@nimbus-dev/sdk 1.1.2

package/dist/crypto/service-account-token.js

@@ -0,0 +1,96 @@
+/**
+ * Google service-account OAuth2 access tokens via the JWT-bearer grant.
+ *
+ * Google Cloud REST APIs (App Distribution, BigQuery, …) accept a short-lived
+ * OAuth2 access token. This mints one from a service-account key (the JSON the
+ * developer downloads) by signing an RS256 JWT assertion and exchanging it at
+ * the token endpoint — no `googleapis` dependency. Shared so the gateway sync
+ * and a connector's MCP server sign identically without duplicating the flow.
+ *
+ * See: https://developers.google.com/identity/protocols/oauth2/service-account
+ */
+import { signJwt } from "./jwt";
+const SCOPE_CLOUD_PLATFORM = "https://www.googleapis.com/auth/cloud-platform";
+const DEFAULT_TOKEN_URI = "https://oauth2.googleapis.com/token";
+/** Google caps SA assertion lifetime at 1 hour. */
+const ASSERTION_TTL_SECONDS = 3600;
+const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+function asString(value) {
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+/**
+ * Parse a service-account key JSON string into the fields the JWT-bearer flow
+ * needs. Returns null on malformed JSON or a missing `client_email` /
+ * `private_key`; `token_uri` defaults to Google's endpoint when absent.
+ */
+export function parseServiceAccountJson(json) {
+    let parsed;
+    try {
+        parsed = JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== "object" || parsed === null) {
+        return null;
+    }
+    const obj = parsed;
+    const clientEmail = asString(obj["client_email"]);
+    const privateKey = asString(obj["private_key"]);
+    if (clientEmail === undefined || privateKey === undefined) {
+        return null;
+    }
+    return {
+        clientEmail,
+        privateKey,
+        tokenUri: asString(obj["token_uri"]) ?? DEFAULT_TOKEN_URI,
+    };
+}
+/**
+ * Sign an RS256 JWT assertion for the JWT-bearer grant. `nowMs` is injectable
+ * so tests can assert deterministic `iat`/`exp`; `scope` defaults to
+ * `cloud-platform`.
+ */
+export function signServiceAccountAssertion(sa, nowMs = Date.now(), scope = SCOPE_CLOUD_PLATFORM) {
+    const nowSec = Math.floor(nowMs / 1000);
+    return signJwt({
+        header: { alg: "RS256", typ: "JWT" },
+        payload: {
+            iss: sa.clientEmail,
+            scope,
+            aud: sa.tokenUri,
+            iat: nowSec,
+            exp: nowSec + ASSERTION_TTL_SECONDS,
+        },
+        privateKeyPem: sa.privateKey,
+    });
+}
+/**
+ * Exchange a service-account assertion for an OAuth2 access token. `fetchFn` and
+ * `nowMs` are injectable for tests; the live path uses the global `fetch`.
+ * Returns null when the token endpoint declines the assertion.
+ */
+export async function mintGoogleAccessToken(sa, fetchFn = globalThis.fetch, nowMs = Date.now(), scope = SCOPE_CLOUD_PLATFORM) {
+    const assertion = signServiceAccountAssertion(sa, nowMs, scope);
+    const body = new URLSearchParams({ grant_type: JWT_BEARER_GRANT, assertion }).toString();
+    const res = await fetchFn(sa.tokenUri, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body,
+    });
+    if (!res.ok) {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = (await res.json());
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== "object" || parsed === null) {
+        return null;
+    }
+    return asString(parsed["access_token"]) ?? null;
+}
+//# sourceMappingURL=service-account-token.js.map

package/dist/crypto/service-account-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account-token.js","sourceRoot":"","sources":["../../src/crypto/service-account-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAEhC,MAAM,oBAAoB,GAAG,gDAAgD,CAAC;AAC9E,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;AAChE,mDAAmD;AACnD,MAAM,qBAAqB,GAAG,IAAI,CAAC;AACnC,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AAQvE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAChD,IAAI,WAAW,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,WAAW;QACX,UAAU;QACV,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,iBAAiB;KAC1D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,EAAwB,EACxB,QAAgB,IAAI,CAAC,GAAG,EAAE,EAC1B,QAAgB,oBAAoB;IAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC;QACb,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE;QACpC,OAAO,EAAE;YACP,GAAG,EAAE,EAAE,CAAC,WAAW;YACnB,KAAK;YACL,GAAG,EAAE,EAAE,CAAC,QAAQ;YAChB,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,MAAM,GAAG,qBAAqB;SACpC;QACD,aAAa,EAAE,EAAE,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC;AAID;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAwB,EACxB,UAAqB,UAAU,CAAC,KAAkB,EAClD,QAAgB,IAAI,CAAC,GAAG,EAAE,EAC1B,QAAgB,oBAAoB;IAEpC,MAAM,SAAS,GAAG,2BAA2B,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI;KACL,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAE,MAAkC,CAAC,cAAc,CAAC,CAAC,IAAI,IAAI,CAAC;AAC/E,CAAC"}

package/dist/crypto/verify-signature.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Ed25519 sign + verify primitives for extension manifest signatures.
+ * Connector authors use this to sign manifests; the gateway uses it to verify
+ * at install + every startup (I16 wiring sites).
+ */
+export declare class PublisherKeyMismatch extends Error {
+    readonly name = "PublisherKeyMismatch";
+}
+export declare class SignatureInvalidFormat extends Error {
+    readonly name = "SignatureInvalidFormat";
+}
+export declare class SignatureInvalid extends Error {
+    readonly name = "SignatureInvalid";
+}
+export type SignatureDisableReason = "publisher_key_missing" | "publisher_key_mismatch" | "signature_failed" | "signature_malformed";
+export declare function encodeBase64(bytes: Uint8Array): string;
+export declare function decodeBase64(s: string): Uint8Array;
+type SignedManifestShape = {
+    publisher?: {
+        id: string;
+        key: string;
+    };
+    signature?: string;
+    [k: string]: unknown;
+};
+/**
+ * Verify `manifest.signature` against the canonical bytes of the manifest
+ * (with `signature` stripped), the declared `manifest.publisher.key`, and
+ * the externally-resolved `resolvedPubkey`. Throws on any mismatch.
+ *
+ * Caller must check `manifest.publisher !== undefined` first — this function
+ * does not gate the unsigned case.
+ */
+export declare function verifyManifestSignature(manifest: SignedManifestShape, resolvedPubkey: Uint8Array): Promise<void>;
+/**
+ * Deterministically sign a manifest's canonical bytes with `privkey` (32-byte
+ * Ed25519 seed). Returns the 64-byte signature as base64. Any existing
+ * `signature` field on the manifest is ignored (stripped by
+ * `canonicalizeManifest`).
+ */
+export declare function signManifest(manifest: SignedManifestShape, privkey: Uint8Array): Promise<string>;
+/**
+ * Generate a fresh Ed25519 keypair via WebCrypto and export both halves as
+ * raw 32-byte arrays. Used by `nimbus extension keygen` and by every test
+ * fixture (no committed crypto material — see spec §6.3).
+ */
+export declare function generateEd25519Keypair(): {
+    privkey: Uint8Array;
+    pubkey: Uint8Array;
+};
+/**
+ * Map a verification error class to the `SignatureDisableReason` string the
+ * `SignatureDisabledRegistry` (hard-disable.ts) records.
+ */
+export declare function errorToHardDisableReason(err: unknown): SignatureDisableReason;
+export {};
+//# sourceMappingURL=verify-signature.d.ts.map

package/dist/crypto/verify-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-signature.d.ts","sourceRoot":"","sources":["../../src/crypto/verify-signature.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAkB,IAAI,0BAA0B;CACjD;AACD,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,SAAkB,IAAI,4BAA4B;CACnD;AACD,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;CAC7C;AAED,MAAM,MAAM,sBAAsB,GAC9B,uBAAuB,GACvB,wBAAwB,GACxB,kBAAkB,GAClB,qBAAqB,CAAC;AAE1B,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEtD;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAElD;AAWD,KAAK,mBAAmB,GAAG;IACzB,SAAS,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,mBAAmB,EAC7B,cAAc,EAAE,UAAU,GACzB,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAQpF;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAK7E"}

package/dist/crypto/verify-signature.js

@@ -0,0 +1,102 @@
+/**
+ * Ed25519 sign + verify primitives for extension manifest signatures.
+ * Connector authors use this to sign manifests; the gateway uses it to verify
+ * at install + every startup (I16 wiring sites).
+ */
+import { canonicalizeManifest } from "./canonical-json";
+export class PublisherKeyMismatch extends Error {
+    name = "PublisherKeyMismatch";
+}
+export class SignatureInvalidFormat extends Error {
+    name = "SignatureInvalidFormat";
+}
+export class SignatureInvalid extends Error {
+    name = "SignatureInvalid";
+}
+export function encodeBase64(bytes) {
+    return Buffer.from(bytes).toString("base64");
+}
+export function decodeBase64(s) {
+    return new Uint8Array(Buffer.from(s, "base64"));
+}
+function constantTimeBytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
+    }
+    return diff === 0;
+}
+/**
+ * Verify `manifest.signature` against the canonical bytes of the manifest
+ * (with `signature` stripped), the declared `manifest.publisher.key`, and
+ * the externally-resolved `resolvedPubkey`. Throws on any mismatch.
+ *
+ * Caller must check `manifest.publisher !== undefined` first — this function
+ * does not gate the unsigned case.
+ */
+export async function verifyManifestSignature(manifest, resolvedPubkey) {
+    if (manifest.publisher === undefined || manifest.signature === undefined) {
+        throw new Error("verifyManifestSignature called on unsigned manifest — caller must check first");
+    }
+    if (resolvedPubkey.length !== 32)
+        throw new SignatureInvalidFormat();
+    const declaredPubkey = decodeBase64(manifest.publisher.key);
+    if (declaredPubkey.length !== 32)
+        throw new SignatureInvalidFormat();
+    if (!constantTimeBytesEqual(declaredPubkey, resolvedPubkey)) {
+        throw new PublisherKeyMismatch();
+    }
+    const sig = decodeBase64(manifest.signature);
+    if (sig.length !== 64)
+        throw new SignatureInvalidFormat();
+    const canonical = canonicalizeManifest(manifest);
+    const cryptoKey = await crypto.subtle.importKey("raw", new Uint8Array(resolvedPubkey), { name: "Ed25519" }, false, ["verify"]);
+    const ok = await crypto.subtle.verify("Ed25519", cryptoKey, new Uint8Array(sig), new Uint8Array(canonical));
+    if (!ok)
+        throw new SignatureInvalid();
+}
+/**
+ * Deterministically sign a manifest's canonical bytes with `privkey` (32-byte
+ * Ed25519 seed). Returns the 64-byte signature as base64. Any existing
+ * `signature` field on the manifest is ignored (stripped by
+ * `canonicalizeManifest`).
+ */
+export async function signManifest(manifest, privkey) {
+    if (privkey.length !== 32)
+        throw new SignatureInvalidFormat();
+    const d = Buffer.from(privkey).toString("base64url");
+    const cryptoKey = await crypto.subtle.importKey("jwk", { kty: "OKP", crv: "Ed25519", d }, { name: "Ed25519" }, false, ["sign"]);
+    const canonical = canonicalizeManifest(manifest);
+    const sig = await crypto.subtle.sign("Ed25519", cryptoKey, new Uint8Array(canonical));
+    return encodeBase64(new Uint8Array(sig));
+}
+/**
+ * Generate a fresh Ed25519 keypair via WebCrypto and export both halves as
+ * raw 32-byte arrays. Used by `nimbus extension keygen` and by every test
+ * fixture (no committed crypto material — see spec §6.3).
+ */
+export function generateEd25519Keypair() {
+    const nodeCrypto = require("node:crypto");
+    const { privateKey, publicKey } = nodeCrypto.generateKeyPairSync("ed25519");
+    const privJwk = privateKey.export({ format: "jwk" });
+    const pubJwk = publicKey.export({ format: "jwk" });
+    const privkey = new Uint8Array(Buffer.from(privJwk.d, "base64url"));
+    const pubkey = new Uint8Array(Buffer.from(pubJwk.x, "base64url"));
+    return { privkey, pubkey };
+}
+/**
+ * Map a verification error class to the `SignatureDisableReason` string the
+ * `SignatureDisabledRegistry` (hard-disable.ts) records.
+ */
+export function errorToHardDisableReason(err) {
+    if (err instanceof PublisherKeyMismatch)
+        return "publisher_key_mismatch";
+    if (err instanceof SignatureInvalidFormat)
+        return "signature_malformed";
+    if (err instanceof SignatureInvalid)
+        return "signature_failed";
+    return "signature_failed";
+}
+//# sourceMappingURL=verify-signature.js.map

package/dist/crypto/verify-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-signature.js","sourceRoot":"","sources":["../../src/crypto/verify-signature.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC3B,IAAI,GAAG,sBAAsB,CAAC;CACjD;AACD,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC7B,IAAI,GAAG,wBAAwB,CAAC;CACnD;AACD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,kBAAkB,CAAC;CAC7C;AAQD,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAa,EAAE,CAAa;IAC1D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAA6B,EAC7B,cAA0B;IAE1B,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,sBAAsB,EAAE,CAAC;IACrE,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,sBAAsB,EAAE,CAAC;IACrE,IAAI,CAAC,sBAAsB,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,sBAAsB,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,IAAI,UAAU,CAAC,cAAc,CAAC,EAC9B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACnC,SAAS,EACT,SAAS,EACT,IAAI,UAAU,CAAC,GAAG,CAAC,EACnB,IAAI,UAAU,CAAC,SAAS,CAAC,CAC1B,CAAC;IACF,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA6B,EAC7B,OAAmB;IAEnB,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,sBAAsB,EAAE,CAAC;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,EACjC,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACtF,OAAO,YAAY,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,UAAU,GAAiC,OAAO,CAAC,aAAa,CAAC,CAAC;IACxE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAkB,CAAC;IACtE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAkB,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAClE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACnD,IAAI,GAAG,YAAY,oBAAoB;QAAE,OAAO,wBAAwB,CAAC;IACzE,IAAI,GAAG,YAAY,sBAAsB;QAAE,OAAO,qBAAqB,CAAC;IACxE,IAAI,GAAG,YAAY,gBAAgB;QAAE,OAAO,kBAAkB,CAAC;IAC/D,OAAO,kBAAkB,CAAC;AAC5B,CAAC"}

package/dist/distribution-channel.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Channels a Nimbus binary can be distributed through. When Nimbus runs from a
+ * package-manager install, the self-updater steps aside so the package manager
+ * owns updates.
+ *
+ * Lives in the SDK so the gateway and CLI share one copy: the `cli` package
+ * reaches the gateway over IPC only (no source imports), so a shared pure helper
+ * must live in a package both may depend on — the same pattern the manifest
+ * signer uses.
+ */
+export type DistributionChannel = "homebrew" | "scoop" | "winget" | "apt" | "yum" | "msi" | "pkg";
+export interface ResolveChannelOptions {
+    /** Defaults to `process.env`. */
+    env?: Record<string, string | undefined>;
+    /** Defaults to `process.execPath`. */
+    execPath?: string;
+    /**
+     * Resolves symlinks so a package manager's real install path (e.g. Homebrew's
+     * Cellar) is inspected rather than the `bin` symlink that launched the process.
+     * Injectable for tests; defaults to a safe `realpathSync` that falls back to the
+     * input path if resolution fails.
+     */
+    realpath?: (p: string) => string;
+}
+/**
+ * Resolve the distribution channel this binary was installed through, or `null`
+ * for a plain/direct-download install (where the self-updater stays enabled).
+ * An explicit `NIMBUS_DISTRIBUTION_CHANNEL` env marker takes precedence over
+ * path heuristics; an unknown marker value is ignored.
+ */
+export declare function resolveDistributionChannel(opts?: ResolveChannelOptions): DistributionChannel | null;
+/** Human-facing upgrade hint per channel, used by `nimbus update`. */
+export declare function channelUpgradeHint(channel: DistributionChannel): string;
+//# sourceMappingURL=distribution-channel.d.ts.map

package/dist/distribution-channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distribution-channel.d.ts","sourceRoot":"","sources":["../src/distribution-channel.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAYlG,MAAM,WAAW,qBAAqB;IACpC,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;CAClC;AAmCD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,GAAE,qBAA0B,GAC/B,mBAAmB,GAAG,IAAI,CAK5B;AAED,sEAAsE;AACtE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAiBvE"}

package/dist/distribution-channel.js

@@ -0,0 +1,73 @@
+import { realpathSync } from "node:fs";
+const KNOWN_CHANNELS = new Set([
+    "homebrew",
+    "scoop",
+    "winget",
+    "apt",
+    "yum",
+    "msi",
+    "pkg",
+]);
+function safeRealpath(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+function fromEnv(env) {
+    const raw = env["NIMBUS_DISTRIBUTION_CHANNEL"];
+    if (raw && KNOWN_CHANNELS.has(raw)) {
+        return raw;
+    }
+    return null;
+}
+function fromPath(execPath, realpath) {
+    // Resolve symlinks first: package managers expose the binary via a symlink whose
+    // own path may not contain the tell-tale Cellar/apps segment.
+    const resolved = realpath(execPath);
+    const p = resolved.replaceAll("\\", "/").toLowerCase();
+    // Homebrew: macOS `/opt/homebrew/Cellar/...` or `/usr/local/Cellar/...`,
+    // Linuxbrew `/home/linuxbrew/.linuxbrew/...`.
+    if (p.includes("/cellar/") || p.includes("/.linuxbrew/")) {
+        return "homebrew";
+    }
+    // Scoop: `~/scoop/apps/<app>/...`.
+    if (p.includes("/scoop/apps/")) {
+        return "scoop";
+    }
+    return null;
+}
+/**
+ * Resolve the distribution channel this binary was installed through, or `null`
+ * for a plain/direct-download install (where the self-updater stays enabled).
+ * An explicit `NIMBUS_DISTRIBUTION_CHANNEL` env marker takes precedence over
+ * path heuristics; an unknown marker value is ignored.
+ */
+export function resolveDistributionChannel(opts = {}) {
+    const env = opts.env ?? process.env;
+    const execPath = opts.execPath ?? process.execPath;
+    const realpath = opts.realpath ?? safeRealpath;
+    return fromEnv(env) ?? fromPath(execPath, realpath);
+}
+/** Human-facing upgrade hint per channel, used by `nimbus update`. */
+export function channelUpgradeHint(channel) {
+    switch (channel) {
+        case "homebrew":
+            return "Installed via Homebrew — run 'brew upgrade nimbus' to update.";
+        case "scoop":
+            return "Installed via Scoop — run 'scoop update nimbus' to update.";
+        case "winget":
+            return "Installed via winget — run 'winget upgrade NimbusAgent.Nimbus' to update.";
+        case "apt":
+            return "Installed via apt — run 'sudo apt update && sudo apt upgrade nimbus' to update.";
+        case "yum":
+            return "Installed via dnf/yum — run 'sudo dnf upgrade nimbus' to update.";
+        case "msi":
+            return "Installed via the Windows installer — download the latest .msi from the releases page.";
+        case "pkg":
+            return "Installed via the macOS installer — download the latest .pkg from the releases page.";
+    }
+}
+//# sourceMappingURL=distribution-channel.js.map

package/dist/distribution-channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"distribution-channel.js","sourceRoot":"","sources":["../src/distribution-channel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAcvC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAsB;IAClD,UAAU;IACV,OAAO;IACP,QAAQ;IACR,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;CACmC,CAAC,CAAC;AAgB5C,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAuC;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC/C,IAAI,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,GAA0B,CAAC,EAAE,CAAC;QAC1D,OAAO,GAA0B,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,QAA+B;IACjE,iFAAiF;IACjF,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,yEAAyE;IACzE,8CAA8C;IAC9C,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACzD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,mCAAmC;IACnC,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,UAAU;YACb,OAAO,+DAA+D,CAAC;QACzE,KAAK,OAAO;YACV,OAAO,4DAA4D,CAAC;QACtE,KAAK,QAAQ;YACX,OAAO,2EAA2E,CAAC;QACrF,KAAK,KAAK;YACR,OAAO,iFAAiF,CAAC;QAC3F,KAAK,KAAK;YACR,OAAO,kEAAkE,CAAC;QAC5E,KAAK,KAAK;YACR,OAAO,wFAAwF,CAAC;QAClG,KAAK,KAAK;YACR,OAAO,sFAAsF,CAAC;IAClG,CAAC;AACH,CAAC"}

package/dist/hitl-request.d.ts

@@ -0,0 +1,7 @@
+export interface HitlRequest {
+    actionId: string;
+    summary: string;
+    diff?: string;
+}
+export declare function isHitlRequest(value: unknown): value is HitlRequest;
+//# sourceMappingURL=hitl-request.d.ts.map

package/dist/hitl-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl-request.d.ts","sourceRoot":"","sources":["../src/hitl-request.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAelE"}

package/dist/hitl-request.js

@@ -0,0 +1,15 @@
+export function isHitlRequest(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const candidate = value;
+    const actionId = candidate["actionId"];
+    const summary = candidate["summary"];
+    const diff = candidate["diff"];
+    return (typeof actionId === "string" &&
+        actionId.length > 0 &&
+        typeof summary === "string" &&
+        summary.length > 0 &&
+        (diff === undefined || typeof diff === "string"));
+}
+//# sourceMappingURL=hitl-request.js.map

package/dist/hitl-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl-request.js","sourceRoot":"","sources":["../src/hitl-request.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,CACL,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,MAAM,GAAG,CAAC;QACnB,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CACjD,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @nimbus-dev/sdk v1.0.0 — Plugin API v1 (stable baseline)
+ * MIT License
+ *
+ * Typed scaffolding for building Nimbus extensions (MCP connectors).
+ * See CHANGELOG.md for the stable surface guarantee.
+ */
+export type { AuditEmit, AuditLogger } from "./audit-logger";
+export { createScopedAuditLogger } from "./audit-logger";
+export { assertNoRowDataTools, ExtensionContractError, ROW_DATA_TOOL_SEGMENTS, type RowDataToolCandidate, runContractTests, } from "./contract-tests";
+export { type AppStoreConnectJwtParams, signAppStoreConnectJwt, } from "./crypto/app-store-connect-jwt";
+export { canonicalize, canonicalizeManifest, ManifestNestedTooDeep, NonIntegerNumberInManifest, UnsupportedManifestValueType, } from "./crypto/canonical-json";
+export { base64UrlJson, type SignJwtOptions, signJwt } from "./crypto/jwt";
+export { type FetchLike, type GoogleServiceAccount, mintGoogleAccessToken, parseServiceAccountJson, signServiceAccountAssertion, } from "./crypto/service-account-token";
+export type { SignatureDisableReason } from "./crypto/verify-signature";
+export { decodeBase64, encodeBase64, errorToHardDisableReason, generateEd25519Keypair, PublisherKeyMismatch, SignatureInvalid, SignatureInvalidFormat, signManifest, verifyManifestSignature, } from "./crypto/verify-signature";
+export { channelUpgradeHint, type DistributionChannel, type ResolveChannelOptions, resolveDistributionChannel, } from "./distribution-channel";
+export type { HitlRequest } from "./hitl-request";
+export { isHitlRequest } from "./hitl-request";
+export { NimbusExtensionServer } from "./server";
+export { MockGateway } from "./testing/index";
+export type { ExtensionManifest, NimbusItem } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,wBAAwB,EAC7B,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EACL,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,YAAY,EACZ,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -0,0 +1,19 @@
+/**
+ * @nimbus-dev/sdk v1.0.0 — Plugin API v1 (stable baseline)
+ * MIT License
+ *
+ * Typed scaffolding for building Nimbus extensions (MCP connectors).
+ * See CHANGELOG.md for the stable surface guarantee.
+ */
+export { createScopedAuditLogger } from "./audit-logger";
+export { assertNoRowDataTools, ExtensionContractError, ROW_DATA_TOOL_SEGMENTS, runContractTests, } from "./contract-tests";
+export { signAppStoreConnectJwt, } from "./crypto/app-store-connect-jwt";
+export { canonicalize, canonicalizeManifest, ManifestNestedTooDeep, NonIntegerNumberInManifest, UnsupportedManifestValueType, } from "./crypto/canonical-json";
+export { base64UrlJson, signJwt } from "./crypto/jwt";
+export { mintGoogleAccessToken, parseServiceAccountJson, signServiceAccountAssertion, } from "./crypto/service-account-token";
+export { decodeBase64, encodeBase64, errorToHardDisableReason, generateEd25519Keypair, PublisherKeyMismatch, SignatureInvalid, SignatureInvalidFormat, signManifest, verifyManifestSignature, } from "./crypto/verify-signature";
+export { channelUpgradeHint, resolveDistributionChannel, } from "./distribution-channel";
+export { isHitlRequest } from "./hitl-request";
+export { NimbusExtensionServer } from "./server";
+export { MockGateway } from "./testing/index";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EAEtB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAuB,OAAO,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAGL,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,YAAY,EACZ,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,EAGlB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/ipc/index.d.ts

@@ -0,0 +1,2 @@
+export { IPC_MAX_LINE_BYTES, NdjsonLineReader, type NdjsonLineReaderOptions, } from "./ndjson-line-reader.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/ipc/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ipc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,uBAAuB,GAC7B,MAAM,yBAAyB,CAAC"}

package/dist/ipc/index.js

@@ -0,0 +1,2 @@
+export { IPC_MAX_LINE_BYTES, NdjsonLineReader, } from "./ndjson-line-reader.js";
+//# sourceMappingURL=index.js.map

package/dist/ipc/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ipc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC"}

package/dist/ipc/ndjson-line-reader.d.ts

@@ -0,0 +1,20 @@
+/** Max bytes per NDJSON line (UTF-8), aligned with IPC protocol limits. */
+export declare const IPC_MAX_LINE_BYTES: number;
+export type NdjsonLineReaderOptions = {
+    /** When set, oversized lines throw this type instead of `Error`. */
+    lineLimitError?: new (message: string) => Error;
+};
+/**
+ * Buffers UTF-8 chunks and emits complete non-empty lines (trailing `\r` stripped).
+ * Shared by Gateway JSON-RPC and the CLI IPC client.
+ */
+export declare class NdjsonLineReader {
+    private readonly lineLimitCtor;
+    private readonly decoder;
+    private pending;
+    constructor(opts?: NdjsonLineReaderOptions);
+    private throwLineTooLong;
+    push(chunk: Uint8Array): string[];
+    flush(): string[];
+}
+//# sourceMappingURL=ndjson-line-reader.d.ts.map

package/dist/ipc/ndjson-line-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ndjson-line-reader.d.ts","sourceRoot":"","sources":["../../src/ipc/ndjson-line-reader.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAM9C,MAAM,MAAM,uBAAuB,GAAG;IACpC,oEAAoE;IACpE,cAAc,CAAC,EAAE,KACf,OAAO,EAAE,MAAM,KACZ,KAAK,CAAC;CACZ,CAAC;AAEF;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAEnB;IACX,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IACtE,OAAO,CAAC,OAAO,CAAM;gBAET,IAAI,GAAE,uBAA4B;IAI9C,OAAO,CAAC,gBAAgB;IAIxB,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE;IAyBjC,KAAK,IAAI,MAAM,EAAE;CAWlB"}

package/dist/ipc/ndjson-line-reader.js

@@ -0,0 +1,56 @@
+/** Max bytes per NDJSON line (UTF-8), aligned with IPC protocol limits. */
+export const IPC_MAX_LINE_BYTES = 1024 * 1024;
+function byteLengthUtf8(s) {
+    return new TextEncoder().encode(s).length;
+}
+/**
+ * Buffers UTF-8 chunks and emits complete non-empty lines (trailing `\r` stripped).
+ * Shared by Gateway JSON-RPC and the CLI IPC client.
+ */
+export class NdjsonLineReader {
+    lineLimitCtor;
+    decoder = new TextDecoder("utf-8", { fatal: false });
+    pending = "";
+    constructor(opts = {}) {
+        this.lineLimitCtor = opts.lineLimitError ?? Error;
+    }
+    throwLineTooLong(message) {
+        throw new this.lineLimitCtor(message);
+    }
+    push(chunk) {
+        this.pending += this.decoder.decode(chunk, { stream: true });
+        const out = [];
+        while (true) {
+            const nl = this.pending.indexOf("\n");
+            if (nl < 0) {
+                break;
+            }
+            const line = this.pending.slice(0, nl);
+            this.pending = this.pending.slice(nl + 1);
+            const trimmed = line.endsWith("\r") ? line.slice(0, -1) : line;
+            if (trimmed.length === 0) {
+                continue;
+            }
+            if (byteLengthUtf8(trimmed) > IPC_MAX_LINE_BYTES) {
+                this.throwLineTooLong("Message exceeds 1MB line limit");
+            }
+            out.push(trimmed);
+        }
+        if (byteLengthUtf8(this.pending) > IPC_MAX_LINE_BYTES) {
+            this.throwLineTooLong("Message exceeds 1MB line limit");
+        }
+        return out;
+    }
+    flush() {
+        const rest = this.pending + this.decoder.decode();
+        this.pending = "";
+        if (rest.length === 0) {
+            return [];
+        }
+        if (byteLengthUtf8(rest) > IPC_MAX_LINE_BYTES) {
+            this.throwLineTooLong("Message exceeds 1MB line limit");
+        }
+        return [rest.endsWith("\r") ? rest.slice(0, -1) : rest];
+    }
+}
+//# sourceMappingURL=ndjson-line-reader.js.map

package/dist/ipc/ndjson-line-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ndjson-line-reader.js","sourceRoot":"","sources":["../../src/ipc/ndjson-line-reader.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC5C,CAAC;AASD;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IACV,aAAa,CAEnB;IACM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,OAAO,GAAG,EAAE,CAAC;IAErB,YAAY,OAAgC,EAAE;QAC5C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC;IACpD,CAAC;IAEO,gBAAgB,CAAC,OAAe;QACtC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,KAAiB;QACpB,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBACX,MAAM;YACR,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,kBAAkB,EAAE,CAAC;gBACjD,IAAI,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,CAAC;YAC1D,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,kBAAkB,EAAE,CAAC;YACtD,IAAI,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAClD,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,kBAAkB,EAAE,CAAC;YAC9C,IAAI,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/server.d.ts

@@ -0,0 +1,29 @@
+/**
+ * NimbusExtensionServer — base class for all Nimbus MCP extension servers
+ *
+ * Usage:
+ *   const server = new NimbusExtensionServer({ manifest, onAuth });
+ *   server.registerTool("search", { description, inputSchema, handler });
+ *   server.start();
+ */
+import type { ExtensionManifest } from "./types";
+export interface ExtensionServerOptions<TClient> {
+    manifest: ExtensionManifest;
+    onAuth?: (ctx: {
+        accessToken: string;
+    }) => TClient;
+}
+export interface ToolDefinition<TInput, TClient> {
+    description: string;
+    inputSchema: Record<string, unknown>;
+    handler: (input: TInput, ctx: {
+        client: TClient;
+    }) => Promise<unknown>;
+}
+export declare class NimbusExtensionServer<TClient = unknown> {
+    private readonly _options;
+    constructor(options: ExtensionServerOptions<TClient>);
+    registerTool<TInput>(_name: string, _definition: ToolDefinition<TInput, TClient>): void;
+    start(): void;
+}
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD,MAAM,WAAW,sBAAsB,CAAC,OAAO;IAC7C,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;CACpD;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,EAAE,OAAO;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxE;AAED,qBAAa,qBAAqB,CAAC,OAAO,GAAG,OAAO;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;gBAE/C,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC;IAIpD,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAIvF,KAAK,IAAI,IAAI;CAKd"}