arc-1 0.6.9 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (157) hide show
  1. package/README.md +12 -9
  2. package/bin/arc1-cli.js +10 -0
  3. package/bin/arc1.js +1 -1
  4. package/dist/adt/abapgit.d.ts +39 -0
  5. package/dist/adt/abapgit.d.ts.map +1 -0
  6. package/dist/adt/abapgit.js +333 -0
  7. package/dist/adt/abapgit.js.map +1 -0
  8. package/dist/adt/cds-impact.d.ts +35 -0
  9. package/dist/adt/cds-impact.d.ts.map +1 -1
  10. package/dist/adt/cds-impact.js +71 -0
  11. package/dist/adt/cds-impact.js.map +1 -1
  12. package/dist/adt/client.d.ts +4 -1
  13. package/dist/adt/client.d.ts.map +1 -1
  14. package/dist/adt/client.js +18 -5
  15. package/dist/adt/client.js.map +1 -1
  16. package/dist/adt/config.d.ts +1 -0
  17. package/dist/adt/config.d.ts.map +1 -1
  18. package/dist/adt/config.js +1 -0
  19. package/dist/adt/config.js.map +1 -1
  20. package/dist/adt/crud.d.ts.map +1 -1
  21. package/dist/adt/crud.js +74 -8
  22. package/dist/adt/crud.js.map +1 -1
  23. package/dist/adt/devtools.d.ts +39 -3
  24. package/dist/adt/devtools.d.ts.map +1 -1
  25. package/dist/adt/devtools.js +237 -25
  26. package/dist/adt/devtools.js.map +1 -1
  27. package/dist/adt/diagnostics.d.ts +69 -7
  28. package/dist/adt/diagnostics.d.ts.map +1 -1
  29. package/dist/adt/diagnostics.js +694 -36
  30. package/dist/adt/diagnostics.js.map +1 -1
  31. package/dist/adt/errors.d.ts +36 -2
  32. package/dist/adt/errors.d.ts.map +1 -1
  33. package/dist/adt/errors.js +111 -11
  34. package/dist/adt/errors.js.map +1 -1
  35. package/dist/adt/features.d.ts.map +1 -1
  36. package/dist/adt/features.js +3 -0
  37. package/dist/adt/features.js.map +1 -1
  38. package/dist/adt/gcts.d.ts +68 -0
  39. package/dist/adt/gcts.d.ts.map +1 -0
  40. package/dist/adt/gcts.js +239 -0
  41. package/dist/adt/gcts.js.map +1 -0
  42. package/dist/adt/http.d.ts.map +1 -1
  43. package/dist/adt/http.js +86 -1
  44. package/dist/adt/http.js.map +1 -1
  45. package/dist/adt/rap-handlers.d.ts +165 -0
  46. package/dist/adt/rap-handlers.d.ts.map +1 -0
  47. package/dist/adt/rap-handlers.js +835 -0
  48. package/dist/adt/rap-handlers.js.map +1 -0
  49. package/dist/adt/rap-preflight.d.ts +43 -0
  50. package/dist/adt/rap-preflight.d.ts.map +1 -0
  51. package/dist/adt/rap-preflight.js +405 -0
  52. package/dist/adt/rap-preflight.js.map +1 -0
  53. package/dist/adt/safety.d.ts +60 -33
  54. package/dist/adt/safety.d.ts.map +1 -1
  55. package/dist/adt/safety.js +204 -113
  56. package/dist/adt/safety.js.map +1 -1
  57. package/dist/adt/transport.d.ts +1 -1
  58. package/dist/adt/transport.d.ts.map +1 -1
  59. package/dist/adt/transport.js +6 -3
  60. package/dist/adt/transport.js.map +1 -1
  61. package/dist/adt/types.d.ts +225 -0
  62. package/dist/adt/types.d.ts.map +1 -1
  63. package/dist/adt/xml-parser.d.ts +15 -1
  64. package/dist/adt/xml-parser.d.ts.map +1 -1
  65. package/dist/adt/xml-parser.js +28 -15
  66. package/dist/adt/xml-parser.js.map +1 -1
  67. package/dist/authz/policy.d.ts +53 -0
  68. package/dist/authz/policy.d.ts.map +1 -0
  69. package/dist/authz/policy.js +199 -0
  70. package/dist/authz/policy.js.map +1 -0
  71. package/dist/cli-args.d.ts +14 -0
  72. package/dist/cli-args.d.ts.map +1 -0
  73. package/dist/cli-args.js +62 -0
  74. package/dist/cli-args.js.map +1 -0
  75. package/dist/cli.d.ts +13 -7
  76. package/dist/cli.d.ts.map +1 -1
  77. package/dist/cli.js +252 -55
  78. package/dist/cli.js.map +1 -1
  79. package/dist/extract-sap-cookies.d.ts +24 -0
  80. package/dist/extract-sap-cookies.d.ts.map +1 -0
  81. package/dist/extract-sap-cookies.js +317 -0
  82. package/dist/extract-sap-cookies.js.map +1 -0
  83. package/dist/handlers/hyperfocused.d.ts +4 -3
  84. package/dist/handlers/hyperfocused.d.ts.map +1 -1
  85. package/dist/handlers/hyperfocused.js +25 -16
  86. package/dist/handlers/hyperfocused.js.map +1 -1
  87. package/dist/handlers/intent.d.ts +4 -12
  88. package/dist/handlers/intent.d.ts.map +1 -1
  89. package/dist/handlers/intent.js +1448 -89
  90. package/dist/handlers/intent.js.map +1 -1
  91. package/dist/handlers/schemas.d.ts +83 -11
  92. package/dist/handlers/schemas.d.ts.map +1 -1
  93. package/dist/handlers/schemas.js +115 -4
  94. package/dist/handlers/schemas.js.map +1 -1
  95. package/dist/handlers/tools.d.ts +4 -3
  96. package/dist/handlers/tools.d.ts.map +1 -1
  97. package/dist/handlers/tools.js +342 -143
  98. package/dist/handlers/tools.js.map +1 -1
  99. package/dist/index.d.ts +1 -1
  100. package/dist/index.js +7 -6
  101. package/dist/index.js.map +1 -1
  102. package/dist/probe/catalog.d.ts +30 -0
  103. package/dist/probe/catalog.d.ts.map +1 -0
  104. package/dist/probe/catalog.js +196 -0
  105. package/dist/probe/catalog.js.map +1 -0
  106. package/dist/probe/fixtures.d.ts +54 -0
  107. package/dist/probe/fixtures.d.ts.map +1 -0
  108. package/dist/probe/fixtures.js +94 -0
  109. package/dist/probe/fixtures.js.map +1 -0
  110. package/dist/probe/format.d.ts +10 -0
  111. package/dist/probe/format.d.ts.map +1 -0
  112. package/dist/probe/format.js +114 -0
  113. package/dist/probe/format.js.map +1 -0
  114. package/dist/probe/quality.d.ts +13 -0
  115. package/dist/probe/quality.d.ts.map +1 -0
  116. package/dist/probe/quality.js +50 -0
  117. package/dist/probe/quality.js.map +1 -0
  118. package/dist/probe/runner.d.ts +48 -0
  119. package/dist/probe/runner.d.ts.map +1 -0
  120. package/dist/probe/runner.js +211 -0
  121. package/dist/probe/runner.js.map +1 -0
  122. package/dist/probe/types.d.ts +159 -0
  123. package/dist/probe/types.d.ts.map +1 -0
  124. package/dist/probe/types.js +11 -0
  125. package/dist/probe/types.js.map +1 -0
  126. package/dist/server/audit.d.ts +26 -3
  127. package/dist/server/audit.d.ts.map +1 -1
  128. package/dist/server/audit.js +12 -1
  129. package/dist/server/audit.js.map +1 -1
  130. package/dist/server/config.d.ts +34 -19
  131. package/dist/server/config.d.ts.map +1 -1
  132. package/dist/server/config.js +327 -187
  133. package/dist/server/config.js.map +1 -1
  134. package/dist/server/deny-actions.d.ts +31 -0
  135. package/dist/server/deny-actions.d.ts.map +1 -0
  136. package/dist/server/deny-actions.js +156 -0
  137. package/dist/server/deny-actions.js.map +1 -0
  138. package/dist/server/effective-policy-log.d.ts +27 -0
  139. package/dist/server/effective-policy-log.d.ts.map +1 -0
  140. package/dist/server/effective-policy-log.js +103 -0
  141. package/dist/server/effective-policy-log.js.map +1 -0
  142. package/dist/server/http.d.ts.map +1 -1
  143. package/dist/server/http.js +15 -16
  144. package/dist/server/http.js.map +1 -1
  145. package/dist/server/server.d.ts +38 -4
  146. package/dist/server/server.d.ts.map +1 -1
  147. package/dist/server/server.js +234 -31
  148. package/dist/server/server.js.map +1 -1
  149. package/dist/server/types.d.ts +31 -13
  150. package/dist/server/types.d.ts.map +1 -1
  151. package/dist/server/types.js +11 -10
  152. package/dist/server/types.js.map +1 -1
  153. package/dist/server/xsuaa.d.ts +1 -2
  154. package/dist/server/xsuaa.d.ts.map +1 -1
  155. package/dist/server/xsuaa.js +13 -14
  156. package/dist/server/xsuaa.js.map +1 -1
  157. package/package.json +9 -3
@@ -0,0 +1,11 @@
1
+ /**
2
+ * Types for the ADT type-availability probe.
3
+ *
4
+ * The probe is pure diagnostic tooling — it does not change product behavior.
5
+ * It collects multiple independent signals per ADT object type and reports
6
+ * both the per-type verdict AND the quality-of-probe metrics, so anyone
7
+ * running it against their own system can see not just "is TABL supported"
8
+ * but "how confident should we be in that answer".
9
+ */
10
+ export {};
11
+ //# sourceMappingURL=types.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/probe/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}
@@ -32,7 +32,7 @@ export interface ToolCallEndEvent extends AuditEventBase {
32
32
  errorClass?: string;
33
33
  errorMessage?: string;
34
34
  resultSize?: number;
35
- /** First 500 chars of the response text (for debugging in server logs) */
35
+ /** Sanitized and truncated response preview (for debugging in server logs). */
36
36
  resultPreview?: string;
37
37
  }
38
38
  /** HTTP request to SAP ADT */
@@ -43,6 +43,14 @@ export interface HttpRequestEvent extends AuditEventBase {
43
43
  statusCode: number;
44
44
  durationMs: number;
45
45
  errorBody?: string;
46
+ /** Full request body when ARC1_LOG_HTTP_DEBUG=true. Truncated past 65536 chars. */
47
+ requestBody?: string;
48
+ /** Request headers with sensitive values redacted when ARC1_LOG_HTTP_DEBUG=true. */
49
+ requestHeaders?: Record<string, string>;
50
+ /** Full response body when ARC1_LOG_HTTP_DEBUG=true. Truncated past 65536 chars. */
51
+ responseBody?: string;
52
+ /** Response headers with sensitive values redacted when ARC1_LOG_HTTP_DEBUG=true. */
53
+ responseHeaders?: Record<string, string>;
46
54
  }
47
55
  /** CSRF token fetch */
48
56
  export interface HttpCsrfFetchEvent extends AuditEventBase {
@@ -75,7 +83,7 @@ export interface ServerStartEvent extends AuditEventBase {
75
83
  event: 'server_start';
76
84
  version: string;
77
85
  transport: string;
78
- readOnly: boolean;
86
+ allowWrites: boolean;
79
87
  url: string;
80
88
  pid?: number;
81
89
  }
@@ -92,8 +100,23 @@ export interface ElicitationResponseEvent extends AuditEventBase {
92
100
  tool: string;
93
101
  action: string;
94
102
  }
103
+ /** Two-phase activation preaudit handshake completed.
104
+ *
105
+ * ADT's activation endpoint sometimes responds to `preauditRequested=true` with an
106
+ * <ioc:inactiveObjects> prompt listing related objects that must be included; the client
107
+ * re-POSTs them with `preauditRequested=false` to commit. This event marks that the
108
+ * handshake fired (so audit consumers can correlate the two http_request events as one
109
+ * logical operation) and records its outcome. */
110
+ export interface ActivationPreauditEvent extends AuditEventBase {
111
+ event: 'activation_preaudit_completed';
112
+ objectLabel: string;
113
+ refCount: number;
114
+ phase1DurationMs: number;
115
+ phase2DurationMs: number;
116
+ outcome: 'success' | 'error';
117
+ }
95
118
  /** Discriminated union of all audit events */
96
- export type AuditEvent = ToolCallStartEvent | ToolCallEndEvent | HttpRequestEvent | HttpCsrfFetchEvent | AuthScopeDeniedEvent | AuthPPCreatedEvent | SafetyBlockedEvent | ServerStartEvent | ElicitationSentEvent | ElicitationResponseEvent;
119
+ export type AuditEvent = ToolCallStartEvent | ToolCallEndEvent | HttpRequestEvent | HttpCsrfFetchEvent | AuthScopeDeniedEvent | AuthPPCreatedEvent | SafetyBlockedEvent | ServerStartEvent | ElicitationSentEvent | ElicitationResponseEvent | ActivationPreauditEvent;
97
120
  /** Sanitize tool call arguments — remove values that might contain sensitive data */
98
121
  export declare function sanitizeArgs(args: Record<string, unknown>): Record<string, unknown>;
99
122
  //# sourceMappingURL=audit.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/server/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,QAAQ,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,4BAA4B;AAC5B,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,KAAK,EAAE,iBAAiB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,iDAAiD;AACjD,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,8BAA8B;AAC9B,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,uBAAuB;AACvB,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,KAAK,EAAE,iBAAiB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAwB;AACxB,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,KAAK,EAAE,mBAAmB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,yCAAyC;AACzC,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,KAAK,EAAE,gBAAgB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAqB;AACrB,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,KAAK,EAAE,cAAc,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,KAAK,EAAE,kBAAkB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,wBAAyB,SAAQ,cAAc;IAC9D,KAAK,EAAE,sBAAsB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,MAAM,UAAU,GAClB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,kBAAkB,GAClB,oBAAoB,GACpB,kBAAkB,GAClB,kBAAkB,GAClB,gBAAgB,GAChB,oBAAoB,GACpB,wBAAwB,CAAC;AAE7B,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAanF"}
1
+ {"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/server/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,QAAQ,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,4BAA4B;AAC5B,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,KAAK,EAAE,iBAAiB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,iDAAiD;AACjD,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,8BAA8B;AAC9B,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED,uBAAuB;AACvB,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,KAAK,EAAE,iBAAiB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAwB;AACxB,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,KAAK,EAAE,mBAAmB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,yCAAyC;AACzC,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,KAAK,EAAE,gBAAgB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAqB;AACrB,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,KAAK,EAAE,cAAc,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,KAAK,EAAE,kBAAkB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,wBAAyB,SAAQ,cAAc;IAC9D,KAAK,EAAE,sBAAsB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;kDAMkD;AAClD,MAAM,WAAW,uBAAwB,SAAQ,cAAc;IAC7D,KAAK,EAAE,+BAA+B,CAAC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC;CAC9B;AAED,8CAA8C;AAC9C,MAAM,MAAM,UAAU,GAClB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,kBAAkB,GAClB,oBAAoB,GACpB,kBAAkB,GAClB,kBAAkB,GAClB,gBAAgB,GAChB,oBAAoB,GACpB,wBAAwB,GACxB,uBAAuB,CAAC;AAE5B,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwBnF"}
@@ -9,7 +9,18 @@
9
9
  */
10
10
  /** Sanitize tool call arguments — remove values that might contain sensitive data */
11
11
  export function sanitizeArgs(args) {
12
- const sensitiveKeys = ['password', 'token', 'secret', 'cookie', 'authorization', 'csrf', 'apikey'];
12
+ const sensitiveKeys = [
13
+ 'password',
14
+ 'token',
15
+ 'secret',
16
+ 'cookie',
17
+ 'authorization',
18
+ 'csrf',
19
+ 'apikey',
20
+ 'authpwd',
21
+ 'authtoken',
22
+ 'remotepassword',
23
+ ];
13
24
  const result = {};
14
25
  for (const [key, value] of Object.entries(args)) {
15
26
  if (sensitiveKeys.some((s) => key.toLowerCase().includes(s))) {
@@ -1 +1 @@
1
- {"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/server/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgHH,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,IAA6B;IACxD,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnG,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAC7B,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,kBAAkB,KAAK,CAAC,MAAM,SAAS,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
1
+ {"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/server/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAyIH,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,IAA6B;IACxD,MAAM,aAAa,GAAG;QACpB,UAAU;QACV,OAAO;QACP,QAAQ;QACR,QAAQ;QACR,eAAe;QACf,MAAM;QACN,QAAQ;QACR,SAAS;QACT,WAAW;QACX,gBAAgB;KACjB,CAAC;IACF,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAC7B,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,kBAAkB,KAAK,CAAC,MAAM,SAAS,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
@@ -4,37 +4,52 @@
4
4
  * Resolves configuration from CLI flags, environment variables, and defaults.
5
5
  * Priority: CLI > env > .env > defaults
6
6
  *
7
- * Environment variable names match the Go version exactly (SAP_URL, SAP_USER, etc.)
8
- * for drop-in compatibility with existing deployments and documentation.
7
+ * Post-authz-refactor-v2 (v0.7):
8
+ * - Profile layer (`ARC1_PROFILE`) was removed. Use explicit `SAP_ALLOW_*` env vars.
9
+ * - Op-code allowlist/blocklist env vars (`SAP_ALLOWED_OPS` / `SAP_DISALLOWED_OPS`)
10
+ * were removed. Use `SAP_DENY_ACTIONS` for fine-grained per-action denials.
11
+ * - Single `ARC1_API_KEY` was removed. Use `ARC1_API_KEYS="key:profile"` instead.
12
+ * - Negated safety flags (`SAP_READ_ONLY`, `SAP_BLOCK_DATA`, `SAP_BLOCK_FREE_SQL`,
13
+ * `SAP_ENABLE_TRANSPORTS`, `SAP_ENABLE_GIT`) were replaced with positive opt-ins
14
+ * (`SAP_ALLOW_WRITES`, `SAP_ALLOW_DATA_PREVIEW`, `SAP_ALLOW_FREE_SQL`,
15
+ * `SAP_ALLOW_TRANSPORT_WRITES`, `SAP_ALLOW_GIT_WRITES`).
16
+ * - See docs_page/updating.md for the full migration table.
9
17
  */
10
- import type { ServerConfig } from './types.js';
18
+ import type { SafetyConfig } from '../adt/safety.js';
19
+ import type { ConfigSource, ServerConfig } from './types.js';
20
+ /**
21
+ * Named API-key profiles — the safety config + scope set granted to a key
22
+ * with that profile name. Used by multi-key auth (`ARC1_API_KEYS=key:profile`).
23
+ *
24
+ * For BTP/XSUAA deployments, the equivalent concept is role templates in
25
+ * xs-security.json. The two stay conceptually aligned.
26
+ */
27
+ export interface ApiKeyProfile {
28
+ scopes: string[];
29
+ /** Partial SafetyConfig — intersected with the server ceiling at request time. */
30
+ safety: Partial<SafetyConfig>;
31
+ }
32
+ export declare const API_KEY_PROFILES: Record<string, ApiKeyProfile>;
11
33
  /**
12
34
  * Parse API keys string into structured array.
13
35
  * Format: "key1:profile1,key2:profile2"
14
- * Each entry maps an API key to a named profile.
15
36
  */
16
37
  export declare function parseApiKeys(raw: string): Array<{
17
38
  key: string;
18
39
  profile: string;
19
40
  }>;
20
41
  /**
21
- * Maps profile names to the scopes they grant.
22
- * Used when API keys are assigned to profiles the key inherits these scopes.
23
- * Kept in sync with PROFILES: each profile's safety flags determine its scopes.
42
+ * Parse CLI args + env into a `{ config, sources }` pair.
43
+ * `sources` records where each field's value came from (default / env / flag / file).
44
+ * Consumed by the startup effective-policy log and the `arc1 config show` subcommand.
24
45
  */
25
- export declare const PROFILE_SCOPES: Record<string, string[]>;
46
+ export declare function resolveConfig(args: string[]): {
47
+ config: ServerConfig;
48
+ sources: Record<string, ConfigSource>;
49
+ };
26
50
  /**
27
- * Named profiles convenience presets for common safety configurations.
28
- * Each profile sets a combination of safety flags. Individual CLI flags
29
- * applied after the profile can override any profile default.
30
- */
31
- export declare const PROFILES: Record<string, Partial<ServerConfig>>;
32
- /**
33
- * Parse CLI arguments and environment variables into a ServerConfig.
34
- *
35
- * We use a simple hand-rolled parser here (not commander) because
36
- * the MCP server entry point needs to be fast and lightweight.
37
- * Commander is used for the full CLI (cli.ts), not the server startup.
51
+ * Thin wrapper around `resolveConfig` that returns only the config object.
52
+ * Kept for callers that don't need per-field source attribution.
38
53
  */
39
54
  export declare function parseArgs(args: string[]): ServerConfig;
40
55
  /**
@@ -1 +1 @@
1
- {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/server/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAiB,YAAY,EAAiB,MAAM,YAAY,CAAC;AAG7E;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA8BjF;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAOnD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAwC1D,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,CAwLtD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CA8CzD"}
1
+ {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/server/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,KAAK,EAAE,YAAY,EAAiB,YAAY,EAAiB,MAAM,YAAY,CAAC;AAG3F;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kFAAkF;IAClF,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CAC/B;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA2E1D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA4BjF;AAwDD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CAAE,CAuR7G;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,CAEtD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CA4CzD"}