@opengsd/cloud-mcp-gateway 1.2.0

package/README.md

@@ -0,0 +1,72 @@
+# @opengsd/cloud-mcp-gateway
+
+Cloud-hosted MCP gateway for brokering remote MCP clients to a paired Local GSD Runtime.
+
+The gateway is a live routing layer. It does not host workspaces, clone source code, store `.gsd` artifacts, or run GSD workflows itself.
+
+## Local Smoke Test
+
+Build and start the gateway with persistent auth storage:
+
+```bash
+export GSD_CLOUD_USER_TOKEN="$(openssl rand -hex 32)"
+npm run build -w @opengsd/cloud-mcp-gateway
+node packages/cloud-mcp-gateway/dist/cli.js \
+  --port 8787 \
+  --auth-store ./.tmp/gsd-cloud-auth.json
+```
+
+Create a pairing code:
+
+```bash
+curl -s -X POST http://localhost:8787/pairing-codes \
+  -H "Authorization: Bearer $GSD_CLOUD_USER_TOKEN" \
+  -H 'Content-Type: application/json'
+```
+
+Pair and connect the local daemon with the returned code:
+
+```bash
+npm run build -w @opengsd/daemon
+node packages/daemon/dist/cli.js cloud pair \
+  --gateway http://localhost:8787 \
+  --code <CODE> \
+  --runtime-name local-dev
+
+node packages/daemon/dist/cli.js cloud connect --verbose
+```
+
+List projects through MCP:
+
+```bash
+node --input-type=module <<'NODE'
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+
+const client = new Client({ name: "gateway-smoke", version: "0.0.1" });
+const transport = new StreamableHTTPClientTransport(
+  new URL("http://localhost:8787/mcp"),
+  { requestInit: { headers: { Authorization: `Bearer ${process.env.GSD_CLOUD_USER_TOKEN}` } } },
+);
+
+await client.connect(transport);
+const result = await client.callTool({ name: "gsd_cloud_projects", arguments: {} });
+console.log(result.content[0].text);
+await client.close();
+NODE
+```
+
+## Auth Storage
+
+By default, the gateway uses in-memory auth state for local development and tests.
+
+For persistent auth state, set one of:
+
+```bash
+node packages/cloud-mcp-gateway/dist/cli.js --auth-store /secure/path/gsd-cloud-auth.json
+GSD_CLOUD_AUTH_STORE_PATH=/secure/path/gsd-cloud-auth.json node packages/cloud-mcp-gateway/dist/cli.js
+```
+
+The auth store persists user tokens, device tokens, and pairing codes as salted scrypt-derived hashes. Raw bearer tokens and device tokens are not written to disk.
+
+`GSD_CLOUD_USER_TOKEN` seeds the initial user bearer token and is required at startup.

package/bin/gsd-cloud-mcp-gateway.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const binDir = dirname(fileURLToPath(import.meta.url));
+const target = join(binDir, '..', 'dist', 'cli.js');
+
+if (!existsSync(target)) {
+  process.stderr.write('gsd-cloud-mcp-gateway: build output missing. Run `pnpm --filter @opengsd/cloud-mcp-gateway run build`.\n');
+  process.exit(1);
+}
+
+await import('../dist/cli.js');

package/dist/auth-store.d.ts

@@ -0,0 +1,62 @@
+export interface UserTokenRecord {
+    userId: string;
+    revoked?: boolean;
+}
+export interface DeviceTokenRecord {
+    userId: string;
+    runtimeId: string;
+    runtimeName?: string;
+    revoked?: boolean;
+}
+export interface PairingCodeRecord {
+    userId: string;
+    expiresAt: number;
+}
+export interface DeviceTokenIssue {
+    userId: string;
+    runtimeId: string;
+    deviceToken: string;
+}
+export interface AuthStoreSnapshot {
+    version: 1;
+    userTokens: Array<UserTokenRecord & SecretHashRecord>;
+    deviceTokens: Array<DeviceTokenRecord & SecretHashRecord>;
+    pairingCodes: Array<PairingCodeRecord & SecretHashRecord>;
+}
+export interface SecretHashRecord {
+    secretHash: string;
+    secretSalt: string;
+}
+export declare class InMemoryAuthStore {
+    protected readonly userTokens: Map<string, UserTokenRecord & SecretHashRecord>;
+    protected readonly deviceTokens: Map<string, DeviceTokenRecord & SecretHashRecord>;
+    protected readonly pairingCodes: Map<string, PairingCodeRecord & SecretHashRecord>;
+    constructor(seedUserToken?: {
+        token: string;
+        userId: string;
+    }, snapshot?: AuthStoreSnapshot);
+    addUserToken(token: string, userId: string): void;
+    authenticateUser(token: string | undefined): string | null;
+    authenticateDevice(token: string | undefined): DeviceTokenRecord | null;
+    createPairingCode(userId: string, ttlMs?: number): {
+        code: string;
+        expiresAt: number;
+    };
+    exchangePairingCode(code: string, runtimeName?: string): DeviceTokenIssue;
+    revokeDeviceToken(deviceToken: string): boolean;
+    snapshot(): AuthStoreSnapshot;
+    protected afterMutation(): void;
+    private loadSnapshot;
+}
+export declare class FileAuthStore extends InMemoryAuthStore {
+    private readonly filePath;
+    constructor(filePath: string, seedUserToken?: {
+        token: string;
+        userId: string;
+    });
+    protected afterMutation(): void;
+    private persist;
+}
+export declare function extractBearerToken(header: string | string[] | undefined): string | undefined;
+export declare function deriveSecretHash(secret: string, secretSalt?: string): SecretHashRecord;
+//# sourceMappingURL=auth-store.d.ts.map

package/dist/auth-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,KAAK,CAAC,eAAe,GAAG,gBAAgB,CAAC,CAAC;IACtD,YAAY,EAAE,KAAK,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,CAAC;IAC1D,YAAY,EAAE,KAAK,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,iBAAiB;IAC5B,SAAS,CAAC,QAAQ,CAAC,UAAU,kDAAyD;IACtF,SAAS,CAAC,QAAQ,CAAC,YAAY,oDAA2D;IAC1F,SAAS,CAAC,QAAQ,CAAC,YAAY,oDAA2D;gBAE9E,aAAa,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,QAAQ,CAAC,EAAE,iBAAiB;IAK3F,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQjD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAO1D,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI;IAOvE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAiB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAS9F,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB;IAkBzE,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAQ/C,QAAQ,IAAI,iBAAiB;IAS7B,SAAS,CAAC,aAAa,IAAI,IAAI;IAI/B,OAAO,CAAC,YAAY;CAarB;AAED,qBAAa,aAAc,SAAQ,iBAAiB;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAGhC,QAAQ,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;cAQhC,aAAa,IAAI,IAAI;IAIxC,OAAO,CAAC,OAAO;CAMhB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAgB5F;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,SAAkC,GAAG,gBAAgB,CAK/G"}

package/dist/auth-store.js

@@ -0,0 +1,171 @@
+import { randomBytes, randomUUID, scryptSync, timingSafeEqual } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+export class InMemoryAuthStore {
+    userTokens = new Map();
+    deviceTokens = new Map();
+    pairingCodes = new Map();
+    constructor(seedUserToken, snapshot) {
+        if (snapshot)
+            this.loadSnapshot(snapshot);
+        if (seedUserToken)
+            this.addUserToken(seedUserToken.token, seedUserToken.userId);
+    }
+    addUserToken(token, userId) {
+        const existing = findSecretRecord(this.userTokens, token);
+        if (existing?.userId === userId && !existing.revoked)
+            return;
+        const key = deriveSecretHash(token);
+        this.userTokens.set(key.secretHash, { ...key, userId });
+        this.afterMutation();
+    }
+    authenticateUser(token) {
+        if (!token)
+            return null;
+        const record = findSecretRecord(this.userTokens, token);
+        if (!record || record.revoked)
+            return null;
+        return record.userId;
+    }
+    authenticateDevice(token) {
+        if (!token)
+            return null;
+        const record = findSecretRecord(this.deviceTokens, token);
+        if (!record || record.revoked)
+            return null;
+        return record;
+    }
+    createPairingCode(userId, ttlMs = 10 * 60 * 1000) {
+        const code = randomBytes(4).toString("hex").toUpperCase();
+        const expiresAt = Date.now() + ttlMs;
+        const key = deriveSecretHash(code);
+        this.pairingCodes.set(key.secretHash, { ...key, userId, expiresAt });
+        this.afterMutation();
+        return { code, expiresAt };
+    }
+    exchangePairingCode(code, runtimeName) {
+        const normalized = code.trim().toUpperCase();
+        const codeEntry = findSecretEntry(this.pairingCodes, normalized);
+        if (!codeEntry || codeEntry[1].expiresAt < Date.now()) {
+            if (codeEntry)
+                this.pairingCodes.delete(codeEntry[0]);
+            this.afterMutation();
+            throw new Error("Pairing code is invalid or expired");
+        }
+        const [codeHash, record] = codeEntry;
+        this.pairingCodes.delete(codeHash);
+        const runtimeId = `rt_${randomUUID()}`;
+        const deviceToken = `gsd_dev_${randomBytes(32).toString("hex")}`;
+        const key = deriveSecretHash(deviceToken);
+        this.deviceTokens.set(key.secretHash, { ...key, userId: record.userId, runtimeId, runtimeName });
+        this.afterMutation();
+        return { userId: record.userId, runtimeId, deviceToken };
+    }
+    revokeDeviceToken(deviceToken) {
+        const record = findSecretRecord(this.deviceTokens, deviceToken);
+        if (!record)
+            return false;
+        record.revoked = true;
+        this.afterMutation();
+        return true;
+    }
+    snapshot() {
+        return {
+            version: 1,
+            userTokens: Array.from(this.userTokens.values()),
+            deviceTokens: Array.from(this.deviceTokens.values()),
+            pairingCodes: Array.from(this.pairingCodes.values()),
+        };
+    }
+    afterMutation() {
+        // Extension point for persistent stores.
+    }
+    loadSnapshot(snapshot) {
+        for (const record of snapshot.userTokens ?? []) {
+            this.userTokens.set(record.secretHash, record);
+        }
+        for (const record of snapshot.deviceTokens ?? []) {
+            this.deviceTokens.set(record.secretHash, record);
+        }
+        for (const record of snapshot.pairingCodes ?? []) {
+            if (record.expiresAt >= Date.now()) {
+                this.pairingCodes.set(record.secretHash, record);
+            }
+        }
+    }
+}
+export class FileAuthStore extends InMemoryAuthStore {
+    filePath;
+    constructor(filePath, seedUserToken) {
+        super(undefined, readSnapshot(filePath));
+        this.filePath = filePath;
+        if (seedUserToken)
+            this.addUserToken(seedUserToken.token, seedUserToken.userId);
+        this.persist();
+    }
+    afterMutation() {
+        this.persist();
+    }
+    persist() {
+        mkdirSync(dirname(this.filePath), { recursive: true });
+        const tmp = `${this.filePath}.${process.pid}.${Date.now()}.tmp`;
+        writeFileSync(tmp, `${JSON.stringify(this.snapshot(), null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+        renameSync(tmp, this.filePath);
+    }
+}
+export function extractBearerToken(header) {
+    const value = Array.isArray(header) ? header[0] : header;
+    if (!value || value.length <= "Bearer ".length)
+        return undefined;
+    if (value.slice(0, "Bearer".length).toLowerCase() !== "bearer")
+        return undefined;
+    const firstSeparator = value.charCodeAt("Bearer".length);
+    if (firstSeparator !== 0x20 && firstSeparator !== 0x09)
+        return undefined;
+    let tokenStart = "Bearer".length + 1;
+    while (tokenStart < value.length) {
+        const char = value.charCodeAt(tokenStart);
+        if (char !== 0x20 && char !== 0x09)
+            break;
+        tokenStart += 1;
+    }
+    return tokenStart < value.length ? value.slice(tokenStart) : undefined;
+}
+export function deriveSecretHash(secret, secretSalt = randomBytes(16).toString("hex")) {
+    return {
+        secretHash: scryptSync(secret, secretSalt, 32).toString("hex"),
+        secretSalt,
+    };
+}
+function findSecretRecord(records, secret) {
+    return findSecretEntry(records, secret)?.[1];
+}
+function findSecretEntry(records, secret) {
+    for (const entry of records) {
+        if (secretMatches(entry[1], secret))
+            return entry;
+    }
+    return undefined;
+}
+function secretMatches(record, secret) {
+    const candidate = Buffer.from(deriveSecretHash(secret, record.secretSalt).secretHash, "hex");
+    const expected = Buffer.from(record.secretHash, "hex");
+    return candidate.length === expected.length && timingSafeEqual(candidate, expected);
+}
+function readSnapshot(filePath) {
+    try {
+        const parsed = JSON.parse(readFileSync(filePath, "utf8"));
+        if (parsed.version !== 1)
+            return undefined;
+        return {
+            version: 1,
+            userTokens: Array.isArray(parsed.userTokens) ? parsed.userTokens : [],
+            deviceTokens: Array.isArray(parsed.deviceTokens) ? parsed.deviceTokens : [],
+            pairingCodes: Array.isArray(parsed.pairingCodes) ? parsed.pairingCodes : [],
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=auth-store.js.map

package/dist/auth-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqCpC,MAAM,OAAO,iBAAiB;IACT,UAAU,GAAG,IAAI,GAAG,EAA8C,CAAC;IACnE,YAAY,GAAG,IAAI,GAAG,EAAgD,CAAC;IACvE,YAAY,GAAG,IAAI,GAAG,EAAgD,CAAC;IAE1F,YAAY,aAAiD,EAAE,QAA4B;QACzF,IAAI,QAAQ;YAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,aAAa;YAAE,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,YAAY,CAAC,KAAa,EAAE,MAAc;QACxC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,MAAM,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO;QAC7D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED,gBAAgB,CAAC,KAAyB;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,kBAAkB,CAAC,KAAyB;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QACtD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,mBAAmB,CAAC,IAAY,EAAE,WAAoB;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtD,IAAI,SAAS;gBAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,UAAU,EAAE,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC;IAED,iBAAiB,CAAC,WAAmB;QACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ;QACN,OAAO;YACL,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAChD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YACpD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IAES,aAAa;QACrB,yCAAyC;IAC3C,CAAC;IAEO,YAAY,CAAC,QAA2B;QAC9C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,iBAAiB;IACjC,QAAQ,CAAS;IAElC,YACE,QAAgB,EAChB,aAAiD;QAEjD,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,aAAa;YAAE,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEO,OAAO;QACb,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QAChE,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAqC;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACjE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEjF,MAAM,cAAc,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEzE,IAAI,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACrC,OAAO,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM;QAC1C,UAAU,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC3F,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9D,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAA6B,OAAuB,EAAE,MAAc;IAC3F,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CAA6B,OAAuB,EAAE,MAAc;IAC1F,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,MAAwB,EAAE,MAAc;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA+B,CAAC;QACxF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,OAAO;YACL,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAA6C,CAAC,CAAC,CAAC,EAAE;YACxG,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAiD,CAAC,CAAC,CAAC,EAAE;YAChH,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAiD,CAAC,CAAC,CAAC,EAAE;SACjH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import { randomBytes, randomUUID, scryptSync, timingSafeEqual } from \"node:crypto\";\nimport { mkdirSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\n\nexport interface UserTokenRecord {\n  userId: string;\n  revoked?: boolean;\n}\n\nexport interface DeviceTokenRecord {\n  userId: string;\n  runtimeId: string;\n  runtimeName?: string;\n  revoked?: boolean;\n}\n\nexport interface PairingCodeRecord {\n  userId: string;\n  expiresAt: number;\n}\n\nexport interface DeviceTokenIssue {\n  userId: string;\n  runtimeId: string;\n  deviceToken: string;\n}\n\nexport interface AuthStoreSnapshot {\n  version: 1;\n  userTokens: Array<UserTokenRecord & SecretHashRecord>;\n  deviceTokens: Array<DeviceTokenRecord & SecretHashRecord>;\n  pairingCodes: Array<PairingCodeRecord & SecretHashRecord>;\n}\n\nexport interface SecretHashRecord {\n  secretHash: string;\n  secretSalt: string;\n}\n\nexport class InMemoryAuthStore {\n  protected readonly userTokens = new Map<string, UserTokenRecord & SecretHashRecord>();\n  protected readonly deviceTokens = new Map<string, DeviceTokenRecord & SecretHashRecord>();\n  protected readonly pairingCodes = new Map<string, PairingCodeRecord & SecretHashRecord>();\n\n  constructor(seedUserToken?: { token: string; userId: string }, snapshot?: AuthStoreSnapshot) {\n    if (snapshot) this.loadSnapshot(snapshot);\n    if (seedUserToken) this.addUserToken(seedUserToken.token, seedUserToken.userId);\n  }\n\n  addUserToken(token: string, userId: string): void {\n    const existing = findSecretRecord(this.userTokens, token);\n    if (existing?.userId === userId && !existing.revoked) return;\n    const key = deriveSecretHash(token);\n    this.userTokens.set(key.secretHash, { ...key, userId });\n    this.afterMutation();\n  }\n\n  authenticateUser(token: string | undefined): string | null {\n    if (!token) return null;\n    const record = findSecretRecord(this.userTokens, token);\n    if (!record || record.revoked) return null;\n    return record.userId;\n  }\n\n  authenticateDevice(token: string | undefined): DeviceTokenRecord | null {\n    if (!token) return null;\n    const record = findSecretRecord(this.deviceTokens, token);\n    if (!record || record.revoked) return null;\n    return record;\n  }\n\n  createPairingCode(userId: string, ttlMs = 10 * 60 * 1000): { code: string; expiresAt: number } {\n    const code = randomBytes(4).toString(\"hex\").toUpperCase();\n    const expiresAt = Date.now() + ttlMs;\n    const key = deriveSecretHash(code);\n    this.pairingCodes.set(key.secretHash, { ...key, userId, expiresAt });\n    this.afterMutation();\n    return { code, expiresAt };\n  }\n\n  exchangePairingCode(code: string, runtimeName?: string): DeviceTokenIssue {\n    const normalized = code.trim().toUpperCase();\n    const codeEntry = findSecretEntry(this.pairingCodes, normalized);\n    if (!codeEntry || codeEntry[1].expiresAt < Date.now()) {\n      if (codeEntry) this.pairingCodes.delete(codeEntry[0]);\n      this.afterMutation();\n      throw new Error(\"Pairing code is invalid or expired\");\n    }\n    const [codeHash, record] = codeEntry;\n    this.pairingCodes.delete(codeHash);\n    const runtimeId = `rt_${randomUUID()}`;\n    const deviceToken = `gsd_dev_${randomBytes(32).toString(\"hex\")}`;\n    const key = deriveSecretHash(deviceToken);\n    this.deviceTokens.set(key.secretHash, { ...key, userId: record.userId, runtimeId, runtimeName });\n    this.afterMutation();\n    return { userId: record.userId, runtimeId, deviceToken };\n  }\n\n  revokeDeviceToken(deviceToken: string): boolean {\n    const record = findSecretRecord(this.deviceTokens, deviceToken);\n    if (!record) return false;\n    record.revoked = true;\n    this.afterMutation();\n    return true;\n  }\n\n  snapshot(): AuthStoreSnapshot {\n    return {\n      version: 1,\n      userTokens: Array.from(this.userTokens.values()),\n      deviceTokens: Array.from(this.deviceTokens.values()),\n      pairingCodes: Array.from(this.pairingCodes.values()),\n    };\n  }\n\n  protected afterMutation(): void {\n    // Extension point for persistent stores.\n  }\n\n  private loadSnapshot(snapshot: AuthStoreSnapshot): void {\n    for (const record of snapshot.userTokens ?? []) {\n      this.userTokens.set(record.secretHash, record);\n    }\n    for (const record of snapshot.deviceTokens ?? []) {\n      this.deviceTokens.set(record.secretHash, record);\n    }\n    for (const record of snapshot.pairingCodes ?? []) {\n      if (record.expiresAt >= Date.now()) {\n        this.pairingCodes.set(record.secretHash, record);\n      }\n    }\n  }\n}\n\nexport class FileAuthStore extends InMemoryAuthStore {\n  private readonly filePath: string;\n\n  constructor(\n    filePath: string,\n    seedUserToken?: { token: string; userId: string },\n  ) {\n    super(undefined, readSnapshot(filePath));\n    this.filePath = filePath;\n    if (seedUserToken) this.addUserToken(seedUserToken.token, seedUserToken.userId);\n    this.persist();\n  }\n\n  protected override afterMutation(): void {\n    this.persist();\n  }\n\n  private persist(): void {\n    mkdirSync(dirname(this.filePath), { recursive: true });\n    const tmp = `${this.filePath}.${process.pid}.${Date.now()}.tmp`;\n    writeFileSync(tmp, `${JSON.stringify(this.snapshot(), null, 2)}\\n`, { encoding: \"utf8\", mode: 0o600 });\n    renameSync(tmp, this.filePath);\n  }\n}\n\nexport function extractBearerToken(header: string | string[] | undefined): string | undefined {\n  const value = Array.isArray(header) ? header[0] : header;\n  if (!value || value.length <= \"Bearer \".length) return undefined;\n  if (value.slice(0, \"Bearer\".length).toLowerCase() !== \"bearer\") return undefined;\n\n  const firstSeparator = value.charCodeAt(\"Bearer\".length);\n  if (firstSeparator !== 0x20 && firstSeparator !== 0x09) return undefined;\n\n  let tokenStart = \"Bearer\".length + 1;\n  while (tokenStart < value.length) {\n    const char = value.charCodeAt(tokenStart);\n    if (char !== 0x20 && char !== 0x09) break;\n    tokenStart += 1;\n  }\n\n  return tokenStart < value.length ? value.slice(tokenStart) : undefined;\n}\n\nexport function deriveSecretHash(secret: string, secretSalt = randomBytes(16).toString(\"hex\")): SecretHashRecord {\n  return {\n    secretHash: scryptSync(secret, secretSalt, 32).toString(\"hex\"),\n    secretSalt,\n  };\n}\n\nfunction findSecretRecord<T extends SecretHashRecord>(records: Map<string, T>, secret: string): T | undefined {\n  return findSecretEntry(records, secret)?.[1];\n}\n\nfunction findSecretEntry<T extends SecretHashRecord>(records: Map<string, T>, secret: string): [string, T] | undefined {\n  for (const entry of records) {\n    if (secretMatches(entry[1], secret)) return entry;\n  }\n  return undefined;\n}\n\nfunction secretMatches(record: SecretHashRecord, secret: string): boolean {\n  const candidate = Buffer.from(deriveSecretHash(secret, record.secretSalt).secretHash, \"hex\");\n  const expected = Buffer.from(record.secretHash, \"hex\");\n  return candidate.length === expected.length && timingSafeEqual(candidate, expected);\n}\n\nfunction readSnapshot(filePath: string): AuthStoreSnapshot | undefined {\n  try {\n    const parsed = JSON.parse(readFileSync(filePath, \"utf8\")) as Partial<AuthStoreSnapshot>;\n    if (parsed.version !== 1) return undefined;\n    return {\n      version: 1,\n      userTokens: Array.isArray(parsed.userTokens) ? parsed.userTokens as AuthStoreSnapshot[\"userTokens\"] : [],\n      deviceTokens: Array.isArray(parsed.deviceTokens) ? parsed.deviceTokens as AuthStoreSnapshot[\"deviceTokens\"] : [],\n      pairingCodes: Array.isArray(parsed.pairingCodes) ? parsed.pairingCodes as AuthStoreSnapshot[\"pairingCodes\"] : [],\n    };\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { listenGateway } from "./server.js";
+const portArg = process.argv.indexOf("--port");
+const authStoreArg = process.argv.indexOf("--auth-store");
+const port = portArg >= 0 ? Number(process.argv[portArg + 1]) : undefined;
+const authStorePath = authStoreArg >= 0 ? process.argv[authStoreArg + 1] : undefined;
+listenGateway({ port, authStorePath }).then(({ url }) => {
+    process.stderr.write(`[gsd-cloud-mcp-gateway] listening on ${url}\n`);
+}).catch((err) => {
+    process.stderr.write(`[gsd-cloud-mcp-gateway] fatal: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;AAC1D,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,MAAM,aAAa,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAErF,aAAa,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,GAAG,IAAI,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\nimport { listenGateway } from \"./server.js\";\n\nconst portArg = process.argv.indexOf(\"--port\");\nconst authStoreArg = process.argv.indexOf(\"--auth-store\");\nconst port = portArg >= 0 ? Number(process.argv[portArg + 1]) : undefined;\nconst authStorePath = authStoreArg >= 0 ? process.argv[authStoreArg + 1] : undefined;\n\nlistenGateway({ port, authStorePath }).then(({ url }) => {\n  process.stderr.write(`[gsd-cloud-mcp-gateway] listening on ${url}\\n`);\n}).catch((err) => {\n  process.stderr.write(`[gsd-cloud-mcp-gateway] fatal: ${err instanceof Error ? err.message : String(err)}\\n`);\n  process.exit(1);\n});\n"]}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { FileAuthStore, InMemoryAuthStore, deriveSecretHash, extractBearerToken } from "./auth-store.js";
+export { RuntimeRegistry } from "./runtime-registry.js";
+export { CLOUD_GATEWAY_TOOL_NAMES, createGatewayMcpServer } from "./mcp.js";
+export { createGatewayServer, listenGateway } from "./server.js";
+export type { CloudProjectRecord, GatewayToRuntimeMessage, RuntimeProject, RuntimeToGatewayMessage, } from "./protocol.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjE,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,uBAAuB,GACxB,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { FileAuthStore, InMemoryAuthStore, deriveSecretHash, extractBearerToken } from "./auth-store.js";
+export { RuntimeRegistry } from "./runtime-registry.js";
+export { CLOUD_GATEWAY_TOOL_NAMES, createGatewayMcpServer } from "./mcp.js";
+export { createGatewayServer, listenGateway } from "./server.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC","sourcesContent":["export { FileAuthStore, InMemoryAuthStore, deriveSecretHash, extractBearerToken } from \"./auth-store.js\";\nexport { RuntimeRegistry } from \"./runtime-registry.js\";\nexport { CLOUD_GATEWAY_TOOL_NAMES, createGatewayMcpServer } from \"./mcp.js\";\nexport { createGatewayServer, listenGateway } from \"./server.js\";\nexport type {\n  CloudProjectRecord,\n  GatewayToRuntimeMessage,\n  RuntimeProject,\n  RuntimeToGatewayMessage,\n} from \"./protocol.js\";\n"]}

package/dist/mcp.d.ts

@@ -0,0 +1,8 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { RuntimeRegistry } from "./runtime-registry.js";
+export declare const CLOUD_GATEWAY_TOOL_NAMES: readonly ["gsd_cloud_projects", "gsd_execute", "gsd_status", "gsd_result", "gsd_cancel", "gsd_query", "gsd_resolve_blocker", "gsd_progress", "gsd_roadmap", "gsd_history", "gsd_doctor", "gsd_captures", "gsd_knowledge", "gsd_graph", ...string[]];
+export declare function createGatewayMcpServer(params: {
+    userId: string;
+    registry: RuntimeRegistry;
+}): McpServer;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAwB7D,eAAO,MAAM,wBAAwB,qPAI3B,CAAC;AAOX,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,eAAe,CAAC;CAC3B,GAAG,SAAS,CA2DZ"}

package/dist/mcp.js

@@ -0,0 +1,86 @@
+import { z } from "zod";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { WORKFLOW_TOOL_NAMES } from "@opengsd/mcp-server";
+const SERVER_NAME = "gsd-cloud-gateway";
+const SERVER_VERSION = "1.0.2";
+const SESSION_TOOL_NAMES = [
+    "gsd_execute",
+    "gsd_status",
+    "gsd_result",
+    "gsd_cancel",
+    "gsd_query",
+    "gsd_resolve_blocker",
+    "gsd_progress",
+    "gsd_roadmap",
+    "gsd_history",
+    "gsd_doctor",
+    "gsd_captures",
+    "gsd_knowledge",
+    "gsd_graph",
+];
+const CLOUD_PROJECTS_TOOL = "gsd_cloud_projects";
+export const CLOUD_GATEWAY_TOOL_NAMES = [
+    CLOUD_PROJECTS_TOOL,
+    ...SESSION_TOOL_NAMES,
+    ...WORKFLOW_TOOL_NAMES,
+];
+const passthroughSchema = z.object({
+    runtimeId: z.string().optional().describe("Connected Local GSD Runtime ID"),
+    projectAlias: z.string().optional().describe("Gateway project alias advertised by the Local GSD Runtime"),
+}).passthrough();
+export function createGatewayMcpServer(params) {
+    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, { capabilities: { tools: {} } });
+    server.registerTool(CLOUD_PROJECTS_TOOL, {
+        description: "List projects currently advertised by connected Local GSD Runtimes.",
+        inputSchema: {},
+    }, async () => ({
+        content: [{
+                type: "text",
+                text: JSON.stringify({ projects: params.registry.listProjects(params.userId) }, null, 2),
+            }],
+    }));
+    const seen = new Set([CLOUD_PROJECTS_TOOL]);
+    for (const toolName of [...SESSION_TOOL_NAMES, ...WORKFLOW_TOOL_NAMES]) {
+        if (seen.has(toolName))
+            continue;
+        seen.add(toolName);
+        server.registerTool(toolName, {
+            description: `Forward ${toolName} to a connected Local GSD Runtime through the Cloud MCP Gateway.`,
+            inputSchema: passthroughSchema,
+        }, async (args, extra) => {
+            try {
+                const result = await params.registry.callTool({
+                    userId: params.userId,
+                    toolName,
+                    args: args,
+                    signal: extra.signal,
+                });
+                if (isMcpToolResult(result))
+                    return result;
+                return {
+                    content: [{
+                            type: "text",
+                            text: typeof result === "string" ? result : JSON.stringify(result, null, 2),
+                        }],
+                };
+            }
+            catch (err) {
+                return {
+                    isError: true,
+                    content: [{
+                            type: "text",
+                            text: err instanceof Error ? err.message : String(err),
+                        }],
+                };
+            }
+        });
+    }
+    return server;
+}
+function isMcpToolResult(value) {
+    return !!value
+        && typeof value === "object"
+        && Array.isArray(value.content)
+        && value.content.every((item) => item.type === "text" && typeof item.text === "string");
+}
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,MAAM,kBAAkB,GAAG;IACzB,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,qBAAqB;IACrB,cAAc;IACd,aAAa;IACb,aAAa;IACb,YAAY;IACZ,cAAc;IACd,eAAe;IACf,WAAW;CACH,CAAC;AAEX,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AAEjD,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,mBAAmB;IACnB,GAAG,kBAAkB;IACrB,GAAG,mBAAmB;CACd,CAAC;AAEX,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;CAC1G,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjB,MAAM,UAAU,sBAAsB,CAAC,MAGtC;IACC,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,WAAW,EAAE,qEAAqE;QAClF,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,CAAC;QACX,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;aACzF,CAAC;KACH,CAAC,CACH,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACpD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,kBAAkB,EAAE,GAAG,mBAAmB,CAAC,EAAE,CAAC;QACvE,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnB,MAAM,CAAC,YAAY,CACjB,QAAQ,EACR;YACE,WAAW,EAAE,WAAW,QAAQ,kEAAkE;YAClG,WAAW,EAAE,iBAAiB;SAC/B,EACD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ;oBACR,IAAI,EAAE,IAA+B;oBACrC,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;gBACH,IAAI,eAAe,CAAC,MAAM,CAAC;oBAAE,OAAO,MAAe,CAAC;gBACpD,OAAO;oBACL,OAAO,EAAE,CAAC;4BACR,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;yBAC5E,CAAC;iBACH,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,CAAC;4BACR,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;yBACvD,CAAC;iBACH,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IAKrC,OAAO,CAAC,CAAC,KAAK;WACT,OAAO,KAAK,KAAK,QAAQ;WACzB,KAAK,CAAC,OAAO,CAAE,KAA+B,CAAC,OAAO,CAAC;WACtD,KAAgE,CAAC,OAAO,CAAC,KAAK,CAChF,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAChE,CAAC;AACN,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport type { RuntimeRegistry } from \"./runtime-registry.js\";\nimport { WORKFLOW_TOOL_NAMES } from \"@opengsd/mcp-server\";\n\nconst SERVER_NAME = \"gsd-cloud-gateway\";\nconst SERVER_VERSION = \"1.0.2\";\n\nconst SESSION_TOOL_NAMES = [\n  \"gsd_execute\",\n  \"gsd_status\",\n  \"gsd_result\",\n  \"gsd_cancel\",\n  \"gsd_query\",\n  \"gsd_resolve_blocker\",\n  \"gsd_progress\",\n  \"gsd_roadmap\",\n  \"gsd_history\",\n  \"gsd_doctor\",\n  \"gsd_captures\",\n  \"gsd_knowledge\",\n  \"gsd_graph\",\n] as const;\n\nconst CLOUD_PROJECTS_TOOL = \"gsd_cloud_projects\";\n\nexport const CLOUD_GATEWAY_TOOL_NAMES = [\n  CLOUD_PROJECTS_TOOL,\n  ...SESSION_TOOL_NAMES,\n  ...WORKFLOW_TOOL_NAMES,\n] as const;\n\nconst passthroughSchema = z.object({\n  runtimeId: z.string().optional().describe(\"Connected Local GSD Runtime ID\"),\n  projectAlias: z.string().optional().describe(\"Gateway project alias advertised by the Local GSD Runtime\"),\n}).passthrough();\n\nexport function createGatewayMcpServer(params: {\n  userId: string;\n  registry: RuntimeRegistry;\n}): McpServer {\n  const server = new McpServer(\n    { name: SERVER_NAME, version: SERVER_VERSION },\n    { capabilities: { tools: {} } },\n  );\n\n  server.registerTool(\n    CLOUD_PROJECTS_TOOL,\n    {\n      description: \"List projects currently advertised by connected Local GSD Runtimes.\",\n      inputSchema: {},\n    },\n    async () => ({\n      content: [{\n        type: \"text\" as const,\n        text: JSON.stringify({ projects: params.registry.listProjects(params.userId) }, null, 2),\n      }],\n    }),\n  );\n\n  const seen = new Set<string>([CLOUD_PROJECTS_TOOL]);\n  for (const toolName of [...SESSION_TOOL_NAMES, ...WORKFLOW_TOOL_NAMES]) {\n    if (seen.has(toolName)) continue;\n    seen.add(toolName);\n    server.registerTool(\n      toolName,\n      {\n        description: `Forward ${toolName} to a connected Local GSD Runtime through the Cloud MCP Gateway.`,\n        inputSchema: passthroughSchema,\n      },\n      async (args, extra) => {\n        try {\n          const result = await params.registry.callTool({\n            userId: params.userId,\n            toolName,\n            args: args as Record<string, unknown>,\n            signal: extra.signal,\n          });\n          if (isMcpToolResult(result)) return result as never;\n          return {\n            content: [{\n              type: \"text\" as const,\n              text: typeof result === \"string\" ? result : JSON.stringify(result, null, 2),\n            }],\n          };\n        } catch (err) {\n          return {\n            isError: true,\n            content: [{\n              type: \"text\" as const,\n              text: err instanceof Error ? err.message : String(err),\n            }],\n          };\n        }\n      },\n    );\n  }\n\n  return server;\n}\n\nfunction isMcpToolResult(value: unknown): value is {\n  content: Array<{ type: \"text\"; text: string }>;\n  isError?: boolean;\n  structuredContent?: unknown;\n} {\n  return !!value\n    && typeof value === \"object\"\n    && Array.isArray((value as { content?: unknown }).content)\n    && (value as { content: Array<{ type?: unknown; text?: unknown }> }).content.every(\n      (item) => item.type === \"text\" && typeof item.text === \"string\",\n    );\n}\n"]}

package/dist/protocol.d.ts

@@ -0,0 +1,50 @@
+export interface RuntimeProject {
+    alias: string;
+    path?: string;
+    repoIdentity: string;
+    remoteLabel?: string;
+    markers?: string[];
+}
+export interface RuntimeHelloMessage {
+    type: "hello";
+    runtimeId: string;
+    runtimeName?: string;
+    projects: RuntimeProject[];
+}
+export interface RuntimeProjectsMessage {
+    type: "projects";
+    runtimeId?: string;
+    projects: RuntimeProject[];
+}
+export interface RuntimeHeartbeatMessage {
+    type: "heartbeat";
+    runtimeId?: string;
+    at?: number;
+}
+export interface RuntimeToolCallMessage {
+    type: "tool_call";
+    requestId: string;
+    toolName: string;
+    args: Record<string, unknown>;
+    projectAlias?: string;
+}
+export interface RuntimeToolResultMessage {
+    type: "tool_result";
+    requestId: string;
+    result?: unknown;
+    error?: string;
+}
+export interface RuntimeCancelMessage {
+    type: "cancel";
+    requestId: string;
+}
+export type GatewayToRuntimeMessage = RuntimeToolCallMessage | RuntimeCancelMessage;
+export type RuntimeToGatewayMessage = RuntimeHelloMessage | RuntimeProjectsMessage | RuntimeHeartbeatMessage | RuntimeToolResultMessage;
+export interface CloudProjectRecord extends RuntimeProject {
+    runtimeId: string;
+    runtimeName?: string;
+    online: boolean;
+    lastSeenAt: number;
+}
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,uBAAuB,GAAG,sBAAsB,GAAG,oBAAoB,CAAC;AAEpF,MAAM,MAAM,uBAAuB,GAC/B,mBAAmB,GACnB,sBAAsB,GACtB,uBAAuB,GACvB,wBAAwB,CAAC;AAE7B,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE"}

package/dist/protocol.js

@@ -0,0 +1,4 @@
+export function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+//# sourceMappingURL=protocol.js.map

package/dist/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AA8DA,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["export interface RuntimeProject {\n  alias: string;\n  path?: string;\n  repoIdentity: string;\n  remoteLabel?: string;\n  markers?: string[];\n}\n\nexport interface RuntimeHelloMessage {\n  type: \"hello\";\n  runtimeId: string;\n  runtimeName?: string;\n  projects: RuntimeProject[];\n}\n\nexport interface RuntimeProjectsMessage {\n  type: \"projects\";\n  runtimeId?: string;\n  projects: RuntimeProject[];\n}\n\nexport interface RuntimeHeartbeatMessage {\n  type: \"heartbeat\";\n  runtimeId?: string;\n  at?: number;\n}\n\nexport interface RuntimeToolCallMessage {\n  type: \"tool_call\";\n  requestId: string;\n  toolName: string;\n  args: Record<string, unknown>;\n  projectAlias?: string;\n}\n\nexport interface RuntimeToolResultMessage {\n  type: \"tool_result\";\n  requestId: string;\n  result?: unknown;\n  error?: string;\n}\n\nexport interface RuntimeCancelMessage {\n  type: \"cancel\";\n  requestId: string;\n}\n\nexport type GatewayToRuntimeMessage = RuntimeToolCallMessage | RuntimeCancelMessage;\n\nexport type RuntimeToGatewayMessage =\n  | RuntimeHelloMessage\n  | RuntimeProjectsMessage\n  | RuntimeHeartbeatMessage\n  | RuntimeToolResultMessage;\n\nexport interface CloudProjectRecord extends RuntimeProject {\n  runtimeId: string;\n  runtimeName?: string;\n  online: boolean;\n  lastSeenAt: number;\n}\n\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n"]}

package/dist/runtime-registry.d.ts

@@ -0,0 +1,27 @@
+import WebSocket from "ws";
+import type { CloudProjectRecord } from "./protocol.js";
+export interface GatewayToolCall {
+    userId: string;
+    toolName: string;
+    args: Record<string, unknown>;
+    signal?: AbortSignal;
+}
+export declare class RuntimeRegistry {
+    private readonly runtimes;
+    private readonly pending;
+    private readonly projectQueues;
+    attachRuntime(params: {
+        userId: string;
+        runtimeId: string;
+        runtimeName?: string;
+        socket: WebSocket;
+    }): void;
+    listProjects(userId: string): CloudProjectRecord[];
+    callTool(call: GatewayToolCall): Promise<unknown>;
+    private resolveTarget;
+    private forwardToolCall;
+    private handleMessage;
+    private send;
+    private failPendingForRuntime;
+}
+//# sourceMappingURL=runtime-registry.d.ts.map

package/dist/runtime-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-registry.d.ts","sourceRoot":"","sources":["../src/runtime-registry.ts"],"names":[],"mappings":"AACA,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,KAAK,EACV,kBAAkB,EAInB,MAAM,eAAe,CAAC;AAsBvB,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IAErE,aAAa,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,SAAS,CAAC;KACnB,GAAG,IAAI;IA4BR,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAiB5C,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBvD,OAAO,CAAC,aAAa;IAmCrB,OAAO,CAAC,eAAe;IAuDvB,OAAO,CAAC,aAAa;IAiCrB,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,qBAAqB;CAS9B"}

package/dist/runtime-registry.js

@@ -0,0 +1,198 @@
+import { randomUUID } from "node:crypto";
+import WebSocket from "ws";
+import { isRecord } from "./protocol.js";
+export class RuntimeRegistry {
+    runtimes = new Map();
+    pending = new Map();
+    projectQueues = new Map();
+    attachRuntime(params) {
+        const existing = this.runtimes.get(params.runtimeId);
+        if (existing && existing.socket !== params.socket) {
+            this.failPendingForRuntime(params.runtimeId, `Local GSD Runtime disconnected: ${params.runtimeId}`);
+            existing.socket.close(4000, "replaced");
+        }
+        const runtime = {
+            userId: params.userId,
+            runtimeId: params.runtimeId,
+            runtimeName: params.runtimeName,
+            socket: params.socket,
+            projects: [],
+            lastSeenAt: Date.now(),
+        };
+        this.runtimes.set(params.runtimeId, runtime);
+        params.socket.on("message", (data) => {
+            this.handleMessage(params.runtimeId, data.toString("utf8"));
+        });
+        params.socket.on("close", () => {
+            if (this.runtimes.get(params.runtimeId)?.socket === params.socket) {
+                this.runtimes.delete(params.runtimeId);
+                this.failPendingForRuntime(params.runtimeId, `Local GSD Runtime disconnected: ${params.runtimeId}`);
+            }
+        });
+    }
+    listProjects(userId) {
+        const rows = [];
+        for (const runtime of this.runtimes.values()) {
+            if (runtime.userId !== userId)
+                continue;
+            for (const project of runtime.projects) {
+                rows.push({
+                    ...project,
+                    runtimeId: runtime.runtimeId,
+                    runtimeName: runtime.runtimeName,
+                    online: true,
+                    lastSeenAt: runtime.lastSeenAt,
+                });
+            }
+        }
+        return rows.sort((a, b) => a.alias.localeCompare(b.alias));
+    }
+    async callTool(call) {
+        const target = this.resolveTarget(call.userId, call.args);
+        const projectKey = `${target.runtime.runtimeId}:${target.projectAlias ?? "__runtime__"}`;
+        const prior = this.projectQueues.get(projectKey) ?? Promise.resolve();
+        const run = prior.catch(() => undefined).then(() => this.forwardToolCall(target.runtime, {
+            ...call,
+            args: target.args,
+        }, target.projectAlias));
+        const cleanup = run.catch(() => undefined).finally(() => {
+            if (this.projectQueues.get(projectKey) === run)
+                this.projectQueues.delete(projectKey);
+            if (this.projectQueues.get(projectKey) === cleanup)
+                this.projectQueues.delete(projectKey);
+        });
+        this.projectQueues.set(projectKey, cleanup);
+        return run;
+    }
+    resolveTarget(userId, rawArgs) {
+        const args = { ...rawArgs };
+        const runtimeId = typeof args.runtimeId === "string" ? args.runtimeId : undefined;
+        const projectAlias = typeof args.projectAlias === "string"
+            ? args.projectAlias
+            : typeof args.projectDir === "string"
+                ? args.projectDir
+                : undefined;
+        delete args.runtimeId;
+        delete args.projectAlias;
+        const candidates = Array.from(this.runtimes.values()).filter((runtime) => runtime.userId === userId);
+        if (runtimeId) {
+            const runtime = candidates.find((candidate) => candidate.runtimeId === runtimeId);
+            if (!runtime)
+                throw new Error(`Local GSD Runtime is offline: ${runtimeId}`);
+            return { runtime, projectAlias, args };
+        }
+        if (projectAlias) {
+            const matches = candidates.filter((runtime) => runtime.projects.some((project) => project.alias === projectAlias || project.path === projectAlias));
+            if (matches.length === 1)
+                return { runtime: matches[0], projectAlias, args };
+            if (matches.length > 1)
+                throw new Error(`Project alias is ambiguous: ${projectAlias}`);
+        }
+        if (candidates.length === 1)
+            return { runtime: candidates[0], projectAlias, args };
+        if (candidates.length === 0)
+            throw new Error("No Local GSD Runtime is connected");
+        throw new Error("runtimeId or projectAlias is required when multiple Local GSD Runtimes are connected");
+    }
+    forwardToolCall(runtime, call, projectAlias) {
+        const requestId = randomUUID();
+        const payload = {
+            type: "tool_call",
+            requestId,
+            toolName: call.toolName,
+            args: call.args,
+            projectAlias,
+        };
+        return new Promise((resolve, reject) => {
+            // Removes the abort listener so a long-lived signal reused across many
+            // calls doesn't retain a listener per resolved call.
+            const removeAbortListener = () => {
+                call.signal?.removeEventListener("abort", abort);
+            };
+            const timer = setTimeout(() => {
+                this.pending.delete(requestId);
+                removeAbortListener();
+                reject(new Error(`Timed out waiting for Local GSD Runtime response to ${call.toolName}`));
+            }, 10 * 60 * 1000);
+            const abort = () => {
+                this.send(runtime, { type: "cancel", requestId });
+                this.pending.delete(requestId);
+                clearTimeout(timer);
+                reject(new Error(`${call.toolName} cancelled by client`));
+            };
+            this.pending.set(requestId, {
+                runtimeId: runtime.runtimeId,
+                toolName: call.toolName,
+                resolve,
+                reject,
+                timer,
+                removeAbortListener,
+            });
+            if (call.signal?.aborted)
+                return abort();
+            call.signal?.addEventListener("abort", abort, { once: true });
+            try {
+                this.send(runtime, payload);
+            }
+            catch (err) {
+                removeAbortListener();
+                this.pending.delete(requestId);
+                clearTimeout(timer);
+                reject(err instanceof Error ? err : new Error(String(err)));
+            }
+        });
+    }
+    handleMessage(runtimeId, text) {
+        let message;
+        try {
+            const parsed = JSON.parse(text);
+            if (!isRecord(parsed) || typeof parsed.type !== "string")
+                return;
+            message = parsed;
+        }
+        catch {
+            return;
+        }
+        const runtime = this.runtimes.get(runtimeId);
+        if (runtime)
+            runtime.lastSeenAt = Date.now();
+        if (message.type === "hello" && runtime) {
+            runtime.runtimeName = message.runtimeName ?? runtime.runtimeName;
+            runtime.projects = message.projects;
+            return;
+        }
+        if (message.type === "projects" && runtime) {
+            runtime.projects = message.projects;
+            return;
+        }
+        if (message.type === "tool_result") {
+            const pending = this.pending.get(message.requestId);
+            if (!pending)
+                return;
+            this.pending.delete(message.requestId);
+            clearTimeout(pending.timer);
+            pending.removeAbortListener();
+            if (message.error)
+                pending.reject(new Error(message.error));
+            else
+                pending.resolve(message.result);
+        }
+    }
+    send(runtime, message) {
+        if (runtime.socket.readyState !== WebSocket.OPEN) {
+            throw new Error(`Local GSD Runtime is offline: ${runtime.runtimeId}`);
+        }
+        runtime.socket.send(JSON.stringify(message));
+    }
+    failPendingForRuntime(runtimeId, message) {
+        for (const [requestId, pending] of this.pending) {
+            if (pending.runtimeId !== runtimeId)
+                continue;
+            this.pending.delete(requestId);
+            clearTimeout(pending.timer);
+            pending.removeAbortListener();
+            pending.reject(new Error(`${message} while waiting for ${pending.toolName}`));
+        }
+    }
+}
+//# sourceMappingURL=runtime-registry.js.map

package/dist/runtime-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-registry.js","sourceRoot":"","sources":["../src/runtime-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,SAAS,MAAM,IAAI,CAAC;AAO3B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AA4BzC,MAAM,OAAO,eAAe;IACT,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IAChD,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IACzC,aAAa,GAAG,IAAI,GAAG,EAA4B,CAAC;IAErE,aAAa,CAAC,MAKb;QACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAClD,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,SAAS,EAAE,mCAAmC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACpG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,OAAO,GAAsB;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAE7C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YACnC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAC7B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACvC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,SAAS,EAAE,mCAAmC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACtG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,MAAc;QACzB,MAAM,IAAI,GAAyB,EAAE,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS;YACxC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,OAAO;oBACV,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,MAAM,EAAE,IAAI;oBACZ,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAqB;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,YAAY,IAAI,aAAa,EAAE,CAAC;QACzF,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE;YACvF,GAAG,IAAI;YACP,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACtD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACtF,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,aAAa,CAAC,MAAc,EAAE,OAAgC;QAKpE,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YACxD,CAAC,CAAC,IAAI,CAAC,YAAY;YACnB,CAAC,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;gBACnC,CAAC,CAAC,IAAI,CAAC,UAAU;gBACjB,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO,IAAI,CAAC,SAAS,CAAC;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAEzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACrG,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;YAClF,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,SAAS,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,YAAY,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,CACpG,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAC9E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,YAAY,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACpF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC1G,CAAC;IAEO,eAAe,CACrB,OAA0B,EAC1B,IAAqB,EACrB,YAAqB;QAErB,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,GAA4B;YACvC,IAAI,EAAE,WAAW;YACjB,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY;SACb,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,uEAAuE;YACvE,qDAAqD;YACrD,MAAM,mBAAmB,GAAG,GAAG,EAAE;gBAC/B,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACnD,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC/B,mBAAmB,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,uDAAuD,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC5F,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAEnB,MAAM,KAAK,GAAG,GAAG,EAAE;gBACjB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC/B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,sBAAsB,CAAC,CAAC,CAAC;YAC5D,CAAC,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE;gBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO;gBACP,MAAM;gBACN,KAAK;gBACL,mBAAmB;aACpB,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,OAAO,KAAK,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAE9D,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,mBAAmB,EAAE,CAAC;gBACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC/B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,SAAiB,EAAE,IAAY;QACnD,IAAI,OAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACjE,OAAO,GAAG,MAA4C,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO;YAAE,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,EAAE,CAAC;YACxC,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC;YACjE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,EAAE,CAAC;YAC3C,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACvC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;;gBACvD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,OAA0B,EAAE,OAAgC;QACvE,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,CAAC;IAEO,qBAAqB,CAAC,SAAiB,EAAE,OAAe;QAC9D,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;gBAAE,SAAS;YAC9C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/B,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,sBAAsB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;CACF","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport WebSocket from \"ws\";\nimport type {\n  CloudProjectRecord,\n  GatewayToRuntimeMessage,\n  RuntimeProject,\n  RuntimeToGatewayMessage,\n} from \"./protocol.js\";\nimport { isRecord } from \"./protocol.js\";\n\ninterface RuntimeConnection {\n  runtimeId: string;\n  userId: string;\n  runtimeName?: string;\n  socket: WebSocket;\n  projects: RuntimeProject[];\n  lastSeenAt: number;\n}\n\ninterface PendingCall {\n  runtimeId: string;\n  toolName: string;\n  resolve: (value: unknown) => void;\n  reject: (error: Error) => void;\n  timer: ReturnType<typeof setTimeout>;\n  /** Detaches the abort listener from the caller's signal on resolution. */\n  removeAbortListener: () => void;\n}\n\nexport interface GatewayToolCall {\n  userId: string;\n  toolName: string;\n  args: Record<string, unknown>;\n  signal?: AbortSignal;\n}\n\nexport class RuntimeRegistry {\n  private readonly runtimes = new Map<string, RuntimeConnection>();\n  private readonly pending = new Map<string, PendingCall>();\n  private readonly projectQueues = new Map<string, Promise<unknown>>();\n\n  attachRuntime(params: {\n    userId: string;\n    runtimeId: string;\n    runtimeName?: string;\n    socket: WebSocket;\n  }): void {\n    const existing = this.runtimes.get(params.runtimeId);\n    if (existing && existing.socket !== params.socket) {\n      this.failPendingForRuntime(params.runtimeId, `Local GSD Runtime disconnected: ${params.runtimeId}`);\n      existing.socket.close(4000, \"replaced\");\n    }\n\n    const runtime: RuntimeConnection = {\n      userId: params.userId,\n      runtimeId: params.runtimeId,\n      runtimeName: params.runtimeName,\n      socket: params.socket,\n      projects: [],\n      lastSeenAt: Date.now(),\n    };\n    this.runtimes.set(params.runtimeId, runtime);\n\n    params.socket.on(\"message\", (data) => {\n      this.handleMessage(params.runtimeId, data.toString(\"utf8\"));\n    });\n    params.socket.on(\"close\", () => {\n      if (this.runtimes.get(params.runtimeId)?.socket === params.socket) {\n        this.runtimes.delete(params.runtimeId);\n        this.failPendingForRuntime(params.runtimeId, `Local GSD Runtime disconnected: ${params.runtimeId}`);\n      }\n    });\n  }\n\n  listProjects(userId: string): CloudProjectRecord[] {\n    const rows: CloudProjectRecord[] = [];\n    for (const runtime of this.runtimes.values()) {\n      if (runtime.userId !== userId) continue;\n      for (const project of runtime.projects) {\n        rows.push({\n          ...project,\n          runtimeId: runtime.runtimeId,\n          runtimeName: runtime.runtimeName,\n          online: true,\n          lastSeenAt: runtime.lastSeenAt,\n        });\n      }\n    }\n    return rows.sort((a, b) => a.alias.localeCompare(b.alias));\n  }\n\n  async callTool(call: GatewayToolCall): Promise<unknown> {\n    const target = this.resolveTarget(call.userId, call.args);\n    const projectKey = `${target.runtime.runtimeId}:${target.projectAlias ?? \"__runtime__\"}`;\n    const prior = this.projectQueues.get(projectKey) ?? Promise.resolve();\n    const run = prior.catch(() => undefined).then(() => this.forwardToolCall(target.runtime, {\n      ...call,\n      args: target.args,\n    }, target.projectAlias));\n    const cleanup = run.catch(() => undefined).finally(() => {\n      if (this.projectQueues.get(projectKey) === run) this.projectQueues.delete(projectKey);\n      if (this.projectQueues.get(projectKey) === cleanup) this.projectQueues.delete(projectKey);\n    });\n    this.projectQueues.set(projectKey, cleanup);\n    return run;\n  }\n\n  private resolveTarget(userId: string, rawArgs: Record<string, unknown>): {\n    runtime: RuntimeConnection;\n    projectAlias?: string;\n    args: Record<string, unknown>;\n  } {\n    const args = { ...rawArgs };\n    const runtimeId = typeof args.runtimeId === \"string\" ? args.runtimeId : undefined;\n    const projectAlias = typeof args.projectAlias === \"string\"\n      ? args.projectAlias\n      : typeof args.projectDir === \"string\"\n        ? args.projectDir\n        : undefined;\n    delete args.runtimeId;\n    delete args.projectAlias;\n\n    const candidates = Array.from(this.runtimes.values()).filter((runtime) => runtime.userId === userId);\n    if (runtimeId) {\n      const runtime = candidates.find((candidate) => candidate.runtimeId === runtimeId);\n      if (!runtime) throw new Error(`Local GSD Runtime is offline: ${runtimeId}`);\n      return { runtime, projectAlias, args };\n    }\n\n    if (projectAlias) {\n      const matches = candidates.filter((runtime) =>\n        runtime.projects.some((project) => project.alias === projectAlias || project.path === projectAlias),\n      );\n      if (matches.length === 1) return { runtime: matches[0]!, projectAlias, args };\n      if (matches.length > 1) throw new Error(`Project alias is ambiguous: ${projectAlias}`);\n    }\n\n    if (candidates.length === 1) return { runtime: candidates[0]!, projectAlias, args };\n    if (candidates.length === 0) throw new Error(\"No Local GSD Runtime is connected\");\n    throw new Error(\"runtimeId or projectAlias is required when multiple Local GSD Runtimes are connected\");\n  }\n\n  private forwardToolCall(\n    runtime: RuntimeConnection,\n    call: GatewayToolCall,\n    projectAlias?: string,\n  ): Promise<unknown> {\n    const requestId = randomUUID();\n    const payload: GatewayToRuntimeMessage = {\n      type: \"tool_call\",\n      requestId,\n      toolName: call.toolName,\n      args: call.args,\n      projectAlias,\n    };\n\n    return new Promise((resolve, reject) => {\n      // Removes the abort listener so a long-lived signal reused across many\n      // calls doesn't retain a listener per resolved call.\n      const removeAbortListener = () => {\n        call.signal?.removeEventListener(\"abort\", abort);\n      };\n      const timer = setTimeout(() => {\n        this.pending.delete(requestId);\n        removeAbortListener();\n        reject(new Error(`Timed out waiting for Local GSD Runtime response to ${call.toolName}`));\n      }, 10 * 60 * 1000);\n\n      const abort = () => {\n        this.send(runtime, { type: \"cancel\", requestId });\n        this.pending.delete(requestId);\n        clearTimeout(timer);\n        reject(new Error(`${call.toolName} cancelled by client`));\n      };\n      this.pending.set(requestId, {\n        runtimeId: runtime.runtimeId,\n        toolName: call.toolName,\n        resolve,\n        reject,\n        timer,\n        removeAbortListener,\n      });\n\n      if (call.signal?.aborted) return abort();\n      call.signal?.addEventListener(\"abort\", abort, { once: true });\n\n      try {\n        this.send(runtime, payload);\n      } catch (err) {\n        removeAbortListener();\n        this.pending.delete(requestId);\n        clearTimeout(timer);\n        reject(err instanceof Error ? err : new Error(String(err)));\n      }\n    });\n  }\n\n  private handleMessage(runtimeId: string, text: string): void {\n    let message: RuntimeToGatewayMessage;\n    try {\n      const parsed = JSON.parse(text) as unknown;\n      if (!isRecord(parsed) || typeof parsed.type !== \"string\") return;\n      message = parsed as unknown as RuntimeToGatewayMessage;\n    } catch {\n      return;\n    }\n\n    const runtime = this.runtimes.get(runtimeId);\n    if (runtime) runtime.lastSeenAt = Date.now();\n\n    if (message.type === \"hello\" && runtime) {\n      runtime.runtimeName = message.runtimeName ?? runtime.runtimeName;\n      runtime.projects = message.projects;\n      return;\n    }\n    if (message.type === \"projects\" && runtime) {\n      runtime.projects = message.projects;\n      return;\n    }\n    if (message.type === \"tool_result\") {\n      const pending = this.pending.get(message.requestId);\n      if (!pending) return;\n      this.pending.delete(message.requestId);\n      clearTimeout(pending.timer);\n      pending.removeAbortListener();\n      if (message.error) pending.reject(new Error(message.error));\n      else pending.resolve(message.result);\n    }\n  }\n\n  private send(runtime: RuntimeConnection, message: GatewayToRuntimeMessage): void {\n    if (runtime.socket.readyState !== WebSocket.OPEN) {\n      throw new Error(`Local GSD Runtime is offline: ${runtime.runtimeId}`);\n    }\n    runtime.socket.send(JSON.stringify(message));\n  }\n\n  private failPendingForRuntime(runtimeId: string, message: string): void {\n    for (const [requestId, pending] of this.pending) {\n      if (pending.runtimeId !== runtimeId) continue;\n      this.pending.delete(requestId);\n      clearTimeout(pending.timer);\n      pending.removeAbortListener();\n      pending.reject(new Error(`${message} while waiting for ${pending.toolName}`));\n    }\n  }\n}\n"]}

package/dist/server.d.ts

@@ -0,0 +1,20 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+import { InMemoryAuthStore } from "./auth-store.js";
+import { RuntimeRegistry } from "./runtime-registry.js";
+export interface GatewayServerOptions {
+    port?: number;
+    host?: string;
+    userToken?: string;
+    userId?: string;
+    authStorePath?: string;
+}
+export declare function createGatewayServer(options?: GatewayServerOptions): {
+    server: import("http").Server<typeof IncomingMessage, typeof ServerResponse>;
+    auth: InMemoryAuthStore;
+    registry: RuntimeRegistry;
+};
+export declare function listenGateway(options?: GatewayServerOptions): Promise<{
+    close: () => Promise<void>;
+    url: string;
+}>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAKpF,OAAO,EAAqC,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAIxD,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,oBAAyB;;;;EAuFrE;AAED,wBAAsB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC;IAC/E,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CASD"}

package/dist/server.js

@@ -0,0 +1,139 @@
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+import { WebSocketServer } from "ws";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { createGatewayMcpServer } from "./mcp.js";
+import { extractBearerToken, FileAuthStore, InMemoryAuthStore } from "./auth-store.js";
+import { RuntimeRegistry } from "./runtime-registry.js";
+const MAX_JSON_BODY_BYTES = 1024 * 1024;
+export function createGatewayServer(options = {}) {
+    const userId = options.userId ?? "local-user";
+    const userToken = options.userToken ?? process.env.GSD_CLOUD_USER_TOKEN;
+    if (!userToken) {
+        throw new Error("GSD_CLOUD_USER_TOKEN is required");
+    }
+    const authStorePath = options.authStorePath ?? process.env.GSD_CLOUD_AUTH_STORE_PATH;
+    const auth = authStorePath
+        ? new FileAuthStore(authStorePath, { token: userToken, userId })
+        : new InMemoryAuthStore({ token: userToken, userId });
+    const registry = new RuntimeRegistry();
+    const wss = new WebSocketServer({ noServer: true });
+    const server = createServer(async (req, res) => {
+        try {
+            if (req.method === "GET" && req.url === "/healthz") {
+                return sendJson(res, 200, { ok: true });
+            }
+            if (req.method === "POST" && req.url === "/pairing-codes") {
+                const authedUser = requireUser(req, auth);
+                if (!authedUser)
+                    return sendJson(res, 401, { error: "Unauthorized" });
+                return sendJson(res, 200, auth.createPairingCode(authedUser));
+            }
+            if (req.method === "POST" && req.url === "/pairing/exchange") {
+                const body = await readJson(req);
+                const code = typeof body.code === "string" ? body.code : "";
+                const runtimeName = typeof body.runtimeName === "string" ? body.runtimeName : undefined;
+                try {
+                    return sendJson(res, 200, auth.exchangePairingCode(code, runtimeName));
+                }
+                catch {
+                    return sendJson(res, 400, { error: "Pairing code is invalid or expired" });
+                }
+            }
+            if (req.url?.startsWith("/mcp")) {
+                const authedUser = requireUser(req, auth);
+                if (!authedUser)
+                    return sendJson(res, 401, { error: "Unauthorized" });
+                const body = req.method === "POST" ? await readJson(req) : undefined;
+                const transport = new StreamableHTTPServerTransport({
+                    sessionIdGenerator: undefined,
+                });
+                const mcp = createGatewayMcpServer({ userId: authedUser, registry });
+                await mcp.connect(transport);
+                await transport.handleRequest(req, res, body);
+                return;
+            }
+            sendJson(res, 404, { error: "Not found" });
+        }
+        catch (err) {
+            if (err instanceof BadRequestError) {
+                return sendJson(res, 400, { error: err.message });
+            }
+            sendJson(res, 500, { error: "Internal server error" });
+        }
+    });
+    server.on("upgrade", (req, socket, head) => {
+        try {
+            const url = new URL(req.url ?? "/", "http://localhost");
+            if (url.pathname !== "/runtime/connect") {
+                socket.destroy();
+                return;
+            }
+            const deviceToken = extractBearerToken(req.headers.authorization);
+            const device = auth.authenticateDevice(deviceToken);
+            if (!device) {
+                socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
+                socket.destroy();
+                return;
+            }
+            wss.handleUpgrade(req, socket, head, (ws) => {
+                registry.attachRuntime({
+                    userId: device.userId,
+                    runtimeId: device.runtimeId,
+                    runtimeName: device.runtimeName,
+                    socket: ws,
+                });
+                ws.send(JSON.stringify({ type: "connected", requestId: randomUUID(), runtimeId: device.runtimeId }));
+            });
+        }
+        catch {
+            socket.destroy();
+        }
+    });
+    return { server, auth, registry };
+}
+export async function listenGateway(options = {}) {
+    const { server } = createGatewayServer(options);
+    const port = options.port ?? Number(process.env.PORT ?? 8787);
+    const host = options.host ?? "0.0.0.0";
+    await new Promise((resolve) => server.listen(port, host, resolve));
+    return {
+        url: `http://${host === "0.0.0.0" ? "localhost" : host}:${port}`,
+        close: () => new Promise((resolve, reject) => server.close((err) => err ? reject(err) : resolve())),
+    };
+}
+function requireUser(req, auth) {
+    return auth.authenticateUser(extractBearerToken(req.headers.authorization));
+}
+async function readJson(req) {
+    const chunks = [];
+    let totalBytes = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        totalBytes += buffer.byteLength;
+        if (totalBytes > MAX_JSON_BODY_BYTES) {
+            throw new BadRequestError("Request body too large");
+        }
+        chunks.push(buffer);
+    }
+    if (chunks.length === 0)
+        return {};
+    try {
+        const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : {};
+    }
+    catch {
+        throw new BadRequestError("Invalid JSON request body");
+    }
+}
+function sendJson(res, status, body) {
+    if (res.headersSent)
+        return;
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(JSON.stringify(body));
+}
+class BadRequestError extends Error {
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AACrC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AAUxC,MAAM,UAAU,mBAAmB,CAAC,UAAgC,EAAE;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACxE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACrF,MAAM,IAAI,GAAG,aAAa;QACxB,CAAC,CAAC,IAAI,aAAa,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAChE,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBACnD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC;gBAC1D,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC1C,IAAI,CAAC,UAAU;oBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBACtE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;YAChE,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,mBAAmB,EAAE,CAAC;gBAC7D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;gBACxF,IAAI,CAAC;oBACH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;gBACzE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC1C,IAAI,CAAC,UAAU;oBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBACtE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;oBAClD,kBAAkB,EAAE,SAAS;iBAC9B,CAAC,CAAC;gBACH,MAAM,GAAG,GAAG,sBAAsB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACrE,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC7B,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;gBACnC,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;gBACxC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBAClD,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,QAAQ,CAAC,aAAa,CAAC;oBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,MAAM,EAAE,EAAE;iBACX,CAAC,CAAC;gBACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACvG,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAgC,EAAE;IAIpE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IACvC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACzE,OAAO;QACL,GAAG,EAAE,UAAU,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE;QAChE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KACpG,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAoB,EAAE,IAAuB;IAChE,OAAO,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;QAChC,IAAI,UAAU,GAAG,mBAAmB,EAAE,CAAC;YACrC,MAAM,IAAI,eAAe,CAAC,wBAAwB,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QAC7E,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAC,MAAiC;YACnC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO;IAC5B,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,eAAgB,SAAQ,KAAK;CAAG","sourcesContent":["import { createServer, type IncomingMessage, type ServerResponse } from \"node:http\";\nimport { randomUUID } from \"node:crypto\";\nimport { WebSocketServer } from \"ws\";\nimport { StreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport { createGatewayMcpServer } from \"./mcp.js\";\nimport { extractBearerToken, FileAuthStore, InMemoryAuthStore } from \"./auth-store.js\";\nimport { RuntimeRegistry } from \"./runtime-registry.js\";\n\nconst MAX_JSON_BODY_BYTES = 1024 * 1024;\n\nexport interface GatewayServerOptions {\n  port?: number;\n  host?: string;\n  userToken?: string;\n  userId?: string;\n  authStorePath?: string;\n}\n\nexport function createGatewayServer(options: GatewayServerOptions = {}) {\n  const userId = options.userId ?? \"local-user\";\n  const userToken = options.userToken ?? process.env.GSD_CLOUD_USER_TOKEN;\n  if (!userToken) {\n    throw new Error(\"GSD_CLOUD_USER_TOKEN is required\");\n  }\n  const authStorePath = options.authStorePath ?? process.env.GSD_CLOUD_AUTH_STORE_PATH;\n  const auth = authStorePath\n    ? new FileAuthStore(authStorePath, { token: userToken, userId })\n    : new InMemoryAuthStore({ token: userToken, userId });\n  const registry = new RuntimeRegistry();\n  const wss = new WebSocketServer({ noServer: true });\n\n  const server = createServer(async (req, res) => {\n    try {\n      if (req.method === \"GET\" && req.url === \"/healthz\") {\n        return sendJson(res, 200, { ok: true });\n      }\n\n      if (req.method === \"POST\" && req.url === \"/pairing-codes\") {\n        const authedUser = requireUser(req, auth);\n        if (!authedUser) return sendJson(res, 401, { error: \"Unauthorized\" });\n        return sendJson(res, 200, auth.createPairingCode(authedUser));\n      }\n\n      if (req.method === \"POST\" && req.url === \"/pairing/exchange\") {\n        const body = await readJson(req);\n        const code = typeof body.code === \"string\" ? body.code : \"\";\n        const runtimeName = typeof body.runtimeName === \"string\" ? body.runtimeName : undefined;\n        try {\n          return sendJson(res, 200, auth.exchangePairingCode(code, runtimeName));\n        } catch {\n          return sendJson(res, 400, { error: \"Pairing code is invalid or expired\" });\n        }\n      }\n\n      if (req.url?.startsWith(\"/mcp\")) {\n        const authedUser = requireUser(req, auth);\n        if (!authedUser) return sendJson(res, 401, { error: \"Unauthorized\" });\n        const body = req.method === \"POST\" ? await readJson(req) : undefined;\n        const transport = new StreamableHTTPServerTransport({\n          sessionIdGenerator: undefined,\n        });\n        const mcp = createGatewayMcpServer({ userId: authedUser, registry });\n        await mcp.connect(transport);\n        await transport.handleRequest(req, res, body);\n        return;\n      }\n\n      sendJson(res, 404, { error: \"Not found\" });\n    } catch (err) {\n      if (err instanceof BadRequestError) {\n        return sendJson(res, 400, { error: err.message });\n      }\n      sendJson(res, 500, { error: \"Internal server error\" });\n    }\n  });\n\n  server.on(\"upgrade\", (req, socket, head) => {\n    try {\n      const url = new URL(req.url ?? \"/\", \"http://localhost\");\n      if (url.pathname !== \"/runtime/connect\") {\n        socket.destroy();\n        return;\n      }\n      const deviceToken = extractBearerToken(req.headers.authorization);\n      const device = auth.authenticateDevice(deviceToken);\n      if (!device) {\n        socket.write(\"HTTP/1.1 401 Unauthorized\\r\\n\\r\\n\");\n        socket.destroy();\n        return;\n      }\n      wss.handleUpgrade(req, socket, head, (ws) => {\n        registry.attachRuntime({\n          userId: device.userId,\n          runtimeId: device.runtimeId,\n          runtimeName: device.runtimeName,\n          socket: ws,\n        });\n        ws.send(JSON.stringify({ type: \"connected\", requestId: randomUUID(), runtimeId: device.runtimeId }));\n      });\n    } catch {\n      socket.destroy();\n    }\n  });\n\n  return { server, auth, registry };\n}\n\nexport async function listenGateway(options: GatewayServerOptions = {}): Promise<{\n  close: () => Promise<void>;\n  url: string;\n}> {\n  const { server } = createGatewayServer(options);\n  const port = options.port ?? Number(process.env.PORT ?? 8787);\n  const host = options.host ?? \"0.0.0.0\";\n  await new Promise<void>((resolve) => server.listen(port, host, resolve));\n  return {\n    url: `http://${host === \"0.0.0.0\" ? \"localhost\" : host}:${port}`,\n    close: () => new Promise((resolve, reject) => server.close((err) => err ? reject(err) : resolve())),\n  };\n}\n\nfunction requireUser(req: IncomingMessage, auth: InMemoryAuthStore): string | null {\n  return auth.authenticateUser(extractBearerToken(req.headers.authorization));\n}\n\nasync function readJson(req: IncomingMessage): Promise<Record<string, unknown>> {\n  const chunks: Buffer[] = [];\n  let totalBytes = 0;\n  for await (const chunk of req) {\n    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);\n    totalBytes += buffer.byteLength;\n    if (totalBytes > MAX_JSON_BODY_BYTES) {\n      throw new BadRequestError(\"Request body too large\");\n    }\n    chunks.push(buffer);\n  }\n  if (chunks.length === 0) return {};\n  try {\n    const parsed = JSON.parse(Buffer.concat(chunks).toString(\"utf8\")) as unknown;\n    return parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n      ? parsed as Record<string, unknown>\n      : {};\n  } catch {\n    throw new BadRequestError(\"Invalid JSON request body\");\n  }\n}\n\nfunction sendJson(res: ServerResponse, status: number, body: unknown): void {\n  if (res.headersSent) return;\n  res.writeHead(status, { \"content-type\": \"application/json\" });\n  res.end(JSON.stringify(body));\n}\n\nclass BadRequestError extends Error {}\n"]}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@opengsd/cloud-mcp-gateway",
+  "version": "1.2.0",
+  "description": "Cloud MCP gateway for brokering remote MCP clients to local GSD runtimes",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/open-gsd/gsd-pi.git",
+    "directory": "packages/cloud-mcp-gateway"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "gsd-cloud-mcp-gateway": "./bin/gsd-cloud-mcp-gateway.js"
+  },
+  "scripts": {
+    "build": "node ../../scripts/clean-package-dist.cjs && tsc",
+    "test": "pnpm run build && node --test dist/*.test.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@opengsd/mcp-server": "^1.2.0",
+    "ws": "^8.20.0",
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.12.0",
+    "@types/ws": "^8.5.13",
+    "typescript": "^5.4.0"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "files": [
+    "README.md",
+    "bin",
+    "dist",
+    "!dist/**/*.test.*"
+  ]
+}