metricsEnabled: boolEnv(env, 'IMGLY_METRICS_ENABLED', false),\n    workspace,\n    auth,\n    gateway\n  };\n  if (env.IMGLY_VIEWER_CORS_ORIGINS)\n    cfg.viewerCorsOrigins = env.IMGLY_VIEWER_CORS_ORIGINS.split(',').map((s) =>\n      s.trim()\n    );\n  if (env.IMGLY_PUBLIC_BASE_URL)\n    cfg.publicBaseUrl = env.IMGLY_PUBLIC_BASE_URL.replace(/\\/+$/, '');\n  return cfg;\n}\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,8EAA8E;AAC9E,6EAA6E;AAC7E,4CAA4C;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,WAAW,CAAC;AAI7C;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,MAAW,OAAO,CAAC,GAAG;IAEtB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IACrC,IAAI,QAAQ;QAAE,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAqDD,SAAS,UAAU,CAAC,GAAQ,EAAE,IAAY;IACxC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,MAAM,CAAC,GAAQ,EAAE,IAAY,EAAE,QAAgB;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,mBAAmB,CAAC,CAAC;IAC7E,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,OAAO,CAAC,GAAQ,EAAE,IAAY,EAAE,QAAiB;IACxD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAW,OAAO,CAAC,GAAG;IAC/C,MAAM,YAAY,GAAG,aAAa,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,oBAAoB,IAAI,QAAQ,CAAkB,CAAC;IACrE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ;QAC9D,MAAM,IAAI,KAAK,CACb,oEAAoE,IAAI,IAAI,CAC7E,CAAC;IAEJ,MAAM,IAAI,GAAyB;QACjC,IAAI;QACJ,MAAM,EAAE,GAAG,CAAC,2BAA2B,IAAI,gBAAgB;KAC5D,CAAC;IACF,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,uBAAuB,IAAI,OAAO,CAAqB,CAAC;IAC7E,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,IAAI;QACzC,MAAM,IAAI,KAAK,CACb,0DAA0D,OAAO,IAAI,CACtE,CAAC;IAEJ,IAAI,SAA0B,CAAC;IAC/B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,EAAE,GAAa;YACnB,MAAM,EAAE,UAAU,CAAC,GAAG,EAAE,2BAA2B,CAAC;YACpD,MAAM,EAAE,GAAG,CAAC,yBAAyB,IAAI,MAAM;SAChD,CAAC;QACF,IAAI,GAAG,CAAC,2BAA2B;YACjC,EAAE,CAAC,QAAQ,GAAG,GAAG,CAAC,2BAA2B,CAAC;QAChD,wEAAwE;QACxE,MAAM,WAAW,GAAG,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,eAAe,GAAG,aAAa,CACnC,sCAAsC,EACtC,GAAG,CACJ,CAAC;QACF,IAAI,WAAW;YAAE,EAAE,CAAC,WAAW,GAAG,WAAW,CAAC;QAC9C,IAAI,eAAe;YAAE,EAAE,CAAC,eAAe,GAAG,eAAe,CAAC;QAC1D,SAAS,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,UAAU;QAAE,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC;IAC5C,IAAI,GAAG,CAAC,sBAAsB;QAAE,OAAO,CAAC,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAE7E,MAAM,GAAG,GAAiB;QACxB,YAAY;QACZ,OAAO,EAAE,GAAG,CAAC,cAAc,IAAI,KAAK;QACpC,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/C,aAAa,EAAE,MAAM,CAAC,GAAG,EAAE,4BAA4B,EAAE,GAAG,CAAC,GAAG,IAAI;QACpE,QAAQ,EAAE,GAAG,CAAC,eAAe,IAAI,MAAM;QACvC,SAAS;QACT,IAAI;QACJ,OAAO;KACR,CAAC;IACF,IAAI,GAAG,CAAC,yBAAyB;QAC/B,GAAG,CAAC,iBAAiB,GAAG,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzE,CAAC,CAAC,IAAI,EAAE,CACT,CAAC;IACJ,IAAI,GAAG,CAAC,qBAAqB;QAC3B,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAW,OAAO,CAAC,GAAG;IAC3D,OAAO,OAAO,CAAC,GAAG,EAAE,wBAAwB,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAW,OAAO,CAAC,GAAG;IAC1D,IAAI,GAAG,CAAC,qBAAqB;QAAE,OAAO,GAAG,CAAC,qBAAqB,CAAC;IAChE,MAAM,aAAa,GACjB,GAAG,CAAC,kBAAkB,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC1E,OAAO,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC","sourcesContent":["// packages/codesign-mcp/src/config.ts\n//\n// The IMGLY_* configuration contract (spec §9.2). One image, switched purely\n// by runtime env. Non-secret knobs are plain env vars; the four secrets\n// (license, gateway key, two S3 keys) also accept the `*_FILE` convention via\n// resolveSecret — the de-facto Docker/K8s secret standard. No secret is ever\n// logged or written; loadConfig only reads.\nimport { readFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join as joinPath } from 'node:path';\n\nexport type Env = Record<string, string | undefined>;\n\n/**\n * Resolve a secret: prefer `<NAME>_FILE` (trimmed file contents — secret files\n * end in a newline) and fall back to the plain `<NAME>` env var. A superset of\n * \"just env vars\": production mounts a file, local dev passes the raw value.\n */\nexport function resolveSecret(\n  name: string,\n  env: Env = process.env\n): string | undefined {\n  const filePath = env[`${name}_FILE`];\n  if (filePath) return readFileSync(filePath, 'utf8').trim();\n  return env[name];\n}\n\nexport type WorkspaceMode = 'header' | 'session' | 'single';\nexport type WorkspaceBackend = 'local' | 's3';\n\nexport interface S3Config {\n  bucket: string;\n  endpoint?: string;\n  region: string;\n  accessKeyId?: string;\n  secretAccessKey?: string;\n}\n\nexport interface WorkspaceConfig {\n  backend: WorkspaceBackend;\n  /** local backend only */\n  dir?: string;\n  /** s3 backend only */\n  s3?: S3Config;\n}\n\nexport interface ServerConfig {\n  cesdkLicense: string;\n  /**\n   * Build identity, surfaced as the MCP `serverInfo.version`. Lets a client\n   * (e.g. the deploy smoketest) detect a stale, not-yet-rolled-out container:\n   * the deploy injects the git SHA, the smoketest asserts the running server\n   * reports it. Default `'dev'` for local runs.\n   */\n  buildId: string;\n  port: number;\n  /** Max concurrent engines/sessions — the RAM cap (spec §9.2). */\n  maxEngines: number;\n  idleTimeoutMs: number;\n  logLevel: string;\n  workspace: WorkspaceConfig;\n  auth: {\n    mode: WorkspaceMode;\n    /** header carrying the trusted workspaceId (header mode). */\n    header: string;\n    /** fixed workspaceId (single mode). */\n    fixedWorkspaceId?: string;\n  };\n  gateway: { apiKey?: string; baseUrl?: string };\n  viewerCorsOrigins?: string[];\n  /**\n   * Public origin of this deployment (e.g. the Cloudflare Worker URL),\n   * no trailing slash. Used to build viewer URLs the MCP client's human can\n   * actually open. Absent → loopback URLs (local dev).\n   */\n  publicBaseUrl?: string;\n}\n\nfunction requireEnv(env: Env, name: string): string {\n  const v = env[name];\n  if (!v) throw new Error(`config: ${name} is required`);\n  return v;\n}\n\nfunction intEnv(env: Env, name: string, fallback: number): number {\n  const raw = env[name];\n  if (raw === undefined) return fallback;\n  const n = Number(raw);\n  if (!Number.isFinite(n)) throw new Error(`config: ${name} must be a number`);\n  return n;\n}\n\nfunction boolEnv(env: Env, name: string, fallback: boolean): boolean {\n  const raw = env[name];\n  if (raw === undefined) return fallback;\n  return raw === 'true' || raw === '1';\n}\n\nexport function loadConfig(env: Env = process.env): ServerConfig {\n  const cesdkLicense = resolveSecret('IMGLY_CESDK_LICENSE', env);\n  if (!cesdkLicense) throw new Error('config: IMGLY_CESDK_LICENSE is required');\n\n  const mode = (env.IMGLY_WORKSPACE_MODE ?? 'header') as WorkspaceMode;\n  if (mode !== 'header' && mode !== 'session' && mode !== 'single')\n    throw new Error(\n      `config: IMGLY_WORKSPACE_MODE must be header|session|single (got \"${mode}\")`\n    );\n\n  const auth: ServerConfig['auth'] = {\n    mode,\n    header: env.IMGLY_AUTH_WORKSPACE_HEADER ?? 'X-Workspace-Id'\n  };\n  if (mode === 'single') {\n    auth.fixedWorkspaceId = requireEnv(env, 'IMGLY_WORKSPACE_ID');\n  }\n\n  const backend = (env.IMGLY_WORKSPACE_BACKEND ?? 'local') as WorkspaceBackend;\n  if (backend !== 'local' && backend !== 's3')\n    throw new Error(\n      `config: IMGLY_WORKSPACE_BACKEND must be local|s3 (got \"${backend}\")`\n    );\n\n  let workspace: WorkspaceConfig;\n  if (backend === 's3') {\n    const s3: S3Config = {\n      bucket: requireEnv(env, 'IMGLY_WORKSPACE_S3_BUCKET'),\n      region: env.IMGLY_WORKSPACE_S3_REGION ?? 'auto'\n    };\n    if (env.IMGLY_WORKSPACE_S3_ENDPOINT)\n      s3.endpoint = env.IMGLY_WORKSPACE_S3_ENDPOINT;\n    // Keys are optional: absent -> AWS default credential chain (IAM role).\n    const accessKeyId = resolveSecret('IMGLY_WORKSPACE_S3_ACCESS_KEY_ID', env);\n    const secretAccessKey = resolveSecret(\n      'IMGLY_WORKSPACE_S3_SECRET_ACCESS_KEY',\n      env\n    );\n    if (accessKeyId) s3.accessKeyId = accessKeyId;\n    if (secretAccessKey) s3.secretAccessKey = secretAccessKey;\n    workspace = { backend, s3 };\n  } else {\n    workspace = { backend, dir: env.IMGLY_WORKSPACE_DIR ?? '/data' };\n  }\n\n  const gateway: ServerConfig['gateway'] = {};\n  const gatewayKey = resolveSecret('IMGLY_GATEWAY_API_KEY', env);\n  if (gatewayKey) gateway.apiKey = gatewayKey;\n  if (env.IMGLY_GATEWAY_BASE_URL) gateway.baseUrl = env.IMGLY_GATEWAY_BASE_URL;\n\n  const cfg: ServerConfig = {\n    cesdkLicense,\n    buildId: env.IMGLY_BUILD_ID ?? 'dev',\n    port: intEnv(env, 'PORT', 8080),\n    maxEngines: intEnv(env, 'IMGLY_MAX_ENGINES', 8),\n    idleTimeoutMs: intEnv(env, 'IMGLY_SESSION_IDLE_TIMEOUT', 900) * 1000,\n    logLevel: env.IMGLY_LOG_LEVEL ?? 'info',\n    workspace,\n    auth,\n    gateway\n  };\n  if (env.IMGLY_VIEWER_CORS_ORIGINS)\n    cfg.viewerCorsOrigins = env.IMGLY_VIEWER_CORS_ORIGINS.split(',').map((s) =>\n      s.trim()\n    );\n  if (env.IMGLY_PUBLIC_BASE_URL)\n    cfg.publicBaseUrl = env.IMGLY_PUBLIC_BASE_URL.replace(/\\/+$/, '');\n  return cfg;\n}\n\n/**\n * Local diagnostics file logging is ON by default so evidence exists before a\n * user knows they hit a bug. Disable with IMGLY_DIAGNOSTICS_FILE=false (or 0).\n */\nexport function diagnosticsFileEnabled(env: Env = process.env): boolean {\n  return boolEnv(env, 'IMGLY_DIAGNOSTICS_FILE', true);\n}\n\n/**\n * Where diagnostics NDJSON is written. Explicit IMGLY_DIAGNOSTICS_DIR wins;\n * otherwise <workspaceRoot>/logs, where workspaceRoot mirrors the stdio default\n * ($CODESIGN_WORKSPACE ?? ~/.codesign/workspace).\n */\nexport function resolveDiagnosticsDir(env: Env = process.env): string {\n  if (env.IMGLY_DIAGNOSTICS_DIR) return env.IMGLY_DIAGNOSTICS_DIR;\n  const workspaceRoot =\n    env.CODESIGN_WORKSPACE ?? joinPath(homedir(), '.codesign', 'workspace');\n  return joinPath(workspaceRoot, 'logs');\n}\n"]}

package/dist/diagnostics/bundle.d.ts

@@ -0,0 +1,10 @@
+import type { Env } from '../config.js';
+export interface BundleFile {
+    name: string;
+    bytes: Buffer;
+}
+export declare function collectBundleFiles(dir: string, meta: Record<string, unknown>): Promise<BundleFile[]>;
+export declare function buildBundleMeta(env?: Env): Record<string, unknown>;
+export declare function runDiagnose(env?: Env): Promise<string>;
+export declare function writeStoreZip(files: BundleFile[], outPath: string): Promise<void>;
+//# sourceMappingURL=bundle.d.ts.map

package/dist/diagnostics/bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/diagnostics/bundle.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAIxC,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,UAAU,EAAE,CAAC,CAgBvB;AAgBD,wBAAgB,eAAe,CAC7B,GAAG,GAAE,GAAiB,GACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBzB;AAED,wBAAsB,WAAW,CAAC,GAAG,GAAE,GAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAWzE;AAsBD,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EAAE,EACnB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA0Df"}

package/dist/diagnostics/bundle.js

@@ -0,0 +1,148 @@
+// packages/codesign-mcp/src/diagnostics/bundle.ts
+//
+// Behind `codesign-mcp diagnose`: collect the rotated NDJSON, scrub raw text
+// (belt-and-suspenders over write-time redaction), add a non-secret meta.json,
+// and pack it all into a single zero-dependency STORE zip the user forwards.
+// No network. Works whether or not a server is running (it just reads disk;
+// the active file's incomplete trailing line is skipped).
+import { mkdir, readdir, readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { arch, platform } from 'node:os';
+import { createRequire } from 'node:module';
+import { deflateRawSync } from 'node:zlib';
+import { resolveDiagnosticsDir } from '../config.js';
+import { redactText } from './redact.js';
+export async function collectBundleFiles(dir, meta) {
+    const names = (await readdir(dir).catch(() => []))
+        .filter((n) => /^diagnostics(\.\d+)?\.ndjson$/.test(n))
+        .sort();
+    const files = [];
+    for (const name of names) {
+        const raw = await readFile(join(dir, name), 'utf8').catch(() => '');
+        const scrubbed = scrubNdjson(raw);
+        if (scrubbed.length > 0)
+            files.push({ name, bytes: Buffer.from(scrubbed, 'utf8') });
+    }
+    files.push({
+        name: 'meta.json',
+        bytes: Buffer.from(redactText(JSON.stringify(meta, null, 2)), 'utf8')
+    });
+    return files;
+}
+/** Redact each COMPLETE line; drop an incomplete trailing line (mid-write). */
+function scrubNdjson(raw) {
+    if (raw.length === 0)
+        return '';
+    const endsClean = raw.endsWith('\n');
+    const lines = raw.split('\n');
+    if (!endsClean)
+        lines.pop(); // partial trailing line
+    return (lines
+        .filter((l) => l.length > 0)
+        .map((l) => redactText(l))
+        .join('\n') + '\n');
+}
+export function buildBundleMeta(env = process.env) {
+    const require = createRequire(import.meta.url);
+    let cesdkVersion = 'unknown';
+    try {
+        cesdkVersion = require('@cesdk/engine/package.json').version;
+    }
+    catch {
+        // engine package layout may not expose package.json; leave 'unknown'
+    }
+    return {
+        buildId: env.IMGLY_BUILD_ID ?? 'dev',
+        os: platform(),
+        arch: arch(),
+        node: process.version,
+        cesdkEngine: cesdkVersion,
+        diagnosticsDir: resolveDiagnosticsDir(env)
+    };
+}
+export async function runDiagnose(env = process.env) {
+    const dir = resolveDiagnosticsDir(env);
+    // Ensure the dir exists — on a fresh install there may be no logs yet but the
+    // user still expects a zip (it will contain only meta.json).
+    await mkdir(dir, { recursive: true });
+    const files = await collectBundleFiles(dir, buildBundleMeta(env));
+    // Timestamp is injected by the caller of Date.now at runtime — fine in product code.
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const outPath = join(dir, `diagnostics-${stamp}.zip`);
+    await writeStoreZip(files, outPath);
+    return outPath;
+}
+// --- Minimal ZIP writer (deflate, zero deps) ---------------------------------
+// One local-file-header + data per entry, then a central directory. Enough for
+// any unzip tool to open; we deflate with node:zlib to keep bundles small.
+const CRC_TABLE = (() => {
+    const t = new Uint32Array(256);
+    for (let n = 0; n < 256; n++) {
+        let c = n;
+        for (let k = 0; k < 8; k++)
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        t[n] = c >>> 0;
+    }
+    return t;
+})();
+function crc32(buf) {
+    let c = 0xffffffff;
+    for (let i = 0; i < buf.length; i++)
+        c = CRC_TABLE[(c ^ buf[i]) & 0xff] ^ (c >>> 8);
+    return (c ^ 0xffffffff) >>> 0;
+}
+export async function writeStoreZip(files, outPath) {
+    const chunks = [];
+    const central = [];
+    let offset = 0;
+    for (const file of files) {
+        const nameBuf = Buffer.from(file.name, 'utf8');
+        const crc = crc32(file.bytes);
+        const compressed = deflateRawSync(file.bytes);
+        const local = Buffer.alloc(30);
+        local.writeUInt32LE(0x04034b50, 0); // local file header signature
+        local.writeUInt16LE(20, 4); // version needed
+        local.writeUInt16LE(0, 6); // flags
+        local.writeUInt16LE(8, 8); // method: deflate
+        local.writeUInt16LE(0, 10); // mod time
+        local.writeUInt16LE(0, 12); // mod date
+        local.writeUInt32LE(crc, 14);
+        local.writeUInt32LE(compressed.length, 18);
+        local.writeUInt32LE(file.bytes.length, 22);
+        local.writeUInt16LE(nameBuf.length, 26);
+        local.writeUInt16LE(0, 28); // extra len
+        chunks.push(local, nameBuf, compressed);
+        const cd = Buffer.alloc(46);
+        cd.writeUInt32LE(0x02014b50, 0); // central dir header signature
+        cd.writeUInt16LE(20, 4); // version made by
+        cd.writeUInt16LE(20, 6); // version needed
+        cd.writeUInt16LE(0, 8); // flags
+        cd.writeUInt16LE(8, 10); // method
+        cd.writeUInt16LE(0, 12);
+        cd.writeUInt16LE(0, 14);
+        cd.writeUInt32LE(crc, 16);
+        cd.writeUInt32LE(compressed.length, 20);
+        cd.writeUInt32LE(file.bytes.length, 24);
+        cd.writeUInt16LE(nameBuf.length, 28);
+        cd.writeUInt16LE(0, 30); // extra
+        cd.writeUInt16LE(0, 32); // comment
+        cd.writeUInt16LE(0, 34); // disk #
+        cd.writeUInt16LE(0, 36); // internal attrs
+        cd.writeUInt32LE(0, 38); // external attrs
+        cd.writeUInt32LE(offset, 42); // local header offset
+        central.push(cd, nameBuf);
+        offset += local.length + nameBuf.length + compressed.length;
+    }
+    const centralBuf = Buffer.concat(central);
+    const end = Buffer.alloc(22);
+    end.writeUInt32LE(0x06054b50, 0); // end of central dir signature
+    end.writeUInt16LE(0, 4);
+    end.writeUInt16LE(0, 6);
+    end.writeUInt16LE(files.length, 8);
+    end.writeUInt16LE(files.length, 10);
+    end.writeUInt32LE(centralBuf.length, 12);
+    end.writeUInt32LE(offset, 16);
+    end.writeUInt16LE(0, 20);
+    await writeFile(outPath, Buffer.concat([...chunks, centralBuf, end]));
+}
+//# sourceMappingURL=bundle.js.map

package/dist/diagnostics/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/diagnostics/bundle.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,0DAA0D;AAC1D,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,IAA6B;IAE7B,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;SAC3D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SACtD,IAAI,EAAE,CAAC;IACV,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;KACtE,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,SAAS;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,wBAAwB;IACrD,OAAO,CACL,KAAK;SACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;SACzB,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,MAAW,OAAO,CAAC,GAAG;IAEtB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,YAAY,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,YAAY,GACV,OAAO,CAAC,4BAA4B,CACrC,CAAC,OAAO,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,cAAc,IAAI,KAAK;QACpC,EAAE,EAAE,QAAQ,EAAE;QACd,IAAI,EAAE,IAAI,EAAE;QACZ,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,WAAW,EAAE,YAAY;QACzB,cAAc,EAAE,qBAAqB,CAAC,GAAG,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAW,OAAO,CAAC,GAAG;IACtD,MAAM,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACvC,8EAA8E;IAC9E,6DAA6D;IAC7D,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,qFAAqF;IACrF,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,CAAC,CAAC;IACtD,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACpC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE;IACtB,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QACjC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAmB,EACnB,OAAe;IAEf,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/B,KAAK,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,8BAA8B;QAClE,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB;QAC7C,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ;QACnC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB;QAC7C,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW;QACvC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW;QACvC,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7B,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY;QACxC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAExC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5B,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,+BAA+B;QAChE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB;QAC3C,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB;QAC1C,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ;QAChC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;QAClC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1B,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ;QACjC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU;QACnC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;QAClC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB;QAC1C,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB;QAC1C,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB;QACpD,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAE1B,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAC9D,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7B,GAAG,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,+BAA+B;IACjE,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9B,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzB,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC","sourcesContent":["// packages/codesign-mcp/src/diagnostics/bundle.ts\n//\n// Behind `codesign-mcp diagnose`: collect the rotated NDJSON, scrub raw text\n// (belt-and-suspenders over write-time redaction), add a non-secret meta.json,\n// and pack it all into a single zero-dependency STORE zip the user forwards.\n// No network. Works whether or not a server is running (it just reads disk;\n// the active file's incomplete trailing line is skipped).\nimport { mkdir, readdir, readFile, writeFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { arch, platform } from 'node:os';\nimport { createRequire } from 'node:module';\nimport { deflateRawSync } from 'node:zlib';\nimport type { Env } from '../config.js';\nimport { resolveDiagnosticsDir } from '../config.js';\nimport { redactText } from './redact.js';\n\nexport interface BundleFile {\n  name: string;\n  bytes: Buffer;\n}\n\nexport async function collectBundleFiles(\n  dir: string,\n  meta: Record<string, unknown>\n): Promise<BundleFile[]> {\n  const names = (await readdir(dir).catch(() => [] as string[]))\n    .filter((n) => /^diagnostics(\\.\\d+)?\\.ndjson$/.test(n))\n    .sort();\n  const files: BundleFile[] = [];\n  for (const name of names) {\n    const raw = await readFile(join(dir, name), 'utf8').catch(() => '');\n    const scrubbed = scrubNdjson(raw);\n    if (scrubbed.length > 0)\n      files.push({ name, bytes: Buffer.from(scrubbed, 'utf8') });\n  }\n  files.push({\n    name: 'meta.json',\n    bytes: Buffer.from(redactText(JSON.stringify(meta, null, 2)), 'utf8')\n  });\n  return files;\n}\n\n/** Redact each COMPLETE line; drop an incomplete trailing line (mid-write). */\nfunction scrubNdjson(raw: string): string {\n  if (raw.length === 0) return '';\n  const endsClean = raw.endsWith('\\n');\n  const lines = raw.split('\\n');\n  if (!endsClean) lines.pop(); // partial trailing line\n  return (\n    lines\n      .filter((l) => l.length > 0)\n      .map((l) => redactText(l))\n      .join('\\n') + '\\n'\n  );\n}\n\nexport function buildBundleMeta(\n  env: Env = process.env\n): Record<string, unknown> {\n  const require = createRequire(import.meta.url);\n  let cesdkVersion = 'unknown';\n  try {\n    cesdkVersion = (\n      require('@cesdk/engine/package.json') as { version: string }\n    ).version;\n  } catch {\n    // engine package layout may not expose package.json; leave 'unknown'\n  }\n  return {\n    buildId: env.IMGLY_BUILD_ID ?? 'dev',\n    os: platform(),\n    arch: arch(),\n    node: process.version,\n    cesdkEngine: cesdkVersion,\n    diagnosticsDir: resolveDiagnosticsDir(env)\n  };\n}\n\nexport async function runDiagnose(env: Env = process.env): Promise<string> {\n  const dir = resolveDiagnosticsDir(env);\n  // Ensure the dir exists — on a fresh install there may be no logs yet but the\n  // user still expects a zip (it will contain only meta.json).\n  await mkdir(dir, { recursive: true });\n  const files = await collectBundleFiles(dir, buildBundleMeta(env));\n  // Timestamp is injected by the caller of Date.now at runtime — fine in product code.\n  const stamp = new Date().toISOString().replace(/[:.]/g, '-');\n  const outPath = join(dir, `diagnostics-${stamp}.zip`);\n  await writeStoreZip(files, outPath);\n  return outPath;\n}\n\n// --- Minimal ZIP writer (deflate, zero deps) ---------------------------------\n// One local-file-header + data per entry, then a central directory. Enough for\n// any unzip tool to open; we deflate with node:zlib to keep bundles small.\nconst CRC_TABLE = (() => {\n  const t = new Uint32Array(256);\n  for (let n = 0; n < 256; n++) {\n    let c = n;\n    for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;\n    t[n] = c >>> 0;\n  }\n  return t;\n})();\n\nfunction crc32(buf: Buffer): number {\n  let c = 0xffffffff;\n  for (let i = 0; i < buf.length; i++)\n    c = CRC_TABLE[(c ^ buf[i]) & 0xff] ^ (c >>> 8);\n  return (c ^ 0xffffffff) >>> 0;\n}\n\nexport async function writeStoreZip(\n  files: BundleFile[],\n  outPath: string\n): Promise<void> {\n  const chunks: Buffer[] = [];\n  const central: Buffer[] = [];\n  let offset = 0;\n\n  for (const file of files) {\n    const nameBuf = Buffer.from(file.name, 'utf8');\n    const crc = crc32(file.bytes);\n    const compressed = deflateRawSync(file.bytes);\n    const local = Buffer.alloc(30);\n    local.writeUInt32LE(0x04034b50, 0); // local file header signature\n    local.writeUInt16LE(20, 4); // version needed\n    local.writeUInt16LE(0, 6); // flags\n    local.writeUInt16LE(8, 8); // method: deflate\n    local.writeUInt16LE(0, 10); // mod time\n    local.writeUInt16LE(0, 12); // mod date\n    local.writeUInt32LE(crc, 14);\n    local.writeUInt32LE(compressed.length, 18);\n    local.writeUInt32LE(file.bytes.length, 22);\n    local.writeUInt16LE(nameBuf.length, 26);\n    local.writeUInt16LE(0, 28); // extra len\n    chunks.push(local, nameBuf, compressed);\n\n    const cd = Buffer.alloc(46);\n    cd.writeUInt32LE(0x02014b50, 0); // central dir header signature\n    cd.writeUInt16LE(20, 4); // version made by\n    cd.writeUInt16LE(20, 6); // version needed\n    cd.writeUInt16LE(0, 8); // flags\n    cd.writeUInt16LE(8, 10); // method\n    cd.writeUInt16LE(0, 12);\n    cd.writeUInt16LE(0, 14);\n    cd.writeUInt32LE(crc, 16);\n    cd.writeUInt32LE(compressed.length, 20);\n    cd.writeUInt32LE(file.bytes.length, 24);\n    cd.writeUInt16LE(nameBuf.length, 28);\n    cd.writeUInt16LE(0, 30); // extra\n    cd.writeUInt16LE(0, 32); // comment\n    cd.writeUInt16LE(0, 34); // disk #\n    cd.writeUInt16LE(0, 36); // internal attrs\n    cd.writeUInt32LE(0, 38); // external attrs\n    cd.writeUInt32LE(offset, 42); // local header offset\n    central.push(cd, nameBuf);\n\n    offset += local.length + nameBuf.length + compressed.length;\n  }\n\n  const centralBuf = Buffer.concat(central);\n  const end = Buffer.alloc(22);\n  end.writeUInt32LE(0x06054b50, 0); // end of central dir signature\n  end.writeUInt16LE(0, 4);\n  end.writeUInt16LE(0, 6);\n  end.writeUInt16LE(files.length, 8);\n  end.writeUInt16LE(files.length, 10);\n  end.writeUInt32LE(centralBuf.length, 12);\n  end.writeUInt32LE(offset, 16);\n  end.writeUInt16LE(0, 20);\n\n  await writeFile(outPath, Buffer.concat([...chunks, centralBuf, end]));\n}\n"]}

package/dist/diagnostics/compose.d.ts

@@ -0,0 +1,3 @@
+import type { DiagnosticsSink } from './events.js';
+export declare function composeSinks(...sinks: DiagnosticsSink[]): DiagnosticsSink;
+//# sourceMappingURL=compose.d.ts.map

package/dist/diagnostics/compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/diagnostics/compose.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAmB,eAAe,EAAE,MAAM,aAAa,CAAC;AAEpE,wBAAgB,YAAY,CAAC,GAAG,KAAK,EAAE,eAAe,EAAE,GAAG,eAAe,CAYzE"}

package/dist/diagnostics/compose.js

@@ -0,0 +1,15 @@
+export function composeSinks(...sinks) {
+    return {
+        emit(event) {
+            for (const sink of sinks) {
+                try {
+                    sink.emit(event);
+                }
+                catch {
+                    // A misbehaving sink must never break event production.
+                }
+            }
+        }
+    };
+}
+//# sourceMappingURL=compose.js.map

package/dist/diagnostics/compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../src/diagnostics/compose.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,YAAY,CAAC,GAAG,KAAwB;IACtD,OAAO;QACL,IAAI,CAAC,KAAsB;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,CAAC;gBAAC,MAAM,CAAC;oBACP,wDAAwD;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["// packages/codesign-mcp/src/diagnostics/compose.ts\n//\n// Fan one event out to N sinks. M1 uses a single file sink; compose keeps the\n// future multi-sink path trivial and lets tests observe alongside the file sink.\n// One sink throwing must not rob the others (or the caller) — each emit is guarded.\nimport type { DiagnosticEvent, DiagnosticsSink } from './events.js';\n\nexport function composeSinks(...sinks: DiagnosticsSink[]): DiagnosticsSink {\n  return {\n    emit(event: DiagnosticEvent): void {\n      for (const sink of sinks) {\n        try {\n          sink.emit(event);\n        } catch {\n          // A misbehaving sink must never break event production.\n        }\n      }\n    }\n  };\n}\n"]}

package/dist/diagnostics/events.d.ts

@@ -0,0 +1,34 @@
+import type { Span } from '../tools/spans.js';
+export interface ErrorInfo {
+    message: string;
+    stack?: string;
+}
+export type DiagnosticEvent = {
+    kind: 'tool_call';
+    timestamp: number;
+    tool: string;
+    succeeded: boolean;
+    totalMs: number;
+    spans: Span[];
+    error?: ErrorInfo;
+    args?: unknown;
+    result?: unknown;
+    revision?: string;
+    session?: string;
+} | {
+    kind: 'engine_log';
+    timestamp: number;
+    level: 'log' | 'info' | 'warn' | 'error' | 'debug' | 'trace';
+    text: string;
+} | {
+    kind: 'lifecycle';
+    timestamp: number;
+    text: string;
+    error?: ErrorInfo;
+};
+export interface DiagnosticsSink {
+    emit(event: DiagnosticEvent): void;
+}
+/** The off-switch: a sink that accepts and discards every event. */
+export declare const NOOP_DIAGNOSTICS_SINK: DiagnosticsSink;
+//# sourceMappingURL=events.d.ts.map

package/dist/diagnostics/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/diagnostics/events.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC7D,IAAI,EAAE,MAAM,CAAC;CACd,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AAEN,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;CACpC;AAED,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,EAAE,eAA+B,CAAC"}

package/dist/diagnostics/events.js

@@ -0,0 +1,3 @@
+/** The off-switch: a sink that accepts and discards every event. */
+export const NOOP_DIAGNOSTICS_SINK = { emit() { } };
+//# sourceMappingURL=events.js.map

package/dist/diagnostics/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/diagnostics/events.ts"],"names":[],"mappings":"AA2CA,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAoB,EAAE,IAAI,KAAI,CAAC,EAAE,CAAC","sourcesContent":["// packages/codesign-mcp/src/diagnostics/events.ts\n//\n// The single transport shape for the diagnostics stream. Every diagnostic datum\n// — tool call, engine console line, lifecycle breadcrumb — is one DiagnosticEvent,\n// one NDJSON line. Sinks (file today; OTel/in-memory later) consume this union.\nimport type { Span } from '../tools/spans.js';\n\nexport interface ErrorInfo {\n  message: string;\n  stack?: string;\n}\n\nexport type DiagnosticEvent =\n  | {\n      kind: 'tool_call';\n      timestamp: number;\n      tool: string;\n      succeeded: boolean;\n      totalMs: number;\n      spans: Span[];\n      error?: ErrorInfo;\n      args?: unknown;\n      result?: unknown;\n      revision?: string;\n      session?: string;\n    }\n  | {\n      kind: 'engine_log';\n      timestamp: number;\n      level: 'log' | 'info' | 'warn' | 'error' | 'debug' | 'trace';\n      text: string;\n    }\n  | {\n      kind: 'lifecycle';\n      timestamp: number;\n      text: string;\n      error?: ErrorInfo;\n    };\n\nexport interface DiagnosticsSink {\n  emit(event: DiagnosticEvent): void;\n}\n\n/** The off-switch: a sink that accepts and discards every event. */\nexport const NOOP_DIAGNOSTICS_SINK: DiagnosticsSink = { emit() {} };\n"]}

package/dist/diagnostics/file-sink.d.ts

@@ -0,0 +1,38 @@
+import type { DiagnosticEvent, DiagnosticsSink } from './events.js';
+export interface FileSinkOptions {
+    dir: string;
+    fileName?: string;
+    maxFileBytes?: number;
+    keep?: number;
+    totalBudgetBytes?: number;
+    maxAgeMs?: number;
+}
+export declare class FileDiagnosticsSink implements DiagnosticsSink {
+    private readonly dir;
+    private readonly fileName;
+    private readonly maxFileBytes;
+    private readonly keep;
+    private readonly totalBudgetBytes;
+    private readonly active;
+    private tail;
+    private gitignoreWritten;
+    private notifiedError;
+    constructor(opts: FileSinkOptions);
+    emit(event: DiagnosticEvent): void;
+    /** Await all queued writes — for tests and graceful shutdown. */
+    flush(): Promise<void>;
+    private write;
+    private activeSize;
+    private rotate;
+    private enforceBudget;
+    private rotatedPath;
+    private rotatedFiles;
+    private noteError;
+    /**
+     * Startup GC: delete rotated files older than maxAgeMs, then enforce the
+     * total-size budget. The safe point to run this is before any writer is
+     * active. Never throws.
+     */
+    static pruneOnStartup(opts: FileSinkOptions): Promise<void>;
+}
+//# sourceMappingURL=file-sink.d.ts.map

package/dist/diagnostics/file-sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-sink.d.ts","sourceRoot":"","sources":["../../src/diagnostics/file-sink.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGpE,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAYD,qBAAa,mBAAoB,YAAW,eAAe;IACzD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,IAAI,CAAoC;IAChD,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,aAAa,CAAS;gBAElB,IAAI,EAAE,eAAe;IASjC,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAmBlC,iEAAiE;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAId,KAAK;YAaL,UAAU;YAQV,MAAM;YAeN,aAAa;IAW3B,OAAO,CAAC,WAAW;YAOL,YAAY;IAiB1B,OAAO,CAAC,SAAS;IAQjB;;;;OAIG;WACU,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CA0BlE"}

package/dist/diagnostics/file-sink.js

@@ -0,0 +1,157 @@
+// packages/codesign-mcp/src/diagnostics/file-sink.ts
+//
+// The M1 sink: one rotated NDJSON file holding the whole stream, redacted at
+// write so secrets never touch disk. Bounded three ways — per-file rotation,
+// a total-size budget across rotated files, and a startup prune by age +
+// budget. emit() is fire-and-forget (queued) so it never adds tool latency,
+// and it swallows its own I/O errors so a failed append can't break a call.
+import { appendFile, stat, rename, unlink, mkdir, readdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { redactValue } from './redact.js';
+const DEFAULTS = {
+    fileName: 'diagnostics.ndjson',
+    maxFileBytes: 8 * 1024 * 1024,
+    keep: 5,
+    totalBudgetBytes: 50 * 1024 * 1024,
+    maxAgeMs: 14 * 24 * 60 * 60 * 1000
+};
+const ROTATED_RE = /^(.*)\.(\d+)\.ndjson$/;
+export class FileDiagnosticsSink {
+    constructor(opts) {
+        this.tail = Promise.resolve();
+        this.gitignoreWritten = false;
+        this.notifiedError = false;
+        this.dir = opts.dir;
+        this.fileName = opts.fileName ?? DEFAULTS.fileName;
+        this.maxFileBytes = opts.maxFileBytes ?? DEFAULTS.maxFileBytes;
+        this.keep = opts.keep ?? DEFAULTS.keep;
+        this.totalBudgetBytes = opts.totalBudgetBytes ?? DEFAULTS.totalBudgetBytes;
+        this.active = join(this.dir, this.fileName);
+    }
+    emit(event) {
+        // Redact at write: secrets never hit disk. Fail-closed — a redactor throw
+        // drops the payload to a stub rather than writing raw.
+        let line;
+        try {
+            line = JSON.stringify(redactValue(event)) + '\n';
+        }
+        catch {
+            line =
+                JSON.stringify({
+                    kind: event?.kind ?? 'unknown',
+                    timestamp: event?.timestamp ?? 0,
+                    redactionError: true
+                }) + '\n';
+        }
+        this.tail = this.tail
+            .then(() => this.write(line))
+            .catch((err) => this.noteError(err));
+    }
+    /** Await all queued writes — for tests and graceful shutdown. */
+    async flush() {
+        await this.tail;
+    }
+    async write(line) {
+        await mkdir(this.dir, { recursive: true });
+        if (!this.gitignoreWritten) {
+            this.gitignoreWritten = true;
+            await writeFile(join(this.dir, '.gitignore'), '*\n').catch(() => { });
+        }
+        const size = await this.activeSize();
+        if (size > 0 && size + Buffer.byteLength(line) > this.maxFileBytes) {
+            await this.rotate();
+        }
+        await appendFile(this.active, line);
+    }
+    async activeSize() {
+        try {
+            return (await stat(this.active)).size;
+        }
+        catch {
+            return 0;
+        }
+    }
+    async rotate() {
+        // Shift diagnostics.N.ndjson -> N+1, active -> .1, then trim to keep + budget.
+        const rotated = await this.rotatedFiles();
+        for (const { index } of rotated.sort((a, b) => b.index - a.index)) {
+            const from = this.rotatedPath(index);
+            if (index + 1 > this.keep) {
+                await unlink(from).catch(() => { });
+            }
+            else {
+                await rename(from, this.rotatedPath(index + 1)).catch(() => { });
+            }
+        }
+        await rename(this.active, this.rotatedPath(1)).catch(() => { });
+        await this.enforceBudget();
+    }
+    async enforceBudget() {
+        const rotated = await this.rotatedFiles();
+        let total = rotated.reduce((n, r) => n + r.size, 0);
+        // Delete oldest (highest index) first until under budget.
+        for (const r of rotated.sort((a, b) => b.index - a.index)) {
+            if (total <= this.totalBudgetBytes)
+                break;
+            await unlink(this.rotatedPath(r.index)).catch(() => { });
+            total -= r.size;
+        }
+    }
+    rotatedPath(index) {
+        return join(this.dir, `${this.fileName.replace(/\.ndjson$/, '')}.${index}.ndjson`);
+    }
+    async rotatedFiles() {
+        const base = this.fileName.replace(/\.ndjson$/, '');
+        const out = [];
+        for (const name of await readdir(this.dir).catch(() => [])) {
+            const m = name.match(ROTATED_RE);
+            if (m && m[1] === base) {
+                const size = (await stat(join(this.dir, name)).catch(() => ({ size: 0 }))).size;
+                out.push({ index: Number(m[2]), size });
+            }
+        }
+        return out;
+    }
+    noteError(err) {
+        if (this.notifiedError)
+            return;
+        this.notifiedError = true;
+        process.stderr.write(`codesign-mcp: diagnostics file write failed — ${err instanceof Error ? err.message : String(err)}\n`);
+    }
+    /**
+     * Startup GC: delete rotated files older than maxAgeMs, then enforce the
+     * total-size budget. The safe point to run this is before any writer is
+     * active. Never throws.
+     */
+    static async pruneOnStartup(opts) {
+        const dir = opts.dir;
+        const fileName = opts.fileName ?? DEFAULTS.fileName;
+        const base = fileName.replace(/\.ndjson$/, '');
+        const maxAgeMs = opts.maxAgeMs ?? DEFAULTS.maxAgeMs;
+        const totalBudgetBytes = opts.totalBudgetBytes ?? DEFAULTS.totalBudgetBytes;
+        const now = Date.now();
+        const rotated = [];
+        for (const name of await readdir(dir).catch(() => [])) {
+            const m = name.match(ROTATED_RE);
+            if (!m || m[1] !== base)
+                continue;
+            const s = await stat(join(dir, name)).catch(() => null);
+            if (!s)
+                continue;
+            if (now - s.mtimeMs > maxAgeMs) {
+                await unlink(join(dir, name)).catch(() => { });
+            }
+            else {
+                rotated.push({ index: Number(m[2]), size: s.size, mtimeMs: s.mtimeMs });
+            }
+        }
+        let total = rotated.reduce((n, r) => n + r.size, 0);
+        for (const r of rotated.sort((a, b) => b.index - a.index)) {
+            if (total <= totalBudgetBytes)
+                break;
+            await unlink(join(dir, `${base}.${r.index}.ndjson`)).catch(() => { });
+            total -= r.size;
+        }
+    }
+}
+//# sourceMappingURL=file-sink.js.map

package/dist/diagnostics/file-sink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-sink.js","sourceRoot":"","sources":["../../src/diagnostics/file-sink.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,OAAO,EACL,UAAU,EACV,IAAI,EACJ,MAAM,EACN,MAAM,EACN,KAAK,EACL,OAAO,EACP,SAAS,EACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAW1C,MAAM,QAAQ,GAAG;IACf,QAAQ,EAAE,oBAAoB;IAC9B,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;IAC7B,IAAI,EAAE,CAAC;IACP,gBAAgB,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAClC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CACnC,CAAC;AAEF,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C,MAAM,OAAO,mBAAmB;IAW9B,YAAY,IAAqB;QAJzB,SAAI,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;QACxC,qBAAgB,GAAG,KAAK,CAAC;QACzB,kBAAa,GAAG,KAAK,CAAC;QAG5B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;QACnD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC;QAC/D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC;QACvC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB,CAAC;QAC3E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,KAAsB;QACzB,0EAA0E;QAC1E,uDAAuD;QACvD,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI;gBACF,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS;oBAC9B,SAAS,EAAE,KAAK,EAAE,SAAS,IAAI,CAAC;oBAChC,cAAc,EAAE,IAAI;iBACrB,CAAC,GAAG,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI;aAClB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC5B,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,IAAY;QAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACrC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACnE,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,+EAA+E;QAC/E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1C,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC1B,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/D,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1C,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpD,0DAA0D;QAC1D,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,IAAI,KAAK,IAAI,IAAI,CAAC,gBAAgB;gBAAE,MAAM;YAC1C,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxD,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,KAAa;QAC/B,OAAO,IAAI,CACT,IAAI,CAAC,GAAG,EACR,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAC5D,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY;QAGxB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,GAAG,GAA2C,EAAE,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,CACX,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAC5D,CAAC,IAAI,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,SAAS,CAAC,GAAY;QAC5B,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO;QAC/B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACtG,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAqB;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;QACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;QACpD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB,CAAC;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAA4D,EAAE,CAAC;QAC5E,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,SAAS;YAClC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;gBAC/B,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QACD,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,IAAI,KAAK,IAAI,gBAAgB;gBAAE,MAAM;YACrC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrE,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;CACF","sourcesContent":["// packages/codesign-mcp/src/diagnostics/file-sink.ts\n//\n// The M1 sink: one rotated NDJSON file holding the whole stream, redacted at\n// write so secrets never touch disk. Bounded three ways — per-file rotation,\n// a total-size budget across rotated files, and a startup prune by age +\n// budget. emit() is fire-and-forget (queued) so it never adds tool latency,\n// and it swallows its own I/O errors so a failed append can't break a call.\nimport {\n  appendFile,\n  stat,\n  rename,\n  unlink,\n  mkdir,\n  readdir,\n  writeFile\n} from 'node:fs/promises';\nimport { join } from 'node:path';\nimport type { DiagnosticEvent, DiagnosticsSink } from './events.js';\nimport { redactValue } from './redact.js';\n\nexport interface FileSinkOptions {\n  dir: string;\n  fileName?: string;\n  maxFileBytes?: number;\n  keep?: number;\n  totalBudgetBytes?: number;\n  maxAgeMs?: number;\n}\n\nconst DEFAULTS = {\n  fileName: 'diagnostics.ndjson',\n  maxFileBytes: 8 * 1024 * 1024,\n  keep: 5,\n  totalBudgetBytes: 50 * 1024 * 1024,\n  maxAgeMs: 14 * 24 * 60 * 60 * 1000\n};\n\nconst ROTATED_RE = /^(.*)\\.(\\d+)\\.ndjson$/;\n\nexport class FileDiagnosticsSink implements DiagnosticsSink {\n  private readonly dir: string;\n  private readonly fileName: string;\n  private readonly maxFileBytes: number;\n  private readonly keep: number;\n  private readonly totalBudgetBytes: number;\n  private readonly active: string;\n  private tail: Promise<void> = Promise.resolve();\n  private gitignoreWritten = false;\n  private notifiedError = false;\n\n  constructor(opts: FileSinkOptions) {\n    this.dir = opts.dir;\n    this.fileName = opts.fileName ?? DEFAULTS.fileName;\n    this.maxFileBytes = opts.maxFileBytes ?? DEFAULTS.maxFileBytes;\n    this.keep = opts.keep ?? DEFAULTS.keep;\n    this.totalBudgetBytes = opts.totalBudgetBytes ?? DEFAULTS.totalBudgetBytes;\n    this.active = join(this.dir, this.fileName);\n  }\n\n  emit(event: DiagnosticEvent): void {\n    // Redact at write: secrets never hit disk. Fail-closed — a redactor throw\n    // drops the payload to a stub rather than writing raw.\n    let line: string;\n    try {\n      line = JSON.stringify(redactValue(event)) + '\\n';\n    } catch {\n      line =\n        JSON.stringify({\n          kind: event?.kind ?? 'unknown',\n          timestamp: event?.timestamp ?? 0,\n          redactionError: true\n        }) + '\\n';\n    }\n    this.tail = this.tail\n      .then(() => this.write(line))\n      .catch((err) => this.noteError(err));\n  }\n\n  /** Await all queued writes — for tests and graceful shutdown. */\n  async flush(): Promise<void> {\n    await this.tail;\n  }\n\n  private async write(line: string): Promise<void> {\n    await mkdir(this.dir, { recursive: true });\n    if (!this.gitignoreWritten) {\n      this.gitignoreWritten = true;\n      await writeFile(join(this.dir, '.gitignore'), '*\\n').catch(() => {});\n    }\n    const size = await this.activeSize();\n    if (size > 0 && size + Buffer.byteLength(line) > this.maxFileBytes) {\n      await this.rotate();\n    }\n    await appendFile(this.active, line);\n  }\n\n  private async activeSize(): Promise<number> {\n    try {\n      return (await stat(this.active)).size;\n    } catch {\n      return 0;\n    }\n  }\n\n  private async rotate(): Promise<void> {\n    // Shift diagnostics.N.ndjson -> N+1, active -> .1, then trim to keep + budget.\n    const rotated = await this.rotatedFiles();\n    for (const { index } of rotated.sort((a, b) => b.index - a.index)) {\n      const from = this.rotatedPath(index);\n      if (index + 1 > this.keep) {\n        await unlink(from).catch(() => {});\n      } else {\n        await rename(from, this.rotatedPath(index + 1)).catch(() => {});\n      }\n    }\n    await rename(this.active, this.rotatedPath(1)).catch(() => {});\n    await this.enforceBudget();\n  }\n\n  private async enforceBudget(): Promise<void> {\n    const rotated = await this.rotatedFiles();\n    let total = rotated.reduce((n, r) => n + r.size, 0);\n    // Delete oldest (highest index) first until under budget.\n    for (const r of rotated.sort((a, b) => b.index - a.index)) {\n      if (total <= this.totalBudgetBytes) break;\n      await unlink(this.rotatedPath(r.index)).catch(() => {});\n      total -= r.size;\n    }\n  }\n\n  private rotatedPath(index: number): string {\n    return join(\n      this.dir,\n      `${this.fileName.replace(/\\.ndjson$/, '')}.${index}.ndjson`\n    );\n  }\n\n  private async rotatedFiles(): Promise<\n    Array<{ index: number; size: number }>\n  > {\n    const base = this.fileName.replace(/\\.ndjson$/, '');\n    const out: Array<{ index: number; size: number }> = [];\n    for (const name of await readdir(this.dir).catch(() => [] as string[])) {\n      const m = name.match(ROTATED_RE);\n      if (m && m[1] === base) {\n        const size = (\n          await stat(join(this.dir, name)).catch(() => ({ size: 0 }))\n        ).size;\n        out.push({ index: Number(m[2]), size });\n      }\n    }\n    return out;\n  }\n\n  private noteError(err: unknown): void {\n    if (this.notifiedError) return;\n    this.notifiedError = true;\n    process.stderr.write(\n      `codesign-mcp: diagnostics file write failed — ${err instanceof Error ? err.message : String(err)}\\n`\n    );\n  }\n\n  /**\n   * Startup GC: delete rotated files older than maxAgeMs, then enforce the\n   * total-size budget. The safe point to run this is before any writer is\n   * active. Never throws.\n   */\n  static async pruneOnStartup(opts: FileSinkOptions): Promise<void> {\n    const dir = opts.dir;\n    const fileName = opts.fileName ?? DEFAULTS.fileName;\n    const base = fileName.replace(/\\.ndjson$/, '');\n    const maxAgeMs = opts.maxAgeMs ?? DEFAULTS.maxAgeMs;\n    const totalBudgetBytes = opts.totalBudgetBytes ?? DEFAULTS.totalBudgetBytes;\n    const now = Date.now();\n    const rotated: Array<{ index: number; size: number; mtimeMs: number }> = [];\n    for (const name of await readdir(dir).catch(() => [] as string[])) {\n      const m = name.match(ROTATED_RE);\n      if (!m || m[1] !== base) continue;\n      const s = await stat(join(dir, name)).catch(() => null);\n      if (!s) continue;\n      if (now - s.mtimeMs > maxAgeMs) {\n        await unlink(join(dir, name)).catch(() => {});\n      } else {\n        rotated.push({ index: Number(m[2]), size: s.size, mtimeMs: s.mtimeMs });\n      }\n    }\n    let total = rotated.reduce((n, r) => n + r.size, 0);\n    for (const r of rotated.sort((a, b) => b.index - a.index)) {\n      if (total <= totalBudgetBytes) break;\n      await unlink(join(dir, `${base}.${r.index}.ndjson`)).catch(() => {});\n      total -= r.size;\n    }\n  }\n}\n"]}

package/dist/diagnostics/redact.d.ts

@@ -0,0 +1,7 @@
+/** Key names whose VALUE is always dropped, matched case-insensitively. */
+export declare const SECRET_KEY_RE: RegExp;
+/** Substrings shaped like a credential; scrubbed out of any string. */
+export declare const SECRET_PATTERNS: RegExp[];
+export declare function redactText(text: string): string;
+export declare function redactValue(value: unknown): unknown;
+//# sourceMappingURL=redact.d.ts.map

package/dist/diagnostics/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/diagnostics/redact.ts"],"names":[],"mappings":"AAUA,2EAA2E;AAC3E,eAAO,MAAM,aAAa,QACoC,CAAC;AAE/D,uEAAuE;AACvE,eAAO,MAAM,eAAe,EAAE,MAAM,EAOnC,CAAC;AAEF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM/C;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAWnD"}