@padua/cli 1.13.0 → 2.0.0

package/dist/mcp/config/loaders.js

@@ -0,0 +1,149 @@
+"use strict";
+/**
+ * MCP config loader functions.
+ *
+ * Reads padua.config.json (mcp key) and mcp-providers.json,
+ * validates with Zod schemas from types.ts, and returns typed defaults.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDefaultMcpConfig = getDefaultMcpConfig;
+exports.loadMcpConfig = loadMcpConfig;
+exports.loadProvidersConfig = loadProvidersConfig;
+exports.downloadProvidersConfig = downloadProvidersConfig;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const types_1 = require("./types");
+const errors_1 = require("../errors");
+// ---------------------------------------------------------------------------
+// Path constants
+// ---------------------------------------------------------------------------
+const PADUA_DIR = (0, path_1.join)((0, os_1.homedir)(), '.padua');
+const LOCAL_CONFIG_PATH = (0, path_1.join)(PADUA_DIR, 'padua.config.json');
+const PROVIDERS_CONFIG_PATH = (0, path_1.join)(PADUA_DIR, 'mcp-providers.json');
+const S3_PROVIDERS_URI = 's3://paduafg-developers/mcp-config.json';
+// ---------------------------------------------------------------------------
+// Defaults
+// ---------------------------------------------------------------------------
+/**
+ * Returns a fresh McpLocalConfig object containing all default values.
+ * All fields are populated so callers can rely on the result being complete.
+ */
+function getDefaultMcpConfig() {
+    return {
+        port: 8919,
+        store: {
+            path: (0, path_1.join)(PADUA_DIR, 'tokens.db'),
+            encryptionKeySource: 'keychain',
+        },
+        logging: {
+            level: 'info',
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// loadMcpConfig
+// ---------------------------------------------------------------------------
+/**
+ * Reads the `mcp` key from `~/.padua/padua.config.json` (or `configPath`) and
+ * returns a validated McpLocalConfig merged over the defaults.
+ *
+ * Returns defaults when:
+ * - The file does not exist.
+ * - The file exists but has no `mcp` key.
+ *
+ * Throws ValidationError (code INVALID_CONFIG) when:
+ * - The `mcp` key is present but fails Zod validation.
+ * - The file contains invalid JSON.
+ */
+function loadMcpConfig(configPath) {
+    const filePath = configPath ?? LOCAL_CONFIG_PATH;
+    if (!(0, fs_1.existsSync)(filePath)) {
+        return getDefaultMcpConfig();
+    }
+    const raw = parseJsonFile(filePath);
+    const mcpRaw = raw.mcp ?? {};
+    const result = types_1.McpLocalConfigSchema.safeParse(mcpRaw);
+    if (!result.success) {
+        throw new errors_1.ValidationError(`Invalid mcp config: ${result.error.message}`, errors_1.ErrorCodes.INVALID_CONFIG);
+    }
+    return mergeWithDefaults(result.data);
+}
+// ---------------------------------------------------------------------------
+// loadProvidersConfig
+// ---------------------------------------------------------------------------
+/**
+ * Reads `~/.padua/mcp-providers.json` (or `configPath`) and returns a validated
+ * McpProvidersConfig.
+ *
+ * Returns null when the file does not exist (not an error condition — the user
+ * simply has not downloaded the provider config yet).
+ *
+ * Throws ValidationError (code INVALID_CONFIG) when:
+ * - The file exists but fails Zod validation.
+ * - The file contains invalid JSON.
+ */
+function loadProvidersConfig(configPath) {
+    const filePath = configPath ?? PROVIDERS_CONFIG_PATH;
+    if (!(0, fs_1.existsSync)(filePath)) {
+        return null;
+    }
+    const raw = parseJsonFile(filePath);
+    const result = types_1.McpProvidersConfigSchema.safeParse(raw);
+    if (!result.success) {
+        throw new errors_1.ValidationError(`Invalid mcp-providers.json: ${result.error.message}`, errors_1.ErrorCodes.INVALID_CONFIG);
+    }
+    return result.data;
+}
+// ---------------------------------------------------------------------------
+// downloadProvidersConfig
+// ---------------------------------------------------------------------------
+/**
+ * Downloads the provider config from S3 using the active SSO profile and writes
+ * it to `~/.padua/mcp-providers.json` with permissions 0o600.
+ *
+ * Throws an Error when the aws CLI exits with a non-zero status code.
+ */
+async function downloadProvidersConfig(profile) {
+    const result = (0, child_process_1.spawnSync)('aws', ['s3', 'cp', S3_PROVIDERS_URI, PROVIDERS_CONFIG_PATH, '--profile', profile], { stdio: 'pipe' });
+    if (result.status !== 0) {
+        const stderr = result.stderr?.toString() ?? '';
+        throw new Error(`Failed to download mcp-providers.json: ${stderr}`);
+    }
+    (0, fs_1.chmodSync)(PROVIDERS_CONFIG_PATH, 0o600);
+}
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+/**
+ * Reads and parses a JSON file.  Throws an Error with a clear message when
+ * the file content is not valid JSON (SyntaxError from JSON.parse).
+ */
+function parseJsonFile(filePath) {
+    const content = (0, fs_1.readFileSync)(filePath, 'utf8');
+    try {
+        return JSON.parse(content);
+    }
+    catch (err) {
+        throw new errors_1.ValidationError(`Failed to parse JSON at ${filePath}: ${err.message}`, errors_1.ErrorCodes.INVALID_CONFIG);
+    }
+}
+/**
+ * Merges user-supplied McpLocalConfig values over the defaults.
+ * Only top-level keys present in `userConfig` overwrite defaults; nested objects
+ * are merged shallowly so the user can override a single sub-field.
+ */
+function mergeWithDefaults(userConfig) {
+    const defaults = getDefaultMcpConfig();
+    return {
+        port: userConfig.port ?? defaults.port,
+        store: userConfig.store
+            ? { ...defaults.store, ...userConfig.store }
+            : defaults.store,
+        logging: userConfig.logging
+            ? { ...defaults.logging, ...userConfig.logging }
+            : defaults.logging,
+    };
+}
+//# sourceMappingURL=loaders.js.map

package/dist/mcp/config/loaders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loaders.js","sourceRoot":"","sources":["../../../src/mcp/config/loaders.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAgCH,kDAWC;AAkBD,sCAmBC;AAiBD,kDAkBC;AAYD,0DAaC;AA1ID,iDAA0C;AAC1C,2BAAyD;AACzD,2BAA6B;AAC7B,+BAA4B;AAE5B,mCAKiB;AACjB,sCAAwD;AAExD,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,SAAS,GAAG,IAAA,WAAI,EAAC,IAAA,YAAO,GAAE,EAAE,QAAQ,CAAC,CAAC;AAC5C,MAAM,iBAAiB,GAAG,IAAA,WAAI,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC/D,MAAM,qBAAqB,GAAG,IAAA,WAAI,EAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AACpE,MAAM,gBAAgB,GAAG,yCAAyC,CAAC;AAEnE,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;GAGG;AACH,SAAgB,mBAAmB;IACjC,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,IAAI,EAAE,IAAA,WAAI,EAAC,SAAS,EAAE,WAAW,CAAC;YAClC,mBAAmB,EAAE,UAAU;SAChC;QACD,OAAO,EAAE;YACP,KAAK,EAAE,MAAM;SACd;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,SAAgB,aAAa,CAAC,UAAmB;IAC/C,MAAM,QAAQ,GAAG,UAAU,IAAI,iBAAiB,CAAC;IAEjD,IAAI,CAAC,IAAA,eAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,MAAM,GAAI,GAA+B,CAAC,GAAG,IAAI,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,4BAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAEtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,wBAAe,CACvB,uBAAuB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAC7C,mBAAU,CAAC,cAAc,CAC1B,CAAC;IACJ,CAAC;IAED,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,SAAgB,mBAAmB,CAAC,UAAmB;IACrD,MAAM,QAAQ,GAAG,UAAU,IAAI,qBAAqB,CAAC;IAErD,IAAI,CAAC,IAAA,eAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,gCAAwB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAEvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,wBAAe,CACvB,+BAA+B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACrD,mBAAU,CAAC,cAAc,CAC1B,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,IAA0B,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;GAKG;AACI,KAAK,UAAU,uBAAuB,CAAC,OAAe;IAC3D,MAAM,MAAM,GAAG,IAAA,yBAAS,EACtB,KAAK,EACL,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,WAAW,EAAE,OAAO,CAAC,EAC3E,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAA,cAAS,EAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAe,CACvB,2BAA2B,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAChE,mBAAU,CAAC,cAAc,CAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,UAA0B;IACnD,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IAEvC,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;QACtC,KAAK,EAAE,UAAU,CAAC,KAAK;YACrB,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE;YAC5C,CAAC,CAAC,QAAQ,CAAC,KAAK;QAClB,OAAO,EAAE,UAAU,CAAC,OAAO;YACzB,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE;YAChD,CAAC,CAAC,QAAQ,CAAC,OAAO;KACrB,CAAC;AACJ,CAAC"}

package/dist/mcp/config/types.d.ts

@@ -0,0 +1,234 @@
+import { z } from 'zod';
+/**
+ * MCP daemon local settings read from the `mcp` key in padua.config.json.
+ * All fields are optional; callers apply defaults at load time.
+ */
+export interface McpLocalConfig {
+    /** Listening port for the MCP HTTP server. Default: 8919. */
+    port?: number;
+    store?: {
+        /** Absolute path to the SQLite token database. Default: ~/.padua/tokens.db */
+        path?: string;
+        /** Source for the AES-256-GCM encryption key. Default: keychain. */
+        encryptionKeySource?: 'keychain' | 'env';
+    };
+    logging?: {
+        /** Log verbosity level. Default: info. */
+        level?: 'debug' | 'info' | 'warn' | 'error';
+        /** Absolute path to the log file. Defaults to stderr when absent. */
+        path?: string;
+    };
+}
+export declare const McpLocalConfigSchema: z.ZodObject<{
+    port: z.ZodOptional<z.ZodNumber>;
+    store: z.ZodOptional<z.ZodObject<{
+        path: z.ZodOptional<z.ZodString>;
+        encryptionKeySource: z.ZodOptional<z.ZodEnum<["keychain", "env"]>>;
+    }, "strip", z.ZodTypeAny, {
+        path?: string | undefined;
+        encryptionKeySource?: "keychain" | "env" | undefined;
+    }, {
+        path?: string | undefined;
+        encryptionKeySource?: "keychain" | "env" | undefined;
+    }>>;
+    logging: z.ZodOptional<z.ZodObject<{
+        level: z.ZodOptional<z.ZodEnum<["debug", "info", "warn", "error"]>>;
+        path: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path?: string | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+    }, {
+        path?: string | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    port?: number | undefined;
+    store?: {
+        path?: string | undefined;
+        encryptionKeySource?: "keychain" | "env" | undefined;
+    } | undefined;
+    logging?: {
+        path?: string | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+    } | undefined;
+}, {
+    port?: number | undefined;
+    store?: {
+        path?: string | undefined;
+        encryptionKeySource?: "keychain" | "env" | undefined;
+    } | undefined;
+    logging?: {
+        path?: string | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+    } | undefined;
+}>;
+/**
+ * OAuth2 credentials and settings for the GitLab provider.
+ * Downloaded from S3 and stored in mcp-providers.json.
+ */
+export interface GitLabProviderConfig {
+    /** Base URL of the GitLab instance. HTTPS required. */
+    baseUrl: string;
+    /** OAuth2 application client ID. */
+    clientId: string;
+    /** OAuth2 scopes to request. At least one scope must be specified. */
+    scopes: string[];
+    /** Local port for the OAuth2 callback server. Default: 18080. */
+    redirectPort?: number;
+}
+export declare const GitLabProviderConfigSchema: z.ZodObject<{
+    /** z.string().url() validates URL structure; startsWith enforces HTTPS. */
+    baseUrl: z.ZodString;
+    clientId: z.ZodString;
+    scopes: z.ZodArray<z.ZodString, "many">;
+    redirectPort: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    baseUrl: string;
+    clientId: string;
+    scopes: string[];
+    redirectPort?: number | undefined;
+}, {
+    baseUrl: string;
+    clientId: string;
+    scopes: string[];
+    redirectPort?: number | undefined;
+}>;
+/**
+ * OAuth2 credentials and settings for the Atlassian provider.
+ * The clientSecret is required because Atlassian uses a confidential client flow.
+ */
+export interface AtlassianProviderConfig {
+    /** OAuth2 application client ID. */
+    clientId: string;
+    /** OAuth2 application client secret. Required for confidential client flow. */
+    clientSecret: string;
+    /** OAuth2 scopes to request. At least one scope must be specified. */
+    scopes: string[];
+    /** Local port for the OAuth2 callback server. Default: 18081. */
+    redirectPort?: number;
+}
+export declare const AtlassianProviderConfigSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodArray<z.ZodString, "many">;
+    redirectPort: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    scopes: string[];
+    clientSecret: string;
+    redirectPort?: number | undefined;
+}, {
+    clientId: string;
+    scopes: string[];
+    clientSecret: string;
+    redirectPort?: number | undefined;
+}>;
+/**
+ * Root structure of mcp-providers.json, downloaded from S3.
+ * Both provider entries are optional — omit any provider that is not enabled.
+ */
+export interface McpProvidersConfig {
+    /** Schema version of the providers file (semver string). */
+    version: string;
+    providers: {
+        gitlab?: GitLabProviderConfig;
+        atlassian?: AtlassianProviderConfig;
+    };
+}
+export declare const McpProvidersConfigSchema: z.ZodObject<{
+    version: z.ZodString;
+    providers: z.ZodObject<{
+        gitlab: z.ZodOptional<z.ZodObject<{
+            /** z.string().url() validates URL structure; startsWith enforces HTTPS. */
+            baseUrl: z.ZodString;
+            clientId: z.ZodString;
+            scopes: z.ZodArray<z.ZodString, "many">;
+            redirectPort: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            baseUrl: string;
+            clientId: string;
+            scopes: string[];
+            redirectPort?: number | undefined;
+        }, {
+            baseUrl: string;
+            clientId: string;
+            scopes: string[];
+            redirectPort?: number | undefined;
+        }>>;
+        atlassian: z.ZodOptional<z.ZodObject<{
+            clientId: z.ZodString;
+            clientSecret: z.ZodString;
+            scopes: z.ZodArray<z.ZodString, "many">;
+            redirectPort: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            clientId: string;
+            scopes: string[];
+            clientSecret: string;
+            redirectPort?: number | undefined;
+        }, {
+            clientId: string;
+            scopes: string[];
+            clientSecret: string;
+            redirectPort?: number | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        gitlab?: {
+            baseUrl: string;
+            clientId: string;
+            scopes: string[];
+            redirectPort?: number | undefined;
+        } | undefined;
+        atlassian?: {
+            clientId: string;
+            scopes: string[];
+            clientSecret: string;
+            redirectPort?: number | undefined;
+        } | undefined;
+    }, {
+        gitlab?: {
+            baseUrl: string;
+            clientId: string;
+            scopes: string[];
+            redirectPort?: number | undefined;
+        } | undefined;
+        atlassian?: {
+            clientId: string;
+            scopes: string[];
+            clientSecret: string;
+            redirectPort?: number | undefined;
+        } | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    version: string;
+    providers: {
+        gitlab?: {
+            baseUrl: string;
+            clientId: string;
+            scopes: string[];
+            redirectPort?: number | undefined;
+        } | undefined;
+        atlassian?: {
+            clientId: string;
+            scopes: string[];
+            clientSecret: string;
+            redirectPort?: number | undefined;
+        } | undefined;
+    };
+}, {
+    version: string;
+    providers: {
+        gitlab?: {
+            baseUrl: string;
+            clientId: string;
+            scopes: string[];
+            redirectPort?: number | undefined;
+        } | undefined;
+        atlassian?: {
+            clientId: string;
+            scopes: string[];
+            clientSecret: string;
+            redirectPort?: number | undefined;
+        } | undefined;
+    };
+}>;
+//# sourceMappingURL=types.d.ts.map

package/dist/mcp/config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/mcp/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,KAAK,CAAC,EAAE;QACN,8EAA8E;QAC9E,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,oEAAoE;QACpE,mBAAmB,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;KAC1C,CAAC;IAEF,OAAO,CAAC,EAAE;QACR,0CAA0C;QAC1C,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;QAC5C,qEAAqE;QACrE,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc/B,CAAC;AAMH;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,0BAA0B;IACrC,2EAA2E;;;;;;;;;;;;;;;EAK3E,CAAC;AAMH;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;EAKxC,CAAC;AAMH;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE;QACT,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,SAAS,CAAC,EAAE,uBAAuB,CAAC;KACrC,CAAC;CACH;AAED,eAAO,MAAM,wBAAwB;;;;YAlDnC,2EAA2E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwD3E,CAAC"}

package/dist/mcp/config/types.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpProvidersConfigSchema = exports.AtlassianProviderConfigSchema = exports.GitLabProviderConfigSchema = exports.McpLocalConfigSchema = void 0;
+const zod_1 = require("zod");
+// ---------------------------------------------------------------------------
+// Shared primitive schemas
+// ---------------------------------------------------------------------------
+/** Non-reserved, non-privileged port range (1025-65535). */
+const portSchema = zod_1.z.number().int().min(1025).max(65535).optional();
+exports.McpLocalConfigSchema = zod_1.z.object({
+    port: portSchema,
+    store: zod_1.z
+        .object({
+        path: zod_1.z.string().optional(),
+        encryptionKeySource: zod_1.z.enum(['keychain', 'env']).optional(),
+    })
+        .optional(),
+    logging: zod_1.z
+        .object({
+        level: zod_1.z.enum(['debug', 'info', 'warn', 'error']).optional(),
+        path: zod_1.z.string().optional(),
+    })
+        .optional(),
+});
+exports.GitLabProviderConfigSchema = zod_1.z.object({
+    /** z.string().url() validates URL structure; startsWith enforces HTTPS. */
+    baseUrl: zod_1.z.string().url().startsWith('https://'),
+    clientId: zod_1.z.string().min(1),
+    scopes: zod_1.z.array(zod_1.z.string().min(1)).min(1),
+    redirectPort: portSchema,
+});
+exports.AtlassianProviderConfigSchema = zod_1.z.object({
+    clientId: zod_1.z.string().min(1),
+    clientSecret: zod_1.z.string().min(1),
+    scopes: zod_1.z.array(zod_1.z.string().min(1)).min(1),
+    redirectPort: portSchema,
+});
+exports.McpProvidersConfigSchema = zod_1.z.object({
+    version: zod_1.z.string(),
+    providers: zod_1.z.object({
+        gitlab: exports.GitLabProviderConfigSchema.optional(),
+        atlassian: exports.AtlassianProviderConfigSchema.optional(),
+    }),
+});
+//# sourceMappingURL=types.js.map

package/dist/mcp/config/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/mcp/config/types.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,4DAA4D;AAC5D,MAAM,UAAU,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;AA6BvD,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,UAAU;IAChB,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,mBAAmB,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC5D,CAAC;SACD,QAAQ,EAAE;IACb,OAAO,EAAE,OAAC;SACP,MAAM,CAAC;QACN,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC5D,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAqBU,QAAA,0BAA0B,GAAG,OAAC,CAAC,MAAM,CAAC;IACjD,2EAA2E;IAC3E,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IAChD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,YAAY,EAAE,UAAU;CACzB,CAAC,CAAC;AAqBU,QAAA,6BAA6B,GAAG,OAAC,CAAC,MAAM,CAAC;IACpD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,YAAY,EAAE,UAAU;CACzB,CAAC,CAAC;AAmBU,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC;QAClB,MAAM,EAAE,kCAA0B,CAAC,QAAQ,EAAE;QAC7C,SAAS,EAAE,qCAA6B,CAAC,QAAQ,EAAE;KACpD,CAAC;CACH,CAAC,CAAC"}

package/dist/mcp/daemon/entry-logic.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Daemon entry-point logic extracted for testability.
+ *
+ * All functions in this module are pure filesystem / process utilities that
+ * can be exercised in unit tests without forking a real daemon process.
+ */
+/**
+ * Write the daemon startup confirmation file to tmpdir.
+ *
+ * Returns the absolute path of the file written so the caller can log it
+ * or pass it to cleanupOnShutdown.
+ */
+export declare function writeStartupFile(pid: number, port: number): string;
+/**
+ * Remove daemon-owned files during graceful shutdown.
+ *
+ * Silently ignores ENOENT — any file that is already absent is fine.
+ * Any other filesystem error is re-thrown.
+ */
+export declare function cleanupOnShutdown(pid: number): void;
+/**
+ * Read the package version from package.json in cwd.
+ *
+ * Falls back to "0.0.0" when the file cannot be found or parsed — this keeps
+ * the daemon running even in unusual deploy layouts.
+ */
+export declare function getPackageVersion(): string;
+//# sourceMappingURL=entry-logic.d.ts.map

package/dist/mcp/daemon/entry-logic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-logic.d.ts","sourceRoot":"","sources":["../../../src/mcp/daemon/entry-logic.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CASlE;AAMD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAUnD;AAgBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAQ1C"}

package/dist/mcp/daemon/entry-logic.js

@@ -0,0 +1,82 @@
+"use strict";
+/**
+ * Daemon entry-point logic extracted for testability.
+ *
+ * All functions in this module are pure filesystem / process utilities that
+ * can be exercised in unit tests without forking a real daemon process.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeStartupFile = writeStartupFile;
+exports.cleanupOnShutdown = cleanupOnShutdown;
+exports.getPackageVersion = getPackageVersion;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+// ---------------------------------------------------------------------------
+// writeStartupFile
+// ---------------------------------------------------------------------------
+/**
+ * Write the daemon startup confirmation file to tmpdir.
+ *
+ * Returns the absolute path of the file written so the caller can log it
+ * or pass it to cleanupOnShutdown.
+ */
+function writeStartupFile(pid, port) {
+    const filePath = (0, node_path_1.join)((0, node_os_1.tmpdir)(), `padua-mcp-${pid}.ready`);
+    const data = {
+        pid,
+        port,
+        readyAt: new Date().toISOString(),
+    };
+    (0, node_fs_1.writeFileSync)(filePath, JSON.stringify(data));
+    return filePath;
+}
+// ---------------------------------------------------------------------------
+// cleanupOnShutdown
+// ---------------------------------------------------------------------------
+/**
+ * Remove daemon-owned files during graceful shutdown.
+ *
+ * Silently ignores ENOENT — any file that is already absent is fine.
+ * Any other filesystem error is re-thrown.
+ */
+function cleanupOnShutdown(pid) {
+    const files = [
+        (0, node_path_1.join)((0, node_os_1.homedir)(), '.padua', 'mcp-server.pid'),
+        (0, node_path_1.join)((0, node_os_1.homedir)(), '.padua', 'mcp-auth.json'),
+        (0, node_path_1.join)((0, node_os_1.tmpdir)(), `padua-mcp-${pid}.ready`),
+    ];
+    for (const f of files) {
+        removeIfExists(f);
+    }
+}
+function removeIfExists(filePath) {
+    try {
+        (0, node_fs_1.unlinkSync)(filePath);
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT') {
+            throw err;
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// getPackageVersion
+// ---------------------------------------------------------------------------
+/**
+ * Read the package version from package.json in cwd.
+ *
+ * Falls back to "0.0.0" when the file cannot be found or parsed — this keeps
+ * the daemon running even in unusual deploy layouts.
+ */
+function getPackageVersion() {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const pkg = require((0, node_path_1.join)(__dirname, '..', '..', '..', 'package.json'));
+        return pkg.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+//# sourceMappingURL=entry-logic.js.map

package/dist/mcp/daemon/entry-logic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-logic.js","sourceRoot":"","sources":["../../../src/mcp/daemon/entry-logic.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAiBH,4CASC;AAYD,8CAUC;AAsBD,8CAQC;AA5ED,qCAAoD;AACpD,yCAAiC;AACjC,qCAA0C;AAG1C,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,GAAW,EAAE,IAAY;IACxD,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,aAAa,GAAG,QAAQ,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAsB;QAC9B,GAAG;QACH,IAAI;QACJ,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;IACF,IAAA,uBAAa,EAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG;QACZ,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,QAAQ,EAAE,gBAAgB,CAAC;QAC3C,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,QAAQ,EAAE,eAAe,CAAC;QAC1C,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,aAAa,GAAG,QAAQ,CAAC;KACzC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,cAAc,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,CAAC;QACH,IAAA,oBAAU,EAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAgB,iBAAiB;IAC/B,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAyB,CAAC;QAC/F,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/mcp/daemon/entry.d.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+/**
+ * Daemon process entry point.
+ * Runs in the forked child process via child_process.fork().
+ * Not imported by other modules — it is the entryScript passed to forkDaemon().
+ */
+export {};
+//# sourceMappingURL=entry.d.ts.map

package/dist/mcp/daemon/entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.d.ts","sourceRoot":"","sources":["../../../src/mcp/daemon/entry.ts"],"names":[],"mappings":";AACA;;;;GAIG"}

package/dist/mcp/daemon/entry.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Daemon process entry point.
+ * Runs in the forked child process via child_process.fork().
+ * Not imported by other modules — it is the entryScript passed to forkDaemon().
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const logging_1 = require("../server/logging");
+const entry_logic_1 = require("./entry-logic");
+const port = parseInt(process.env.PADUA_MCP_PORT ?? '8919', 10);
+const bearerToken = process.env.PADUA_MCP_BEARER_TOKEN ?? '';
+const logger = (0, logging_1.createLogger)();
+// Ignore SIGINT — the daemon must not respond to Ctrl-C from the parent terminal.
+process.on('SIGINT', () => { });
+// Graceful shutdown: clean up files and exit cleanly.
+process.on('SIGTERM', () => {
+    logger.info('Shutting down daemon...');
+    (0, entry_logic_1.cleanupOnShutdown)(process.pid);
+    process.exit(0);
+});
+async function main() {
+    logger.info('Daemon starting', { pid: process.pid, port });
+    const version = (0, entry_logic_1.getPackageVersion)();
+    const startupFilePath = (0, entry_logic_1.writeStartupFile)(process.pid, port);
+    logger.info('Daemon ready', { port, startupFile: startupFilePath, version });
+    // Keep the process alive; signal handlers above manage lifecycle.
+    void bearerToken; // consumed via env by the MCP server (server.ts integration)
+}
+main().catch((err) => {
+    logger.error('Daemon failed to start', { error: String(err) });
+    process.exit(1);
+});
+//# sourceMappingURL=entry.js.map

package/dist/mcp/daemon/entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.js","sourceRoot":"","sources":["../../../src/mcp/daemon/entry.ts"],"names":[],"mappings":";;AACA;;;;GAIG;;AAEH,+CAAiD;AACjD,+CAAuF;AAEvF,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AAChE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;AAC7D,MAAM,MAAM,GAAG,IAAA,sBAAY,GAAE,CAAC;AAE9B,kFAAkF;AAClF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAE/B,sDAAsD;AACtD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACvC,IAAA,+BAAiB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAG,IAAA,+BAAiB,GAAE,CAAC;IAEpC,MAAM,eAAe,GAAG,IAAA,8BAAgB,EAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;IAE7E,kEAAkE;IAClE,KAAK,WAAW,CAAC,CAAC,6DAA6D;AACjF,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/mcp/daemon/fork.d.ts

@@ -0,0 +1,21 @@
+import type { DaemonInfo } from './types';
+interface PathResolver {
+    pidFile: () => string;
+    authFile: () => string;
+    startupFile: (pid: number) => string;
+    paduaDir: () => string;
+}
+/** Override path resolution — intended for tests only. */
+export declare function setPathResolver(r: Partial<PathResolver>): void;
+/** Reset path resolution to production defaults. */
+export declare function resetPathResolver(): void;
+export declare function getPidFilePath(): string;
+export declare function getAuthFilePath(): string;
+export declare function getStartupFilePath(pid: number): string;
+export declare function isProcessAlive(pid: number): boolean;
+export declare function readExistingDaemon(): DaemonInfo | null;
+export declare function forkDaemon(entryScript: string, port: number): Promise<DaemonInfo>;
+export declare function stopDaemon(): boolean;
+export declare function cleanupDaemonFiles(pid?: number): void;
+export {};
+//# sourceMappingURL=fork.d.ts.map

package/dist/mcp/daemon/fork.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fork.d.ts","sourceRoot":"","sources":["../../../src/mcp/daemon/fork.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,SAAS,CAAC;AAOvD,UAAU,YAAY;IACpB,OAAO,EAAE,MAAM,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,MAAM,CAAC;IACvB,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IACrC,QAAQ,EAAE,MAAM,MAAM,CAAC;CACxB;AASD,0DAA0D;AAC1D,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAE9D;AAED,oDAAoD;AACpD,wBAAgB,iBAAiB,IAAI,IAAI,CAOxC;AAMD,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtD;AAMD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOnD;AAMD,wBAAgB,kBAAkB,IAAI,UAAU,GAAG,IAAI,CAyBtD;AAMD,wBAAsB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAuBvF;AAMD,wBAAgB,UAAU,IAAI,OAAO,CAgBpC;AAMD,wBAAgB,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAMrD"}