@reposkein/mcp 0.4.0 → 0.5.0

package/dist/serve/serve.js

@@ -0,0 +1,581 @@
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import { makeViewHandler, vizDistDir } from "../cli/view.js";
+import { createMcpServer } from "../server/createMcpServer.js";
+import { agentSlug } from "../store/sidecar.js";
+import { resolveSessionId } from "../store/sessionLog.js";
+import { bearerFromAuthHeader, loadServeTokens, matchServeToken, } from "./tokens.js";
+import { startHeadWatcher } from "./watch.js";
+/** The one path the MCP Streamable HTTP transport answers on. Everything else
+ *  is the viewer + `/api/*`, served by view.ts's own handler. */
+export const MCP_PATH = "/mcp";
+/** Cookie the viewer gets after a successful `?token=` handshake, so a browser
+ *  can keep loading `/api/*` without the secret in every URL. */
+const TOKEN_COOKIE = "reposkein_token";
+/** Cap on a single JSON-RPC POST body. Tool arguments are prose and node ids;
+ *  4 MB is orders of magnitude past anything legitimate. */
+const MAX_BODY_BYTES = 4 * 1024 * 1024;
+/** Cap on concurrent MCP sessions. A leaked token shouldn't be able to make
+ *  the process allocate servers without bound; an operator hitting this has a
+ *  problem worth an error, not silent growth. */
+const MAX_SESSIONS = 64;
+/** How long a session may sit untouched before it is reaped.
+ *
+ *  A crashed or network-partitioned client never sends the DELETE that closes
+ *  its session, so without this every such client permanently consumes one of
+ *  MAX_SESSIONS — and a long-lived server eventually wedges at the cap with
+ *  nothing but corpses. Five minutes is far longer than any tool call and far
+ *  shorter than a working day, so a live-but-idle agent that comes back gets a
+ *  clean `404 session_not_found` and re-initializes. */
+const SESSION_IDLE_MS = 5 * 60 * 1000;
+/** Default bind host. NOT 0.0.0.0: even in the mode that exists to be
+ *  reachable, exposure is an explicit `--host` decision by the operator. */
+export const DEFAULT_SERVE_HOST = "127.0.0.1";
+export const DEFAULT_SERVE_PORT = 4318;
+export const DEFAULT_WATCH_INTERVAL_MS = 30_000;
+export function parseServeArgs(argv) {
+    let port = DEFAULT_SERVE_PORT;
+    let host = DEFAULT_SERVE_HOST;
+    let watchIntervalMs = DEFAULT_WATCH_INTERVAL_MS;
+    let http = false;
+    const positional = [];
+    const intArg = (raw, fallback) => {
+        const n = parseInt(raw ?? "", 10);
+        return Number.isFinite(n) && n >= 0 ? n : fallback;
+    };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === "--http")
+            http = true;
+        else if (a === "--port")
+            port = intArg(argv[++i], DEFAULT_SERVE_PORT);
+        else if (a.startsWith("--port="))
+            port = intArg(a.slice(7), DEFAULT_SERVE_PORT);
+        else if (a === "--host")
+            host = argv[++i] ?? DEFAULT_SERVE_HOST;
+        else if (a.startsWith("--host="))
+            host = a.slice(7);
+        // Seconds on the CLI (an operator thinks in seconds), ms internally.
+        else if (a === "--watch-interval")
+            watchIntervalMs = intArg(argv[++i], 30) * 1000;
+        else if (a.startsWith("--watch-interval="))
+            watchIntervalMs = intArg(a.slice(17), 30) * 1000;
+        else if (!a.startsWith("-"))
+            positional.push(a);
+    }
+    const repoPath = positional[0] ?? process.env.REPOSKEIN_REPO_PATH ?? ".";
+    return { repoPath, opts: { port, host, watchIntervalMs }, http };
+}
+function sendJson(res, status, body, headers = {}) {
+    const text = JSON.stringify(body);
+    res.writeHead(status, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Cache-Control": "no-store",
+        ...headers,
+    });
+    res.end(text);
+}
+/** Reads a request body as JSON, capped. Resolves `{ ok: false }` on a bad
+ *  parse or an oversized body — never throws, never buffers past the cap.
+ *
+ *  Deliberately does NOT destroy the request itself: on oversize it stops
+ *  accumulating and resolves, leaving the caller to write its 400 first and
+ *  destroy afterwards. Destroying here raced the response and turned a clean
+ *  "body too large" into an unexplained connection reset. */
+function readJsonBody(req) {
+    return new Promise((resolvePromise) => {
+        const chunks = [];
+        let size = 0;
+        let settled = false;
+        const finish = (r) => {
+            if (settled)
+                return;
+            settled = true;
+            resolvePromise(r);
+        };
+        req.on("data", (chunk) => {
+            if (settled)
+                return; // over cap already; drain without buffering
+            size += chunk.length;
+            if (size > MAX_BODY_BYTES) {
+                chunks.length = 0;
+                finish({
+                    ok: false,
+                    error: `request body exceeds ${MAX_BODY_BYTES} bytes`,
+                    oversize: true,
+                });
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => {
+            if (chunks.length === 0)
+                return finish({ ok: true, value: undefined });
+            try {
+                finish({ ok: true, value: JSON.parse(Buffer.concat(chunks).toString("utf8")) });
+            }
+            catch {
+                finish({ ok: false, error: "request body is not valid JSON" });
+            }
+        });
+        req.on("error", () => finish({ ok: false, error: "request stream error" }));
+    });
+}
+function cookieValue(header, name) {
+    if (!header)
+        return null;
+    for (const part of header.split(";")) {
+        const eq = part.indexOf("=");
+        if (eq === -1)
+            continue;
+        if (part.slice(0, eq).trim() !== name)
+            continue;
+        try {
+            return decodeURIComponent(part.slice(eq + 1).trim()) || null;
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+/** Builds the one request handler that answers both the MCP endpoint and the
+ *  viewer/`/api/*` surface (REP-17 requirement: one process, one graph).
+ *
+ *  URL layout:
+ *    POST/GET/DELETE `/mcp`  — MCP Streamable HTTP transport
+ *    GET `/api/graph`, `/api/jsonl/*`, `/api/source`, `/api/temporal`
+ *                            — byte-identical to `reposkein-mcp view`, because
+ *                              it IS view.ts's handler, not a copy
+ *    GET everything else     — the prebuilt viewer SPA
+ *
+ *  Auth applies to every route. `/mcp` accepts ONLY
+ *  `Authorization: Bearer <token>`; the viewer routes additionally accept
+ *  `?token=` (which is immediately traded for an HttpOnly cookie and
+ *  redirected away, so it appears once) because a static SPA in a browser
+ *  cannot attach an Authorization header to its own page load. */
+export function createServeApp(opts) {
+    const log = opts.log ?? ((m) => void process.stderr.write(`${m}\n`));
+    const factory = opts.viewHandlerFactory ?? makeViewHandler;
+    const repoPath = resolve(opts.repoPath);
+    const maxSessions = opts.maxSessions ?? MAX_SESSIONS;
+    const idleMs = opts.idleMs ?? SESSION_IDLE_MS;
+    const now = opts.now ?? Date.now;
+    // One session-log id per PROCESS (honoring REPOSKEIN_SESSION_ID), suffixed
+    // per token below. Computed once here rather than per connection: a
+    // reconnecting agent should append to the same file it was writing before,
+    // and `reposkein-mcp stats` groups by that id.
+    const logIdBase = resolveSessionId(process.env);
+    let viewHandler = factory(repoPath, opts.repoId);
+    const sessions = new Map();
+    // Slots claimed by an in-progress `initialize` that has not yet registered
+    // its session. The cap check and this increment are one synchronous pair,
+    // which is what closes the check-then-set race: without it, N concurrent
+    // initializes all saw `sessions.size` from before any of them had connected
+    // and every one of them was admitted.
+    let reservedSlots = 0;
+    /** Closes idle, quiescent sessions. See `ServeApp.sweepIdleSessions`. */
+    function sweepIdleSessions() {
+        const cutoff = now() - idleMs;
+        let closed = 0;
+        for (const [id, s] of [...sessions]) {
+            if (s.inFlight > 0)
+                continue; // never kill a live request
+            if (s.lastSeen > cutoff)
+                continue;
+            sessions.delete(id);
+            closed++;
+            log(`reposkein serve: reaped idle mcp session for "${s.tokenName}"`);
+            void s.transport.close().catch(() => undefined);
+            void s.server.close().catch(() => undefined);
+        }
+        return closed;
+    }
+    const unauthorized = (res, detail) => sendJson(res, 401, { error: "unauthorized", detail }, { "WWW-Authenticate": `Bearer realm="reposkein"` });
+    /** Authenticates one request. `allowCookieAndQuery` is false for `/mcp`. */
+    function authenticate(req, url, allowCookieAndQuery) {
+        const header = bearerFromAuthHeader(req.headers.authorization);
+        const hit = matchServeToken(opts.tokens, header);
+        if (hit || !allowCookieAndQuery)
+            return { token: hit, fromQuery: false };
+        const fromQuery = url.searchParams.get("token");
+        const q = matchServeToken(opts.tokens, fromQuery);
+        if (q)
+            return { token: q, fromQuery: true };
+        const cookie = cookieValue(req.headers.cookie, TOKEN_COOKIE);
+        return { token: matchServeToken(opts.tokens, cookie), fromQuery: false };
+    }
+    async function handleMcp(req, res, token) {
+        // No standalone notification stream. This server never sends anything the
+        // client didn't ask for (every tool is request/response, `enableJsonResponse`
+        // is on), so a GET would open a socket that stays open for the connection's
+        // whole life and produces nothing. Worse, it never completes — which meant
+        // it pinned `inFlight` above zero and made the idle reaper a no-op for any
+        // client that opened one. The spec allows 405 here; clients treat the
+        // stream as optional and carry on.
+        if (req.method === "GET") {
+            sendJson(res, 405, {
+                error: "sse_stream_not_supported",
+                detail: "This server answers MCP over POST only (JSON responses, no server-initiated " +
+                    "notifications). Use POST for requests and DELETE to end a session.",
+            }, { Allow: "POST, DELETE" });
+            return;
+        }
+        const rawSessionId = req.headers["mcp-session-id"];
+        const sessionId = Array.isArray(rawSessionId) ? rawSessionId[0] : rawSessionId;
+        if (sessionId) {
+            const existing = sessions.get(sessionId);
+            if (!existing) {
+                sendJson(res, 404, {
+                    error: "session_not_found",
+                    detail: "This Mcp-Session-Id is unknown (expired after 5 minutes idle, closed, or the " +
+                        "server restarted). Re-run initialize to open a new session.",
+                });
+                return;
+            }
+            if (existing.tokenName !== token.name) {
+                sendJson(res, 403, {
+                    error: "session_token_mismatch",
+                    detail: "This MCP session belongs to a different token. Start a new session " +
+                        "(omit Mcp-Session-Id) instead of reusing another caller's.",
+                });
+                return;
+            }
+            // Claim the session for the duration of this request: `lastSeen` keeps
+            // the reaper away from an active client, `inFlight` keeps it away from
+            // an active REQUEST even if that request outlives the idle window.
+            existing.lastSeen = now();
+            existing.inFlight++;
+            try {
+                const body = req.method === "POST" ? await readJsonBody(req) : { ok: true, value: undefined };
+                if (!body.ok) {
+                    sendJson(res, 400, { error: "bad_request", detail: body.error });
+                    if (body.oversize)
+                        req.destroy();
+                    return;
+                }
+                if (req.method === "POST" && body.value === undefined) {
+                    sendJson(res, 400, {
+                        error: "bad_request",
+                        detail: "Empty POST body. Send a JSON-RPC request, notification, or batch.",
+                    });
+                    return;
+                }
+                await existing.transport.handleRequest(req, res, body.value);
+            }
+            finally {
+                existing.inFlight--;
+            }
+            return;
+        }
+        if (req.method !== "POST") {
+            sendJson(res, 400, {
+                error: "bad_request",
+                detail: "Mcp-Session-Id is required for DELETE on /mcp.",
+            });
+            return;
+        }
+        const body = await readJsonBody(req);
+        if (!body.ok) {
+            sendJson(res, 400, { error: "bad_request", detail: body.error });
+            if (body.oversize)
+                req.destroy();
+            return;
+        }
+        if (!isInitializeRequest(body.value)) {
+            sendJson(res, 400, {
+                error: "bad_request",
+                detail: "No valid Mcp-Session-Id and this is not an initialize request. " +
+                    "Open a session with initialize first.",
+            });
+            return;
+        }
+        // Free anything the network already abandoned before deciding we're full.
+        sweepIdleSessions();
+        if (sessions.size + reservedSlots >= maxSessions) {
+            sendJson(res, 503, {
+                error: "too_many_sessions",
+                detail: `This server holds the maximum of ${maxSessions} MCP sessions. Retry later.`,
+            });
+            return;
+        }
+        // Reserved synchronously, in the same tick as the check above.
+        reservedSlots++;
+        // Set by `onsessioninitialized` the moment the session is registered with
+        // `inFlight: 1` (this request). Held out here, not read back off the
+        // transport, so the `finally` can release the count on EVERY exit path.
+        // If anything after registration throws — the SDK `await`s our callback
+        // and does not guard it, and the response write can fail — an inline
+        // decrement is skipped, and a session stuck at `inFlight: 1` is one the
+        // reaper will never touch: a slot leaked until restart.
+        let registeredId;
+        try {
+            // A NEW connection: its own McpServer, its own RepoSession. Nothing in
+            // here is shared with any other session, which is what makes one
+            // caller's `select_repo` invisible to everybody else.
+            const server = createMcpServer({
+                cwd: repoPath,
+                envRepoPath: repoPath,
+                // One log file per token per process, so an operator can see who did
+                // what without every connection sharing one file.
+                sessionId: `${logIdBase}-${agentSlug(token.name)}`,
+                identity: token.name,
+                capabilities: { write: token.write },
+                ...(opts.ensureGraph ? { ensureGraph: opts.ensureGraph } : {}),
+            });
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: () => randomUUID(),
+                // Plain JSON responses rather than an SSE stream per request: this
+                // server has no server-initiated notifications to push, and a
+                // request/response shape keeps sockets short-lived (and shutdown
+                // instant) on a long-running shared process.
+                enableJsonResponse: true,
+                onsessioninitialized: (id) => {
+                    registeredId = id;
+                    sessions.set(id, {
+                        transport,
+                        server,
+                        tokenName: token.name,
+                        lastSeen: now(),
+                        // The initialize request itself is in flight right now.
+                        inFlight: 1,
+                    });
+                    log(`reposkein serve: mcp session opened for "${token.name}" (write=${token.write})`);
+                },
+                onsessionclosed: (id) => {
+                    sessions.delete(id);
+                },
+            });
+            transport.onclose = () => {
+                const id = transport.sessionId;
+                if (id)
+                    sessions.delete(id);
+                void server.close().catch(() => {
+                    /* shutting down */
+                });
+            };
+            await server.connect(transport);
+            await transport.handleRequest(req, res, body.value);
+        }
+        finally {
+            // Mirrors the existing-session branch: this request's own `inFlight`
+            // claim is released HERE, not inline after `handleRequest`, so no exit
+            // path can skip it.
+            //
+            // Defense in depth as of SDK 1.30: the Node wrapper runs the transport
+            // inside `@hono/node-server`'s request listener, which catches handler
+            // errors and answers 500 itself — so a throw after registration does not
+            // currently reject `handleRequest`. That is a library implementation
+            // detail we don't control, and it is the only thing that was keeping an
+            // inline decrement correct. Structurally, nothing may sit between the
+            // request completing and the claim being released.
+            if (registeredId !== undefined) {
+                const created = sessions.get(registeredId);
+                if (created)
+                    created.inFlight--;
+            }
+            reservedSlots--;
+        }
+    }
+    const handler = (req, res) => {
+        const rawUrl = req.url ?? "/";
+        // The base is a placeholder — only pathname/searchParams are used.
+        const url = new URL(rawUrl, "http://localhost");
+        const isMcp = url.pathname === MCP_PATH;
+        const { token, fromQuery } = authenticate(req, url, !isMcp);
+        if (!token) {
+            log(`reposkein serve: 401 ${req.method ?? "?"} ${url.pathname} ` +
+                `(${req.headers.authorization ? "token rejected" : "no bearer token"})`);
+            unauthorized(res, isMcp
+                ? "Send `Authorization: Bearer <token>`. Ask the operator for a token; see docs/REMOTE.md."
+                : "Send `Authorization: Bearer <token>`, or open this page as `?token=<token>` once.");
+            return;
+        }
+        if (isMcp) {
+            handleMcp(req, res, token).catch((err) => {
+                log(`reposkein serve: mcp request failed: ${err instanceof Error ? err.message : String(err)}`);
+                if (!res.headersSent) {
+                    sendJson(res, 500, { error: "internal_error", detail: "See the server log." });
+                }
+                else {
+                    res.end();
+                }
+            });
+            return;
+        }
+        // A browser authenticated by `?token=`: trade it for an HttpOnly cookie
+        // and redirect to the clean URL, so the secret shows up in exactly one
+        // request line instead of every one.
+        if (fromQuery) {
+            url.searchParams.delete("token");
+            const q = url.searchParams.toString();
+            // `Secure` whenever the request reached us over TLS. We terminate plain
+            // HTTP ourselves, so the only evidence is the proxy's forwarded scheme —
+            // set it when that says https so the cookie can't leak back over a
+            // downgraded connection, and omit it otherwise (a `Secure` cookie on a
+            // genuinely plain-HTTP deployment is simply discarded by the browser,
+            // which would break the handshake this exists to provide).
+            const forwardedProto = req.headers["x-forwarded-proto"];
+            const rawProto = Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto;
+            const proto = (rawProto ?? "").split(",")[0].trim().toLowerCase();
+            const secure = proto === "https" ? "; Secure" : "";
+            res.writeHead(302, {
+                Location: url.pathname + (q ? `?${q}` : ""),
+                "Set-Cookie": `${TOKEN_COOKIE}=${encodeURIComponent(token.token)}; Path=/; HttpOnly; SameSite=Strict${secure}`,
+                "Cache-Control": "no-store",
+            });
+            res.end();
+            return;
+        }
+        viewHandler(req, res);
+    };
+    return {
+        handler,
+        refresh: () => {
+            viewHandler = factory(repoPath, opts.repoId);
+        },
+        sweepIdleSessions,
+        close: async () => {
+            const open = [...sessions.values()];
+            sessions.clear();
+            for (const s of open) {
+                try {
+                    await s.transport.close();
+                }
+                catch {
+                    /* best-effort */
+                }
+                try {
+                    await s.server.close();
+                }
+                catch {
+                    /* best-effort */
+                }
+            }
+        },
+        sessionCount: () => sessions.size,
+    };
+}
+/** `git status --porcelain` for the served checkout, or null when git is
+ *  unavailable / the path isn't a repo. Never throws. */
+export function gitPorcelainStatus(repoPath) {
+    try {
+        const out = execFileSync("git", ["-C", repoPath, "status", "--porcelain"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        return out.split("\n").filter((l) => l.trim() !== "");
+    }
+    catch {
+        return null;
+    }
+}
+/** The startup warning for serving a checkout with local modifications, or
+ *  null when the tree is clean (or git can't tell us).
+ *
+ *  Serving a dirty checkout is legal and sometimes exactly what an operator
+ *  wants, so this WARNS and never refuses. But it is worth saying loudly:
+ *  `serve`'s own re-index writes into `.reposkein/` (the committed summary
+ *  shards absorb every `local/summaries-*.jsonl` sidecar), so a checkout that
+ *  someone also works in will accumulate diffs that look like the server's
+ *  fault — and a re-index landing on top of half-finished local edits indexes
+ *  those edits. A dedicated deploy clone has neither problem. */
+export function dirtyCheckoutWarning(repoPath, statusFn = gitPorcelainStatus) {
+    const lines = statusFn(repoPath);
+    if (!lines || lines.length === 0)
+        return null;
+    const sample = lines.slice(0, 5).map((l) => `    ${l}`);
+    const more = lines.length > sample.length ? `\n    … and ${lines.length - sample.length} more` : "";
+    return (`reposkein serve: WARNING — the served checkout has ${lines.length} uncommitted ` +
+        `change(s):\n${sample.join("\n")}${more}\n` +
+        "  Serving it anyway. Two things to know:\n" +
+        "    - re-indexing writes into .reposkein/ (committed summary shards absorb the local\n" +
+        "      sidecars), so this working tree will keep accumulating diffs.\n" +
+        "    - a re-index picks up whatever is in the tree, including half-finished edits.\n" +
+        "  Recommended: serve a DEDICATED DEPLOY CLONE that only ever fast-forwards, not a\n" +
+        "  working copy someone edits. See docs/REMOTE.md.");
+}
+/** `reposkein-mcp serve --http [path] [--port N] [--host H] [--watch-interval S]`.
+ *
+ *  Strictly optional (REP-17 / adr:2026-08-21-optional-shared-remote-mcp-server-…):
+ *  stdio is still the default transport and nothing binds a socket unless this
+ *  runs. Refuses to start without at least one configured token — an
+ *  unauthenticated remote MCP server would hand write access to the network. */
+export async function runServe(repoPath, repoId, opts) {
+    const nodesPath = join(repoPath, ".reposkein", "nodes.jsonl");
+    if (!existsSync(nodesPath)) {
+        console.error(`reposkein: no .reposkein/nodes.jsonl at ${repoPath}.\n` +
+            "  Build the graph first: `reposkein-mcp index` (or `reposkein-mcp init`).");
+        return 1;
+    }
+    const loaded = loadServeTokens(repoPath, process.env);
+    for (const e of loaded.errors)
+        console.error(`reposkein serve: ${e}`);
+    if (loaded.tokens.length === 0) {
+        console.error("reposkein serve: refusing to start with no tokens.\n" +
+            "  Set REPOSKEIN_SERVE_TOKENS='name:secret[:write]' (comma-separated), or add\n" +
+            "  [serve] tokens = \"name:secret\" to .reposkein/config.toml (private deployments only —\n" +
+            "  config.toml is committed). See docs/REMOTE.md.");
+        return 1;
+    }
+    const vizMissing = !existsSync(join(vizDistDir(), "index.html"));
+    if (vizMissing) {
+        console.error(`reposkein serve: the viewer bundle is missing (${vizDistDir()}); /api/* still works, ` +
+            "but the SPA will 404. Rebuild the package (`npm run build` in mcp/) to serve it.");
+    }
+    // Warn, never refuse: see `dirtyCheckoutWarning`.
+    const dirty = dirtyCheckoutWarning(repoPath);
+    if (dirty)
+        console.error(dirty);
+    const app = createServeApp({ repoPath, repoId, tokens: loaded.tokens });
+    const watcher = startHeadWatcher(repoPath, repoId, {
+        intervalMs: opts.watchIntervalMs,
+        onReindexed: () => app.refresh(),
+    });
+    // Catch up once at startup: the checkout may have moved while nothing was
+    // watching it. Same idempotent check as every tick, so an up-to-date repo
+    // does no work.
+    await watcher.tick();
+    const server = createServer(app.handler);
+    return await new Promise((resolvePromise) => {
+        let settled = false;
+        const settle = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            resolvePromise(code);
+        };
+        server.on("error", (err) => {
+            console.error(`reposkein serve: server error: ${err.message}`);
+            watcher.stop();
+            settle(1);
+        });
+        server.listen(opts.port, opts.host, () => {
+            const addr = server.address();
+            const port = typeof addr === "object" && addr ? addr.port : opts.port;
+            const names = loaded.tokens
+                .map((t) => `${t.name}${t.write ? " (write)" : ""}`)
+                .join(", ");
+            console.error(`reposkein serve: ${repoId} on http://${opts.host}:${port}\n` +
+                `  MCP endpoint:   http://${opts.host}:${port}${MCP_PATH}\n` +
+                `  viewer + /api/: http://${opts.host}:${port}/\n` +
+                `  tokens (${loaded.source}): ${names}\n` +
+                `  watch: ${opts.watchIntervalMs > 0 ? `${opts.watchIntervalMs / 1000}s HEAD poll` : "disabled"}\n` +
+                "  plain HTTP — terminate TLS in front of this. Ctrl-C to stop.");
+        });
+        const shutdown = () => {
+            watcher.stop();
+            void app.close().finally(() => {
+                server.close(() => settle(0));
+            });
+        };
+        process.on("SIGINT", shutdown);
+        process.on("SIGTERM", shutdown);
+    });
+}
+//# sourceMappingURL=serve.js.map

package/dist/serve/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../src/serve/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAA+B,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,eAAe,GAEhB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAoB,MAAM,YAAY,CAAC;AAEhE;iEACiE;AACjE,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE/B;iEACiE;AACjE,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAEvC;4DAC4D;AAC5D,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvC;;iDAEiD;AACjD,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB;;;;;;;wDAOwD;AACxD,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAStC;4EAC4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD,MAAM,UAAU,cAAc,CAAC,IAAc;IAK3C,IAAI,IAAI,GAAG,kBAAkB,CAAC;IAC9B,IAAI,IAAI,GAAG,kBAAkB,CAAC;IAC9B,IAAI,eAAe,GAAG,yBAAyB,CAAC;IAChD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,CAAC,GAAuB,EAAE,QAAgB,EAAU,EAAE;QACnE,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrD,CAAC,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,QAAQ;YAAE,IAAI,GAAG,IAAI,CAAC;aAC3B,IAAI,CAAC,KAAK,QAAQ;YAAE,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;aACjE,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;aAC3E,IAAI,CAAC,KAAK,QAAQ;YAAE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,kBAAkB,CAAC;aAC3D,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpD,qEAAqE;aAChE,IAAI,CAAC,KAAK,kBAAkB;YAAE,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;aAC7E,IAAI,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC;YACxC,eAAe,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;aAC9C,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC;IACzE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC;AACnE,CAAC;AA0DD,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa,EAAE,UAAkC,EAAE;IACxG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,iCAAiC;QACjD,eAAe,EAAE,UAAU;QAC3B,GAAG,OAAO;KACX,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAeD;;;;;;6DAM6D;AAC7D,SAAS,YAAY,CAAC,GAAoB;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAQ,EAAE;YAC3C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,cAAc,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,OAAO;gBAAE,OAAO,CAAC,4CAA4C;YACjE,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC1B,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBAClB,MAAM,CAAC;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,wBAAwB,cAAc,QAAQ;oBACrD,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC;gBACH,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YAClF,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA0B,EAAE,IAAY;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAChD,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;kEAckE;AAClE,MAAM,UAAU,cAAc,CAAC,IAA2B;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,IAAI,eAAe,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,2EAA2E;IAC3E,oEAAoE;IACpE,2EAA2E;IAC3E,+CAA+C;IAC/C,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC/C,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,sCAAsC;IACtC,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,yEAAyE;IACzE,SAAS,iBAAiB;QACxB,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC;QAC9B,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC;gBAAE,SAAS,CAAC,4BAA4B;YAC1D,IAAI,CAAC,CAAC,QAAQ,GAAG,MAAM;gBAAE,SAAS;YAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpB,MAAM,EAAE,CAAC;YACT,GAAG,CAAC,iDAAiD,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;YACrE,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAChD,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAmB,EAAE,MAAc,EAAQ,EAAE,CACjE,QAAQ,CACN,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,EACjC,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,CACnD,CAAC;IAEJ,4EAA4E;IAC5E,SAAS,YAAY,CACnB,GAAoB,EACpB,GAAQ,EACR,mBAA4B;QAE5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,GAAG,IAAI,CAAC,mBAAmB;YAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3E,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,GAAoB,EAAE,GAAmB,EAAE,KAAiB;QACnF,0EAA0E;QAC1E,8EAA8E;QAC9E,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,mCAAmC;QACnC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,QAAQ,CACN,GAAG,EACH,GAAG,EACH;gBACE,KAAK,EAAE,0BAA0B;gBACjC,MAAM,EACJ,8EAA8E;oBAC9E,oEAAoE;aACvE,EACD,EAAE,KAAK,EAAE,cAAc,EAAE,CAC1B,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QAE/E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,KAAK,EAAE,mBAAmB;oBAC1B,MAAM,EACJ,+EAA+E;wBAC/E,6DAA6D;iBAChE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;gBACtC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,KAAK,EAAE,wBAAwB;oBAC/B,MAAM,EACJ,qEAAqE;wBACrE,4DAA4D;iBAC/D,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,QAAQ,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC;YAC1B,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;gBAC5F,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;oBACjE,IAAI,IAAI,CAAC,QAAQ;wBAAE,GAAG,CAAC,OAAO,EAAE,CAAC;oBACjC,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACtD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;wBACjB,KAAK,EAAE,aAAa;wBACpB,MAAM,EAAE,mEAAmE;qBAC5E,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,MAAM,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/D,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,gDAAgD;aACzD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACjE,IAAI,IAAI,CAAC,QAAQ;gBAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,KAAK,EAAE,aAAa;gBACpB,MAAM,EACJ,iEAAiE;oBACjE,uCAAuC;aAC1C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,0EAA0E;QAC1E,iBAAiB,EAAE,CAAC;QACpB,IAAI,QAAQ,CAAC,IAAI,GAAG,aAAa,IAAI,WAAW,EAAE,CAAC;YACjD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,oCAAoC,WAAW,6BAA6B;aACrF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,+DAA+D;QAC/D,aAAa,EAAE,CAAC;QAChB,0EAA0E;QAC1E,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,YAAgC,CAAC;QAErC,IAAI,CAAC;YACH,uEAAuE;YACvE,iEAAiE;YACjE,sDAAsD;YACtD,MAAM,MAAM,GAAG,eAAe,CAAC;gBAC7B,GAAG,EAAE,QAAQ;gBACb,WAAW,EAAE,QAAQ;gBACrB,qEAAqE;gBACrE,kDAAkD;gBAClD,SAAS,EAAE,GAAG,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;gBAClD,QAAQ,EAAE,KAAK,CAAC,IAAI;gBACpB,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBACpC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;gBACtC,mEAAmE;gBACnE,8DAA8D;gBAC9D,iEAAiE;gBACjE,6CAA6C;gBAC7C,kBAAkB,EAAE,IAAI;gBACxB,oBAAoB,EAAE,CAAC,EAAU,EAAE,EAAE;oBACnC,YAAY,GAAG,EAAE,CAAC;oBAClB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE;wBACf,SAAS;wBACT,MAAM;wBACN,SAAS,EAAE,KAAK,CAAC,IAAI;wBACrB,QAAQ,EAAE,GAAG,EAAE;wBACf,wDAAwD;wBACxD,QAAQ,EAAE,CAAC;qBACZ,CAAC,CAAC;oBACH,GAAG,CAAC,4CAA4C,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;gBACxF,CAAC;gBACD,eAAe,EAAE,CAAC,EAAU,EAAE,EAAE;oBAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACtB,CAAC;aACF,CAAC,CAAC;YACH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACvB,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,CAAC;gBAC/B,IAAI,EAAE;oBAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;oBAC7B,mBAAmB;gBACrB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;gBAAS,CAAC;YACT,qEAAqE;YACrE,uEAAuE;YACvE,oBAAoB;YACpB,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,qEAAqE;YACrE,wEAAwE;YACxE,sEAAsE;YACtE,mDAAmD;YACnD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3C,IAAI,OAAO;oBAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YAClC,CAAC;YACD,aAAa,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC9B,mEAAmE;QACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAExC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CACD,wBAAwB,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,GAAG;gBAC1D,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,GAAG,CAC1E,CAAC;YACF,YAAY,CACV,GAAG,EACH,KAAK;gBACH,CAAC,CAAC,yFAAyF;gBAC3F,CAAC,CAAC,mFAAmF,CACxF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAChD,GAAG,CAAC,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACjF,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,qCAAqC;QACrC,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACtC,wEAAwE;YACxE,yEAAyE;YACzE,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;YACpF,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,YAAY,EACV,GAAG,YAAY,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,sCAAsC,MAAM,EAAE;gBAClG,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,OAAO,EAAE,GAAG,EAAE;YACZ,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QACD,iBAAiB;QACjB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACpC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QACD,YAAY,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI;KAClC,CAAC;AACJ,CAAC;AAED;yDACyD;AACzD,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE;YACzE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;iEASiE;AACjE,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,WAA2C,kBAAkB;IAE7D,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACpG,OAAO,CACL,sDAAsD,KAAK,CAAC,MAAM,eAAe;QACjF,eAAe,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI;QAC3C,4CAA4C;QAC5C,wFAAwF;QACxF,uEAAuE;QACvE,qFAAqF;QACrF,qFAAqF;QACrF,mDAAmD,CACpD,CAAC;AACJ,CAAC;AAED;;;;;gFAKgF;AAChF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAkB;IACjF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CACX,2CAA2C,QAAQ,KAAK;YACtD,2EAA2E,CAC9E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CACX,sDAAsD;YACpD,gFAAgF;YAChF,4FAA4F;YAC5F,kDAAkD,CACrD,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IACjE,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CACX,kDAAkD,UAAU,EAAE,yBAAyB;YACrF,kFAAkF,CACrF,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEhC,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,MAAM,OAAO,GAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE;QAC9D,UAAU,EAAE,IAAI,CAAC,eAAe;QAChC,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE;KACjC,CAAC,CAAC;IACH,0EAA0E;IAC1E,0EAA0E;IAC1E,gBAAgB;IAChB,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAErB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEzC,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,EAAE;QAClD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAQ,EAAE;YACpC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,cAAc,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,OAAO,CAAC,KAAK,CAAC,kCAAkC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACtE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM;iBACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;iBACnD,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,OAAO,CAAC,KAAK,CACX,oBAAoB,MAAM,cAAc,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI;gBAC3D,4BAA4B,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,QAAQ,IAAI;gBAC5D,4BAA4B,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK;gBAClD,aAAa,MAAM,CAAC,MAAM,MAAM,KAAK,IAAI;gBACzC,YAAY,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,eAAe,GAAG,IAAI,aAAa,CAAC,CAAC,CAAC,UAAU,IAAI;gBACnG,gEAAgE,CACnE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,GAAS,EAAE;YAC1B,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/serve/tokens.d.ts

@@ -0,0 +1,49 @@
+/** One bearer credential a `serve --http` operator handed out (REP-17).
+ *
+ *  `name` is NOT a secret: it is the connection's writer identity, landing in
+ *  `summary_by` / `decided_by` and selecting the per-agent sidecar file. It is
+ *  the thing that gets logged. `token` is the secret and is never logged,
+ *  printed, or echoed into a tool result. */
+export interface ServeToken {
+    name: string;
+    token: string;
+    /** True only for entries declared `name:token:write`. */
+    write: boolean;
+}
+export interface ParsedTokens {
+    tokens: ServeToken[];
+    /** Human-readable reasons entries were dropped. NEVER contains a token
+     *  value — an operator pastes these into a bug report. */
+    errors: string[];
+}
+/** Parses a token list: `name:token[:write]` entries separated by commas,
+ *  whitespace, or newlines.
+ *
+ *  Chosen over JSON because it has to survive being pasted into a shell
+ *  export, a systemd `Environment=` line, and a TOML string without escaping.
+ *  Anything unparseable is DROPPED with a reason rather than silently
+ *  becoming a valid credential — a malformed entry must never widen access.
+ *  Capability is opt-in: only the literal third field `write` grants it. */
+export declare function parseServeTokens(spec: string): ParsedTokens;
+export interface LoadedTokens extends ParsedTokens {
+    /** Where the accepted entries came from, for the startup banner. */
+    source: "env" | "config" | "none";
+}
+/** Resolves the token list for `serve`: `REPOSKEIN_SERVE_TOKENS` wins over
+ *  `[serve] tokens` in `.reposkein/config.toml`.
+ *
+ *  Env-over-config because the config file is COMMITTED — an operator who
+ *  puts real secrets there has leaked them to everyone with repo access, so
+ *  the documented path is the env var and config is the convenience for a
+ *  private deployment. Only one source is consulted (no union): merging them
+ *  would make "why does this old token still work?" unanswerable. */
+export declare function loadServeTokens(repoPath: string, env?: NodeJS.ProcessEnv): LoadedTokens;
+/** Extracts the credential from an `Authorization: Bearer <token>` header.
+ *  Returns null for a missing, non-Bearer, or empty-value header. */
+export declare function bearerFromAuthHeader(header: string | string[] | undefined): string | null;
+/** Finds the token a presented credential matches, or null.
+ *
+ *  Scans the WHOLE list with no early exit so the response time doesn't
+ *  reveal which position matched (or how many tokens the operator
+ *  configured). */
+export declare function matchServeToken(tokens: readonly ServeToken[], presented: string | null): ServeToken | null;