@n24q02m/hull 0.0.0-stage → 0.4.0-beta.9

package/build/auth/stable-sub.js

@@ -0,0 +1,38 @@
+/**
+ * Derive a stable, opaque subject id from a workspace username.
+ *
+ * TypeScript port of core-py's ``stable_sub.py``. Output is byte-identical for
+ * ASCII usernames, locked by the shared ``crypto-vectors.json`` fixture.
+ */
+import { createHmac } from 'node:crypto';
+// Used only when CREDENTIAL_SECRET is unset (single-user/dev): the sub stays
+// stable, just predictable. Production multi-user always sets CREDENTIAL_SECRET.
+const DEV_FALLBACK_KEY = Buffer.from('mcp-core-stable-sub-dev-salt', 'utf-8');
+/**
+ * Derive a stable, opaque subject id from a workspace username.
+ *
+ * Same ``(serverName, normalized username)`` -> same ``sub``, so a returning
+ * user lands on the same per-``sub`` credential bucket instead of the random
+ * subject minted per ``/authorize``. The output shape (22 chars, urlsafe
+ * base64, no padding) matches ``randomBytes(16).toString('base64url')`` so
+ * downstream code cannot tell a stable sub from a random one.
+ *
+ * Normalization is ``trim().toLowerCase()``. Python's ``str.casefold()`` maps
+ * a few non-ASCII characters differently (``'ß'.casefold() == 'ss'``), so
+ * cross-language parity is guaranteed for ASCII usernames only; the divergence
+ * is asserted by a test in both languages.
+ *
+ * SECURITY: with a SHARED relay password the username is a PARTITION key, NOT a
+ * secret -- anyone who knows the password can submit any username and reach that
+ * bucket. Intentional for a trusted group; untrusted multi-tenant needs per-user
+ * secrets or delegated OAuth.
+ */
+export function deriveStableSub(username, serverName, credentialSecret) {
+    const normalized = username.trim().toLowerCase();
+    if (!normalized)
+        throw new Error('username must be non-empty');
+    const key = credentialSecret ? Buffer.from(credentialSecret, 'utf-8') : DEV_FALLBACK_KEY;
+    const digest = createHmac('sha256', key).update(`sub:${serverName}:${normalized}`, 'utf8').digest();
+    return digest.subarray(0, 16).toString('base64url');
+}
+//# sourceMappingURL=stable-sub.js.map

package/build/auth/stable-sub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stable-sub.js","sourceRoot":"","sources":["../../src/auth/stable-sub.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,6EAA6E;AAC7E,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,UAAkB,EAClB,gBAA2C;IAE3C,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAChD,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC9D,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAA;IACxF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,UAAU,IAAI,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAA;IACnG,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACrD,CAAC"}

package/build/auth/well-known.d.ts

@@ -0,0 +1,4 @@
+/** OAuth 2.1 well-known metadata generators (RFC 8414 + RFC 9728). */
+export declare function authorizationServerMetadata(issuerUrl: string): Record<string, unknown>;
+export declare function protectedResourceMetadata(resource: string, authorizationServers: string[]): Record<string, unknown>;
+//# sourceMappingURL=well-known.d.ts.map

package/build/auth/well-known.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.d.ts","sourceRoot":"","sources":["../../src/auth/well-known.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBtF;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMnH"}

package/build/auth/well-known.js

@@ -0,0 +1,26 @@
+/** OAuth 2.1 well-known metadata generators (RFC 8414 + RFC 9728). */
+export function authorizationServerMetadata(issuerUrl) {
+    return {
+        issuer: issuerUrl,
+        authorization_endpoint: `${issuerUrl}/authorize`,
+        token_endpoint: `${issuerUrl}/token`,
+        registration_endpoint: `${issuerUrl}/register`,
+        jwks_uri: `${issuerUrl}/.well-known/jwks.json`,
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code', 'refresh_token'],
+        code_challenge_methods_supported: ['S256'],
+        token_endpoint_auth_methods_supported: ['none'],
+        scopes_supported: ['offline_access'],
+        // RFC 9207 / SEP-2468: the AS returns the ``iss`` parameter in every
+        // authorization response so clients can defend against mix-up attacks.
+        authorization_response_iss_parameter_supported: true
+    };
+}
+export function protectedResourceMetadata(resource, authorizationServers) {
+    return {
+        resource,
+        authorization_servers: authorizationServers,
+        bearer_methods_supported: ['header']
+    };
+}
+//# sourceMappingURL=well-known.js.map

package/build/auth/well-known.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.js","sourceRoot":"","sources":["../../src/auth/well-known.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,sBAAsB,EAAE,GAAG,SAAS,YAAY;QAChD,cAAc,EAAE,GAAG,SAAS,QAAQ;QACpC,qBAAqB,EAAE,GAAG,SAAS,WAAW;QAC9C,QAAQ,EAAE,GAAG,SAAS,wBAAwB;QAC9C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,CAAC,gBAAgB,CAAC;QACpC,qEAAqE;QACrE,uEAAuE;QACvE,8CAA8C,EAAE,IAAI;KACrD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,oBAA8B;IACxF,OAAO;QACL,QAAQ;QACR,qBAAqB,EAAE,oBAAoB;QAC3C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAA;AACH,CAAC"}

package/build/cli/build-cli.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Console-script CLI builder shared by every TypeScript MCP server.
+ *
+ * TS counterpart of `mcp_core.build_cli` (core-py). `buildCli` wraps a
+ * server's existing `serve(argv) -> number | void` entry point with
+ * subcommand dispatch, without changing that entry point's behaviour for the
+ * two invocation shapes it already handles:
+ *
+ * - Bare invocation (`argv` empty) still means "start the server".
+ * - Any flag-prefixed argv (`--http` etc.) is passed through to `serve`
+ *   byte-for-byte, so existing `--http` semantics are untouched -- except
+ *   `-h`/`--help` (always) and `--version`/`-V` (only when `version` is set),
+ *   which are intercepted here and never reach `serve`. Starting the server on
+ *   those would hang in stdio mode instead of printing the requested output.
+ *
+ * A leading *positional* argv[0] is treated as a subcommand name -- either one
+ * of the reserved built-ins (`config`/`doctor`/`logout`/`relay`/`status`/`token`)
+ * or a server-specific one supplied via `extra` -- and is routed to its handler
+ * instead of `serve`. `status` and `logout` are top-level aliases of
+ * `config status` and `config delete` (same output and exit codes).
+ *
+ * `auth` is deliberately NOT a built-in: signing in is domain-specific (OAuth
+ * device code, bot token, API key paste, relay form, ...), so each server that
+ * needs it supplies its own `auth` handler via `extra`.
+ * STDOUT is the MCP protocol channel in stdio mode, so only this subcommand
+ * path prints to stdout; the `serve` path never touches stdout here.
+ *
+ * Built-in output convention: informational results (configured/not
+ * configured, session details, doctor's `[ok]`/`[warn]`/`[fail]` lines) go to
+ * stdout (`console.log`); failures and prompts (no active session, refused
+ * delete, corrupt config) go to stderr (`console.error`) alongside a non-zero
+ * return code. Credential *values* are never printed by any built-in -- only
+ * names/keys/status.
+ */
+/** A server's start entry point. Returns an exit code, or nothing for 0. */
+export type ServeFn = (argv: string[]) => number | void | Promise<number | void>;
+/**
+ * A subcommand handler. Receives the argv that follows the subcommand name
+ * (e.g. for `config status --yes` the handler gets `['status', '--yes']`) and
+ * returns the process exit code.
+ */
+export type CliHandler = (argv: string[]) => number | Promise<number>;
+export interface BuildCliOptions {
+    /** The server's start entry point (bare/flag argv routes here). */
+    serve: ServeFn;
+    /**
+     * Server-specific subcommands. A name here overrides the reserved built-in
+     * of the same name (`config`/`doctor`/`logout`/`relay`/`status`/`token`), so a
+     * server can supply its own handler. This is also where a server provides
+     * `auth`, which is not a built-in because sign-in is domain-specific.
+     */
+    extra?: Record<string, CliHandler>;
+    /** Powers `--version`/`-V`. When unset, those flags fall through to serve. */
+    version?: string;
+    /**
+     * Credential storage plugin slug (e.g. `"wet"`): decides where `config` and
+     * `doctor` read/write via `PerPluginStore`. Servers save credentials under
+     * this slug, not the console name, so the two must not be conflated. When
+     * omitted it defaults to `serverName` with a trailing `"-mcp"` stripped,
+     * which matches the wet/mnemo/crg convention; pass it explicitly when the
+     * slug differs (telegram saves under `"telegram"` though its console name
+     * is `"better-telegram-mcp"`).
+     */
+    pluginName?: string;
+}
+/**
+ * Build the console-script entry point for one MCP server.
+ *
+ * `serverName` is the console/display name (e.g. `"wet-mcp"`): it names the
+ * program in help/usage and status lines, and keys relay session state and
+ * run mode (which servers store under their `SERVER_NAME`).
+ *
+ * `options.pluginName` is the credential storage slug that `PerPluginStore`
+ * keys on (e.g. `"wet"`): it decides where `config` and `doctor` read/write
+ * credentials. Servers save creds under this slug, not under the console
+ * name, so the two must not be conflated. When omitted it defaults to
+ * `serverName` with a trailing `"-mcp"` stripped, which matches the wet/
+ * mnemo/crg convention; pass it explicitly when the slug differs (telegram
+ * saves under `"telegram"` though its console name is `"better-telegram-mcp"`).
+ *
+ * Reserved built-ins: `config` (`status`/`delete`), `status` (= `config
+ * status`), `logout` (= `config delete`; non-interactive use needs `--yes`,
+ * otherwise exit 1), `relay`, `doctor` and `token`. `auth` is not a built-in:
+ * sign-in is domain-specific, so a server that needs it passes an `auth`
+ * handler in `extra`.
+ *
+ * `extra` subcommand names take precedence over the reserved built-ins, so a
+ * server (or a test) can supply its own handler for any of them.
+ * `version`, when set, powers `--version`/`-V` (handled before `serve` or any
+ * subcommand runs); when unset, `--version`/`-V` falls through to `serve` like
+ * any other flag.
+ *
+ * The returned `run(argv)` resolves to the process exit code. A server's entry
+ * point calls it and exits: `buildCli(name, opts)(process.argv.slice(2)).then((c) => process.exit(c))`.
+ */
+export declare function buildCli(serverName: string, options: BuildCliOptions): (argv?: string[] | null) => Promise<number>;
+//# sourceMappingURL=build-cli.d.ts.map

package/build/cli/build-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-cli.d.ts","sourceRoot":"","sources":["../../src/cli/build-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAmBH,4EAA4E;AAC5E,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;AAEhF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;AAErE,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,KAAK,EAAE,OAAO,CAAA;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAClC,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AA6LD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAiDlH"}

package/build/cli/build-cli.js

@@ -0,0 +1,309 @@
+/**
+ * Console-script CLI builder shared by every TypeScript MCP server.
+ *
+ * TS counterpart of `mcp_core.build_cli` (core-py). `buildCli` wraps a
+ * server's existing `serve(argv) -> number | void` entry point with
+ * subcommand dispatch, without changing that entry point's behaviour for the
+ * two invocation shapes it already handles:
+ *
+ * - Bare invocation (`argv` empty) still means "start the server".
+ * - Any flag-prefixed argv (`--http` etc.) is passed through to `serve`
+ *   byte-for-byte, so existing `--http` semantics are untouched -- except
+ *   `-h`/`--help` (always) and `--version`/`-V` (only when `version` is set),
+ *   which are intercepted here and never reach `serve`. Starting the server on
+ *   those would hang in stdio mode instead of printing the requested output.
+ *
+ * A leading *positional* argv[0] is treated as a subcommand name -- either one
+ * of the reserved built-ins (`config`/`doctor`/`logout`/`relay`/`status`/`token`)
+ * or a server-specific one supplied via `extra` -- and is routed to its handler
+ * instead of `serve`. `status` and `logout` are top-level aliases of
+ * `config status` and `config delete` (same output and exit codes).
+ *
+ * `auth` is deliberately NOT a built-in: signing in is domain-specific (OAuth
+ * device code, bot token, API key paste, relay form, ...), so each server that
+ * needs it supplies its own `auth` handler via `extra`.
+ * STDOUT is the MCP protocol channel in stdio mode, so only this subcommand
+ * path prints to stdout; the `serve` path never touches stdout here.
+ *
+ * Built-in output convention: informational results (configured/not
+ * configured, session details, doctor's `[ok]`/`[warn]`/`[fail]` lines) go to
+ * stdout (`console.log`); failures and prompts (no active session, refused
+ * delete, corrupt config) go to stderr (`console.error`) alongside a non-zero
+ * return code. Credential *values* are never printed by any built-in -- only
+ * names/keys/status.
+ */
+import { accessSync, constants, existsSync } from 'node:fs';
+import { createInterface } from 'node:readline';
+import { tryOpenBrowser } from '../relay/browser.js';
+import { backendFromEnv } from '../storage/backends.js';
+import { pluginNameForServer } from '../storage/credential-store.js';
+import { dataDir, legacyDataDirs } from '../storage/data-dir.js';
+import { clearMode, getMode } from '../storage/mode.js';
+import { PerPluginStore } from '../storage/per-plugin-store.js';
+import { acquireSessionLock, releaseSessionLock } from '../storage/session-lock.js';
+import { tokenCliHandler } from '../token-auth/cli.js';
+// Minimum Node major the stack supports (mcp-core package.json `engines`
+// pins `>=24.18.0`). Doctor's runtime check is the TS analogue of core-py's
+// exact `python == 3.13` line; TS uses a floor because the package supports
+// Node 24+ (its @types/node targets 26).
+const MIN_NODE_MAJOR = 24;
+function printCliHelp(serverName, handlers) {
+    const names = Object.keys(handlers).sort().join(', ');
+    console.log(`usage: ${serverName} [-h] [--version] [<subcommand> ...]`);
+    console.log('Any other flags/args are passed through to the MCP server (e.g. --http).');
+    console.log(`subcommands: ${names}`);
+}
+async function configStatus(serverName, pluginName) {
+    // Credentials are keyed by the plugin slug (what the server saves under),
+    // while `serverName` stays the display label in the printed status.
+    const store = new PerPluginStore(pluginName);
+    if ((await store.load()) !== null) {
+        console.log(`${serverName}: configured (source: file)`);
+        console.log('  (env overrides, if any, take precedence at server start)');
+        return 0;
+    }
+    // load() returns null for both "absent" and "corrupt"; the raw backend read
+    // tells them apart without ever touching the plaintext.
+    if (await store.hasStoredBlob()) {
+        console.error(`${serverName}: config is corrupt (undecryptable) -- re-run setup to restore`);
+        return 1;
+    }
+    console.log(`${serverName}: not configured`);
+    console.log('  (env overrides, if any, take precedence at server start)');
+    return 0;
+}
+async function confirmDelete(serverName) {
+    process.stderr.write(`Delete stored config for ${serverName}? [y/N] `);
+    const rl = createInterface({ input: process.stdin });
+    try {
+        const line = await new Promise((resolve) => {
+            rl.once('line', resolve);
+        });
+        return ['y', 'yes'].includes(line.trim().toLowerCase());
+    }
+    finally {
+        rl.close();
+    }
+}
+async function configDelete(serverName, pluginName, yes) {
+    if (!yes) {
+        if (!process.stdin.isTTY) {
+            console.error(`${serverName}: refusing to delete without --yes in non-interactive mode`);
+            return 1;
+        }
+        if (!(await confirmDelete(serverName))) {
+            console.error(`${serverName}: aborted`);
+            return 1;
+        }
+    }
+    await new PerPluginStore(pluginName).clear();
+    console.log(`${serverName}: config deleted`);
+    return 0;
+}
+function configHandler(serverName, pluginName) {
+    return async (argv) => {
+        const action = argv[0];
+        if (action === 'status')
+            return configStatus(serverName, pluginName);
+        if (action === 'delete')
+            return configDelete(serverName, pluginName, argv.includes('--yes'));
+        console.error(`${serverName}: config expects 'status' or 'delete'`);
+        return 2;
+    };
+}
+function relayStatus(serverName, info) {
+    if (info === null) {
+        console.error(`${serverName}: no active relay session`);
+        return 1;
+    }
+    const ageS = (Date.now() - info.createdAt) / 1000;
+    console.log(`${serverName}: session ${info.sessionId.slice(0, 8)} relay_url=${info.relayUrl} age=${ageS.toFixed(0)}s`);
+    return 0;
+}
+function relayHandler(serverName) {
+    return async (argv) => {
+        const action = argv[0];
+        if (action === 'reset') {
+            await releaseSessionLock(serverName);
+            await clearMode(serverName);
+            console.log(`${serverName}: relay state cleared`);
+            return 0;
+        }
+        if (action !== 'status' && action !== 'open') {
+            console.error(`${serverName}: relay expects 'status', 'open', or 'reset'`);
+            return 2;
+        }
+        const info = await acquireSessionLock(serverName);
+        if (action === 'status')
+            return relayStatus(serverName, info);
+        // "open"
+        if (info === null) {
+            console.error(`${serverName}: no active relay session`);
+            return 1;
+        }
+        // Branch on the return value: `tryOpenBrowser` declines under headless / CI
+        // / the env-guard, and printing "opened" there is untrue in the very first
+        // line the user reads -- they wait for a tab that never appears. Failing to
+        // open is not a failure of the command (the URL is still correct and still
+        // usable), so the exit code stays 0.
+        if (await tryOpenBrowser(info.relayUrl)) {
+            console.log(`${serverName}: opened ${info.relayUrl}`);
+        }
+        else {
+            console.log(`${serverName}: could not launch a browser here; visit ${info.relayUrl}`);
+        }
+        return 0;
+    };
+}
+async function runDoctor(serverName, pluginName) {
+    let ok = true;
+    const nodeVersion = process.versions.node;
+    if (Number(nodeVersion.split('.')[0]) >= MIN_NODE_MAJOR) {
+        console.log(`[ok] node ${nodeVersion}`);
+    }
+    else {
+        console.log(`[fail] node ${nodeVersion} (expected >=${MIN_NODE_MAJOR})`);
+        ok = false;
+    }
+    let backendOk = true;
+    try {
+        backendFromEnv();
+        console.log('[ok] credential backend initializes');
+    }
+    catch (err) {
+        console.log(`[fail] credential backend: ${err.message}`);
+        backendOk = false;
+        ok = false;
+    }
+    // Only check writability if the dir already exists -- doctor must not create
+    // it as a side effect (mkdir-probing would leave stray dirs for servers that
+    // were never configured). The dir is keyed by the plugin slug (matching
+    // PerPluginStore's on-disk layout `~/.<plugin>/`), not the console name.
+    const storeDir = dataDir(pluginName);
+    if (existsSync(storeDir)) {
+        try {
+            accessSync(storeDir, constants.W_OK);
+            console.log(`[ok] store dir writable: ${storeDir}`);
+        }
+        catch {
+            console.log(`[fail] store dir not writable: ${storeDir}`);
+            ok = false;
+        }
+    }
+    else {
+        // Credentials from an older layout are still read, but only the next save
+        // moves them into the current dir -- surface that instead of "not yet".
+        const legacy = legacyDataDirs(pluginName).find((loc) => existsSync(loc.dir));
+        if (legacy !== undefined) {
+            console.log(`[warn] only legacy store dir found: ${legacy.dir} (credentials move to ${storeDir} on next save)`);
+        }
+        else {
+            console.log(`[warn] store dir does not exist yet: ${storeDir}`);
+        }
+    }
+    // PerPluginStore builds its backend from the same env, so it would throw the
+    // error already reported above and abort the remaining checks.
+    if (!backendOk) {
+        console.log('[warn] config: not checked (credential backend unavailable)');
+    }
+    else {
+        const store = new PerPluginStore(pluginName);
+        if ((await store.load()) !== null) {
+            console.log('[ok] config: configured');
+        }
+        else if (await store.hasStoredBlob()) {
+            console.log('[fail] config: corrupt');
+            ok = false;
+        }
+        else {
+            console.log('[warn] config: not configured');
+        }
+    }
+    const info = await acquireSessionLock(serverName);
+    if (info !== null) {
+        console.log(`[ok] relay session active (${info.sessionId.slice(0, 8)})`);
+    }
+    else {
+        console.log('[warn] no active relay session');
+    }
+    console.log(`[ok] mode: ${(await getMode(serverName)) ?? 'unset'}`);
+    return ok ? 0 : 1;
+}
+function doctorHandler(serverName, pluginName) {
+    return () => runDoctor(serverName, pluginName);
+}
+/**
+ * Build the console-script entry point for one MCP server.
+ *
+ * `serverName` is the console/display name (e.g. `"wet-mcp"`): it names the
+ * program in help/usage and status lines, and keys relay session state and
+ * run mode (which servers store under their `SERVER_NAME`).
+ *
+ * `options.pluginName` is the credential storage slug that `PerPluginStore`
+ * keys on (e.g. `"wet"`): it decides where `config` and `doctor` read/write
+ * credentials. Servers save creds under this slug, not under the console
+ * name, so the two must not be conflated. When omitted it defaults to
+ * `serverName` with a trailing `"-mcp"` stripped, which matches the wet/
+ * mnemo/crg convention; pass it explicitly when the slug differs (telegram
+ * saves under `"telegram"` though its console name is `"better-telegram-mcp"`).
+ *
+ * Reserved built-ins: `config` (`status`/`delete`), `status` (= `config
+ * status`), `logout` (= `config delete`; non-interactive use needs `--yes`,
+ * otherwise exit 1), `relay`, `doctor` and `token`. `auth` is not a built-in:
+ * sign-in is domain-specific, so a server that needs it passes an `auth`
+ * handler in `extra`.
+ *
+ * `extra` subcommand names take precedence over the reserved built-ins, so a
+ * server (or a test) can supply its own handler for any of them.
+ * `version`, when set, powers `--version`/`-V` (handled before `serve` or any
+ * subcommand runs); when unset, `--version`/`-V` falls through to `serve` like
+ * any other flag.
+ *
+ * The returned `run(argv)` resolves to the process exit code. A server's entry
+ * point calls it and exits: `buildCli(name, opts)(process.argv.slice(2)).then((c) => process.exit(c))`.
+ */
+export function buildCli(serverName, options) {
+    const { serve, extra, version, pluginName = pluginNameForServer(serverName) } = options;
+    const handlers = {
+        config: configHandler(serverName, pluginName),
+        status: () => configStatus(serverName, pluginName),
+        logout: (argv) => configDelete(serverName, pluginName, argv.includes('--yes')),
+        relay: relayHandler(serverName),
+        doctor: doctorHandler(serverName, pluginName),
+        token: tokenCliHandler(),
+        ...extra
+    };
+    return async (argv) => {
+        const args = argv ?? process.argv.slice(2);
+        if (args.length === 0) {
+            const rc = await serve([]);
+            return rc == null ? 0 : rc;
+        }
+        // Peek argv[0] before any subcommand routing: bare/flag argv must never
+        // reach a subcommand handler, or `--http` would be misread instead of
+        // passed through to `serve`. `-h`/`--help`/`--version` are intercepted
+        // here because starting the server on them would hang (stdio blocks on
+        // stdin) instead of printing the requested output.
+        if (args[0] === '-h' || args[0] === '--help') {
+            printCliHelp(serverName, handlers);
+            return 0;
+        }
+        if (version != null && (args[0] === '--version' || args[0] === '-V')) {
+            console.log(`${serverName} ${version}`);
+            return 0;
+        }
+        if (args[0].startsWith('-')) {
+            const rc = await serve(args);
+            return rc == null ? 0 : rc;
+        }
+        const subcommand = args[0];
+        const handler = handlers[subcommand];
+        if (handler === undefined) {
+            const names = Object.keys(handlers).sort().join(', ');
+            console.error(`${serverName}: unknown subcommand '${subcommand}' (expected one of: ${names})`);
+            return 2;
+        }
+        return handler(args.slice(1));
+    };
+}
+//# sourceMappingURL=build-cli.js.map

package/build/cli/build-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-cli.js","sourceRoot":"","sources":["../../src/cli/build-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAoB,MAAM,4BAA4B,CAAA;AACrG,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,yCAAyC;AACzC,MAAM,cAAc,GAAG,EAAE,CAAA;AAoCzB,SAAS,YAAY,CAAC,UAAkB,EAAE,QAAoC;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrD,OAAO,CAAC,GAAG,CAAC,UAAU,UAAU,sCAAsC,CAAC,CAAA;IACvE,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAA;IACvF,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAA;AACtC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,UAAkB;IAChE,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,UAAU,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,6BAA6B,CAAC,CAAA;QACvD,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;QACzE,OAAO,CAAC,CAAA;IACV,CAAC;IACD,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,gEAAgE,CAAC,CAAA;QAC5F,OAAO,CAAC,CAAA;IACV,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,kBAAkB,CAAC,CAAA;IAC5C,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;IACzE,OAAO,CAAC,CAAA;AACV,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,UAAkB;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,UAAU,UAAU,CAAC,CAAA;IACtE,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IACpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACjD,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;QACF,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IACzD,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAA;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,UAAkB,EAAE,GAAY;IAC9E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,4DAA4D,CAAC,CAAA;YACxF,OAAO,CAAC,CAAA;QACV,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,WAAW,CAAC,CAAA;YACvC,OAAO,CAAC,CAAA;QACV,CAAC;IACH,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAA;IAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,kBAAkB,CAAC,CAAA;IAC5C,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,aAAa,CAAC,UAAkB,EAAE,UAAkB;IAC3D,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QACpE,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QAC5F,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,uCAAuC,CAAC,CAAA;QACnE,OAAO,CAAC,CAAA;IACV,CAAC,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,IAAwB;IAC/D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,2BAA2B,CAAC,CAAA;QACvD,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAA;IACjD,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,QAAQ,QAAQ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACtH,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;YACpC,MAAM,SAAS,CAAC,UAAU,CAAC,CAAA;YAC3B,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,uBAAuB,CAAC,CAAA;YACjD,OAAO,CAAC,CAAA;QACV,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,8CAA8C,CAAC,CAAA;YAC1E,OAAO,CAAC,CAAA;QACV,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;QACjD,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAC7D,SAAS;QACT,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,2BAA2B,CAAC,CAAA;YACvD,OAAO,CAAC,CAAA;QACV,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,qCAAqC;QACrC,IAAI,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QACvD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,4CAA4C,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QACvF,CAAC;QACD,OAAO,CAAC,CAAA;IACV,CAAC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,UAAkB;IAC7D,IAAI,EAAE,GAAG,IAAI,CAAA;IAEb,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAA;IACzC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,aAAa,WAAW,EAAE,CAAC,CAAA;IACzC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,eAAe,WAAW,gBAAgB,cAAc,GAAG,CAAC,CAAA;QACxE,EAAE,GAAG,KAAK,CAAA;IACZ,CAAC;IAED,IAAI,SAAS,GAAG,IAAI,CAAA;IACpB,IAAI,CAAC;QACH,cAAc,EAAE,CAAA;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACnE,SAAS,GAAG,KAAK,CAAA;QACjB,EAAE,GAAG,KAAK,CAAA;IACZ,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACpC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACpC,OAAO,CAAC,GAAG,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAA;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAA;YACzD,EAAE,GAAG,KAAK,CAAA;QACZ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,uCAAuC,MAAM,CAAC,GAAG,yBAAyB,QAAQ,gBAAgB,CAAC,CAAA;QACjH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,+DAA+D;IAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;IAC5E,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,UAAU,CAAC,CAAA;QAC5C,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;QACxC,CAAC;aAAM,IAAI,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;YACrC,EAAE,GAAG,KAAK,CAAA;QACZ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACjD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;IAC1E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;IAC/C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAA;IAEnE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,UAAkB,EAAE,UAAkB;IAC3D,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,OAAwB;IACnE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,EAAE,GAAG,OAAO,CAAA;IACvF,MAAM,QAAQ,GAA+B;QAC3C,MAAM,EAAE,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC;QAC7C,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC;QAClD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9E,KAAK,EAAE,YAAY,CAAC,UAAU,CAAC;QAC/B,MAAM,EAAE,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC;QAC7C,KAAK,EAAE,eAAe,EAAE;QACxB,GAAG,KAAK;KACT,CAAA;IAED,OAAO,KAAK,EAAE,IAAsB,EAAmB,EAAE;QACvD,MAAM,IAAI,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAE1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1B,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5B,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7C,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YAClC,OAAO,CAAC,CAAA;QACV,CAAC;QAED,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC,CAAA;YACvC,OAAO,CAAC,CAAA;QACV,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;YAC5B,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;QACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACrD,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,yBAAyB,UAAU,uBAAuB,KAAK,GAAG,CAAC,CAAA;YAC9F,OAAO,CAAC,CAAA;QACV,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/B,CAAC,CAAA;AACH,CAAC"}

package/build/cli/index.d.ts

@@ -0,0 +1,2 @@
+export { type BuildCliOptions, buildCli, type CliHandler, type ServeFn } from './build-cli.js';
+//# sourceMappingURL=index.d.ts.map

package/build/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAA"}

package/build/cli/index.js

@@ -0,0 +1,2 @@
+export { buildCli } from './build-cli.js';
+//# sourceMappingURL=index.js.map

package/build/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,QAAQ,EAAiC,MAAM,gBAAgB,CAAA"}

package/build/crypto/aes.d.ts

@@ -0,0 +1,8 @@
+export interface EncryptResult {
+    ciphertext: Uint8Array;
+    iv: Uint8Array;
+    tag: Uint8Array;
+}
+export declare function encrypt(key: CryptoKey, plaintext: string): Promise<EncryptResult>;
+export declare function decrypt(key: CryptoKey, ciphertext: Uint8Array, iv: Uint8Array, tag?: Uint8Array): Promise<string>;
+//# sourceMappingURL=aes.d.ts.map

package/build/crypto/aes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aes.d.ts","sourceRoot":"","sources":["../../src/crypto/aes.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,CAAA;IACtB,EAAE,EAAE,UAAU,CAAA;IACd,GAAG,EAAE,UAAU,CAAA;CAChB;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAWvF;AAED,wBAAsB,OAAO,CAC3B,GAAG,EAAE,SAAS,EACd,UAAU,EAAE,UAAU,EACtB,EAAE,EAAE,UAAU,EACd,GAAG,CAAC,EAAE,UAAU,GACf,OAAO,CAAC,MAAM,CAAC,CAYjB"}

package/build/crypto/aes.js

@@ -0,0 +1,27 @@
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+export async function encrypt(key, plaintext) {
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const encoded = encoder.encode(plaintext);
+    const encrypted = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, encoded);
+    // WebCrypto appends 16-byte GCM tag to ciphertext
+    const combined = new Uint8Array(encrypted);
+    const ciphertext = combined.slice(0, combined.length - 16);
+    const tag = combined.slice(combined.length - 16);
+    return { ciphertext, iv, tag };
+}
+export async function decrypt(key, ciphertext, iv, tag) {
+    let data;
+    if (tag) {
+        data = new Uint8Array(ciphertext.length + tag.length);
+        data.set(ciphertext, 0);
+        data.set(tag, ciphertext.length);
+    }
+    else {
+        data = new Uint8Array(ciphertext);
+    }
+    const ivCopy = new Uint8Array(iv);
+    const decrypted = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: ivCopy }, key, data);
+    return decoder.decode(decrypted);
+}
+//# sourceMappingURL=aes.js.map

package/build/crypto/aes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aes.js","sourceRoot":"","sources":["../../src/crypto/aes.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AACjC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAQjC,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAc,EAAE,SAAiB;IAC7D,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAEpF,kDAAkD;IAClD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAA;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IAC1D,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IAEhD,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,CAAA;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAc,EACd,UAAsB,EACtB,EAAc,EACd,GAAgB;IAEhB,IAAI,IAA6B,CAAA;IACjC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;QACrD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IACjC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACzF,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;AAClC,CAAC"}

package/build/crypto/ecdh.d.ts

@@ -0,0 +1,5 @@
+export declare function generateKeyPair(): Promise<CryptoKeyPair>;
+export declare function exportPublicKey(key: CryptoKey): Promise<string>;
+export declare function importPublicKey(base64url: string): Promise<CryptoKey>;
+export declare function deriveSharedSecret(privateKey: CryptoKey, publicKey: CryptoKey): Promise<ArrayBuffer>;
+//# sourceMappingURL=ecdh.d.ts.map

package/build/crypto/ecdh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecdh.d.ts","sourceRoot":"","sources":["../../src/crypto/ecdh.ts"],"names":[],"mappings":"AAEA,wBAAsB,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,CAE9D;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAGrE;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAG3E;AAED,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAE1G"}

package/build/crypto/ecdh.js

@@ -0,0 +1,16 @@
+const ALGORITHM = { name: 'ECDH', namedCurve: 'P-256' };
+export async function generateKeyPair() {
+    return crypto.subtle.generateKey(ALGORITHM, true, ['deriveKey', 'deriveBits']);
+}
+export async function exportPublicKey(key) {
+    const raw = await crypto.subtle.exportKey('raw', key);
+    return Buffer.from(raw).toString('base64url');
+}
+export async function importPublicKey(base64url) {
+    const raw = Buffer.from(base64url, 'base64url');
+    return crypto.subtle.importKey('raw', raw, ALGORITHM, true, []);
+}
+export async function deriveSharedSecret(privateKey, publicKey) {
+    return crypto.subtle.deriveBits({ name: 'ECDH', public: publicKey }, privateKey, 256);
+}
+//# sourceMappingURL=ecdh.js.map

package/build/crypto/ecdh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecdh.js","sourceRoot":"","sources":["../../src/crypto/ecdh.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;AAEvD,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAA;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc;IAClD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACrD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAC/C,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAqB,EAAE,SAAoB;IAClF,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAA;AACvF,CAAC"}

package/build/crypto/index.d.ts

@@ -0,0 +1,4 @@
+export { decrypt, type EncryptResult, encrypt } from './aes.js';
+export { deriveSharedSecret, exportPublicKey, generateKeyPair, importPublicKey } from './ecdh.js';
+export { deriveAesKey, deriveJwtSigningSeed } from './kdf.js';
+//# sourceMappingURL=index.d.ts.map

package/build/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,aAAa,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA"}

package/build/crypto/index.js

@@ -0,0 +1,4 @@
+export { decrypt, encrypt } from './aes.js';
+export { deriveSharedSecret, exportPublicKey, generateKeyPair, importPublicKey } from './ecdh.js';
+export { deriveAesKey, deriveJwtSigningSeed } from './kdf.js';
+//# sourceMappingURL=index.js.map

package/build/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAsB,OAAO,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA"}