arc-1 1.0.2 → 1.1.0

package/dist/server/audit.js

@@ -9,59 +9,266 @@
  */
 const SENSITIVE_KEY_FRAGMENTS = [
     'password',
+    'passwd',
+    'passphrase',
+    'pwd',
     'token',
     'secret',
     'cookie',
+    'session',
+    'sessionid',
+    'jsessionid',
+    'sapsessionid',
     'authorization',
     'csrf',
     'apikey',
     'authpwd',
+    'authuser',
     'authtoken',
     'remotepassword',
+    'credential',
+    'accesskey',
+    'privatekey',
+    'sshkey',
+    'signature',
 ];
+const KNOWN_SENSITIVE_FIELD_KEYS = new Set([
+    'password',
+    'passwd',
+    'passphrase',
+    'pwd',
+    'token',
+    'secret',
+    'cookie',
+    'session',
+    'sessionid',
+    'jsessionid',
+    'sap-sessionid',
+    'sap_sessionid',
+    'authorization',
+    'csrf',
+    'apikey',
+    'api-key',
+    'api_key',
+    'authpwd',
+    'auth-pwd',
+    'auth_pwd',
+    'authuser',
+    'auth-user',
+    'auth_user',
+    'authtoken',
+    'auth-token',
+    'auth_token',
+    'remotepassword',
+    'remote-password',
+    'remote_password',
+    'credential',
+    'accesskey',
+    'access-key',
+    'access_key',
+    'privatekey',
+    'private-key',
+    'private_key',
+    'sshkey',
+    'ssh-key',
+    'ssh_key',
+    'signature',
+    'x-csrf-token',
+    'x_csrf_token',
+    'set-cookie',
+    'x-api-key',
+    'proxy-authorization',
+]);
+const KNOWN_SAFE_FIELD_KEYS = new Set(['includesignature']);
 const PAYLOAD_BODY_KEYS = new Set(['errorbody', 'errormessage', 'requestbody', 'responsebody', 'resultpreview']);
+const REDACTION_LIMIT_MARKER = '[TRUNCATED: redaction budget exceeded]';
+const MAX_REDACTION_DEPTH = 16;
+const MAX_REDACTION_ENTRIES = 512;
+const MAX_AUDIT_STRING_LENGTH = 500;
+const AUDIT_STRING_PREFIX_LENGTH = 200;
+function normalizeSafeUnicodeEscapes(value) {
+    return value.replace(/\\{1,8}u([0-9a-f]{4})/gi, (encoded, hex) => {
+        const decoded = String.fromCharCode(Number.parseInt(hex, 16));
+        return /^[a-z0-9_.-]$/i.test(decoded) ? decoded : encoded;
+    });
+}
+function canonicalKey(key) {
+    return normalizeSafeUnicodeEscapes(key)
+        .toLowerCase()
+        .replace(/[^a-z0-9]/g, '');
+}
 function isSensitiveKey(key) {
+    const normalized = canonicalKey(key);
+    return (!KNOWN_SAFE_FIELD_KEYS.has(normalized) && SENSITIVE_KEY_FRAGMENTS.some((fragment) => normalized.includes(fragment)));
+}
+function isUrlKey(key) {
+    const normalized = canonicalKey(key);
+    return ['url', 'urls', 'uri', 'uris', 'href', 'hrefs'].some((suffix) => normalized === suffix || normalized.endsWith(suffix));
+}
+function isSensitiveUrlQueryKey(key) {
     const lower = key.toLowerCase();
-    return SENSITIVE_KEY_FRAGMENTS.some((fragment) => lower.includes(fragment));
+    return (isSensitiveKey(key) ||
+        ['auth', 'credential', 'access_key', 'accesskey', 'signature'].some((fragment) => lower.includes(fragment)));
+}
+function redactCredentialAssignments(value) {
+    return value
+        .replace(/\bauthorization\s*([:=])\s*(?:bearer|basic)\s+(?:\\{1,64}"[^"]*\\{1,64}"|\\{1,64}'[^']*\\{1,64}'|"[^"]*"|'[^']*'|[^\s,;&<>"']+)/gi, 'authorization$1[REDACTED]')
+        .replace(/\b(bearer|basic)\s+(?:\\{1,64}"[^"]*\\{1,64}"|\\{1,64}'[^']*\\{1,64}'|"[^"]*"|'[^']*'|[^\s,;&<>"']+)/gi, '$1 [REDACTED]')
+        .replace(/\b(password|passwd|passphrase|pwd|token|secret|api[_-]?key|authorization|credential|access[_-]?key|private[_-]?key|ssh[_-]?key|signature|cookie|jsessionid|sap[_-]?sessionid|sessionid|session|(?:client[_-]?vcs[_-]?)?auth[_-]?(?:pwd|user|token)|remote[_-]?(?:password|user|token))(?:(?:\\{1,64})?["'])?\s*([:=])\s*(?:(?:bearer|basic)\s+)?(?:\\{1,64}"[^"]*\\{1,64}"|\\{1,64}'[^']*\\{1,64}'|"[^"]*"|'[^']*'|[^\s,;&<>"']+)/gi, '$1$2[REDACTED]');
+}
+function normalizeEscapedUrlSlashes(value) {
+    return normalizeSafeUnicodeEscapes(value.replace(/\\{1,8}\//g, '/'));
+}
+/** Redact query-style assignments in a query string or URL fragment, including encoded keys. */
+function sanitizeUrlAssignments(value) {
+    return redactCredentialAssignments(value).replace(/(^|[&;])([^=&;]+)(?:=([^&;]*))?/g, (part, separator, rawKey) => {
+        let decodedKey = rawKey;
+        try {
+            decodedKey = decodeURIComponent(rawKey.replace(/\+/g, ' '));
+        }
+        catch {
+            // Keep the raw key for the sensitivity check.
+        }
+        return isSensitiveUrlQueryKey(decodedKey) ? `${separator}[REDACTED]=[REDACTED]` : part;
+    });
+}
+function sanitizeUrl(value) {
+    const normalizedValue = normalizeEscapedUrlSlashes(value);
+    try {
+        const parsed = new URL(normalizedValue);
+        let changed = parsed.username.length > 0 || parsed.password.length > 0;
+        if (changed) {
+            parsed.username = '';
+            parsed.password = '';
+        }
+        const sanitizedPath = redactCredentialAssignments(parsed.pathname);
+        if (sanitizedPath !== parsed.pathname) {
+            parsed.pathname = sanitizedPath;
+            changed = true;
+        }
+        if (parsed.search) {
+            const sanitizedSearch = sanitizeUrlAssignments(parsed.search.slice(1));
+            if (sanitizedSearch !== parsed.search.slice(1)) {
+                parsed.search = `?${sanitizedSearch}`;
+                changed = true;
+            }
+        }
+        if (parsed.hash) {
+            const sanitizedHash = sanitizeUrlAssignments(parsed.hash.slice(1));
+            if (sanitizedHash !== parsed.hash.slice(1)) {
+                parsed.hash = `#${sanitizedHash}`;
+                changed = true;
+            }
+        }
+        return changed ? parsed.toString() : normalizedValue;
+    }
+    catch {
+        // Invalid URLs are rejected later by the handler, but audit runs before validation. Apply a
+        // best-effort textual scrub so malformed userinfo/query secrets cannot escape first.
+        const withoutUserinfo = normalizedValue.replace(/^([a-z][a-z\d+.-]*:\/\/)[^/@\s]+@/i, '$1[REDACTED]@');
+        const fragmentStart = withoutUserinfo.indexOf('#');
+        const beforeFragment = fragmentStart >= 0 ? withoutUserinfo.slice(0, fragmentStart) : withoutUserinfo;
+        const fragment = fragmentStart >= 0 ? withoutUserinfo.slice(fragmentStart + 1) : undefined;
+        const queryStart = beforeFragment.indexOf('?');
+        const path = queryStart >= 0 ? beforeFragment.slice(0, queryStart) : beforeFragment;
+        const query = queryStart >= 0 ? beforeFragment.slice(queryStart + 1) : undefined;
+        return `${redactCredentialAssignments(path)}${query === undefined ? '' : `?${sanitizeUrlAssignments(query)}`}${fragment === undefined ? '' : `#${sanitizeUrlAssignments(fragment)}`}`;
+    }
+}
+function sanitizeText(value) {
+    const normalized = normalizeEscapedUrlSlashes(value);
+    return redactCredentialAssignments(normalized).replace(/https?:\/\/[^\s<>"']+/gi, (candidate) => {
+        const trailing = candidate.match(/[),.;]+$/)?.[0] ?? '';
+        const core = trailing ? candidate.slice(0, -trailing.length) : candidate;
+        return `${sanitizeUrl(core)}${trailing}`;
+    });
+}
+function boundAuditString(value, originalLength = value.length) {
+    if (value.length <= MAX_AUDIT_STRING_LENGTH && originalLength <= MAX_AUDIT_STRING_LENGTH)
+        return value;
+    return `${value.slice(0, AUDIT_STRING_PREFIX_LENGTH)}... [truncated ${originalLength} chars]`;
+}
+function auditStringInput(value) {
+    return value.length <= MAX_AUDIT_STRING_LENGTH ? value : value.slice(0, MAX_AUDIT_STRING_LENGTH);
+}
+function redactedAuditKey(entryKey, target) {
+    const normalizedEntryKey = normalizeSafeUnicodeEscapes(auditStringInput(entryKey));
+    const sensitiveKeyContainsData = isSensitiveKey(normalizedEntryKey) && !KNOWN_SENSITIVE_FIELD_KEYS.has(normalizedEntryKey.toLowerCase());
+    const sanitized = sensitiveKeyContainsData
+        ? '[REDACTED sensitive key]'
+        : boundAuditString(sanitizeText(normalizedEntryKey), entryKey.length);
+    if (!Object.hasOwn(target, sanitized))
+        return sanitized;
+    let collision = 2;
+    while (Object.hasOwn(target, `[REDACTED duplicate key ${collision}]`))
+        collision += 1;
+    return `[REDACTED duplicate key ${collision}]`;
+}
+function setAuditEntry(target, entryKey, value) {
+    Object.defineProperty(target, redactedAuditKey(entryKey, target), {
+        value,
+        enumerable: true,
+        configurable: true,
+        writable: true,
+    });
 }
 function redactPayloadValue(value) {
     if (typeof value === 'string')
         return `[REDACTED ${value.length} chars]`;
     return '[REDACTED]';
 }
-function redactValue(key, value) {
+function redactValue(key, value, state, depth, mode) {
+    if (depth > MAX_REDACTION_DEPTH || state.remainingEntries <= 0)
+        return REDACTION_LIMIT_MARKER;
+    state.remainingEntries -= 1;
     if (isSensitiveKey(key))
         return '[REDACTED]';
-    if (PAYLOAD_BODY_KEYS.has(key.toLowerCase())) {
+    if (mode === 'audit-event' && PAYLOAD_BODY_KEYS.has(canonicalKey(key))) {
         if (value == null)
             return value;
         return redactPayloadValue(value);
     }
-    if (Array.isArray(value))
-        return value.map((entry) => redactValue('', entry));
+    if (typeof value === 'string') {
+        const boundedInput = auditStringInput(value);
+        const sanitized = isUrlKey(key) ? sanitizeUrl(boundedInput) : sanitizeText(boundedInput);
+        return boundAuditString(sanitized, value.length);
+    }
+    if (Array.isArray(value)) {
+        if (state.seen.has(value))
+            return REDACTION_LIMIT_MARKER;
+        state.seen.add(value);
+        const result = [];
+        for (const entry of value) {
+            if (state.remainingEntries <= 0) {
+                result.push(REDACTION_LIMIT_MARKER);
+                break;
+            }
+            result.push(redactValue(key, entry, state, depth + 1, mode));
+        }
+        return result;
+    }
     if (value && typeof value === 'object') {
-        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, redactValue(k, v)]));
+        if (state.seen.has(value))
+            return REDACTION_LIMIT_MARKER;
+        state.seen.add(value);
+        const result = {};
+        for (const [entryKey, entryValue] of Object.entries(value)) {
+            if (state.remainingEntries <= 0) {
+                setAuditEntry(result, '__truncated__', REDACTION_LIMIT_MARKER);
+                break;
+            }
+            setAuditEntry(result, entryKey, redactValue(entryKey, entryValue, state, depth + 1, mode));
+        }
+        return result;
     }
     return value;
 }
 /** Redact sensitive or high-volume SAP payload fields before any audit sink sees them. */
 export function redactAuditEvent(event) {
-    return redactValue('', event);
+    return redactValue('', event, { remainingEntries: MAX_REDACTION_ENTRIES, seen: new WeakSet() }, 0, 'audit-event');
 }
-/** Sanitize tool call arguments — remove values that might contain sensitive data */
+/** Sanitize tool call arguments before the pre-dispatch audit event is emitted. */
 export function sanitizeArgs(args) {
-    const result = {};
-    for (const [key, value] of Object.entries(args)) {
-        if (isSensitiveKey(key)) {
-            result[key] = '[REDACTED]';
-        }
-        else if (typeof value === 'string' && value.length > 500) {
-            result[key] = `${value.slice(0, 200)}... [truncated ${value.length} chars]`;
-        }
-        else {
-            result[key] = value;
-        }
-    }
-    return result;
+    return redactValue('', args, { remainingEntries: MAX_REDACTION_ENTRIES, seen: new WeakSet() }, 0, 'tool-args');
 }
 //# sourceMappingURL=audit.js.map

package/dist/server/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/server/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA+PH,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,eAAe;IACf,MAAM;IACN,QAAQ;IACR,SAAS;IACT,WAAW;IACX,gBAAgB;CACjB,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;AAEjH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,KAAK,CAAC,MAAM,SAAS,CAAC;IACzE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,KAAc;IAC9C,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IAC7C,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC7C,IAAI,KAAK,IAAI,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,OAAO,WAAW,CAAC,EAAE,EAAE,KAAK,CAAe,CAAC;AAC9C,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,IAA6B;IACxD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAC7B,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,kBAAkB,KAAK,CAAC,MAAM,SAAS,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/server/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA+PH,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,KAAK;IACL,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,WAAW;IACX,YAAY;IACZ,cAAc;IACd,eAAe;IACf,MAAM;IACN,QAAQ;IACR,SAAS;IACT,UAAU;IACV,WAAW;IACX,gBAAgB;IAChB,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,WAAW;CACZ,CAAC;AACF,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,KAAK;IACL,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,WAAW;IACX,YAAY;IACZ,eAAe;IACf,eAAe;IACf,eAAe;IACf,MAAM;IACN,QAAQ;IACR,SAAS;IACT,SAAS;IACT,SAAS;IACT,UAAU;IACV,UAAU;IACV,UAAU;IACV,WAAW;IACX,WAAW;IACX,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,aAAa;IACb,QAAQ;IACR,SAAS;IACT,SAAS;IACT,WAAW;IACX,cAAc;IACd,cAAc;IACd,YAAY;IACZ,WAAW;IACX,qBAAqB;CACtB,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAE5D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;AACjH,MAAM,sBAAsB,GAAG,wCAAwC,CAAC;AACxE,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AASvC,SAAS,2BAA2B,CAAC,KAAa;IAChD,OAAO,KAAK,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,OAAO,EAAE,GAAW,EAAE,EAAE;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9D,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,2BAA2B,CAAC,GAAG,CAAC;SACpC,WAAW,EAAE;SACb,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,CACL,CAAC,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CACpH,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CACzD,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,OAAO,CACL,cAAc,CAAC,GAAG,CAAC;QACnB,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAC5G,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAa;IAChD,OAAO,KAAK;SACT,OAAO,CACN,mIAAmI,EACnI,2BAA2B,CAC5B;SACA,OAAO,CACN,wGAAwG,EACxG,eAAe,CAChB;SACA,OAAO,CACN,qaAAqa,EACra,gBAAgB,CACjB,CAAC;AACN,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa;IAC/C,OAAO,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,gGAAgG;AAChG,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC,OAAO,CAC/C,kCAAkC,EAClC,CAAC,IAAI,EAAE,SAAiB,EAAE,MAAc,EAAE,EAAE;QAC1C,IAAI,UAAU,GAAG,MAAM,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QACD,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,eAAe,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;QACxC,IAAI,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACvE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;YACrB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,aAAa,GAAG,2BAA2B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,aAAa,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,GAAG,aAAa,CAAC;YAChC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,eAAe,GAAG,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,IAAI,eAAe,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;gBACtC,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,aAAa,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,IAAI,aAAa,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;gBAClC,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,4FAA4F;QAC5F,qFAAqF;QACrF,MAAM,eAAe,GAAG,eAAe,CAAC,OAAO,CAAC,oCAAoC,EAAE,eAAe,CAAC,CAAC;QACvG,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;QACtG,MAAM,QAAQ,GAAG,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QACpF,MAAM,KAAK,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,GAC1G,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,QAAQ,CAAC,EACpE,EAAE,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,SAAS,EAAE,EAAE;QAC9F,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,cAAc,GAAG,KAAK,CAAC,MAAM;IACpE,IAAI,KAAK,CAAC,MAAM,IAAI,uBAAuB,IAAI,cAAc,IAAI,uBAAuB;QAAE,OAAO,KAAK,CAAC;IACvG,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC,kBAAkB,cAAc,SAAS,CAAC;AAChG,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,MAAM,IAAI,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAA+B;IACzE,MAAM,kBAAkB,GAAG,2BAA2B,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnF,MAAM,wBAAwB,GAC5B,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,kBAAkB,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1G,MAAM,SAAS,GAAG,wBAAwB;QACxC,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,SAAS,GAAG,CAAC;QAAE,SAAS,IAAI,CAAC,CAAC;IACtF,OAAO,2BAA2B,SAAS,GAAG,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,MAA+B,EAAE,QAAgB,EAAE,KAAc;IACtF,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;QAChE,KAAK;QACL,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,KAAK,CAAC,MAAM,SAAS,CAAC;IACzE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,KAAc,EAAE,KAAqB,EAAE,KAAa,EAAE,IAAmB;IACzG,IAAI,KAAK,GAAG,mBAAmB,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAC9F,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC;IAC5B,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IAC7C,IAAI,IAAI,KAAK,aAAa,IAAI,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,KAAK,IAAI,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACzF,OAAO,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,sBAAsB,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACpC,MAAM;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,sBAAsB,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtF,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,EAAE,CAAC;gBAChC,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,sBAAsB,CAAC,CAAC;gBAC/D,MAAM;YACR,CAAC;YACD,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,OAAO,WAAW,CAChB,EAAE,EACF,KAAK,EACL,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,EAAE,EAChE,CAAC,EACD,aAAa,CACA,CAAC;AAClB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAAC,IAA6B;IACxD,OAAO,WAAW,CAChB,EAAE,EACF,IAAI,EACJ,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,EAAE,EAChE,CAAC,EACD,WAAW,CACe,CAAC;AAC/B,CAAC"}

package/dist/server/config.d.ts

@@ -17,6 +17,20 @@
  */
 import type { SafetyConfig } from '../adt/safety.js';
 import type { ConfigSource, ServerConfig } from './types.js';
+/**
+ * Parse metadata for configuration flags accepted by the CLI.
+ *
+ * `resolveConfig()` remains the source of truth for defaults, environment
+ * variables, precedence, and validation. This table only describes the argv
+ * grammar so Commander and the low-level resolver cannot drift apart.
+ */
+export interface CliConfigOptionSpec {
+    name: string;
+    valueName: string;
+    description: string;
+    valueOptional?: boolean;
+}
+export declare const CLI_CONFIG_OPTION_SPECS: readonly CliConfigOptionSpec[];
 /**
  * Named API-key profiles — the safety config + scope set granted to a key
  * with that profile name. Used by multi-key auth (`ARC1_API_KEYS=key:profile`).
@@ -38,6 +52,8 @@ export declare function parseApiKeys(raw: string): Array<{
     key: string;
     profile: string;
 }>;
+/** Fail with migration guidance before a strict CLI parser rejects removed flags as unknown. */
+export declare function assertNoRemovedCliFlags(args: readonly string[]): void;
 /**
  * Parse CLI args + env into a `{ config, sources }` pair.
  * `sources` records where each field's value came from (default / env / flag / file).

package/dist/server/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/server/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,KAAK,EACV,YAAY,EAGZ,YAAY,EAGb,MAAM,YAAY,CAAC;AAGpB;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kFAAkF;IAClF,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CAC/B;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA2E1D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA4BjF;AAwGD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CAAE,CAqf7G;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,CAEtD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CA4KzD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/server/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,KAAK,EACV,YAAY,EAGZ,YAAY,EAGb,MAAM,YAAY,CAAC;AAGpB;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,eAAO,MAAM,uBAAuB,EAAE,SAAS,mBAAmB,EAwGjE,CAAC;AAUF;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kFAAkF;IAClF,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CAC/B;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA2E1D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA8BjF;AAkFD,gGAAgG;AAChG,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAMrE;AA8BD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CAAE,CA6f7G;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,CAEtD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CA4KzD"}

package/dist/server/config.js

@@ -18,6 +18,117 @@
 import { parseDenyActions, validateDenyActions } from './deny-actions.js';
 import { logger } from './logger.js';
 import { DEFAULT_CONFIG } from './types.js';
+export const CLI_CONFIG_OPTION_SPECS = [
+    { name: 'url', valueName: 'url', description: 'SAP base URL' },
+    { name: 'user', valueName: 'user', description: 'SAP username (prefer SAP_USER in CI)' },
+    { name: 'password', valueName: 'password', description: 'SAP password (prefer SAP_PASSWORD in CI)' },
+    { name: 'client', valueName: 'client', description: 'SAP client' },
+    { name: 'language', valueName: 'language', description: 'SAP logon and object master language' },
+    { name: 'insecure', valueName: 'boolean', description: 'Disable SAP TLS verification (true/false)' },
+    {
+        name: 'gzip-datapreview-body',
+        valueName: 'boolean',
+        description: 'Gzip data-preview POST bodies for WAF compatibility (true/false)',
+    },
+    { name: 'cookie-file', valueName: 'path', description: 'Netscape-format SAP cookie file' },
+    { name: 'cookie-string', valueName: 'cookies', description: 'SAP Cookie header value' },
+    { name: 'transport', valueName: 'transport', description: 'MCP transport: stdio or http-streamable' },
+    { name: 'http-addr', valueName: 'host:port', description: 'HTTP transport bind address' },
+    { name: 'port', valueName: 'port', description: 'HTTP transport port override' },
+    { name: 'server-name', valueName: 'name', description: 'MCP server name' },
+    {
+        name: 'ui',
+        valueName: 'mode',
+        description: 'Enable the read-only admin UI (optional: local/web/off)',
+        valueOptional: true,
+    },
+    { name: 'ui-addr', valueName: 'host:port', description: 'Admin UI bind address' },
+    { name: 'ui-port', valueName: 'port', description: 'Admin UI port override' },
+    { name: 'ui-open', valueName: 'boolean', description: 'Open the local admin UI in a browser (true/false)' },
+    { name: 'allow-writes', valueName: 'boolean', description: 'Enable SAP mutations (true/false)' },
+    { name: 'allow-data-preview', valueName: 'boolean', description: 'Enable table data preview (true/false)' },
+    { name: 'allow-free-sql', valueName: 'boolean', description: 'Enable freestyle SQL (true/false)' },
+    {
+        name: 'allow-transport-writes',
+        valueName: 'boolean',
+        description: 'Enable transport mutations (true/false)',
+    },
+    { name: 'allow-git-writes', valueName: 'boolean', description: 'Enable Git mutations (true/false)' },
+    { name: 'allowed-packages', valueName: 'patterns', description: 'Comma-separated write package allowlist' },
+    { name: 'allowed-transports', valueName: 'ids', description: 'Comma-separated transport allowlist' },
+    { name: 'deny-actions', valueName: 'patterns', description: 'Action deny patterns or file path' },
+    { name: 'feature-abapgit', valueName: 'mode', description: 'abapGit feature toggle: auto/on/off' },
+    { name: 'feature-gcts', valueName: 'mode', description: 'gCTS feature toggle: auto/on/off' },
+    { name: 'feature-rap', valueName: 'mode', description: 'RAP feature toggle: auto/on/off' },
+    { name: 'feature-amdp', valueName: 'mode', description: 'AMDP feature toggle: auto/on/off' },
+    { name: 'feature-ui5', valueName: 'mode', description: 'UI5 feature toggle: auto/on/off' },
+    { name: 'feature-transport', valueName: 'mode', description: 'Transport feature toggle: auto/on/off' },
+    { name: 'feature-hana', valueName: 'mode', description: 'HANA feature toggle: auto/on/off' },
+    { name: 'feature-ui5repo', valueName: 'mode', description: 'UI5 repository feature toggle: auto/on/off' },
+    { name: 'feature-flp', valueName: 'mode', description: 'FLP feature toggle: auto/on/off' },
+    { name: 'system-type', valueName: 'type', description: 'SAP system type: auto/btp/onprem' },
+    { name: 'abap-release', valueName: 'release', description: 'ABAP release override for abaplint' },
+    { name: 'api-keys', valueName: 'keys', description: 'MCP API keys (prefer ARC1_API_KEYS in CI)' },
+    { name: 'oidc-issuer', valueName: 'url', description: 'OIDC issuer URL' },
+    { name: 'oidc-audience', valueName: 'audience', description: 'OIDC audience' },
+    { name: 'oidc-clock-tolerance', valueName: 'seconds', description: 'OIDC clock tolerance' },
+    { name: 'oidc-discovery', valueName: 'boolean', description: 'Enable OIDC discovery (true/false)' },
+    { name: 'oidc-scopes', valueName: 'scopes', description: 'OIDC scopes' },
+    { name: 'xsuaa-auth', valueName: 'boolean', description: 'Enable XSUAA MCP authentication (true/false)' },
+    { name: 'allow-http-no-auth', valueName: 'boolean', description: 'Allow unauthenticated HTTP MCP (true/false)' },
+    { name: 'oauth-dcr-ttl-seconds', valueName: 'seconds', description: 'OAuth DCR client lifetime' },
+    { name: 'dcr-signing-secret', valueName: 'secret', description: 'OAuth DCR signing secret' },
+    { name: 'btp-service-key', valueName: 'json', description: 'BTP ABAP service-key JSON' },
+    { name: 'btp-service-key-file', valueName: 'path', description: 'BTP ABAP service-key file' },
+    { name: 'btp-oauth-callback-port', valueName: 'port', description: 'BTP OAuth callback port' },
+    { name: 'multi-target-endpoints', valueName: 'boolean', description: 'Enable multi-target endpoints (true/false)' },
+    {
+        name: 'multi-target-allow-basic-auth',
+        valueName: 'boolean',
+        description: 'Allow shared Basic multi-target identity (true/false)',
+    },
+    { name: 'pp-enabled', valueName: 'boolean', description: 'Enable principal propagation (true/false)' },
+    { name: 'pp-strict', valueName: 'boolean', description: 'Require principal propagation (true/false)' },
+    {
+        name: 'pp-allow-shared-cookies',
+        valueName: 'boolean',
+        description: 'Allow shared cookies beside principal propagation (true/false)',
+    },
+    { name: 'disable-saml', valueName: 'boolean', description: 'Disable SAP SAML redirects (true/false)' },
+    { name: 'tool-mode', valueName: 'mode', description: 'Tool mode: standard or hyperfocused' },
+    {
+        name: 'schema-nullable-optionals',
+        valueName: 'mode',
+        description: 'Optional-schema null mode: auto/on/off',
+    },
+    { name: 'plugins', valueName: 'paths', description: 'Comma-separated extension paths' },
+    { name: 'allow-plugin-execute', valueName: 'boolean', description: 'Enable plugin class execution (true/false)' },
+    {
+        name: 'allow-plugin-raw-writes',
+        valueName: 'boolean',
+        description: 'Enable plugin non-ADT writes (true/false)',
+    },
+    { name: 'abaplint-config', valueName: 'path', description: 'Custom abaplint configuration file' },
+    { name: 'lint-before-write', valueName: 'boolean', description: 'Lint before source writes (true/false)' },
+    { name: 'check-before-write', valueName: 'boolean', description: 'Run SAP syntax check before writes (true/false)' },
+    { name: 'cache', valueName: 'mode', description: 'Cache mode: auto/memory/sqlite/none' },
+    { name: 'cache-file', valueName: 'path', description: 'SQLite cache file' },
+    { name: 'max-concurrent', valueName: 'count', description: 'Maximum concurrent SAP requests' },
+    { name: 'auth-rate-limit', valueName: 'per-minute', description: 'OAuth requests per IP per minute' },
+    { name: 'rate-limit', valueName: 'per-minute', description: 'MCP calls per user per minute' },
+    { name: 'allowed-origins', valueName: 'origins', description: 'Comma-separated browser CORS origins' },
+    { name: 'log-file', valueName: 'path', description: 'Audit/log output file' },
+    { name: 'log-level', valueName: 'level', description: 'Log level: debug/info/warn/error' },
+    { name: 'log-format', valueName: 'format', description: 'Log format: text or json' },
+    { name: 'minimal-errors', valueName: 'boolean', description: 'Hide SAP diagnostic details (true/false)' },
+    { name: 'verbose', valueName: 'boolean', description: 'Enable verbose logging (true/false)' },
+];
+const CLI_CONFIG_OPTION_NAMES = new Set(CLI_CONFIG_OPTION_SPECS.map((spec) => spec.name));
+function assertRegisteredCliConfigOption(name) {
+    if (!CLI_CONFIG_OPTION_NAMES.has(name)) {
+        throw new Error(`Internal configuration error: CLI flag --${name} is not registered`);
+    }
+}
 export const API_KEY_PROFILES = {
     viewer: {
         scopes: ['read'],
@@ -100,22 +211,24 @@ export const API_KEY_PROFILES = {
  */
 export function parseApiKeys(raw) {
     const entries = [];
-    for (const pair of raw.split(',')) {
+    const validProfiles = Object.keys(API_KEY_PROFILES).join(', ');
+    const invalidEntry = (position) => new Error(`Invalid API key entry at position ${position}: expected a non-empty key and valid profile in 'key:profile' format. ` +
+        `Valid profiles: ${validProfiles}`);
+    for (const [index, pair] of raw.split(',').entries()) {
         const trimmed = pair.trim();
         if (!trimmed)
             continue;
         const colonIdx = trimmed.lastIndexOf(':');
         if (colonIdx === -1) {
-            throw new Error(`Invalid API key entry '${trimmed}': expected 'key:profile' format. ` +
-                `Valid profiles: ${Object.keys(API_KEY_PROFILES).join(', ')}`);
+            throw invalidEntry(index + 1);
         }
         const key = trimmed.slice(0, colonIdx);
         const profile = trimmed.slice(colonIdx + 1);
         if (!key) {
-            throw new Error('Invalid API key entry: key cannot be empty');
+            throw invalidEntry(index + 1);
         }
         if (!API_KEY_PROFILES[profile]) {
-            throw new Error(`Invalid profile '${profile}' in API key entry. Valid profiles: ${Object.keys(API_KEY_PROFILES).join(', ')}`);
+            throw invalidEntry(index + 1);
         }
         entries.push({ key, profile });
     }
@@ -177,6 +290,26 @@ const RETIRED_CLI_FLAGS = {
     'cache-warmup': RETIRED_ENV_VARS.ARC1_CACHE_WARMUP,
     'cache-warmup-packages': RETIRED_ENV_VARS.ARC1_CACHE_WARMUP_PACKAGES,
 };
+function cliFlagViolations(args, flags) {
+    return Object.entries(flags)
+        .filter(([flag]) => args.some((arg) => arg === `--${flag}` || arg.startsWith(`--${flag}=`)))
+        .map(([flag, hint]) => `  --${flag}: ${hint}`);
+}
+function legacyConfigError(violations) {
+    return new Error(`Legacy authorization config detected (removed in v0.7):\n${violations.join('\n')}\n\nSee docs_page/updating.md#v07-authorization-refactor-breaking-change for the full migration guide.`);
+}
+function retiredConfigError(violations) {
+    return new Error(`Removed ARC-1 configuration detected:\n${violations.join('\n')}\n\nSee docs_page/updating.md for migration details.`);
+}
+/** Fail with migration guidance before a strict CLI parser rejects removed flags as unknown. */
+export function assertNoRemovedCliFlags(args) {
+    const legacyViolations = cliFlagViolations(args, LEGACY_CLI_FLAGS);
+    if (legacyViolations.length > 0)
+        throw legacyConfigError(legacyViolations);
+    const retiredViolations = cliFlagViolations(args, RETIRED_CLI_FLAGS);
+    if (retiredViolations.length > 0)
+        throw retiredConfigError(retiredViolations);
+}
 /** Migration guard — throws a helpful error if any legacy identifier is set. */
 function detectLegacyConfig(args) {
     const violations = [];
@@ -185,13 +318,9 @@ function detectLegacyConfig(args) {
             violations.push(`  ${env}: ${LEGACY_ENV_VARS[env]}`);
         }
     }
-    for (const flag of Object.keys(LEGACY_CLI_FLAGS)) {
-        if (args.some((a) => a === `--${flag}` || a.startsWith(`--${flag}=`))) {
-            violations.push(`  --${flag}: ${LEGACY_CLI_FLAGS[flag]}`);
-        }
-    }
+    violations.push(...cliFlagViolations(args, LEGACY_CLI_FLAGS));
     if (violations.length > 0) {
-        throw new Error(`Legacy authorization config detected (removed in v0.7):\n${violations.join('\n')}\n\nSee docs_page/updating.md#v07-authorization-refactor-breaking-change for the full migration guide.`);
+        throw legacyConfigError(violations);
     }
 }
 function detectRetiredConfig(args) {
@@ -200,13 +329,9 @@ function detectRetiredConfig(args) {
         if (process.env[env] !== undefined)
             violations.push(`  ${env}: ${RETIRED_ENV_VARS[env]}`);
     }
-    for (const flag of Object.keys(RETIRED_CLI_FLAGS)) {
-        if (args.some((arg) => arg === `--${flag}` || arg.startsWith(`--${flag}=`))) {
-            violations.push(`  --${flag}: ${RETIRED_CLI_FLAGS[flag]}`);
-        }
-    }
+    violations.push(...cliFlagViolations(args, RETIRED_CLI_FLAGS));
     if (violations.length > 0) {
-        throw new Error(`Removed ARC-1 configuration detected:\n${violations.join('\n')}\n\nSee docs_page/updating.md for migration details.`);
+        throw retiredConfigError(violations);
     }
 }
 /**
@@ -221,6 +346,7 @@ export function resolveConfig(args) {
     const sources = {};
     // ── Resolvers ──────────────────────────────────────────────────────
     const getFlag = (name) => {
+        assertRegisteredCliConfigOption(name);
         const prefix = `--${name}=`;
         for (let i = 0; i < args.length; i++) {
             if (args[i] === `--${name}` && i + 1 < args.length)
@@ -231,6 +357,7 @@ export function resolveConfig(args) {
         return undefined;
     };
     const getOptionalFlagValue = (name) => {
+        assertRegisteredCliConfigOption(name);
         const prefix = `--${name}=`;
         for (let i = 0; i < args.length; i++) {
             if (args[i] === `--${name}`) {
@@ -311,6 +438,7 @@ export function resolveConfig(args) {
     config.client = resolveStr('client', 'SAP_CLIENT', '100', 'client');
     config.language = resolveStr('language', 'SAP_LANGUAGE', 'EN', 'language');
     config.insecure = resolveBool('insecure', 'SAP_INSECURE', false, 'insecure');
+    config.gzipDataPreviewBody = resolveBool('gzip-datapreview-body', 'SAP_GZIP_DATAPREVIEW_BODY', false, 'gzipDataPreviewBody');
     // ── Cookie Auth ────────────────────────────────────────────────────
     config.cookieFile = resolveOptionalStr('cookie-file', 'SAP_COOKIE_FILE', 'cookieFile');
     config.cookieString = resolveOptionalStr('cookie-string', 'SAP_COOKIE_STRING', 'cookieString');