@tickernelz/paperclip-pro-shared 2026.925.0

package/dist/markdown-work-products.test.js

@@ -0,0 +1,122 @@
+import { describe, expect, it } from "vitest";
+import { ARTIFACT_REVIEW_DOCUMENT_KEY_PREFIX, artifactReviewDocumentKey, getAttachmentArtifactWorkProductMetadata, getMarkdownWorkProductAttachmentMetadata, isArtifactReviewDocumentKey, isMarkdownArtifactWorkProduct, isMarkdownAttachmentContent, workProductIdFromArtifactReviewDocumentKey, } from "./markdown-work-products.js";
+const ATTACHMENT_ID = "00000000-0000-4000-8000-000000000001";
+const WORK_PRODUCT_ID = "11111111-2222-4333-8444-555555555555";
+function attachmentMetadata(overrides = {}) {
+    const contentPath = `/api/attachments/${ATTACHMENT_ID}/content`;
+    return {
+        attachmentId: ATTACHMENT_ID,
+        contentType: "text/markdown",
+        byteSize: 128,
+        contentPath,
+        openPath: contentPath,
+        downloadPath: `${contentPath}?download=1`,
+        originalFilename: "notes.md",
+        ...overrides,
+    };
+}
+function workProduct(overrides = {}) {
+    return {
+        type: "artifact",
+        provider: "paperclip",
+        metadata: attachmentMetadata(),
+        ...overrides,
+    };
+}
+describe("isMarkdownAttachmentContent", () => {
+    it.each([
+        "text/markdown",
+        "text/x-markdown",
+        "application/markdown",
+        "application/x-markdown",
+    ])("accepts %s regardless of filename", (contentType) => {
+        expect(isMarkdownAttachmentContent({ contentType, originalFilename: null })).toBe(true);
+    });
+    it("ignores MIME parameters and case", () => {
+        expect(isMarkdownAttachmentContent({
+            contentType: "Text/Markdown; charset=utf-8",
+            originalFilename: null,
+        })).toBe(true);
+    });
+    it.each([
+        "text/plain",
+        "application/octet-stream",
+        "binary/octet-stream",
+        "application/x-binary",
+    ])("accepts a .md filename when the content type is %s", (contentType) => {
+        expect(isMarkdownAttachmentContent({ contentType, originalFilename: "README.md" })).toBe(true);
+    });
+    it("accepts a .markdown filename with a generic content type", () => {
+        expect(isMarkdownAttachmentContent({
+            contentType: "application/octet-stream",
+            originalFilename: "guide.markdown",
+        })).toBe(true);
+    });
+    it("rejects .mdx files", () => {
+        expect(isMarkdownAttachmentContent({
+            contentType: "application/octet-stream",
+            originalFilename: "page.mdx",
+        })).toBe(false);
+        expect(isMarkdownAttachmentContent({ contentType: "text/plain", originalFilename: "page.mdx" })).toBe(false);
+    });
+    it("rejects markdown filenames with non-generic content types", () => {
+        expect(isMarkdownAttachmentContent({ contentType: "text/html", originalFilename: "notes.md" })).toBe(false);
+    });
+    it("rejects non-markdown filenames with generic content types", () => {
+        expect(isMarkdownAttachmentContent({ contentType: "text/plain", originalFilename: "notes.txt" })).toBe(false);
+    });
+    it("rejects a missing content type", () => {
+        expect(isMarkdownAttachmentContent({ contentType: null, originalFilename: "notes.md" })).toBe(false);
+    });
+});
+describe("getAttachmentArtifactWorkProductMetadata", () => {
+    it("returns canonical metadata for a valid paperclip artifact work product", () => {
+        const metadata = getAttachmentArtifactWorkProductMetadata(workProduct());
+        expect(metadata?.attachmentId).toBe(ATTACHMENT_ID);
+    });
+    it("returns null for non-artifact work products", () => {
+        expect(getAttachmentArtifactWorkProductMetadata(workProduct({ type: "document" }))).toBeNull();
+    });
+    it("returns null for non-paperclip providers", () => {
+        expect(getAttachmentArtifactWorkProductMetadata(workProduct({ provider: "github" }))).toBeNull();
+    });
+    it("returns null when metadata is missing or non-canonical", () => {
+        expect(getAttachmentArtifactWorkProductMetadata(workProduct({ metadata: null }))).toBeNull();
+        expect(getAttachmentArtifactWorkProductMetadata(workProduct({
+            metadata: attachmentMetadata({ openPath: "https://evil.example/content" }),
+        }))).toBeNull();
+    });
+});
+describe("getMarkdownWorkProductAttachmentMetadata", () => {
+    it("returns metadata only when the attachment is markdown-eligible", () => {
+        expect(getMarkdownWorkProductAttachmentMetadata(workProduct())).not.toBeNull();
+        expect(getMarkdownWorkProductAttachmentMetadata(workProduct({
+            metadata: attachmentMetadata({ contentType: "application/pdf", originalFilename: "a.pdf" }),
+        }))).toBeNull();
+    });
+    it("backs the boolean eligibility helper", () => {
+        expect(isMarkdownArtifactWorkProduct(workProduct())).toBe(true);
+        expect(isMarkdownArtifactWorkProduct(workProduct({
+            metadata: attachmentMetadata({ contentType: "image/png", originalFilename: "a.png" }),
+        }))).toBe(false);
+    });
+});
+describe("artifact review document keys", () => {
+    it("builds a deterministic key that fits the 64-character document key limit", () => {
+        const key = artifactReviewDocumentKey(WORK_PRODUCT_ID);
+        expect(key).toBe(`artifact-review-${WORK_PRODUCT_ID}`);
+        expect(key.length).toBeLessThanOrEqual(64);
+        expect(key).toMatch(/^[a-z0-9][a-z0-9_-]*$/);
+    });
+    it("identifies proxy review-document keys", () => {
+        expect(isArtifactReviewDocumentKey(artifactReviewDocumentKey(WORK_PRODUCT_ID))).toBe(true);
+        expect(isArtifactReviewDocumentKey("plan")).toBe(false);
+        expect(isArtifactReviewDocumentKey("notes")).toBe(false);
+        expect(isArtifactReviewDocumentKey(ARTIFACT_REVIEW_DOCUMENT_KEY_PREFIX)).toBe(false);
+    });
+    it("round-trips the work product id", () => {
+        expect(workProductIdFromArtifactReviewDocumentKey(artifactReviewDocumentKey(WORK_PRODUCT_ID))).toBe(WORK_PRODUCT_ID);
+        expect(workProductIdFromArtifactReviewDocumentKey("plan")).toBeNull();
+    });
+});
+//# sourceMappingURL=markdown-work-products.test.js.map

package/dist/markdown-work-products.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-work-products.test.js","sourceRoot":"","sources":["../src/markdown-work-products.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,mCAAmC,EACnC,yBAAyB,EACzB,wCAAwC,EACxC,wCAAwC,EACxC,2BAA2B,EAC3B,6BAA6B,EAC7B,2BAA2B,EAC3B,0CAA0C,GAC3C,MAAM,6BAA6B,CAAC;AAErC,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAC7D,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAE/D,SAAS,kBAAkB,CAAC,SAAS,GAA4B,EAAE;IACjE,MAAM,WAAW,GAAG,oBAAoB,aAAa,UAAU,CAAC;IAChE,OAAO;QACL,YAAY,EAAE,aAAa;QAC3B,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,GAAG;QACb,WAAW;QACX,QAAQ,EAAE,WAAW;QACrB,YAAY,EAAE,GAAG,WAAW,aAAa;QACzC,gBAAgB,EAAE,UAAU;QAC5B,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,SAAS,GAA4B,EAAE;IAC1D,OAAO;QACL,IAAI,EAAE,UAAmB;QACzB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,kBAAkB,EAAE;QAC9B,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,IAAI,CAAC;QACN,eAAe;QACf,iBAAiB;QACjB,sBAAsB;QACtB,wBAAwB;KACzB,CAAC,CAAC,mCAAmC,EAAE,CAAC,WAAW,EAAE,EAAE;QACtD,MAAM,CAAC,2BAA2B,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CACJ,2BAA2B,CAAC;YAC1B,WAAW,EAAE,8BAA8B;YAC3C,gBAAgB,EAAE,IAAI;SACvB,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,YAAY;QACZ,0BAA0B;QAC1B,qBAAqB;QACrB,sBAAsB;KACvB,CAAC,CAAC,oDAAoD,EAAE,CAAC,WAAW,EAAE,EAAE;QACvE,MAAM,CAAC,2BAA2B,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CACJ,2BAA2B,CAAC;YAC1B,WAAW,EAAE,0BAA0B;YACvC,gBAAgB,EAAE,gBAAgB;SACnC,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,CACJ,2BAA2B,CAAC;YAC1B,WAAW,EAAE,0BAA0B;YACvC,gBAAgB,EAAE,UAAU;SAC7B,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,MAAM,CACJ,2BAA2B,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CACzF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CACJ,2BAA2B,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CACxF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CACJ,2BAA2B,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAC1F,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,2BAA2B,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAC3F,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,QAAQ,GAAG,wCAAwC,CAAC,WAAW,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,wCAAwC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,wCAAwC,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,wCAAwC,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7F,MAAM,CACJ,wCAAwC,CACtC,WAAW,CAAC;YACV,QAAQ,EAAE,kBAAkB,CAAC,EAAE,QAAQ,EAAE,8BAA8B,EAAE,CAAC;SAC3E,CAAC,CACH,CACF,CAAC,QAAQ,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,wCAAwC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC/E,MAAM,CACJ,wCAAwC,CACtC,WAAW,CAAC;YACV,QAAQ,EAAE,kBAAkB,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;SAC5F,CAAC,CACH,CACF,CAAC,QAAQ,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,6BAA6B,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,CACJ,6BAA6B,CAC3B,WAAW,CAAC;YACV,QAAQ,EAAE,kBAAkB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;SACtF,CAAC,CACH,CACF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,GAAG,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,eAAe,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3F,MAAM,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,2BAA2B,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CACJ,0CAA0C,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC,CACvF,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACxB,MAAM,CAAC,0CAA0C,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/mcp-config-help-prompt.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The static prompt an operator copies and hands to an agent to get a
+ * paste-ready MCP config back (PAP-17087, plan section 3A).
+ *
+ * This is a constant on purpose. It must never interpolate the textarea's
+ * contents, the company, an endpoint, or a secret: the operator pastes it into
+ * whatever chat surface they like, so anything folded in here leaves Paperclip.
+ * Keeping it a constant is also what makes "opening or copying help makes no
+ * connection or import request" true by construction rather than by review.
+ *
+ * The instructions are ordered so the *first* thing in the reply is the JSON the
+ * operator has to paste, because that is the only part Paperclip's config
+ * preview parser reads. Everything else is prose for the human.
+ */
+export declare const MCP_CONFIG_HELP_PROMPT = "I want to connect an MCP (Model Context Protocol) server to Paperclip, and I need a paste-ready config.\n\nTarget server: <name the server, or ask me if I have not said>\n\nPlease:\n\n1. Confirm which MCP server this is. If I have not named one, or you are unsure which product I mean, ask me for its name or a link to its documentation before answering. Then consult the current official documentation for that server (the vendor's own docs or the server's own repository), not your memory of it.\n\n2. Reply with one valid, paste-ready JSON object FIRST, before any prose. It must have a single top-level \"mcpServers\" key containing exactly one remote server entry, using:\n   - the exact HTTP(S) endpoint as \"url\", including any required query parameters\n   - the exact required header names, spelled the way the server expects them\n   Example of the shape (not the values):\n\n   {\n     \"mcpServers\": {\n       \"example\": {\n         \"url\": \"https://mcp.example.com/mcp\",\n         \"headers\": { \"Authorization\": \"Bearer <YOUR_TOKEN>\" }\n       }\n     }\n   }\n\n3. Use an obvious placeholder for every credential, like <YOUR_API_KEY>. Do not ask me to paste a real token into this conversation, do not repeat one back to me, and do not embed one in the JSON.\n\n4. After the JSON, add short setup notes covering:\n   - how I obtain each credential, step by step\n   - which scopes or permissions the credential needs\n   - which fields are optional and what they change\n   - whether this server requires browser sign-in (OAuth) instead of headers, in which case say so plainly\n   - the official documentation links you actually used\n\n5. Do not invent fields, header names, or URLs. If you are not certain about something, say which part you are unsure about instead of guessing. If this server only runs locally as a command (stdio) and has no remote HTTP endpoint, say that the paste-a-config path does not apply, and give me the verified local command separately.";
+/**
+ * What the operator needs to know about the hand-off, shown above the prompt.
+ * Kept next to the prompt so the two cannot drift apart.
+ */
+export declare const MCP_CONFIG_HELP_INSTRUCTIONS: readonly ["Copy this prompt and send it to an agent or assistant that can look up the server's documentation.", "Paste only the JSON block it replies with back into the box on this page.", "Paperclip reads the header names from that JSON and asks you for the values, then stores them as Paperclip secrets — so the config you paste should contain placeholders, not live credentials."];
+//# sourceMappingURL=mcp-config-help-prompt.d.ts.map

package/dist/mcp-config-help-prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-config-help-prompt.d.ts","sourceRoot":"","sources":["../src/mcp-config-help-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,g9DA+ByS,CAAC;AAE7U;;;GAGG;AACH,eAAO,MAAM,4BAA4B,YACvC,oGAAoG,EACpG,2EAA2E,EAC3E,iMAAiM,CACzL,CAAC"}

package/dist/mcp-config-help-prompt.js

@@ -0,0 +1,56 @@
+/**
+ * The static prompt an operator copies and hands to an agent to get a
+ * paste-ready MCP config back (PAP-17087, plan section 3A).
+ *
+ * This is a constant on purpose. It must never interpolate the textarea's
+ * contents, the company, an endpoint, or a secret: the operator pastes it into
+ * whatever chat surface they like, so anything folded in here leaves Paperclip.
+ * Keeping it a constant is also what makes "opening or copying help makes no
+ * connection or import request" true by construction rather than by review.
+ *
+ * The instructions are ordered so the *first* thing in the reply is the JSON the
+ * operator has to paste, because that is the only part Paperclip's config
+ * preview parser reads. Everything else is prose for the human.
+ */
+export const MCP_CONFIG_HELP_PROMPT = `I want to connect an MCP (Model Context Protocol) server to Paperclip, and I need a paste-ready config.
+
+Target server: <name the server, or ask me if I have not said>
+
+Please:
+
+1. Confirm which MCP server this is. If I have not named one, or you are unsure which product I mean, ask me for its name or a link to its documentation before answering. Then consult the current official documentation for that server (the vendor's own docs or the server's own repository), not your memory of it.
+
+2. Reply with one valid, paste-ready JSON object FIRST, before any prose. It must have a single top-level "mcpServers" key containing exactly one remote server entry, using:
+   - the exact HTTP(S) endpoint as "url", including any required query parameters
+   - the exact required header names, spelled the way the server expects them
+   Example of the shape (not the values):
+
+   {
+     "mcpServers": {
+       "example": {
+         "url": "https://mcp.example.com/mcp",
+         "headers": { "Authorization": "Bearer <YOUR_TOKEN>" }
+       }
+     }
+   }
+
+3. Use an obvious placeholder for every credential, like <YOUR_API_KEY>. Do not ask me to paste a real token into this conversation, do not repeat one back to me, and do not embed one in the JSON.
+
+4. After the JSON, add short setup notes covering:
+   - how I obtain each credential, step by step
+   - which scopes or permissions the credential needs
+   - which fields are optional and what they change
+   - whether this server requires browser sign-in (OAuth) instead of headers, in which case say so plainly
+   - the official documentation links you actually used
+
+5. Do not invent fields, header names, or URLs. If you are not certain about something, say which part you are unsure about instead of guessing. If this server only runs locally as a command (stdio) and has no remote HTTP endpoint, say that the paste-a-config path does not apply, and give me the verified local command separately.`;
+/**
+ * What the operator needs to know about the hand-off, shown above the prompt.
+ * Kept next to the prompt so the two cannot drift apart.
+ */
+export const MCP_CONFIG_HELP_INSTRUCTIONS = [
+    "Copy this prompt and send it to an agent or assistant that can look up the server's documentation.",
+    "Paste only the JSON block it replies with back into the box on this page.",
+    "Paperclip reads the header names from that JSON and asks you for the values, then stores them as Paperclip secrets — so the config you paste should contain placeholders, not live credentials.",
+];
+//# sourceMappingURL=mcp-config-help-prompt.js.map

package/dist/mcp-config-help-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-config-help-prompt.js","sourceRoot":"","sources":["../src/mcp-config-help-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4UA+BsS,CAAC;AAE7U;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,oGAAoG;IACpG,2EAA2E;IAC3E,iMAAiM;CACzL,CAAC"}

package/dist/mcp-remote-headers.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Header-name/value safety for user-supplied remote MCP credentials (PAP-17087).
+ *
+ * Both the guided "Connect your own MCP server" flow and the paste-config escape
+ * hatch let an operator name arbitrary request headers for an arbitrary endpoint.
+ * Those names reach a real outbound `fetch`, so they are validated here — once,
+ * in shared code — instead of at each call site:
+ *
+ * - only RFC 9110 `token` characters, so a name can never smuggle a separator,
+ *   whitespace, or CR/LF into the request line;
+ * - never a hop-by-hop, framing, routing, or ambient-credential header, because
+ *   those either belong to the transport or would let a pasted config redirect
+ *   the request or attach a browser cookie;
+ * - values must stay printable single-line, which blocks header/response
+ *   splitting through a value that carries `\r\n`.
+ *
+ * `Authorization` is deliberately allowed: it is the header the bearer-key path
+ * uses, and its value is stored as a Paperclip secret like every other one.
+ */
+export type McpRemoteHeaderRejection = "empty" | "too_long" | "invalid_characters" | "forbidden" | "value_too_long" | "value_control_characters";
+export interface McpRemoteHeaderCheck {
+    ok: boolean;
+    reason?: McpRemoteHeaderRejection;
+}
+/**
+ * Is `name` a header Paperclip is willing to send on a user-configured remote
+ * MCP request? Returns the specific rejection reason so callers can produce an
+ * actionable, UI-safe message.
+ */
+export declare function checkMcpRemoteHeaderName(name: string): McpRemoteHeaderCheck;
+/**
+ * Is `value` safe to send as a header value? Rejects CR/LF and other control
+ * characters (header splitting) and absurdly long values.
+ */
+export declare function checkMcpRemoteHeaderValue(value: string): McpRemoteHeaderCheck;
+export declare function isSafeMcpRemoteHeaderName(name: string): boolean;
+export declare function isSafeMcpRemoteHeaderValue(value: string): boolean;
+/** A UI-safe explanation for a rejected header. Never echoes the value. */
+export declare function mcpRemoteHeaderRejectionMessage(headerName: string, reason: McpRemoteHeaderRejection): string;
+/**
+ * `credentialValues` keys use a `headers.<Name>` config path. Extract the header
+ * name, or `null` when the path is not a header path.
+ */
+export declare function mcpRemoteHeaderNameFromConfigPath(configPath: string): string | null;
+export declare const MCP_REMOTE_HEADER_LIMITS: {
+    readonly maxNameLength: 128;
+    readonly maxValueLength: 8192;
+};
+//# sourceMappingURL=mcp-remote-headers.d.ts.map

package/dist/mcp-remote-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-remote-headers.d.ts","sourceRoot":"","sources":["../src/mcp-remote-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAwCH,MAAM,MAAM,wBAAwB,GAChC,OAAO,GACP,UAAU,GACV,oBAAoB,GACpB,WAAW,GACX,gBAAgB,GAChB,0BAA0B,CAAC;AAE/B,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,wBAAwB,CAAC;CACnC;AAID;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAW3E;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,CAQ7E;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,2EAA2E;AAC3E,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,wBAAwB,GAC/B,MAAM,CAeR;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAInF;AAED,eAAO,MAAM,wBAAwB;aACnC,aAAa;aACb,cAAc;CACN,CAAC"}

package/dist/mcp-remote-headers.js

@@ -0,0 +1,127 @@
+/**
+ * Header-name/value safety for user-supplied remote MCP credentials (PAP-17087).
+ *
+ * Both the guided "Connect your own MCP server" flow and the paste-config escape
+ * hatch let an operator name arbitrary request headers for an arbitrary endpoint.
+ * Those names reach a real outbound `fetch`, so they are validated here — once,
+ * in shared code — instead of at each call site:
+ *
+ * - only RFC 9110 `token` characters, so a name can never smuggle a separator,
+ *   whitespace, or CR/LF into the request line;
+ * - never a hop-by-hop, framing, routing, or ambient-credential header, because
+ *   those either belong to the transport or would let a pasted config redirect
+ *   the request or attach a browser cookie;
+ * - values must stay printable single-line, which blocks header/response
+ *   splitting through a value that carries `\r\n`.
+ *
+ * `Authorization` is deliberately allowed: it is the header the bearer-key path
+ * uses, and its value is stored as a Paperclip secret like every other one.
+ */
+/** RFC 9110 field-name = token. */
+const HTTP_TOKEN_PATTERN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const MAX_HEADER_NAME_LENGTH = 128;
+const MAX_HEADER_VALUE_LENGTH = 8_192;
+/**
+ * Headers Paperclip refuses to project from a user-supplied config.
+ *
+ * `connection`/`keep-alive`/`te`/`trailer`/`transfer-encoding`/`upgrade` are
+ * hop-by-hop (RFC 9110 §7.6.1) and belong to the fetch implementation.
+ * `content-length`/`host` frame and route the request. `cookie` would attach
+ * ambient browser-style credentials that Paperclip cannot scope or rotate.
+ * `proxy-*` targets an intermediary rather than the MCP server.
+ */
+const FORBIDDEN_HEADER_NAMES = new Set([
+    "connection",
+    "content-length",
+    "cookie",
+    "cookie2",
+    "expect",
+    "host",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "proxy-connection",
+    "set-cookie",
+    "set-cookie2",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "via",
+]);
+/** Prefixes reserved for the transport or for intermediaries. */
+const FORBIDDEN_HEADER_PREFIXES = ["proxy-", "sec-", "http2-"];
+const OK = { ok: true };
+/**
+ * Is `name` a header Paperclip is willing to send on a user-configured remote
+ * MCP request? Returns the specific rejection reason so callers can produce an
+ * actionable, UI-safe message.
+ */
+export function checkMcpRemoteHeaderName(name) {
+    const trimmed = name.trim();
+    if (!trimmed)
+        return { ok: false, reason: "empty" };
+    if (trimmed.length > MAX_HEADER_NAME_LENGTH)
+        return { ok: false, reason: "too_long" };
+    if (!HTTP_TOKEN_PATTERN.test(trimmed))
+        return { ok: false, reason: "invalid_characters" };
+    const lower = trimmed.toLowerCase();
+    if (FORBIDDEN_HEADER_NAMES.has(lower))
+        return { ok: false, reason: "forbidden" };
+    if (FORBIDDEN_HEADER_PREFIXES.some((prefix) => lower.startsWith(prefix))) {
+        return { ok: false, reason: "forbidden" };
+    }
+    return OK;
+}
+/**
+ * Is `value` safe to send as a header value? Rejects CR/LF and other control
+ * characters (header splitting) and absurdly long values.
+ */
+export function checkMcpRemoteHeaderValue(value) {
+    if (value.length > MAX_HEADER_VALUE_LENGTH)
+        return { ok: false, reason: "value_too_long" };
+    // Reject C0/C1 controls and DEL. A tab is legal in a field value per RFC 9110
+    // but has no legitimate use in a credential, so it is rejected too.
+    if (/[\u0000-\u001f\u007f-\u009f]/.test(value)) {
+        return { ok: false, reason: "value_control_characters" };
+    }
+    return OK;
+}
+export function isSafeMcpRemoteHeaderName(name) {
+    return checkMcpRemoteHeaderName(name).ok;
+}
+export function isSafeMcpRemoteHeaderValue(value) {
+    return checkMcpRemoteHeaderValue(value).ok;
+}
+/** A UI-safe explanation for a rejected header. Never echoes the value. */
+export function mcpRemoteHeaderRejectionMessage(headerName, reason) {
+    switch (reason) {
+        case "empty":
+            return "Header names cannot be blank.";
+        case "too_long":
+            return `Header name "${headerName.slice(0, MAX_HEADER_NAME_LENGTH)}" is too long.`;
+        case "invalid_characters":
+            return `"${headerName.slice(0, MAX_HEADER_NAME_LENGTH)}" is not a valid header name. Use letters, digits, and dashes.`;
+        case "forbidden":
+            return `Paperclip manages the "${headerName}" header and cannot send a custom value for it.`;
+        case "value_too_long":
+            return `The value for "${headerName}" is too long.`;
+        case "value_control_characters":
+            return `The value for "${headerName}" contains line breaks or control characters.`;
+    }
+}
+/**
+ * `credentialValues` keys use a `headers.<Name>` config path. Extract the header
+ * name, or `null` when the path is not a header path.
+ */
+export function mcpRemoteHeaderNameFromConfigPath(configPath) {
+    if (!configPath.startsWith("headers."))
+        return null;
+    const name = configPath.slice("headers.".length).trim();
+    return name.length > 0 ? name : null;
+}
+export const MCP_REMOTE_HEADER_LIMITS = {
+    maxNameLength: MAX_HEADER_NAME_LENGTH,
+    maxValueLength: MAX_HEADER_VALUE_LENGTH,
+};
+//# sourceMappingURL=mcp-remote-headers.js.map

package/dist/mcp-remote-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-remote-headers.js","sourceRoot":"","sources":["../src/mcp-remote-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,mCAAmC;AACnC,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAE5D,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,YAAY;IACZ,gBAAgB;IAChB,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,kBAAkB;IAClB,YAAY;IACZ,aAAa;IACb,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,KAAK;CACN,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,yBAAyB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AAe/D,MAAM,EAAE,GAAyB,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACpD,IAAI,OAAO,CAAC,MAAM,GAAG,sBAAsB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACtF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1F,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjF,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3F,8EAA8E;IAC9E,oEAAoE;IACpE,IAAI,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,+BAA+B,CAC7C,UAAkB,EAClB,MAAgC;IAEhC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO,+BAA+B,CAAC;QACzC,KAAK,UAAU;YACb,OAAO,gBAAgB,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,gBAAgB,CAAC;QACrF,KAAK,oBAAoB;YACvB,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,gEAAgE,CAAC;QACzH,KAAK,WAAW;YACd,OAAO,0BAA0B,UAAU,iDAAiD,CAAC;QAC/F,KAAK,gBAAgB;YACnB,OAAO,kBAAkB,UAAU,gBAAgB,CAAC;QACtD,KAAK,0BAA0B;YAC7B,OAAO,kBAAkB,UAAU,+CAA+C,CAAC;IACvF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAAC,UAAkB;IAClE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,aAAa,EAAE,sBAAsB;IACrC,cAAc,EAAE,uBAAuB;CAC/B,CAAC"}

package/dist/mcp-remote-headers.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mcp-remote-headers.test.d.ts.map

package/dist/mcp-remote-headers.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-remote-headers.test.d.ts","sourceRoot":"","sources":["../src/mcp-remote-headers.test.ts"],"names":[],"mappings":""}

package/dist/mcp-remote-headers.test.js

@@ -0,0 +1,112 @@
+import { describe, expect, it } from "vitest";
+import { checkMcpRemoteHeaderName, checkMcpRemoteHeaderValue, mcpRemoteHeaderNameFromConfigPath, mcpRemoteHeaderRejectionMessage, } from "./mcp-remote-headers.js";
+describe("checkMcpRemoteHeaderName", () => {
+    it("accepts the header names real MCP servers ask for", () => {
+        for (const name of [
+            "Authorization",
+            "authorization",
+            "X-PostHog-Project-Id",
+            "x-api-key",
+            "Mcp-Session-Id",
+            "X_Custom.Token",
+        ]) {
+            expect(checkMcpRemoteHeaderName(name), name).toEqual({ ok: true });
+        }
+    });
+    it("rejects hop-by-hop, framing, routing and ambient-credential headers", () => {
+        for (const name of [
+            "Host",
+            "host",
+            "Connection",
+            "Content-Length",
+            "Transfer-Encoding",
+            "TE",
+            "Trailer",
+            "Upgrade",
+            "Keep-Alive",
+            "Cookie",
+            "Set-Cookie",
+            "Proxy-Authorization",
+            "Via",
+            "Expect",
+        ]) {
+            expect(checkMcpRemoteHeaderName(name), name).toEqual({ ok: false, reason: "forbidden" });
+        }
+    });
+    it("rejects reserved prefixes browsers and proxies own", () => {
+        for (const name of ["Sec-Fetch-Mode", "sec-websocket-key", "Proxy-Foo", "HTTP2-Settings"]) {
+            expect(checkMcpRemoteHeaderName(name), name).toEqual({ ok: false, reason: "forbidden" });
+        }
+    });
+    it("rejects names that could smuggle a separator or a new header line", () => {
+        for (const name of [
+            "X-Bad\r\nX-Injected",
+            "X-Bad\nX-Injected",
+            "X Bad",
+            "X-Bad:",
+            "X-Bad;Other",
+            "X-Bad,Other",
+            'X-"Bad"',
+            "X-Bad/Other",
+            "X-Bad(Other)",
+            "X-Bad@Other",
+            "X-Bad\u0000",
+        ]) {
+            expect(checkMcpRemoteHeaderName(name), JSON.stringify(name)).toEqual({
+                ok: false,
+                reason: "invalid_characters",
+            });
+        }
+    });
+    it("rejects blank and over-long names", () => {
+        expect(checkMcpRemoteHeaderName("")).toEqual({ ok: false, reason: "empty" });
+        expect(checkMcpRemoteHeaderName("   ")).toEqual({ ok: false, reason: "empty" });
+        expect(checkMcpRemoteHeaderName("x".repeat(129))).toEqual({ ok: false, reason: "too_long" });
+        expect(checkMcpRemoteHeaderName("x".repeat(128))).toEqual({ ok: true });
+    });
+});
+describe("checkMcpRemoteHeaderValue", () => {
+    it("accepts ordinary credential values", () => {
+        for (const value of ["Bearer phx_abc123", "phx_abc123", "12345", "a b c", ""]) {
+            expect(checkMcpRemoteHeaderValue(value), JSON.stringify(value)).toEqual({ ok: true });
+        }
+    });
+    it("rejects values that would split the request", () => {
+        for (const value of [
+            "abc\r\nX-Injected: 1",
+            "abc\nX-Injected: 1",
+            "abc\rdef",
+            "abc\u0000def",
+            "abc\tdef",
+            "abc\u007fdef",
+        ]) {
+            expect(checkMcpRemoteHeaderValue(value), JSON.stringify(value)).toEqual({
+                ok: false,
+                reason: "value_control_characters",
+            });
+        }
+    });
+    it("rejects over-long values", () => {
+        expect(checkMcpRemoteHeaderValue("x".repeat(8_193))).toEqual({ ok: false, reason: "value_too_long" });
+        expect(checkMcpRemoteHeaderValue("x".repeat(8_192))).toEqual({ ok: true });
+    });
+});
+describe("mcpRemoteHeaderNameFromConfigPath", () => {
+    it("extracts a header name from a headers.* config path", () => {
+        expect(mcpRemoteHeaderNameFromConfigPath("headers.X-Api-Key")).toBe("X-Api-Key");
+        expect(mcpRemoteHeaderNameFromConfigPath("headers.  X-Api-Key  ")).toBe("X-Api-Key");
+    });
+    it("returns null for non-header and empty paths", () => {
+        expect(mcpRemoteHeaderNameFromConfigPath("credentials.authorization")).toBeNull();
+        expect(mcpRemoteHeaderNameFromConfigPath("headers.")).toBeNull();
+        expect(mcpRemoteHeaderNameFromConfigPath("headers.   ")).toBeNull();
+    });
+});
+describe("mcpRemoteHeaderRejectionMessage", () => {
+    it("explains the problem without echoing the value", () => {
+        expect(mcpRemoteHeaderRejectionMessage("Host", "forbidden")).toContain("Host");
+        expect(mcpRemoteHeaderRejectionMessage("X-Api-Key", "value_control_characters"))
+            .toBe('The value for "X-Api-Key" contains line breaks or control characters.');
+    });
+});
+//# sourceMappingURL=mcp-remote-headers.test.js.map

package/dist/mcp-remote-headers.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-remote-headers.test.js","sourceRoot":"","sources":["../src/mcp-remote-headers.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AAEjC,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,KAAK,MAAM,IAAI,IAAI;YACjB,eAAe;YACf,eAAe;YACf,sBAAsB;YACtB,WAAW;YACX,gBAAgB;YAChB,gBAAgB;SACjB,EAAE,CAAC;YACF,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,KAAK,MAAM,IAAI,IAAI;YACjB,MAAM;YACN,MAAM;YACN,YAAY;YACZ,gBAAgB;YAChB,mBAAmB;YACnB,IAAI;YACJ,SAAS;YACT,SAAS;YACT,YAAY;YACZ,QAAQ;YACR,YAAY;YACZ,qBAAqB;YACrB,KAAK;YACL,QAAQ;SACT,EAAE,CAAC;YACF,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAC1F,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,KAAK,MAAM,IAAI,IAAI;YACjB,qBAAqB;YACrB,mBAAmB;YACnB,OAAO;YACP,QAAQ;YACR,aAAa;YACb,aAAa;YACb,SAAS;YACT,aAAa;YACb,cAAc;YACd,aAAa;YACb,aAAa;SACd,EAAE,CAAC;YACF,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;gBACnE,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,oBAAoB;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,KAAK,MAAM,KAAK,IAAI,CAAC,mBAAmB,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;YAC9E,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,KAAK,MAAM,KAAK,IAAI;YAClB,sBAAsB;YACtB,oBAAoB;YACpB,UAAU;YACV,cAAc;YACd,UAAU;YACV,cAAc;SACf,EAAE,CAAC;YACF,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;gBACtE,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,0BAA0B;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACtG,MAAM,CAAC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,iCAAiC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjF,MAAM,CAAC,iCAAiC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,iCAAiC,CAAC,2BAA2B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClF,MAAM,CAAC,iCAAiC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjE,MAAM,CAAC,iCAAiC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,+BAA+B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/E,MAAM,CAAC,+BAA+B,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;aAC7E,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/network-bind.d.ts

@@ -0,0 +1,27 @@
+import type { BindMode, DeploymentExposure, DeploymentMode } from "./constants.js";
+export declare const LOOPBACK_BIND_HOST = "127.0.0.1";
+export declare const ALL_INTERFACES_BIND_HOST = "0.0.0.0";
+export declare function isLoopbackHost(host: string | null | undefined): boolean;
+export declare function isAllInterfacesHost(host: string | null | undefined): boolean;
+export declare function inferBindModeFromHost(host: string | null | undefined, opts?: {
+    tailnetBindHost?: string | null | undefined;
+}): BindMode;
+export declare function validateConfiguredBindMode(input: {
+    deploymentMode: DeploymentMode;
+    deploymentExposure: DeploymentExposure;
+    bind?: BindMode | null | undefined;
+    host?: string | null | undefined;
+    customBindHost?: string | null | undefined;
+}): string[];
+export declare function resolveRuntimeBind(input: {
+    bind?: BindMode | null | undefined;
+    host?: string | null | undefined;
+    customBindHost?: string | null | undefined;
+    tailnetBindHost?: string | null | undefined;
+}): {
+    bind: BindMode;
+    host: string;
+    customBindHost?: string;
+    errors: string[];
+};
+//# sourceMappingURL=network-bind.d.ts.map

package/dist/network-bind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-bind.d.ts","sourceRoot":"","sources":["../src/network-bind.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEnF,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAC9C,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAOlD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGvE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAG5E;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,GACrD,QAAQ,CAQV;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC5C,GAAG,MAAM,EAAE,CAqBX;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC3C,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC7C,GAAG;IACF,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAgCA"}