llm-cli-gateway 2.13.1 → 2.14.0-rc.1

package/dist/provider-surface-generator.d.ts

@@ -0,0 +1,98 @@
+import type { CliType } from "./provider-types.js";
+import { type AdminSafetyClass, type AdminSurfaceKind, type ProviderDefinition } from "./provider-definitions.js";
+export declare function modelsResourceUri(id: CliType): string;
+export declare function sessionsResourceUri(id: CliType): string;
+export declare function providerAcpResourceUri(id: CliType): string;
+export interface RequestToolDescriptor {
+    readonly provider: CliType;
+    readonly displayName: string;
+    readonly syncToolName: string;
+    readonly asyncToolName: string;
+    readonly transport: string;
+    readonly acpCapable: boolean;
+}
+export interface ResourceDescriptor {
+    readonly provider: CliType;
+    readonly displayName: string;
+    readonly sessionLabel: string;
+    readonly icon: string;
+    readonly modelsUri: string;
+    readonly sessionsUri: string;
+    readonly exposesModelsResource: boolean;
+    readonly exposesSessionsResource: boolean;
+}
+export interface ModelListingRow {
+    readonly provider: CliType;
+    readonly displayName: string;
+    readonly strategy: string;
+    readonly discoveryArgv: readonly string[];
+    readonly evidence: string;
+}
+export interface SessionListingRow {
+    readonly provider: CliType;
+    readonly sessionLabel: string;
+    readonly resourceUri: string;
+    readonly continue: boolean;
+    readonly resume: boolean;
+    readonly fork: boolean;
+    readonly sessionIdSelection: boolean;
+}
+export interface ProviderCapabilityRow {
+    readonly provider: CliType;
+    readonly displayName: string;
+    readonly executables: readonly string[];
+    readonly transport: string;
+    readonly acpClassification: string;
+    readonly sandbox: boolean;
+    readonly permissionMode: boolean;
+    readonly approvalMode: boolean;
+    readonly trust: boolean;
+    readonly outputFormats: readonly string[];
+    readonly streamingFormats: readonly string[];
+    readonly capabilityScope: string;
+}
+export interface AdminToolDescriptor {
+    readonly provider: CliType;
+    readonly displayName: string;
+    readonly families: readonly {
+        readonly family: string;
+        readonly safety: AdminSafetyClass;
+        readonly kind: AdminSurfaceKind;
+        readonly readOnly: boolean;
+        readonly invokableSubcommand: boolean;
+        readonly evidence: string;
+    }[];
+}
+export interface UpstreamContractRow {
+    readonly provider: CliType;
+    readonly targetVersion: string;
+    readonly helpChecksumRef: string | null;
+    readonly acpClassification: string;
+    readonly nativeEntrypoint: string | null;
+}
+export interface DocsSummaryRow {
+    readonly provider: CliType;
+    readonly displayName: string;
+    readonly primaryDocs: readonly string[];
+    readonly capabilityScope: string;
+}
+export declare function generateProviderIdListing(defs?: readonly ProviderDefinition[]): readonly CliType[];
+export declare function generateRequestToolDescriptors(defs?: readonly ProviderDefinition[]): readonly RequestToolDescriptor[];
+export declare function generateResourceDescriptors(defs?: readonly ProviderDefinition[]): readonly ResourceDescriptor[];
+export declare function parseModelsResourceUri(uri: string, defs?: readonly ProviderDefinition[]): CliType | null;
+export declare function parseSessionsResourceUri(uri: string, defs?: readonly ProviderDefinition[]): CliType | null;
+export interface ProviderAcpDescriptor {
+    readonly provider: CliType;
+    readonly displayName: string;
+    readonly icon: string;
+    readonly acpUri: string;
+    readonly nativeAcp: boolean;
+}
+export declare function generateProviderAcpDescriptors(defs?: readonly ProviderDefinition[]): readonly ProviderAcpDescriptor[];
+export declare function parseProviderAcpResourceUri(uri: string, defs?: readonly ProviderDefinition[]): CliType | null;
+export declare function generateModelListingRows(defs?: readonly ProviderDefinition[]): readonly ModelListingRow[];
+export declare function generateSessionListingRows(defs?: readonly ProviderDefinition[]): readonly SessionListingRow[];
+export declare function generateProviderCapabilityRows(defs?: readonly ProviderDefinition[]): readonly ProviderCapabilityRow[];
+export declare function generateAdminToolDescriptors(defs?: readonly ProviderDefinition[]): readonly AdminToolDescriptor[];
+export declare function generateUpstreamContractRows(defs?: readonly ProviderDefinition[]): readonly UpstreamContractRow[];
+export declare function generateDocsSummaryRows(defs?: readonly ProviderDefinition[]): readonly DocsSummaryRow[];

package/dist/provider-surface-generator.js

@@ -0,0 +1,140 @@
+import { adminSurfaceKind, getAllProviderDefinitions, } from "./provider-definitions.js";
+export function modelsResourceUri(id) {
+    return `models://${id}`;
+}
+export function sessionsResourceUri(id) {
+    return `sessions://${id}`;
+}
+export function providerAcpResourceUri(id) {
+    return `provider-acp://${id}`;
+}
+export function generateProviderIdListing(defs = getAllProviderDefinitions()) {
+    return defs.map(def => def.id);
+}
+export function generateRequestToolDescriptors(defs = getAllProviderDefinitions()) {
+    return defs.map(def => ({
+        provider: def.id,
+        displayName: def.displayName,
+        syncToolName: def.requestSurface.syncToolName,
+        asyncToolName: def.requestSurface.asyncToolName,
+        transport: def.requestSurface.transport,
+        acpCapable: def.requestSurface.acpCapable,
+    }));
+}
+export function generateResourceDescriptors(defs = getAllProviderDefinitions()) {
+    return defs.map(def => ({
+        provider: def.id,
+        displayName: def.displayName,
+        sessionLabel: def.sessionLabel,
+        icon: def.icon,
+        modelsUri: modelsResourceUri(def.id),
+        sessionsUri: sessionsResourceUri(def.id),
+        exposesModelsResource: def.resourcePolicy.exposesModelsResource,
+        exposesSessionsResource: def.resourcePolicy.exposesSessionsResource,
+    }));
+}
+export function parseModelsResourceUri(uri, defs = getAllProviderDefinitions()) {
+    for (const def of defs) {
+        if (def.resourcePolicy.exposesModelsResource && modelsResourceUri(def.id) === uri) {
+            return def.id;
+        }
+    }
+    return null;
+}
+export function parseSessionsResourceUri(uri, defs = getAllProviderDefinitions()) {
+    for (const def of defs) {
+        if (def.resourcePolicy.exposesSessionsResource && sessionsResourceUri(def.id) === uri) {
+            return def.id;
+        }
+    }
+    return null;
+}
+export function generateProviderAcpDescriptors(defs = getAllProviderDefinitions()) {
+    return defs
+        .filter(def => def.acp.classification === "native")
+        .map(def => ({
+        provider: def.id,
+        displayName: def.displayName,
+        icon: def.icon,
+        acpUri: providerAcpResourceUri(def.id),
+        nativeAcp: true,
+    }));
+}
+export function parseProviderAcpResourceUri(uri, defs = getAllProviderDefinitions()) {
+    for (const def of defs) {
+        if (providerAcpResourceUri(def.id) === uri) {
+            return def.id;
+        }
+    }
+    return null;
+}
+export function generateModelListingRows(defs = getAllProviderDefinitions()) {
+    return defs.map(def => ({
+        provider: def.id,
+        displayName: def.displayName,
+        strategy: def.discovery.modelDiscovery.strategy,
+        discoveryArgv: def.discovery.modelDiscovery.argv,
+        evidence: def.discovery.modelDiscovery.evidence,
+    }));
+}
+export function generateSessionListingRows(defs = getAllProviderDefinitions()) {
+    return defs.map(def => ({
+        provider: def.id,
+        sessionLabel: def.sessionLabel,
+        resourceUri: sessionsResourceUri(def.id),
+        continue: def.discovery.sessionContinuity.continue,
+        resume: def.discovery.sessionContinuity.resume,
+        fork: def.discovery.sessionContinuity.fork,
+        sessionIdSelection: def.discovery.sessionContinuity.sessionIdSelection,
+    }));
+}
+export function generateProviderCapabilityRows(defs = getAllProviderDefinitions()) {
+    return defs.map(def => ({
+        provider: def.id,
+        displayName: def.displayName,
+        executables: def.executables,
+        transport: def.requestSurface.transport,
+        acpClassification: def.acp.classification,
+        sandbox: def.safetyModes.sandbox,
+        permissionMode: def.safetyModes.permissionMode,
+        approvalMode: def.safetyModes.approvalMode,
+        trust: def.safetyModes.trust,
+        outputFormats: def.outputFormats,
+        streamingFormats: def.streamingFormats,
+        capabilityScope: def.capabilityScope,
+    }));
+}
+export function generateAdminToolDescriptors(defs = getAllProviderDefinitions()) {
+    return defs.map(def => ({
+        provider: def.id,
+        displayName: def.displayName,
+        families: def.adminSubcommands.map(family => {
+            const kind = adminSurfaceKind(family);
+            return {
+                family: family.family,
+                safety: family.safety,
+                kind,
+                readOnly: family.safety === "read-only",
+                invokableSubcommand: kind === "cli-subcommand",
+                evidence: family.evidence,
+            };
+        }),
+    }));
+}
+export function generateUpstreamContractRows(defs = getAllProviderDefinitions()) {
+    return defs.map(def => ({
+        provider: def.id,
+        targetVersion: def.upstreamContract.targetVersion,
+        helpChecksumRef: def.upstreamContract.helpChecksumRef,
+        acpClassification: def.acp.classification,
+        nativeEntrypoint: def.acp.nativeEntrypoint,
+    }));
+}
+export function generateDocsSummaryRows(defs = getAllProviderDefinitions()) {
+    return defs.map(def => ({
+        provider: def.id,
+        displayName: def.displayName,
+        primaryDocs: def.docs.primary,
+        capabilityScope: def.capabilityScope,
+    }));
+}

package/dist/provider-tool-capabilities.d.ts

@@ -1,6 +1,6 @@
 import { type CliInfo } from "./model-registry.js";
-import { type CliType } from "./session-manager.js";
-import { type ProvidersConfig } from "./config.js";
+import { type CliType } from "./provider-definitions.js";
+import { type AcpConfig, type ProvidersConfig } from "./config.js";
 export interface ProviderToolControl {
     name?: string;
     supported: boolean;
@@ -130,6 +130,7 @@ export interface ProviderCapabilityQuery {
     includePaths?: boolean;
     refresh?: boolean;
     providersConfig?: ProvidersConfig;
+    acpConfig?: AcpConfig;
 }
 export type ProviderToolCapabilitiesMap = Partial<Record<ProviderCapabilityId, ProviderToolCapabilities>>;
 export declare function getProviderToolCapabilities(queryOrCli?: ProviderCapabilityQuery | ProviderCapabilityId): ProviderToolCapabilitiesMap;

package/dist/provider-tool-capabilities.js

@@ -4,7 +4,7 @@ import path from "path";
 import { parse as parseToml } from "smol-toml";
 import { CLAUDE_MCP_SERVER_NAMES } from "./claude-mcp-config.js";
 import { getAvailableCliInfo } from "./model-registry.js";
-import { CLI_TYPES } from "./session-manager.js";
+import { CLI_TYPES, getProviderDefinition } from "./provider-definitions.js";
 import { enabledApiProviders, isXaiProviderEnabled, loadProvidersConfig, } from "./config.js";
 import { apiContinuityForKind } from "./api-provider.js";
 const MAX_SKILLS_PER_DIR = 100;
@@ -34,11 +34,11 @@ export const ACP_CONTRACT = {
     providers: {
         mistral: {
             classification: "native_candidate",
-            summary: "Mistral Vibe exposes native ACP via vibe-acp; first runtime pilot candidate.",
+            summary: "Mistral Vibe exposes native ACP via vibe-acp; runtime routing is live but config-gated.",
         },
         grok: {
             classification: "native_candidate",
-            summary: "xAI Grok CLI exposes native ACP via grok agent stdio; second runtime pilot candidate.",
+            summary: "xAI Grok CLI exposes native ACP via grok agent stdio; runtime routing is live but config-gated.",
         },
         codex: {
             classification: "adapter_mediated_deferred",
@@ -50,7 +50,7 @@ export const ACP_CONTRACT = {
         },
         gemini: {
             classification: "absent_watchlist",
-            summary: "Google Antigravity agy 1.0.13 has no ACP surface; watchlist item only.",
+            summary: "Google Antigravity agy 1.0.14 has no ACP surface; watchlist item only.",
         },
         grok_api: {
             classification: "absent_watchlist",
@@ -58,7 +58,7 @@ export const ACP_CONTRACT = {
         },
         devin: {
             classification: "native_candidate",
-            summary: "Cognition Devin CLI exposes a native ACP server via `devin acp` (stdio); Slice D1 initialize + session/new smoke passed (protocolVersion 1, third runtime pilot). Runtime routing stays config-gated.",
+            summary: "Cognition Devin CLI exposes a native ACP server via `devin acp` (stdio); Slice D1 initialize + session/new smoke passed (protocolVersion 1). Runtime routing is live but config-gated.",
         },
         cursor: {
             classification: "native_candidate",
@@ -67,126 +67,128 @@ export const ACP_CONTRACT = {
     },
 };
 const ACP_DOCS_REFERENCE = "docs/plans/first-class-acp-gateway-extension.dag.toml";
-const ACP_CAPABILITIES = {
+const ACP_RUNTIME_GATE_CAVEAT = "Native ACP runtime routing is config-gated: it is live only when `[acp].enabled` " +
+    "plus this provider's `enabled` and `runtime_enabled` are all set; otherwise " +
+    'transport:"acp" requests fail closed and default requests use the CLI transport.';
+const ACP_RESIDUAL = {
     mistral: {
         status: "native_smoke_passed",
-        mediation: "native",
-        targetVersion: "vibe 2.17.1",
-        entrypoint: { command: "vibe-acp", args: [] },
-        runtimeEnabled: false,
         smokeSupported: true,
         smokeStatus: "passed",
-        caveats: [
-            "Native ACP via the provider-scoped vibe-acp executable; first runtime pilot.",
-            "Runtime routing stays disabled until ACP is enabled in gateway config.",
-        ],
-        docs: ACP_DOCS_REFERENCE,
+        caveats: ["Native ACP via the provider-scoped vibe-acp executable.", ACP_RUNTIME_GATE_CAVEAT],
     },
     grok: {
         status: "native_smoke_passed",
-        mediation: "native",
-        targetVersion: "grok 0.2.73 (9ff14c43bb)",
-        entrypoint: { command: "grok", args: ["agent", "stdio"] },
-        runtimeEnabled: false,
         smokeSupported: true,
         smokeStatus: "passed",
         caveats: [
-            "Native ACP via grok agent stdio; second runtime pilot.",
+            "Native ACP via grok agent stdio.",
             "Credential lookup is owned by the installed CLI; empty-env smoke is not expected to pass.",
-            "Runtime routing stays disabled until ACP is enabled in gateway config.",
+            ACP_RUNTIME_GATE_CAVEAT,
         ],
-        docs: ACP_DOCS_REFERENCE,
     },
     codex: {
         status: "adapter_mediated_deferred",
-        mediation: "adapter_mediated",
-        targetVersion: "codex-cli 0.142.4",
-        entrypoint: null,
-        runtimeEnabled: false,
         smokeSupported: false,
         smokeStatus: "unsupported",
         caveats: [
             "No native ACP entrypoint at the target version; ACP would be adapter-mediated.",
             "Adapter support requires a separate threat model and is never labelled native gateway ACP support.",
         ],
-        docs: ACP_DOCS_REFERENCE,
     },
     claude: {
         status: "adapter_mediated_deferred",
-        mediation: "adapter_mediated",
-        targetVersion: "claude 2.1.195",
-        entrypoint: null,
-        runtimeEnabled: false,
         smokeSupported: false,
         smokeStatus: "unsupported",
         caveats: [
             "No native Claude Code CLI ACP entrypoint at the target version; ACP would be adapter-mediated.",
             "Adapter ownership, permission bridging, and install story must be specified before runtime support.",
         ],
-        docs: ACP_DOCS_REFERENCE,
     },
     gemini: {
         status: "absent_watchlist",
-        mediation: "none",
-        targetVersion: "agy 1.0.13",
-        entrypoint: null,
-        runtimeEnabled: false,
         smokeSupported: false,
         smokeStatus: "unsupported",
         caveats: [
-            "Antigravity agy 1.0.13 has no ACP flag or subcommand.",
+            "Antigravity agy 1.0.14 has no ACP flag or subcommand.",
             "Legacy Gemini CLI ACP evidence does not transfer to agy; kept on the upstream drift watchlist.",
         ],
-        docs: ACP_DOCS_REFERENCE,
     },
     grok_api: {
         status: "not_applicable",
-        mediation: "none",
-        targetVersion: "xAI Responses API",
-        entrypoint: null,
-        runtimeEnabled: false,
         smokeSupported: false,
         smokeStatus: "unsupported",
         caveats: ["ACP is a CLI-stdio transport; the HTTP API provider has no ACP surface."],
-        docs: ACP_DOCS_REFERENCE,
     },
     devin: {
         status: "native_smoke_passed",
-        mediation: "native",
-        targetVersion: "devin 2026.8.18 (16737566)",
-        entrypoint: { command: "devin", args: ["acp"] },
-        runtimeEnabled: false,
         smokeSupported: true,
         smokeStatus: "passed",
         caveats: [
             'Native ACP via `devin acp` (stdio JSON-RPC); Slice D1 initialize + session/new smoke passed (protocolVersion 1, agent "Affogato").',
             "Credentials come from `devin auth login` or WINDSURF_API_KEY; empty-env smoke is not expected to pass.",
-            "Runtime routing stays disabled until ACP is enabled in gateway config.",
+            ACP_RUNTIME_GATE_CAVEAT,
         ],
-        docs: ACP_DOCS_REFERENCE,
     },
     cursor: {
         status: "native_smoke_passed",
-        mediation: "native",
-        targetVersion: "cursor-agent 2026.06.29-2ad2186",
-        entrypoint: { command: "cursor-agent", args: ["acp"] },
-        runtimeEnabled: false,
         smokeSupported: true,
         smokeStatus: "passed",
         caveats: [
-            "Native ACP via hidden `cursor-agent acp` stdio JSON-RPC entrypoint; manual initialize + session/new smoke passed locally (protocolVersion 1, session created; no agentInfo returned).",
-            "Runtime routing stays disabled until ACP is enabled in gateway config.",
+            "Native ACP via the companion-owned hidden `cursor-agent acp` stdio JSON-RPC entrypoint; manual initialize + session/new smoke passed locally (protocolVersion 1, session created; no agentInfo returned).",
+            ACP_RUNTIME_GATE_CAVEAT,
         ],
-        docs: ACP_DOCS_REFERENCE,
     },
 };
-function cloneAcpCapability(acp) {
+function acpMediationFor(cli) {
+    switch (ACP_CONTRACT.providers[cli].classification) {
+        case "native_candidate":
+            return "native";
+        case "adapter_mediated_deferred":
+            return "adapter_mediated";
+        case "absent_watchlist":
+            return "none";
+    }
+}
+function acpRegistryFacts(cli) {
+    if (cli === "grok_api") {
+        return { entrypoint: null, targetVersion: "xAI Responses API" };
+    }
+    const def = getProviderDefinition(cli);
     return {
-        ...acp,
-        entrypoint: acp.entrypoint
-            ? { command: acp.entrypoint.command, args: [...acp.entrypoint.args] }
+        entrypoint: def.acp.entrypoint
+            ? { command: def.acp.entrypoint.command, args: [...def.acp.entrypoint.args] }
             : null,
-        caveats: [...acp.caveats],
+        targetVersion: def.upstreamContract.targetVersion,
+    };
+}
+function resolveAcpRuntimeEnabled(cli, mediation, acpConfig) {
+    if (mediation !== "native")
+        return false;
+    if (!acpConfig?.enabled)
+        return false;
+    const providerConfig = acpConfig.providers[cli];
+    return providerConfig?.enabled === true && providerConfig.runtimeEnabled === true;
+}
+function buildAcpCapability(cli, acpConfig) {
+    const residual = ACP_RESIDUAL[cli];
+    const mediation = acpMediationFor(cli);
+    const { entrypoint, targetVersion } = acpRegistryFacts(cli);
+    const runtimeEnabled = resolveAcpRuntimeEnabled(cli, mediation, acpConfig);
+    const caveats = [...residual.caveats];
+    if (mediation === "native" && (acpConfig === null || acpConfig === undefined)) {
+        caveats.push("runtimeEnabled shows the safe default (off): the resolved gateway [acp] config was not available to this capability read.");
+    }
+    return {
+        status: residual.status,
+        mediation,
+        targetVersion,
+        entrypoint,
+        runtimeEnabled,
+        smokeSupported: residual.smokeSupported,
+        smokeStatus: residual.smokeStatus,
+        caveats,
+        docs: ACP_DOCS_REFERENCE,
     };
 }
 const PROVIDER_CAPABILITY_IDS = [
@@ -972,7 +974,7 @@ function buildOneProviderToolCapabilities(cli, query) {
         modelInfo: getModelInfo(cli, query),
         summary: definition.summary,
         acpContract: { ...ACP_CONTRACT.providers[cli] },
-        acp: cloneAcpCapability(ACP_CAPABILITIES[cli]),
+        acp: buildAcpCapability(cli, query.acpConfig),
         controls: cloneControls(definition.controls),
         features,
         discoveredSkills,
@@ -1234,6 +1236,7 @@ function normalizeQuery(queryOrCli) {
         includePaths: query.includePaths ?? false,
         refresh: query.refresh ?? false,
         providersConfig: query.providersConfig,
+        acpConfig: query.acpConfig,
     };
 }
 function capabilityCacheKey(cli, query) {
@@ -1244,8 +1247,20 @@ function capabilityCacheKey(cli, query) {
         includeUnsupported: query.includeUnsupported,
         includePaths: query.includePaths,
         providersConfig: query.providersConfig ? providerConfigCacheKey(query.providersConfig) : null,
+        acpConfig: query.acpConfig ? acpConfigCacheKey(query.acpConfig) : null,
     });
 }
+function acpConfigCacheKey(config) {
+    return {
+        enabled: config.enabled,
+        providers: Object.fromEntries(Object.entries(config.providers)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([name, provider]) => [
+            name,
+            { enabled: provider.enabled, runtimeEnabled: provider.runtimeEnabled },
+        ])),
+    };
+}
 function providerConfigCacheKey(config) {
     return {
         xai: config.xai

package/dist/remote-url.d.ts

@@ -0,0 +1,28 @@
+export declare const OAUTH_AUTHORIZE_PATH = "/oauth/authorize";
+export declare const OAUTH_TOKEN_PATH = "/oauth/token";
+export declare const OAUTH_REGISTER_PATH = "/oauth/register";
+export declare const OAUTH_PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+export declare const OAUTH_AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
+export declare const OPENID_CONFIGURATION_PATH = "/.well-known/openid-configuration";
+export declare const DEFAULT_MCP_PATH = "/mcp";
+export declare function joinBaseAndPath(baseOrigin: string, path: string): string;
+export declare function toOrigin(rawUrl: string | null | undefined): string | null;
+export declare function resolveConfiguredRemoteOrigin(opts: {
+    issuer?: string | null;
+    publicUrl?: string | null;
+}): string | null;
+export interface RemoteConnectorUrls {
+    baseOrigin: string | null;
+    mcpUrl: string | null;
+    issuer: string | null;
+    authorizationUrl: string | null;
+    tokenUrl: string | null;
+    registrationUrl: string | null;
+    protectedResourceMetadataUrl: string | null;
+    authorizationServerMetadataUrl: string | null;
+}
+export declare function buildRemoteConnectorUrls(opts: {
+    baseOrigin: string | null;
+    mcpPath?: string;
+    oauthEnabled: boolean;
+}): RemoteConnectorUrls;

package/dist/remote-url.js

@@ -0,0 +1,61 @@
+export const OAUTH_AUTHORIZE_PATH = "/oauth/authorize";
+export const OAUTH_TOKEN_PATH = "/oauth/token";
+export const OAUTH_REGISTER_PATH = "/oauth/register";
+export const OAUTH_PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+export const OAUTH_AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
+export const OPENID_CONFIGURATION_PATH = "/.well-known/openid-configuration";
+export const DEFAULT_MCP_PATH = "/mcp";
+export function joinBaseAndPath(baseOrigin, path) {
+    const trimmedBase = baseOrigin.replace(/\/+$/, "");
+    const suffix = path.startsWith("/") ? path : `/${path}`;
+    return `${trimmedBase}${suffix}`;
+}
+export function toOrigin(rawUrl) {
+    if (!rawUrl)
+        return null;
+    try {
+        return new URL(rawUrl).origin;
+    }
+    catch {
+        return null;
+    }
+}
+export function resolveConfiguredRemoteOrigin(opts) {
+    if (opts.issuer && opts.issuer !== "auto") {
+        const fromIssuer = toOrigin(opts.issuer);
+        if (fromIssuer)
+            return fromIssuer;
+    }
+    return toOrigin(opts.publicUrl ?? null);
+}
+export function buildRemoteConnectorUrls(opts) {
+    const base = opts.baseOrigin;
+    const mcpPath = opts.mcpPath && opts.mcpPath.length > 0 ? opts.mcpPath : DEFAULT_MCP_PATH;
+    if (!base) {
+        return {
+            baseOrigin: null,
+            mcpUrl: null,
+            issuer: null,
+            authorizationUrl: null,
+            tokenUrl: null,
+            registrationUrl: null,
+            protectedResourceMetadataUrl: null,
+            authorizationServerMetadataUrl: null,
+        };
+    }
+    const oauth = opts.oauthEnabled;
+    return {
+        baseOrigin: base,
+        mcpUrl: joinBaseAndPath(base, mcpPath),
+        issuer: oauth ? base : null,
+        authorizationUrl: oauth ? joinBaseAndPath(base, OAUTH_AUTHORIZE_PATH) : null,
+        tokenUrl: oauth ? joinBaseAndPath(base, OAUTH_TOKEN_PATH) : null,
+        registrationUrl: oauth ? joinBaseAndPath(base, OAUTH_REGISTER_PATH) : null,
+        protectedResourceMetadataUrl: oauth
+            ? joinBaseAndPath(base, OAUTH_PROTECTED_RESOURCE_METADATA_PATH)
+            : null,
+        authorizationServerMetadataUrl: oauth
+            ? joinBaseAndPath(base, OAUTH_AUTHORIZATION_SERVER_METADATA_PATH)
+            : null,
+    };
+}