@1claw/cli 0.59.9 → 0.60.0

package/README.md

@@ -1,4 +1,4 @@
-# @1claw/cli (v0.59.4)
+# @1claw/cli (v0.59.9)
 
 > ⭐ **Star [1clawAI/agent-templates](https://github.com/1clawAI/agent-templates)** — ready-to-run agent templates wired to 1Claw. It is our single starred repo.
 
@@ -773,6 +773,18 @@ Manage platform apps for developers building multi-tenant applications on top of
 1claw platform reissue-claim <connection-id>   # Reissue a claim URL (no re-provisioning)
 1claw platform app-stats <app-id>              # Connection/bootstrap/grant statistics
 1claw platform marketplace                     # Browse the public platform marketplace
+
+# Fleets — every agent one template provisioned, as one cohort.
+# Each of these acts on all of them at once, so the mutating ones confirm
+# first and print how many agents they are about to touch.
+1claw platform fleet status <app-id> <template-id>    # Version skew and drift
+1claw platform fleet agents <app-id> <template-id>    # List them (--drifted to filter)
+1claw platform fleet patch <app-id> <template-id> \
+  --set system_prompt="You are..."                    # Guardrails/capability flags refused
+1claw platform fleet rollout <app-id> <template-id> \
+  --dry-run                                           # Plan; changes nothing, claims no job
+1claw platform fleet rollout <app-id> <template-id>   # Apply; skips hand-edited agents
+1claw platform fleet pause <app-id> <template-id>     # Deactivate the whole cohort
 1claw platform upsert-user \
   --email user@example.com                     # Provision or find a user (platform-only)
 1claw platform upsert-user \
@@ -963,7 +975,9 @@ Browse the public agent directory and manage agent discoverability.
 
 ## Local Vault (Offline, Encrypted)
 
-Store secrets locally in an encrypted vault — no cloud required. Secrets are encrypted at rest with AES-256-GCM using a passphrase-derived key (PBKDF2, 100k iterations).
+Store secrets locally in an encrypted vault — no cloud required. Secrets are encrypted at rest with AES-256-GCM using a passphrase-derived key (**scrypt**, N=2^17, r=8).
+
+Files written before v0.59.10 used PBKDF2 at 100k iterations. They still open, and are rewritten with scrypt the next time the vault is saved — a vault in use upgrades itself. The change matters because this file sits on your disk and its whole security is the passphrase: 100k SHA-256 rounds is a few milliseconds on a GPU, while scrypt at these parameters costs ~128MB and a few hundred milliseconds per guess.
 
 ```bash
 1claw local init                   # Create local vault with passphrase
@@ -985,6 +999,44 @@ Vault file: `~/.config/1claw/local-vault.enc` (0600 permissions, safe to back up
 
 **Forgot your passphrase?** The vault is encrypted with a passphrase-derived key, so there is no recovery of the contents. To start over, run `1claw local destroy --force` (no passphrase required — it also stops any running daemon holding the old vault), then `1claw local init`.
 
+## Browser Bridge (`browser`)
+
+Let an agent log into a site without ever giving it the password. The agent
+drives the browser; the bridge types the secret.
+
+```bash
+# Hosted — pair a machine, define what may be typed where
+1claw browser pair laptop --public-key "<bridge public key>"
+1claw browser devices                    # revoked devices are listed, not hidden
+1claw browser revoke <device-id>         # what makes a leaked credential stop working
+
+1claw browser binding create acme-login \
+  --vault <vault-id> --path acme/password \
+  --login-url https://app.acme.example/login \
+  --hosts app.acme.example                # exact match; wildcards are refused
+1claw browser binding list
+1claw browser binding rm <binding-id>
+
+# Local file — no 1Claw account needed
+export ONECLAW_BRIDGE_VAULT_PASSPHRASE='…'   # never a flag: argv shows up in ps
+1claw browser vault init ~/.1claw/bridge.json
+printf '%s' 'the-password' | 1claw browser vault add ~/.1claw/bridge.json \
+  --id acme --url https://app.acme.example/login --hosts app.acme.example
+1claw browser vault list ~/.1claw/bridge.json   # ids and rules, never a secret
+
+# Run it
+1claw browser start --vault ~/.1claw/bridge.json --chrome /path/to/chrome
+```
+
+This replaces `1claw-vault`, which shipped with `@1claw/browser-bridge`. That
+binary still works and prints a pointer; it goes in the next minor. It is the
+same file and the same format — `1claw browser vault` reads and writes through
+the bridge's own implementation rather than a second copy.
+
+The local-file subcommands need `@1claw/browser-bridge` installed (an optional
+dependency) and **no account**. The hosted subcommands need an account and no
+extra install.
+
 ## Local Daemon (Secret Proxy)
 
 The daemon serves secrets over a Unix socket and injects them into HTTP requests without exposing values to the AI model. This provides a trust boundary: the model knows *which* secret to use and *where* to send it, but never sees the raw value.

package/dist/src/commands/approval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval.d.ts","sourceRoot":"","sources":["../../../src/commands/approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwBpC,eAAO,MAAM,eAAe,SAE3B,CAAC"}
+{"version":3,"file":"approval.d.ts","sourceRoot":"","sources":["../../../src/commands/approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqCpC,eAAO,MAAM,eAAe,SAE3B,CAAC"}

package/dist/src/commands/approval.js

@@ -29,7 +29,10 @@ approvalCommand
         printTable(result.approvals.map((a) => ({
             id: a.id,
             action: a.action,
-            target: `${a.target_type}/${a.target_id.slice(0, 8)}`,
+            // The sentence if there is one; the raw target otherwise.
+            target: a.human_summary
+                ? truncate(a.human_summary, 40)
+                : `${a.target_type}/${a.target_id.slice(0, 8)}`,
             risk: riskBadge(a.risk_tier),
             status: statusBadge(a.status),
             agent: a.agent_id.slice(0, 8),
@@ -40,7 +43,7 @@ approvalCommand
         })), [
             { key: "id", header: "ID", width: 38 },
             { key: "action", header: "Action", width: 18 },
-            { key: "target", header: "Target", width: 22 },
+            { key: "target", header: "Summary", width: 42 },
             { key: "risk", header: "Risk" },
             { key: "status", header: "Status" },
             { key: "agent", header: "Agent" },
@@ -90,17 +93,30 @@ approvalCommand
             printJson(a);
             return;
         }
-        printKeyValue([
+        const rows = [
             ["ID", a.id],
             ["Action", a.action],
-            ["Target Type", a.target_type],
-            ["Target ID", a.target_id],
-            ["Risk Tier", a.risk_tier],
-            ["Status", a.status],
-            ["Agent ID", a.agent_id],
-            ["Created", new Date(a.created_at).toLocaleDateString()],
-            ["Expires", a.expires_at ? new Date(a.expires_at).toLocaleDateString() : "—"],
-        ]);
+        ];
+        if (a.human_summary)
+            rows.push(["Summary", a.human_summary]);
+        rows.push(["Target Type", a.target_type], ["Target ID", a.target_id], ["Risk Tier", riskBadge(a.risk_tier)]);
+        // Only worth a line when the two disagree — otherwise it is noise.
+        if (a.declared_below_floor) {
+            rows.push([
+                "Requested Tier",
+                chalk.yellow(`${a.declared_risk_tier} (raised to ${a.risk_tier} by policy)`),
+            ]);
+        }
+        rows.push(["Status", statusBadge(a.status)], ["Agent ID", a.agent_id]);
+        if (a.payload && Object.keys(a.payload).length > 0) {
+            rows.push(["Payload", JSON.stringify(a.payload)]);
+        }
+        if (a.reason)
+            rows.push(["Reason", a.reason]);
+        if (a.decision_reason)
+            rows.push(["Decision Reason", a.decision_reason]);
+        rows.push(["Created", new Date(a.created_at).toLocaleDateString()], ["Expires", a.expires_at ? new Date(a.expires_at).toLocaleDateString() : "—"]);
+        printKeyValue(rows);
     }
     catch (e) {
         handleError(e);
@@ -127,16 +143,19 @@ approvalCommand
         handleError(e);
     }
 });
+function truncate(s, max) {
+    return s.length <= max ? s : `${s.slice(0, max - 1)}…`;
+}
 function riskBadge(tier) {
-    switch (tier.toLowerCase()) {
-        case "t1":
+    switch (tier) {
+        case 1:
             return chalk.green("T1");
-        case "t2":
+        case 2:
             return chalk.yellow("T2");
-        case "t3":
+        case 3:
             return chalk.red("T3");
         default:
-            return tier;
+            return String(tier);
     }
 }
 function statusBadge(status) {

package/dist/src/commands/approval.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../../src/commands/approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EACH,UAAU,EACV,aAAa,EACb,YAAY,EACZ,SAAS,EACT,SAAS,GACZ,MAAM,cAAc,CAAC;AActB,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,CAC9D,mCAAmC,CACtC,CAAC;AAEF,eAAe;KACV,OAAO,CAAC,MAAM,CAAC;KACf,KAAK,CAAC,IAAI,CAAC;KACX,WAAW,CAAC,wBAAwB,CAAC;KACrC,MAAM,CAAC,mBAAmB,EAAE,qDAAqD,CAAC;KAClF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;KAClC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACnB,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,GAAG,CACpB,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACpC,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,SAAS,CAAC,MAAM,CAAC,CAAC;YAClB,OAAO;QACX,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YACjC,OAAO;QACX,CAAC;QACD,UAAU,CACN,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YACrD,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5B,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;YAC7B,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7B,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,kBAAkB,EAAE;YACpD,OAAO,EAAE,CAAC,CAAC,UAAU;gBACjB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,kBAAkB,EAAE;gBAC7C,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;SACvB,CAAC,CAAC,EACH;YACI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;YACtC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;YAC9C,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;YAC9C,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;YAC/B,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;YACnC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;YACjC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;YACrC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;SACxC,CACJ,CAAC;IACN,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,WAAW,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,eAAe;KACV,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,qDAAqD,CAAC;KAClE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;KAClC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;IAC/B,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,GAAG,CACpB,cAAc,EAAE,SAAS,CAC5B,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,SAAS,CAAC,MAAM,CAAC,CAAC;YAClB,OAAO;QACX,CAAC;QACD,aAAa,CAAC;YACV,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC;gBACI,SAAS;gBACT,MAAM,CAAC,UAAU;oBACb,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,cAAc,EAAE;oBAC9C,CAAC,CAAC,GAAG;aACZ;SACJ,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,WAAW,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,eAAe;KACV,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,sBAAsB,CAAC;KACnC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;KAClC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;IAC/B,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,MAAM,GAAG,CAAW,cAAc,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,SAAS,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACX,CAAC;QACD,aAAa,CAAC;YACV,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACZ,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC;YAC9B,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC;YAC1B,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC;YAC1B,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC;YACxB,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,kBAAkB,EAAE,CAAC;YACxD,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;SAChF,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,WAAW,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,eAAe;KACV,OAAO,CAAC,wBAAwB,CAAC;KACjC,WAAW,CAAC,sCAAsC,CAAC;KACnD,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;KACpD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,QAAgB,EAAE,IAAI,EAAE,EAAE;IACjD,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,CAAC,KAAK,CACT,KAAK,CAAC,GAAG,CAAC,yCAAyC,CAAC,CACvD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;SAC1C,CAAC,CAAC;QACH,YAAY,CACR,YAAY,EAAE,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CACvE,CAAC;IACN,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,WAAW,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,SAAS,SAAS,CAAC,IAAY;IAC3B,QAAQ,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACzB,KAAK,IAAI;YACL,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,KAAK,IAAI;YACL,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,KAAK,IAAI;YACL,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B;YACI,OAAO,IAAI,CAAC;IACpB,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAC/B,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3B,KAAK,SAAS;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,KAAK,UAAU;YACX,OAAO,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACnC,KAAK,UAAU;YACX,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC;YACI,OAAO,MAAM,CAAC;IACtB,CAAC;AACL,CAAC"}
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../../src/commands/approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EACH,UAAU,EACV,aAAa,EACb,YAAY,EACZ,SAAS,EACT,SAAS,GACZ,MAAM,cAAc,CAAC;AA2BtB,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,CAC9D,mCAAmC,CACtC,CAAC;AAEF,eAAe;KACV,OAAO,CAAC,MAAM,CAAC;KACf,KAAK,CAAC,IAAI,CAAC;KACX,WAAW,CAAC,wBAAwB,CAAC;KACrC,MAAM,CAAC,mBAAmB,EAAE,qDAAqD,CAAC;KAClF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;KAClC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACnB,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,GAAG,CACpB,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACpC,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,SAAS,CAAC,MAAM,CAAC,CAAC;YAClB,OAAO;QACX,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YACjC,OAAO;QACX,CAAC;QACD,UAAU,CACN,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,0DAA0D;YAC1D,MAAM,EAAE,CAAC,CAAC,aAAa;gBACnB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC;gBAC/B,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YACnD,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5B,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;YAC7B,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7B,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,kBAAkB,EAAE;YACpD,OAAO,EAAE,CAAC,CAAC,UAAU;gBACjB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,kBAAkB,EAAE;gBAC7C,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;SACvB,CAAC,CAAC,EACH;YACI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;YACtC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;YAC9C,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;YAC/C,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;YAC/B,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;YACnC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;YACjC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;YACrC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;SACxC,CACJ,CAAC;IACN,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,WAAW,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,eAAe;KACV,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,qDAAqD,CAAC;KAClE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;KAClC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;IAC/B,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,GAAG,CACpB,cAAc,EAAE,SAAS,CAC5B,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,SAAS,CAAC,MAAM,CAAC,CAAC;YAClB,OAAO;QACX,CAAC;QACD,aAAa,CAAC;YACV,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC;gBACI,SAAS;gBACT,MAAM,CAAC,UAAU;oBACb,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,cAAc,EAAE;oBAC9C,CAAC,CAAC,GAAG;aACZ;SACJ,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,WAAW,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,eAAe;KACV,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,sBAAsB,CAAC;KACnC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;KAClC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;IAC/B,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,MAAM,GAAG,CAAW,cAAc,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,SAAS,CAAC,CAAC,CAAC,CAAC;YACb,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAuB;YAC7B,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACZ,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;SACvB,CAAC;QACF,IAAI,CAAC,CAAC,aAAa;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CACL,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,EAC9B,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,EAC1B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CACxC,CAAC;QACF,mEAAmE;QACnE,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC;gBACN,gBAAgB;gBAChB,KAAK,CAAC,MAAM,CACR,GAAG,CAAC,CAAC,kBAAkB,eAAe,CAAC,CAAC,SAAS,aAAa,CACjE;aACJ,CAAC,CAAC;QACP,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC,eAAe;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CACL,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,kBAAkB,EAAE,CAAC,EACxD,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAChF,CAAC;QACF,aAAa,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,WAAW,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,eAAe;KACV,OAAO,CAAC,wBAAwB,CAAC;KACjC,WAAW,CAAC,sCAAsC,CAAC;KACnD,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;KACpD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,QAAgB,EAAE,IAAI,EAAE,EAAE;IACjD,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,CAAC,KAAK,CACT,KAAK,CAAC,GAAG,CAAC,yCAAyC,CAAC,CACvD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;SAC1C,CAAC,CAAC;QACH,YAAY,CACR,YAAY,EAAE,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CACvE,CAAC;IACN,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,WAAW,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,SAAS,QAAQ,CAAC,CAAS,EAAE,GAAW;IACpC,OAAO,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;AAC3D,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC3B,QAAQ,IAAI,EAAE,CAAC;QACX,KAAK,CAAC;YACF,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,KAAK,CAAC;YACF,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,KAAK,CAAC;YACF,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B;YACI,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAC/B,QAAQ,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3B,KAAK,SAAS;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,KAAK,UAAU;YACX,OAAO,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACnC,KAAK,UAAU;YACX,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC;YACI,OAAO,MAAM,CAAC;IACtB,CAAC;AACL,CAAC"}

package/dist/src/commands/browser.d.ts

@@ -0,0 +1,21 @@
+import { Command } from "commander";
+/**
+ * The browser bridge, hosted and local, under one command.
+ *
+ * There used to be a second binary — `1claw-vault`, shipped with
+ * `@1claw/browser-bridge` — because the bridge's local file backend needed
+ * managing and the main CLI had no commands for any of this. Two CLIs whose
+ * names differ by a hyphen, one of which shares a word with an unrelated
+ * subcommand (`1claw vault` manages *hosted* vaults), is a naming problem
+ * nobody can hold in their head.
+ *
+ * So: `1claw browser` for the hosted side, `1claw browser vault` for the local
+ * file. The split that matters is visible in the command itself.
+ *
+ * The local-file subcommands deliberately do **not** call `requireToken()`.
+ * The whole reason that backend exists is that someone can run the bridge with
+ * no 1Claw account, and folding it into this CLI must not quietly take that
+ * away.
+ */
+export declare const browserCommand: Command;
+//# sourceMappingURL=browser.d.ts.map

package/dist/src/commands/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../../src/commands/browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOpC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,SACuD,CAAC"}

package/dist/src/commands/browser.js

@@ -0,0 +1,362 @@
+import { Command } from "commander";
+import { readFile, writeFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { api } from "../client.js";
+import { requireToken, handleError } from "../middleware.js";
+import { printTable, printJson, printSuccess, printKeyValue, printInfo, printError } from "../output.js";
+/**
+ * The browser bridge, hosted and local, under one command.
+ *
+ * There used to be a second binary — `1claw-vault`, shipped with
+ * `@1claw/browser-bridge` — because the bridge's local file backend needed
+ * managing and the main CLI had no commands for any of this. Two CLIs whose
+ * names differ by a hyphen, one of which shares a word with an unrelated
+ * subcommand (`1claw vault` manages *hosted* vaults), is a naming problem
+ * nobody can hold in their head.
+ *
+ * So: `1claw browser` for the hosted side, `1claw browser vault` for the local
+ * file. The split that matters is visible in the command itself.
+ *
+ * The local-file subcommands deliberately do **not** call `requireToken()`.
+ * The whole reason that backend exists is that someone can run the bridge with
+ * no 1Claw account, and folding it into this CLI must not quietly take that
+ * away.
+ */
+export const browserCommand = new Command("browser")
+    .description("Browser bridge — pair devices, define bindings, run the bridge");
+/**
+ * The vault refuses a bridge it will not speak to, and the check is on the
+ * pairing route as well as the fill routes — server-side, so a known-vulnerable
+ * build can be turned away without waiting for anyone to upgrade.
+ *
+ * The CLI is not a bridge, but it pairs *on behalf of* one, so it has to name a
+ * version. This is the protocol version it writes, not the CLI's own.
+ */
+const BRIDGE_PROTOCOL_VERSION = "0.1.0";
+// ── Hosted: devices ─────────────────────────────────────────────────────────
+browserCommand
+    .command("pair <label>")
+    .description("Pair this machine and mint its bridge credential (shown once)")
+    .requiredOption("--public-key <pin>", "The bridge's public key, pinned on first use")
+    .option("--bridge-version <v>", "Bridge version reported to the vault")
+    .option("-p, --password <password>", "Account password for the step-up re-auth")
+    .option("--json", "Output as JSON")
+    .action(async (label, opts) => {
+    try {
+        requireToken();
+        const res = await api("/browser/devices", {
+            method: "POST",
+            headers: {
+                "x-1claw-bridge-version": opts.bridgeVersion ?? BRIDGE_PROTOCOL_VERSION,
+                // Pairing is behind a step-up re-auth, deliberately: the
+                // device being paired is the one that will type secrets
+                // into pages, so a stolen session must not be enough.
+                ...(opts.password ? { "X-Auth-Confirm": opts.password } : {}),
+            },
+            body: {
+                label,
+                public_key_pin: opts.publicKey,
+                bridge_version: opts.bridgeVersion ?? BRIDGE_PROTOCOL_VERSION,
+            },
+        });
+        if (opts.json)
+            return printJson(res);
+        printSuccess(`Paired "${res.label}".`);
+        printKeyValue([
+            ["Device", res.device_id],
+            ["Credential", res.credential],
+        ]);
+        printInfo("Shown once. There is no endpoint that returns it again.");
+    }
+    catch (err) {
+        handleError(err);
+    }
+});
+browserCommand
+    .command("devices")
+    .description("List paired devices (revoked ones included)")
+    .option("--json", "Output as JSON")
+    .action(async (opts) => {
+    try {
+        requireToken();
+        const res = await api("/browser/devices");
+        if (opts.json)
+            return printJson(res);
+        // Revoked devices are listed rather than hidden: "was this machine
+        // ever paired" is the question people ask after a laptop goes missing.
+        printTable((res.devices ?? []).map((d) => ({
+            id: String(d.id ?? ""),
+            label: String(d.label ?? ""),
+            platform: String(d.platform ?? "—"),
+            last_seen: String(d.last_seen_at ?? "never"),
+            revoked: d.revoked_at ? String(d.revoked_at) : "—",
+        })), [
+            { key: "id", header: "ID" },
+            { key: "label", header: "Label" },
+            { key: "platform", header: "Platform" },
+            { key: "last_seen", header: "Last seen" },
+            { key: "revoked", header: "Revoked" },
+        ]);
+    }
+    catch (err) {
+        handleError(err);
+    }
+});
+browserCommand
+    .command("revoke <device-id>")
+    .description("Revoke a paired device — this is what makes a leaked credential stop working")
+    .action(async (deviceId) => {
+    try {
+        requireToken();
+        await api(`/browser/devices/${encodeURIComponent(deviceId)}`, { method: "DELETE" });
+        printSuccess(`Revoked ${deviceId}. It opens no sessions and authorises no fills.`);
+    }
+    catch (err) {
+        handleError(err);
+    }
+});
+// ── Hosted: bindings ────────────────────────────────────────────────────────
+const binding = browserCommand
+    .command("binding")
+    .description("Which secret may be typed, and into which hosts");
+binding
+    .command("create <name>")
+    .description("Define a binding (human only)")
+    .requiredOption("--vault <id>", "Vault holding the secret")
+    .requiredOption("--path <path>", "Secret path within the vault")
+    .requiredOption("--login-url <url>", "The page the bridge navigates to")
+    .requiredOption("--hosts <hosts>", "Comma-separated allowed hosts (exact match, no wildcards)")
+    .option("--sso-hosts <hosts>", "Comma-separated hosts a login may redirect through")
+    .option("--json", "Output as JSON")
+    .action(async (name, opts) => {
+    try {
+        requireToken();
+        const res = await api("/browser/credentials", {
+            method: "POST",
+            body: {
+                name,
+                vault_id: opts.vault,
+                secret_path: opts.path,
+                login_url: opts.loginUrl,
+                allowed_hosts: String(opts.hosts).split(",").map((h) => h.trim()).filter(Boolean),
+                ...(opts.ssoHosts
+                    ? { sso_hosts: String(opts.ssoHosts).split(",").map((h) => h.trim()).filter(Boolean) }
+                    : {}),
+            },
+        });
+        if (opts.json)
+            return printJson(res);
+        printSuccess(`Created binding "${name}".`);
+    }
+    catch (err) {
+        handleError(err);
+    }
+});
+binding
+    .command("list")
+    .description("List bindings")
+    .option("--json", "Output as JSON")
+    .action(async (opts) => {
+    try {
+        requireToken();
+        const res = await api("/browser/credentials");
+        if (opts.json)
+            return printJson(res);
+        printTable((res.credentials ?? []).map((c) => ({
+            id: String(c.id ?? ""),
+            name: String(c.name ?? ""),
+            login_url: String(c.login_url ?? ""),
+            hosts: Array.isArray(c.allowed_hosts) ? c.allowed_hosts.join(",") : "",
+        })), [
+            { key: "id", header: "ID" },
+            { key: "name", header: "Name" },
+            { key: "login_url", header: "Login URL" },
+            { key: "hosts", header: "Allowed hosts" },
+        ]);
+    }
+    catch (err) {
+        handleError(err);
+    }
+});
+binding
+    .command("rm <binding-id>")
+    .description("Delete a binding")
+    .action(async (id) => {
+    try {
+        requireToken();
+        await api(`/browser/credentials/${encodeURIComponent(id)}`, { method: "DELETE" });
+        printSuccess(`Deleted binding ${id}.`);
+    }
+    catch (err) {
+        handleError(err);
+    }
+});
+// ── Local file: no account required ─────────────────────────────────────────
+/**
+ * The passphrase, from the environment only.
+ *
+ * Never a flag: argv is world-readable in `ps` and lands in shell history.
+ */
+function passphrase() {
+    const p = process.env.ONECLAW_BRIDGE_VAULT_PASSPHRASE;
+    if (!p) {
+        printError("Set ONECLAW_BRIDGE_VAULT_PASSPHRASE — the passphrase is never taken as a flag.");
+        process.exit(1);
+    }
+    return p;
+}
+/** Read stdin to the end, for a secret that must not appear in argv. */
+async function readStdin() {
+    const chunks = [];
+    for await (const c of process.stdin)
+        chunks.push(Buffer.from(c));
+    return Buffer.concat(chunks).toString("utf-8");
+}
+async function bridgeVaultApi() {
+    try {
+        // Resolved at run time, not build time: it is an optional dependency,
+        // so the type checker must not require it to be installed here.
+        const spec = "@1claw/browser-bridge";
+        return (await import(spec));
+    }
+    catch {
+        printError("The local-file commands need @1claw/browser-bridge, which is not installed.\n" +
+            "  Install it alongside the CLI, or use `1claw browser` without `vault` for the hosted side.");
+        process.exit(1);
+    }
+}
+async function loadFile(path) {
+    const { openVault } = await bridgeVaultApi();
+    return openVault(JSON.parse(await readFile(path, "utf-8")), passphrase());
+}
+async function saveFile(path, doc) {
+    const { sealVault } = await bridgeVaultApi();
+    // 0600: this file is the whole security boundary for a local backend.
+    await writeFile(path, JSON.stringify(await sealVault(doc, passphrase()), null, 2), {
+        mode: 0o600,
+    });
+}
+const localVault = browserCommand
+    .command("vault")
+    .description("The bridge's local encrypted file — no 1Claw account needed");
+localVault
+    .command("init <file>")
+    .description("Create an empty vault file")
+    .action(async (file) => {
+    try {
+        await saveFile(file, { entries: [], registrations: [], captures: [] });
+        printSuccess(`Created ${file}`);
+    }
+    catch (err) {
+        handleError(err);
+    }
+});
+localVault
+    .command("add <file>")
+    .description("Add a credential. The secret comes from stdin, never from a flag.")
+    .requiredOption("--id <id>", "Binding id the agent will name")
+    .requiredOption("--url <url>", "Login URL the bridge navigates to")
+    .requiredOption("--hosts <hosts>", "Comma-separated allowed hosts")
+    .option("--sso <hosts>", "Comma-separated SSO hosts a login may redirect through")
+    .action(async (file, opts) => {
+    try {
+        const secret = (await readStdin()).replace(/\n$/, "");
+        if (!secret) {
+            printError("No secret on stdin. Pipe it: printf '%s' 'the-password' | 1claw browser vault add …");
+            process.exit(1);
+        }
+        const doc = await loadFile(file);
+        const entries = [...doc.entries.filter((e) => e.id !== opts.id), {
+                id: opts.id,
+                secret,
+                loginUrl: opts.url,
+                allowedHosts: String(opts.hosts).split(",").map((h) => h.trim()).filter(Boolean),
+                ...(opts.sso
+                    ? { ssoHosts: String(opts.sso).split(",").map((h) => h.trim()).filter(Boolean) }
+                    : {}),
+            }];
+        await saveFile(file, { ...doc, entries });
+        printSuccess(`Added ${opts.id}`);
+    }
+    catch (err) {
+        handleError(err);
+    }
+});
+localVault
+    .command("list <file>")
+    .description("List what the vault authorises — ids and rules, never a secret")
+    .action(async (file) => {
+    try {
+        const doc = await loadFile(file);
+        const rows = [];
+        for (const e of doc.entries) {
+            rows.push({ kind: "credential", id: e.id, url: e.loginUrl, detail: e.allowedHosts.join(",") });
+        }
+        for (const r of doc.registrations ?? []) {
+            rows.push({ kind: "signup", id: r.id, url: r.signupUrl, detail: r.username });
+        }
+        for (const c of doc.captures ?? []) {
+            rows.push({ kind: "capture", id: c.id, url: c.captureUrl, detail: c.allowedHosts.join(",") });
+        }
+        printTable(rows, [
+            { key: "kind", header: "Kind" },
+            { key: "id", header: "ID" },
+            { key: "url", header: "URL" },
+            { key: "detail", header: "Hosts / user" },
+        ]);
+    }
+    catch (err) {
+        handleError(err);
+    }
+});
+localVault
+    .command("rm <file> <id>")
+    .description("Remove a credential, signup policy or capture policy by id")
+    .action(async (file, id) => {
+    try {
+        const doc = await loadFile(file);
+        await saveFile(file, {
+            ...doc,
+            entries: doc.entries.filter((e) => e.id !== id),
+            registrations: (doc.registrations ?? []).filter((r) => r.id !== id),
+            captures: (doc.captures ?? []).filter((c) => c.id !== id),
+        });
+        printSuccess(`Removed ${id}`);
+    }
+    catch (err) {
+        handleError(err);
+    }
+});
+// ── Running the bridge ──────────────────────────────────────────────────────
+browserCommand
+    .command("start")
+    .description("Run the bridge against a vault (hosted or local file)")
+    .option("--vault <file>", "Local vault file. Omit to use the hosted vault.")
+    .option("--chrome <path>", "Path to a Chromium binary")
+    .option("--port <port>", "Port for the gated CDP socket")
+    .allowUnknownOption(true)
+    .action(async (opts, cmd) => {
+    // Delegated rather than reimplemented. The bridge owns its own argument
+    // handling, and a second parser here would drift from it — the same way
+    // a second copy of the vault format did.
+    const args = [];
+    if (opts.vault)
+        args.push("--vault", opts.vault);
+    if (opts.chrome)
+        args.push("--chrome", opts.chrome);
+    if (opts.port)
+        args.push("--port", String(opts.port));
+    args.push(...(cmd.args ?? []));
+    const child = spawn("1claw-browser-bridge", args, { stdio: "inherit" });
+    child.on("error", (e) => {
+        if (e.code === "ENOENT") {
+            printError("1claw-browser-bridge is not on PATH.\n" +
+                "  Install @1claw/browser-bridge, or run it from a checkout of the bridge repo.");
+            process.exit(1);
+        }
+        printError(String(e.message));
+        process.exit(1);
+    });
+    child.on("exit", (code) => process.exit(code ?? 0));
+});
+//# sourceMappingURL=browser.js.map

package/dist/src/commands/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../../src/commands/browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEzG;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC;KAC/C,WAAW,CAAC,gEAAgE,CAAC,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAExC,+EAA+E;AAE/E,cAAc;KACT,OAAO,CAAC,cAAc,CAAC;KACvB,WAAW,CAAC,+DAA+D,CAAC;KAC5E,cAAc,CAAC,oBAAoB,EAAE,8CAA8C,CAAC;KACpF,MAAM,CAAC,sBAAsB,EAAE,sCAAsC,CAAC;KACtE,MAAM,CAAC,2BAA2B,EAAE,0CAA0C,CAAC;KAC/E,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;KAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;IAC1B,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,GAAG,CACjB,kBAAkB,EAClB;YACI,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,wBAAwB,EAAE,IAAI,CAAC,aAAa,IAAI,uBAAuB;gBACvE,yDAAyD;gBACzD,wDAAwD;gBACxD,sDAAsD;gBACtD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE;YACD,IAAI,EAAE;gBACF,KAAK;gBACL,cAAc,EAAE,IAAI,CAAC,SAAS;gBAC9B,cAAc,EAAE,IAAI,CAAC,aAAa,IAAI,uBAAuB;aAChE;SACJ,CACJ,CAAC;QACF,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,YAAY,CAAC,WAAW,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;QACvC,aAAa,CAAC;YACV,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC;YACzB,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC;SACjC,CAAC,CAAC;QACH,SAAS,CAAC,yDAAyD,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,WAAW,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,cAAc;KACT,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,6CAA6C,CAAC;KAC1D,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;KAClC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACnB,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,GAAG,CACjB,kBAAkB,CACrB,CAAC;QACF,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,mEAAmE;QACnE,uEAAuE;QACvE,UAAU,CACN,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5B,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACtB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC;YACnC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC;YAC5C,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG;SACrD,CAAC,CAAC,EACH;YACI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;YAC3B,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;YACjC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE;YACvC,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE;YACzC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;SACxC,CACJ,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,WAAW,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,cAAc;KACT,OAAO,CAAC,oBAAoB,CAAC;KAC7B,WAAW,CAAC,8EAA8E,CAAC;KAC3F,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;IACvB,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,GAAG,CAAC,oBAAoB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,YAAY,CAAC,WAAW,QAAQ,iDAAiD,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,WAAW,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,+EAA+E;AAE/E,MAAM,OAAO,GAAG,cAAc;KACzB,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,iDAAiD,CAAC,CAAC;AAEpE,OAAO;KACF,OAAO,CAAC,eAAe,CAAC;KACxB,WAAW,CAAC,+BAA+B,CAAC;KAC5C,cAAc,CAAC,cAAc,EAAE,0BAA0B,CAAC;KAC1D,cAAc,CAAC,eAAe,EAAE,8BAA8B,CAAC;KAC/D,cAAc,CAAC,mBAAmB,EAAE,kCAAkC,CAAC;KACvE,cAAc,CAAC,iBAAiB,EAAE,2DAA2D,CAAC;KAC9F,MAAM,CAAC,qBAAqB,EAAE,oDAAoD,CAAC;KACnF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;KAClC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACzB,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,sBAAsB,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACF,IAAI;gBACJ,QAAQ,EAAE,IAAI,CAAC,KAAK;gBACpB,WAAW,EAAE,IAAI,CAAC,IAAI;gBACtB,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBACjF,GAAG,CAAC,IAAI,CAAC,QAAQ;oBACb,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;oBACtF,CAAC,CAAC,EAAE,CAAC;aACZ;SACJ,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,YAAY,CAAC,oBAAoB,IAAI,IAAI,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,WAAW,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,OAAO;KACF,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,eAAe,CAAC;KAC5B,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;KAClC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACnB,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,GAAG,CACjB,sBAAsB,CACzB,CAAC;QACF,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,UAAU,CACN,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACtB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YAC1B,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;YACpC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;SACzE,CAAC,CAAC,EACH;YACI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;YAC3B,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;YAC/B,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE;YACzC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE;SAC5C,CACJ,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,WAAW,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,OAAO;KACF,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,kBAAkB,CAAC;KAC/B,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;IACjB,IAAI,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,GAAG,CAAC,wBAAwB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClF,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,WAAW,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,+EAA+E;AAE/E;;;;GAIG;AACH,SAAS,UAAU;IACf,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;IACtD,IAAI,CAAC,CAAC,EAAE,CAAC;QACL,UAAU,CAAC,gFAAgF,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,SAAS;IACpB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAoBD,KAAK,UAAU,cAAc;IAIzB,IAAI,CAAC;QACD,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,IAAI,GAAG,uBAAuB,CAAC;QACrC,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAU,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACL,UAAU,CACN,+EAA+E;YAC3E,6FAA6F,CACpG,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAChC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;IAC7C,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAY;IAC9C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;IAC7C,sEAAsE;IACtE,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAC/E,IAAI,EAAE,KAAK;KACd,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,GAAG,cAAc;KAC5B,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,6DAA6D,CAAC,CAAC;AAEhF,UAAU;KACL,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,4BAA4B,CAAC;KACzC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACnB,IAAI,CAAC;QACD,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,YAAY,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,WAAW,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,UAAU;KACL,OAAO,CAAC,YAAY,CAAC;KACrB,WAAW,CAAC,mEAAmE,CAAC;KAChF,cAAc,CAAC,WAAW,EAAE,gCAAgC,CAAC;KAC7D,cAAc,CAAC,aAAa,EAAE,mCAAmC,CAAC;KAClE,cAAc,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;KAClE,MAAM,CAAC,eAAe,EAAE,wDAAwD,CAAC;KACjF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACzB,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,UAAU,CAAC,qFAAqF,CAAC,CAAC;YAClG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,EAAE;gBAC7D,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAChF,GAAG,CAAC,IAAI,CAAC,GAAG;oBACR,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;oBAChF,CAAC,CAAC,EAAE,CAAC;aACZ,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,YAAY,CAAC,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,WAAW,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,UAAU;KACL,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,gEAAgE,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACnB,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,GAA8B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,UAAU,CAAC,IAAI,EAAE;YACb,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;YAC/B,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;YAC3B,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;YAC7B,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE;SAC5C,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,WAAW,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,UAAU;KACL,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,4DAA4D,CAAC;KACzE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;IACvB,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,QAAQ,CAAC,IAAI,EAAE;YACjB,GAAG,GAAG;YACN,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/C,aAAa,EAAE,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YACnE,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC5D,CAAC,CAAC;QACH,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,WAAW,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,+EAA+E;AAE/E,cAAc;KACT,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,uDAAuD,CAAC;KACpE,MAAM,CAAC,gBAAgB,EAAE,iDAAiD,CAAC;KAC3E,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;KACtD,MAAM,CAAC,eAAe,EAAE,+BAA+B,CAAC;KACxD,kBAAkB,CAAC,IAAI,CAAC;KACxB,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IACxB,wEAAwE;IACxE,wEAAwE;IACxE,yCAAyC;IACzC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAE/B,MAAM,KAAK,GAAG,KAAK,CAAC,sBAAsB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAwB,EAAE,EAAE;QAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,UAAU,CACN,wCAAwC;gBACpC,gFAAgF,CACvF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC"}

package/dist/src/commands/chart.d.ts

@@ -0,0 +1,6 @@
+import { Command } from "commander";
+export declare const diffCommand: Command;
+export declare const applyCommand: Command;
+/** Persist what an apply set, so the next run can tell drift from a first run. */
+export declare function writeAppliedState(state: Record<string, unknown>): void;
+//# sourceMappingURL=chart.d.ts.map

package/dist/src/commands/chart.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chart.d.ts","sourceRoot":"","sources":["../../../src/commands/chart.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+IpC,eAAO,MAAM,WAAW,SAoBlB,CAAC;AAEP,eAAO,MAAM,YAAY,SAgFnB,CAAC;AAEP,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAGtE"}