zora-agent 0.9.0

package/dist/config/defaults.js

@@ -0,0 +1,173 @@
+/**
+ * Default configuration values for Zora.
+ * These are applied when config.toml doesn't specify a value.
+ * Matches the spec §7 configuration reference and docs/CONFIGURATION.md.
+ */
+export const DEFAULT_AGENT = {
+    name: 'zora-agent',
+    workspace: '~/.zora/workspace',
+    max_parallel_jobs: 3,
+    default_timeout: '2h',
+    heartbeat_interval: '30m',
+    log_level: 'info',
+    identity: {
+        soul_file: '~/.zora/workspace/SOUL.md',
+    },
+    resources: {
+        cpu_throttle_percent: 80,
+        memory_limit_mb: 4096,
+        throttle_check_interval: '10s',
+    },
+};
+export const DEFAULT_ROUTING = {
+    mode: 'respect_ranking',
+};
+export const DEFAULT_FAILOVER = {
+    enabled: true,
+    auto_handoff: true,
+    max_handoff_context_tokens: 50_000,
+    retry_after_cooldown: true,
+    max_retries: 3,
+    checkpoint_on_auth_failure: true,
+    notify_on_failover: true,
+};
+export const DEFAULT_MEMORY = {
+    long_term_file: '~/.zora/memory/MEMORY.md',
+    daily_notes_dir: '~/.zora/memory/daily',
+    items_dir: '~/.zora/memory/items',
+    categories_dir: '~/.zora/memory/categories',
+    context_days: 7,
+    max_context_items: 20,
+    max_category_summaries: 5,
+    auto_extract_interval: 10,
+};
+export const DEFAULT_SECURITY = {
+    policy_file: '~/.zora/policy.toml',
+    audit_log: '~/.zora/audit/audit.jsonl',
+    audit_hash_chain: true,
+    audit_single_writer: true,
+    integrity_check: true,
+    integrity_interval: '30m',
+    integrity_includes_tool_registry: true,
+    leak_detection: true,
+    sanitize_untrusted_content: true,
+    jit_secret_decryption: true,
+};
+export const DEFAULT_STEERING = {
+    enabled: true,
+    poll_interval: '5s',
+    dashboard_port: 7070,
+    notify_on_flag: true,
+    flag_timeout: '10m',
+    auto_approve_low_risk: true,
+    always_flag_irreversible: true,
+    telegram: {
+        enabled: false,
+        allowed_users: [],
+        rate_limit_per_min: 20
+    }
+};
+export const DEFAULT_NOTIFICATIONS = {
+    enabled: true,
+    on_task_complete: true,
+    on_error: true,
+    on_failover: true,
+    on_auth_expiry: true,
+    on_all_providers_down: true,
+};
+export const DEFAULT_MCP = {
+    servers: {},
+};
+export const DEFAULT_CONFIG = {
+    agent: DEFAULT_AGENT,
+    providers: [],
+    routing: DEFAULT_ROUTING,
+    failover: DEFAULT_FAILOVER,
+    memory: DEFAULT_MEMORY,
+    security: DEFAULT_SECURITY,
+    steering: DEFAULT_STEERING,
+    notifications: DEFAULT_NOTIFICATIONS,
+    mcp: DEFAULT_MCP,
+};
+/**
+ * Validates a provider config entry has all required fields and valid values.
+ * Returns an array of error messages (empty = valid).
+ */
+export function validateProviderConfig(p, index) {
+    const errors = [];
+    const prefix = `providers[${index}]`;
+    if (!p.name || typeof p.name !== 'string') {
+        errors.push(`${prefix}.name is required and must be a string`);
+    }
+    if (!p.type || typeof p.type !== 'string') {
+        errors.push(`${prefix}.type is required and must be a string`);
+    }
+    if (p.rank == null || typeof p.rank !== 'number' || p.rank < 1) {
+        errors.push(`${prefix}.rank is required and must be a positive integer`);
+    }
+    if (!Array.isArray(p.capabilities) || p.capabilities.length === 0) {
+        errors.push(`${prefix}.capabilities must be a non-empty array of strings`);
+    }
+    const validCostTiers = ['free', 'included', 'metered', 'premium'];
+    if (!p.cost_tier || !validCostTiers.includes(p.cost_tier)) {
+        errors.push(`${prefix}.cost_tier must be one of: ${validCostTiers.join(', ')}`);
+    }
+    return errors;
+}
+/**
+ * Validates the full ZoraConfig.
+ * Returns an array of error messages (empty = valid).
+ */
+export function validateConfig(config) {
+    const errors = [];
+    // Agent validation
+    if (!config.agent.name) {
+        errors.push('agent.name is required');
+    }
+    if (config.agent.max_parallel_jobs < 1) {
+        errors.push('agent.max_parallel_jobs must be >= 1');
+    }
+    if (config.agent.resources.cpu_throttle_percent < 1 || config.agent.resources.cpu_throttle_percent > 100) {
+        errors.push('agent.resources.cpu_throttle_percent must be 1-100');
+    }
+    if (config.agent.resources.memory_limit_mb < 256) {
+        errors.push('agent.resources.memory_limit_mb must be >= 256');
+    }
+    // Routing validation
+    const validModes = ['respect_ranking', 'optimize_cost', 'provider_only', 'round_robin'];
+    if (!validModes.includes(config.routing.mode)) {
+        errors.push(`routing.mode must be one of: ${validModes.join(', ')}`);
+    }
+    if (config.routing.mode === 'provider_only' && !config.routing.provider_only_name) {
+        errors.push('routing.provider_only_name is required when mode is provider_only');
+    }
+    // Provider validation
+    for (let i = 0; i < config.providers.length; i++) {
+        errors.push(...validateProviderConfig(config.providers[i], i));
+    }
+    // Check for duplicate provider names
+    const names = config.providers.map((p) => p.name);
+    const dupes = names.filter((n, i) => names.indexOf(n) !== i);
+    if (dupes.length > 0) {
+        errors.push(`Duplicate provider names: ${[...new Set(dupes)].join(', ')}`);
+    }
+    // Check for duplicate ranks
+    const ranks = config.providers.filter((p) => p.enabled).map((p) => p.rank);
+    const dupeRanks = ranks.filter((r, i) => ranks.indexOf(r) !== i);
+    if (dupeRanks.length > 0) {
+        errors.push(`Duplicate provider ranks among enabled providers: ${[...new Set(dupeRanks)].join(', ')}`);
+    }
+    // Failover validation
+    if (config.failover.max_retries < 0) {
+        errors.push('failover.max_retries must be >= 0');
+    }
+    if (config.failover.max_handoff_context_tokens < 1000) {
+        errors.push('failover.max_handoff_context_tokens must be >= 1000');
+    }
+    // Steering validation
+    if (config.steering.dashboard_port < 1 || config.steering.dashboard_port > 65535) {
+        errors.push('steering.dashboard_port must be 1-65535');
+    }
+    return errors;
+}
+//# sourceMappingURL=defaults.js.map

package/dist/config/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,MAAM,CAAC,MAAM,aAAa,GAAgB;IACxC,IAAI,EAAE,YAAY;IAClB,SAAS,EAAE,mBAAmB;IAC9B,iBAAiB,EAAE,CAAC;IACpB,eAAe,EAAE,IAAI;IACrB,kBAAkB,EAAE,KAAK;IACzB,SAAS,EAAE,MAAM;IACjB,QAAQ,EAAE;QACR,SAAS,EAAE,2BAA2B;KACvC;IACD,SAAS,EAAE;QACT,oBAAoB,EAAE,EAAE;QACxB,eAAe,EAAE,IAAI;QACrB,uBAAuB,EAAE,KAAK;KAC/B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAkB;IAC5C,IAAI,EAAE,iBAAiB;CACxB,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC9C,OAAO,EAAE,IAAI;IACb,YAAY,EAAE,IAAI;IAClB,0BAA0B,EAAE,MAAM;IAClC,oBAAoB,EAAE,IAAI;IAC1B,WAAW,EAAE,CAAC;IACd,0BAA0B,EAAE,IAAI;IAChC,kBAAkB,EAAE,IAAI;CACzB,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,cAAc,EAAE,0BAA0B;IAC1C,eAAe,EAAE,sBAAsB;IACvC,SAAS,EAAE,sBAAsB;IACjC,cAAc,EAAE,2BAA2B;IAC3C,YAAY,EAAE,CAAC;IACf,iBAAiB,EAAE,EAAE;IACrB,sBAAsB,EAAE,CAAC;IACzB,qBAAqB,EAAE,EAAE;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC9C,WAAW,EAAE,qBAAqB;IAClC,SAAS,EAAE,2BAA2B;IACtC,gBAAgB,EAAE,IAAI;IACtB,mBAAmB,EAAE,IAAI;IACzB,eAAe,EAAE,IAAI;IACrB,kBAAkB,EAAE,KAAK;IACzB,gCAAgC,EAAE,IAAI;IACtC,cAAc,EAAE,IAAI;IACpB,0BAA0B,EAAE,IAAI;IAChC,qBAAqB,EAAE,IAAI;CAC5B,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC9C,OAAO,EAAE,IAAI;IACb,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,IAAI;IACpB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,KAAK;IACnB,qBAAqB,EAAE,IAAI;IAC3B,wBAAwB,EAAE,IAAI;IAC9B,QAAQ,EAAE;QACR,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,EAAE;QACjB,kBAAkB,EAAE,EAAE;KACvB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAwB;IACxD,OAAO,EAAE,IAAI;IACb,gBAAgB,EAAE,IAAI;IACtB,QAAQ,EAAE,IAAI;IACd,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE,IAAI;IACpB,qBAAqB,EAAE,IAAI;CAC5B,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,KAAK,EAAE,aAAa;IACpB,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,eAAe;IACxB,QAAQ,EAAE,gBAAgB;IAC1B,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,gBAAgB;IAC1B,QAAQ,EAAE,gBAAgB;IAC1B,aAAa,EAAE,qBAAqB;IACpC,GAAG,EAAE,WAAW;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAA0B,EAAE,KAAa;IAC9E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,aAAa,KAAK,GAAG,CAAC;IAErC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,wCAAwC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,wCAAwC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,kDAAkD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,oDAAoD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,8BAA8B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,mBAAmB;IACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,oBAAoB,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,oBAAoB,GAAG,GAAG,EAAE,CAAC;QACzG,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAChE,CAAC;IAED,qBAAqB;IACrB,MAAM,UAAU,GAAG,CAAC,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;IACxF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,gCAAgC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IACnF,CAAC;IAED,sBAAsB;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,qCAAqC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,4BAA4B;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,0BAA0B,GAAG,IAAI,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACrE,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,GAAG,KAAK,EAAE,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/config/index.d.ts

@@ -0,0 +1,3 @@
+export { DEFAULT_CONFIG, validateConfig, validateProviderConfig } from './defaults.js';
+export { loadConfig, loadConfigFromString, parseConfig, ConfigError } from './loader.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/config/index.js

@@ -0,0 +1,3 @@
+export { DEFAULT_CONFIG, validateConfig, validateProviderConfig } from './defaults.js';
+export { loadConfig, loadConfigFromString, parseConfig, ConfigError } from './loader.js';
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/config/loader.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Config Loader — reads config.toml, merges with defaults, validates.
+ *
+ * Spec §4.2: Config system — TOML parser, defaults, validation.
+ * Uses smol-toml for zero-dependency TOML parsing.
+ */
+import type { ZoraConfig, McpServerEntry } from '../types.js';
+export declare class ConfigError extends Error {
+    readonly errors: string[];
+    constructor(message: string, errors: string[]);
+}
+/**
+ * Parse raw TOML data into a ZoraConfig, applying defaults for missing fields.
+ */
+export declare function parseConfig(raw: Record<string, unknown>): ZoraConfig;
+/**
+ * Load config from a TOML file path. Merges with defaults and validates.
+ * Throws ConfigError if validation fails.
+ */
+export declare function loadConfig(configPath: string): Promise<ZoraConfig>;
+/**
+ * Load config from a TOML string. Useful for testing.
+ */
+export declare function loadConfigFromString(toml: string): ZoraConfig;
+/**
+ * Converts Zora MCP server config to the SDK's McpServerConfig format.
+ * SDK types: McpStdioServerConfig | McpSSEServerConfig | McpHttpServerConfig
+ */
+export declare function toSdkMcpServers(servers: Record<string, McpServerEntry>): Record<string, Record<string, unknown>>;
+//# sourceMappingURL=loader.d.ts.map

package/dist/config/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAkB,cAAc,EAAE,MAAM,aAAa,CAAC;AAG9E,qBAAa,WAAY,SAAQ,KAAK;aAGlB,MAAM,EAAE,MAAM,EAAE;gBADhC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EAAE;CAKnC;AAoCD;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAiCpE;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAcxE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAa7D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GACtC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA8BzC"}

package/dist/config/loader.js

@@ -0,0 +1,130 @@
+/**
+ * Config Loader — reads config.toml, merges with defaults, validates.
+ *
+ * Spec §4.2: Config system — TOML parser, defaults, validation.
+ * Uses smol-toml for zero-dependency TOML parsing.
+ */
+import { readFile } from 'node:fs/promises';
+import { parse as parseTOML } from 'smol-toml';
+import { DEFAULT_CONFIG, validateConfig } from './defaults.js';
+export class ConfigError extends Error {
+    errors;
+    constructor(message, errors) {
+        super(message);
+        this.errors = errors;
+        this.name = 'ConfigError';
+    }
+}
+/**
+ * Deep merge two objects. Arrays are replaced, not merged.
+ * Source values override target values.
+ */
+function deepMerge(target, source) {
+    const result = { ...target };
+    for (const key of Object.keys(source)) {
+        const sourceVal = source[key];
+        const targetVal = result[key];
+        if (sourceVal !== null &&
+            typeof sourceVal === 'object' &&
+            !Array.isArray(sourceVal) &&
+            targetVal !== null &&
+            typeof targetVal === 'object' &&
+            !Array.isArray(targetVal)) {
+            result[key] = deepMerge(targetVal, sourceVal);
+        }
+        else {
+            result[key] = sourceVal;
+        }
+    }
+    return result;
+}
+/**
+ * Parse raw TOML data into a ZoraConfig, applying defaults for missing fields.
+ */
+export function parseConfig(raw) {
+    // Start with defaults
+    const config = deepMerge(DEFAULT_CONFIG, raw);
+    // Providers are an array in TOML ([[providers]]), need special handling
+    if (Array.isArray(raw['providers'])) {
+        config.providers = raw['providers'].map((p) => ({
+            name: '',
+            type: '',
+            rank: 0,
+            capabilities: [],
+            cost_tier: 'metered',
+            enabled: true,
+            ...p,
+        }));
+    }
+    // Handle MCP config
+    if (raw['mcp'] && typeof raw['mcp'] === 'object') {
+        const mcpRaw = raw['mcp'];
+        if (mcpRaw['servers'] && typeof mcpRaw['servers'] === 'object') {
+            config.mcp = {
+                servers: mcpRaw['servers'],
+            };
+        }
+    }
+    return config;
+}
+/**
+ * Load config from a TOML file path. Merges with defaults and validates.
+ * Throws ConfigError if validation fails.
+ */
+export async function loadConfig(configPath) {
+    const content = await readFile(configPath, 'utf-8');
+    const raw = parseTOML(content);
+    const config = parseConfig(raw);
+    const errors = validateConfig(config);
+    if (errors.length > 0) {
+        throw new ConfigError(`Invalid configuration (${errors.length} error${errors.length > 1 ? 's' : ''})`, errors);
+    }
+    return config;
+}
+/**
+ * Load config from a TOML string. Useful for testing.
+ */
+export function loadConfigFromString(toml) {
+    const raw = parseTOML(toml);
+    const config = parseConfig(raw);
+    const errors = validateConfig(config);
+    if (errors.length > 0) {
+        throw new ConfigError(`Invalid configuration (${errors.length} error${errors.length > 1 ? 's' : ''})`, errors);
+    }
+    return config;
+}
+/**
+ * Converts Zora MCP server config to the SDK's McpServerConfig format.
+ * SDK types: McpStdioServerConfig | McpSSEServerConfig | McpHttpServerConfig
+ */
+export function toSdkMcpServers(servers) {
+    const result = {};
+    for (const [name, server] of Object.entries(servers)) {
+        if (server.type === 'stdio' || (!server.type && server.command)) {
+            // stdio transport
+            if (!server.command) {
+                console.warn(`Skipping MCP server "${name}": stdio transport requires a command`);
+                continue;
+            }
+            result[name] = {
+                command: server.command,
+                ...(server.args && { args: server.args }),
+                ...(server.env && { env: server.env }),
+            };
+        }
+        else {
+            // HTTP or SSE transport
+            if (!server.url) {
+                console.warn(`Skipping MCP server "${name}": http/sse transport requires a url`);
+                continue;
+            }
+            result[name] = {
+                type: server.type ?? 'http',
+                url: server.url,
+                ...(server.headers && { headers: server.headers }),
+            };
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=loader.js.map

package/dist/config/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/D,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB;IAFlB,YACE,OAAe,EACC,MAAgB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAAU;QAGhC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,SAAS,CAChB,MAAS,EACT,MAA+B;IAE/B,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAE7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAI,MAAkC,CAAC,GAAG,CAAC,CAAC;QAE3D,IACE,SAAS,KAAK,IAAI;YAClB,OAAO,SAAS,KAAK,QAAQ;YAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YACzB,SAAS,KAAK,IAAI;YAClB,OAAO,SAAS,KAAK,QAAQ;YAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACzB,CAAC;YACA,MAAkC,CAAC,GAAG,CAAC,GAAG,SAAS,CAClD,SAAoC,EACpC,SAAoC,CACrC,CAAC;QACJ,CAAC;aAAM,CAAC;YACL,MAAkC,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAA4B;IACtD,sBAAsB;IACtB,MAAM,MAAM,GAAG,SAAS,CACtB,cAAoD,EACpD,GAAG,CACqB,CAAC;IAE3B,wEAAwE;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,SAAS,GAAI,GAAG,CAAC,WAAW,CAA+B,CAAC,GAAG,CACpE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACN,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,CAAC;YACP,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,SAAkB;YAC7B,OAAO,EAAE,IAAI;YACb,GAAG,CAAC;SACL,CAAmB,CACrB,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAA4B,CAAC;QACrD,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,CAAC,GAAG,GAAG;gBACX,OAAO,EAAE,MAAM,CAAC,SAAS,CAAmC;aAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB;IACjD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAA4B,CAAC;IAC1D,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAEhC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CACnB,0BAA0B,MAAM,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAC/E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAA4B,CAAC;IACvD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAEhC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CACnB,0BAA0B,MAAM,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAC/E,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAuC;IAEvC,MAAM,MAAM,GAA4C,EAAE,CAAC;IAE3D,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAChE,kBAAkB;YAClB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,wBAAwB,IAAI,uCAAuC,CAAC,CAAC;gBAClF,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG;gBACb,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;aACvC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,wBAAwB;YACxB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,wBAAwB,IAAI,sCAAsC,CAAC,CAAC;gBACjF,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG;gBACb,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM;gBAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;aACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/config/policy-loader.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Policy Loader — centralized TOML → ZoraPolicy parsing.
+ *
+ * Replaces duplicated policy parsing in cli/index.ts and cli/daemon.ts.
+ * Handles backward compatibility: missing sections use safe defaults.
+ */
+import type { ZoraPolicy } from '../types.js';
+/**
+ * Load and parse a ZoraPolicy from a TOML file.
+ * Throws if the file does not exist.
+ */
+export declare function loadPolicy(policyPath: string): Promise<ZoraPolicy>;
+/**
+ * Parse a ZoraPolicy from raw TOML data.
+ * Applies safe defaults for any missing sections or fields.
+ */
+export declare function parsePolicy(raw: Record<string, unknown>): ZoraPolicy;
+//# sourceMappingURL=policy-loader.d.ts.map

package/dist/config/policy-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-loader.d.ts","sourceRoot":"","sources":["../../src/config/policy-loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;GAGG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAQxE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAgDpE"}

package/dist/config/policy-loader.js

@@ -0,0 +1,72 @@
+/**
+ * Policy Loader — centralized TOML → ZoraPolicy parsing.
+ *
+ * Replaces duplicated policy parsing in cli/index.ts and cli/daemon.ts.
+ * Handles backward compatibility: missing sections use safe defaults.
+ */
+import fs from 'node:fs';
+/**
+ * Load and parse a ZoraPolicy from a TOML file.
+ * Throws if the file does not exist.
+ */
+export async function loadPolicy(policyPath) {
+    if (!fs.existsSync(policyPath)) {
+        throw new Error(`Policy file not found at ${policyPath}. Run \`zora init\` first.`);
+    }
+    const { parse: parseTOML } = await import('smol-toml');
+    const raw = parseTOML(fs.readFileSync(policyPath, 'utf-8'));
+    return parsePolicy(raw);
+}
+/**
+ * Parse a ZoraPolicy from raw TOML data.
+ * Applies safe defaults for any missing sections or fields.
+ */
+export function parsePolicy(raw) {
+    const fsPol = raw['filesystem'];
+    const shPol = raw['shell'];
+    const actPol = raw['actions'];
+    const netPol = raw['network'];
+    const budPol = raw['budget'];
+    const dryPol = raw['dry_run'];
+    return {
+        filesystem: {
+            allowed_paths: fsPol?.['allowed_paths'] ?? [],
+            denied_paths: fsPol?.['denied_paths'] ?? [],
+            resolve_symlinks: fsPol?.['resolve_symlinks'] ?? true,
+            follow_symlinks: fsPol?.['follow_symlinks'] ?? false,
+        },
+        shell: {
+            mode: shPol?.['mode'] ?? 'allowlist',
+            allowed_commands: shPol?.['allowed_commands'] ?? ['ls', 'npm', 'git'],
+            denied_commands: shPol?.['denied_commands'] ?? [],
+            split_chained_commands: shPol?.['split_chained_commands'] ?? true,
+            max_execution_time: shPol?.['max_execution_time'] ?? '1m',
+        },
+        actions: {
+            reversible: actPol?.['reversible'] ?? [],
+            irreversible: actPol?.['irreversible'] ?? [],
+            always_flag: actPol?.['always_flag'] ?? [],
+        },
+        network: {
+            allowed_domains: netPol?.['allowed_domains'] ?? [],
+            denied_domains: netPol?.['denied_domains'] ?? [],
+            max_request_size: netPol?.['max_request_size'] ?? '10mb',
+        },
+        ...(budPol ? {
+            budget: {
+                max_actions_per_session: budPol['max_actions_per_session'] ?? 0,
+                max_actions_per_type: budPol['max_actions_per_type'] ?? {},
+                token_budget: budPol['token_budget'] ?? 0,
+                on_exceed: budPol['on_exceed'] ?? 'block',
+            },
+        } : {}),
+        ...(dryPol ? {
+            dry_run: {
+                enabled: dryPol['enabled'] ?? false,
+                tools: dryPol['tools'] ?? [],
+                audit_dry_runs: dryPol['audit_dry_runs'] ?? true,
+            },
+        } : {}),
+    };
+}
+//# sourceMappingURL=policy-loader.js.map

package/dist/config/policy-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-loader.js","sourceRoot":"","sources":["../../src/config/policy-loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AAGzB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,4BAA4B,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,CAAC;IACvF,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAA4B;IACtD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAwC,CAAC;IACvE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAwC,CAAC;IAClE,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAwC,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAwC,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAwC,CAAC;IACpE,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAwC,CAAC;IAErE,OAAO;QACL,UAAU,EAAE;YACV,aAAa,EAAG,KAAK,EAAE,CAAC,eAAe,CAAc,IAAI,EAAE;YAC3D,YAAY,EAAG,KAAK,EAAE,CAAC,cAAc,CAAc,IAAI,EAAE;YACzD,gBAAgB,EAAG,KAAK,EAAE,CAAC,kBAAkB,CAAa,IAAI,IAAI;YAClE,eAAe,EAAG,KAAK,EAAE,CAAC,iBAAiB,CAAa,IAAI,KAAK;SAClE;QACD,KAAK,EAAE;YACL,IAAI,EAAG,KAAK,EAAE,CAAC,MAAM,CAA2C,IAAI,WAAW;YAC/E,gBAAgB,EAAG,KAAK,EAAE,CAAC,kBAAkB,CAAc,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;YACnF,eAAe,EAAG,KAAK,EAAE,CAAC,iBAAiB,CAAc,IAAI,EAAE;YAC/D,sBAAsB,EAAG,KAAK,EAAE,CAAC,wBAAwB,CAAa,IAAI,IAAI;YAC9E,kBAAkB,EAAG,KAAK,EAAE,CAAC,oBAAoB,CAAY,IAAI,IAAI;SACtE;QACD,OAAO,EAAE;YACP,UAAU,EAAG,MAAM,EAAE,CAAC,YAAY,CAAc,IAAI,EAAE;YACtD,YAAY,EAAG,MAAM,EAAE,CAAC,cAAc,CAAc,IAAI,EAAE;YAC1D,WAAW,EAAG,MAAM,EAAE,CAAC,aAAa,CAAc,IAAI,EAAE;SACzD;QACD,OAAO,EAAE;YACP,eAAe,EAAG,MAAM,EAAE,CAAC,iBAAiB,CAAc,IAAI,EAAE;YAChE,cAAc,EAAG,MAAM,EAAE,CAAC,gBAAgB,CAAc,IAAI,EAAE;YAC9D,gBAAgB,EAAG,MAAM,EAAE,CAAC,kBAAkB,CAAY,IAAI,MAAM;SACrE;QACD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACX,MAAM,EAAE;gBACN,uBAAuB,EAAG,MAAM,CAAC,yBAAyB,CAAY,IAAI,CAAC;gBAC3E,oBAAoB,EAAG,MAAM,CAAC,sBAAsB,CAA4B,IAAI,EAAE;gBACtF,YAAY,EAAG,MAAM,CAAC,cAAc,CAAY,IAAI,CAAC;gBACrD,SAAS,EAAG,MAAM,CAAC,WAAW,CAAsB,IAAI,OAAO;aAChE;SACF,CAAC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACX,OAAO,EAAE;gBACP,OAAO,EAAG,MAAM,CAAC,SAAS,CAAa,IAAI,KAAK;gBAChD,KAAK,EAAG,MAAM,CAAC,OAAO,CAAc,IAAI,EAAE;gBAC1C,cAAc,EAAG,MAAM,CAAC,gBAAgB,CAAa,IAAI,IAAI;aAC9D;SACF,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/dist/dashboard/auth-middleware.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Auth Middleware — Bearer token authentication for the dashboard API.
+ *
+ * Spec v0.6 §5.8 "Dashboard Authentication":
+ *   - Validates Authorization: Bearer <token> header.
+ *   - Skips auth for the /health endpoint.
+ *   - Token sourced from environment variable or static config.
+ */
+import type { RequestHandler } from 'express';
+export interface AuthMiddlewareOptions {
+    tokenEnvVar?: string;
+    staticToken?: string;
+}
+export declare function createAuthMiddleware(options: AuthMiddlewareOptions): RequestHandler;
+//# sourceMappingURL=auth-middleware.d.ts.map

package/dist/dashboard/auth-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../src/dashboard/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAE/E,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CAwCnF"}

package/dist/dashboard/auth-middleware.js

@@ -0,0 +1,44 @@
+/**
+ * Auth Middleware — Bearer token authentication for the dashboard API.
+ *
+ * Spec v0.6 §5.8 "Dashboard Authentication":
+ *   - Validates Authorization: Bearer <token> header.
+ *   - Skips auth for the /health endpoint.
+ *   - Token sourced from environment variable or static config.
+ */
+import crypto from 'node:crypto';
+export function createAuthMiddleware(options) {
+    return (req, res, next) => {
+        // Skip auth for health checks
+        if (req.path === '/health' || req.path === '/api/health') {
+            next();
+            return;
+        }
+        const expectedToken = options.staticToken
+            ?? (options.tokenEnvVar ? process.env[options.tokenEnvVar] : undefined);
+        if (!expectedToken) {
+            res.status(500).json({ error: 'Server misconfiguration: no auth token defined' });
+            return;
+        }
+        const authHeader = req.headers.authorization;
+        if (!authHeader) {
+            res.status(401).json({ error: 'Missing Authorization header' });
+            return;
+        }
+        // HTTP auth schemes are case-insensitive (RFC 7235)
+        if (!authHeader.toLowerCase().startsWith('bearer ')) {
+            res.status(401).json({ error: 'Invalid Authorization header format. Expected: Bearer <token>' });
+            return;
+        }
+        const token = authHeader.slice('bearer '.length);
+        // Use timing-safe comparison to prevent timing attacks
+        const tokenBuf = Buffer.from(token);
+        const expectedBuf = Buffer.from(expectedToken);
+        if (tokenBuf.length !== expectedBuf.length || !crypto.timingSafeEqual(tokenBuf, expectedBuf)) {
+            res.status(401).json({ error: 'Invalid token' });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=auth-middleware.js.map

package/dist/dashboard/auth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../src/dashboard/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAQjC,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,8BAA8B;QAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACzD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW;eACpC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAE1E,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,oDAAoD;QACpD,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+DAA+D,EAAE,CAAC,CAAC;YACjG,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEjD,uDAAuD;QACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/dashboard/frontend/vite.config.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("vite").UserConfig;
+export default _default;
+//# sourceMappingURL=vite.config.d.ts.map

package/dist/dashboard/frontend/vite.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite.config.d.ts","sourceRoot":"","sources":["../../../src/dashboard/frontend/vite.config.ts"],"names":[],"mappings":";AAIA,wBAMG"}

package/dist/dashboard/frontend/vite.config.js

@@ -0,0 +1,11 @@
+import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+// https://vitejs.dev/config/
+export default defineConfig({
+    plugins: [react()],
+    build: {
+        outDir: 'dist',
+        emptyOutDir: true,
+    },
+});
+//# sourceMappingURL=vite.config.js.map

package/dist/dashboard/frontend/vite.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite.config.js","sourceRoot":"","sources":["../../../src/dashboard/frontend/vite.config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,MAAM,sBAAsB,CAAC;AAEzC,6BAA6B;AAC7B,eAAe,YAAY,CAAC;IAC1B,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,KAAK,EAAE;QACL,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,IAAI;KAClB;CACF,CAAC,CAAC"}

package/dist/dashboard/server.d.ts

@@ -0,0 +1,55 @@
+/**
+ * DashboardServer — Local API and static file server for the Zora UI.
+ *
+ * Spec §6.0 "Web Dashboard Spec":
+ *   - Binds to localhost:7070 by default.
+ *   - Serves as the primary ingress for async steering.
+ */
+import type { ExecutionLoop } from '../orchestrator/execution-loop.js';
+import type { SessionManager } from '../orchestrator/session-manager.js';
+import type { SteeringManager } from '../steering/steering-manager.js';
+import type { AuthMonitor } from '../orchestrator/auth-monitor.js';
+import type { LLMProvider } from '../types.js';
+export interface SubmitTaskFn {
+    (prompt: string): Promise<string>;
+}
+export interface DashboardOptions {
+    loop?: ExecutionLoop;
+    providers?: LLMProvider[];
+    sessionManager: SessionManager;
+    steeringManager: SteeringManager;
+    authMonitor: AuthMonitor;
+    submitTask?: SubmitTaskFn;
+    port?: number;
+    host?: string;
+}
+export declare class DashboardServer {
+    private readonly _app;
+    private readonly _options;
+    private _server;
+    private readonly _sseClients;
+    constructor(options: DashboardOptions);
+    /**
+     * Simple in-memory rate limiter (no external dependency).
+     * Limits to 100 requests per 15 minutes per IP.
+     * Prunes expired entries periodically to prevent unbounded memory growth.
+     */
+    private _createRateLimiter;
+    private _setupRoutes;
+    /**
+     * Broadcast an event to all connected SSE clients.
+     */
+    broadcastEvent(event: {
+        type: string;
+        data: unknown;
+    }): void;
+    /**
+     * Starts the dashboard server on localhost.
+     */
+    start(): Promise<void>;
+    /**
+     * Stops the dashboard server.
+     */
+    stop(): Promise<void>;
+}
+//# sourceMappingURL=server.d.ts.map

package/dist/dashboard/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/dashboard/server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAyB,MAAM,aAAa,CAAC;AAItE,MAAM,WAAW,YAAY;IAC3B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,cAAc,EAAE,cAAc,CAAC;IAC/B,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmC;gBAEnD,OAAO,EAAE,gBAAgB;IAiBrC;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAoC1B,OAAO,CAAC,YAAY;IA2JpB;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IAa5D;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAW5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAgB5B"}