@mcpolyglot/cli 0.2.0 → 0.4.0

package/dist/commands/doctor.js

@@ -1,6 +1,8 @@
 import pc from 'picocolors';
 import { loadConfig, looksLikeLiteralCredential } from '@mcpolyglot/config';
+import { isColumnDenied, PolicySchema, tableAccess, } from '@mcpolyglot/connector-sql';
 import { buildServerFromConfig } from '../factory.js';
+import { doctorAgents } from './doctor-agents.js';
 import { headerBar, section, ok, err, warn, bullet, footerBar, stdoutSink, sym, chip, } from '../ui.js';
 export async function doctorCommand(opts) {
     let allOk = true;
@@ -27,9 +29,18 @@ export async function doctorCommand(opts) {
             warn(`${s.id}: url looks like a literal credential`, 'use ${env:NAME}, ${file:./path}, or ${keychain:item}', stdoutSink);
         }
     }
+    // An invalid policy stops the server from starting, so report it before building one.
+    for (const s of cfg.sources) {
+        const parsed = 'policy' in s ? PolicySchema.safeParse(s.policy ?? {}) : undefined;
+        if (parsed && !parsed.success) {
+            section('Policy', stdoutSink);
+            err(`${s.id}: invalid policy`, parsed.error.issues.map((i) => i.message).join('; '), stdoutSink);
+            return false;
+        }
+    }
     section('Sources', stdoutSink);
     const { connectors, server } = await buildServerFromConfig(cfg);
-    for (const c of connectors) {
+    for (const [i, c] of connectors.entries()) {
         try {
             await c.init({
                 logger: { debug: () => { }, info: () => { }, warn: () => { }, error: () => { } },
@@ -47,6 +58,20 @@ export async function doctorCommand(opts) {
             for (const t of tools) {
                 process.stdout.write(`      ${sym.bullet} ${pc.bold(t.name)}  ${pc.dim('[')}${pc.cyan(t.scopes.join(', '))}${pc.dim(']')}\n`);
             }
+            const src = cfg.sources[i];
+            if (c.kind === 'sql' && src && src.kind !== 'mongo' && src.kind !== 'openapi') {
+                const snap = await c.introspect();
+                if (snap.kind === 'sql' && !printPolicyReport(checkPolicy(src.policy, snap.tables))) {
+                    allOk = false;
+                }
+                // The classifier is defense-in-depth; the DB grant is the control. A user that can
+                // read server files or is superuser makes the policy advisory, so doctor fails.
+                const privs = await c.auditPrivileges();
+                for (const p of privs) {
+                    allOk = false;
+                    err('privileges', p, stdoutSink);
+                }
+            }
             await c.close();
         }
         catch (e) {
@@ -54,6 +79,7 @@ export async function doctorCommand(opts) {
             err(c.id, e.message, stdoutSink);
         }
     }
+    doctorAgents(cfg, connectors);
     await server.stop().catch(() => { });
     section('Summary', stdoutSink);
     if (allOk) {
@@ -65,4 +91,56 @@ export async function doctorCommand(opts) {
     footerBar([`run: ${pc.cyan('mcpolyglot serve')}`, `docs: ${pc.cyan('github.com/ishay60/mcpolyglot')}`], stdoutSink);
     return allOk;
 }
+/** Check a source's policy against its live schema. `policy` must already parse. */
+export function checkPolicy(raw, tables) {
+    const policy = PolicySchema.parse(raw ?? {});
+    const name = (t) => (t.schema ? `${t.schema}.${t.name}` : t.name);
+    const matches = (key, t) => {
+        const k = key.toLowerCase();
+        return k === t.name.toLowerCase() || k === name(t).toLowerCase();
+    };
+    const report = {
+        problems: [],
+        readable: [],
+        writable: [],
+        hidden: [],
+        hiddenColumns: [],
+    };
+    for (const key of Object.keys(policy.tables)) {
+        if (!tables.some((t) => matches(key, t))) {
+            report.problems.push(`policy.tables names "${key}", which is not in the schema`);
+        }
+    }
+    for (const entry of policy.denyColumns) {
+        const dot = entry.lastIndexOf('.');
+        const [table, column] = [entry.slice(0, dot), entry.slice(dot + 1).toLowerCase()];
+        const bare = table.split('.').pop().toLowerCase();
+        const candidates = table === '*' ? tables : tables.filter((t) => t.name.toLowerCase() === bare);
+        if (!candidates.some((t) => t.columns.some((c) => c.name.toLowerCase() === column))) {
+            report.problems.push(`denyColumns has "${entry}", which matches no column in the schema`);
+        }
+    }
+    for (const t of tables) {
+        const access = tableAccess(policy, t.schema ?? 'null', t.name);
+        const bucket = access === 'write' ? 'writable' : access === 'read' ? 'readable' : 'hidden';
+        report[bucket].push(name(t));
+        if (access !== 'none') {
+            for (const c of t.columns) {
+                if (isColumnDenied(policy, t.name, c.name))
+                    report.hiddenColumns.push(`${name(t)}.${c.name}`);
+            }
+        }
+    }
+    return report;
+}
+function printPolicyReport(r) {
+    const list = (xs) => (xs.length ? xs.join(', ') : pc.dim('none'));
+    bullet(pc.dim('readable'), list(r.readable), stdoutSink);
+    bullet(pc.dim('writable'), list(r.writable), stdoutSink);
+    bullet(pc.dim('hidden'), list(r.hidden), stdoutSink);
+    bullet(pc.dim('hidden columns'), list(r.hiddenColumns), stdoutSink);
+    for (const p of r.problems)
+        err('policy', p, stdoutSink);
+    return r.problems.length === 0;
+}
 //# sourceMappingURL=doctor.js.map

package/dist/commands/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,SAAS,EACT,OAAO,EACP,EAAE,EACF,GAAG,EACH,IAAI,EACJ,MAAM,EACN,SAAS,EACT,UAAU,EACV,GAAG,EACH,IAAI,GACL,MAAM,UAAU,CAAC;AAMlB,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB;IACrD,IAAI,KAAK,GAAG,IAAI,CAAC;IAEjB,SAAS,CACP;QACE,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,oDAAoD;KAC/D,EACD,UAAU,CACX,CAAC;IAEF,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9B,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9B,GAAG,CAAC,iBAAiB,EAAG,CAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uBAAuB;IACvB,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/F,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,CACF,GAAG,CAAC,CAAC,EAAE,uCAAuC,EAC9C,sDAAsD,EACtD,UAAU,CACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/B,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE;aAC7E,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,SAAS,KAAK,EAAE,UAAU,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,KAAK,CAAC;gBACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,WAAW,EAAE,UAAU,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,kBAAkB,EAAE,CAAC;YACrC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC;YACxF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CACxG,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,GAAG,KAAK,CAAC;YACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAG,CAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEpC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/B,IAAI,KAAK,EAAE,CAAC;QACV,UAAU,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,2BAA2B,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;IACnE,CAAC;IACD,SAAS,CACP,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,+BAA+B,CAAC,EAAE,CAAC,EAC5F,UAAU,CACX,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,EACL,cAAc,EACd,YAAY,EACZ,WAAW,GAEZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,SAAS,EACT,OAAO,EACP,EAAE,EACF,GAAG,EACH,IAAI,EACJ,MAAM,EACN,SAAS,EACT,UAAU,EACV,GAAG,EACH,IAAI,GACL,MAAM,UAAU,CAAC;AAMlB,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB;IACrD,IAAI,KAAK,GAAG,IAAI,CAAC;IAEjB,SAAS,CACP;QACE,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,oDAAoD;KAC/D,EACD,UAAU,CACX,CAAC;IAEF,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9B,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9B,GAAG,CAAC,iBAAiB,EAAG,CAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uBAAuB;IACvB,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/F,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,CACF,GAAG,CAAC,CAAC,EAAE,uCAAuC,EAC9C,sDAAsD,EACtD,UAAU,CACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC9B,GAAG,CACD,GAAG,CAAC,CAAC,EAAE,kBAAkB,EACzB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EACpD,UAAU,CACX,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/B,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE;aAC7E,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,SAAS,KAAK,EAAE,UAAU,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,KAAK,CAAC;gBACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,WAAW,EAAE,UAAU,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,kBAAkB,EAAE,CAAC;YACrC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC;YACxF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CACxG,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,UAAU,EAAE,CAAC;gBAClC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBACpF,KAAK,GAAG,KAAK,CAAC;gBAChB,CAAC;gBACD,mFAAmF;gBACnF,gFAAgF;gBAChF,MAAM,KAAK,GAAG,MAAO,CAAkB,CAAC,eAAe,EAAE,CAAC;gBAC1D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,KAAK,GAAG,KAAK,CAAC;oBACd,GAAG,CAAC,YAAY,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YACD,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,GAAG,KAAK,CAAC;YACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAG,CAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC9B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEpC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/B,IAAI,KAAK,EAAE,CAAC;QACV,UAAU,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,2BAA2B,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;IACnE,CAAC;IACD,SAAS,CACP,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,+BAA+B,CAAC,EAAE,CAAC,EAC5F,UAAU,CACX,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAUD,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,MAAqB;IAC7D,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,CAAc,EAAE,EAAE;QAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,CAAC,CAAC;IACF,MAAM,MAAM,GAAiB;QAC3B,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE;QACV,aAAa,EAAE,EAAE;KAClB,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,GAAG,+BAA+B,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;QAChG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC;YACpF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,KAAK,0CAA0C,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3F,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;oBACxC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAe;IACxC,MAAM,IAAI,GAAG,CAAC,EAAY,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IACrD,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;QAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;IACzD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;AACjC,CAAC"}

package/dist/commands/init.d.ts

@@ -1,5 +1,21 @@
+import type { TableSchema } from '@mcpolyglot/core';
+import { type Policy, type SqlDialect } from '@mcpolyglot/connector-sql';
+type SqlKind = SqlDialect['kind'];
 export interface InitOptions {
     cwd: string;
+    /** DB URL (or SQLite path). When set, init introspects it and skips the prompts. */
+    url?: string;
+    id?: string;
 }
+export declare function inferKind(url: string): SqlKind;
+/** Every table explicitly `read`, unknown tables hidden, sensitive-looking columns denied. */
+export declare function generatePolicy(tables: TableSchema[]): Pick<Policy, 'tables' | 'defaultAccess' | 'denyColumns'>;
 export declare function initCommand(opts: InitOptions): Promise<void>;
+export declare function renderConfig(opts: {
+    kind: SqlKind;
+    id: string;
+    url: string;
+    policy?: ReturnType<typeof generatePolicy>;
+}): string;
+export {};
 //# sourceMappingURL=init.d.ts.map

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA6FlE"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAIL,KAAK,MAAM,EACX,KAAK,UAAU,EAChB,MAAM,2BAA2B,CAAC;AAGnC,KAAK,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;AAElC,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAOD,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAK9C;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAC5B,MAAM,EAAE,WAAW,EAAE,GACpB,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,eAAe,GAAG,aAAa,CAAC,CAS1D;AAkBD,wBAAsB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAkElE;AAyDD,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;CAC5C,GAAG,MAAM,CA2BT"}

package/dist/commands/init.js

@@ -2,7 +2,45 @@ import { writeFileSync, existsSync } from 'node:fs';
 import { resolve } from 'node:path';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
+import { looksLikeLiteralCredential, resolveSecrets } from '@mcpolyglot/config';
+import { MysqlDialect, PostgresDialect, SqliteDialect, } from '@mcpolyglot/connector-sql';
 import { headerBar, panel, footerBar, step, chip, stdoutSink } from '../ui.js';
+/** Column names that usually hold secrets or PII. A suggestion, not a guarantee. */
+// ponytail: name-only heuristic; misses e.g. `notes` holding secrets. Values are never sampled.
+const SENSITIVE_COLUMN = /pass(word|wd)?|pwd|secret|token|ssn|social_?security|api_?key|hash|salt|private_?key|card_?number|cvv|otp|mfa/i;
+export function inferKind(url) {
+    if (/^postgres(ql)?:\/\//i.test(url))
+        return 'postgres';
+    if (/^mysql:\/\//i.test(url))
+        return 'mysql';
+    if (/^mariadb:\/\//i.test(url))
+        return 'mariadb';
+    return 'sqlite';
+}
+/** Every table explicitly `read`, unknown tables hidden, sensitive-looking columns denied. */
+export function generatePolicy(tables) {
+    const key = (t) => (t.schema ? `${t.schema}.${t.name}` : t.name);
+    return {
+        defaultAccess: 'none',
+        tables: Object.fromEntries(tables.map((t) => [key(t), 'read'])),
+        denyColumns: tables.flatMap((t) => t.columns.filter((c) => SENSITIVE_COLUMN.test(c.name)).map((c) => `${key(t)}.${c.name}`)),
+    };
+}
+async function introspect(kind, url) {
+    const resolved = await resolveSecrets(url);
+    const dialect = kind === 'postgres'
+        ? new PostgresDialect(resolved)
+        : kind === 'sqlite'
+            ? new SqliteDialect(resolved)
+            : new MysqlDialect(resolved);
+    await dialect.connect();
+    try {
+        return await dialect.listTables();
+    }
+    finally {
+        await dialect.close();
+    }
+}
 export async function initCommand(opts) {
     headerBar({
         version: '0.0.1',
@@ -10,6 +48,8 @@ export async function initCommand(opts) {
         subtitle: 'scaffold mcpolyglot.config.ts in this directory',
     }, stdoutSink);
     const target = resolve(opts.cwd, 'mcpolyglot.config.ts');
+    if (opts.url)
+        return initFromUrl(opts, opts.url, target);
     if (existsSync(target)) {
         const proceed = await p.confirm({
             message: `mcpolyglot.config.ts already exists in ${opts.cwd}. Overwrite?`,
@@ -58,6 +98,28 @@ export async function initCommand(opts) {
     }
     const config = renderConfig({ kind: kind, id: id, url });
     writeFileSync(target, config, 'utf8');
+    printNext(target);
+}
+async function initFromUrl(opts, url, target) {
+    if (existsSync(target)) {
+        throw new Error(`${target} already exists; move it aside first.`);
+    }
+    const kind = inferKind(url);
+    step(1, 2, `Introspect ${kind}`, stdoutSink);
+    const tables = await introspect(kind, url);
+    const policy = generatePolicy(tables);
+    stdoutSink(`  ${chip('OK', 'ok')}  ${tables.length} tables, ${policy.denyColumns.length} sensitive-looking columns`);
+    step(2, 2, 'Write config', stdoutSink);
+    // Never write a literal password into the config; point at the env var instead.
+    const safeUrl = kind !== 'sqlite' && looksLikeLiteralCredential(url) ? '${env:DATABASE_URL}' : url;
+    if (safeUrl !== url) {
+        p.note(`Set ${pc.cyan('DATABASE_URL')} to your connection string before serving.`, 'Secret');
+    }
+    const id = opts.id ?? (kind === 'sqlite' ? 'sqlite.local' : `${kind}.main`);
+    writeFileSync(target, renderConfig({ kind, id, url: safeUrl, policy }), 'utf8');
+    printNext(target);
+}
+function printNext(target) {
     stdoutSink('');
     stdoutSink(`  ${chip('OK', 'ok')}  wrote ${pc.bold(target)}`);
     panel({
@@ -78,10 +140,12 @@ export async function initCommand(opts) {
     }, stdoutSink);
     footerBar(['docs: github.com/ishay60/mcpolyglot'], stdoutSink);
 }
-function renderConfig(opts) {
-    return `import { defineConfig } from '@mcpolyglot/config';
+export function renderConfig(opts) {
+    // Type-only import: erased at load time, so the file runs under npx without
+    // @mcpolyglot/config installed next to it. Install it for editor autocomplete.
+    return `import type { McpolyglotConfig } from '@mcpolyglot/config';
 
-export default defineConfig({
+export default {
   server: { name: 'mcpolyglot', version: '0.0.1' },
   transport: { kind: 'stdio' },
   sources: [
@@ -95,13 +159,29 @@ export default defineConfig({
       redact: {
         columns: [],
         patterns: [],
-      },
+      },${opts.policy ? renderPolicy(opts.policy) : ''}
     },
   ],
   audit: { path: '~/.mcpolyglot/audit.log' },
   rateLimit: { defaultPerMinute: 30, maxConcurrent: 5 },
   security: { wrapMode: 'strict' },
-});
+} satisfies McpolyglotConfig;
 `;
 }
+function renderPolicy(policy) {
+    const q = JSON.stringify;
+    const tables = Object.keys(policy.tables).map((t) => `\n          ${q(t)}: 'read',`);
+    const denies = policy.denyColumns.map((c) => `\n          ${q(c)},`);
+    return `
+      policy: {
+        // Tables not listed below are hidden. Add new tables here explicitly.
+        defaultAccess: 'none',
+        // Every table is read-only. Set a table to 'write' only if an agent must modify it.
+        tables: {${tables.join('')}
+        },
+        // Suggested from column names (password, token, ssn, hash, ...). Review: keep, add, remove.
+        denyColumns: [${denies.join('')}
+        ],
+      },`;
+}
 //# sourceMappingURL=init.js.map

package/dist/commands/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAM/E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAiB;IACjD,SAAS,CACP;QACE,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,iDAAiD;KAC5D,EACD,UAAU,CACX,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC;YAC9B,OAAO,EAAE,0CAA0C,IAAI,CAAC,GAAG,cAAc;YACzE,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,mCAAmC;QAC5C,OAAO,EAAE;YACP,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE;YAC/D,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,0BAA0B,EAAE;SACvE;KACF,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,iCAAiC;QAC1C,YAAY,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc;QAC9D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+CAA+C;KAC/F,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO;IAE3B,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IACrC,IAAI,GAAW,CAAC;IAChB,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,GAAG,GAAG,qBAAqB,CAAC;QAC5B,CAAC,CAAC,IAAI,CACJ,OAAO,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,uCAAuC,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EACnG,SAAS,CACV,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;YACxB,OAAO,EAAE,sBAAsB;YAC/B,WAAW,EAAE,WAAW;YACxB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;SAC/D,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO;QAC7B,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,IAA6B,EAAE,EAAE,EAAE,EAAY,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAEtC,UAAU,CAAC,EAAE,CAAC,CAAC;IACf,UAAU,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE9D,KAAK,CACH;QACE,KAAK,EAAE,MAAM;QACb,KAAK,EAAE;YACL,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE;YAClF,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE;YAC7E,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE;SAC7E;KACF,EACD,UAAU,CACX,CAAC;IAEF,KAAK,CACH;QACE,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE;YACL,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,iEAAiE,CAAC,EAAE;YAC5G,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE;YAC9D,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,2DAA2D,CAAC,EAAE;SACtG;KACF,EACD,UAAU,CACX,CAAC;IAEF,SAAS,CAAC,CAAC,qCAAqC,CAAC,EAAE,UAAU,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,YAAY,CAAC,IAA8D;IAClF,OAAO;;;;;;;aAOI,IAAI,CAAC,EAAE;eACL,IAAI,CAAC,IAAI;cACV,IAAI,CAAC,GAAG;;;;;;;;;;;;;;CAcrB,CAAC;AACF,CAAC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EACL,YAAY,EACZ,eAAe,EACf,aAAa,GAGd,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAW/E,oFAAoF;AACpF,gGAAgG;AAChG,MAAM,gBAAgB,GACpB,gHAAgH,CAAC;AAEnH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACxD,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAC5B,MAAqB;IAErB,MAAM,GAAG,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9E,OAAO;QACL,aAAa,EAAE,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAe,CAAC,CAAC,CAAC;QACxE,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAChC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CACzF;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAa,EAAE,GAAW;IAClD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GACX,IAAI,KAAK,UAAU;QACjB,CAAC,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC;QAC/B,CAAC,CAAC,IAAI,KAAK,QAAQ;YACjB,CAAC,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC;YAC7B,CAAC,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAiB;IACjD,SAAS,CACP;QACE,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,iDAAiD;KAC5D,EACD,UAAU,CACX,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC;YAC9B,OAAO,EAAE,0CAA0C,IAAI,CAAC,GAAG,cAAc;YACzE,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,mCAAmC;QAC5C,OAAO,EAAE;YACP,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE;YAC/D,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,0BAA0B,EAAE;SACvE;KACF,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,iCAAiC;QAC1C,YAAY,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc;QAC9D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+CAA+C;KAC/F,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO;IAE3B,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IACrC,IAAI,GAAW,CAAC;IAChB,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,GAAG,GAAG,qBAAqB,CAAC;QAC5B,CAAC,CAAC,IAAI,CACJ,OAAO,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,uCAAuC,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EACnG,SAAS,CACV,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;YACxB,OAAO,EAAE,sBAAsB;YAC/B,WAAW,EAAE,WAAW;YACxB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;SAC/D,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO;QAC7B,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,IAA6B,EAAE,EAAE,EAAE,EAAY,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,SAAS,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAiB,EAAE,GAAW,EAAE,MAAc;IACvE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,uCAAuC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,UAAU,CACR,KAAK,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,WAAW,CAAC,MAAM,4BAA4B,CACzG,CAAC;IAEF,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IACvC,gFAAgF;IAChF,MAAM,OAAO,GACX,IAAI,KAAK,QAAQ,IAAI,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC;IACrF,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,4CAA4C,EAAE,QAAQ,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IAC5E,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAChF,SAAS,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,UAAU,CAAC,EAAE,CAAC,CAAC;IACf,UAAU,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE9D,KAAK,CACH;QACE,KAAK,EAAE,MAAM;QACb,KAAK,EAAE;YACL,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE;YAClF,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE;YAC7E,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE;SAC7E;KACF,EACD,UAAU,CACX,CAAC;IAEF,KAAK,CACH;QACE,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE;YACL,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,iEAAiE,CAAC,EAAE;YAC5G,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE;YAC9D,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,2DAA2D,CAAC,EAAE;SACtG;KACF,EACD,UAAU,CACX,CAAC;IAEF,SAAS,CAAC,CAAC,qCAAqC,CAAC,EAAE,UAAU,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAK5B;IACC,4EAA4E;IAC5E,+EAA+E;IAC/E,OAAO;;;;;;;aAOI,IAAI,CAAC,EAAE;eACL,IAAI,CAAC,IAAI;cACV,IAAI,CAAC,GAAG;;;;;;;UAOZ,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;;;;;;;CAOrD,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,MAAyC;IAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;IACzB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrE,OAAO;;;;;mBAKU,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;;;wBAGV,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;;SAE9B,CAAC;AACV,CAAC"}

package/dist/commands/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgFpE"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAuGpE"}

package/dist/commands/serve.js

@@ -2,7 +2,8 @@ import { register } from 'node:module';
 import { pathToFileURL } from 'node:url';
 import { extname, basename } from 'node:path';
 import pc from 'picocolors';
-import { loadConfig } from '@mcpolyglot/config';
+import { loadConfig, resolveSecrets } from '@mcpolyglot/config';
+import { ConfigError } from '@mcpolyglot/core';
 import { StdioTransport } from '@mcpolyglot/core/transports/stdio';
 import { StreamableHttpTransport } from '@mcpolyglot/core/transports/streamable-http';
 import { buildServerFromConfig } from '../factory.js';
@@ -37,39 +38,60 @@ export async function serveCommand(opts) {
     const httpAuth = cfg.transport.kind === 'http' ? cfg.transport.auth : { type: 'bearer' };
     let transport;
     if (wantHttp) {
+        if (cfg.agents && httpAuth.type === 'oauth') {
+            throw new ConfigError('`agents` uses per-agent bearer tokens; it cannot be combined with OAuth.');
+        }
         const httpTransport = new StreamableHttpTransport({
             host: httpHost,
             port: httpPort,
-            auth: httpAuth.type === 'oauth'
-                ? {
-                    kind: 'oauth',
-                    issuer: httpAuth.issuer,
-                    audience: httpAuth.audience,
-                    ...(httpAuth.jwksUri ? { jwksUri: httpAuth.jwksUri } : {}),
-                }
-                : { kind: 'bearer', ...(httpAuth.token ? { token: httpAuth.token } : {}) },
+            auth: cfg.agents
+                ? { kind: 'agents', agents: cfg.agents }
+                : httpAuth.type === 'oauth'
+                    ? {
+                        kind: 'oauth',
+                        issuer: httpAuth.issuer,
+                        audience: httpAuth.audience,
+                        ...(httpAuth.jwksUri ? { jwksUri: httpAuth.jwksUri } : {}),
+                    }
+                    : {
+                        kind: 'bearer',
+                        ...(httpAuth.token ? { token: await resolveSecrets(httpAuth.token) } : {}),
+                    },
         });
         transport = httpTransport;
         kv('Mode', pc.cyan('streamable-http'));
         kv('URL', link(`http://${httpHost}:${httpPort}/mcp`));
         kv('Health', link(`http://${httpHost}:${httpPort}/healthz`));
-        if (httpTransport.authKind === 'oauth' && httpAuth.type === 'oauth') {
+        if (cfg.agents) {
+            kv('Auth', pc.cyan(`agents · ${cfg.agents.map((a) => a.id).join(', ')}`));
+        }
+        else if (httpTransport.authKind === 'oauth' && httpAuth.type === 'oauth') {
             kv('Auth', pc.cyan(`oauth · ${httpAuth.issuer}`));
             kv('Audience', pc.dim(httpAuth.audience));
         }
         else if (httpTransport.bearerToken) {
-            kv('Token', pc.yellow(httpTransport.bearerToken));
+            // Only echo a generated token; a configured one would leak into container logs.
+            kv('Token', 'token' in httpAuth && httpAuth.token
+                ? pc.dim('from config')
+                : pc.yellow(httpTransport.bearerToken));
         }
         kv('Config', pc.dim(basename(opts.config)));
     }
     else {
         transport = new StdioTransport();
         kv('Mode', pc.cyan('stdio'));
+        if (cfg.agents)
+            kv('Agents', pc.yellow('ignored under stdio (single local user)'));
         kv('Config', pc.dim(basename(opts.config)));
     }
     await server.start(transport);
     ready(Date.now() - startedAt);
-    footerBar(['Ctrl+C to stop', 'audit: ~/.mcpolyglot/audit.log']);
+    const auditSinks = [
+        cfg.audit.console && (cfg.transport.kind === 'stdio' ? 'stderr' : 'stdout'),
+        cfg.audit.path,
+        cfg.audit.webhookUrl && 'webhook',
+    ].filter(Boolean);
+    footerBar(['Ctrl+C to stop', `audit: ${auditSinks.join(', ') || 'off'}`]);
     const shutdown = async () => {
         process.stderr.write(pc.dim('\n  shutting down…\n'));
         await server.stop().catch(() => { });

package/dist/commands/serve.js.map

@@ -1 +1 @@
-{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAyB,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAY/E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAkB;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACtE,IAAI,CAAC;YACH,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IAED,SAAS,CAAC;QACR,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,6CAA6C;KACxD,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAEhE,OAAO,CAAC,SAAS,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAI,CAC7G,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,WAAW,CAAC,CAAC;IACrB,oEAAoE;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC;IAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9F,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9F,MAAM,QAAQ,GACZ,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAE1E,IAAI,SAAmD,CAAC;IACxD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,aAAa,GAAG,IAAI,uBAAuB,CAAC;YAChD,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,QAAQ;YACd,IAAI,EACF,QAAQ,CAAC,IAAI,KAAK,OAAO;gBACvB,CAAC,CAAC;oBACE,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D;gBACH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SAC/E,CAAC,CAAC;QACH,SAAS,GAAG,aAAa,CAAC;QAC1B,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,QAAQ,IAAI,QAAQ,MAAM,CAAC,CAAC,CAAC;QACtD,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,QAAQ,IAAI,QAAQ,UAAU,CAAC,CAAC,CAAC;QAC7D,IAAI,aAAa,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACpE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAClD,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;YACrC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7B,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE9B,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;IAC9B,SAAS,CAAC,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAEhE,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACrD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAyB,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAY/E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAkB;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACtE,IAAI,CAAC;YACH,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IAED,SAAS,CAAC;QACR,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,6CAA6C;KACxD,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAEhE,OAAO,CAAC,SAAS,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAI,CAC7G,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,WAAW,CAAC,CAAC;IACrB,oEAAoE;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC;IAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9F,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9F,MAAM,QAAQ,GACZ,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAE1E,IAAI,SAAmD,CAAC;IACxD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5C,MAAM,IAAI,WAAW,CACnB,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,uBAAuB,CAAC;YAChD,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,GAAG,CAAC,MAAM;gBACd,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;gBACxC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;oBACzB,CAAC,CAAC;wBACE,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;wBAC3B,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC3D;oBACH,CAAC,CAAC;wBACE,IAAI,EAAE,QAAQ;wBACd,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC3E;SACR,CAAC,CAAC;QACH,SAAS,GAAG,aAAa,CAAC;QAC1B,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,QAAQ,IAAI,QAAQ,MAAM,CAAC,CAAC,CAAC;QACtD,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,QAAQ,IAAI,QAAQ,UAAU,CAAC,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC;aAAM,IAAI,aAAa,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3E,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAClD,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;YACrC,gFAAgF;YAChF,EAAE,CACA,OAAO,EACP,OAAO,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK;gBACnC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;gBACvB,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CACzC,CAAC;QACJ,CAAC;QACD,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM;YAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC,CAAC;QACnF,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE9B,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG;QACjB,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,IAAI;QACd,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,SAAS;KAClC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,SAAS,CAAC,CAAC,gBAAgB,EAAE,UAAU,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;IAE1E,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACrD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC"}

package/dist/commands/token.d.ts

@@ -0,0 +1,5 @@
+/** Mint a token. The only place mcpolyglot ever prints one; config stores just the hash. */
+export declare function tokenCreateCommand(agentId: string): void;
+/** Hash a token read from stdin (trailing newline ignored). */
+export declare function tokenHashCommand(): Promise<void>;
+//# sourceMappingURL=token.d.ts.map

package/dist/commands/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/commands/token.ts"],"names":[],"mappings":"AAIA,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAYxD;AAED,+DAA+D;AAC/D,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAItD"}

package/dist/commands/token.js

@@ -0,0 +1,23 @@
+import { randomBytes } from 'node:crypto';
+import { text } from 'node:stream/consumers';
+import { hashToken } from '@mcpolyglot/core/transports/streamable-http';
+/** Mint a token. The only place mcpolyglot ever prints one; config stores just the hash. */
+export function tokenCreateCommand(agentId) {
+    const token = `mcpg_${randomBytes(32).toString('base64url')}`;
+    const hash = hashToken(token);
+    const label = new Date().toISOString().slice(0, 10);
+    process.stdout.write(`token (shown once, give it to the agent): ${token}\n` +
+        `sha256: ${hash}\n\n` +
+        `add to the agent in your config:\n` +
+        `  agents: [{ id: '${agentId}', tokens: [{ hash: '${hash}', label: '${label}' }], sources: { … } }]\n` +
+        `rotate: add this hash next to the old one, move clients over, then set the old one's revoked: true.\n` +
+        `restart \`mcpolyglot serve\` to apply.\n`);
+}
+/** Hash a token read from stdin (trailing newline ignored). */
+export async function tokenHashCommand() {
+    const token = (await text(process.stdin)).replace(/\r?\n$/, '');
+    if (!token)
+        throw new Error('no token on stdin');
+    process.stdout.write(hashToken(token) + '\n');
+}
+//# sourceMappingURL=token.js.map

package/dist/commands/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/commands/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,6CAA6C,CAAC;AAExE,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,KAAK,GAAG,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6CAA6C,KAAK,IAAI;QACpD,WAAW,IAAI,MAAM;QACrB,oCAAoC;QACpC,qBAAqB,OAAO,wBAAwB,IAAI,cAAc,KAAK,2BAA2B;QACtG,uGAAuG;QACvG,0CAA0C,CAC7C,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;AAChD,CAAC"}

package/dist/factory.d.ts

@@ -1,9 +1,11 @@
-import { McpolyglotServer, type Connector, type SecurityHooks } from '@mcpolyglot/core';
-import { type McpolyglotConfig } from '@mcpolyglot/config';
+import { McpolyglotServer, type AgentGrant, type Connector, type Scope, type SecurityHooks } from '@mcpolyglot/core';
+import { type McpolyglotConfig, type SourceConfig, type AgentConfig } from '@mcpolyglot/config';
 export interface BuiltServer {
     server: McpolyglotServer;
     hooks: SecurityHooks;
     connectors: Connector[];
+    /** Present when `cfg.agents` is set. */
+    agents?: AgentGrant[];
     perEntity: Record<string, {
         enabled: boolean;
         include?: string[];
@@ -16,4 +18,6 @@ export declare function buildServerFromConfig(cfg: McpolyglotConfig, logger?: {
     warn: (msg: string, fields?: Record<string, unknown>) => void;
     error: (msg: string, fields?: Record<string, unknown>) => void;
 }): Promise<BuiltServer>;
+/** An agent never gets a scope its sources don't grant. */
+export declare function agentScopes(agent: AgentConfig, sources: SourceConfig[]): Scope[];
 //# sourceMappingURL=factory.d.ts.map

package/dist/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,aAAa,EAEnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,gBAAgB,EAItB,MAAM,oBAAoB,CAAC;AAU5B,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,aAAa,CAAC;IACrB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACzF;AAED,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,gBAAgB,EACrB,MAAM;iBA8H6B,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAAxC,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAAxC,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;iBAAxC,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CA9HhD,GAC1B,OAAO,CAAC,WAAW,CAAC,CAqDtB"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,KAAK,EACV,KAAK,aAAa,EAEnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAEjB,KAAK,WAAW,EAEjB,MAAM,oBAAoB,CAAC;AAa5B,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,aAAa,CAAC;IACrB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,wCAAwC;IACxC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACzF;AAED,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,gBAAgB,EACrB,MAAM;iBAoN6B,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAAxC,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAAxC,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;iBAAxC,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CApNhD,GAC1B,OAAO,CAAC,WAAW,CAAC,CA+DtB;AAyGD,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,KAAK,EAAE,CAGhF"}