@qodalis/mcp-cli 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,24 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
+[Semantic Versioning](https://semver.org/).
+
+## [0.1.0] - 2026-10-15
+
+### Added
+
+- First release: a stdio MCP server that proxies Claude Code (or any MCP client)
+  to a Qodalis CLI server's MCP endpoint (`<QCLI_URL>/api/qcli/mcp`). Tools are
+  taken from the server's `tools/list` and passed through unchanged; calls are
+  forwarded.
+- Authentication with an API token or the server's static MCP token
+  (`QCLI_TOKEN`), or with `QCLI_USER` / `QCLI_PASSWORD` (signs in again after a
+  401).
+- `QCLI_READ_ONLY`, `QCLI_TOOLS` and `QCLI_EXCLUDE` client-side tool filters.
+- Resilience: connect on first use, failed connects are not cached, one retry on
+  connection loss, fast failure (`QCLI_CONNECTION_TIMEOUT`) with actionable
+  messages for unreachable servers, rejected credentials, missing permissions and
+  MCP not enabled; 60 s tool-list cache refreshed for unknown tools.
+- `QCLI_REQUEST_TIMEOUT`, `QCLI_TRUST_CERT`, `--env-file` / `QCLI_ENV_FILE`,
+  `QODALIS_CLI_*` aliases, `--help`, `--version`.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Qodalis Solutions SRL
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,274 @@
-# Temporary Holding Version
+# @qodalis/mcp-cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A resilient [Model Context Protocol](https://modelcontextprotocol.io) server that
+gives [Claude Code](https://code.claude.com) a [Qodalis CLI](https://cli.qodalis.com)
+server: its CLI commands, files, data explorer, jobs and plugin tools.
+
+Every Qodalis CLI server (.NET, Node or Python) can expose an MCP endpoint at
+`<server>/api/qcli/mcp`. `mcp-cli` runs on your machine as a stdio MCP server
+and proxies to that endpoint: Claude Code sees exactly the server's tools, with
+the permissions of the account you configure. It handles sign-in, reconnects
+after network drops and lets you narrow what the assistant may use.
+
+## Highlights
+
+- **No tool-specific code.** Tools come from the server's `tools/list` and are
+  passed through unchanged (names, schemas, annotations); calls are forwarded.
+  New commands on the server show up without updating the proxy.
+- **Token or password.** Use an API token (`QCLI_TOKEN`), or sign in with
+  `QCLI_USER` / `QCLI_PASSWORD`; an expired session is renewed automatically on
+  the next call.
+- **Read-only mode** (`QCLI_READ_ONLY=true`) exposes only the tools the server
+  marks read-only, and refuses calls to anything else.
+- **Client-side allow and deny lists** (`QCLI_TOOLS`, `QCLI_EXCLUDE`, trailing
+  `*` allowed) on top of the server's own permissions.
+- **Self-healing connection.** It connects on first use, never caches a failed
+  connect, retries once when the connection drops, and fails fast (8 s) when the
+  server is unreachable, with a message that says what to check.
+- **Clear errors**: a rejected token, MCP not enabled on the server, a missing
+  permission or an unreachable host each come back as one actionable sentence.
+
+## Quick start
+
+```bash
+npx -y @qodalis/mcp-cli --help
+```
+
+The server must have MCP enabled (`mcp` option; see
+[MCP endpoint](https://cli.qodalis.com/docs/server-integration#mcp-endpoint)).
+Default ports: .NET `8046`, Node `8047`, Python `8048`.
+
+### Claude Code
+
+```bash
+claude mcp add qcli -- npx -y @qodalis/mcp-cli
+```
+
+then set the environment in `~/.claude.json`:
+
+```json
+{
+  "mcpServers": {
+    "qcli": {
+      "command": "npx",
+      "args": ["-y", "@qodalis/mcp-cli"],
+      "env": {
+        "QCLI_URL": "http://localhost:8047",
+        "QCLI_TOKEN": "qcli_pat_..."
+      }
+    }
+  }
+}
+```
+
+or sign in with a user name and password instead of a token:
+
+```json
+"env": {
+  "QCLI_URL": "http://localhost:8047",
+  "QCLI_USER": "ops",
+  "QCLI_PASSWORD": "********"
+}
+```
+
+The same in one command, with `-e` flags:
+
+```bash
+claude mcp add qcli -e QCLI_URL=http://localhost:8047 -e QCLI_TOKEN=qcli_pat_... -- npx -y @qodalis/mcp-cli
+```
+
+Add `--scope user` to make it available in every project. With
+`--scope project` the entry goes into the project's `.mcp.json`, which is
+usually committed: keep the secret out of it with
+`"QCLI_TOKEN": "${QCLI_TOKEN}"` and set the variable in your shell. A `.env`
+file works too:
+
+```json
+{ "command": "npx", "args": ["-y", "@qodalis/mcp-cli", "--env-file", "/path/to/.env"] }
+```
+
+Pin a version in shared configs (`@qodalis/mcp-cli@0.1.0`) so an upgrade is a
+deliberate change.
+
+### Getting a token
+
+In the web CLI connected to the server (users plugin), signed in as the account
+the assistant should act as:
+
+```bash
+token create claude --expires=90
+# token create claude --permissions=commands:execute,files:read   (narrower scope)
+```
+
+The token (`qcli_pat_…`) is shown once. Without the web CLI, sign in and create
+one with curl:
+
+```bash
+SESSION=$(curl -s http://localhost:8047/api/v1/qcli/sessions \
+  -H 'Content-Type: application/json' -d '{"username":"ops","password":"..."}' | jq -r .token)
+curl -s http://localhost:8047/api/v1/qcli/tokens -H "Authorization: Bearer $SESSION" \
+  -H 'Content-Type: application/json' -d '{"name":"claude","expiresInDays":90}' | jq -r .token
+curl -s -X DELETE http://localhost:8047/api/v1/qcli/sessions/current -H "Authorization: Bearer $SESSION"
+```
+
+A server **without** the users plugin protects its endpoint with a static token
+(its `mcp.token` option): put that value in `QCLI_TOKEN`. If it sets none, the
+endpoint is open and no auth variable is needed.
+
+## Configuration
+
+Every setting is an environment variable. `QODALIS_CLI_*` names are accepted as
+aliases for every key.
+
+| Variable                  | Default  | Description                                                                                        |
+| ------------------------- | -------- | -------------------------------------------------------------------------------------------------- |
+| `QCLI_URL`                | required | Server base URL, e.g. `https://cli.example.com` (a pasted `…/api/qcli/mcp` URL is accepted).       |
+| `QCLI_TOKEN`              | none     | API token (`token create` in the web CLI) or the server's static `mcp.token`.                      |
+| `QCLI_USER`               | none     | Sign in with this user name instead of a token (needs `QCLI_PASSWORD`).                            |
+| `QCLI_PASSWORD`           | none     | Password for `QCLI_USER`. Never logged.                                                            |
+| `QCLI_READ_ONLY`          | `false`  | Expose and allow only tools annotated `readOnlyHint: true`. See [read-only mode](#read-only-mode). |
+| `QCLI_TOOLS`              | all      | Comma-separated allow-list of tool names; a trailing `*` matches a prefix (`fs_*`).                |
+| `QCLI_EXCLUDE`            | none     | Comma-separated deny-list, same syntax, applied after `QCLI_TOOLS`.                                |
+| `QCLI_CONNECTION_TIMEOUT` | `8000`   | Milliseconds to wait for the TCP/TLS connection before reporting the server unreachable.           |
+| `QCLI_REQUEST_TIMEOUT`    | `60000`  | Milliseconds a single request (`tools/list`, `tools/call`) may take.                               |
+| `QCLI_TRUST_CERT`         | `false`  | Accept a self-signed TLS certificate.                                                              |
+| `QCLI_ENV_FILE`           | none     | Path to a `.env` file (same as `--env-file`). Variables already set in the environment win.        |
+
+Set either `QCLI_TOKEN` or `QCLI_USER` + `QCLI_PASSWORD`, not both.
+
+## Tools
+
+The tools are whatever the server exposes to your account. A typical server
+offers:
+
+| Tools                                                                | Available when                         |
+| -------------------------------------------------------------------- | -------------------------------------- |
+| `server_info`                                                        | always: version, enabled features      |
+| one tool per CLI command (`weather`, `weather_current`, ...)         | always                                 |
+| `fs_list`, `fs_stat`, `fs_read`, `fs_write`, `fs_mkdir`, `fs_delete` | the server's filesystem API is enabled |
+| `data_sources`, `data_schema`, `data_query`                          | the data explorer is enabled           |
+| `jobs_list`, `jobs_get`, `jobs_history`, `jobs_trigger`, ...         | the jobs plugin is installed           |
+| plugin tools                                                         | a server plugin contributes them       |
+
+Each one is limited by the account's permissions on the server (for example
+`commands:execute`, `files:read` / `files:write`, `data:query`, `jobs:manage`),
+and by the token's scope when it was created with `--permissions`.
+
+## Read-only mode
+
+With `QCLI_READ_ONLY=true` the proxy lists only the tools the server annotates
+`readOnlyHint: true` (such as `server_info`, `fs_list`, `fs_read`,
+`data_schema`, `jobs_list`) and refuses calls to any other tool before they
+reach the server. Command tools carry no read-only annotation, so they are
+hidden in this mode; add the ones you want with a separate, non-read-only entry
+and `QCLI_TOOLS`.
+
+The filter is defence in depth. The real boundary is the account: give the
+assistant a user (or a token scope) with only the permissions it should have.
+
+## Several servers
+
+Add one entry per server (and per access level) with a distinct name:
+
+```json
+{
+  "mcpServers": {
+    "qcli-dev": {
+      "command": "npx",
+      "args": ["-y", "@qodalis/mcp-cli"],
+      "env": { "QCLI_URL": "http://localhost:8047", "QCLI_TOKEN": "qcli_pat_dev..." }
+    },
+    "qcli-prod": {
+      "command": "npx",
+      "args": ["-y", "@qodalis/mcp-cli"],
+      "env": {
+        "QCLI_URL": "https://cli.example.com",
+        "QCLI_TOKEN": "qcli_pat_prod...",
+        "QCLI_READ_ONLY": "true"
+      }
+    },
+    "qcli-prod-jobs": {
+      "command": "npx",
+      "args": ["-y", "@qodalis/mcp-cli"],
+      "env": {
+        "QCLI_URL": "https://cli.example.com",
+        "QCLI_TOKEN": "qcli_pat_prod...",
+        "QCLI_TOOLS": "jobs_*,server_info",
+        "QCLI_EXCLUDE": "jobs_cancel"
+      }
+    }
+  }
+}
+```
+
+## Troubleshooting
+
+`claude mcp list` shows whether each server connects; inside a session `/mcp`
+shows its status and tools and lets you reconnect. The proxy logs to stderr
+(`claude --debug` shows it).
+
+| Message                                                                       | What to do                                                                                                                                                |
+| ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `… answered 401 (not authenticated): QCLI_TOKEN is wrong, expired or revoked` | Create a new token (`token create claude`) and update `QCLI_TOKEN`. `token list` in the web CLI shows expiry dates.                                       |
+| `… rejected QCLI_USER / QCLI_PASSWORD`                                        | Check the credentials; the account may be disabled or locked out after failed sign-ins.                                                                   |
+| `… answered 403 …`                                                            | The account lacks `commands:execute`, or the server rejected the request origin.                                                                          |
+| `MCP is not enabled on this server (enable the mcp option)`                   | Turn on the server's `mcp` option and restart it; check `QCLI_URL` (base URL, not a page of the web app).                                                 |
+| `Cannot reach … Check QCLI_URL / VPN.`                                        | The server is down, the URL or port is wrong, or the VPN is disconnected. Retry the call once it is back: the proxy reconnects by itself.                 |
+| `… did not answer within 60000 ms`                                            | A slow command; raise `QCLI_REQUEST_TIMEOUT`.                                                                                                             |
+| A tool is missing                                                             | The account (or token scope) lacks its permission, the feature is not enabled on the server, or `QCLI_READ_ONLY` / `QCLI_TOOLS` / `QCLI_EXCLUDE` hide it. |
+| `QCLI_URL … is required` at startup                                           | The `env` block is missing or the variable name is misspelled; `npx -y @qodalis/mcp-cli --help` lists every variable.                                     |
+
+## How reconnection works
+
+1. The proxy connects to the endpoint on the first `tools/list` or
+   `tools/call`, not at startup, so Claude Code starts even when the server is
+   down.
+2. A failed connect is not cached: the next call tries again.
+3. A connection-level error (refused, reset, socket closed, DNS failure) drops
+   the connection and retries the request once on a fresh one. A connect timeout
+   is not retried, so an unreachable host fails within `QCLI_CONNECTION_TIMEOUT`.
+4. With `QCLI_USER` / `QCLI_PASSWORD`, a 401 signs in again and retries once.
+5. The tool list is cached for 60 s; a call to a tool the proxy does not know
+   yet refreshes it first, so new server commands work without a restart.
+
+## Security notes
+
+- Tokens and passwords are read from the environment, sent only to `QCLI_URL`,
+  and never written to logs or tool results.
+- Prefer an API token with a narrow `--permissions` scope and an expiry over a
+  password; revoke it with `token revoke <id>` when it is no longer needed.
+- Use `https://` for anything but `localhost`. `QCLI_TRUST_CERT=true` disables
+  certificate verification for this process; use it only for self-signed
+  certificates you control.
+- Nothing is written to stdout except the MCP protocol stream.
+
+See [SECURITY.md](SECURITY.md) for reporting vulnerabilities.
+
+## Library use
+
+The pieces are exported for embedding:
+
+```ts
+import { createProxyServer, loadConfig, RemoteServer } from '@qodalis/mcp-cli';
+
+const config = loadConfig(process.env);
+const remote = new RemoteServer(config, { clientInfo: { name: 'my-app', version: '1.0.0' } });
+const server = createProxyServer(remote, config); // a low-level MCP Server: connect any transport
+```
+
+## Development
+
+```bash
+npm install
+npm run build
+npm test             # unit tests and stdio end-to-end tests against a fake server (build first)
+npm run typecheck
+npm run check-format
+npm run dev -- --env-file .env   # run from source
+```
+
+See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+[MIT](LICENSE) © Qodalis Solutions SRL

package/dist/src/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/src/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":""}

package/dist/src/cli.js

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+import { serveStdio } from '@modelcontextprotocol/server/stdio';
+import { ConfigError, describeConfig, ENV_FILE_VARIABLES, loadConfig } from './config.js';
+import { applyEnvFile } from './env-file.js';
+import { RemoteServer } from './remote.js';
+import { createProxyServer, SERVER_NAME, SERVER_VERSION } from './server.js';
+const SHUTDOWN_GRACE_MS = 5000;
+const usage = `Proxies Claude Code (or any MCP client) to a Qodalis CLI server's MCP endpoint
+(<QCLI_URL>/api/qcli/mcp). Configuration is read from the environment (QCLI_* or
+QODALIS_CLI_* names):
+  QCLI_URL (required)              server base URL, e.g. http://localhost:8047
+  QCLI_TOKEN                       API token (token create in the web CLI) or the server's mcp token
+  QCLI_USER, QCLI_PASSWORD         sign in with a password instead (signs in again on 401)
+  QCLI_READ_ONLY (false)           only tools the server marks read-only
+  QCLI_TOOLS                       comma-separated allow-list of tool names (trailing * allowed)
+  QCLI_EXCLUDE                     comma-separated deny-list, applied after QCLI_TOOLS
+  QCLI_CONNECTION_TIMEOUT (8000 ms)  QCLI_REQUEST_TIMEOUT (60000 ms)
+  QCLI_TRUST_CERT (false)          accept a self-signed TLS certificate
+  QCLI_ENV_FILE                    path to a .env file (same as --env-file)
+`;
+const log = (message) => {
+    // Anything written to stdout corrupts the JSON-RPC stream: all logging goes to stderr.
+    process.stderr.write(`[${SERVER_NAME}] ${message}\n`);
+};
+const parseArgs = (argv) => {
+    const result = {};
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--help' || arg === '-h') {
+            process.stdout.write(`Usage: mcp-cli [--env-file <path>] [--help] [--version]\n\n${usage}`);
+            process.exit(0);
+        }
+        if (arg === '--version' || arg === '-v') {
+            process.stdout.write(`${SERVER_VERSION}\n`);
+            process.exit(0);
+        }
+        if (arg === '--env-file') {
+            const value = argv[i + 1];
+            if (!value) {
+                throw new ConfigError('--env-file requires a path.');
+            }
+            result.envFile = value;
+            i++;
+            continue;
+        }
+        throw new ConfigError(`Unknown argument "${arg}".`);
+    }
+    return result;
+};
+const main = () => {
+    try {
+        const args = parseArgs(process.argv.slice(2));
+        const envFile = args.envFile ?? ENV_FILE_VARIABLES.map((name) => process.env[name]).find(Boolean);
+        if (envFile) {
+            applyEnvFile(envFile, process.env);
+        }
+        const config = loadConfig(process.env);
+        if (config.trustCert) {
+            log('QCLI_TRUST_CERT=true: TLS certificates are not verified');
+        }
+        const remote = new RemoteServer(config, {
+            clientInfo: { name: SERVER_NAME, version: SERVER_VERSION },
+            log,
+        });
+        const handle = serveStdio(() => createProxyServer(remote, config), {
+            onerror: (error) => log(`transport error: ${error.message}`),
+        });
+        log(`v${SERVER_VERSION} ready for ${describeConfig(config)}; connects on first use`);
+        let shuttingDown = false;
+        const shutdown = async (reason) => {
+            if (shuttingDown) {
+                return;
+            }
+            shuttingDown = true;
+            log(`shutting down (${reason})`);
+            setTimeout(() => process.exit(0), SHUTDOWN_GRACE_MS).unref();
+            await handle.close().catch(() => undefined);
+            await remote.close();
+            process.exit(0);
+        };
+        process.once('SIGINT', () => void shutdown('SIGINT'));
+        process.once('SIGTERM', () => void shutdown('SIGTERM'));
+        process.stdin.once('end', () => void shutdown('stdin closed'));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        log(`fatal: ${message}`);
+        process.exit(1);
+    }
+};
+main();
+//# sourceMappingURL=cli.js.map

package/dist/src/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7E,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,MAAM,KAAK,GAAG;;;;;;;;;;;;CAYb,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;IAClC,uFAAuF;IACvF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,WAAW,KAAK,OAAO,IAAI,CAAC,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,IAAc,EAAwB,EAAE;IACvD,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,8DAA8D,KAAK,EAAE,CACxE,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,cAAc,IAAI,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,MAAM,IAAI,WAAW,CAAC,6BAA6B,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YACvB,CAAC,EAAE,CAAC;YACJ,SAAS;QACb,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,GAAS,EAAE;IACpB,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,OAAO,GACT,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtF,IAAI,OAAO,EAAE,CAAC;YACV,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACnB,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE;YACpC,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE;YAC1D,GAAG;SACN,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE;YAC/D,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,OAAO,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,cAAc,cAAc,cAAc,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAErF,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;YACrD,IAAI,YAAY,EAAE,CAAC;gBACf,OAAO;YACX,CAAC;YACD,YAAY,GAAG,IAAI,CAAC;YACpB,GAAG,CAAC,kBAAkB,MAAM,GAAG,CAAC,CAAC;YACjC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,KAAK,EAAE,CAAC;YAC7D,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC;AAEF,IAAI,EAAE,CAAC"}

package/dist/src/config.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Environment-driven configuration. Primary names use `QCLI_`; `QODALIS_CLI_`
+ * is accepted as an alias for every key.
+ */
+export type Env = Record<string, string | undefined>;
+export declare class ConfigError extends Error {
+    constructor(message: string);
+}
+/** How the proxy authenticates to the Qodalis CLI server. */
+export type AuthConfig = {
+    kind: 'none';
+} | {
+    kind: 'token';
+    token: string;
+} | {
+    kind: 'password';
+    password: string;
+    user: string;
+};
+export type Config = {
+    auth: AuthConfig;
+    connectionTimeoutMs: number;
+    /** Client-side deny-list (trailing `*` allowed), applied after `tools` */
+    exclude: string[];
+    /** Expose and allow only tools annotated `readOnlyHint: true` */
+    readOnly: boolean;
+    requestTimeoutMs: number;
+    /** Client-side allow-list (trailing `*` allowed); empty = every tool */
+    tools: string[];
+    /** Accept self-signed TLS certificates */
+    trustCert: boolean;
+    /** Server base URL, e.g. `https://cli.example.com` (no trailing slash) */
+    url: string;
+};
+export declare const PREFIXES: string[];
+/** `QCLI_<suffix>` plus the `QODALIS_CLI_<suffix>` alias. */
+export declare const names: (suffix: string) => string[];
+export declare const ENV_FILE_VARIABLES: string[];
+export type EnvReader = {
+    boolean: (names: string[], fallback: boolean) => boolean;
+    list: (names: string[]) => string[];
+    optional: (names: string[]) => string | undefined;
+    positiveInteger: (names: string[], fallback: number) => number;
+    required: (names: string[]) => string;
+};
+/** Typed readers over an environment map; the first non-empty name wins. */
+export declare const createEnvReader: (env: Env) => EnvReader;
+/**
+ * Canonical server URL: scheme and host, optional base path, no trailing slash.
+ * A pasted endpoint URL (`…/api/qcli/mcp`) is accepted and reduced to the base.
+ */
+export declare const normalizeUrl: (input: string) => string;
+export declare const loadConfig: (env?: Env) => Config;
+/** One-line summary for the startup log (never contains secrets). */
+export declare const describeConfig: (config: Config) => string;
+//# sourceMappingURL=config.d.ts.map

package/dist/src/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAErD,qBAAa,WAAY,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI9B;AAED,6DAA6D;AAC7D,MAAM,MAAM,UAAU,GAChB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D,MAAM,MAAM,MAAM,GAAG;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iEAAiE;IACjE,QAAQ,EAAE,OAAO,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,0CAA0C;IAC1C,SAAS,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,eAAO,MAAM,QAAQ,UAA0B,CAAC;AAEhD,6DAA6D;AAC7D,eAAO,MAAM,KAAK,GAAI,QAAQ,MAAM,KAAG,MAAM,EAAqD,CAAC;AAEnG,eAAO,MAAM,kBAAkB,UAAoB,CAAC;AAKpD,MAAM,MAAM,SAAS,GAAG;IACpB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,KAAK,OAAO,CAAC;IACzD,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,SAAS,CAAC;IAClD,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/D,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;CACzC,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,eAAe,GAAI,KAAK,GAAG,KAAG,SAoD1C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,MAAM,KAAG,MAY5C,CAAC;AAqBF,eAAO,MAAM,UAAU,GAAI,MAAK,GAAiB,KAAG,MAYnD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,KAAG,MAe/C,CAAC"}

package/dist/src/config.js

@@ -0,0 +1,130 @@
+export class ConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ConfigError';
+    }
+}
+export const PREFIXES = ['QCLI', 'QODALIS_CLI'];
+/** `QCLI_<suffix>` plus the `QODALIS_CLI_<suffix>` alias. */
+export const names = (suffix) => PREFIXES.map((prefix) => `${prefix}_${suffix}`);
+export const ENV_FILE_VARIABLES = names('ENV_FILE');
+const TRUE_VALUES = new Set(['1', 'true', 'yes', 'on']);
+const FALSE_VALUES = new Set(['0', 'false', 'no', 'off']);
+/** Typed readers over an environment map; the first non-empty name wins. */
+export const createEnvReader = (env) => {
+    const optional = (names) => {
+        for (const name of names) {
+            const value = env[name]?.trim();
+            if (value) {
+                return value;
+            }
+        }
+        return undefined;
+    };
+    const describe = (names) => names.length > 1
+        ? `${names[0]} (or its alias ${names.slice(1).join(' / ')})`
+        : (names[0] ?? '');
+    const required = (names) => {
+        const value = optional(names);
+        if (!value) {
+            throw new ConfigError(`${describe(names)} is required.`);
+        }
+        return value;
+    };
+    const boolean = (names, fallback) => {
+        const value = optional(names);
+        if (value === undefined) {
+            return fallback;
+        }
+        const normalized = value.toLowerCase();
+        if (TRUE_VALUES.has(normalized)) {
+            return true;
+        }
+        if (FALSE_VALUES.has(normalized)) {
+            return false;
+        }
+        throw new ConfigError(`${names[0]} must be a boolean (true/false), got "${value}".`);
+    };
+    const positiveInteger = (names, fallback) => {
+        const value = optional(names);
+        if (value === undefined) {
+            return fallback;
+        }
+        const parsed = Number(value);
+        if (!Number.isInteger(parsed) || parsed <= 0) {
+            throw new ConfigError(`${names[0]} must be a positive integer, got "${value}".`);
+        }
+        return parsed;
+    };
+    const list = (names) => (optional(names) ?? '')
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+    return { boolean, list, optional, positiveInteger, required };
+};
+/**
+ * Canonical server URL: scheme and host, optional base path, no trailing slash.
+ * A pasted endpoint URL (`…/api/qcli/mcp`) is accepted and reduced to the base.
+ */
+export const normalizeUrl = (input) => {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        throw new ConfigError(`QCLI_URL must be an http(s) URL, got "${input}".`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new ConfigError(`QCLI_URL must be an http(s) URL, got "${input}".`);
+    }
+    const path = url.pathname.replace(/\/+$/, '').replace(/\/api\/qcli\/mcp$/i, '');
+    return `${url.protocol}//${url.host}${path}`;
+};
+const loadAuth = (read) => {
+    const token = read.optional(names('TOKEN'));
+    const user = read.optional(names('USER'));
+    const password = read.optional(names('PASSWORD'));
+    if (token && (user || password)) {
+        throw new ConfigError('Set either QCLI_TOKEN or QCLI_USER + QCLI_PASSWORD, not both.');
+    }
+    if (token) {
+        return { kind: 'token', token };
+    }
+    if (user || password) {
+        if (!user || !password) {
+            throw new ConfigError('QCLI_USER and QCLI_PASSWORD must be set together.');
+        }
+        return { kind: 'password', password, user };
+    }
+    return { kind: 'none' };
+};
+export const loadConfig = (env = process.env) => {
+    const read = createEnvReader(env);
+    return {
+        auth: loadAuth(read),
+        connectionTimeoutMs: read.positiveInteger(names('CONNECTION_TIMEOUT'), 8000),
+        exclude: read.list(names('EXCLUDE')),
+        readOnly: read.boolean(names('READ_ONLY'), false),
+        requestTimeoutMs: read.positiveInteger(names('REQUEST_TIMEOUT'), 60000),
+        tools: read.list(names('TOOLS')),
+        trustCert: read.boolean(names('TRUST_CERT'), false),
+        url: normalizeUrl(read.required(names('URL'))),
+    };
+};
+/** One-line summary for the startup log (never contains secrets). */
+export const describeConfig = (config) => {
+    const auth = config.auth.kind === 'token'
+        ? 'token auth'
+        : config.auth.kind === 'password'
+            ? `signs in as ${config.auth.user}`
+            : 'no auth';
+    const filters = [
+        config.readOnly ? 'read-only tools' : 'all tools',
+        config.tools.length ? `allow ${config.tools.join(',')}` : '',
+        config.exclude.length ? `exclude ${config.exclude.join(',')}` : '',
+    ]
+        .filter(Boolean)
+        .join(', ');
+    return `${config.url} (${auth}; ${filters})`;
+};
+//# sourceMappingURL=config.js.map

package/dist/src/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,WAAY,SAAQ,KAAK;IAClC,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC9B,CAAC;CACJ;AAwBD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAEhD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAY,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;AAEnG,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;AAEpD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AACxD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAU1D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAQ,EAAa,EAAE;IACnD,MAAM,QAAQ,GAAG,CAAC,KAAe,EAAsB,EAAE;QACrD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;YAChC,IAAI,KAAK,EAAE,CAAC;gBACR,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,KAAe,EAAU,EAAE,CACzC,KAAK,CAAC,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,kBAAkB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;QAC5D,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAG,CAAC,KAAe,EAAU,EAAE;QACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,KAAe,EAAE,QAAiB,EAAW,EAAE;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC;QACpB,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,yCAAyC,KAAK,IAAI,CAAC,CAAC;IACzF,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,CAAC,KAAe,EAAE,QAAgB,EAAU,EAAE;QAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC;QACpB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,qCAAqC,KAAK,IAAI,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAe,EAAY,EAAE,CACvC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;AAClE,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE;IAClD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,WAAW,CAAC,yCAAyC,KAAK,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,IAAI,WAAW,CAAC,yCAAyC,KAAK,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;AACjD,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,IAAe,EAAc,EAAE;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACR,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,CAAC,mDAAmD,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAW,OAAO,CAAC,GAAG,EAAU,EAAE;IACzD,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO;QACH,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;QACpB,mBAAmB,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC;QAC5E,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;QACjD,gBAAgB,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC;QACvE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;QACnD,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;KACjD,CAAC;AACN,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAU,EAAE;IACrD,MAAM,IAAI,GACN,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;QACxB,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU;YAC/B,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;YACnC,CAAC,CAAC,SAAS,CAAC;IACtB,MAAM,OAAO,GAAG;QACZ,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW;QACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QAC5D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;KACrE;SACI,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,OAAO,GAAG,MAAM,CAAC,GAAG,KAAK,IAAI,KAAK,OAAO,GAAG,CAAC;AACjD,CAAC,CAAC"}

package/dist/src/env-file.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A small `.env` parser (no dependency): `KEY=value`, optional `export`,
+ * `#` comments, single/double quotes with `\n`/`\t`/`\\`/`\"` escapes inside
+ * double quotes, and inline comments after unquoted values.
+ */
+export declare const parseEnvFile: (content: string) => Record<string, string>;
+/** Loads a .env file into `env` without overriding keys that are already set. */
+export declare const applyEnvFile: (path: string, env: Record<string, string | undefined>) => void;
+//# sourceMappingURL=env-file.d.ts.map

package/dist/src/env-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.d.ts","sourceRoot":"","sources":["../../src/env-file.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAgBnE,CAAC;AAmBF,iFAAiF;AACjF,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,EAAE,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KAAG,IAapF,CAAC"}