@n24q02m/hull 0.4.0 → 0.5.0-beta.2

package/README.md

@@ -1,6 +1,6 @@
 # @n24q02m/hull
 
-**TypeScript core of hull: MCP Streamable HTTP transport, OAuth 2.1 authorization server, credential storage and relay client for self-hosted MCP servers.**
+**TypeScript core of hull: MCP Streamable HTTP transport, token-table HTTP auth, encrypted credential storage and a CLI builder for self-hosted MCP servers.**
 
 This package is the TypeScript side of the hull monorepo. It is released in
 lockstep with the Python dist `n24q02m-hull`: one hull release tag publishes
@@ -25,13 +25,9 @@ subpath:
 | Import path | Provides |
 |---|---|
 | `@n24q02m/hull` | Everything below, plus `buildCli` (console-script subcommand dispatch around a server entry point) and `tryOpenBrowser` |
-| `@n24q02m/hull/transport` | `runHttpServer` (local HTTP server with routes), `StreamableHTTPServer` (MCP Streamable HTTP transport), `OAuthMiddleware` (bearer JWT verification) |
-| `@n24q02m/hull/oauth` | `OAuthProvider` (OAuth 2.1 authorization server), `JWTIssuer`, `verifyPKCE`, `InMemoryAuthCache`, `SqliteUserStore` |
-| `@n24q02m/hull/auth` | `createLocalOAuthApp` and `createDelegatedOAuthApp` (credential-form and upstream-OAuth flows), `renderCredentialForm`, `createSessionStore`, `deriveStableSub`, `authorizationServerMetadata` / `protectedResourceMetadata` (well-known documents) |
-| `@n24q02m/hull/crypto` | AES `encrypt` / `decrypt`, ECDH `generateKeyPair` / `deriveSharedSecret` / `exportPublicKey` / `importPublicKey`, key derivation `deriveAesKey` / `deriveJwtSigningSeed` |
-| `@n24q02m/hull/storage` | `atomicWriteFile`, credential backends (`LocalFsBackend`, `InMemoryBackend`, `CfKvBackend`, `backendFromEnv`), encrypted credential read/write/delete and config import/export, `PerPluginStore`, data dir helpers (`dataDir`, `dataDirCandidates`, `legacyDataDirs`), `resolveConfig` (environment variables, then stored config, then defaults), server mode state, session lock, machine identity helpers |
-| `@n24q02m/hull/relay` | Relay client: `createSession`, `generatePassphrase`, `pollForResult`, `sendMessage`, `pollForResponses`, `notifyComplete` |
-| `@n24q02m/hull/schema` | Type-only config schema: `ConfigField`, `ConfigMode`, `RelayConfigSchema` and related form layout types |
+| `@n24q02m/hull/transport` | `runHttpServer` (local HTTP server with routes), `StreamableHTTPServer` (MCP Streamable HTTP transport), `jsonResponse` |
+| `@n24q02m/hull/crypto` | AES `encrypt` / `decrypt`, ECDH `generateKeyPair` / `deriveSharedSecret` / `exportPublicKey` / `importPublicKey`, key derivation `deriveAesKey` |
+| `@n24q02m/hull/storage` | `atomicWriteFile`, credential backends (`LocalFsBackend`, `InMemoryBackend`, `backendFromEnv`), encrypted credential read/write/delete and config import/export, `PerPluginStore`, data dir helpers (`dataDir`, `dataDirCandidates`, `legacyDataDirs`), `resolveConfig` (environment variables, then stored config, then defaults), machine identity helpers, and the provider key pool (`CredentialStore`, `KeyPool`, `AccountRegistry`, `SecretCipher`) |
 | `@n24q02m/hull/token-auth` | Token-table HTTP auth: `Authenticator`, `hashToken` / `verifyToken`, `loadUsers`, `currentUser`, `ensurePathAllowed`, `guardRequest`, `SlidingWindowLimiter`, `tokenCliHandler` |
 
 ## Credential storage layout
@@ -64,9 +60,48 @@ dirs are only read, never written. The next `save()` writes to `~/.<plugin>/`,
 and from then on the new copy takes precedence. `clear()` removes the blob
 from every location. A corrupt blob is reported as corrupt; the store does
 not fall back to an older copy behind it. Injected backends (`InMemoryBackend`,
-`CfKvBackend`, a `LocalFsBackend` with a custom `baseDir`) are used as the
+a `LocalFsBackend` with a custom `baseDir`) are used as the
 only source.
 
+## Provider key pools (`~/.hull/hull.db`)
+
+`@n24q02m/hull/storage` mirrors the Python key pool: ordered credentials per
+provider (optionally scoped to a named account), encrypted at rest and rotated
+on failure. This is separate from `PerPluginStore` above — the pool lives in the
+shared hull database, not in `~/.<plugin>/`.
+
+```ts
+import { CredentialStore } from '@n24q02m/hull/storage'
+
+const store = new CredentialStore() // ~/.hull/hull.db + ~/.hull/.credential-key
+store.migrateModelCells(settings.models) // idempotent seed from existing cells
+
+const work = store.accounts().add({ provider: 'openrouter', name: 'Work', email: 'ops@example.com' })
+store.addCredential({
+  provider: 'openrouter',
+  apiKey: process.env.OPENROUTER_KEY ?? '',
+  baseUrl: 'https://openrouter.ai/api/v1',
+  accountId: work.accountId // "openrouter:work"
+})
+
+const pool = store.poolForCell(settings.models.embed)
+const result = await pool.runAsync((credential) => callProvider(credential))
+```
+
+| Upstream | Rotation behaviour |
+|---|---|
+| `401` / `403` | disable that credential, take the next |
+| `429` | cooldown `Retry-After` / `rate_limit_reset` (1 s…1 h, default 60 s), take the next |
+| `5xx` | retry the same credential once (`max5xxRetries`), then rotate |
+| anything else | re-throw unchanged; pool state untouched |
+| empty / all blocked | `PoolExhaustedError` with counts and a redacted last error |
+
+Acquired credentials are leased (default 60 s), so concurrent tasks never
+receive the same key. `store.health(provider)` is the read-only view; keys and
+their values never appear in health, `toString`, `toJSON`, or error text — only
+a 4-character hint. Tables (`provider_accounts`, `provider_credentials`) are
+created additively with `CREATE TABLE IF NOT EXISTS` in the existing database.
+
 ## CLI built-ins
 
 `buildCli(serverName, { serve, extra, version, pluginName })` routes a leading
@@ -79,21 +114,17 @@ positional argument to a subcommand. Bare or flag-prefixed argv (for example
 | `logout [--yes]` | Same as `config delete`: removes the stored credential from the current and every legacy dir. Without `--yes` it prompts on a TTY; non-interactive use without `--yes` exits 1. |
 | `config status` / `config delete [--yes]` | The long forms of the two commands above. |
 | `doctor` | Runtime, backend, store dir and config checks. Warns `only legacy store dir found` when credentials still sit in a legacy dir. |
-| `relay status` / `relay open` / `relay reset` | Relay session state. |
 | `token hash` | Mint a token-table hash (see below). |
 
 `auth` is not a built-in. Signing in depends on the server (OAuth device code,
-bot token, API key, relay form), so each server provides its own `auth`
+bot token, API key), so each server provides its own `auth`
 handler through `extra`. Entries in `extra` also override a built-in of the
 same name.
 
 ## Token-table HTTP auth
 
 `runHttpServer` accepts an `auth` option with the three modes of core-py
-`[server] auth`. It replaces the OAuth/relay stack for that server: `auth` is
-mutually exclusive with `relaySchema`, `delegatedOAuth`, `jwtIssuer`,
-`authDisabled` and `authScope`, and needs neither a relay nor an OAuth
-issuer.
+`[server] auth`; when omitted the server runs in `no-auth` mode (loopback only).
 
 | Mode | Config | Behaviour |
 |---|---|---|
@@ -150,7 +181,7 @@ printf '%s' "$TOKEN" | my-mcp token hash
 ```ts
 import { runHttpServer } from '@n24q02m/hull/transport'
 import { encrypt, decrypt } from '@n24q02m/hull/crypto'
-import type { RelayConfigSchema } from '@n24q02m/hull/schema'
+import { buildCli, tryOpenBrowser } from '@n24q02m/hull'
 ```
 
 ## Development

package/build/cli/build-cli.d.ts

@@ -14,13 +14,13 @@
  *   those would hang in stdio mode instead of printing the requested output.
  *
  * A leading *positional* argv[0] is treated as a subcommand name -- either one
- * of the reserved built-ins (`config`/`doctor`/`logout`/`relay`/`status`/`token`)
+ * of the reserved built-ins (`config`/`doctor`/`logout`/`status`/`token`)
  * or a server-specific one supplied via `extra` -- and is routed to its handler
  * instead of `serve`. `status` and `logout` are top-level aliases of
  * `config status` and `config delete` (same output and exit codes).
  *
  * `auth` is deliberately NOT a built-in: signing in is domain-specific (OAuth
- * device code, bot token, API key paste, relay form, ...), so each server that
+ * device code, bot token, API key paste, ...), so each server that
  * needs it supplies its own `auth` handler via `extra`.
  * STDOUT is the MCP protocol channel in stdio mode, so only this subcommand
  * path prints to stdout; the `serve` path never touches stdout here.
@@ -45,7 +45,7 @@ export interface BuildCliOptions {
     serve: ServeFn;
     /**
      * Server-specific subcommands. A name here overrides the reserved built-in
-     * of the same name (`config`/`doctor`/`logout`/`relay`/`status`/`token`), so a
+     * of the same name (`config`/`doctor`/`logout`/`status`/`token`), so a
      * server can supply its own handler. This is also where a server provides
      * `auth`, which is not a built-in because sign-in is domain-specific.
      */
@@ -67,8 +67,7 @@ export interface BuildCliOptions {
  * Build the console-script entry point for one MCP server.
  *
  * `serverName` is the console/display name (e.g. `"wet-mcp"`): it names the
- * program in help/usage and status lines, and keys relay session state and
- * run mode (which servers store under their `SERVER_NAME`).
+ * program in help/usage and status lines.
  *
  * `options.pluginName` is the credential storage slug that `PerPluginStore`
  * keys on (e.g. `"wet"`): it decides where `config` and `doctor` read/write
@@ -80,7 +79,7 @@ export interface BuildCliOptions {
  *
  * Reserved built-ins: `config` (`status`/`delete`), `status` (= `config
  * status`), `logout` (= `config delete`; non-interactive use needs `--yes`,
- * otherwise exit 1), `relay`, `doctor` and `token`. `auth` is not a built-in:
+ * otherwise exit 1), `doctor` and `token`. `auth` is not a built-in:
  * sign-in is domain-specific, so a server that needs it passes an `auth`
  * handler in `extra`.
  *

package/build/cli/build-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-cli.d.ts","sourceRoot":"","sources":["../../src/cli/build-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAmBH,4EAA4E;AAC5E,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;AAEhF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;AAErE,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,KAAK,EAAE,OAAO,CAAA;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAClC,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AA6LD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAiDlH"}
+{"version":3,"file":"build-cli.d.ts","sourceRoot":"","sources":["../../src/cli/build-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAgBH,4EAA4E;AAC5E,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;AAEhF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;AAErE,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,KAAK,EAAE,OAAO,CAAA;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAClC,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAwID;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAgDlH"}

package/build/cli/build-cli.js

@@ -14,13 +14,13 @@
  *   those would hang in stdio mode instead of printing the requested output.
  *
  * A leading *positional* argv[0] is treated as a subcommand name -- either one
- * of the reserved built-ins (`config`/`doctor`/`logout`/`relay`/`status`/`token`)
+ * of the reserved built-ins (`config`/`doctor`/`logout`/`status`/`token`)
  * or a server-specific one supplied via `extra` -- and is routed to its handler
  * instead of `serve`. `status` and `logout` are top-level aliases of
  * `config status` and `config delete` (same output and exit codes).
  *
  * `auth` is deliberately NOT a built-in: signing in is domain-specific (OAuth
- * device code, bot token, API key paste, relay form, ...), so each server that
+ * device code, bot token, API key paste, ...), so each server that
  * needs it supplies its own `auth` handler via `extra`.
  * STDOUT is the MCP protocol channel in stdio mode, so only this subcommand
  * path prints to stdout; the `serve` path never touches stdout here.
@@ -34,13 +34,10 @@
  */
 import { accessSync, constants, existsSync } from 'node:fs';
 import { createInterface } from 'node:readline';
-import { tryOpenBrowser } from '../relay/browser.js';
 import { backendFromEnv } from '../storage/backends.js';
 import { pluginNameForServer } from '../storage/credential-store.js';
 import { dataDir, legacyDataDirs } from '../storage/data-dir.js';
-import { clearMode, getMode } from '../storage/mode.js';
 import { PerPluginStore } from '../storage/per-plugin-store.js';
-import { acquireSessionLock, releaseSessionLock } from '../storage/session-lock.js';
 import { tokenCliHandler } from '../token-auth/cli.js';
 // Minimum Node major the stack supports (mcp-core package.json `engines`
 // pins `>=24.18.0`). Doctor's runtime check is the TS analogue of core-py's
@@ -111,50 +108,6 @@ function configHandler(serverName, pluginName) {
         return 2;
     };
 }
-function relayStatus(serverName, info) {
-    if (info === null) {
-        console.error(`${serverName}: no active relay session`);
-        return 1;
-    }
-    const ageS = (Date.now() - info.createdAt) / 1000;
-    console.log(`${serverName}: session ${info.sessionId.slice(0, 8)} relay_url=${info.relayUrl} age=${ageS.toFixed(0)}s`);
-    return 0;
-}
-function relayHandler(serverName) {
-    return async (argv) => {
-        const action = argv[0];
-        if (action === 'reset') {
-            await releaseSessionLock(serverName);
-            await clearMode(serverName);
-            console.log(`${serverName}: relay state cleared`);
-            return 0;
-        }
-        if (action !== 'status' && action !== 'open') {
-            console.error(`${serverName}: relay expects 'status', 'open', or 'reset'`);
-            return 2;
-        }
-        const info = await acquireSessionLock(serverName);
-        if (action === 'status')
-            return relayStatus(serverName, info);
-        // "open"
-        if (info === null) {
-            console.error(`${serverName}: no active relay session`);
-            return 1;
-        }
-        // Branch on the return value: `tryOpenBrowser` declines under headless / CI
-        // / the env-guard, and printing "opened" there is untrue in the very first
-        // line the user reads -- they wait for a tab that never appears. Failing to
-        // open is not a failure of the command (the URL is still correct and still
-        // usable), so the exit code stays 0.
-        if (await tryOpenBrowser(info.relayUrl)) {
-            console.log(`${serverName}: opened ${info.relayUrl}`);
-        }
-        else {
-            console.log(`${serverName}: could not launch a browser here; visit ${info.relayUrl}`);
-        }
-        return 0;
-    };
-}
 async function runDoctor(serverName, pluginName) {
     let ok = true;
     const nodeVersion = process.versions.node;
@@ -219,14 +172,6 @@ async function runDoctor(serverName, pluginName) {
             console.log('[warn] config: not configured');
         }
     }
-    const info = await acquireSessionLock(serverName);
-    if (info !== null) {
-        console.log(`[ok] relay session active (${info.sessionId.slice(0, 8)})`);
-    }
-    else {
-        console.log('[warn] no active relay session');
-    }
-    console.log(`[ok] mode: ${(await getMode(serverName)) ?? 'unset'}`);
     return ok ? 0 : 1;
 }
 function doctorHandler(serverName, pluginName) {
@@ -236,8 +181,7 @@ function doctorHandler(serverName, pluginName) {
  * Build the console-script entry point for one MCP server.
  *
  * `serverName` is the console/display name (e.g. `"wet-mcp"`): it names the
- * program in help/usage and status lines, and keys relay session state and
- * run mode (which servers store under their `SERVER_NAME`).
+ * program in help/usage and status lines.
  *
  * `options.pluginName` is the credential storage slug that `PerPluginStore`
  * keys on (e.g. `"wet"`): it decides where `config` and `doctor` read/write
@@ -249,7 +193,7 @@ function doctorHandler(serverName, pluginName) {
  *
  * Reserved built-ins: `config` (`status`/`delete`), `status` (= `config
  * status`), `logout` (= `config delete`; non-interactive use needs `--yes`,
- * otherwise exit 1), `relay`, `doctor` and `token`. `auth` is not a built-in:
+ * otherwise exit 1), `doctor` and `token`. `auth` is not a built-in:
  * sign-in is domain-specific, so a server that needs it passes an `auth`
  * handler in `extra`.
  *
@@ -268,7 +212,6 @@ export function buildCli(serverName, options) {
         config: configHandler(serverName, pluginName),
         status: () => configStatus(serverName, pluginName),
         logout: (argv) => configDelete(serverName, pluginName, argv.includes('--yes')),
-        relay: relayHandler(serverName),
         doctor: doctorHandler(serverName, pluginName),
         token: tokenCliHandler(),
         ...extra

package/build/cli/build-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-cli.js","sourceRoot":"","sources":["../../src/cli/build-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAoB,MAAM,4BAA4B,CAAA;AACrG,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,yCAAyC;AACzC,MAAM,cAAc,GAAG,EAAE,CAAA;AAoCzB,SAAS,YAAY,CAAC,UAAkB,EAAE,QAAoC;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrD,OAAO,CAAC,GAAG,CAAC,UAAU,UAAU,sCAAsC,CAAC,CAAA;IACvE,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAA;IACvF,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAA;AACtC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,UAAkB;IAChE,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,UAAU,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,6BAA6B,CAAC,CAAA;QACvD,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;QACzE,OAAO,CAAC,CAAA;IACV,CAAC;IACD,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,gEAAgE,CAAC,CAAA;QAC5F,OAAO,CAAC,CAAA;IACV,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,kBAAkB,CAAC,CAAA;IAC5C,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;IACzE,OAAO,CAAC,CAAA;AACV,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,UAAkB;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,UAAU,UAAU,CAAC,CAAA;IACtE,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IACpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACjD,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;QACF,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IACzD,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAA;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,UAAkB,EAAE,GAAY;IAC9E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,4DAA4D,CAAC,CAAA;YACxF,OAAO,CAAC,CAAA;QACV,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,WAAW,CAAC,CAAA;YACvC,OAAO,CAAC,CAAA;QACV,CAAC;IACH,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAA;IAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,kBAAkB,CAAC,CAAA;IAC5C,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,aAAa,CAAC,UAAkB,EAAE,UAAkB;IAC3D,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QACpE,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QAC5F,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,uCAAuC,CAAC,CAAA;QACnE,OAAO,CAAC,CAAA;IACV,CAAC,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,IAAwB;IAC/D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,2BAA2B,CAAC,CAAA;QACvD,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAA;IACjD,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,QAAQ,QAAQ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACtH,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;YACpC,MAAM,SAAS,CAAC,UAAU,CAAC,CAAA;YAC3B,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,uBAAuB,CAAC,CAAA;YACjD,OAAO,CAAC,CAAA;QACV,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,8CAA8C,CAAC,CAAA;YAC1E,OAAO,CAAC,CAAA;QACV,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;QACjD,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAC7D,SAAS;QACT,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,2BAA2B,CAAC,CAAA;YACvD,OAAO,CAAC,CAAA;QACV,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,qCAAqC;QACrC,IAAI,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QACvD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,4CAA4C,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QACvF,CAAC;QACD,OAAO,CAAC,CAAA;IACV,CAAC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,UAAkB;IAC7D,IAAI,EAAE,GAAG,IAAI,CAAA;IAEb,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAA;IACzC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,aAAa,WAAW,EAAE,CAAC,CAAA;IACzC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,eAAe,WAAW,gBAAgB,cAAc,GAAG,CAAC,CAAA;QACxE,EAAE,GAAG,KAAK,CAAA;IACZ,CAAC;IAED,IAAI,SAAS,GAAG,IAAI,CAAA;IACpB,IAAI,CAAC;QACH,cAAc,EAAE,CAAA;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACnE,SAAS,GAAG,KAAK,CAAA;QACjB,EAAE,GAAG,KAAK,CAAA;IACZ,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACpC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACpC,OAAO,CAAC,GAAG,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAA;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAA;YACzD,EAAE,GAAG,KAAK,CAAA;QACZ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,uCAAuC,MAAM,CAAC,GAAG,yBAAyB,QAAQ,gBAAgB,CAAC,CAAA;QACjH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,+DAA+D;IAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;IAC5E,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,UAAU,CAAC,CAAA;QAC5C,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;QACxC,CAAC;aAAM,IAAI,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;YACrC,EAAE,GAAG,KAAK,CAAA;QACZ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACjD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;IAC1E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;IAC/C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAA;IAEnE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,UAAkB,EAAE,UAAkB;IAC3D,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,OAAwB;IACnE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,EAAE,GAAG,OAAO,CAAA;IACvF,MAAM,QAAQ,GAA+B;QAC3C,MAAM,EAAE,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC;QAC7C,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC;QAClD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9E,KAAK,EAAE,YAAY,CAAC,UAAU,CAAC;QAC/B,MAAM,EAAE,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC;QAC7C,KAAK,EAAE,eAAe,EAAE;QACxB,GAAG,KAAK;KACT,CAAA;IAED,OAAO,KAAK,EAAE,IAAsB,EAAmB,EAAE;QACvD,MAAM,IAAI,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAE1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1B,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5B,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7C,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YAClC,OAAO,CAAC,CAAA;QACV,CAAC;QAED,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC,CAAA;YACvC,OAAO,CAAC,CAAA;QACV,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;YAC5B,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;QACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACrD,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,yBAAyB,UAAU,uBAAuB,KAAK,GAAG,CAAC,CAAA;YAC9F,OAAO,CAAC,CAAA;QACV,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/B,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"build-cli.js","sourceRoot":"","sources":["../../src/cli/build-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,yCAAyC;AACzC,MAAM,cAAc,GAAG,EAAE,CAAA;AAoCzB,SAAS,YAAY,CAAC,UAAkB,EAAE,QAAoC;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrD,OAAO,CAAC,GAAG,CAAC,UAAU,UAAU,sCAAsC,CAAC,CAAA;IACvE,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAA;IACvF,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAA;AACtC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,UAAkB;IAChE,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,UAAU,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,6BAA6B,CAAC,CAAA;QACvD,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;QACzE,OAAO,CAAC,CAAA;IACV,CAAC;IACD,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,gEAAgE,CAAC,CAAA;QAC5F,OAAO,CAAC,CAAA;IACV,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,kBAAkB,CAAC,CAAA;IAC5C,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;IACzE,OAAO,CAAC,CAAA;AACV,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,UAAkB;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,UAAU,UAAU,CAAC,CAAA;IACtE,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IACpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACjD,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;QACF,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IACzD,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAA;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,UAAkB,EAAE,GAAY;IAC9E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,4DAA4D,CAAC,CAAA;YACxF,OAAO,CAAC,CAAA;QACV,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,WAAW,CAAC,CAAA;YACvC,OAAO,CAAC,CAAA;QACV,CAAC;IACH,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAA;IAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,kBAAkB,CAAC,CAAA;IAC5C,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,aAAa,CAAC,UAAkB,EAAE,UAAkB;IAC3D,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QACpE,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QAC5F,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,uCAAuC,CAAC,CAAA;QACnE,OAAO,CAAC,CAAA;IACV,CAAC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,UAAkB;IAC7D,IAAI,EAAE,GAAG,IAAI,CAAA;IAEb,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAA;IACzC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,aAAa,WAAW,EAAE,CAAC,CAAA;IACzC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,eAAe,WAAW,gBAAgB,cAAc,GAAG,CAAC,CAAA;QACxE,EAAE,GAAG,KAAK,CAAA;IACZ,CAAC;IAED,IAAI,SAAS,GAAG,IAAI,CAAA;IACpB,IAAI,CAAC;QACH,cAAc,EAAE,CAAA;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QACnE,SAAS,GAAG,KAAK,CAAA;QACjB,EAAE,GAAG,KAAK,CAAA;IACZ,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACpC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACpC,OAAO,CAAC,GAAG,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAA;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAA;YACzD,EAAE,GAAG,KAAK,CAAA;QACZ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,uCAAuC,MAAM,CAAC,GAAG,yBAAyB,QAAQ,gBAAgB,CAAC,CAAA;QACjH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,+DAA+D;IAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;IAC5E,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,UAAU,CAAC,CAAA;QAC5C,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;QACxC,CAAC;aAAM,IAAI,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;YACrC,EAAE,GAAG,KAAK,CAAA;QACZ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,UAAkB,EAAE,UAAkB;IAC3D,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,OAAwB;IACnE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,EAAE,GAAG,OAAO,CAAA;IACvF,MAAM,QAAQ,GAA+B;QAC3C,MAAM,EAAE,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC;QAC7C,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC;QAClD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9E,MAAM,EAAE,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC;QAC7C,KAAK,EAAE,eAAe,EAAE;QACxB,GAAG,KAAK;KACT,CAAA;IAED,OAAO,KAAK,EAAE,IAAsB,EAAmB,EAAE;QACvD,MAAM,IAAI,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAE1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1B,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5B,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7C,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YAClC,OAAO,CAAC,CAAA;QACV,CAAC;QAED,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC,CAAA;YACvC,OAAO,CAAC,CAAA;QACV,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;YAC5B,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;QACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACrD,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,yBAAyB,UAAU,uBAAuB,KAAK,GAAG,CAAC,CAAA;YAC9F,OAAO,CAAC,CAAA;QACV,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/B,CAAC,CAAA;AACH,CAAC"}

package/build/crypto/index.d.ts

@@ -1,4 +1,4 @@
 export { decrypt, type EncryptResult, encrypt } from './aes.js';
 export { deriveSharedSecret, exportPublicKey, generateKeyPair, importPublicKey } from './ecdh.js';
-export { deriveAesKey, deriveJwtSigningSeed } from './kdf.js';
+export { deriveAesKey } from './kdf.js';
 //# sourceMappingURL=index.d.ts.map

package/build/crypto/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,aAAa,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,aAAa,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA"}

package/build/crypto/index.js

@@ -1,4 +1,4 @@
 export { decrypt, encrypt } from './aes.js';
 export { deriveSharedSecret, exportPublicKey, generateKeyPair, importPublicKey } from './ecdh.js';
-export { deriveAesKey, deriveJwtSigningSeed } from './kdf.js';
+export { deriveAesKey } from './kdf.js';
 //# sourceMappingURL=index.js.map

package/build/crypto/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAsB,OAAO,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAsB,OAAO,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA"}

package/build/crypto/kdf.d.ts

@@ -1,15 +1,2 @@
 export declare function deriveAesKey(sharedSecret: ArrayBuffer, passphrase: string): Promise<CryptoKey>;
-/**
- * Derive a deterministic 32-byte Ed25519 seed for OAuth JWT signing.
- *
- * Used in HTTP multi-user mode (CREDENTIAL_SECRET set) so every container
- * replica converges on the SAME signing key without a shared volume or
- * external secret store. Domain-separated per server via the HKDF info label.
- *
- * HKDF-SHA256 with IKM = secret, empty salt, info =
- * `mcp-jwt-signing-key-v1:<serverName>`. Byte-identical to core-py's
- * `derive_jwt_signing_seed` for the same inputs (enforced by the shared
- * crypto-vectors fixture).
- */
-export declare function deriveJwtSigningSeed(secret: string, serverName: string): Buffer;
 //# sourceMappingURL=kdf.d.ts.map

package/build/crypto/kdf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/crypto/kdf.ts"],"names":[],"mappings":"AAOA,wBAAsB,YAAY,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAWpG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG/E"}
+{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/crypto/kdf.ts"],"names":[],"mappings":"AAOA,wBAAsB,YAAY,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAWpG"}

package/build/crypto/kdf.js

@@ -1,26 +1,11 @@
-import { hkdfSync } from 'node:crypto';
 const encoder = new TextEncoder();
+// HKDF info label inherited from the former relay handshake. It is an input to
+// the derived key, so changing it changes every key (see the cross-language
+// vectors in tests/fixtures/crypto-vectors.json); the value must stay.
 const INFO = encoder.encode('mcp-relay');
-const JWT_SIGNING_INFO_PREFIX = 'mcp-jwt-signing-key-v1:';
 export async function deriveAesKey(sharedSecret, passphrase) {
     const salt = encoder.encode(passphrase);
     const keyMaterial = await crypto.subtle.importKey('raw', sharedSecret, 'HKDF', false, ['deriveKey']);
     return crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt, info: INFO }, keyMaterial, { name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
 }
-/**
- * Derive a deterministic 32-byte Ed25519 seed for OAuth JWT signing.
- *
- * Used in HTTP multi-user mode (CREDENTIAL_SECRET set) so every container
- * replica converges on the SAME signing key without a shared volume or
- * external secret store. Domain-separated per server via the HKDF info label.
- *
- * HKDF-SHA256 with IKM = secret, empty salt, info =
- * `mcp-jwt-signing-key-v1:<serverName>`. Byte-identical to core-py's
- * `derive_jwt_signing_seed` for the same inputs (enforced by the shared
- * crypto-vectors fixture).
- */
-export function deriveJwtSigningSeed(secret, serverName) {
-    const info = encoder.encode(`${JWT_SIGNING_INFO_PREFIX}${serverName}`);
-    return Buffer.from(hkdfSync('sha256', Buffer.from(secret, 'utf-8'), Buffer.alloc(0), info, 32));
-}
 //# sourceMappingURL=kdf.js.map

package/build/crypto/kdf.js.map

@@ -1 +1 @@
-{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../src/crypto/kdf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AACxC,MAAM,uBAAuB,GAAG,yBAAyB,CAAA;AAEzD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,YAAyB,EAAE,UAAkB;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACvC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAEpG,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EACnD,WAAW,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,UAAkB;IACrE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,uBAAuB,GAAG,UAAU,EAAE,CAAC,CAAA;IACtE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;AACjG,CAAC"}
+{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../src/crypto/kdf.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,+EAA+E;AAC/E,4EAA4E;AAC5E,uEAAuE;AACvE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAExC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,YAAyB,EAAE,UAAkB;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACvC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAEpG,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EACnD,WAAW,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;AACH,CAAC"}

package/build/index.d.ts

@@ -1,19 +1,9 @@
-export { authorizationServerMetadata, type CapabilityInfo, type ConfigField, type CredentialsCallback, createDelegatedOAuthApp, createLocalOAuthApp, type DelegatedOAuthAppOptions, type DelegatedOAuthAppResult, type FlowType, type LocalOAuthAppOptions, type LocalOAuthAppResult, type NextStep, type OAuthTokens, protectedResourceMetadata, type RelayConfigSchema, type RenderOptions, renderCredentialForm, type StepCallback, type SubjectContext, type TokenCallback, type UpstreamOAuthConfig } from './auth/index.js';
 export { type BuildCliOptions, buildCli, type CliHandler, type ServeFn } from './cli/build-cli.js';
 export * from './crypto/index.js';
-export { JWTIssuer } from './oauth/jwt-issuer.js';
-export { verifyPKCE } from './oauth/pkce.js';
-export { InMemoryAuthCache, type IOAuthSessionCache, OAuthProvider, type OAuthProviderOptions, type PreAuthSession } from './oauth/provider.js';
-export { type IUserCredentialStore, SqliteUserStore } from './oauth/user-store.js';
-export { tryOpenBrowser } from './relay/browser.js';
-export { createSession, generatePassphrase, notifyComplete, pollForResponses, pollForResult, type RelaySession, sendMessage } from './relay/client.js';
-export { buildOpenRelayHandler, type ElicitationServer, type OpenRelayHandlerOptions, type OpenRelayResult, registerOpenRelayTool, type ToolRegistrar } from './relay/tool-helpers.js';
-export type * from './schema/types.js';
 export { exportConfig, importConfig, listConfigs, scheduleReloadExit } from './storage/config-file.js';
 export { deleteStoredConfig as deleteConfig, readStoredConfig as readConfig, writeStoredConfig as writeConfig } from './storage/credential-store.js';
-export { clearMode, getMode, type ServerMode, setLocalMode } from './storage/mode.js';
 export * from './storage/resolver.js';
-export { acquireSessionLock, releaseSessionLock, type SessionInfo, writeSessionLock } from './storage/session-lock.js';
 export * from './token-auth/index.js';
 export { type HttpRoute, type HttpServerHandle, type RunHttpServerOptions, runHttpServer } from './transport/local-server.js';
+export { tryOpenBrowser } from './util/browser.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,QAAQ,EACb,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAClG,cAAc,mBAAmB,CAAA;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EACL,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,KAAK,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,KAAK,YAAY,EACjB,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAA;AAChC,mBAAmB,mBAAmB,CAAA;AACtC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAGtG,OAAO,EACL,kBAAkB,IAAI,YAAY,EAClC,gBAAgB,IAAI,UAAU,EAC9B,iBAAiB,IAAI,WAAW,EACjC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrF,cAAc,uBAAuB,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,WAAW,EAChB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAGlC,cAAc,uBAAuB,CAAA;AAErC,OAAO,EACL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,aAAa,EACd,MAAM,6BAA6B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAClG,cAAc,mBAAmB,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAGtG,OAAO,EACL,kBAAkB,IAAI,YAAY,EAClC,gBAAgB,IAAI,UAAU,EAC9B,iBAAiB,IAAI,WAAW,EACjC,MAAM,+BAA+B,CAAA;AACtC,cAAc,uBAAuB,CAAA;AAGrC,cAAc,uBAAuB,CAAA;AAErC,OAAO,EACL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,aAAa,EACd,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA"}

package/build/index.js

@@ -1,28 +1,16 @@
-// Local OAuth 2.1 Authorization Server (single-user, 127.0.0.1) +
-// Delegated OAuth (upstream redirect / device code) for remote multi-user.
-export { authorizationServerMetadata, createDelegatedOAuthApp, createLocalOAuthApp, protectedResourceMetadata, renderCredentialForm } from './auth/index.js';
-// Console-script CLI builder shared by every TS MCP server (config/relay/doctor
-// built-ins + version + help; parity with core-py's build_cli).
+// Console-script CLI builder shared by every TS MCP server (config/doctor/logout/status/token built-ins).
 export { buildCli } from './cli/build-cli.js';
 export * from './crypto/index.js';
-// OAuth 2.1 multi-user infrastructure (HTTP mode)
-export { JWTIssuer } from './oauth/jwt-issuer.js';
-export { verifyPKCE } from './oauth/pkce.js';
-export { InMemoryAuthCache, OAuthProvider } from './oauth/provider.js';
-export { SqliteUserStore } from './oauth/user-store.js';
-export { tryOpenBrowser } from './relay/browser.js';
-export { createSession, generatePassphrase, notifyComplete, pollForResponses, pollForResult, sendMessage } from './relay/client.js';
-export { buildOpenRelayHandler, registerOpenRelayTool } from './relay/tool-helpers.js';
 export { exportConfig, importConfig, listConfigs, scheduleReloadExit } from './storage/config-file.js';
 // Single-user credential read/write/delete route through the unified
 // per-plugin store (with legacy config.enc read fallback).
 export { deleteStoredConfig as deleteConfig, readStoredConfig as readConfig, writeStoredConfig as writeConfig } from './storage/credential-store.js';
-export { clearMode, getMode, setLocalMode } from './storage/mode.js';
 export * from './storage/resolver.js';
-export { acquireSessionLock, releaseSessionLock, writeSessionLock } from './storage/session-lock.js';
 // HTTP token-table auth (no-auth / token / multi users.toml), the TS port of
 // core-py hull_core.auth; wired into runHttpServer via its `auth` option.
 export * from './token-auth/index.js';
-// HTTP MCP server entry point (OAuth AS + /mcp transport on 127.0.0.1)
+// HTTP MCP server entry point (Streamable HTTP transport on host:port)
 export { runHttpServer } from './transport/local-server.js';
+// Cross-platform best-effort browser opener (WSL-aware, headless/CI-guarded).
+export { tryOpenBrowser } from './util/browser.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,2EAA2E;AAC3E,OAAO,EACL,2BAA2B,EAI3B,uBAAuB,EACvB,mBAAmB,EAQnB,yBAAyB,EAGzB,oBAAoB,EAKrB,MAAM,iBAAiB,CAAA;AACxB,gFAAgF;AAChF,gEAAgE;AAChE,OAAO,EAAwB,QAAQ,EAAiC,MAAM,oBAAoB,CAAA;AAClG,cAAc,mBAAmB,CAAA;AACjC,kDAAkD;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EACL,iBAAiB,EAEjB,aAAa,EAGd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAA6B,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,aAAa,EAEb,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,qBAAqB,EAIrB,qBAAqB,EAEtB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACtG,qEAAqE;AACrE,2DAA2D;AAC3D,OAAO,EACL,kBAAkB,IAAI,YAAY,EAClC,gBAAgB,IAAI,UAAU,EAC9B,iBAAiB,IAAI,WAAW,EACjC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAmB,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrF,cAAc,uBAAuB,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAClC,6EAA6E;AAC7E,0EAA0E;AAC1E,cAAc,uBAAuB,CAAA;AACrC,uEAAuE;AACvE,OAAO,EAIL,aAAa,EACd,MAAM,6BAA6B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,OAAO,EAAwB,QAAQ,EAAiC,MAAM,oBAAoB,CAAA;AAClG,cAAc,mBAAmB,CAAA;AACjC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACtG,qEAAqE;AACrE,2DAA2D;AAC3D,OAAO,EACL,kBAAkB,IAAI,YAAY,EAClC,gBAAgB,IAAI,UAAU,EAC9B,iBAAiB,IAAI,WAAW,EACjC,MAAM,+BAA+B,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,6EAA6E;AAC7E,0EAA0E;AAC1E,cAAc,uBAAuB,CAAA;AACrC,uEAAuE;AACvE,OAAO,EAIL,aAAa,EACd,MAAM,6BAA6B,CAAA;AACpC,8EAA8E;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA"}

package/build/storage/account-registry.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Named provider accounts for multi-account pools (TypeScript mirror of
+ * `hull_core/credentials/registry.py`).
+ *
+ * A provider such as OpenRouter can be used through several identities (one
+ * per email, workspace or billing owner). Each account owns its own credential
+ * pool: rotation never hops between accounts, so a 429 on one account's key
+ * cannot silently spend another account's quota.
+ *
+ * `accountId` is the stable identifier config points at; `name` is the human
+ * label and is unique per provider. Credentials can only be attached to an
+ * existing account whose provider matches.
+ */
+import { type Account, type CredentialHealth, type KeyPool, type KeyPoolOptions } from './key-pool.js';
+import type { CredentialStore } from './key-pool-store.js';
+/** CRUD over `provider_accounts` plus per-account pool resolution. */
+export declare class AccountRegistry {
+    readonly store: CredentialStore;
+    constructor(store: CredentialStore);
+    /** Register one named account; the default id is `<provider>:<name slug>`. */
+    add(input: {
+        provider: string;
+        name: string;
+        accountId?: string | null;
+        email?: string | null;
+        workspace?: string | null;
+        labels?: Record<string, unknown> | null;
+    }): Account;
+    /** Resolve an account id first, then a unique name; `null` when absent. */
+    maybeGet(ref: string): Account | null;
+    get(ref: string): Account;
+    listAccounts(provider?: string): Account[];
+    /**
+     * Partially update metadata; omitted fields keep their value. `labels: null`
+     * clears the labels, `email: null`/`workspace: null` clear those fields. The
+     * provider and account id are immutable.
+     */
+    update(ref: string, patch?: {
+        name?: string;
+        email?: string | null;
+        workspace?: string | null;
+        labels?: Record<string, unknown> | null;
+    }): Account;
+    /** Delete an account; credentials block the delete unless dropped explicitly. */
+    remove(ref: string, options?: {
+        dropCredentials?: boolean;
+    }): void;
+    /** Masked pool state for one account (safe to log). */
+    credentials(ref: string): CredentialHealth[];
+    /** The KeyPool scoped to one account (provider + account id). */
+    pool(ref: string, options?: KeyPoolOptions): KeyPool;
+}
+//# sourceMappingURL=account-registry.d.ts.map

package/build/storage/account-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-registry.d.ts","sourceRoot":"","sources":["../../src/storage/account-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,OAAO,EAAgB,KAAK,gBAAgB,EAAE,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AACpH,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAqDtE,sEAAsE;AACtE,qBAAa,eAAe;IAC1B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAE/B,YAAY,KAAK,EAAE,eAAe,EAEjC;IAED,8EAA8E;IAC9E,GAAG,CAAC,KAAK,EAAE;QACT,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE,MAAM,CAAA;QACZ,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;KACxC,GAAG,OAAO,CAcV;IAED,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAapC;IAED,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAIxB;IAED,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,EAAE,CAGzC;IAED;;;;OAIG;IACH,MAAM,CACJ,GAAG,EAAE,MAAM,EACX,KAAK,GAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;KACnC,GACL,OAAO,CAaT;IAED,iFAAiF;IACjF,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,IAAI,CAGrE;IAED,uDAAuD;IACvD,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAG3C;IAED,iEAAiE;IACjE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAGvD;CACF"}