noodleseed-cli 0.1.4

package/dist/config.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Local CLI configuration for the hosted workflow. Persisted at `~/.mrdn/config.json` with `0600` perms
+ * (the dir `0700`) because it can hold a control-plane auth token. The token is **never logged** — only
+ * {@link maskToken}'d. Resolution precedence everywhere is **flag > env > config > default**.
+ */
+export interface MrdnConfig {
+    /** Default deploy-service base URL (e.g. `https://borg.noodleseed.com`). */
+    readonly serviceUrl?: string;
+    /** Control-plane bearer token (Google ID token in hosted alpha). Sensitive — stored `0600`, never logged. */
+    readonly authToken?: string;
+    /** Google OAuth client id used for service-backed browser login. */
+    readonly googleClientId?: string;
+    /** Stored Google refresh token for service-backed control-plane login. Sensitive. */
+    readonly refreshToken?: string;
+    /** Cached Google ID token. Sensitive; refreshed before control-plane calls when expired. */
+    readonly idToken?: string;
+    readonly idTokenExpiresAt?: string;
+    readonly identity?: {
+        readonly subject: string;
+        readonly email: string;
+    };
+    /** Default environment name (reserved; the broker becomes tenant+environment-scoped later). */
+    readonly defaultEnv?: string;
+}
+/** A locally-cached record of a deployed server. Caller keys are **live bearer credentials** — do not commit. */
+export interface SavedServer {
+    readonly deploymentId: string;
+    readonly url: string;
+    /** The once-shown caller key; absent for owner-only servers, which authenticate by identity instead. */
+    readonly callerKey?: string;
+    readonly createdAt: string;
+}
+export declare function configDir(home?: string): string;
+export declare function configPath(home?: string): string;
+export declare function serversPath(home?: string): string;
+/** Read the config, or an empty config if absent/unreadable/corrupt (never throws). */
+export declare function readConfig(home?: string): MrdnConfig;
+/** Write the config with `0700` dir / `0600` file perms (chmod even if the file pre-existed looser). */
+export declare function writeConfig(config: MrdnConfig, home?: string): void;
+/** Clear the stored auth token (logout), keeping the service URL. Removes the file if nothing remains. */
+export declare function clearConfig(home?: string): void;
+/** Read the saved-servers cache (empty if absent/corrupt). */
+export declare function readServers(home?: string): SavedServer[];
+/** Append a deployed server to the local cache (`0600`). The caller key is a live credential. */
+export declare function appendServer(server: SavedServer, home?: string): void;
+/** Resolve the effective deploy-service URL: flag > `MRDN_SERVICE_URL` > config (undefined → caller default). */
+export declare function resolveServiceUrl(flag: string | undefined, env: NodeJS.ProcessEnv, config: MrdnConfig): string | undefined;
+/** Resolve the effective control-plane auth token: flag > `MRDN_AUTH_TOKEN` > config. */
+export declare function resolveAuthToken(flag: string | undefined, env: NodeJS.ProcessEnv, config: MrdnConfig): string | undefined;
+/** Mask a token for display: `abcd…yz`, never the full value. */
+export declare function maskToken(token: string | undefined): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,6GAA6G;IAC7G,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,qFAAqF;IACrF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,+FAA+F;IAC/F,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,iHAAiH;AACjH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wGAAwG;IACxG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE1D;AACD,wBAAgB,UAAU,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE3D;AACD,wBAAgB,WAAW,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE5D;AAED,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,IAAI,GAAE,MAAkB,GAAG,UAAU,CAM/D;AAED,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,GAAE,MAAkB,GAAG,IAAI,CAE9E;AAED,0GAA0G;AAC1G,wBAAgB,WAAW,CAAC,IAAI,GAAE,MAAkB,GAAG,IAAI,CAiB1D;AAED,8DAA8D;AAC9D,wBAAgB,WAAW,CAAC,IAAI,GAAE,MAAkB,GAAG,WAAW,EAAE,CAOnE;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,GAAE,MAAkB,GAAG,IAAI,CAIhF;AAED,iHAAiH;AACjH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,UAAU,GACjB,MAAM,GAAG,SAAS,CAEpB;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,UAAU,GACjB,MAAM,GAAG,SAAS,CAEpB;AAED,iEAAiE;AACjE,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAG3D"}

package/dist/config.js

@@ -0,0 +1,77 @@
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+export function configDir(home = homedir()) {
+    return join(home, '.mrdn');
+}
+export function configPath(home = homedir()) {
+    return join(configDir(home), 'config.json');
+}
+export function serversPath(home = homedir()) {
+    return join(configDir(home), 'servers.json');
+}
+/** Read the config, or an empty config if absent/unreadable/corrupt (never throws). */
+export function readConfig(home = homedir()) {
+    try {
+        return JSON.parse(readFileSync(configPath(home), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+/** Write the config with `0700` dir / `0600` file perms (chmod even if the file pre-existed looser). */
+export function writeConfig(config, home = homedir()) {
+    writeSecure(configPath(home), `${JSON.stringify(config, null, 2)}\n`, home);
+}
+/** Clear the stored auth token (logout), keeping the service URL. Removes the file if nothing remains. */
+export function clearConfig(home = homedir()) {
+    const { authToken: _authToken, refreshToken: _refreshToken, idToken: _idToken, idTokenExpiresAt: _idTokenExpiresAt, identity: _identity, googleClientId: _googleClientId, ...rest } = readConfig(home);
+    if (Object.keys(rest).length === 0) {
+        try {
+            rmSync(configPath(home), { force: true });
+        }
+        catch { }
+        return;
+    }
+    writeConfig(rest, home);
+}
+/** Read the saved-servers cache (empty if absent/corrupt). */
+export function readServers(home = homedir()) {
+    try {
+        const parsed = JSON.parse(readFileSync(serversPath(home), 'utf8'));
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+/** Append a deployed server to the local cache (`0600`). The caller key is a live credential. */
+export function appendServer(server, home = homedir()) {
+    const list = readServers(home);
+    list.push(server);
+    writeSecure(serversPath(home), `${JSON.stringify(list, null, 2)}\n`, home);
+}
+/** Resolve the effective deploy-service URL: flag > `MRDN_SERVICE_URL` > config (undefined → caller default). */
+export function resolveServiceUrl(flag, env, config) {
+    return flag ?? env.MRDN_SERVICE_URL ?? config.serviceUrl;
+}
+/** Resolve the effective control-plane auth token: flag > `MRDN_AUTH_TOKEN` > config. */
+export function resolveAuthToken(flag, env, config) {
+    return flag ?? env.MRDN_AUTH_TOKEN ?? config.authToken;
+}
+/** Mask a token for display: `abcd…yz`, never the full value. */
+export function maskToken(token) {
+    if (!token)
+        return '(none)';
+    return token.length <= 8 ? '********' : `${token.slice(0, 4)}…${token.slice(-2)}`;
+}
+/** Write a file under `~/.mrdn` with a `0700` dir and a `0600` file (idempotent chmod). */
+function writeSecure(path, contents, home) {
+    const dir = configDir(home);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    writeFileSync(path, contents, { mode: 0o600 });
+    chmodSync(path, 0o600);
+    return path;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAoCjC,MAAM,UAAU,SAAS,CAAC,OAAe,OAAO,EAAE;IAChD,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7B,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,OAAe,OAAO,EAAE;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;AAC9C,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,OAAe,OAAO,EAAE;IAClD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,OAAe,OAAO,EAAE;IACjD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAe,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,WAAW,CAAC,MAAkB,EAAE,OAAe,OAAO,EAAE;IACtE,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,WAAW,CAAC,OAAe,OAAO,EAAE;IAClD,MAAM,EACJ,SAAS,EAAE,UAAU,EACrB,YAAY,EAAE,aAAa,EAC3B,OAAO,EAAE,QAAQ,EACjB,gBAAgB,EAAE,iBAAiB,EACnC,QAAQ,EAAE,SAAS,EACnB,cAAc,EAAE,eAAe,EAC/B,GAAG,IAAI,EACR,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACrB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,OAAO;IACT,CAAC;IACD,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,WAAW,CAAC,OAAe,OAAO,EAAE;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,YAAY,CAAC,MAAmB,EAAE,OAAe,OAAO,EAAE;IACxE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,iBAAiB,CAC/B,IAAwB,EACxB,GAAsB,EACtB,MAAkB;IAElB,OAAO,IAAI,IAAI,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC,UAAU,CAAC;AAC3D,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,gBAAgB,CAC9B,IAAwB,EACxB,GAAsB,EACtB,MAAkB;IAElB,OAAO,IAAI,IAAI,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,SAAS,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,2FAA2F;AAC3F,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB,EAAE,IAAY;IAC/D,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/control-plane.d.ts

@@ -0,0 +1,33 @@
+import type { MrdnConfig } from './config.js';
+export interface ServiceAuthMetadata {
+    readonly ok: true;
+    readonly service: string;
+    readonly googleClientId: string | null;
+    readonly allowedEmailDomain: string;
+    readonly authType: string;
+}
+export interface LoginResult {
+    readonly serviceUrl: string;
+    readonly email?: string;
+    readonly subject?: string;
+}
+export declare function browserLogin(input: {
+    readonly serviceUrl: string;
+    readonly home: string;
+    readonly openBrowser?: (url: string) => void;
+    readonly fetchImpl?: typeof fetch;
+}): Promise<LoginResult>;
+export declare function getAuthMetadata(serviceUrl: string, fetchImpl?: typeof fetch): Promise<ServiceAuthMetadata>;
+export declare function resolveControlPlaneToken(input: {
+    readonly serviceFlag?: string | undefined;
+    readonly authFlag?: string | undefined;
+    readonly env: NodeJS.ProcessEnv;
+    readonly home: string;
+    readonly fetchImpl?: typeof fetch | undefined;
+}): Promise<{
+    readonly serviceUrl: string;
+    readonly token?: string;
+    readonly config: MrdnConfig;
+}>;
+export declare function serviceJson<T>(url: string, token: string | undefined, init?: RequestInit, fetchImpl?: typeof fetch): Promise<T>;
+//# sourceMappingURL=control-plane.d.ts.map

package/dist/control-plane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAO9C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACnC,GAAG,OAAO,CAAC,WAAW,CAAC,CA4CvB;AAED,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAM9B;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;CAC/C,GAAG,OAAO,CAAC;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC,CA8BjG;AAED,wBAAsB,WAAW,CAAC,CAAC,EACjC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,IAAI,GAAE,WAAgB,EACtB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,CAAC,CAAC,CAeZ"}

package/dist/control-plane.js

@@ -0,0 +1,223 @@
+import { spawn } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { readConfig, resolveServiceUrl, writeConfig } from './config.js';
+import { DEFAULT_SERVICE_URL } from './deploy.js';
+const GOOGLE_AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
+const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
+export async function browserLogin(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const serviceUrl = normalizeServiceUrl(input.serviceUrl);
+    const metadata = await getAuthMetadata(serviceUrl, fetchImpl);
+    if (!metadata.googleClientId) {
+        writeConfig({ ...readConfig(input.home), serviceUrl }, input.home);
+        return { serviceUrl };
+    }
+    const verifier = base64Url(randomBytes(32));
+    const challenge = base64Url(createHash('sha256').update(verifier).digest());
+    const state = base64Url(randomBytes(24));
+    const callback = await waitForCallback(state);
+    const redirectUri = `http://127.0.0.1:${callback.port}/callback`;
+    const authUrl = new URL(GOOGLE_AUTH_URL);
+    authUrl.searchParams.set('client_id', metadata.googleClientId);
+    authUrl.searchParams.set('redirect_uri', redirectUri);
+    authUrl.searchParams.set('response_type', 'code');
+    authUrl.searchParams.set('scope', 'openid email profile');
+    authUrl.searchParams.set('code_challenge', challenge);
+    authUrl.searchParams.set('code_challenge_method', 'S256');
+    authUrl.searchParams.set('state', state);
+    authUrl.searchParams.set('access_type', 'offline');
+    authUrl.searchParams.set('prompt', 'consent');
+    (input.openBrowser ?? openBrowser)(authUrl.toString());
+    const code = await callback.code;
+    const token = await exchangeCode({
+        clientId: metadata.googleClientId,
+        code,
+        verifier,
+        redirectUri,
+        fetchImpl,
+    });
+    const identity = decodeIdentity(token.idToken);
+    const config = {
+        ...readConfig(input.home),
+        serviceUrl,
+        googleClientId: metadata.googleClientId,
+        idToken: token.idToken,
+        idTokenExpiresAt: expiresAt(token.expiresIn),
+        ...(token.refreshToken !== undefined ? { refreshToken: token.refreshToken } : {}),
+        ...(identity !== undefined ? { identity } : {}),
+    };
+    writeConfig(config, input.home);
+    return { serviceUrl, ...(identity ?? {}) };
+}
+export async function getAuthMetadata(serviceUrl, fetchImpl = fetch) {
+    const res = await fetchImpl(`${normalizeServiceUrl(serviceUrl)}/v1/auth/google`, {
+        headers: { accept: 'application/json' },
+    });
+    if (!res.ok)
+        throw new Error(`service auth metadata failed (${res.status})`);
+    return (await res.json());
+}
+export async function resolveControlPlaneToken(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    let config = readConfig(input.home);
+    const serviceUrl = normalizeServiceUrl(resolveServiceUrl(input.serviceFlag, input.env, config) ?? DEFAULT_SERVICE_URL);
+    const override = input.authFlag ?? input.env.MRDN_AUTH_TOKEN;
+    if (override !== undefined)
+        return { serviceUrl, token: override, config };
+    if (config.authToken !== undefined)
+        return { serviceUrl, token: config.authToken, config };
+    if (config.idToken !== undefined && !isExpiring(config.idTokenExpiresAt)) {
+        return { serviceUrl, token: config.idToken, config };
+    }
+    if (config.refreshToken !== undefined && config.googleClientId !== undefined) {
+        const refreshed = await refreshIdToken({
+            clientId: config.googleClientId,
+            refreshToken: config.refreshToken,
+            fetchImpl,
+        });
+        const identity = decodeIdentity(refreshed.idToken);
+        config = {
+            ...config,
+            serviceUrl,
+            idToken: refreshed.idToken,
+            idTokenExpiresAt: expiresAt(refreshed.expiresIn),
+            ...(identity !== undefined ? { identity } : {}),
+        };
+        writeConfig(config, input.home);
+        return { serviceUrl, token: refreshed.idToken, config };
+    }
+    return { serviceUrl, config };
+}
+export async function serviceJson(url, token, init = {}, fetchImpl = fetch) {
+    const headers = new Headers(init.headers);
+    headers.set('accept', 'application/json');
+    if (token !== undefined)
+        headers.set('authorization', `Bearer ${token}`);
+    const res = await fetchImpl(url, { ...init, headers });
+    if (!res.ok) {
+        let message = `request failed (${res.status})`;
+        try {
+            const body = (await res.json());
+            if (typeof body.error === 'string')
+                message = body.error;
+        }
+        catch { }
+        throw new Error(message);
+    }
+    if (res.status === 204)
+        return undefined;
+    return (await res.json());
+}
+function normalizeServiceUrl(value) {
+    return value.replace(/\/+$/, '');
+}
+function isExpiring(iso) {
+    if (iso === undefined)
+        return true;
+    return Date.parse(iso) - Date.now() < 60_000;
+}
+function expiresAt(expiresIn) {
+    return new Date(Date.now() + Math.max(0, expiresIn - 60) * 1000).toISOString();
+}
+function decodeIdentity(idToken) {
+    const parts = idToken.split('.');
+    const payload = parts[1];
+    if (payload === undefined)
+        return undefined;
+    try {
+        const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        return typeof decoded.sub === 'string' && typeof decoded.email === 'string'
+            ? { subject: decoded.sub, email: decoded.email.toLowerCase() }
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function base64Url(bytes) {
+    return bytes.toString('base64url');
+}
+async function exchangeCode(input) {
+    const params = new URLSearchParams({
+        client_id: input.clientId,
+        code: input.code,
+        code_verifier: input.verifier,
+        grant_type: 'authorization_code',
+        redirect_uri: input.redirectUri,
+    });
+    return parseGoogleTokenResponse(await input.fetchImpl(GOOGLE_TOKEN_URL, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: params,
+    }));
+}
+async function refreshIdToken(input) {
+    const params = new URLSearchParams({
+        client_id: input.clientId,
+        refresh_token: input.refreshToken,
+        grant_type: 'refresh_token',
+    });
+    return parseGoogleTokenResponse(await input.fetchImpl(GOOGLE_TOKEN_URL, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: params,
+    }));
+}
+async function parseGoogleTokenResponse(res) {
+    const body = (await res.json());
+    if (!res.ok || typeof body.id_token !== 'string') {
+        const message = typeof body.error_description === 'string'
+            ? body.error_description
+            : typeof body.error === 'string'
+                ? body.error
+                : `Google token exchange failed (${res.status})`;
+        throw new Error(message);
+    }
+    return {
+        idToken: body.id_token,
+        ...(typeof body.refresh_token === 'string' ? { refreshToken: body.refresh_token } : {}),
+        expiresIn: typeof body.expires_in === 'number' ? body.expires_in : 3600,
+    };
+}
+async function waitForCallback(expectedState) {
+    let resolveCode;
+    let rejectCode;
+    const code = new Promise((resolve, reject) => {
+        resolveCode = resolve;
+        rejectCode = reject;
+    });
+    const server = createServer((req, res) => {
+        const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+        const gotState = url.searchParams.get('state');
+        const gotCode = url.searchParams.get('code');
+        const error = url.searchParams.get('error');
+        if (error !== null) {
+            res.writeHead(400, { 'content-type': 'text/plain; charset=utf-8' });
+            res.end('Login failed. You can close this tab.');
+            rejectCode(new Error(error));
+        }
+        else if (gotState !== expectedState || gotCode === null) {
+            res.writeHead(400, { 'content-type': 'text/plain; charset=utf-8' });
+            res.end('Invalid login callback. You can close this tab.');
+            rejectCode(new Error('invalid login callback'));
+        }
+        else {
+            res.writeHead(200, { 'content-type': 'text/plain; charset=utf-8' });
+            res.end('Login complete. You can close this tab.');
+            resolveCode(gotCode);
+        }
+        server.close();
+    });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const { port } = server.address();
+    return { port, code };
+}
+function openBrowser(url) {
+    const platform = process.platform;
+    const command = platform === 'darwin' ? 'open' : platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    const child = spawn(command, args, { detached: true, stdio: 'ignore' });
+    child.unref();
+}
+//# sourceMappingURL=control-plane.js.map

package/dist/control-plane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane.js","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAGpF,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,eAAe,GAAG,8CAA8C,CAAC;AACvE,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAgB/D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAKlC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC7B,WAAW,CAAC,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,oBAAoB,QAAQ,CAAC,IAAI,WAAW,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC/D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACnD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC,KAAK,CAAC,WAAW,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC;QAC/B,QAAQ,EAAE,QAAQ,CAAC,cAAc;QACjC,IAAI;QACJ,QAAQ;QACR,WAAW;QACX,SAAS;KACV,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAe;QACzB,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;QACzB,UAAU;QACV,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;QAC5C,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IACF,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,YAA0B,KAAK;IAE/B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,mBAAmB,CAAC,UAAU,CAAC,iBAAiB,EAAE;QAC/E,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAM9C;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,IAAI,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,mBAAmB,CACpC,iBAAiB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,mBAAmB,CAC/E,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC;IAC7D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC3E,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAC3F,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7E,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC;YACrC,QAAQ,EAAE,MAAM,CAAC,cAAc;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS;SACV,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,GAAG;YACP,GAAG,MAAM;YACT,UAAU;YACV,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,gBAAgB,EAAE,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC;YAChD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC;QACF,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAW,EACX,KAAyB,EACzB,OAAoB,EAAE,EACtB,YAA0B,KAAK;IAE/B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,OAAO,GAAG,mBAAmB,GAAG,CAAC,MAAM,GAAG,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;YACvD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAG5E,CAAC;QACF,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YACzE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;YAC9D,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAM3B;IACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,QAAQ;QAC7B,UAAU,EAAE,oBAAoB;QAChC,YAAY,EAAE,KAAK,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,OAAO,wBAAwB,CAC7B,MAAM,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAAE;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM;KACb,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAI7B;IACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,UAAU,EAAE,eAAe;KAC5B,CAAC,CAAC;IACH,OAAO,wBAAwB,CAC7B,MAAM,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAAE;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM;KACb,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,GAAa;IAEb,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAM7B,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;YACxC,CAAC,CAAC,IAAI,CAAC,iBAAiB;YACxB,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAC9B,CAAC,CAAC,IAAI,CAAC,KAAK;gBACZ,CAAC,CAAC,iCAAiC,GAAG,CAAC,MAAM,GAAG,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,GAAG,CAAC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;KACxE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,aAAqB;IAIlD,IAAI,WAAoC,CAAC;IACzC,IAAI,UAAmC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,WAAW,GAAG,OAAO,CAAC;QACtB,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACxE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACjD,UAAU,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,QAAQ,KAAK,aAAa,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC3D,UAAU,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACnD,WAAW,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3F,MAAM,IAAI,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/dist/deploy.d.ts

@@ -0,0 +1,62 @@
+export declare const DEFAULT_SERVICE_URL = "http://127.0.0.1:8787";
+export interface DeployOptions {
+    readonly manifestPath: string;
+    /** Optional declarative connector-catalog file, so deployed tools can call APIs. */
+    readonly connectorsPath?: string;
+    /** Optional local JSON file of `name -> value` secrets (keep it out of the repo). */
+    readonly secretsPath?: string;
+    readonly serviceUrl?: string;
+    /** Control-plane bearer token for hosted management endpoints (`Authorization: Bearer <token>`). */
+    readonly authToken?: string;
+    readonly org?: string;
+    readonly app?: string;
+    readonly env?: string;
+    /**
+     * Access mode for the deployed endpoint. Identity modes (`owner-only`, `org-members`) gate the MCP endpoint
+     * on verified identity and mint no caller key; default `caller-key` keeps the shared per-server bearer.
+     */
+    readonly accessMode?: AccessMode;
+    /** Injectable for tests; defaults to the global `fetch`. */
+    readonly fetchImpl?: typeof fetch;
+    /** Injectable for tests; defaults to `process.env`. Source of `NOODLE_SECRET_<NAME>` values. */
+    readonly secretsEnv?: NodeJS.ProcessEnv;
+}
+export type DeployOutcome = {
+    readonly ok: true;
+    readonly deploymentId: string;
+    readonly url: string;
+    readonly accessMode: AccessMode;
+    /** Present only for `caller-key` deployments; identity modes mint no key. */
+    readonly callerKey?: string;
+} | {
+    readonly ok: false;
+    readonly status: number;
+    readonly message: string;
+    readonly errors?: unknown;
+};
+/**
+ * Read a manifest file and POST it to a deploy service. Returns the deployed server's id + endpoint URL,
+ * or a structured failure (unreachable service, or a `4xx` with compile errors).
+ */
+export declare function deploy(options: DeployOptions): Promise<DeployOutcome>;
+export type AccessMode = 'caller-key' | 'owner-only' | 'org-members';
+/**
+ * Collect deploy-time secret *values* from a local `--secrets` JSON file and/or `NOODLE_SECRET_<NAME>`
+ * environment variables, with env overriding the file. Returns `undefined` when nothing is supplied, so
+ * the deploy body omits `secrets` entirely. Secret values never touch the catalog or manifest — they ride
+ * this side channel only. Throws on a malformed file (caught by `deploy` and surfaced without any value).
+ */
+export declare function loadSecrets(secretsPath: string | undefined, env: NodeJS.ProcessEnv): Record<string, string> | undefined;
+/**
+ * Read a deploy input into `{ manifest, connectors? }`. A `.yaml`/`.json` manifest is taken verbatim; an
+ * authored `.ts`/`.js` server is loaded and emits both its manifest and (if it has `.compute()` operations)
+ * a connector catalog, so authoring a compute server in TypeScript deploys in one command.
+ *
+ * Exported so `validate` reuses the exact same input-loading path as `deploy` (including the `server.ts`
+ * authoring leg), keeping author-time validation faithful to what a deploy would compile.
+ */
+export declare function readDeployInput(path: string): Promise<{
+    manifest: string;
+    connectors?: string;
+}>;
+//# sourceMappingURL=deploy.d.ts.map

package/dist/deploy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,qFAAqF;IACrF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,gGAAgG;IAChG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzC;AAID,MAAM,MAAM,aAAa,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEN;;;GAGG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CA+E3E;AAED,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC;AAerE;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAsBpC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAUpD"}