offrouter-core 0.2.1 → 0.3.0

package/dist/auth/oauth-server.js

@@ -0,0 +1,295 @@
+/**
+ * Local OAuth callback server for OffRouter's live PKCE login flow.
+ *
+ * Binds to 127.0.0.1 ONLY (never 0.0.0.0) so the provider can redirect back
+ * to this machine without exposing the callback to the network. The server
+ * captures the authorization `code` + `state` from the redirect and hands them
+ * to the caller; it never touches tokens, secrets, or the network beyond the
+ * single loopback HTTP socket.
+ */
+import { createServer } from "node:http";
+import { URL } from "node:url";
+/** Loopback-only hostname. Hardcoded to prevent accidental 0.0.0.0 binds. */
+const LOOPBACK_HOST = "127.0.0.1";
+/** Path the provider redirects to (http://localhost:PORT/callback). */
+const CALLBACK_PATH = "/callback";
+/**
+ * Start a loopback HTTP server that captures an OAuth authorization code.
+ * Pass port 0 to let the OS choose a free port (read handle.port afterwards).
+ */
+export function startCallbackServer(port, options = {}) {
+    return new Promise((resolve, reject) => {
+        const serverLevelState = options.expectedState;
+        const effectiveCallbackPath = options.callbackPath ?? CALLBACK_PATH;
+        // Deferred for the first valid callback (has a `code` param).
+        let captured = null;
+        const waiters = [];
+        const httpServer = createServer((req, res) => {
+            handleCallback(req, res);
+        });
+        function handleCallback(req, res) {
+            // Only respond to GET on the callback path; everything else 404s.
+            if (req.method !== "GET") {
+                res.writeHead(405, { "content-type": "text/plain; charset=utf-8" });
+                res.end("Method Not Allowed");
+                return;
+            }
+            let parsedUrl;
+            try {
+                parsedUrl = new URL(req.url ?? "/", `http://${LOOPBACK_HOST}`);
+            }
+            catch {
+                res.writeHead(400, { "content-type": "text/plain; charset=utf-8" });
+                res.end("Bad Request");
+                return;
+            }
+            const pathname = parsedUrl.pathname;
+            const code = parsedUrl.searchParams.get("code");
+            const state = parsedUrl.searchParams.get("state");
+            const error = parsedUrl.searchParams.get("error");
+            // OAuth error from the provider (e.g. user denied consent).
+            if (error) {
+                res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+                res.end(authorizationDeniedPage(error));
+                return;
+            }
+            if (pathname !== effectiveCallbackPath) {
+                res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+                res.end("Not Found");
+                return;
+            }
+            // Missing code -> provider returned nothing usable.
+            if (!code) {
+                res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+                res.end(missingCodePage());
+                return;
+            }
+            // Capture the first valid callback exactly once.
+            const callback = { code, state: state ?? "" };
+            if (!captured) {
+                captured = callback;
+                // Resolve any pending waiters that accept this callback.
+                const pending = waiters.splice(0, waiters.length);
+                for (const w of pending) {
+                    w.resolve(callback);
+                }
+            }
+            // Always show the user a friendly page; security validation happens in
+            // waitForCode (state may not be known at request time).
+            res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+            res.end(successPage());
+        }
+        httpServer.on("error", (err) => {
+            reject(new Error(`Failed to start OAuth callback server on 127.0.0.1:${port}: ${err.message}`, { cause: err }));
+        });
+        httpServer.listen(port, LOOPBACK_HOST, () => {
+            const address = httpServer.address();
+            const boundPort = address && typeof address === "object" ? address.port : port;
+            const redirectUrl = `http://localhost:${boundPort}${effectiveCallbackPath}`;
+            const handle = {
+                url: redirectUrl,
+                port: boundPort,
+                waitForCode(waitOpts = {}) {
+                    const expected = waitOpts.expectedState !== undefined
+                        ? waitOpts.expectedState
+                        : serverLevelState;
+                    const timeoutMs = waitOpts.timeoutMs ?? 5 * 60 * 1000;
+                    return new Promise((resolveWait, rejectWait) => {
+                        let settled = false;
+                        const settle = (outcome, isReject) => {
+                            if (settled)
+                                return;
+                            settled = true;
+                            clearTimeout(timer);
+                            waitOpts.signal?.removeEventListener("abort", onAbort);
+                            if (isReject) {
+                                rejectWait(outcome);
+                            }
+                            else {
+                                resolveWait(outcome);
+                            }
+                        };
+                        const onAbort = () => {
+                            settle(new Error("OAuth callback wait was aborted."), true);
+                        };
+                        const timer = setTimeout(() => {
+                            settle(new Error("OAuth login timed out waiting for callback."), true);
+                        }, timeoutMs);
+                        if (waitOpts.signal?.aborted) {
+                            settle(new Error("OAuth callback wait was aborted."), true);
+                            return;
+                        }
+                        waitOpts.signal?.addEventListener("abort", onAbort);
+                        const resolveWith = (callback) => {
+                            if (expected !== undefined && callback.state !== expected) {
+                                settle(new Error(`OAuth state mismatch: expected "${redactState(expected)}" ` +
+                                    `but received "${redactState(callback.state)}". ` +
+                                    `This may indicate a CSRF attempt or a stale login tab.`), true);
+                                return;
+                            }
+                            settle(callback, false);
+                        };
+                        if (captured) {
+                            resolveWith(captured);
+                            return;
+                        }
+                        waiters.push({ resolve: resolveWith, reject: rejectWait });
+                    });
+                },
+                close() {
+                    return new Promise((resolveClose) => {
+                        httpServer.close(() => resolveClose());
+                        // close() waits for in-flight connections; closeAllConnections is
+                        // available on Node 18+ and speeds shutdown without dropping the
+                        // response the user's browser is mid-receiving.
+                        // (Not called here to keep the success page delivery intact.)
+                    });
+                },
+            };
+            resolve(handle);
+        });
+    });
+}
+// ---------------------------------------------------------------------------
+// Static HTML pages (ASCII-only, no secret material)
+// ---------------------------------------------------------------------------
+// ---------------------------------------------------------------------------
+// Styled HTML pages (dark theme, OffRouter branding)
+// ---------------------------------------------------------------------------
+const STYLED_HTML_TEMPLATE = `
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>OffRouter &mdash; $$TITLE</title>
+  <style>
+    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+    body {
+      background: #09090b;
+      color: #fafafa;
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
+      display: flex;
+      justify-content: center;
+      align-items: center;
+      min-height: 100vh;
+      padding: 1rem;
+    }
+    .card {
+      background: #18181b;
+      border: 1px solid #27272a;
+      border-radius: 12px;
+      padding: 2.5rem;
+      max-width: 560px;
+      width: 100%;
+      text-align: center;
+    }
+    .logo {
+      margin-bottom: 1.5rem;
+    }
+    .logo svg {
+      width: 48px;
+      height: 48px;
+    }
+    .icon {
+      margin-bottom: 1rem;
+    }
+    .icon-success {
+      color: #22c55e;
+    }
+    .icon-error {
+      color: #ef4444;
+    }
+    h1 {
+      font-size: 1.5rem;
+      font-weight: 600;
+      margin-bottom: 0.75rem;
+    }
+    p {
+      color: #a1a1aa;
+      line-height: 1.6;
+      margin-bottom: 1.5rem;
+    }
+    .details {
+      background: #27272a;
+      border-radius: 8px;
+      padding: 1rem;
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+      font-size: 0.875rem;
+      color: #fafafa;
+      word-break: break-word;
+      text-align: left;
+      margin-bottom: 1.5rem;
+    }
+    .link {
+      color: #a1a1aa;
+      font-size: 0.875rem;
+    }
+    .link a {
+      color: #fafafa;
+      text-decoration: underline;
+    }
+    .link a:hover {
+      color: #ffffff;
+    }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="logo">
+      <svg viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg">
+        <circle cx="24" cy="24" r="20" stroke="#fafafa" stroke-width="2"/>
+        <circle cx="24" cy="24" r="9" stroke="#fafafa" stroke-width="2"/>
+        <circle cx="24" cy="24" r="3" fill="#fafafa"/>
+        <line x1="24" y1="4" x2="24" y2="14" stroke="#fafafa" stroke-width="2" stroke-linecap="round"/>
+        <line x1="24" y1="34" x2="24" y2="44" stroke="#fafafa" stroke-width="2" stroke-linecap="round"/>
+        <line x1="4" y1="24" x2="14" y2="24" stroke="#fafafa" stroke-width="2" stroke-linecap="round"/>
+        <line x1="34" y1="24" x2="44" y2="24" stroke="#fafafa" stroke-width="2" stroke-linecap="round"/>
+        <line x1="8.2" y1="8.2" x2="15.5" y2="15.5" stroke="#fafafa" stroke-width="2" stroke-linecap="round"/>
+        <line x1="32.5" y1="32.5" x2="39.8" y2="39.8" stroke="#fafafa" stroke-width="2" stroke-linecap="round"/>
+        <line x1="39.8" y1="8.2" x2="32.5" y2="15.5" stroke="#fafafa" stroke-width="2" stroke-linecap="round"/>
+        <line x1="15.5" y1="32.5" x2="8.2" y2="39.8" stroke="#fafafa" stroke-width="2" stroke-linecap="round"/>
+      </svg>
+    </div>
+    $$CONTENT
+    <div class="link">
+      <a href="https://offrouter.com" target="_blank" rel="noopener noreferrer">Visit offrouter.com</a>
+    </div>
+  </div>
+</body>
+</html>`;
+function styledPage(title, icon, heading, details) {
+    const content = [
+        `<div class="icon ${icon === "✓" ? "icon-success" : "icon-error"}" style="font-size: 2.5rem;">${icon}</div>`,
+        `<h1>${heading}</h1>`,
+        details ? `<p>${details}</p>` : "",
+    ].join("\n");
+    return STYLED_HTML_TEMPLATE
+        .replace("$$TITLE", title)
+        .replace("$$CONTENT", content);
+}
+function successPage() {
+    return styledPage("Authentication successful", "✓", "Authentication successful", "You can close this tab and return to your terminal.");
+}
+function authorizationDeniedPage(error) {
+    const safe = escapeHtml(error);
+    return styledPage("Authentication failed", "✗", "Authentication failed", `The provider reported: <strong>${safe}</strong>. You can close this tab and try again from your terminal.`);
+}
+function missingCodePage() {
+    return styledPage("Authentication incomplete", "✗", "Authentication incomplete", "The callback did not include an authorization code. Please try again from your terminal.");
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+/** Truncate a state token for error messages so it is never echoed in full. */
+function redactState(state) {
+    if (state.length <= 8)
+        return "***";
+    return `${state.slice(0, 4)}...${state.slice(-4)}`;
+}
+//# sourceMappingURL=oauth-server.js.map

package/dist/auth/oauth-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.js","sourceRoot":"","sources":["../../src/auth/oauth-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,6EAA6E;AAC7E,MAAM,aAAa,GAAG,WAAW,CAAC;AAElC,uEAAuE;AACvE,MAAM,aAAa,GAAG,WAAW,CAAC;AAsClC;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,UAAiC,EAAE;IAEnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC;QAC/C,MAAM,qBAAqB,GAAG,OAAO,CAAC,YAAY,IAAI,aAAa,CAAC;QAEpE,8DAA8D;QAC9D,IAAI,QAAQ,GAAwB,IAAI,CAAC;QACzC,MAAM,OAAO,GAGR,EAAE,CAAC;QAER,MAAM,UAAU,GAAW,YAAY,CACrC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YAC5C,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CACF,CAAC;QAEF,SAAS,cAAc,CAAC,GAAoB,EAAE,GAAmB;YAC/D,kEAAkE;YAClE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBAC9B,OAAO;YACT,CAAC;YAED,IAAI,SAAc,CAAC;YACnB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,aAAa,EAAE,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;YACpC,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAElD,4DAA4D;YAC5D,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,KAAK,qBAAqB,EAAE,CAAC;gBACvC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,oDAAoD;YACpD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,iDAAiD;YACjD,MAAM,QAAQ,GAAiB,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,QAAQ,CAAC;gBACpB,yDAAyD;gBACzD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YAED,uEAAuE;YACvE,wDAAwD;YACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACzB,CAAC;QAED,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YACpD,MAAM,CACJ,IAAI,KAAK,CACP,sDAAsD,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,EAC5E,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE;YAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,SAAS,GACb,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/D,MAAM,WAAW,GAAG,oBAAoB,SAAS,GAAG,qBAAqB,EAAE,CAAC;YAE5E,MAAM,MAAM,GAAyB;gBACnC,GAAG,EAAE,WAAW;gBAChB,IAAI,EAAE,SAAS;gBACf,WAAW,CAAC,WAA+B,EAAE;oBAC3C,MAAM,QAAQ,GACZ,QAAQ,CAAC,aAAa,KAAK,SAAS;wBAClC,CAAC,CAAC,QAAQ,CAAC,aAAa;wBACxB,CAAC,CAAC,gBAAgB,CAAC;oBACvB,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;oBAEtD,OAAO,IAAI,OAAO,CAAe,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE;wBAC3D,IAAI,OAAO,GAAG,KAAK,CAAC;wBAEpB,MAAM,MAAM,GAAG,CACb,OAA6B,EAC7B,QAAiB,EACX,EAAE;4BACR,IAAI,OAAO;gCAAE,OAAO;4BACpB,OAAO,GAAG,IAAI,CAAC;4BACf,YAAY,CAAC,KAAK,CAAC,CAAC;4BACpB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;4BACvD,IAAI,QAAQ,EAAE,CAAC;gCACb,UAAU,CAAC,OAAgB,CAAC,CAAC;4BAC/B,CAAC;iCAAM,CAAC;gCACN,WAAW,CAAC,OAAuB,CAAC,CAAC;4BACvC,CAAC;wBACH,CAAC,CAAC;wBAEF,MAAM,OAAO,GAAG,GAAS,EAAE;4BACzB,MAAM,CACJ,IAAI,KAAK,CAAC,kCAAkC,CAAC,EAC7C,IAAI,CACL,CAAC;wBACJ,CAAC,CAAC;wBAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;4BAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,EAAE,IAAI,CAAC,CAAC;wBACzE,CAAC,EAAE,SAAS,CAAC,CAAC;wBAEd,IAAI,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;4BAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,EAAE,IAAI,CAAC,CAAC;4BAC5D,OAAO;wBACT,CAAC;wBACD,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBAEpD,MAAM,WAAW,GAAG,CAAC,QAAsB,EAAQ,EAAE;4BACnD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gCAC1D,MAAM,CACJ,IAAI,KAAK,CACP,mCAAmC,WAAW,CAAC,QAAQ,CAAC,IAAI;oCAC1D,iBAAiB,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK;oCACjD,wDAAwD,CAC3D,EACD,IAAI,CACL,CAAC;gCACF,OAAO;4BACT,CAAC;4BACD,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;wBAC1B,CAAC,CAAC;wBAEF,IAAI,QAAQ,EAAE,CAAC;4BACb,WAAW,CAAC,QAAQ,CAAC,CAAC;4BACtB,OAAO;wBACT,CAAC;wBAED,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC7D,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK;oBACH,OAAO,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,EAAE;wBACxC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;wBACvC,kEAAkE;wBAClE,iEAAiE;wBACjE,gDAAgD;wBAChD,8DAA8D;oBAChE,CAAC,CAAC,CAAC;gBACL,CAAC;aACF,CAAC;YAEF,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAE9E,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAE9E,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAqGrB,CAAC;AAET,SAAS,UAAU,CAAC,KAAa,EAAE,IAAY,EAAE,OAAe,EAAE,OAAe;IAC/E,MAAM,OAAO,GAAG;QACd,oBAAoB,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,gCAAgC,IAAI,QAAQ;QAC5G,OAAO,OAAO,OAAO;QACrB,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE;KACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,oBAAoB;SACxB,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC;SACzB,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,UAAU,CACf,2BAA2B,EAC3B,GAAG,EACH,2BAA2B,EAC3B,qDAAqD,CACtD,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,UAAU,CACf,uBAAuB,EACvB,GAAG,EACH,uBAAuB,EACvB,kCAAkC,IAAI,qEAAqE,CAC5G,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,UAAU,CACf,2BAA2B,EAC3B,GAAG,EACH,2BAA2B,EAC3B,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,76 @@
+import type { PolicyConfig } from "./policy.js";
+/** Defaults applied when user config omits policy knobs. */
+export interface PolicyDefaults {
+    subscriptionFirst: boolean;
+    allowApiKeyFallback: boolean;
+}
+/** Declared provider entry from config (no secrets here). */
+export interface ConfiguredProvider {
+    id: string;
+    enabled: boolean;
+    accounts: ConfiguredAccount[];
+}
+/** Named profile overlay loaded from profiles/*.toml. */
+export interface ConfiguredProfile {
+    id: string;
+    deniedProviders?: string[];
+    allowApiKeyFallback?: boolean;
+    subscriptionFirst?: boolean;
+}
+/** Single configured account within a provider. */
+export interface ConfiguredAccount {
+    id: string;
+    label?: string;
+}
+export interface ConfigWarning {
+    filePath: string;
+    path: string;
+    message: string;
+}
+export interface OffRouterConfig {
+    homeDir: string;
+    sources: string[];
+    policy: PolicyConfig;
+    policyDefaults: PolicyDefaults;
+    providers: Record<string, ConfiguredProvider>;
+    profiles: Record<string, ConfiguredProfile>;
+    warnings: ConfigWarning[];
+}
+export interface LoadConfigOptions {
+    /** Override process.env (for tests). */
+    env?: NodeJS.ProcessEnv;
+    /** Override os.homedir (for tests). */
+    homedir?: () => string;
+    /** Workspace directory that may contain .offrouter/config.toml. */
+    workspaceDir?: string;
+    /**
+     * Whether the workspace is trusted. Project config is ignored when false
+     * or when workspaceDir is unset.
+     */
+    workspaceTrusted?: boolean;
+}
+export interface ResolveHomeOptions {
+    env?: NodeJS.ProcessEnv;
+    homedir?: () => string;
+}
+export declare class ConfigError extends Error {
+    readonly filePath: string;
+    readonly issues: string[];
+    constructor(filePath: string, issues: string[], cause?: unknown);
+}
+/**
+ * Safe default config: work profiles denied, nothing allowlisted, no providers.
+ */
+export declare function defaultConfig(homeDir?: string): OffRouterConfig;
+export declare function resolveOffRouterHome(options?: ResolveHomeOptions): string;
+/**
+ * Load OffRouter configuration.
+ *
+ * Resolution order:
+ * 1. defaults (deny *-work, empty allowlist, no providers)
+ * 2. `$OFFROUTER_HOME/config.toml` or `~/.offrouter/config.toml`
+ * 3. `$OFFROUTER_HOME/profiles/*.toml`
+ * 4. `<workspace>/.offrouter/config.toml` only when workspaceTrusted
+ */
+export declare function loadConfig(options?: LoadConfigOptions): Promise<OffRouterConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC9C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC5C,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;CACxB;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBAEd,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,OAAO;CAUhE;AA+DD;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,SAAK,GAAG,eAAe,CAkB3D;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,kBAAuB,GAC/B,MAAM,CAQR;AAsSD;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,eAAe,CAAC,CAe1B"}