@switchboard-mcp/core 0.1.0

package/dist/schemas/config.js

@@ -0,0 +1,133 @@
+import * as z from "zod";
+import { validateSecretRef } from "../secrets/secret-refs.js";
+export const environmentSchema = z.enum([
+    "local",
+    "development",
+    "staging",
+    "production",
+    "test",
+    "live",
+    "personal",
+    "client"
+]);
+export const operatingModeSchema = z.enum([
+    "inspect",
+    "guarded",
+    "autopilot",
+    "unrestricted"
+]);
+export const enforcementLevelSchema = z.enum([
+    "provider",
+    "switchboard",
+    "advisory"
+]);
+export const secretRefEnvValueSchema = z.object({
+    secretRef: z.string().min(1).refine((value) => validateSecretRef(value).ok, {
+        message: "secretRef must use lowercase letters, numbers, '.', '_', '-', and '/'"
+    })
+});
+export const upstreamEnvValueSchema = z.union([
+    z.string(),
+    secretRefEnvValueSchema
+]);
+export const upstreamEnvSchema = z.record(z.string(), upstreamEnvValueSchema);
+export const stdioUpstreamSchema = z
+    .object({
+    type: z.literal("stdio"),
+    command: z.string().min(1, "stdio upstream command is required"),
+    args: z.array(z.string()).optional(),
+    cwd: z.string().min(1).optional(),
+    env: upstreamEnvSchema.optional()
+})
+    .passthrough();
+export const upstreamSchema = z
+    .object({
+    type: z.string().min(1),
+    command: z.string().optional(),
+    args: z.array(z.string()).optional(),
+    cwd: z.string().min(1).optional(),
+    env: upstreamEnvSchema.optional(),
+    url: z.string().url().optional()
+})
+    .passthrough()
+    .superRefine((upstream, context) => {
+    if (upstream.type === "stdio" && !upstream.command) {
+        context.addIssue({
+            code: "custom",
+            path: ["command"],
+            message: "stdio upstream command is required"
+        });
+    }
+});
+export const profileSchema = z
+    .object({
+    provider: z.string().min(1, "profile.provider is required"),
+    account: z.string().optional(),
+    org: z.string().optional(),
+    project: z.string().optional(),
+    environment: environmentSchema.optional(),
+    namespace: z.string().min(1).optional(),
+    readOnly: z.boolean().default(false),
+    mode: operatingModeSchema.optional(),
+    enforcement: enforcementLevelSchema.optional(),
+    auth: z
+        .object({
+        ref: z.string().min(1),
+        type: z.string().min(1).optional()
+    })
+        .passthrough()
+        .optional(),
+    upstream: upstreamSchema.optional()
+})
+    .passthrough();
+export const workspaceSchema = z
+    .object({
+    paths: z.array(z.string()).default([]),
+    profiles: z.array(z.string()).default([]),
+    defaultEnvironment: environmentSchema.optional()
+})
+    .passthrough();
+export const policySchema = z
+    .object({
+    defaultMode: operatingModeSchema.optional(),
+    requireConfirmation: z.array(z.string()).default([]),
+    hideTools: z.array(z.string()).default([])
+})
+    .passthrough();
+export const switchboardConfigSchema = z
+    .object({
+    version: z.literal(1).default(1),
+    defaults: z.record(z.string(), z.unknown()).default({}),
+    profiles: z.record(z.string(), profileSchema).default({}),
+    workspaces: z.record(z.string(), workspaceSchema).default({}),
+    policies: z.record(z.string(), policySchema).default({})
+})
+    .passthrough()
+    .superRefine((config, context) => {
+    for (const [profileName, profile] of Object.entries(config.profiles)) {
+        if (!canNormalizeNamespace(profileName)) {
+            context.addIssue({
+                code: "custom",
+                path: ["profiles", profileName],
+                message: "Profile names must contain at least one letter or number for namespace generation."
+            });
+        }
+        if (profile.namespace && !canNormalizeNamespace(profile.namespace)) {
+            context.addIssue({
+                code: "custom",
+                path: ["profiles", profileName, "namespace"],
+                message: "Profile namespace must contain at least one letter or number."
+            });
+        }
+    }
+});
+function canNormalizeNamespace(input) {
+    return (input
+        .normalize("NFKD")
+        .replace(/[\u0300-\u036f]/g, "")
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "_")
+        .replace(/^_+|_+$/g, "")
+        .replace(/_{2,}/g, "_").length > 0);
+}
+//# sourceMappingURL=config.js.map

package/dist/schemas/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/schemas/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,OAAO;IACP,aAAa;IACb,SAAS;IACT,YAAY;IACZ,MAAM;IACN,MAAM;IACN,UAAU;IACV,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACxC,SAAS;IACT,SAAS;IACT,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,UAAU;IACV,aAAa;IACb,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE;QAC1E,OAAO,EACL,uEAAuE;KAC1E,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC5C,CAAC,CAAC,MAAM,EAAE;IACV,uBAAuB;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC;IAChE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,WAAW,EAAE;KACb,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC;IAC3D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACpC,IAAI,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACpC,WAAW,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC9C,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACnC,CAAC;SACD,WAAW,EAAE;SACb,QAAQ,EAAE;IACb,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC3C,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3C,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACzD,CAAC;KACD,WAAW,EAAE;KACb,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAC/B,KAAK,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;gBAC/B,OAAO,EACL,oFAAoF;aACvF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC;gBAC5C,OAAO,EACL,+DAA+D;aAClE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAWL,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,CACL,KAAK;SACF,SAAS,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;SAC/B,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CACrC,CAAC;AACJ,CAAC"}

package/dist/secrets/secret-refs.d.ts

@@ -0,0 +1,10 @@
+export interface SecretRefValidation {
+    ok: boolean;
+    errors: string[];
+}
+export declare function isSecretRefValue(value: unknown): value is {
+    secretRef: string;
+};
+export declare function validateSecretRef(ref: string): SecretRefValidation;
+export declare function assertValidSecretRef(ref: string): void;
+//# sourceMappingURL=secret-refs.d.ts.map

package/dist/secrets/secret-refs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-refs.d.ts","sourceRoot":"","sources":["../../src/secrets/secret-refs.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAID,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAQ/E;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAuBlE;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAKtD"}

package/dist/secrets/secret-refs.js

@@ -0,0 +1,32 @@
+const secretRefPattern = /^[a-z0-9](?:[a-z0-9._/-]*[a-z0-9])?$/;
+export function isSecretRefValue(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        "secretRef" in value &&
+        typeof value.secretRef === "string");
+}
+export function validateSecretRef(ref) {
+    const errors = [];
+    const trimmed = ref.trim();
+    if (trimmed.length === 0) {
+        errors.push("secretRef must not be empty");
+    }
+    if (trimmed !== ref) {
+        errors.push("secretRef must not include leading or trailing whitespace");
+    }
+    if (!secretRefPattern.test(ref)) {
+        errors.push("secretRef must use lowercase letters, numbers, '.', '_', '-', and '/'");
+    }
+    if (ref.includes("//")) {
+        errors.push("secretRef must not contain empty path segments");
+    }
+    return { ok: errors.length === 0, errors };
+}
+export function assertValidSecretRef(ref) {
+    const validation = validateSecretRef(ref);
+    if (!validation.ok) {
+        throw new Error(validation.errors.join("; "));
+    }
+}
+//# sourceMappingURL=secret-refs.js.map

package/dist/secrets/secret-refs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-refs.js","sourceRoot":"","sources":["../../src/secrets/secret-refs.ts"],"names":[],"mappings":"AAKA,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;AAEhE,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,WAAW,IAAI,KAAK;QACpB,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAE3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CACT,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/secrets/secrets.d.ts

@@ -0,0 +1,63 @@
+import type { PathResolutionOptions } from "../config/paths.js";
+import type { SwitchboardConfig, UpstreamEnvValue } from "../schemas/config.js";
+export declare const switchboardSecretServiceName = "switchboard-mcp";
+export interface SecretStore {
+    get(ref: string): Promise<string | null>;
+    set(ref: string, value: string): Promise<void>;
+    delete(ref: string): Promise<void>;
+    diagnose?(): Promise<Record<string, unknown>>;
+}
+export interface KeychainSecretStoreOptions {
+    serviceName?: string;
+    env?: NodeJS.ProcessEnv;
+}
+export declare const allowUnsafeSecretBackendsEnv = "SWITCHBOARD_ALLOW_UNSAFE_SECRET_BACKENDS";
+export declare const crossKeychainBackendEnv = "TS_KEYRING_BACKEND";
+export declare const defaultAllowedKeychainBackendIds: readonly ["native-macos", "native-windows", "native-linux"];
+export declare const unsafeKeychainBackendIds: readonly ["macos", "windows", "secret-service", "file", "null"];
+export interface KeychainBackendPolicyDiagnostic extends Record<string, unknown> {
+    ok: boolean;
+    allowedBackendIds: string[];
+    unsafeBackendsAllowed: boolean;
+    backend?: Record<string, unknown>;
+    message?: string;
+}
+export interface SecretRefUsage {
+    ref: string;
+    profileName: string;
+    envName: string;
+    path: string;
+}
+export interface MissingSecretRef {
+    ref: string;
+    usages: SecretRefUsage[];
+    status: "missing" | "error";
+    message: string;
+}
+export interface SecretIndexEntry {
+    ref: string;
+    updatedAt: string;
+}
+export interface SecretIndex {
+    version: 1;
+    refs: SecretIndexEntry[];
+}
+export interface SecretIndexOptions extends PathResolutionOptions {
+    path?: string;
+}
+export declare function createKeychainSecretStore(options?: KeychainSecretStoreOptions): SecretStore;
+export declare function diagnoseKeychainBackendPolicy(options?: KeychainSecretStoreOptions): Promise<KeychainBackendPolicyDiagnostic>;
+export declare function allowedKeychainBackendIds(options?: KeychainSecretStoreOptions): string[];
+export declare function isAllowedKeychainBackendId(backendId: string, options?: KeychainSecretStoreOptions): boolean;
+export declare function keychainAccountForSecretRef(ref: string): string;
+export declare function createMemorySecretStore(initial?: Record<string, string>): SecretStore;
+export declare function resolveSecretIndexPath(options?: SecretIndexOptions): string;
+export declare function readSecretIndex(options?: SecretIndexOptions): Promise<SecretIndex>;
+export declare function listSecretRefs(options?: SecretIndexOptions): Promise<SecretIndexEntry[]>;
+export declare function rememberSecretRef(ref: string, options?: SecretIndexOptions): Promise<SecretIndex>;
+export declare function forgetSecretRef(ref: string, options?: SecretIndexOptions): Promise<SecretIndex>;
+export declare function collectSecretRefUsages(config: SwitchboardConfig): SecretRefUsage[];
+export declare function findMissingSecretRefs(config: SwitchboardConfig, store: SecretStore): Promise<MissingSecretRef[]>;
+export declare function resolveEnvSecretRefs(env: Record<string, UpstreamEnvValue>, store: SecretStore): Promise<Record<string, string>>;
+export declare function removeSecretIndex(options?: SecretIndexOptions): Promise<void>;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/secrets/secrets.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAOhF,eAAO,MAAM,4BAA4B,oBAAoB,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,QAAQ,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,eAAO,MAAM,4BAA4B,6CACG,CAAC;AAC7C,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D,eAAO,MAAM,gCAAgC,6DAInC,CAAC;AAEX,eAAO,MAAM,wBAAwB,iEAM3B,CAAC;AAEX,MAAM,WAAW,+BAAgC,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC9E,EAAE,EAAE,OAAO,CAAC;IACZ,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,CAAC,CAAC;IACX,IAAI,EAAE,gBAAgB,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,0BAA+B,GACvC,WAAW,CA2Bb;AAED,wBAAsB,6BAA6B,CACjD,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,+BAA+B,CAAC,CAoB1C;AAED,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,0BAA+B,GACvC,MAAM,EAAE,CAOV;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAET;AA6DD,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG/D;AAkBD,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,WAAW,CAmBb;AAED,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,kBAAuB,GAC/B,MAAM,CAYR;AAED,wBAAsB,eAAe,CACnC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC,CA2BtB;AAED,wBAAsB,cAAc,CAClC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE7B;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC,CAStB;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,iBAAiB,GACxB,cAAc,EAAE,CAqBlB;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA8B7B;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACrC,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAoBjC;AA0BD,wBAAsB,iBAAiB,CACrC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/secrets/secrets.js

@@ -0,0 +1,301 @@
+import { chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { deletePassword, diagnose as diagnoseKeychain, getPassword, initBackend, setPassword } from "cross-keychain";
+import { assertValidSecretRef, isSecretRefValue, validateSecretRef } from "./secret-refs.js";
+export const switchboardSecretServiceName = "switchboard-mcp";
+export const allowUnsafeSecretBackendsEnv = "SWITCHBOARD_ALLOW_UNSAFE_SECRET_BACKENDS";
+export const crossKeychainBackendEnv = "TS_KEYRING_BACKEND";
+export const defaultAllowedKeychainBackendIds = [
+    "native-macos",
+    "native-windows",
+    "native-linux"
+];
+export const unsafeKeychainBackendIds = [
+    "macos",
+    "windows",
+    "secret-service",
+    "file",
+    "null"
+];
+export function createKeychainSecretStore(options = {}) {
+    const serviceName = options.serviceName ?? switchboardSecretServiceName;
+    const ensureBackend = createKeychainBackendInitializer(options);
+    return {
+        async get(ref) {
+            assertValidSecretRef(ref);
+            await ensureBackend();
+            return withSuppressedKeychainWarnings(() => getPassword(serviceName, keychainAccountForSecretRef(ref)));
+        },
+        async set(ref, value) {
+            assertValidSecretRef(ref);
+            await ensureBackend();
+            await withSuppressedKeychainWarnings(() => setPassword(serviceName, keychainAccountForSecretRef(ref), value));
+        },
+        async delete(ref) {
+            assertValidSecretRef(ref);
+            await ensureBackend();
+            await withSuppressedKeychainWarnings(() => deletePassword(serviceName, keychainAccountForSecretRef(ref)));
+        },
+        diagnose: () => diagnoseKeychainBackendPolicy(options)
+    };
+}
+export async function diagnoseKeychainBackendPolicy(options = {}) {
+    const allowedBackendIds = allowedKeychainBackendIds(options);
+    const unsafeBackendsAllowed = areUnsafeKeychainBackendsAllowed(options);
+    try {
+        await initializeKeychainBackend(options);
+        const backend = await withSuppressedKeychainWarnings(diagnoseKeychain);
+        return {
+            ok: true,
+            allowedBackendIds,
+            unsafeBackendsAllowed,
+            backend
+        };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            allowedBackendIds,
+            unsafeBackendsAllowed,
+            message: messageFromUnknownError(error)
+        };
+    }
+}
+export function allowedKeychainBackendIds(options = {}) {
+    return areUnsafeKeychainBackendsAllowed(options)
+        ? [
+            ...defaultAllowedKeychainBackendIds,
+            ...unsafeKeychainBackendIds
+        ]
+        : [...defaultAllowedKeychainBackendIds];
+}
+export function isAllowedKeychainBackendId(backendId, options = {}) {
+    return allowedKeychainBackendIds(options).includes(backendId);
+}
+function createKeychainBackendInitializer(options) {
+    let initialized = false;
+    return async () => {
+        if (initialized) {
+            return;
+        }
+        await initializeKeychainBackend(options);
+        initialized = true;
+    };
+}
+async function initializeKeychainBackend(options) {
+    const allowedBackendIds = allowedKeychainBackendIds(options);
+    assertRequestedKeychainBackendAllowed(options, allowedBackendIds);
+    await withSuppressedKeychainWarnings(() => initBackend((backend) => allowedBackendIds.includes(backend.id)));
+    const backend = await withSuppressedKeychainWarnings(diagnoseKeychain);
+    const backendId = typeof backend.id === "string" ? backend.id : "unknown";
+    if (!allowedBackendIds.includes(backendId)) {
+        throw new Error([
+            `Switchboard refused keychain backend "${backendId}" for local secrets.`,
+            `Allowed backends: ${allowedBackendIds.join(", ")}.`,
+            `Set ${allowUnsafeSecretBackendsEnv}=1 only for tests or local demos that intentionally use unsafe fallback storage.`
+        ].join(" "));
+    }
+}
+function assertRequestedKeychainBackendAllowed(options, allowedBackendIds) {
+    const requestedBackend = (options.env ?? process.env)[crossKeychainBackendEnv];
+    if (requestedBackend && !allowedBackendIds.includes(requestedBackend)) {
+        throw new Error([
+            `Switchboard refused keychain backend "${requestedBackend}" requested by ${crossKeychainBackendEnv} for local secrets.`,
+            `Allowed backends: ${allowedBackendIds.join(", ")}.`,
+            `Set ${allowUnsafeSecretBackendsEnv}=1 only for tests or local demos that intentionally use unsafe fallback storage.`
+        ].join(" "));
+    }
+}
+function areUnsafeKeychainBackendsAllowed(options) {
+    const value = (options.env ?? process.env)[allowUnsafeSecretBackendsEnv];
+    return value === "1" || value === "true" || value === "yes";
+}
+export function keychainAccountForSecretRef(ref) {
+    assertValidSecretRef(ref);
+    return `switchboard_${Buffer.from(ref, "utf8").toString("base64url")}`;
+}
+async function withSuppressedKeychainWarnings(operation) {
+    const originalWarn = console.warn;
+    console.warn = () => { };
+    try {
+        return await operation();
+    }
+    finally {
+        console.warn = originalWarn;
+    }
+}
+function messageFromUnknownError(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export function createMemorySecretStore(initial = {}) {
+    const values = new Map(Object.entries(initial));
+    return {
+        async get(ref) {
+            assertValidSecretRef(ref);
+            return values.get(ref) ?? null;
+        },
+        async set(ref, value) {
+            assertValidSecretRef(ref);
+            values.set(ref, value);
+        },
+        async delete(ref) {
+            assertValidSecretRef(ref);
+            values.delete(ref);
+        },
+        async diagnose() {
+            return { backend: "memory", count: values.size };
+        }
+    };
+}
+export function resolveSecretIndexPath(options = {}) {
+    if (options.path) {
+        return options.path;
+    }
+    const env = options.env ?? process.env;
+    const home = options.homeDir ?? homedir();
+    const stateRoot = env.XDG_STATE_HOME
+        ? resolve(env.XDG_STATE_HOME)
+        : join(home, ".local", "state");
+    return join(stateRoot, "switchboard", "secrets", "index.json");
+}
+export async function readSecretIndex(options = {}) {
+    const path = resolveSecretIndexPath(options);
+    const raw = await readFile(path, "utf8").catch((error) => {
+        if (isNodeError(error, "ENOENT")) {
+            return "";
+        }
+        throw error;
+    });
+    if (raw.trim().length === 0) {
+        return { version: 1, refs: [] };
+    }
+    const parsed = JSON.parse(raw);
+    return {
+        version: 1,
+        refs: Array.isArray(parsed.refs)
+            ? parsed.refs
+                .filter((entry) => typeof entry?.ref === "string" &&
+                typeof entry.updatedAt === "string" &&
+                validateSecretRef(entry.ref).ok)
+                .sort((a, b) => a.ref.localeCompare(b.ref))
+            : []
+    };
+}
+export async function listSecretRefs(options = {}) {
+    return (await readSecretIndex(options)).refs;
+}
+export async function rememberSecretRef(ref, options = {}) {
+    assertValidSecretRef(ref);
+    const index = await readSecretIndex(options);
+    const updatedAt = new Date().toISOString();
+    const refs = [
+        ...index.refs.filter((entry) => entry.ref !== ref),
+        { ref, updatedAt }
+    ].sort((a, b) => a.ref.localeCompare(b.ref));
+    const next = { version: 1, refs };
+    await writeSecretIndex(next, options);
+    return next;
+}
+export async function forgetSecretRef(ref, options = {}) {
+    assertValidSecretRef(ref);
+    const index = await readSecretIndex(options);
+    const next = {
+        version: 1,
+        refs: index.refs.filter((entry) => entry.ref !== ref)
+    };
+    await writeSecretIndex(next, options);
+    return next;
+}
+export function collectSecretRefUsages(config) {
+    const usages = [];
+    for (const [profileName, profile] of Object.entries(config.profiles)) {
+        const env = profile.upstream?.env;
+        if (!env) {
+            continue;
+        }
+        for (const [envName, value] of Object.entries(env)) {
+            if (isSecretRefValue(value)) {
+                usages.push({
+                    ref: value.secretRef,
+                    profileName,
+                    envName,
+                    path: `profiles.${profileName}.upstream.env.${envName}.secretRef`
+                });
+            }
+        }
+    }
+    return usages;
+}
+export async function findMissingSecretRefs(config, store) {
+    const usagesByRef = new Map();
+    for (const usage of collectSecretRefUsages(config)) {
+        const usages = usagesByRef.get(usage.ref) ?? [];
+        usages.push(usage);
+        usagesByRef.set(usage.ref, usages);
+    }
+    const missing = [];
+    for (const [ref, usages] of usagesByRef) {
+        try {
+            if ((await store.get(ref)) === null) {
+                missing.push({
+                    ref,
+                    usages,
+                    status: "missing",
+                    message: `secretRef "${ref}" is not set`
+                });
+            }
+        }
+        catch (error) {
+            missing.push({
+                ref,
+                usages,
+                status: "error",
+                message: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    return missing.sort((a, b) => a.ref.localeCompare(b.ref));
+}
+export async function resolveEnvSecretRefs(env, store) {
+    const resolved = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (typeof value === "string") {
+            resolved[key] = value;
+            continue;
+        }
+        if (isSecretRefValue(value)) {
+            const secret = await store.get(value.secretRef);
+            if (secret === null) {
+                throw new Error(`secretRef "${value.secretRef}" for env ${key} is not set`);
+            }
+            resolved[key] = secret;
+        }
+    }
+    return resolved;
+}
+async function writeSecretIndex(index, options) {
+    const path = resolveSecretIndexPath(options);
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(tempPath, `${JSON.stringify(index, null, 2)}\n`, {
+        mode: 0o600
+    });
+    await chmod(tempPath, 0o600);
+    await rename(tempPath, path);
+    await chmod(path, 0o600);
+}
+function isNodeError(error, code) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === code);
+}
+export async function removeSecretIndex(options = {}) {
+    await unlink(resolveSecretIndexPath(options)).catch((error) => {
+        if (!isNodeError(error, "ENOENT")) {
+            throw error;
+        }
+    });
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/secrets/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,KAAK,EACL,QAAQ,EACR,MAAM,EACN,MAAM,EACN,SAAS,EACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,cAAc,EACd,QAAQ,IAAI,gBAAgB,EAC5B,WAAW,EACX,WAAW,EACX,WAAW,EACZ,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,MAAM,4BAA4B,GAAG,iBAAiB,CAAC;AAc9D,MAAM,CAAC,MAAM,4BAA4B,GACvC,0CAA0C,CAAC;AAC7C,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,cAAc;IACd,gBAAgB;IAChB,cAAc;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO;IACP,SAAS;IACT,gBAAgB;IAChB,MAAM;IACN,MAAM;CACE,CAAC;AAsCX,MAAM,UAAU,yBAAyB,CACvC,UAAsC,EAAE;IAExC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,4BAA4B,CAAC;IACxE,MAAM,aAAa,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAChE,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,aAAa,EAAE,CAAC;YACtB,OAAO,8BAA8B,CAAC,GAAG,EAAE,CACzC,WAAW,CAAC,WAAW,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAC3D,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;YAClB,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,aAAa,EAAE,CAAC;YACtB,MAAM,8BAA8B,CAAC,GAAG,EAAE,CACxC,WAAW,CAAC,WAAW,EAAE,2BAA2B,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAClE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,aAAa,EAAE,CAAC;YACtB,MAAM,8BAA8B,CAAC,GAAG,EAAE,CACxC,cAAc,CAAC,WAAW,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAC9D,CAAC;QACJ,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,OAAO,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,UAAsC,EAAE;IAExC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;QACvE,OAAO;YACL,EAAE,EAAE,IAAI;YACR,iBAAiB;YACjB,qBAAqB;YACrB,OAAO;SACR,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,iBAAiB;YACjB,qBAAqB;YACrB,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC;SACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,UAAsC,EAAE;IAExC,OAAO,gCAAgC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC;YACE,GAAG,gCAAgC;YACnC,GAAG,wBAAwB;SAC5B;QACH,CAAC,CAAC,CAAC,GAAG,gCAAgC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,SAAiB,EACjB,UAAsC,EAAE;IAExC,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,gCAAgC,CACvC,OAAmC;IAEnC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACzC,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,OAAmC;IAEnC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC7D,qCAAqC,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAClE,MAAM,8BAA8B,CAAC,GAAG,EAAE,CACxC,WAAW,CAAC,CAAC,OAAuB,EAAE,EAAE,CACtC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CACvC,CACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb;YACE,yCAAyC,SAAS,sBAAsB;YACxE,qBAAqB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACpD,OAAO,4BAA4B,kFAAkF;SACtH,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qCAAqC,CAC5C,OAAmC,EACnC,iBAA2B;IAE3B,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAC/E,IAAI,gBAAgB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb;YACE,yCAAyC,gBAAgB,kBAAkB,uBAAuB,qBAAqB;YACvH,qBAAqB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACpD,OAAO,4BAA4B,kFAAkF;SACtH,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CACvC,OAAmC;IAEnC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,4BAA4B,CAAC,CAAC;IACzE,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,eAAe,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,SAA2B;IAE3B,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAClC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC1B,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;YAClB,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,UAA8B,EAAE;IAEhC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,IAAI,CAAC;IACtB,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,cAAc;QAClC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAElC,OAAO,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAChE,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;IACvD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI;iBACR,MAAM,CACL,CAAC,KAAK,EAA6B,EAAE,CACnC,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ;gBAC9B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;gBACnC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAClC;iBACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/C,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAA8B,EAAE;IAEhC,OAAO,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,UAA8B,EAAE;IAEhC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG;QACX,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC;QAClD,EAAE,GAAG,EAAE,SAAS,EAAE;KACnB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAgB,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/C,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,UAA8B,EAAE;IAEhC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAgB;QACxB,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC;KACtD,CAAC;IACF,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAyB;IAEzB,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QAED,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC;oBACV,GAAG,EAAE,KAAK,CAAC,SAAS;oBACpB,WAAW;oBACX,OAAO;oBACP,IAAI,EAAE,YAAY,WAAW,iBAAiB,OAAO,YAAY;iBAClE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAyB,EACzB,KAAkB;IAElB,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC;oBACX,GAAG;oBACH,MAAM;oBACN,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,cAAc,GAAG,cAAc;iBACzC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC;gBACX,GAAG;gBACH,MAAM;gBACN,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAqC,EACrC,KAAkB;IAElB,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACtB,SAAS;QACX,CAAC;QAED,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,cAAc,KAAK,CAAC,SAAS,aAAa,GAAG,aAAa,CAC3D,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAkB,EAClB,OAA2B;IAE3B,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IAC5D,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC/D,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY;IAC/C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACf,KAAK,CAAC,IAAI,KAAK,IAAI,CACpB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAA8B,EAAE;IAEhC,MAAM,MAAM,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACrE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@switchboard-mcp/core",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Core config, mandate, approval, provider-template, install, audit, and secret primitives for Switchboard.",
+  "license": "UNLICENSED",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/woverfield/switchboard.git",
+    "directory": "packages/core"
+  },
+  "homepage": "https://github.com/woverfield/switchboard#readme",
+  "bugs": {
+    "url": "https://github.com/woverfield/switchboard/issues"
+  },
+  "exports": {
+    ".": {
+      "source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "!dist/**/*.test.*",
+    "README.md"
+  ],
+  "dependencies": {
+    "cross-keychain": "^1.1.0",
+    "yaml": "^2.8.2",
+    "zod": "^4.2.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}