@winstonsayno/mcp-gateway 1.1.0 → 1.3.0

package/dist/auth/oauth.js

@@ -0,0 +1,342 @@
+/**
+ * OAuth 2.1 resource-server support, following the MCP authorization spec
+ * (2025-06-18): the gateway is an OAuth *protected resource*.
+ *
+ *  - `GET /.well-known/oauth-protected-resource[/<mcp path>]` serves RFC 9728
+ *    Protected Resource Metadata (resource, authorization_servers,
+ *    scopes_supported, bearer_methods_supported).
+ *  - Bearer access tokens are validated either as JWTs against the
+ *    authorization server's JWKS (configured `jwksUrl`, or the `jwks_uri`
+ *    discovered from RFC 8414 / OpenID metadata of the issuer) or through
+ *    RFC 7662 token introspection (opaque tokens). Introspection results are
+ *    cached until the token expires (at most `cacheSeconds`).
+ *  - The token must be issued for this resource (`aud` contains the resource
+ *    URI, RFC 8707) and by one of the configured authorization servers.
+ *  - Failures answer with RFC 6750 `WWW-Authenticate` challenges that point
+ *    clients at the metadata document: `401` + `error="invalid_token"` for a
+ *    missing / invalid token, `403` + `error="insufficient_scope"` when
+ *    `requiredScopes` are missing.
+ *
+ * @module auth/oauth
+ */
+import { createHash } from 'crypto';
+import { createRemoteJWKSet, decodeJwt, jwtVerify } from 'jose';
+import { logger } from '../utils/logger.js';
+import { scopeFromJwt } from './scopes.js';
+import { ASYMMETRIC_ALGORITHMS } from './middleware.js';
+export const PROTECTED_RESOURCE_METADATA_PATH = '/.well-known/oauth-protected-resource';
+export class TokenError extends Error {
+    code;
+    constructor(message, code = 'invalid_token') {
+        super(message);
+        this.code = code;
+    }
+}
+const asList = (v) => v === undefined ? undefined : Array.isArray(v) ? v : [v];
+function assertSecureUrl(raw, field) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`${field} is not a valid URL: ${raw}`);
+    }
+    const local = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && local)) {
+        throw new Error(`${field} must use https:// (http:// is only allowed for localhost)`);
+    }
+    return url;
+}
+/** RFC 8414 §3 well-known URLs for an issuer (path-inserted form first, then OpenID Connect). */
+export function metadataUrls(issuer) {
+    const u = new URL(issuer);
+    const path = u.pathname.replace(/\/$/, '');
+    const origin = u.origin;
+    const urls = [`${origin}/.well-known/oauth-authorization-server${path}`];
+    urls.push(path ? `${origin}${path}/.well-known/openid-configuration` : `${origin}/.well-known/openid-configuration`);
+    if (path)
+        urls.push(`${origin}/.well-known/openid-configuration${path}`);
+    return urls;
+}
+/** Space-separated `scope` claim (or `scp` array) of a token. */
+export function tokenScopes(claims) {
+    const s = claims.scope ?? claims.scp;
+    if (typeof s === 'string')
+        return s.split(/\s+/).filter(Boolean);
+    if (Array.isArray(s))
+        return s.filter((x) => typeof x === 'string');
+    return [];
+}
+/** Escape a value for a quoted-string in a WWW-Authenticate header. */
+const quote = (v) => `"${v.replace(/["\\]/g, '\\$&')}"`;
+/** Validates bearer tokens for one protected resource. */
+export class OAuthVerifier {
+    config;
+    jwks;
+    jwksPromise;
+    introspectionCache = new Map();
+    fetchImpl;
+    now;
+    constructor(config, options = {}) {
+        this.config = config;
+        if (!config.authorizationServers?.length)
+            throw new Error('auth.oauth.authorizationServers must list at least one issuer');
+        for (const as of config.authorizationServers)
+            assertSecureUrl(as, 'auth.oauth.authorizationServers');
+        if (config.jwksUrl)
+            assertSecureUrl(config.jwksUrl, 'auth.oauth.jwksUrl');
+        if (config.introspection)
+            assertSecureUrl(config.introspection.url, 'auth.oauth.introspection.url');
+        if (config.resource)
+            assertSecureUrl(config.resource, 'auth.oauth.resource');
+        const bad = (config.algorithms ?? []).filter((a) => !ASYMMETRIC_ALGORITHMS.includes(a));
+        if (bad.length)
+            throw new Error(`auth.oauth.algorithms: ${bad.join(', ')} not allowed (asymmetric algorithms only)`);
+        this.fetchImpl = options.fetch ?? fetch;
+        this.now = options.now ?? Date.now;
+        if (config.jwksUrl)
+            this.jwks = this.remoteJwks(new URL(config.jwksUrl));
+    }
+    remoteJwks(url) {
+        return createRemoteJWKSet(url, {
+            cacheMaxAge: (this.config.jwksCacheSeconds ?? 600) * 1000,
+            cooldownDuration: 30_000,
+            timeoutDuration: 5_000,
+        });
+    }
+    /** Issuers whose tokens are accepted. */
+    issuers() {
+        return asList(this.config.issuer) ?? this.config.authorizationServers;
+    }
+    /** Discover `jwks_uri` from the first authorization server's metadata (cached). */
+    async discoverJwks() {
+        if (this.jwks)
+            return this.jwks;
+        this.jwksPromise ??= (async () => {
+            for (const issuer of this.config.authorizationServers) {
+                for (const url of metadataUrls(issuer)) {
+                    try {
+                        const r = await this.fetchImpl(url, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(5_000) });
+                        if (!r.ok)
+                            continue;
+                        const meta = (await r.json());
+                        if (typeof meta.jwks_uri === 'string') {
+                            this.jwks = this.remoteJwks(assertSecureUrl(meta.jwks_uri, 'jwks_uri'));
+                            return this.jwks;
+                        }
+                    }
+                    catch (err) {
+                        logger.debug(`OAuth metadata discovery failed for ${url}: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                }
+            }
+            return undefined;
+        })().finally(() => {
+            if (!this.jwks)
+                this.jwksPromise = undefined; // retry discovery next time
+        });
+        return this.jwksPromise;
+    }
+    /** Validate a bearer token for `resource`. Throws `TokenError`. */
+    async verify(token, resource) {
+        const isJwt = token.split('.').length === 3;
+        let info;
+        if (isJwt && !this.config.introspection?.preferForJwt) {
+            const jwks = await this.discoverJwks();
+            if (jwks)
+                info = await this.verifyJwt(token, jwks, resource);
+            else if (this.config.introspection)
+                info = await this.introspect(token, resource);
+            else
+                throw new TokenError('no JWKS available to validate the token');
+        }
+        else if (this.config.introspection) {
+            info = await this.introspect(token, resource);
+        }
+        else {
+            throw new TokenError('opaque tokens require auth.oauth.introspection');
+        }
+        const required = this.config.requiredScopes ?? [];
+        const missing = required.filter((s) => !info.scopes.includes(s));
+        if (missing.length)
+            throw new TokenError(`missing scope(s): ${missing.join(' ')}`, 'insufficient_scope');
+        return info;
+    }
+    audiences(resource) {
+        return asList(this.config.audience) ?? [resource];
+    }
+    async verifyJwt(token, jwks, resource) {
+        let payload;
+        try {
+            ({ payload } = await jwtVerify(token, jwks, {
+                algorithms: this.config.algorithms ?? ASYMMETRIC_ALGORITHMS,
+                issuer: this.issuers(),
+                audience: this.audiences(resource),
+                clockTolerance: this.config.clockToleranceSeconds ?? 0,
+                requiredClaims: ['exp'],
+            }));
+        }
+        catch (err) {
+            throw new TokenError(err instanceof Error ? err.message : String(err));
+        }
+        const claims = payload;
+        return {
+            subject: payload.sub,
+            clientId: typeof claims.client_id === 'string' ? claims.client_id : typeof claims.azp === 'string' ? claims.azp : undefined,
+            scopes: tokenScopes(claims),
+            claims,
+            exp: payload.exp,
+        };
+    }
+    async introspect(token, resource) {
+        const ic = this.config.introspection;
+        const cacheKey = createHash('sha256').update(token).digest('hex');
+        const t = this.now();
+        const hit = this.introspectionCache.get(cacheKey);
+        if (hit && hit.until > t)
+            return hit.info;
+        if (hit)
+            this.introspectionCache.delete(cacheKey);
+        const headers = {
+            'content-type': 'application/x-www-form-urlencoded',
+            accept: 'application/json',
+        };
+        if (ic.clientId) {
+            const basic = Buffer.from(`${encodeURIComponent(ic.clientId)}:${encodeURIComponent(ic.clientSecret ?? '')}`).toString('base64');
+            headers.authorization = `Basic ${basic}`;
+        }
+        let body;
+        try {
+            const r = await this.fetchImpl(ic.url, {
+                method: 'POST',
+                headers,
+                body: new URLSearchParams({ token, token_type_hint: 'access_token' }).toString(),
+                signal: AbortSignal.timeout(5_000),
+            });
+            if (!r.ok)
+                throw new Error(`introspection endpoint answered ${r.status}`);
+            body = (await r.json());
+        }
+        catch (err) {
+            logger.warn(`OAuth token introspection failed: ${err instanceof Error ? err.message : String(err)}`);
+            throw new TokenError('token introspection failed');
+        }
+        if (body.active !== true)
+            throw new TokenError('token is not active');
+        const exp = typeof body.exp === 'number' ? body.exp : undefined;
+        if (exp !== undefined && exp * 1000 <= t)
+            throw new TokenError('token expired');
+        if (typeof body.iss === 'string' && !this.issuers().includes(body.iss))
+            throw new TokenError('unexpected issuer');
+        const aud = asList(body.aud);
+        if (aud && !aud.some((a) => this.audiences(resource).includes(a))) {
+            throw new TokenError('token was not issued for this resource');
+        }
+        if (!aud && ic.requireAudience !== false)
+            throw new TokenError('token has no audience');
+        const info = {
+            subject: typeof body.sub === 'string' ? body.sub : undefined,
+            clientId: typeof body.client_id === 'string' ? body.client_id : undefined,
+            scopes: tokenScopes(body),
+            claims: body,
+            exp,
+        };
+        const maxMs = (ic.cacheSeconds ?? 60) * 1000;
+        const until = Math.min(t + maxMs, exp !== undefined ? exp * 1000 : Infinity);
+        if (maxMs > 0) {
+            if (this.introspectionCache.size > 10_000)
+                this.introspectionCache.clear();
+            this.introspectionCache.set(cacheKey, { info, until });
+        }
+        return info;
+    }
+}
+/** Public base URL of the request (scheme + host), honouring "trust proxy". */
+export function requestOrigin(req) {
+    return `${req.protocol}://${req.get('host') ?? 'localhost'}`;
+}
+/** Canonical resource URI of the MCP endpoint (RFC 8707). */
+export function resourceUri(config, req, mcpPath) {
+    return config.resource ?? `${requestOrigin(req)}${mcpPath}`;
+}
+/** URL of the protected-resource metadata document for this resource. */
+export function metadataUrl(config, req, mcpPath) {
+    const resource = new URL(resourceUri(config, req, mcpPath));
+    const path = resource.pathname.replace(/\/$/, '');
+    return `${resource.origin}${PROTECTED_RESOURCE_METADATA_PATH}${path}`;
+}
+/** RFC 9728 metadata document. */
+export function protectedResourceMetadata(config, req, mcpPath) {
+    const doc = {
+        resource: resourceUri(config, req, mcpPath),
+        authorization_servers: config.authorizationServers,
+        bearer_methods_supported: ['header'],
+        resource_name: config.resourceName ?? 'mcp-gateway',
+    };
+    if (config.scopesSupported?.length)
+        doc.scopes_supported = config.scopesSupported;
+    if (config.documentation)
+        doc.resource_documentation = config.documentation;
+    const algs = config.algorithms ?? ASYMMETRIC_ALGORITHMS;
+    doc.resource_signing_alg_values_supported = algs;
+    return doc;
+}
+/** `WWW-Authenticate` value for a failed request. */
+export function bearerChallenge(config, req, mcpPath, err) {
+    const parts = [`resource_metadata=${quote(metadataUrl(config, req, mcpPath))}`];
+    if (err) {
+        parts.push(`error=${quote(err.code)}`);
+        parts.push(`error_description=${quote(err.message.replace(/[^\x20-\x7e]/g, ''))}`);
+    }
+    const scopes = config.requiredScopes?.length ? config.requiredScopes : undefined;
+    if (scopes)
+        parts.push(`scope=${quote(scopes.join(' '))}`);
+    return `Bearer ${parts.join(', ')}`;
+}
+/** Express middleware for `auth.strategy: oauth2`. */
+export function oauthMiddleware(config, options) {
+    const verifier = new OAuthVerifier(config, options);
+    const mw = ((req, res, next) => {
+        const path = options.mcpPath();
+        const header = req.headers.authorization;
+        if (!header || !/^Bearer /i.test(header)) {
+            res.set('WWW-Authenticate', bearerChallenge(config, req, path));
+            res.status(401).json({ error: 'Unauthorized', message: 'Bearer access token required' });
+            return;
+        }
+        const token = header.slice(7).trim();
+        verifier.verify(token, resourceUri(config, req, path)).then((info) => {
+            const r = req;
+            r.jwtPayload = info.claims;
+            r.oauth = info;
+            r.clientId = `oauth:${info.subject ?? info.clientId ?? 'unknown'}`;
+            const scope = scopeFromJwt(info.claims);
+            if (scope)
+                r.scope = scope;
+            next();
+        }, (err) => {
+            const te = err instanceof TokenError ? err : new TokenError('invalid token');
+            logger.warn(`OAuth token rejected from ${req.ip}: ${te.message}`);
+            if (res.headersSent)
+                return;
+            res.set('WWW-Authenticate', bearerChallenge(config, req, path, te));
+            const forbidden = te.code === 'insufficient_scope';
+            res.status(forbidden ? 403 : 401).json({
+                error: forbidden ? 'Forbidden' : 'Unauthorized',
+                message: forbidden ? 'Insufficient scope' : 'Invalid or expired access token',
+            });
+        });
+    });
+    mw.verifier = verifier;
+    return mw;
+}
+/** Decode a JWT's claims without verifying it (diagnostics only). */
+export function peekClaims(token) {
+    try {
+        return decodeJwt(token);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,SAAS,EAAyC,MAAM,MAAM,CAAC;AAEvG,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,CAAC,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAWxF,MAAM,OAAO,UAAW,SAAQ,KAAK;IAGxB;IAFX,YACE,OAAe,EACN,OAA+C,eAAe;QAEvE,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,SAAI,GAAJ,IAAI,CAA0D;IAGzE,CAAC;CACF;AAED,MAAM,MAAM,GAAG,CAAC,CAAgC,EAAwB,EAAE,CACxE,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3D,SAAS,eAAe,CAAC,GAAW,EAAE,KAAa;IACjD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4DAA4D,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,mCAAmC,CAAC,CAAC,CAAC,GAAG,MAAM,mCAAmC,CAAC,CAAC;IACrH,IAAI,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,oCAAoC,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,MAA+B;IACzD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC;IACrC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACjF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,uEAAuE;AACvE,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;AAOhE,0DAA0D;AAC1D,MAAM,OAAO,aAAa;IAQb;IAPH,IAAI,CAAmB;IACvB,WAAW,CAAwC;IAC1C,kBAAkB,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC3E,SAAS,CAAe;IACxB,GAAG,CAAe;IAEnC,YACW,MAAmB,EAC5B,UAAgC,EAAE;QADzB,WAAM,GAAN,MAAM,CAAa;QAG5B,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC3H,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,oBAAoB;YAAE,eAAe,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAC;QACrG,IAAI,MAAM,CAAC,OAAO;YAAE,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,aAAa;YAAE,eAAe,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;QACpG,IAAI,MAAM,CAAC,QAAQ;YAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACrH,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,MAAM,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;IAEO,UAAU,CAAC,GAAQ;QACzB,OAAO,kBAAkB,CAAC,GAAG,EAAE;YAC7B,WAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC,GAAG,IAAI;YACzD,gBAAgB,EAAE,MAAM;YACxB,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;IACL,CAAC;IAED,yCAAyC;IACzC,OAAO;QACL,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;IACxE,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAChC,IAAI,CAAC,WAAW,KAAK,CAAC,KAAK,IAAI,EAAE;YAC/B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBACtD,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,IAAI,CAAC;wBACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;wBACrH,IAAI,CAAC,CAAC,CAAC,EAAE;4BAAE,SAAS;wBACpB,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAA2B,CAAC;wBACxD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;4BACxE,OAAO,IAAI,CAAC,IAAI,CAAC;wBACnB,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,KAAK,CAAC,uCAAuC,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAClH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC,4BAA4B;QAC5E,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAgB;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAC5C,IAAI,IAAe,CAAC;QACpB,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,IAAI,IAAI;gBAAE,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;iBACxD,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa;gBAAE,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;;gBAC7E,MAAM,IAAI,UAAU,CAAC,yCAAyC,CAAC,CAAC;QACvE,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YACrC,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,UAAU,CAAC,gDAAgD,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACzG,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,SAAS,CAAC,QAAgB;QAChC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,IAAqB,EAAE,QAAgB;QAC5E,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC1C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,qBAAqB;gBAC3D,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE;gBACtB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAClC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,CAAC;gBACtD,cAAc,EAAE,CAAC,KAAK,CAAC;aACxB,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,MAAM,GAAG,OAAkC,CAAC;QAClD,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,GAAG;YACpB,QAAQ,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;YAC3H,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;YAC3B,MAAM;YACN,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB;QACtD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,aAAc,CAAC;QACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAC1C,IAAI,GAAG;YAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChI,OAAO,CAAC,aAAa,GAAG,SAAS,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,QAAQ,EAAE;gBAChF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACnC,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1E,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrG,MAAM,IAAI,UAAU,CAAC,4BAA4B,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,qBAAqB,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;QAChF,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAClH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAoC,CAAC,CAAC;QAC9D,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,UAAU,CAAC,wCAAwC,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,eAAe,KAAK,KAAK;YAAE,MAAM,IAAI,UAAU,CAAC,uBAAuB,CAAC,CAAC;QACxF,MAAM,IAAI,GAAc;YACtB,OAAO,EAAE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;YAC5D,QAAQ,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACzE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC;YACzB,MAAM,EAAE,IAAI;YACZ,GAAG;SACJ,CAAC;QACF,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,MAAM;gBAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAC3E,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,OAAO,GAAG,GAAG,CAAC,QAAQ,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,MAAmB,EAAE,GAAY,EAAE,OAAe;IAC5E,OAAO,MAAM,CAAC,QAAQ,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,WAAW,CAAC,MAAmB,EAAE,GAAY,EAAE,OAAe;IAC5E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,gCAAgC,GAAG,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,yBAAyB,CAAC,MAAmB,EAAE,GAAY,EAAE,OAAe;IAC1F,MAAM,GAAG,GAA4B;QACnC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;QAC3C,qBAAqB,EAAE,MAAM,CAAC,oBAAoB;QAClD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,aAAa,EAAE,MAAM,CAAC,YAAY,IAAI,aAAa;KACpD,CAAC;IACF,IAAI,MAAM,CAAC,eAAe,EAAE,MAAM;QAAE,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC;IAClF,IAAI,MAAM,CAAC,aAAa;QAAE,GAAG,CAAC,sBAAsB,GAAG,MAAM,CAAC,aAAa,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,IAAI,qBAAqB,CAAC;IACxD,GAAG,CAAC,qCAAqC,GAAG,IAAI,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,GAAY,EACZ,OAAe,EACf,GAAgB;IAEhB,MAAM,KAAK,GAAG,CAAC,qBAAqB,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAChF,IAAI,GAAG,EAAE,CAAC;QACR,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3D,OAAO,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACtC,CAAC;AAOD,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAAC,MAAmB,EAAE,OAA+B;IAClF,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CACzD,CAAC,IAAI,EAAE,EAAE;YACP,MAAM,CAAC,GAAG,GAAoB,CAAC;YAC/B,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC;YACf,CAAC,CAAC,QAAQ,GAAG,SAAS,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;YACnE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,KAAK;gBAAE,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC;YAC3B,IAAI,EAAE,CAAC;QACT,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;YACf,MAAM,EAAE,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;YAC7E,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAClE,IAAI,GAAG,CAAC,WAAW;gBAAE,OAAO;YAC5B,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YACpE,MAAM,SAAS,GAAG,EAAE,CAAC,IAAI,KAAK,oBAAoB,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc;gBAC/C,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iCAAiC;aAC9E,CAAC,CAAC;QACL,CAAC,CACF,CAAC;IACJ,CAAC,CAAiD,CAAC;IACnD,EAAE,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACvB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,CAA4B,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/cli.js

@@ -11,6 +11,9 @@ import { ConfigWatcher } from './config/watcher.js';
 import { Gateway } from './gateway/index.js';
 import { logger } from './utils/logger.js';
 import { VERSION } from './utils/version.js';
+import { randomBytes } from 'crypto';
+import { hashApiKey } from './auth/middleware.js';
+import { securityWarnings } from './security/posture.js';
 const LOG_LEVELS = ['debug', 'info', 'warn', 'error'];
 const program = new Command();
 program
@@ -107,8 +110,9 @@ program
 // ─── validate ─────────────────────────────────────────────────────────────────
 program
     .command('validate')
-    .description('Validate a configuration file')
+    .description('Validate a configuration file and report security warnings')
     .option('-c, --config <path>', 'Path to config file')
+    .option('--strict', 'Exit with code 2 when there are security warnings')
     .action(async (options) => {
     try {
         const config = await loadConfig(options.config);
@@ -116,12 +120,61 @@ program
         console.log(`  Port: ${config.port}`);
         console.log(`  Servers: ${config.servers.length}`);
         console.log(`  Auth: ${config.auth?.strategy ?? 'none'}`);
+        const warnings = securityWarnings(config);
+        if (warnings.length > 0) {
+            console.log('\nSecurity:');
+            for (const w of warnings)
+                console.log(`  ${w.level === 'warn' ? '!' : '-'} ${w.message}`);
+            if (options.strict && warnings.some((w) => w.level === 'warn'))
+                process.exit(2);
+        }
     }
     catch (err) {
         logger.error(`Invalid configuration: ${err instanceof Error ? err.message : String(err)}`);
         process.exit(1);
     }
 });
+// ─── keys ─────────────────────────────────────────────────────────────────────
+async function readStdin() {
+    const chunks = [];
+    for await (const c of process.stdin)
+        chunks.push(c);
+    return Buffer.concat(chunks).toString('utf8').replace(/\r?\n$/, '');
+}
+program
+    .command('hash-key')
+    .description('Print the sha256:<hex> digest of an API key, for auth.apiKeys (reads stdin when no key is given)')
+    .argument('[key]', 'The key (prefer stdin so it stays out of your shell history)')
+    .action(async (key) => {
+    const value = key ?? (process.stdin.isTTY ? '' : await readStdin());
+    if (!value) {
+        logger.error('No key given. Usage: echo -n "$KEY" | mcp-gateway hash-key');
+        process.exit(1);
+    }
+    console.log(hashApiKey(value));
+});
+program
+    .command('gen-key')
+    .description('Generate a random API key and print it with its sha256 digest')
+    .option('-b, --bytes <n>', 'Random bytes (16-128)', '32')
+    .option('--prefix <prefix>', 'Key prefix (helps secret scanners and redaction)', 'mgw_')
+    .option('--json', 'Print JSON')
+    .action((options) => {
+    const bytes = Number(options.bytes);
+    if (!Number.isInteger(bytes) || bytes < 16 || bytes > 128) {
+        logger.error(`Invalid --bytes "${options.bytes}" (16-128)`);
+        process.exit(1);
+    }
+    const key = `${options.prefix}${randomBytes(bytes).toString('base64url')}`;
+    const hash = hashApiKey(key);
+    if (options.json) {
+        console.log(JSON.stringify({ key, hash }));
+        return;
+    }
+    console.log(`key:  ${key}`);
+    console.log(`hash: ${hash}`);
+    console.log('\nGive the key to the client; put the hash in auth.apiKeys. The key is not shown again.');
+});
 program.parse(process.argv);
 if (!process.argv.slice(2).length) {
     program.outputHelp();

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;GAEG;AAEH,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAE/D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,aAAa,CAAC;KACnB,WAAW,CAAC,yDAAyD,CAAC;KACtE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,iFAAiF;AAEjF,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;KACpD,MAAM,CAAC,qBAAqB,EAAE,2BAA2B,CAAC;KAC1D,MAAM,CAAC,qBAAqB,EAAE,mCAAmC,CAAC;KAClE,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;KACjD,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,OAA4B,CAAC;IACjC,IAAI,OAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEhD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAE,UAAgC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,QAAQ,eAAe,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClG,CAAC;YACD,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACrC,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,GAAG,EAAE,CAAC;QAEb,8DAA8D;QAC9D,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;YAClC,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,sBAAsB,CAAC,CAAC;gBACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,+BAA+B,CAAC,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,CAAC;YAChB,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CACZ,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EACrB,CAAC,GAAY,EAAE,EAAE;gBACf,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CACF,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QAEjB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAChD,OAAO,GAAG,CAAC,CAAC;YACZ,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;gBACtB,8CAA8C;gBAC9C,IAAI,OAAO,CAAC,QAAQ;oBAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;gBACvD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACxD,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACrC,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzF,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,MAAM,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,iFAAiF;AAEjF,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,uCAAuC,CAAC;KACpD,MAAM,CAAC,qBAAqB,EAAE,aAAa,EAAE,iBAAiB,CAAC;KAC/D,MAAM,CAAC,SAAS,EAAE,yBAAyB,CAAC;KAC5C,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,MAAM,6CAA6C,CAAC,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,gCAAgC,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEL,iFAAiF;AAEjF,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,+BAA+B,CAAC;KAC5C,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;KACpD,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,UAAU,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;GAEG;AAEH,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAE/D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,aAAa,CAAC;KACnB,WAAW,CAAC,yDAAyD,CAAC;KACtE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,iFAAiF;AAEjF,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;KACpD,MAAM,CAAC,qBAAqB,EAAE,2BAA2B,CAAC;KAC1D,MAAM,CAAC,qBAAqB,EAAE,mCAAmC,CAAC;KAClE,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;KACjD,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,OAA4B,CAAC;IACjC,IAAI,OAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEhD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAE,UAAgC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,QAAQ,eAAe,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClG,CAAC;YACD,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACrC,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,GAAG,EAAE,CAAC;QAEb,8DAA8D;QAC9D,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;YAClC,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,sBAAsB,CAAC,CAAC;gBACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,YAAY,MAAM,+BAA+B,CAAC,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,CAAC;YAChB,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CACZ,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EACrB,CAAC,GAAY,EAAE,EAAE;gBACf,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CACF,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QAEjB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAChD,OAAO,GAAG,CAAC,CAAC;YACZ,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;gBACtB,8CAA8C;gBAC9C,IAAI,OAAO,CAAC,QAAQ;oBAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;gBACvD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACxD,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACrC,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzF,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,MAAM,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,iFAAiF;AAEjF,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,uCAAuC,CAAC;KACpD,MAAM,CAAC,qBAAqB,EAAE,aAAa,EAAE,iBAAiB,CAAC;KAC/D,MAAM,CAAC,SAAS,EAAE,yBAAyB,CAAC;KAC5C,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,MAAM,6CAA6C,CAAC,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,gCAAgC,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEL,iFAAiF;AAEjF,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,4DAA4D,CAAC;KACzE,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;KACpD,MAAM,CAAC,UAAU,EAAE,mDAAmD,CAAC;KACvE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1F,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,iFAAiF;AAEjF,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,kGAAkG,CAAC;KAC/G,QAAQ,CAAC,OAAO,EAAE,8DAA8D,CAAC;KACjF,MAAM,CAAC,KAAK,EAAE,GAAY,EAAE,EAAE;IAC7B,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,+DAA+D,CAAC;KAC5E,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,IAAI,CAAC;KACxD,MAAM,CAAC,mBAAmB,EAAE,kDAAkD,EAAE,MAAM,CAAC;KACvF,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC;KAC9B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,KAAK,YAAY,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;AACzG,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,UAAU,EAAE,CAAC;AACvB,CAAC"}

package/dist/config/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA2MvD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMzE;AAED,wBAAsB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAsB5E;AAkCD,wBAAgB,qBAAqB,IAAI,MAAM,CAgG9C"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAqUvD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMzE;AAED,wBAAsB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAsB5E;AAkCD,wBAAgB,qBAAqB,IAAI,MAAM,CAiH9C"}