@squadrules/mcp 4.8.6

package/dist/http/oidc-profile-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-profile-claims.d.ts","sourceRoot":"","sources":["../../src/http/oidc-profile-claims.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,KAAK,CAAC;AAa1C,MAAM,WAAW,wBAAwB;IACvC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,WAAW,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,WAAW,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,oHAAoH;AACpH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAQnF;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAInD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAiBnF;AAeD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAkCjG;AAOD;;GAEG;AACH,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,wBAAwB,CAiB/G;AAED,wBAAgB,yBAAyB,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAQ7F;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC9C,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAoD5E;AAED,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACtC,oBAAoB,EAClB,oBAAoB,GACpB,MAAM,GACN,YAAY,GACZ,aAAa,GACb,OAAO,GACP,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,eAAe,CAClB,CAAC;AAEF,0FAA0F;AAC1F,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,qBAAqB,CAexG"}

package/dist/http/oidc-profile-claims.js

@@ -0,0 +1,257 @@
+/**
+ * Whitelisted OIDC claims for session, Bearer auth, and GET /api/me.
+ * Do not echo full JWTs — only explicitly allowed keys reduce risk of leaking future custom claims.
+ *
+ * If identity_provider is missing for broker/SSO users, add a Keycloak protocol mapper
+ * (e.g. user session note → token claim) in the realm — that is realm configuration, not only app code.
+ */
+import { fromBase64url } from "@exodus/bytes/base64.js";
+import { utf8toString } from "@exodus/bytes/utf8.js";
+/** IdPs treated as realm-local (not federated SSO) for UX labelling. */
+const LOCAL_IDENTITY_PROVIDERS = new Set(["", "keycloak", "local"]);
+const SSO_LABEL_OVERRIDES = {
+    google: "Google",
+    okta: "Okta",
+    github: "GitHub",
+    microsoft: "Microsoft",
+    azuread: "Microsoft",
+};
+/** Decode JWT payload object from compact serialization (same pattern as auth callback; not a signature verify). */
+export function decodeJwtPayloadSegment(jwt) {
+    try {
+        const segment = jwt.split(".")[1];
+        if (!segment)
+            return null;
+        return JSON.parse(utf8toString(fromBase64url(segment)));
+    }
+    catch {
+        return null;
+    }
+}
+/** Extract realm segment from issuer URL (e.g. …/realms/kairos-dev → kairos-dev). */
+export function realmFromIssuer(iss) {
+    const match = /\/realms\/([^/]+)/.exec(iss);
+    const segment = match?.[1] ?? iss.split("/").filter(Boolean).pop();
+    return typeof segment === "string" ? segment : "default";
+}
+/**
+ * Normalize Keycloak / OIDC `groups` into string paths. Handles array, single path string,
+ * or JSON array string (some gateways serialize oddly).
+ */
+export function extractGroupsFromPayload(payload) {
+    const g = payload["groups"];
+    if (Array.isArray(g))
+        return g.filter((x) => typeof x === "string");
+    if (typeof g === "string") {
+        const t = g.trim();
+        if (!t)
+            return [];
+        if (t.startsWith("[")) {
+            try {
+                const parsed = JSON.parse(t);
+                if (Array.isArray(parsed))
+                    return parsed.filter((x) => typeof x === "string");
+            }
+            catch {
+                return [t];
+            }
+        }
+        return [t];
+    }
+    return [];
+}
+function groupStringVariants(g) {
+    const t = g.trim();
+    if (!t)
+        return [];
+    return [t, t.replace(/^\//, ""), t.startsWith("/") ? t : `/${t}`];
+}
+/** Path form with a single leading slash (for prefix checks on full-path groups). */
+function groupPathForm(g) {
+    const t = g.trim();
+    if (!t)
+        return "";
+    return t.startsWith("/") ? t : `/${t.replace(/^\//, "")}`;
+}
+/**
+ * Keep only token groups that match an allowlist entry:
+ * - **Exact:** plain name or path (`kairos-auditor`, `/kairos-auditor`) — slash optional on either side.
+ * - **Prefix:** entry ends with `/` (e.g. `/kairos-shares/`) — keep any JWT group whose path form starts with that prefix (after normalizing a leading slash on the entry).
+ * - **Default (no filter):** empty allowlist keeps **all** JWT groups (same membership the IdP issued).
+ *   Set a non-empty allowlist to restrict which paths become KAIROS spaces.
+ * Keycloak's Group Membership mapper lists every group the user belongs to; use this on KAIROS
+ * to restrict which entries become session/API groups when you configure an allowlist.
+ */
+export function applyOidcGroupsAllowlist(groups, allowlist) {
+    if (allowlist.length === 0)
+        return [...groups];
+    const exact = new Set();
+    const exactLower = new Set();
+    const prefixes = [];
+    const prefixLower = [];
+    for (const e of allowlist) {
+        const t = e.trim();
+        if (!t)
+            continue;
+        if (t.endsWith("/")) {
+            const p = t.startsWith("/") ? t : `/${t}`;
+            prefixes.push(p);
+            prefixLower.push(p.toLowerCase());
+            continue;
+        }
+        for (const v of groupStringVariants(t)) {
+            exact.add(v);
+            exactLower.add(v.toLowerCase());
+        }
+    }
+    return groups.filter((g) => {
+        const variants = groupStringVariants(g);
+        if (variants.length === 0)
+            return false;
+        if (variants.some((v) => exact.has(v) || exactLower.has(v.toLowerCase())))
+            return true;
+        const pathForm = groupPathForm(g);
+        if (!pathForm)
+            return false;
+        const pathLower = pathForm.toLowerCase();
+        for (let i = 0; i < prefixes.length; i++) {
+            const p = prefixes[i];
+            const pl = prefixLower[i];
+            if (pathForm.startsWith(p) || pathLower.startsWith(pl))
+                return true;
+        }
+        return false;
+    });
+}
+function pickNonEmptyString(payload, key) {
+    const v = payload[key];
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+/**
+ * Whitelisted profile-style claims from a single verified (or callback-trusted) payload.
+ */
+export function extractWhitelistedProfileFromPayload(payload) {
+    const out = {};
+    const pu = pickNonEmptyString(payload, "preferred_username");
+    if (pu !== undefined)
+        out.preferred_username = pu;
+    const name = pickNonEmptyString(payload, "name");
+    if (name !== undefined)
+        out.name = name;
+    const gn = pickNonEmptyString(payload, "given_name");
+    if (gn !== undefined)
+        out.given_name = gn;
+    const fn = pickNonEmptyString(payload, "family_name");
+    if (fn !== undefined)
+        out.family_name = fn;
+    const email = pickNonEmptyString(payload, "email");
+    if (email !== undefined)
+        out.email = email;
+    const ev = payload["email_verified"];
+    if (ev === true || ev === false)
+        out.email_verified = ev;
+    const idp = pickNonEmptyString(payload, "identity_provider");
+    if (idp !== undefined)
+        out.identity_provider = idp;
+    return out;
+}
+export function deriveAccountKindAndLabel(identityProvider) {
+    const raw = typeof identityProvider === "string" ? identityProvider.trim() : "";
+    const lower = raw.toLowerCase();
+    if (!raw || LOCAL_IDENTITY_PROVIDERS.has(lower)) {
+        return { account_kind: "local", account_label: "Local" };
+    }
+    const base = SSO_LABEL_OVERRIDES[lower] ?? raw.charAt(0).toUpperCase() + raw.slice(1);
+    return { account_kind: "sso", account_label: `${base} (SSO)` };
+}
+/**
+ * Merge id_token and access_token payloads after login:
+ * — sub from id token when present; otherwise access. If both subs exist and differ, fail.
+ * — groups prefer access token; fallback to id.
+ * — iss from id token when present; otherwise access; fallback to synthetic realm issuer.
+ * — realm from id token iss, else access iss, else fallbackRealm.
+ * — profile / email claims prefer id token; if id absent, fall back to access for CLI-style flows.
+ */
+export function mergeCallbackTokenPayloads(input) {
+    const { idPayload, accessPayload, fallbackRealm } = input;
+    const idSub = idPayload && typeof idPayload["sub"] === "string" ? idPayload["sub"] : "";
+    const accessSub = accessPayload && typeof accessPayload["sub"] === "string" ? accessPayload["sub"] : "";
+    let sub;
+    if (idSub.length > 0) {
+        sub = idSub;
+        if (accessSub.length > 0 && accessSub !== idSub) {
+            return { ok: false, error: "mismatched_sub" };
+        }
+    }
+    else if (accessSub.length > 0) {
+        sub = accessSub;
+    }
+    else {
+        return { ok: false, error: "missing_sub" };
+    }
+    const accessGroups = accessPayload ? extractGroupsFromPayload(accessPayload) : [];
+    const idGroups = idPayload ? extractGroupsFromPayload(idPayload) : [];
+    const groups = accessGroups.length > 0 ? accessGroups : idGroups;
+    let realm = fallbackRealm;
+    const idIss = idPayload && typeof idPayload["iss"] === "string" ? idPayload["iss"] : "";
+    const accessIss = accessPayload && typeof accessPayload["iss"] === "string" ? accessPayload["iss"] : "";
+    const iss = idIss.length > 0 ? idIss : accessIss.length > 0 ? accessIss : `realm:${fallbackRealm}`;
+    if (idIss.length > 0)
+        realm = realmFromIssuer(idIss);
+    else if (accessIss.length > 0)
+        realm = realmFromIssuer(accessIss);
+    const profileFromId = idPayload ? extractWhitelistedProfileFromPayload(idPayload) : {};
+    const profileFromAccess = accessPayload ? extractWhitelistedProfileFromPayload(accessPayload) : {};
+    const profile = Object.keys(profileFromId).length > 0
+        ? profileFromId
+        : profileFromAccess;
+    const { account_kind, account_label } = deriveAccountKindAndLabel(profile.identity_provider);
+    const merged = {
+        sub,
+        groups,
+        iss,
+        realm,
+        account_kind,
+        account_label,
+    };
+    if (profile.preferred_username !== undefined)
+        merged.preferred_username = profile.preferred_username;
+    if (profile.name !== undefined)
+        merged.name = profile.name;
+    if (profile.given_name !== undefined)
+        merged.given_name = profile.given_name;
+    if (profile.family_name !== undefined)
+        merged.family_name = profile.family_name;
+    if (profile.email !== undefined)
+        merged.email = profile.email;
+    if (profile.email_verified !== undefined)
+        merged.email_verified = profile.email_verified;
+    if (profile.identity_provider !== undefined)
+        merged.identity_provider = profile.identity_provider;
+    return { ok: true, merged };
+}
+/** Attach profile + account labels to auth after Bearer verify (single token payload). */
+export function enrichAuthPayloadFromVerifiedJwt(payload) {
+    const profile = extractWhitelistedProfileFromPayload(payload);
+    const { account_kind, account_label } = deriveAccountKindAndLabel(profile.identity_provider);
+    const out = {
+        account_kind,
+        account_label,
+    };
+    if (profile.preferred_username !== undefined)
+        out.preferred_username = profile.preferred_username;
+    if (profile.name !== undefined)
+        out.name = profile.name;
+    if (profile.given_name !== undefined)
+        out.given_name = profile.given_name;
+    if (profile.family_name !== undefined)
+        out.family_name = profile.family_name;
+    if (profile.email !== undefined)
+        out.email = profile.email;
+    if (profile.email_verified !== undefined)
+        out.email_verified = profile.email_verified;
+    if (profile.identity_provider !== undefined)
+        out.identity_provider = profile.identity_provider;
+    return out;
+}
+//# sourceMappingURL=oidc-profile-claims.js.map

package/dist/http/oidc-profile-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-profile-claims.js","sourceRoot":"","sources":["../../src/http/oidc-profile-claims.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAIrD,wEAAwE;AACxE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE,MAAM,mBAAmB,GAA2B;IAClD,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,WAAW;CACrB,CAAC;AAkCF,oHAAoH;AACpH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAA4B,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;IACnE,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAgC;IACvE,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;gBACxC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;YAC7F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,CAAC,CAAC,CAAC;YACb,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAS;IACpC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,qFAAqF;AACrF,SAAS,aAAa,CAAC,CAAS;IAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAgB,EAAE,SAA4B;IACrF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAClC,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACb,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YACvB,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgC,EAAE,GAAW;IACvE,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oCAAoC,CAAC,OAAgC;IACnF,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IAC7D,IAAI,EAAE,KAAK,SAAS;QAAE,GAAG,CAAC,kBAAkB,GAAG,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IACxC,MAAM,EAAE,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,EAAE,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;IAC1C,MAAM,EAAE,GAAG,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACtD,IAAI,EAAE,KAAK,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;IAC3C,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACrC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK;QAAE,GAAG,CAAC,cAAc,GAAG,EAAE,CAAC;IACzD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC7D,IAAI,GAAG,KAAK,SAAS;QAAE,GAAG,CAAC,iBAAiB,GAAG,GAAG,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,gBAAoC;IAC5E,MAAM,GAAG,GAAG,OAAO,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtF,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAC1D,MAAM,KAAK,GAAG,SAAS,IAAI,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,MAAM,SAAS,GAAG,aAAa,IAAI,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,IAAI,GAAW,CAAC;IAChB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,GAAG,GAAG,KAAK,CAAC;QACZ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEjE,IAAI,KAAK,GAAG,aAAa,CAAC;IAC1B,MAAM,KAAK,GAAG,SAAS,IAAI,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,MAAM,SAAS,GAAG,aAAa,IAAI,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,aAAa,EAAE,CAAC;IACnG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;SAChD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAElE,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,oCAAoC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,oCAAoC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,iBAAiB,CAAC;IAExB,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,yBAAyB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAE7F,MAAM,MAAM,GAAyB;QACnC,GAAG;QACH,MAAM;QACN,GAAG;QACH,KAAK;QACL,YAAY;QACZ,aAAa;KACd,CAAC;IACF,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS;QAAE,MAAM,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IACrG,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3D,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC7E,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAChF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC9D,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;QAAE,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IACzF,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;QAAE,MAAM,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAClG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAeD,0FAA0F;AAC1F,MAAM,UAAU,gCAAgC,CAAC,OAAgC;IAC/E,MAAM,OAAO,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,yBAAyB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7F,MAAM,GAAG,GAA0B;QACjC,YAAY;QACZ,aAAa;KACd,CAAC;IACF,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS;QAAE,GAAG,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAClG,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IACxD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC1E,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAC7E,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC3D,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;QAAE,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IACtF,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;QAAE,GAAG,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC/F,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/http/oidc-scopes.d.ts

@@ -0,0 +1,3 @@
+export declare const DEFAULT_OIDC_SCOPES_SUPPORTED: readonly string[];
+export declare function parseOidcScopesSupported(raw: string | undefined): readonly string[];
+//# sourceMappingURL=oidc-scopes.d.ts.map

package/dist/http/oidc-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-scopes.d.ts","sourceRoot":"","sources":["../../src/http/oidc-scopes.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAMzD,CAAC;AAEH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,CAqBnF"}

package/dist/http/oidc-scopes.js

@@ -0,0 +1,21 @@
+export const DEFAULT_OIDC_SCOPES_SUPPORTED = Object.freeze([
+    'openid',
+    'profile',
+    'email',
+    'kairos-groups',
+    'offline_access'
+]);
+export function parseOidcScopesSupported(raw) {
+    if (raw === undefined)
+        return DEFAULT_OIDC_SCOPES_SUPPORTED;
+    const parsed = Array.from(new Set(raw
+        .split(',')
+        .map((scope) => scope.trim())
+        .filter(Boolean)));
+    if (parsed.length === 0) {
+        process.emitWarning('KAIROS_OIDC_SCOPES_SUPPORTED resolved to an empty list; falling back to default scopes.', { code: 'KAIROS_OIDC_SCOPES_SUPPORTED_EMPTY' });
+        return DEFAULT_OIDC_SCOPES_SUPPORTED;
+    }
+    return Object.freeze(parsed);
+}
+//# sourceMappingURL=oidc-scopes.js.map

package/dist/http/oidc-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-scopes.js","sourceRoot":"","sources":["../../src/http/oidc-scopes.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,6BAA6B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC5E,QAAQ;IACR,SAAS;IACT,OAAO;IACP,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,UAAU,wBAAwB,CAAC,GAAuB;IAC9D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,6BAA6B,CAAC;IAE5D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CACvB,IAAI,GAAG,CACL,GAAG;SACA,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CACnB,CACF,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,WAAW,CACjB,yFAAyF,EACzF,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAC/C,CAAC;QACF,OAAO,6BAA6B,CAAC;IACvC,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * KAIROS MCP Server
+ *
+ * Supports HTTP and stdio transports.
+ */
+import './services/metrics/system-metrics.js';
+/**
+ * Boot the HTTP/MCP application.
+ * Invoked when `node dist/index.js` is the process entrypoint, or after `dist/bootstrap.js` loads this module
+ * (bootstrap is not `index.js`, so `isDirectRun()` is false there and bootstrap must call this explicitly).
+ */
+export declare function runKairosServer(): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwBH,OAAO,sCAAsC,CAAC;AA2D9C;;;;GAIG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAsFrD"}

package/dist/index.js

@@ -0,0 +1,159 @@
+/**
+ * KAIROS MCP Server
+ *
+ * Supports HTTP and stdio transports.
+ */
+import { structuredLogger } from './utils/structured-logger.js';
+import { installGlobalErrorHandlers } from './utils/global-error-handlers.js';
+import { MemoryQdrantStore } from './services/memory/store.js';
+import { startHttpTransport } from './http/http-server.js';
+import { startStdioTransport } from './stdio/stdio-server.js';
+import { injectMemResourcesAtBoot } from './resources/mem-resources-boot.js';
+import { startMetricsServer } from './metrics-server.js';
+import { SERVER_PORT, METRICS_PORT, QDRANT_SNAPSHOT_ON_START, QDRANT_SNAPSHOT_DIR, KAIROS_LOCAL_ARTIFACT_DIRS, TRANSPORT_TYPE } from './config.js';
+import { qdrantService } from './services/qdrant/index.js';
+import { triggerQdrantSnapshot } from './services/qdrant/snapshots.js';
+import { probeEmbeddingDimension } from './services/embedding/service.js';
+import { installQdrantFetchCompatibility } from './services/qdrant/undici-compat.js';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+// Import system metrics to ensure they're initialized
+import './services/metrics/system-metrics.js';
+/** True when this file is the process entrypoint (e.g. `node dist/index.js`, container CMD). */
+function isDirectRun() {
+    const entry = process.argv[1];
+    if (!entry)
+        return false;
+    try {
+        return import.meta.url === pathToFileURL(path.resolve(entry)).href;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Wait for Qdrant to be available with retries
+ * Uses shorter intervals for faster detection when Qdrant becomes available quickly
+ */
+async function waitForQdrant(memoryStore, maxRetries = 30, intervalMs = 1000) {
+    structuredLogger.info('Waiting for Qdrant to be available...');
+    for (let attempt = 1; attempt <= maxRetries; attempt++) {
+        try {
+            const isHealthy = await memoryStore.checkHealth(5000); // 5 second timeout per check
+            if (isHealthy) {
+                structuredLogger.info(`Qdrant is available after ${attempt} attempt(s)`);
+                return;
+            }
+        }
+        catch (err) {
+            const errorMessage = err instanceof Error ? err.message : String(err);
+            structuredLogger.debug(`Qdrant health check error on attempt ${attempt}: ${errorMessage}`);
+            // Health check failed, will retry
+        }
+        if (attempt < maxRetries) {
+            structuredLogger.info(`Qdrant not ready yet (attempt ${attempt}/${maxRetries}), retrying in ${intervalMs}ms...`);
+            await new Promise(resolve => setTimeout(resolve, intervalMs));
+        }
+    }
+    throw new Error(`Qdrant did not become available after ${maxRetries} attempts (${maxRetries * intervalMs / 1000}s)`);
+}
+/**
+ * Install signal handlers for graceful shutdown.
+ * Without listeners Node terminates immediately on SIGTERM, but open handles
+ * (Qdrant gRPC, stdio pipes) can delay exit. An explicit handler ensures
+ * the process exits promptly.
+ */
+function installSignalHandlers() {
+    const shutdown = (signal) => {
+        structuredLogger.info(`Received ${signal}, shutting down`);
+        // Force exit after a short grace period if open handles keep the event loop alive
+        setTimeout(() => process.exit(0), 1000).unref();
+        process.exitCode = 0;
+    };
+    process.on('SIGTERM', () => shutdown('SIGTERM'));
+    process.on('SIGINT', () => shutdown('SIGINT'));
+}
+/**
+ * Boot the HTTP/MCP application.
+ * Invoked when `node dist/index.js` is the process entrypoint, or after `dist/bootstrap.js` loads this module
+ * (bootstrap is not `index.js`, so `isDirectRun()` is false there and bootstrap must call this explicitly).
+ */
+export async function runKairosServer() {
+    try {
+        installQdrantFetchCompatibility();
+        // Install once at startup to capture any background errors/warnings
+        installGlobalErrorHandlers();
+        installSignalHandlers();
+        structuredLogger.info(`KAIROS_LOCAL_ARTIFACT_DIRS (client-resolvable hints): ${KAIROS_LOCAL_ARTIFACT_DIRS.join(', ')}`);
+        const memoryStore = new MemoryQdrantStore();
+        // Wait for Qdrant to be available before initializing
+        await waitForQdrant(memoryStore);
+        const embeddingDim = await probeEmbeddingDimension();
+        structuredLogger.info(`Embedding dimension resolved: ${embeddingDim}`);
+        structuredLogger.info('Initializing Qdrant memory store...');
+        await memoryStore.init();
+        structuredLogger.info('Memory store ready');
+        if (QDRANT_SNAPSHOT_ON_START) {
+            const snapshotResult = await triggerQdrantSnapshot(qdrantService, {
+                enabled: true,
+                directory: QDRANT_SNAPSHOT_DIR,
+                reason: 'startup'
+            });
+            if (!snapshotResult.success) {
+                structuredLogger.warn(`Startup snapshot failed: ${snapshotResult.message || 'unknown error'}`);
+            }
+        }
+        else {
+            structuredLogger.info('Startup snapshot disabled (QDRANT_SNAPSHOT_ON_START=false)');
+        }
+        // Inject mem resources from embedded-mcp-resources into Qdrant at boot
+        // Use --force flag to allow override in new versions
+        await injectMemResourcesAtBoot(memoryStore, { force: true });
+        // Metrics HTTP server: only when the app serves HTTP (stdio mode avoids any HTTP listeners).
+        if (TRANSPORT_TYPE === 'http') {
+            startMetricsServer();
+        }
+        const transportSource = process.env['KAIROS_CLI_TRANSPORT_SOURCE']?.trim();
+        if (transportSource === 'cli' || transportSource === 'env') {
+            structuredLogger.info(`Resolved MCP transport: ${TRANSPORT_TYPE} (source: ${transportSource === 'cli' ? '--transport' : 'TRANSPORT_TYPE'})`);
+        }
+        if (TRANSPORT_TYPE === 'http') {
+            structuredLogger.info(`Application server: ${SERVER_PORT}`);
+        }
+        else {
+            structuredLogger.info('Application server: stdio (no HTTP listener)');
+        }
+        if (TRANSPORT_TYPE === 'http') {
+            structuredLogger.info(`Metrics server: ${METRICS_PORT} (isolated)`);
+        }
+        else {
+            structuredLogger.info('Metrics server: disabled in stdio mode (no HTTP listeners)');
+        }
+        if (TRANSPORT_TYPE === 'http') {
+            await startHttpTransport(memoryStore);
+        }
+        else {
+            await startStdioTransport(memoryStore);
+        }
+    }
+    catch (err) {
+        const error = err instanceof Error ? err : new Error(String(err));
+        // Always print error details to stderr so stdio child processes and CI
+        // logs surface the root cause (structured logger may suppress details).
+        process.stderr.write(`Fatal: ${error.message}\n`);
+        if (error.stack)
+            process.stderr.write(`${error.stack}\n`);
+        try {
+            structuredLogger.error('Fatal error during KAIROS MCP startup', error);
+        }
+        catch {
+            // Ignore logging failures
+        }
+        // Ensure non-zero exit so supervisors can detect failure
+        process.exitCode = 1;
+    }
+}
+if (isDirectRun()) {
+    await runKairosServer();
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACL,WAAW,EACX,YAAY,EACZ,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,+BAA+B,EAAE,MAAM,oCAAoC,CAAC;AACrF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,sDAAsD;AACtD,OAAO,sCAAsC,CAAC;AAE9C,gGAAgG;AAChG,SAAS,WAAW;IAChB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,WAA8B,EAAE,aAAqB,EAAE,EAAE,aAAqB,IAAI;IAC3G,gBAAgB,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAE/D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,6BAA6B;YACpF,IAAI,SAAS,EAAE,CAAC;gBACZ,gBAAgB,CAAC,IAAI,CAAC,6BAA6B,OAAO,aAAa,CAAC,CAAC;gBACzE,OAAO;YACX,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtE,gBAAgB,CAAC,KAAK,CAAC,wCAAwC,OAAO,KAAK,YAAY,EAAE,CAAC,CAAC;YAC3F,kCAAkC;QACtC,CAAC;QAED,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;YACvB,gBAAgB,CAAC,IAAI,CAAC,iCAAiC,OAAO,IAAI,UAAU,kBAAkB,UAAU,OAAO,CAAC,CAAC;YACjH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAClE,CAAC;IACL,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,yCAAyC,UAAU,cAAc,UAAU,GAAG,UAAU,GAAG,IAAI,IAAI,CAAC,CAAC;AACzH,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB;IAC1B,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAChC,gBAAgB,CAAC,IAAI,CAAC,YAAY,MAAM,iBAAiB,CAAC,CAAC;QAC3D,kFAAkF;QAClF,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACjC,IAAI,CAAC;QACD,+BAA+B,EAAE,CAAC;QAClC,oEAAoE;QACpE,0BAA0B,EAAE,CAAC;QAC7B,qBAAqB,EAAE,CAAC;QAExB,gBAAgB,CAAC,IAAI,CACnB,yDAAyD,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjG,CAAC;QAEF,MAAM,WAAW,GAAG,IAAI,iBAAiB,EAAE,CAAC;QAE5C,sDAAsD;QACtD,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QAEjC,MAAM,YAAY,GAAG,MAAM,uBAAuB,EAAE,CAAC;QACrD,gBAAgB,CAAC,IAAI,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC;QAEvE,gBAAgB,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAC7D,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,gBAAgB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAE5C,IAAI,wBAAwB,EAAE,CAAC;YAC3B,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE;gBAC9D,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,mBAAmB;gBAC9B,MAAM,EAAE,SAAS;aACpB,CAAC,CAAC;YAEH,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC1B,gBAAgB,CAAC,IAAI,CAAC,4BAA4B,cAAc,CAAC,OAAO,IAAI,eAAe,EAAE,CAAC,CAAC;YACnG,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,gBAAgB,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QACxF,CAAC;QAED,uEAAuE;QACvE,qDAAqD;QACrD,MAAM,wBAAwB,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7D,6FAA6F;QAC7F,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;YAC5B,kBAAkB,EAAE,CAAC;QACzB,CAAC;QAED,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3E,IAAI,eAAe,KAAK,KAAK,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;YACzD,gBAAgB,CAAC,IAAI,CACjB,2BAA2B,cAAc,aAAa,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,GAAG,CACxH,CAAC;QACN,CAAC;QAED,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;YAC5B,gBAAgB,CAAC,IAAI,CAAC,uBAAuB,WAAW,EAAE,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACJ,gBAAgB,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;YAC5B,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,YAAY,aAAa,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACJ,gBAAgB,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QACxF,CAAC;QAED,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACJ,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAElE,uEAAuE;QACvE,wEAAwE;QACxE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,KAAK;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAE1D,IAAI,CAAC;YACD,gBAAgB,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACL,0BAA0B;QAC9B,CAAC;QAED,yDAAyD;QACzD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzB,CAAC;AACL,CAAC;AAED,IAAI,WAAW,EAAE,EAAE,CAAC;IAChB,MAAM,eAAe,EAAE,CAAC;AAC5B,CAAC"}

package/dist/mcp-apps/activate-widget-html.d.ts

@@ -0,0 +1,6 @@
+/**
+ * MCP Apps HTML resource as a fragment (mount root + style + script), matching Confluence-style
+ * widgets: the host supplies the document shell. Chrome aligns with {@link ./forward-widget-html.ts}.
+ */
+export declare function buildActivateWidgetHtml(): string;
+//# sourceMappingURL=activate-widget-html.d.ts.map

package/dist/mcp-apps/activate-widget-html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activate-widget-html.d.ts","sourceRoot":"","sources":["../../src/mcp-apps/activate-widget-html.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAkBhD"}

package/dist/mcp-apps/activate-widget-html.js

@@ -0,0 +1,29 @@
+import { KAIROS_LOGO_SVG } from './kairos-logo-embedded.js';
+import { ACTIVATE_WIDGET_INLINE_CSS } from './activate-widget-inline-css.js';
+import { ACTIVATE_WIDGET_INLINE_SCRIPT } from './activate-widget-inline-script.js';
+import { minifyInlineWidgetHtml } from './widget-inline-minify.js';
+import { substituteWidgetPresentationToken } from './mcp-widget-presentation-inject.js';
+/**
+ * MCP Apps HTML resource as a fragment (mount root + style + script), matching Confluence-style
+ * widgets: the host supplies the document shell. Chrome aligns with {@link ./forward-widget-html.ts}.
+ */
+export function buildActivateWidgetHtml() {
+    const logo = KAIROS_LOGO_SVG.replaceAll('`', '`');
+    return minifyInlineWidgetHtml(`<div id="kairos-activate-root">
+  <div class="brand activate-brand-row">
+    <div class="activate-brand-left">
+      ${logo}
+      <h1 id="header-title" class="header-title"><span class="ht-brand">KAIROS</span><span class="ht-sep"> • </span><span class="ht-protocol-label">Activate • </span><span class="ht-protocol-name muted">…</span></h1>
+    </div>
+    <div id="header-top-match" class="header-top-match" role="status" aria-live="polite" hidden></div>
+  </div>
+  <div id="out"><span class="waiting">Loading activation results…</span></div>
+</div>
+<style>
+${ACTIVATE_WIDGET_INLINE_CSS}
+</style>
+<script>
+${substituteWidgetPresentationToken(ACTIVATE_WIDGET_INLINE_SCRIPT)}
+</script>`);
+}
+//# sourceMappingURL=activate-widget-html.js.map

package/dist/mcp-apps/activate-widget-html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activate-widget-html.js","sourceRoot":"","sources":["../../src/mcp-apps/activate-widget-html.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAExF;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtD,OAAO,sBAAsB,CAAC;;;QAGxB,IAAI;;;;;;;;EAQV,0BAA0B;;;EAG1B,iCAAiC,CAAC,6BAA6B,CAAC;UACxD,CAAC,CAAC;AACZ,CAAC"}

package/dist/mcp-apps/activate-widget-inline-css.d.ts

@@ -0,0 +1,2 @@
+export declare const ACTIVATE_WIDGET_INLINE_CSS: string;
+//# sourceMappingURL=activate-widget-inline-css.d.ts.map

package/dist/mcp-apps/activate-widget-inline-css.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activate-widget-inline-css.d.ts","sourceRoot":"","sources":["../../src/mcp-apps/activate-widget-inline-css.ts"],"names":[],"mappings":"AAyLA,eAAO,MAAM,0BAA0B,QAC2E,CAAC"}