starmux 0.13.0 → 0.14.0

package/dist/src/mcp-upstream-router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-upstream-router.js","sourceRoot":"","sources":["../../src/mcp-upstream-router.ts"],"names":[],"mappings":"AACA,kFAAkF;AAClF,kFAAkF;AAClF,oEAAoE;AACpE,MAAM,OAAO,aAAc,SAAQ,KAAK;IACV;IAA5B,YAA4B,IAAY;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAA1B,SAAI,GAAJ,IAAI,CAAQ;IAAc,CAAC;CACxD;AACD,SAAS,OAAO,CAAC,OAAe,IAAS,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA,CAAC;AAC3E,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAG,QAAQ,IAAE,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAC,EAAC,MAAM,EAAC,YAAY,GAAC,SAAS,EAAqD;IACzH,IAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAE,MAAM,CAAC,MAAM,KAAG,CAAC;QAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxE,MAAM,OAAO,GAAC,IAAI,GAAG,EAAyH,EAAC,UAAU,GAAC,IAAI,GAAG,EAAU,EAAC,OAAO,GAAQ,EAAE,EAAC,UAAU,GAAa,EAAE,CAAC;IACxN,KAAI,MAAM,EAAC,EAAE,EAAC,QAAQ,EAAC,iBAAiB,GAAC,KAAK,EAAC,SAAS,GAAC,IAAI,EAAC,IAAI,MAAM,EAAC,CAAC;QACxE,IAAG,CAAC,UAAU,CAAC,EAAE,CAAC,IAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;QAC7E,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnB,IAAG,CAAC,QAAQ,IAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;YACpD,OAAO,QAAQ,CAAC,0BAA0B,KAAG,UAAU;YAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACtF,MAAM,KAAK,GAAC,IAAI,GAAG,EAAE,CAAC;QACtB,KAAI,MAAM,IAAI,IAAI,QAAQ,CAAC,eAAe,EAAC,CAAC;YAC1C,IAAG,OAAO,IAAI,EAAE,IAAI,KAAG,QAAQ,IAAE,CAAC,IAAI,CAAC,IAAI,IAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC/D,CAAC,IAAI,CAAC,WAAW,IAAE,OAAO,IAAI,CAAC,WAAW,KAAG,QAAQ;gBACrD,OAAO,CAAC,0BAA0B,CAAC,CAAC;YACtC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,UAAU,GAAC,iBAAiB,CAAA,CAAC,CAAA,IAAI,CAAC,IAAI,CAAA,CAAC,CAAA,EAAE,GAAC,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC;YAC/D,IAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAE,UAAU,KAAG,cAAc;gBACrD,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC;gBAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;YACzE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAC,EAAC,KAAK,EAAC,EAAE,EAAC,UAAU,EAAC,IAAI,CAAC,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,CAAC,CAAC;YAC3E,OAAO,CAAC,IAAI,CAAC,EAAC,GAAG,eAAe,CAAC,IAAI,CAAC,EAAC,IAAI,EAAC,UAAU,EAAC,CAAC,CAAC;QAC3D,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAC,EAAE,EAAC,SAAS,EAAC,KAAK,CAAC,IAAI,EAAC,WAAW,EAAC,iBAAiB,EAAC,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,IAAG,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;QAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAClE,MAAM,cAAc,GAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,YAAY,CAAC,EAAE,QAAQ,CAAC;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,uEAAuE;QACvE,kEAAkE;QAClE,sEAAsE;QACtE,GAAG,CAAC,OAAO,cAAc,EAAE,mBAAmB,KAAG,UAAU;YACvD,OAAO,cAAc,EAAE,kBAAkB,KAAG,UAAU,CAAA,CAAC,CAAA;YACzD,KAAK,CAAC,aAAa,KAAG,OAAO,cAAc,CAAC,mBAAoB,EAAE,CAAC,CAAA,CAAC;YACpE,KAAK,CAAC,YAAY,CAAC,GAAW,IAAE,OAAO,cAAc,CAAC,kBAAmB,CAAC,GAAG,CAAC,CAAC,CAAA,CAAC;YAChF,KAAK,CAAC,qBAAqB;gBACzB,OAAO,OAAO,cAAc,CAAC,2BAA2B,KAAG,UAAU,CAAA,CAAC;oBACpE,cAAc,CAAC,2BAA2B,EAAE,CAAA,CAAC,CAAA,EAAE,CAAC;YACpD,CAAC;SACF,CAAA,CAAC,CAAA,EAAE,CAAC;QACL,eAAe,EAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACtC,MAAM,EAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QAChC,QAAQ,CAAC,UAAkB,IAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,IAAE,IAAI,CAAC,CAAA,CAAC;QAC1E,KAAK,CAAC,kBAAkB,CAAC,UAAkB,EAAC,IAAmB;YAC7D,MAAM,MAAM,GAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrC,IAAG,CAAC,MAAM,IAAE,MAAM,CAAC,KAAK,KAAG,YAAY;gBACrC,OAAO,MAAM,CAAC,SAAS,KAAG,UAAU;gBAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YACvE,MAAM,OAAO,GAAC,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAC,IAAI,IAAE,EAAE,CAAC,CAAC;YACjE,IAAG,CAAC,OAAO,IAAE,OAAO,OAAO,KAAG,QAAQ,IAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC5D,OAAO,CAAC,4BAA4B,CAAC,CAAC;YACxC,OAAO,EAAC,IAAI,EAAC,UAAU,EAAC,SAAS,EAAC,OAAO,EAAC,CAAC;QAC7C,CAAC;QACD,KAAK,CAAC,0BAA0B,CAAC,UAA0B;YACzD,IAAG,CAAC,UAAU,IAAE,OAAO,UAAU,CAAC,IAAI,KAAG,QAAQ;gBAC/C,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAE,CAAC;YAC3C,OAAO,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAC;gBAChD,GAAG,UAAU,EAAC,IAAI,EAAC,MAAM,CAAC,UAAU,EAAC,SAAS,EAAC,UAAU,CAAC,SAAS,IAAE,EAAE;aACxE,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { RouteDefinition,RouteInfo,Tool,ToolArguments,ToolInvocation,UpstreamRouter } from \"./contracts.js\";\n// MCP router: route upstream tool calls without implementing their functionality.\n// Registered upstream servers own their tools; the DC route retains native names.\n// Additional upstream tools are namespaced \"<route>__<nativeTool>\".\nexport class MCPRouteError extends Error {\n  constructor(public readonly code: string){super(code);}\n}\nfunction invalid(message: string): never{throw new MCPRouteError(message);}\nfunction validRoute(route: unknown){\n  return typeof route===\"string\"&&/^[a-z][a-z0-9_-]{0,39}$/.test(route);\n}\nexport function createMCPUpstreamRouter({routes,defaultRoute=\"desktop\"}: {routes: RouteDefinition[]; defaultRoute?: string}): UpstreamRouter{\n  if(!Array.isArray(routes)||routes.length===0)invalid(\"ROUTES_REQUIRED\");\n  const mapping=new Map<string,{route:string;nativeName:string;upstream: RouteDefinition[\"upstream\"];authorize: RouteDefinition[\"authorize\"]}>(),seenRoutes=new Set<string>(),catalog:Tool[]=[],routeInfos:RouteInfo[]=[];\n  for(const {id,upstream,exposeNativeNames=false,authorize=null} of routes){\n    if(!validRoute(id)||seenRoutes.has(id))invalid(\"INVALID_OR_DUPLICATE_ROUTE\");\n    seenRoutes.add(id);\n    if(!upstream||!Array.isArray(upstream.upstreamCatalog)||\n      typeof upstream.forwardWorkspaceInvocation!==\"function\")invalid(\"INVALID_UPSTREAM\");\n    const names=new Set();\n    for(const tool of upstream.upstreamCatalog){\n      if(typeof tool?.name!==\"string\"||!tool.name||names.has(tool.name)||\n        !tool.inputSchema||typeof tool.inputSchema!==\"object\")\n        invalid(\"INVALID_UPSTREAM_CATALOG\");\n      names.add(tool.name);\n      const publicName=exposeNativeNames?tool.name:id+\"__\"+tool.name;\n      if(mapping.has(publicName)||publicName===\"health_check\"||\n        publicName.startsWith(\"gateway_git_\"))invalid(\"ROUTED_TOOL_COLLISION\");\n      mapping.set(publicName,{route:id,nativeName:tool.name,upstream,authorize});\n      catalog.push({...structuredClone(tool),name:publicName});\n    }\n    routeInfos.push(Object.freeze({id,toolCount:names.size,nativeNames:exposeNativeNames}));\n  }\n  if(!seenRoutes.has(defaultRoute))invalid(\"DEFAULT_ROUTE_MISSING\");\n  const resourceSource=routes.find(x=>x.id===defaultRoute)?.upstream;\n  return Object.freeze({\n    // Default native route's MCP App resources correspond to the unchanged\n    // UI URIs advertised on its tools. Additional namespaced upstream\n    // resource URIs require explicit collision/ownership contracts later.\n    ...(typeof resourceSource?.listNativeResources===\"function\"&&\n        typeof resourceSource?.readNativeResource===\"function\"?{\n      async listResources(){return resourceSource.listNativeResources!();},\n      async readResource(uri: string){return resourceSource.readNativeResource!(uri);},\n      async listResourceTemplates(){\n        return typeof resourceSource.listNativeResourceTemplates===\"function\"?\n          resourceSource.listNativeResourceTemplates():[];\n      }\n    }:{}),\n    upstreamCatalog:Object.freeze(catalog),\n    routes:Object.freeze(routeInfos),\n    routeFor(publicName: string){return mapping.get(publicName)?.route||null;},\n    async authorizeExtension(publicName: string,args: ToolArguments){\n      const target=mapping.get(publicName);\n      if(!target||target.route===defaultRoute||\n        typeof target.authorize!==\"function\")invalid(\"ROUTE_NOT_AUTHORIZED\");\n      const checked=await target.authorize(target.nativeName,args||{});\n      if(!checked||typeof checked!==\"object\"||Array.isArray(checked))\n        invalid(\"ROUTE_AUTHORIZATION_FAILED\");\n      return {name:publicName,arguments:checked};\n    },\n    async forwardWorkspaceInvocation(invocation: ToolInvocation){\n      if(!invocation||typeof invocation.name!==\"string\"||\n        !mapping.has(invocation.name))invalid(\"NO_SUCH_ROUTED_TOOL\");\n      const target=mapping.get(invocation.name)!;\n      return target.upstream.forwardWorkspaceInvocation({\n        ...invocation,name:target.nativeName,arguments:invocation.arguments||{}\n      });\n    }\n  });\n}\n"]}

package/dist/src/oauth-keycloak.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-keycloak.js","sourceRoot":"","sources":["../../src/oauth-keycloak.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,QAAe,EAAC,QAAe,EAAC,WAAW,GAAC,KAAK;IAC7E,KAAI,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAC,QAAQ,CAAC,EAAC,CAAC;QACtC,MAAM,CAAC,GAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACvB,IAAG,CAAC,CAAC,QAAQ,IAAE,CAAC,CAAC,QAAQ,IAAE,CAAC,CAAC,IAAI,IAAE,CAAC,CAAC,MAAM,IAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAG,QAAQ;YACvF,CAAC,WAAW,IAAE,CAAC,CAAC,QAAQ,KAAG,OAAO,IAAE,CAAC,WAAW,EAAC,WAAW,EAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClJ,CAAC;IACD,OAAO;QACL,KAAK,EAAC,SAAS,EAAC,OAAO,EAAC,IAAI,EAAC,mBAAmB,EAAC,KAAK,EAAC,oBAAoB,EAAC,KAAK;QACjF,WAAW,EAAC,WAAW,CAAA,CAAC,CAAA,MAAM,CAAA,CAAC,CAAA,UAAU,EAAC,mBAAmB,EAAC,GAAG,EAAC,kBAAkB,EAAC,IAAI,EAAC,oBAAoB,EAAC,CAAC;QAChH,YAAY,EAAC,CAAC,EAAC,IAAI,EAAC,gBAAgB,EAAC,QAAQ,EAAC,gBAAgB,EAAC,UAAU,EAAC,EAAC,wBAAwB,EAAC,MAAM;oBACxG,2BAA2B,EAAC,MAAM,EAAC,qBAAqB,EAAC,sCAAsC,EAAC;gBAChG,eAAe,EAAC,CAAC,EAAC,IAAI,EAAC,SAAS,EAAC,QAAQ,EAAC,gBAAgB,EAAC,cAAc,EAAC,iBAAiB;wBACzF,MAAM,EAAC,EAAC,oBAAoB,EAAC,MAAM,EAAC,EAAC,EAAC,EAAC,IAAI,EAAC,kBAAkB,EAAC,QAAQ,EAAC,gBAAgB,EAAC,cAAc,EAAC,sBAAsB;wBAC9H,MAAM,EAAC,EAAC,0BAA0B,EAAC,kBAAkB,EAAC,oBAAoB,EAAC,MAAM,EAAC,gBAAgB,EAAC,OAAO,EAAC,EAAC,CAAC,EAAC,CAAC;QACnH,OAAO,EAAC,CAAC,EAAC,QAAQ,EAAC,kBAAkB,EAAC,IAAI,EAAC,kBAAkB,EAAC,OAAO,EAAC,IAAI,EAAC,QAAQ,EAAC,gBAAgB;gBAClG,UAAU,EAAC,IAAI,EAAC,UAAU,EAAC,EAAC,YAAY,EAAC,QAAQ,EAAC,EAAC;YACnD,EAAC,QAAQ,EAAC,iBAAiB,EAAC,IAAI,EAAC,4BAA4B,EAAC,OAAO,EAAC,IAAI,EAAC,QAAQ,EAAC,gBAAgB;gBAClG,YAAY,EAAC,KAAK,EAAC,uBAAuB,EAAC,eAAe,EAAC,mBAAmB,EAAC,IAAI,EAAC,yBAAyB,EAAC,KAAK,EAAC,mBAAmB,EAAC,KAAK;gBAC7I,sBAAsB,EAAC,KAAK,EAAC,eAAe,EAAC,IAAI,EAAC,YAAY,EAAC,CAAC,QAAQ,CAAC,EAAC,UAAU,EAAC,EAAE;gBACvF,UAAU,EAAC,EAAC,4BAA4B,EAAC,MAAM,EAAC,EAAC,oBAAoB,EAAC,CAAC,gBAAgB,CAAC,EAAC,mBAAmB,EAAC,EAAE,EAAC,CAAC;KACtH,CAAC;AACJ,CAAC","sourcesContent":["// A reference realm generator, not an embedded authorization server.\n// No users, passwords, client secrets or wildcard callback URLs are generated.\nexport function keycloakRealm(resource:string,callback:string,development=false){\n  for(const value of [resource,callback]){\n    const u=new URL(value);\n    if(u.username||u.password||u.hash||u.search||value.includes('*')||!(u.protocol==='https:'||\n      (development&&u.protocol==='http:'&&['127.0.0.1','localhost','[::1]'].includes(u.hostname))))throw Error('KEYCLOAK_HTTPS_EXACT_URL_REQUIRED');\n  }\n  return {\n    realm:'gateway',enabled:true,registrationAllowed:false,resetPasswordAllowed:false,\n    sslRequired:development?'none':'external',accessTokenLifespan:300,revokeRefreshToken:true,refreshTokenMaxReuse:0,\n    clientScopes:[{name:'gateway:access',protocol:'openid-connect',attributes:{'include.in.token.scope':'true',\n      'display.on.consent.screen':'true','consent.screen.text':'Use the Gateway owner-approved tools'},\n      protocolMappers:[{name:'Subject',protocol:'openid-connect',protocolMapper:'oidc-sub-mapper',\n        config:{'access.token.claim':'true'}},{name:'gateway audience',protocol:'openid-connect',protocolMapper:'oidc-audience-mapper',\n        config:{'included.client.audience':'gateway-resource','access.token.claim':'true','id.token.claim':'false'}}]}],\n    clients:[{clientId:'gateway-resource',name:'Gateway resource',enabled:true,protocol:'openid-connect',\n      bearerOnly:true,attributes:{resource_url:resource}},\n      {clientId:'gateway-chatgpt',name:'ChatGPT Gateway connection',enabled:true,protocol:'openid-connect',\n        publicClient:false,clientAuthenticatorType:'client-secret',standardFlowEnabled:true,directAccessGrantsEnabled:false,implicitFlowEnabled:false,\n        serviceAccountsEnabled:false,consentRequired:true,redirectUris:[callback],webOrigins:[],\n        attributes:{'pkce.code.challenge.method':'S256'},optionalClientScopes:['gateway:access'],defaultClientScopes:[]}]\n  };\n}\n"]}

package/dist/src/oauth-resource.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-resource.js","sourceRoot":"","sources":["../../src/oauth-resource.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+DAA+D;AAC/D,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AACtB,OAAO,EAAC,kBAAkB,EAAC,SAAS,EAAsB,MAAM,MAAM,CAAC;AACvE,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AAEvC,MAAM,GAAG,GAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAC,CAAC,CAAC,MAAM,CAAC;IACtC,MAAM,EAAC,GAAG,EAAC,QAAQ,EAAC,GAAG,EAAC,OAAO,EAAC,GAAG,EAAC,qBAAqB,EAAC,GAAG,EAAC,aAAa,EAAC,GAAG;IAC/E,wFAAwF;IACxF,eAAe,EAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAC,GAAG,CAAC,QAAQ,EAAE,EAAC,kBAAkB,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAC,MAAM,EAAC,KAAK,CAAC,CAAC;IACxF,QAAQ,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAC,uBAAuB,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAC,qBAAqB,EAAC,oBAAoB,EAAC,iBAAiB,CAAC,CAAC;IAC1I,eAAe,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,KAAK,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC1E,iBAAiB,EAAC,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAC,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAC,WAAW,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACpF,QAAQ,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAC,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAC,UAAU,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrG,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAC,UAAU,EAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;CACjF,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,OAAO,UAAW,SAAQ,KAAK;IACd;IAA4B;IAAjD,YAAqB,MAAkB,EAAU,MAAa;QAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAAzD,WAAM,GAAN,MAAM,CAAY;QAAU,WAAM,GAAN,MAAM,CAAO;IAAgB,CAAC;CAChF;AACD,SAAS,UAAU,CAAC,KAAY,EAAC,SAAiB;IAChD,IAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAC,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAG,MAAM,CAAC,QAAQ,IAAE,MAAM,CAAC,QAAQ,IAAE,MAAM,CAAC,IAAI,IAAE,MAAM,CAAC,MAAM;QAC7D,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAG,QAAQ,IAAE,CAAC,SAAS,IAAE,MAAM,CAAC,QAAQ,KAAG,OAAO,IAAE,CAAC,WAAW,EAAC,WAAW,EAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClI,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,CAAC,GAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtD,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC3C,KAAI,MAAM,KAAK,IAAI,CAAC,CAAC,eAAe,IAAE,EAAE;QAAC,UAAU,CAAC,KAAK,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC/E,KAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,EAAC,CAAC,CAAC,qBAAqB,EAAC,CAAC,CAAC,aAAa,EAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAA,CAAC,CAAA,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA,CAAC,CAAA,EAAE,CAAC,CAAC,EAAC,CAAC;QAC9H,IAAG,UAAU,CAAC,KAAK,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,MAAM,KAAG,MAAM,CAAC,MAAM;YAAC,MAAM,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAChH,CAAC;IACD,IAAG,CAAC,CAAC,kBAAkB,KAAG,KAAK,IAAE,CAAC,CAAC,CAAC,oBAAoB;QAAC,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpG,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,eAAe,GAAC,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAC,GAAG,EAAC,QAAQ,EAAC,GAAG,EAAC,sBAAsB,EAAC,GAAG,EAAC,cAAc,EAAC,GAAG;IACrE,qBAAqB,EAAC,GAAG,CAAC,QAAQ,EAAE,EAAC,qCAAqC,EAAC,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjG,gCAAgC,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAC,wBAAwB,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjG,qCAAqC,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAC,gBAAgB,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrH,CAAC,CAAC;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KACqG;IACvI,MAAM,MAAM,GAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAC,KAAK,CAAC,iBAAiB,IAAE,KAAK,CAAC,CAAC;IACrE,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,CAAC,iBAAiB,IAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAC,CAAC,MAAM,CAAC,MAAM,GAAC,yCAAyC,GAAC,IAAI;QAC5E,MAAM,CAAC,MAAM,GAAC,IAAI,GAAC,mCAAmC,CAAC,CAAC;IAC1D,IAAI,QAAkD,CAAC;IACvD,KAAI,MAAM,OAAO,IAAI,UAAU,EAAC,CAAC;QAC/B,IAAG,CAAC;YACF,MAAM,QAAQ,GAAC,MAAM,KAAK,CAAC,OAAO,EAAC,EAAC,QAAQ,EAAC,OAAO,EAAC,MAAM,EAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC;YACxF,IAAG,CAAC,QAAQ,CAAC,EAAE,IAAE,CAAC,QAAQ,CAAC,IAAI;gBAAC,SAAS;YACzC,MAAM,MAAM,GAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAAA,IAAI,IAAI,GAAC,EAAE,CAAC;YAAA,MAAM,OAAO,GAAC,IAAI,WAAW,EAAE,CAAC;YAAA,IAAI,MAAM,GAAC,CAAC,CAAC;YAChG,IAAG,CAAC;gBAAA,SAAO,CAAC;oBAAA,MAAM,KAAK,GAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAAA,IAAG,KAAK,CAAC,IAAI;wBAAC,MAAM;oBAAA,MAAM,IAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;oBAC7F,IAAG,MAAM,GAAC,KAAK;wBAAC,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;oBAAA,IAAI,IAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAC,EAAC,MAAM,EAAC,IAAI,EAAC,CAAC,CAAC;gBAAA,CAAC;YAAA,CAAC;oBACrG,CAAC;gBAAA,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YAAA,CAAC;YAC/B,IAAI,IAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YAAA,QAAQ,GAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC,CAAC;YAAA,MAAM;QAC3F,CAAC;QAAA,MAAK,CAAC,CAAA,uEAAuE,CAAA,CAAC;IACjF,CAAC;IACD,IAAG,CAAC,QAAQ;QAAC,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACnD,IAAG,QAAQ,CAAC,MAAM,KAAG,KAAK,CAAC,MAAM;QAAC,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvE,IAAG,CAAC,QAAQ,CAAC,gCAAgC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAC,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACjK,MAAM,YAAY,GAAC,KAAK,CAAC,kBAAkB,IAAE,UAAU,CAAC;IAAA,MAAM,MAAM,GAAC,KAAK,CAAC,uBAAuB,IAAE,MAAM,CAAC;IAC3G,IAAG,CAAC,QAAQ,CAAC,qCAAqC,EAAE,QAAQ,CAAC,MAAM,CAAC;QAAC,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxH,IAAG,YAAY,KAAG,MAAM,IAAE,CAAC,QAAQ,CAAC,qCAAqC;QAAC,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACnH,IAAG,YAAY,KAAG,KAAK,IAAE,CAAC,QAAQ,CAAC,qBAAqB;QAAC,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACjG,OAAO,mBAAmB,CAAC,EAAC,MAAM,EAAC,KAAK,CAAC,MAAM,EAAC,QAAQ,EAAC,KAAK,CAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,CAAC,QAAQ;QAC/F,qBAAqB,EAAC,QAAQ,CAAC,sBAAsB,EAAC,aAAa,EAAC,QAAQ,CAAC,cAAc;QAC3F,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAA,CAAC,CAAA,EAAC,oBAAoB,EAAC,QAAQ,CAAC,qBAAqB,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC;QAC5F,kBAAkB,EAAC,YAAY,EAAC,QAAQ,EAAC,KAAK,CAAC,QAAQ,EAAC,uBAAuB,EAAC,MAAM;QACtF,eAAe,EAAC,KAAK,CAAC,eAAe,EAAC,iBAAiB,EAAC,KAAK,CAAC,iBAAiB,IAAE,KAAK,EAAC,KAAK,EAAC,gBAAgB,EAAC,CAAC,CAAC;AACpH,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,CAAa;IACvC,MAAM,QAAQ,GAAC,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC,MAAM,GAAC,uCAAuC,GAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAC,EAAE,CAAC,CAAC;AACrG,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,CAAa;IAC5C,OAAO,EAAC,QAAQ,EAAC,CAAC,CAAC,QAAQ,EAAC,qBAAqB,EAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAC,gBAAgB,EAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAC,wBAAwB,EAAC,CAAC,QAAQ,CAAC,EAAC,CAAC;AAC/H,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,CAAa,EAAC,SAAe,GAAG;IAC7D,sEAAsE;IACtE,MAAM,KAAK,GAAC,CAAC,CAAQ,EAAC,EAAE,CAAA,CAAC,CAAC,OAAO,CAAC,KAAK,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAC,KAAK,CAAC,CAAC;IACpE,OAAO,6BAA6B,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,MAAM,KAAG,GAAG,CAAA,CAAC,CAAA,oBAAoB,CAAA,CAAC,CAAA,eAAe,GAAG,CAAC;AACxJ,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,CAAa,EAAC,GAAoB;IACpE,MAAM,MAAM,GAAC,GAAG,IAAE,kBAAkB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAC,EAAC,eAAe,EAAC,IAAI,EAAC,gBAAgB,EAAC,IAAI,EAAC,WAAW,EAAC,MAAM,EAAC,CAAC,CAAC;IACzH,OAAO,KAAK,EAAC,MAAuB,EAAC,EAAE;QACrC,IAAG,CAAC,MAAM,IAAE,MAAM,CAAC,MAAM,GAAC,KAAK,IAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAC,MAAM,IAAI,UAAU,CAAC,GAAG,EAAC,sBAAsB,CAAC,CAAC;QACnH,IAAI,OAAO,CAAC;QACZ,IAAG,CAAC;YAAA,CAAC,EAAC,OAAO,EAAC,GAAC,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,EAAC,MAAM,EAAC,CAAC,CAAC,MAAM,EAAC,QAAQ,EAAC,CAAC,CAAC,CAAC,QAAQ,EAAC,GAAG,CAAC,CAAC,CAAC,eAAe,IAAE,EAAE,CAAC,CAAC,EAAC,UAAU,EAAC,CAAC,OAAO,EAAC,OAAO,EAAC,OAAO,CAAC;gBAC1J,cAAc,EAAC,CAAC,KAAK,EAAC,KAAK,EAAC,KAAK,EAAC,KAAK,EAAC,KAAK,CAAC,EAAC,cAAc,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;QAAA,CAAC;QACtE,OAAM,KAAK,EAAC,CAAC;YACX,MAAM,IAAI,GAAC,KAAK,IAAE,OAAO,KAAK,KAAG,QAAQ,IAAE,MAAM,IAAI,KAAK,CAAA,CAAC,CAAA,KAAK,CAAC,IAAI,CAAA,CAAC,CAAA,EAAE,CAAC;YACzE,IAAG,IAAI,KAAG,kBAAkB,IAAE,KAAK,YAAY,SAAS;gBAAC,MAAM,IAAI,UAAU,CAAC,GAAG,EAAC,wBAAwB,CAAC,CAAC;YAC5G,MAAM,IAAI,UAAU,CAAC,GAAG,EAAC,qBAAqB,CAAC,CAAC;QAClD,CAAC;QACD,IAAG,OAAO,OAAO,CAAC,GAAG,KAAG,QAAQ,IAAE,CAAC,OAAO,CAAC,GAAG,IAAE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAC,GAAG;YACpE,OAAO,OAAO,CAAC,GAAG,KAAG,QAAQ,IAAE,CAAC,OAAO,CAAC,GAAG,IAAE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAC,GAAG,IAAE,OAAO,CAAC,GAAG,KAAG,CAAC,CAAC,QAAQ;YAC7F,OAAO,OAAO,CAAC,GAAG,KAAG,QAAQ,IAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,IAAE,OAAO,CAAC,GAAG,GAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAC,IAAI,CAAC;YAC1G,OAAO,OAAO,CAAC,GAAG,KAAG,QAAQ,IAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,IAAE,OAAO,CAAC,GAAG,IAAE,OAAO,CAAC,GAAG;YAC3F,MAAM,IAAI,UAAU,CAAC,GAAG,EAAC,qBAAqB,CAAC,CAAC;QAClD,IAAG,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;YAAC,MAAM,IAAI,UAAU,CAAC,GAAG,EAAC,2BAA2B,CAAC,CAAC;QAClG,MAAM,MAAM,GAAC,OAAO,OAAO,CAAC,KAAK,KAAG,QAAQ,CAAA,CAAC,CAAA,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA,CAAC,CAAA,EAAE,CAAC;QAC3E,IAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;YAAC,MAAM,IAAI,UAAU,CAAC,GAAG,EAAC,sBAAsB,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAC,CAAC,KAAc,EAAC,EAAE,CAAA,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9F,OAAO,EAAC,EAAE,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAC,OAAO,CAAC,GAAG,EAAC,CAAC,CAAC,QAAQ,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAC,WAAW,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrG,QAAQ,EAAC,CAAC,CAAC,QAAQ,EAAC,MAAM,EAAC,CAAC;IAChC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["// OAuth resource-server adapter. The authorization server owns login, consent,\n// authorization codes, refresh tokens and client registration.\nimport {z} from 'zod';\nimport {createRemoteJWKSet,jwtVerify,type JWTVerifyGetKey} from 'jose';\nimport {createHash} from 'node:crypto';\n\nconst url=z.string().url().max(2048);\nexport const oauthConfigSchema=z.object({\n  issuer:url,resource:url,jwksUri:url,authorizationEndpoint:url,tokenEndpoint:url,\n  // Exact alternate identifiers for this same resource, explicitly approved by the owner.\n  resourceAliases:z.array(url).max(8).optional(),\n  registrationEndpoint:url.optional(),clientRegistration:z.enum(['provided','cimd','dcr']),\n  clientId:z.string().min(1).max(2048),tokenEndpointAuthMethod:z.enum(['none','client_secret_basic','client_secret_post','private_key_jwt']),\n  allowedSubjects:z.array(z.string().min(1).max(256)).min(1).max(32),\n  scope:z.string().regex(/^[A-Za-z0-9:_-]{1,80}$/).default('gateway:access'),\n  allowLoopbackHttp:z.boolean().default(false)\n}).strict();\nexport type OAuthConfig=z.infer<typeof oauthConfigSchema>;\nexport const oauthConnectionSchema=z.object({\n  id:z.string().regex(/^[a-f0-9]{64}$/),subjectHash:z.string().regex(/^[a-f0-9]{64}$/),\n  clientId:z.string().min(1).max(2048),createdAt:z.string().datetime(),lastUsedAt:z.string().datetime(),\n  revokedAt:z.string().datetime().nullable(),permission:z.literal('owner-default')\n}).strict();\nexport type OAuthConnection=z.infer<typeof oauthConnectionSchema>;\nexport class OAuthError extends Error {\n  constructor(readonly status:401|403|503,readonly reason:string){super(reason);}\n}\nfunction checkedUrl(value:string,allowHttp:boolean){\n  if(/[\\u0000-\\u0020\\u007f\\\\]/.test(value))throw Error('OAUTH_URL_INVALID');\n  const parsed=new URL(value);\n  if(parsed.username||parsed.password||parsed.hash||parsed.search||\n    !(parsed.protocol==='https:'||(allowHttp&&parsed.protocol==='http:'&&['localhost','127.0.0.1','[::1]'].includes(parsed.hostname))))\n    throw Error('OAUTH_HTTPS_URL_REQUIRED');\n  return parsed;\n}\nexport function validateOAuthConfig(value:unknown):OAuthConfig{\n  const c=oauthConfigSchema.parse(value);\n  const issuer=checkedUrl(c.issuer,c.allowLoopbackHttp);\n  checkedUrl(c.resource,c.allowLoopbackHttp);\n  for(const alias of c.resourceAliases??[])checkedUrl(alias,c.allowLoopbackHttp);\n  for(const value of [c.jwksUri,c.authorizationEndpoint,c.tokenEndpoint,...(c.registrationEndpoint?[c.registrationEndpoint]:[])]){\n    if(checkedUrl(value,c.allowLoopbackHttp).origin!==issuer.origin)throw Error('OAUTH_ENDPOINT_ORIGIN_MISMATCH');\n  }\n  if(c.clientRegistration==='dcr'&&!c.registrationEndpoint)throw Error('OAUTH_DCR_ENDPOINT_REQUIRED');\n  return c;\n}\nconst discoverySchema=z.object({\n  issuer:url,jwks_uri:url,authorization_endpoint:url,token_endpoint:url,\n  registration_endpoint:url.optional(),client_id_metadata_document_supported:z.boolean().optional(),\n  code_challenge_methods_supported:z.array(z.string()),response_types_supported:z.array(z.string()),\n  token_endpoint_auth_methods_supported:z.array(z.string()).optional(),scopes_supported:z.array(z.string()).optional()\n});\nexport async function discoverOAuth(input:{issuer:string;resource:string;clientId:string;allowedSubjects:string[];\n  clientRegistration?:'provided'|'cimd'|'dcr';tokenEndpointAuthMethod?:OAuthConfig['tokenEndpointAuthMethod'];allowLoopbackHttp?:boolean}){\n  const issuer=checkedUrl(input.issuer,input.allowLoopbackHttp??false);\n  checkedUrl(input.resource,input.allowLoopbackHttp??false);\n  const base=issuer.pathname.replace(/\\/$/,'');\n  const candidates=[issuer.origin+'/.well-known/oauth-authorization-server'+base,\n    issuer.origin+base+'/.well-known/openid-configuration'];\n  let metadata:z.infer<typeof discoverySchema>|undefined;\n  for(const address of candidates){\n    try{\n      const response=await fetch(address,{redirect:'error',signal:AbortSignal.timeout(5000)});\n      if(!response.ok||!response.body)continue;\n      const reader=response.body.getReader();let body='';const decoder=new TextDecoder();let length=0;\n      try{for(;;){const chunk=await reader.read();if(chunk.done)break;length+=chunk.value.byteLength;\n        if(length>65536)throw Error('OAUTH_METADATA_TOO_LARGE');body+=decoder.decode(chunk.value,{stream:true});}}\n      finally{await reader.cancel();}\n      body+=decoder.decode();metadata=discoverySchema.parse(JSON.parse(body) as unknown);break;\n    }catch{/* Try the standard OIDC discovery location; never accept redirects. */}\n  }\n  if(!metadata)throw Error('OAUTH_DISCOVERY_FAILED');\n  if(metadata.issuer!==input.issuer)throw Error('OAUTH_ISSUER_MISMATCH');\n  if(!metadata.code_challenge_methods_supported.includes('S256')||!metadata.response_types_supported.includes('code'))throw Error('OAUTH_CODE_PKCE_S256_REQUIRED');\n  const registration=input.clientRegistration??'provided';const method=input.tokenEndpointAuthMethod??'none';\n  if(!metadata.token_endpoint_auth_methods_supported?.includes(method))throw Error('OAUTH_TOKEN_AUTH_METHOD_UNSUPPORTED');\n  if(registration==='cimd'&&!metadata.client_id_metadata_document_supported)throw Error('OAUTH_CIMD_NOT_ADVERTISED');\n  if(registration==='dcr'&&!metadata.registration_endpoint)throw Error('OAUTH_DCR_NOT_ADVERTISED');\n  return validateOAuthConfig({issuer:input.issuer,resource:input.resource,jwksUri:metadata.jwks_uri,\n    authorizationEndpoint:metadata.authorization_endpoint,tokenEndpoint:metadata.token_endpoint,\n    ...(metadata.registration_endpoint?{registrationEndpoint:metadata.registration_endpoint}:{}),\n    clientRegistration:registration,clientId:input.clientId,tokenEndpointAuthMethod:method,\n    allowedSubjects:input.allowedSubjects,allowLoopbackHttp:input.allowLoopbackHttp??false,scope:'gateway:access'});\n}\nexport function metadataUrl(c:OAuthConfig){\n  const resource=new URL(c.resource);\n  return resource.origin+'/.well-known/oauth-protected-resource'+resource.pathname.replace(/\\/$/,'');\n}\nexport function resourceMetadata(c:OAuthConfig){\n  return {resource:c.resource,authorization_servers:[c.issuer],scopes_supported:[c.scope],bearer_methods_supported:['header']};\n}\nexport function oauthChallenge(c:OAuthConfig,status:401|403=401){\n  // URLs and scope are validated and encoded as quoted-string contents.\n  const quote=(s:string)=>s.replace(/\\\\/g,'\\\\\\\\').replace(/\"/g,'\\\\\"');\n  return `Bearer resource_metadata=\"${quote(metadataUrl(c))}\", scope=\"${quote(c.scope)}\", error=\"${status===403?'insufficient_scope':'invalid_token'}\"`;\n}\nexport function createOAuthVerifier(c:OAuthConfig,key?:JWTVerifyGetKey){\n  const keyset=key??createRemoteJWKSet(new URL(c.jwksUri),{timeoutDuration:4000,cooldownDuration:1000,cacheMaxAge:300000});\n  return async(header:string|undefined)=>{\n    if(!header||header.length>16384||!/^Bearer [^\\s]+$/i.test(header))throw new OAuthError(401,'OAUTH_TOKEN_REQUIRED');\n    let payload;\n    try{({payload}=await jwtVerify(header.slice(7),keyset,{issuer:c.issuer,audience:[c.resource,...(c.resourceAliases??[])],algorithms:['RS256','ES256','PS256'],\n      requiredClaims:['sub','exp','iat','sid','azp'],clockTolerance:0}));}\n    catch(error){\n      const code=error&&typeof error==='object'&&'code' in error?error.code:'';\n      if(code==='ERR_JWKS_TIMEOUT'||error instanceof TypeError)throw new OAuthError(503,'OAUTH_KEYS_UNAVAILABLE');\n      throw new OAuthError(401,'OAUTH_TOKEN_INVALID');\n    }\n    if(typeof payload.sub!=='string'||!payload.sub||payload.sub.length>256||\n      typeof payload.sid!=='string'||!payload.sid||payload.sid.length>512||payload.azp!==c.clientId||\n      typeof payload.iat!=='number'||!Number.isSafeInteger(payload.iat)||payload.iat>Math.floor(Date.now()/1000)||\n      typeof payload.exp!=='number'||!Number.isSafeInteger(payload.exp)||payload.exp<=payload.iat)\n      throw new OAuthError(401,'OAUTH_TOKEN_INVALID');\n    if(!c.allowedSubjects.includes(payload.sub))throw new OAuthError(403,'OAUTH_SUBJECT_NOT_ALLOWED');\n    const scopes=typeof payload.scope==='string'?payload.scope.split(/\\s+/):[];\n    if(!scopes.includes(c.scope))throw new OAuthError(403,'OAUTH_SCOPE_REQUIRED');\n    const hash=(parts:string[])=>createHash('sha256').update(JSON.stringify(parts)).digest('hex');\n    return {id:hash([c.issuer,payload.sub,c.clientId,payload.sid]),subjectHash:hash([c.issuer,payload.sub]),\n      clientId:c.clientId,scopes};\n  };\n}\n"]}

package/dist/src/operator-cli.js

@@ -1,559 +0,0 @@
-import { ownedByUser, supportedHost, windows, childEnvKeys } from "./platform.js";
-import { privateAgentSchema } from "./config-schemas.js";
-import { legacyCliEntry as cliEntry, packageRoot } from "./runtime-paths.js";
-import { runtimeIdentity, formatStartup } from "./runtime-identity.js";
-import { GatewayError, errorCode, errorMessage, errorStderr, isInteger, isSafeInteger, parseJSON, record } from "./validation.js";
-// Operator-facing foreground CLI and explicit, per-user launchd lifecycle.
-// Adopt existing private service without overwriting its checked plist.
-import { execFile as execFileCallback, spawn } from "node:child_process";
-import { access, lstat, readFile } from "node:fs/promises";
-import net from "node:net";
-import { homedir } from "node:os";
-import path from "node:path";
-import { promisify } from "node:util";
-import { acquireControl, connectOwner, globalStop } from "./global-core-control.js";
-import { defaultSetupPath, loadSetupConfig, setupRuntimeEnv } from "./release1-onboarding.js";
-import { SERVICE_LABEL, launchAgentPaths, serviceCommand } from "./release1-service.js";
-const execFile = promisify(execFileCallback);
-const PRIVATE_LABEL = "ai.home.mac-mcp-project-workspace";
-function failure(x) { const e = new GatewayError(x); throw e; }
-;
-const goodPort = (n) => isSafeInteger(n) && n >= 1024 && n <= 65535;
-export function classifyServiceRuntime({ registered = false, portBusy = false, healthy = false, ownedPid = false } = {}) {
-    if (registered)
-        return healthy ? "service-healthy" : "service-unhealthy";
-    if (!portBusy)
-        return "stopped";
-    if (healthy && ownedPid)
-        return "foreground";
-    return "unknown-listener";
-}
-export function serviceActionDecision(action, { registered = false, portBusy = false } = {}) {
-    if (action === "start") {
-        if (registered)
-            return "ALREADY_RUNNING";
-        return portBusy ? "PORT_IN_USE" : "START";
-    }
-    if (action === "restart") {
-        if (!registered && portBusy)
-            return "FOREGROUND_IN_USE";
-        return registered ? "RESTART" : "START";
-    }
-    if (action === "stop")
-        return registered ? "STOP" : "ALREADY_STOPPED";
-    throw Error("INVALID_SERVICE_ACTION");
-}
-const privatePlist = (home) => path.join(home, "Library", "LaunchAgents", PRIVATE_LABEL + ".plist");
-async function owned(p, uid, required = false) {
-    let st;
-    try {
-        st = await lstat(p);
-    }
-    catch (e) {
-        if (errorCode(e) === "ENOENT" && !required)
-            return false;
-        throw e;
-    }
-    if (st.isSymbolicLink() || !st.isFile() || st.nlink !== 1 || !ownedByUser(p, st) || (process.platform !== "win32" && (st.mode & 0o022)))
-        failure("UNTRUSTED_OWNER_FILE");
-    return true;
-}
-async function parsePlist(p) {
-    const { stdout } = await execFile("/usr/bin/plutil", ["-convert", "json", "-o", "-", p], { timeout: 5000, maxBuffer: 20000 });
-    let a;
-    try {
-        a = parseJSON(stdout);
-    }
-    catch {
-        failure("PLIST_INVALID");
-    }
-    return a;
-}
-function validatePrivate(value, home) {
-    const parsed = privateAgentSchema.safeParse(value);
-    if (!parsed.success)
-        failure("PRIVATE_RUNTIME_UNRECOGNIZED");
-    const a = parsed.data;
-    const files = a?.ProgramArguments;
-    const env = a?.EnvironmentVariables;
-    if (a?.Label !== PRIVATE_LABEL || !Array.isArray(files) || files.length !== 2 ||
-        typeof files[0] !== "string" || typeof files[1] !== "string" ||
-        !files[1].startsWith(path.join(home, "Library", "Application Support", "Mac-MCP-Gateway", "releases") + path.sep) ||
-        path.basename(files[1]) !== "dc-workspace-http.mjs" ||
-        a.WorkingDirectory !== path.dirname(path.dirname(files[1])) ||
-        !env || env.MAC_MCP_PROJECT_PORT !== "8793")
-        failure("PRIVATE_RUNTIME_UNRECOGNIZED");
-    return a;
-}
-async function locate(home, uid, profile = "auto") {
-    if (!["live", "setup", "auto"].includes(profile))
-        failure("INVALID_PROFILE");
-    if (process.platform !== "darwin") {
-        if (profile === "live")
-            failure("LEGACY_PROFILE_MACOS_ONLY");
-        return { kind: "setup", label: SERVICE_LABEL, plist: "", installed: false, files: [] };
-    }
-    const privateFile = privatePlist(home);
-    const hasSetup = profile === "auto" && await owned(defaultSetupPath(home), uid);
-    if (profile === "live" || (profile === "auto" && !hasSetup && await owned(privateFile, uid))) {
-        await owned(privateFile, uid, true);
-        const a = validatePrivate(await parsePlist(privateFile), home);
-        return { kind: "live", label: PRIVATE_LABEL, plist: privateFile, agent: a, installed: true,
-            files: [a.StandardOutPath, a.StandardErrorPath].filter((value) => typeof value === "string" && value.length > 0) };
-    }
-    const pl = launchAgentPaths(home);
-    return { kind: "setup", label: SERVICE_LABEL, plist: pl.plist,
-        installed: await owned(pl.plist, uid),
-        files: [path.join(pl.logs, "out.log"), path.join(pl.logs, "err.log")] };
-}
-async function registered(label, uid) {
-    if (process.platform !== "darwin")
-        return false;
-    try {
-        await execFile("/bin/launchctl", ["print", "gui/" + uid + "/" + label], { timeout: 5000, maxBuffer: 10000 });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-async function launch(command, uid, plist) {
-    try {
-        await execFile("/bin/launchctl", [command, "gui/" + uid, plist], { timeout: 12000, maxBuffer: 20000 });
-    }
-    catch (e) {
-        failure("LAUNCHCTL_" + command.toUpperCase() + "_FAILED " +
-            String(errorStderr(e) || errorMessage(e)).slice(0, 120));
-    }
-}
-async function available(port) {
-    return new Promise(resolve => {
-        const server = net.createServer();
-        server.once("error", () => resolve(false));
-        server.listen(port, "127.0.0.1", () => server.close(() => resolve(true)));
-    });
-}
-async function disabledFlag(label, uid) {
-    if (process.platform !== "darwin")
-        return true;
-    try {
-        const { stdout } = await execFile("/bin/launchctl", ["print-disabled", "gui/" + uid], { timeout: 5000, maxBuffer: 120000 });
-        const line = stdout.split("\n").find(s => s.includes('"' + label + '" =>'));
-        if (!line)
-            return null;
-        return line.includes("=> disabled");
-    }
-    catch {
-        return null;
-    }
-}
-async function setAutostart(label, uid, enabled) {
-    try {
-        await execFile("/bin/launchctl", [enabled ? "enable" : "disable",
-            "gui/" + uid + "/" + label], { timeout: 7000, maxBuffer: 15000 });
-    }
-    catch (e) {
-        failure("LAUNCHCTL_AUTOSTART_CHANGE_FAILED " +
-            String(errorStderr(e) || errorMessage(e)).slice(0, 90));
-    }
-}
-async function listenerOwner(port, expectedEntry) {
-    if (process.platform !== "darwin")
-        return null;
-    try {
-        const { stdout } = await execFile("/usr/sbin/lsof", [
-            "-nP", "-t", "-iTCP:" + port, "-sTCP:LISTEN"
-        ], { timeout: 4000 });
-        const pid = Number(stdout.trim().split("\n")[0]);
-        if (!isSafeInteger(pid) || pid < 2)
-            return null;
-        const info = await execFile("/bin/ps", ["-p", String(pid), "-o", "command="], { timeout: 4000 });
-        return { pid, matchingEntry: info.stdout.trim().includes(expectedEntry) };
-    }
-    catch {
-        return null;
-    }
-}
-async function waitForHealthy(port, attempts = 24) {
-    for (let i = 0; i < attempts; i++) {
-        try {
-            const r = await fetch("http://127.0.0.1:" + port + "/healthz", {
-                signal: AbortSignal.timeout(700)
-            });
-            if (r.ok && record(await r.json()).status === "ok")
-                return true;
-        }
-        catch { }
-        await new Promise(resolve => setTimeout(resolve, 250));
-    }
-    return false;
-}
-async function waitUntilFree(port, attempts = 24) {
-    for (let i = 0; i < attempts; i++) {
-        if (await available(port))
-            return true;
-        await new Promise(resolve => setTimeout(resolve, 250));
-    }
-    return false;
-}
-async function envFor(info, home) {
-    return info.kind === "live" ? { ...info.agent.EnvironmentVariables } :
-        setupRuntimeEnv(await loadSetupConfig(defaultSetupPath(home)));
-}
-async function currentStatus(info, uid, home, portOverride) {
-    const active = await registered(info.label, uid);
-    // First-run setup is a user-owned 0600 profile, NOT an installed
-    // launchd Service. Inspect it directly to discover the Core port.
-    let env = info.kind === "live" ? info.agent.EnvironmentVariables : null;
-    if (info.kind === "setup") {
-        try {
-            env = await envFor(info, home);
-        }
-        catch (e) {
-            if (!["ENOENT", "SETUP_CONFIG_MISSING"].includes(errorCode(e) || ""))
-                throw e;
-        }
-    }
-    const port = portOverride ?? (env ? Number(env.MAC_MCP_PROJECT_PORT) : null);
-    const portBusy = goodPort(port) ? !(await available(port)) : false;
-    let health = portBusy ? "unreachable" : "not-running";
-    let workspaceMode = null;
-    let writeScope = null;
-    let accessMode = null;
-    if (portBusy && port !== null) {
-        try {
-            const r = await fetch("http://127.0.0.1:" + port + "/healthz", {
-                signal: AbortSignal.timeout(2000)
-            });
-            const data = record(await r.json());
-            if (data.accessMode === "ingress" || data.accessMode === "api-key" || data.accessMode === "oauth" || data.accessMode === "unavailable")
-                accessMode = data.accessMode;
-            if (r.ok && data.status === "ok" && typeof data.mode === "string" && ["read-only", "read-write"].includes(data.mode))
-                workspaceMode = data.mode;
-            if (r.ok && data.status === "ok" && typeof data.writeScope === "string" && ["home-only", "unrestricted"].includes(data.writeScope))
-                writeScope = data.writeScope;
-            health = r.ok && data.status === "ok" &&
-                data.service === "dc-project-workspace" ? "ok" : "unrecognized";
-        }
-        catch {
-            health = "unreachable";
-        }
-    }
-    const owner = portBusy && port !== null ? await listenerOwner(port, info.kind === "live" ? info.agent.ProgramArguments[1] : "dc-workspace-http.mjs") : null;
-    let trustedControl = false;
-    if (portBusy && goodPort(port)) {
-        try {
-            const lease = await connectOwner(port);
-            trustedControl = lease?.result.result === "RUNNING";
-        }
-        catch { /* Do not trust a malformed/unresponsive owner lease. */ }
-    }
-    const executionMode = classifyServiceRuntime({
-        registered: active, portBusy, healthy: health === "ok",
-        ownedPid: trustedControl || owner?.matchingEntry === true
-    });
-    const autostart = await disabledFlag(info.label, uid);
-    return { profile: info.kind, installed: info.installed, registered: active,
-        label: info.label, port, health, workspaceMode, writeScope, accessMode, executionMode, listenerPid: owner?.pid ?? null,
-        loginAutostart: autostart === null ? ((info.kind === "live" ? info.agent.RunAtLoad : undefined) === true ? "default-enabled" : "unknown") : autostart ? "disabled" : "enabled",
-        tcc: process.platform === "darwin" ? "Foreground Termius vs background launchd may have different macOS privacy access" : "Access follows the current OS account permissions" };
-}
-export async function executeServiceLifecycle(action, { registered: running, portBusy: busy, disable, enable, bootout, bootstrap, waitPortFree, waitHealthy, port }) {
-    const decision = serviceActionDecision(action, { registered: running, portBusy: busy });
-    if (decision === "PORT_IN_USE" || decision === "FOREGROUND_IN_USE")
-        failure("FOREGROUND_OR_OTHER_LISTENER_ACTIVE: port " + port +
-            " already in use; refusing to start competing service");
-    if (action === "stop") {
-        if (running)
-            await bootout();
-        await disable();
-        const freed = running ? await waitPortFree() : !busy;
-        return { result: decision === "STOP" ? "STOPPED" : "ALREADY_STOPPED",
-            loginAutostart: "disabled", portReleased: freed,
-            foregroundInstanceUntouched: !running && busy };
-    }
-    if (decision === "ALREADY_RUNNING")
-        return { result: decision };
-    if (decision === "RESTART") {
-        await bootout();
-        if (!await waitPortFree()) {
-            await disable();
-            failure("SERVICE_RESTART_PORT_NOT_RELEASED");
-        }
-    }
-    await enable();
-    try {
-        await bootstrap();
-    }
-    catch (e) {
-        await disable();
-        throw e;
-    }
-    if (!await waitHealthy()) {
-        try {
-            await bootout();
-        }
-        catch { /* job may already have exited */ }
-        await disable();
-        failure("SERVICE_START_HEALTH_TIMEOUT_ROLLED_BACK");
-    }
-    return { result: decision === "RESTART" ? "RESTARTED" : "STARTED",
-        loginAutostart: "enabled", health: "ok" };
-}
-async function manage(info, action, uid, home, entry) {
-    if (process.platform !== "darwin")
-        failure("BACKGROUND_SERVICE_UNSUPPORTED_USE_RUN");
-    if (action === "install") {
-        if (info.kind === "live")
-            failure("ALREADY_INSTALLED_NO_OVERWRITE");
-        const created = await serviceCommand("install", {
-            home, entry, configFile: defaultSetupPath(home)
-        });
-        // An installed LaunchAgent does not start again at login until the
-        // owner explicitly invokes start; install is not implicit consent.
-        await setAutostart(info.label, uid, false);
-        return { ...created, loginAutostart: "disabled" };
-    }
-    if (!info.installed)
-        failure("SERVICE_NOT_INSTALLED");
-    const running = await registered(info.label, uid);
-    const env = await envFor(info, home);
-    const port = Number(env.MAC_MCP_PROJECT_PORT);
-    if (!goodPort(port))
-        failure("INVALID_SERVICE_PORT");
-    const busy = !(await available(port));
-    const result = await executeServiceLifecycle(action, {
-        registered: running, portBusy: busy, port,
-        disable: () => setAutostart(info.label, uid, false),
-        enable: () => setAutostart(info.label, uid, true),
-        bootout: () => launch("bootout", uid, info.plist),
-        bootstrap: () => launch("bootstrap", uid, info.plist),
-        waitPortFree: () => waitUntilFree(port),
-        waitHealthy: () => waitForHealthy(port)
-    });
-    if (result.result === "ALREADY_RUNNING")
-        return { ...result, health: (await currentStatus(info, uid, home)).health };
-    return result;
-}
-async function logs(info, lines, uid) {
-    if (!isSafeInteger(lines) || lines < 1 || lines > 200)
-        failure("INVALID_LINES");
-    let output = "";
-    for (const p of info.files) {
-        if (typeof p !== "string" || !path.isAbsolute(p))
-            continue;
-        if (!await owned(p, uid))
-            continue;
-        const stdout = (await readFile(p, "utf8")).split("\n").slice(-lines - 1).join("\n");
-        // Only print to the owner's own terminal; no remote log upload.
-        output += "== " + p + " ==\n" + stdout;
-    }
-    return output || "No logs yet.\n";
-}
-async function runForeground(info, options, home, entry, uid) {
-    // App-managed foreground is still this exact CLI/Core, not a second
-    // execution engine. Bind the run to its *actual* immediate GUI parent.
-    const appParent = options.appParentPid;
-    if (appParent !== undefined && (!isSafeInteger(appParent) || appParent <= 1 ||
-        process.ppid !== appParent))
-        failure("APP_PARENT_IDENTITY_MISMATCH");
-    const env = await envFor(info, home);
-    const configuredPort = Number(env.MAC_MCP_PROJECT_PORT);
-    const port = options.port ?? configuredPort;
-    if (!goodPort(port))
-        failure("INVALID_PORT");
-    // Setup is the user's durable 0600 product configuration. An ad hoc
-    // --port must never make App status/topology disagree with the real Core.
-    if (info.kind === "setup" && port !== configuredPort)
-        failure("SETUP_PORT_OVERRIDE_DENIED_RECONFIGURE");
-    // The atomic owner lease arbitrates CLI vs App, not the local 8793
-    // listener. No second Gateway is ever spawned while the lease is held.
-    const control = await acquireControl(port, {
-        launcher: appParent === undefined ? "cli" : "app", root: options.controlRoot
-    });
-    try {
-        if (!await available(port))
-            failure("PORT_IN_USE: a Gateway or unknown local listener already uses this port");
-        env.MAC_MCP_PROJECT_PORT = String(port);
-        if (info.kind === "setup") {
-            env.MAC_MCP_INTERNAL_SETUP_OWNER_PID = String(process.pid);
-            env.MAC_MCP_INTERNAL_SETUP_RUN_ID = control.owner.runId;
-            env.MAC_MCP_INTERNAL_SETUP_TOKEN = control.owner.token;
-        }
-        // Legacy configuration supplies settings only, never a different executable.
-        const args = info.kind === "live" ? [process.execPath, path.join(packageRoot, "src", "dc-workspace-http.mjs")] : [
-            process.execPath, entry, "start-setup"
-        ];
-        const cwd = packageRoot;
-        await owned(args[1], uid, true);
-        await access(cwd);
-        const identity = await runtimeIdentity();
-        const details = { ...identity, configSource: info.kind === "live" ? info.plist : defaultSetupPath(home), port };
-        const structured = options.json === true || appParent !== undefined;
-        process.stdout.write(structured ? JSON.stringify({ event: "GATEWAY_FOREGROUND_START",
-            ...details, mode: info.kind, stop: "Ctrl+C", existingService: "untouched" }) + "\n" : formatStartup(details));
-        // Do not pass unrelated credentials from the operator's shell.
-        const inherited = {};
-        for (const key of childEnvKeys) {
-            if (typeof process.env[key] === "string")
-                inherited[key] = process.env[key];
-        }
-        if (process.env.MAC_MCP_ACCESS_FILE)
-            env.MAC_MCP_ACCESS_FILE = process.env.MAC_MCP_ACCESS_FILE;
-        const child = spawn(args[0], args.slice(1), {
-            cwd, env: { ...inherited, ...env }, stdio: windows ? ["inherit", "inherit", "inherit", "ipc"] : "inherit"
-        });
-        const stopChild = (signal) => {
-            if (child.exitCode !== null)
-                return;
-            if (windows && child.connected)
-                child.send({ type: "gateway-stop" }, () => { });
-            else
-                child.kill(signal);
-        };
-        const exited = new Promise(resolve => child.once("exit", () => resolve(true)));
-        control.onStop(async () => {
-            stopChild("SIGTERM");
-            const ended = await Promise.race([
-                exited, new Promise(resolve => { setTimeout(() => resolve(false), 8000).unref(); })
-            ]);
-            if (!ended)
-                return "STOP_FAILED";
-            return await waitUntilFree(port, 14) ? "STOPPED" : "STOP_FAILED";
-        });
-        control.markRunning();
-        return await new Promise((resolve, reject) => {
-            const interrupt = () => { stopChild("SIGINT"); };
-            const terminate = () => { stopChild("SIGTERM"); };
-            process.on("SIGINT", interrupt);
-            process.on("SIGTERM", terminate);
-            // A force-quit/crash of the menu-bar App must not orphan the owned Core.
-            // Never monitor, signal or adopt any external listener. This check is
-            // activated only by --app-parent-pid; manual CLI Ctrl+C is unchanged.
-            const parentWatch = appParent === undefined ? null : setInterval(() => {
-                if (process.ppid !== appParent) {
-                    terminate();
-                }
-            }, 400);
-            parentWatch?.unref();
-            const cleanup = () => {
-                process.off("SIGINT", interrupt);
-                process.off("SIGTERM", terminate);
-                if (parentWatch)
-                    clearInterval(parentWatch);
-            };
-            child.once("error", e => { cleanup(); reject(e); });
-            child.once("exit", (code, signal) => {
-                cleanup();
-                process.stdout.write(structured ? JSON.stringify({ event: "GATEWAY_FOREGROUND_STOP", code, signal }) + "\n" :
-                    `\n  Core exited (${signal ?? code ?? "unknown"}).\n`);
-                control.markStopped();
-                resolve(code === null ? (signal === "SIGINT" ? 130 : 1) : code);
-            });
-        });
-    }
-    finally {
-        await control.release();
-    }
-}
-export function parseArgs(argv) {
-    const action = argv[0] || "help";
-    const options = {};
-    for (let i = 1; i < argv.length; i++) {
-        const option = argv[i];
-        if (option === "--json" && ["status", "run"].includes(action)) {
-            if (options.json)
-                failure("DUPLICATE_JSON_OPTION");
-            options.json = true;
-            continue;
-        }
-        if (option === "--all" && action === "privacy") {
-            options.all = true;
-            continue;
-        }
-        const v = argv[++i];
-        if (v === undefined)
-            failure("MISSING_OPTION_VALUE");
-        if (option === "--profile" && ["live", "setup", "auto"].includes(v)) {
-            options.profile = v;
-        }
-        else if (option === "--port" && ["run", "stop", "status"].includes(action) && goodPort(Number(v))) {
-            options.port = Number(v);
-        }
-        else if (option === "--app-parent-pid" && action === "run" &&
-            /^[1-9][0-9]*$/.test(v) && isSafeInteger(Number(v))) {
-            options.appParentPid = Number(v);
-        }
-        else if (option === "--target" && action === "privacy" && path.isAbsolute(v) &&
-            !v.includes("\0")) {
-            options.target = v;
-        }
-        else if (option === "--lines" && action === "logs" &&
-            isInteger(Number(v)) && Number(v) >= 1 && Number(v) <= 200) {
-            options.lines = Number(v);
-        }
-        else
-            failure("INVALID_OPTION");
-    }
-    return { action, options };
-}
-export async function operatorCommand(action, options = {}) {
-    supportedHost();
-    if (process.getuid?.() === 0)
-        failure("DO_NOT_RUN_AS_ROOT");
-    const home = options.home || homedir(), uid = process.getuid?.() ?? 0;
-    const info = await locate(home, uid, options.profile || "auto");
-    const entry = options.entry ?? cliEntry();
-    if (action === "status") {
-        const result = await currentStatus(info, uid, home, options.port);
-        const port = options.port ?? result.port ?? 8793;
-        let controller = null;
-        try {
-            controller = await connectOwner(port, { root: options.controlRoot });
-        }
-        catch { /* An unrecognized or stale local owner never grants stop rights. */ }
-        return { event: "GATEWAY_STATUS", ...result,
-            coreControl: controller?.result.result ?? "unavailable",
-            coreLauncher: controller?.owner.launcher ?? "unknown",
-            coreOwnerPid: controller?.owner.pid ?? null };
-    }
-    if (action === "logs")
-        return { event: "GATEWAY_LOGS",
-            output: await logs(info, options.lines ?? 60, uid) };
-    if (action === "privacy") {
-        if (process.platform !== "darwin")
-            failure("PRIVACY_DIAGNOSTICS_MACOS_ONLY");
-        const env = await envFor(info, home);
-        const { privacyReport } = await import("./privacy-diagnostics.js");
-        return privacyReport({ port: Number(env.MAC_MCP_PROJECT_PORT), home,
-            all: options.all === true, target: options.target ?? null });
-    }
-    if (action === "run")
-        return { event: "GATEWAY_RUN_EXIT",
-            code: await runForeground(info, options, home, entry, uid) };
-    if (action === "stop") {
-        const status = await currentStatus(info, uid, home, options.port);
-        const port = options.port ?? status.port ?? 8793;
-        const control = await globalStop(port, { root: options.controlRoot });
-        if (control.result === "NO_CONTROL_OWNER") {
-            if (!await available(port))
-                failure("CORE_STOP_REFUSED_UNKNOWN_LISTENER");
-            return { event: "GATEWAY_CORE", result: "ALREADY_STOPPED", port };
-        }
-        if (!await waitUntilFree(port, 12))
-            failure("CORE_STOP_UNVERIFIED_PORT_STILL_OCCUPIED");
-        return { event: "GATEWAY_CORE", ...control, port };
-    }
-    if (["install", "start", "restart"].includes(action))
-        failure("SERVICE_MODE_DEFERRED");
-    failure("INVALID_ACTION");
-}
-/** Validated legacy settings for the explicit instance migration workflow. */
-export async function legacyProfileDetails(profile, home = homedir()) {
-    const uid = process.getuid?.() ?? 0;
-    const info = await locate(home, uid, profile);
-    const env = await envFor(info, home);
-    return { kind: info.kind, source: info.kind === 'setup' ? defaultSetupPath(home) : info.plist,
-        env, label: info.label, plist: info.plist, installed: info.installed, registered: await registered(info.label, uid) };
-}
-//# sourceMappingURL=operator-cli.js.map