@apralabs/apra-fleet 0.2.2

package/dist/utils/agent-helpers.js

@@ -0,0 +1,84 @@
+import { getAgent, findAgentByName, updateAgent } from '../services/registry.js';
+/**
+ * Look up an agent by ID or return a formatted error string.
+ * Eliminates the repeated pattern of getAgent() + "not found" check in every tool.
+ */
+export function getAgentOrFail(id) {
+    const agent = getAgent(id) ?? findAgentByName(id);
+    if (!agent) {
+        return `Member "${id}" not found.`;
+    }
+    return agent;
+}
+/**
+ * Get the OS for an agent, defaulting to 'linux'.
+ * Eliminates repeated `agent.os ?? 'linux'` casts.
+ */
+export function getAgentOS(agent) {
+    return (agent.os ?? 'linux');
+}
+/**
+ * Format a host label for display.
+ * Local agents show "(local)", remote agents show "host:port".
+ */
+export function formatAgentHost(agent) {
+    return agent.agentType === 'local' ? '(local)' : `${agent.host}:${agent.port}`;
+}
+// T7: idle manager hook — registered by IdleManager.start() via setIdleTouchHook().
+// Kept as a callback to avoid circular import:
+//   idle-manager → activity → strategy → agent-helpers
+let idleTouchHook;
+/**
+ * Register a callback invoked on every touchAgent call.
+ * Called by IdleManager.start() to wire timer resets into tool calls.
+ */
+export function setIdleTouchHook(fn) {
+    idleTouchHook = fn;
+}
+const EXPIRY_WARNING_MS = 10 * 60 * 1000; // 10 minutes
+/**
+ * Check if an agent's VCS token is expired or expiring soon.
+ * Returns a warning string if action is needed, or null if OK / no expiry tracked.
+ */
+export function checkVcsTokenExpiry(agent, now = new Date()) {
+    if (!agent.vcsTokenExpiresAt)
+        return null;
+    const expiresAt = new Date(agent.vcsTokenExpiresAt);
+    const remaining = expiresAt.getTime() - now.getTime();
+    if (remaining <= 0) {
+        return `⚠️ VCS token expired at ${agent.vcsTokenExpiresAt} — re-run provision_vcs_auth to refresh.`;
+    }
+    if (remaining <= EXPIRY_WARNING_MS) {
+        const mins = Math.ceil(remaining / 60000);
+        return `⚠️ VCS token expires in ${mins} minute${mins === 1 ? '' : 's'} (${agent.vcsTokenExpiresAt}) — consider refreshing.`;
+    }
+    return null;
+}
+// In-memory PID store — transient, lives only for the server process lifetime.
+// PIDs are OS-level resources; persisting them to disk would leave stale entries
+// across restarts, so an in-memory map is the right storage layer here.
+const _activePids = new Map();
+/** Return the stored PID for an agent, or undefined if none is recorded. */
+export function getStoredPid(agentId) {
+    return _activePids.get(agentId);
+}
+/** Record the active PID for an agent (called after the process is spawned). */
+export function setStoredPid(agentId, pid) {
+    _activePids.set(agentId, pid);
+}
+/** Remove the stored PID for an agent (called after kill or successful completion). */
+export function clearStoredPid(agentId) {
+    _activePids.delete(agentId);
+}
+/**
+ * Touch an agent's lastUsed timestamp and optionally update its sessionId.
+ */
+export function touchAgent(agentId, sessionId) {
+    const updates = { lastUsed: new Date().toISOString() };
+    if (sessionId !== undefined) {
+        updates.sessionId = sessionId;
+    }
+    updateAgent(agentId, updates);
+    idleTouchHook?.(agentId); // T7: notify idle manager to reset idle timer
+}
+//# sourceMappingURL=agent-helpers.js.map

package/dist/utils/agent-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-helpers.js","sourceRoot":"","sources":["../../src/utils/agent-helpers.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEjF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,WAAW,EAAE,cAAc,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAY;IACrC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,OAAO,CAAa,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAY;IAC1C,OAAO,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,oFAAoF;AACpF,+CAA+C;AAC/C,uDAAuD;AACvD,IAAI,aAAsD,CAAC;AAE3D;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAA6B;IAC5D,aAAa,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AAEvD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAY,EAAE,MAAY,IAAI,IAAI,EAAE;IACtE,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IACtD,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,2BAA2B,KAAK,CAAC,iBAAiB,0CAA0C,CAAC;IACtG,CAAC;IACD,IAAI,SAAS,IAAI,iBAAiB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC;QAC1C,OAAO,2BAA2B,IAAI,UAAU,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,iBAAiB,0BAA0B,CAAC;IAC9H,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,iFAAiF;AACjF,wEAAwE;AACxE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE9C,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,GAAW;IACvD,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,SAAkB;IAC5D,MAAM,OAAO,GAA4B,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAChF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAChC,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9B,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,8CAA8C;AAC1E,CAAC"}

package/dist/utils/ansi.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Strip ANSI escape sequences and non-printable control characters from a string.
+ * Used to clean PTY-captured output from agy.exe which writes via Windows Console API.
+ */
+export declare function stripAnsi(raw: string): string;
+//# sourceMappingURL=ansi.d.ts.map

package/dist/utils/ansi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ansi.d.ts","sourceRoot":"","sources":["../../src/utils/ansi.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAc7C"}

package/dist/utils/ansi.js

@@ -0,0 +1,20 @@
+/**
+ * Strip ANSI escape sequences and non-printable control characters from a string.
+ * Used to clean PTY-captured output from agy.exe which writes via Windows Console API.
+ */
+export function stripAnsi(raw) {
+    return raw
+        // CSI sequences: ESC [ ... (colors, cursor movement, etc.)
+        .replace(/\x1B\[[\x30-\x3F]*[\x20-\x2F]*[\x40-\x7E]/g, '')
+        // OSC sequences: ESC ] ... ST or BEL
+        .replace(/\x1B\][^\x07\x1B]*(?:\x07|\x1B\\)/g, '')
+        // DCS / PM / APC / SOS sequences: ESC [P X ^ _] ... ST
+        .replace(/\x1B[P X^_][^\x1B]*\x1B\\/g, '')
+        // Other two-char ESC sequences: ESC <char>
+        .replace(/\x1B[^\[]/g, '')
+        // Remaining lone ESC
+        .replace(/\x1B/g, '')
+        // Non-printable control chars (keep \n and \t)
+        .replace(/[\x00-\x08\x0B-\x0C\x0E-\x1F\x7F]/g, '');
+}
+//# sourceMappingURL=ansi.js.map

package/dist/utils/ansi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ansi.js","sourceRoot":"","sources":["../../src/utils/ansi.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,GAAG;QACR,2DAA2D;SAC1D,OAAO,CAAC,4CAA4C,EAAE,EAAE,CAAC;QAC1D,qCAAqC;SACpC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC;QAClD,uDAAuD;SACtD,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;QAC1C,2CAA2C;SAC1C,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC1B,qBAAqB;SACpB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACrB,+CAA+C;SAC9C,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC"}

package/dist/utils/auth-env.d.ts

@@ -0,0 +1,8 @@
+import type { Agent } from '../types.js';
+import type { RemoteOS } from './platform.js';
+/**
+ * Build a platform-correct inline export prefix for all stored auth env vars.
+ * Returns empty string if the agent has no stored env vars.
+ */
+export declare function buildAuthEnvPrefix(agent: Agent, os: RemoteOS): string;
+//# sourceMappingURL=auth-env.d.ts.map

package/dist/utils/auth-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-env.d.ts","sourceRoot":"","sources":["../../src/utils/auth-env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAI9C;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,GAAG,MAAM,CAwBrE"}

package/dist/utils/auth-env.js

@@ -0,0 +1,30 @@
+import { decryptPassword } from './crypto.js';
+import { escapeDoubleQuoted } from './shell-escape.js';
+/**
+ * Build a platform-correct inline export prefix for all stored auth env vars.
+ * Returns empty string if the agent has no stored env vars.
+ */
+export function buildAuthEnvPrefix(agent, os) {
+    const vars = agent.encryptedEnvVars;
+    if (!vars || Object.keys(vars).length === 0)
+        return '';
+    const parts = [];
+    for (const [name, encrypted] of Object.entries(vars)) {
+        const value = decryptPassword(encrypted);
+        if (os === 'windows') {
+            // PowerShell: single-quote escaping (matching windows.ts envPrefix pattern)
+            const escaped = value.replace(/'/g, "''");
+            parts.push(`$env:${name}='${escaped}'`);
+        }
+        else {
+            // Linux/macOS: double-quote escaping
+            const escaped = escapeDoubleQuoted(value);
+            parts.push(`export ${name}="${escaped}"`);
+        }
+    }
+    if (os === 'windows') {
+        return parts.join('; ') + '; ';
+    }
+    return parts.join(' && ') + ' && ';
+}
+//# sourceMappingURL=auth-env.js.map

package/dist/utils/auth-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-env.js","sourceRoot":"","sources":["../../src/utils/auth-env.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAY,EAAE,EAAY;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAEzC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,4EAA4E;YAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,OAAO,GAAG,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,qCAAqC;YACrC,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,KAAK,OAAO,GAAG,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;AACrC,CAAC"}

package/dist/utils/collect-secret.d.ts

@@ -0,0 +1,2 @@
+export declare function collectSecret(prompt: string): Promise<string>;
+//# sourceMappingURL=collect-secret.d.ts.map

package/dist/utils/collect-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collect-secret.d.ts","sourceRoot":"","sources":["../../src/utils/collect-secret.ts"],"names":[],"mappings":"AAcA,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsEnE"}

package/dist/utils/collect-secret.js

@@ -0,0 +1,80 @@
+import { secureInput } from './secure-input.js';
+import { OOB_TIMEOUT_MS } from './oob-timeout.js';
+const readKey = () => new Promise((resolve) => {
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.once('data', (buf) => {
+        process.stdin.setRawMode(false);
+        process.stdin.pause();
+        resolve(buf);
+    });
+});
+export async function collectSecret(prompt) {
+    const timeout = setTimeout(() => {
+        process.stderr.write('\n  ⏱ Timed out. Closing.\n');
+        process.exit(1);
+    }, OOB_TIMEOUT_MS);
+    let secretValue;
+    while (true) {
+        try {
+            secretValue = await secureInput({ prompt: `${prompt}: ` });
+        }
+        catch {
+            clearTimeout(timeout);
+            console.error('Cancelled.');
+            process.exit(1);
+            return ''; // unreachable
+        }
+        if (!secretValue) {
+            clearTimeout(timeout);
+            console.error('✗ Empty value. Aborting.');
+            process.exit(1);
+            return ''; // unreachable
+        }
+        const DIM = '\x1b[2m', RESET = '\x1b[0m';
+        process.stderr.write(`${DIM}  [Enter] proceed  [v] view  [Esc] re-enter${RESET}\n`);
+        const key1 = (await readKey())[0];
+        // Cursor is at N+2 (blank line after hint's \n). Password line is N, hint is N+1.
+        if (key1 === 0x76 || key1 === 0x56) {
+            // v/V: reveal in place — clear blank N+2, hint N+1, password N, reprint as plaintext
+            process.stderr.write('\r\x1b[K'); // clear blank N+2
+            process.stderr.write('\x1b[1A\r\x1b[K'); // up to N+1, clear hint
+            process.stderr.write('\x1b[1A\r\x1b[K'); // up to N, clear password line
+            process.stderr.write(`√ ${prompt}:  ${secretValue}\n`);
+            process.stderr.write(`${DIM}  [Enter] confirm  [Esc] re-enter${RESET}\n`);
+            // Cursor now at N+2 again (blank after confirm hint's \n)
+            const key2 = (await readKey())[0];
+            if (key2 === 0x1b) {
+                // Esc: clear blank N+2, confirm hint N+1, value line N — re-enter in place
+                process.stderr.write('\r\x1b[K');
+                process.stderr.write('\x1b[1A\r\x1b[K');
+                process.stderr.write('\x1b[1A\r\x1b[K');
+                continue;
+            }
+            else {
+                // Enter: clear blank N+2, confirm hint N+1, value line N — reprint with stars
+                process.stderr.write('\r\x1b[K');
+                process.stderr.write('\x1b[1A\r\x1b[K');
+                process.stderr.write('\x1b[1A\r\x1b[K');
+                process.stderr.write(`√ ${prompt}:  ${'*'.repeat(secretValue.length)}\n`);
+                break;
+            }
+        }
+        else if (key1 === 0x1b) {
+            // Esc: clear blank N+2, hint N+1, password N — re-enter in place
+            process.stderr.write('\r\x1b[K');
+            process.stderr.write('\x1b[1A\r\x1b[K');
+            process.stderr.write('\x1b[1A\r\x1b[K');
+            continue;
+        }
+        else {
+            // Enter or anything else: clear blank N+2, hint N+1 — password line stays
+            process.stderr.write('\r\x1b[K');
+            process.stderr.write('\x1b[1A\r\x1b[K');
+            break;
+        }
+    }
+    clearTimeout(timeout);
+    return secretValue;
+}
+//# sourceMappingURL=collect-secret.js.map

package/dist/utils/collect-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collect-secret.js","sourceRoot":"","sources":["../../src/utils/collect-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,OAAO,GAAG,GAAoB,EAAE,CACpC,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;IAC9B,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE;QACzC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc;IAChD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,EAAE,cAAc,CAAC,CAAC;IAEnB,IAAI,WAAmB,CAAC;IACxB,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,EAAE,CAAC,CAAC,cAAc;QAC3B,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,EAAE,CAAC,CAAC,cAAc;QAC3B,CAAC;QAED,MAAM,GAAG,GAAG,SAAS,EAAE,KAAK,GAAG,SAAS,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,8CAA8C,KAAK,IAAI,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAElC,kFAAkF;QAClF,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnC,qFAAqF;YACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAW,kBAAkB;YAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAG,wBAAwB;YACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAG,+BAA+B;YAC1E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,MAAM,WAAW,IAAI,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,oCAAoC,KAAK,IAAI,CAAC,CAAC;YAE1E,0DAA0D;YAC1D,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAElC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,2EAA2E;gBAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACxC,SAAS;YACX,CAAC;iBAAM,CAAC;gBACN,8EAA8E;gBAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1E,MAAM;YACR,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,iEAAiE;YACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACxC,SAAS;QACX,CAAC;aAAM,CAAC;YACN,0EAA0E;YAC1E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACxC,MAAM;QACR,CAAC;IACH,CAAC;IAED,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,OAAO,WAAY,CAAC;AACtB,CAAC"}

package/dist/utils/credential-validation.d.ts

@@ -0,0 +1,13 @@
+export type CredentialStatus = {
+    status: 'valid';
+} | {
+    status: 'near-expiry';
+    minutesLeft: number;
+} | {
+    status: 'expired-refreshable';
+} | {
+    status: 'expired-no-refresh';
+};
+export declare function validateCredentials(json: string): CredentialStatus | null;
+export declare function credentialStatusNote(cs: CredentialStatus | null): string;
+//# sourceMappingURL=credential-validation.d.ts.map

package/dist/utils/credential-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-validation.d.ts","sourceRoot":"","sources":["../../src/utils/credential-validation.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,MAAM,EAAE,qBAAqB,CAAA;CAAE,GACjC;IAAE,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAErC,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAkBzE;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,CASxE"}

package/dist/utils/credential-validation.js

@@ -0,0 +1,35 @@
+const NEAR_EXPIRY_THRESHOLD_MS = 60 * 60 * 1000; // 1 hour
+export function validateCredentials(json) {
+    let parsed;
+    try {
+        parsed = JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+    const oauth = parsed?.claudeAiOauth;
+    if (!oauth?.expiresAt)
+        return null;
+    const msLeft = new Date(oauth.expiresAt).getTime() - Date.now();
+    if (msLeft <= 0) {
+        return oauth.refreshToken
+            ? { status: 'expired-refreshable' }
+            : { status: 'expired-no-refresh' };
+    }
+    return msLeft < NEAR_EXPIRY_THRESHOLD_MS
+        ? { status: 'near-expiry', minutesLeft: Math.ceil(msLeft / 60000) }
+        : { status: 'valid' };
+}
+export function credentialStatusNote(cs) {
+    if (!cs)
+        return '';
+    if (cs.status === 'valid')
+        return '';
+    if (cs.status === 'near-expiry') {
+        return `Note: Token expires in ~${cs.minutesLeft} minute${cs.minutesLeft === 1 ? '' : 's'}. Consider running /login to refresh.`;
+    }
+    return cs.status === 'expired-refreshable'
+        ? 'Note: Token is expired but has a refresh token — the agent CLI will auto-refresh on first use.'
+        : 'Token is expired with no refresh token. Run /login to get a fresh token before provisioning.';
+}
+//# sourceMappingURL=credential-validation.js.map

package/dist/utils/credential-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-validation.js","sourceRoot":"","sources":["../../src/utils/credential-validation.ts"],"names":[],"mappings":"AAAA,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AAQ1D,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,MAAM,EAAE,aAAa,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,SAAS;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEhE,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC,YAAY;YACvB,CAAC,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE;YACnC,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvC,CAAC;IAED,OAAO,MAAM,GAAG,wBAAwB;QACtC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,EAAE;QACnE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,EAA2B;IAC9D,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,EAAE,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAChC,OAAO,2BAA2B,EAAE,CAAC,WAAW,UAAU,EAAE,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,uCAAuC,CAAC;IACnI,CAAC;IACD,OAAO,EAAE,CAAC,MAAM,KAAK,qBAAqB;QACxC,CAAC,CAAC,gGAAgG;QAClG,CAAC,CAAC,8FAA8F,CAAC;AACrG,CAAC"}

package/dist/utils/crypto.d.ts

@@ -0,0 +1,3 @@
+export declare function encryptPassword(plaintext: string): string;
+export declare function decryptPassword(ciphertext: string): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/utils/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAgDA,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAW1D"}

package/dist/utils/crypto.js

@@ -0,0 +1,61 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { FLEET_DIR } from '../paths.js';
+import { logWarn } from './log-helpers.js';
+const ALGORITHM = 'aes-256-gcm';
+const KEY_LENGTH = 32;
+const IV_LENGTH = 16;
+const SALT_PATH = path.join(FLEET_DIR, 'salt');
+const CREDENTIALS_PATH = path.join(FLEET_DIR, 'credentials.json');
+/**
+ * Get or create a per-installation random AES-256-GCM key.
+ * The key is stored in ~/.apra-fleet/data/salt (32 random bytes, hex-encoded, mode 0o600).
+ * On first run a fresh random key is generated; subsequent runs load from file.
+ */
+function getOrCreateKey() {
+    try {
+        if (fs.existsSync(SALT_PATH)) {
+            return Buffer.from(fs.readFileSync(SALT_PATH, 'utf-8').trim(), 'hex');
+        }
+    }
+    catch {
+        // Fall through to create new key
+    }
+    if (!fs.existsSync(FLEET_DIR)) {
+        fs.mkdirSync(FLEET_DIR, { recursive: true, mode: 0o700 });
+    }
+    const key = crypto.randomBytes(KEY_LENGTH);
+    fs.writeFileSync(SALT_PATH, key.toString('hex'), { mode: 0o600 });
+    // Migration: if credentials.json already exists, it was encrypted with the
+    // old deriveKey() scheme and cannot be decrypted with the new random key.
+    // Back it up so the user's data isn't silently lost.
+    if (fs.existsSync(CREDENTIALS_PATH)) {
+        fs.renameSync(CREDENTIALS_PATH, CREDENTIALS_PATH + '.bak');
+        logWarn('crypto', '[apra-fleet] Encryption key upgraded to random persistent key. ' +
+            'Existing stored credentials could not be migrated and have been backed up to credentials.json.bak. ' +
+            'Please re-enter any stored API keys via credential_store_set.');
+    }
+    return key;
+}
+export function encryptPassword(plaintext) {
+    const key = getOrCreateKey();
+    const iv = crypto.randomBytes(IV_LENGTH);
+    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+    let encrypted = cipher.update(plaintext, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    const authTag = cipher.getAuthTag();
+    return `${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted}`;
+}
+export function decryptPassword(ciphertext) {
+    const [ivHex, authTagHex, encrypted] = ciphertext.split(':');
+    const iv = Buffer.from(ivHex, 'hex');
+    const authTag = Buffer.from(authTagHex, 'hex');
+    const key = getOrCreateKey();
+    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+    decrypted += decipher.final('utf8');
+    return decrypted;
+}
+//# sourceMappingURL=crypto.js.map

package/dist/utils/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAElE;;;;GAIG;AACH,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC3C,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAElE,2EAA2E;IAC3E,0EAA0E;IAC1E,qDAAqD;IACrD,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpC,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,MAAM,CAAC,CAAC;QAC3D,OAAO,CACL,QAAQ,EACR,iEAAiE;YACjE,qGAAqG;YACrG,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAEzD,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACxD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAE/C,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/utils/deep-merge.d.ts

@@ -0,0 +1,3 @@
+export declare function isObject(item: unknown): item is Record<string, unknown>;
+export declare function deepMerge<T extends object, U extends object>(target: T, source: U): T & U;
+//# sourceMappingURL=deep-merge.d.ts.map

package/dist/utils/deep-merge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-merge.d.ts","sourceRoot":"","sources":["../../src/utils/deep-merge.ts"],"names":[],"mappings":"AAAA,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEvE;AAED,wBAAgB,SAAS,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAkBzF"}

package/dist/utils/deep-merge.js

@@ -0,0 +1,23 @@
+export function isObject(item) {
+    return (item && typeof item === 'object' && !Array.isArray(item));
+}
+export function deepMerge(target, source) {
+    const output = { ...target };
+    if (isObject(target) && isObject(source)) {
+        Object.keys(source).forEach(key => {
+            if (isObject(source[key])) {
+                if (!(key in target)) {
+                    Object.assign(output, { [key]: source[key] });
+                }
+                else {
+                    output[key] = deepMerge(target[key], source[key]);
+                }
+            }
+            else {
+                Object.assign(output, { [key]: source[key] });
+            }
+        });
+    }
+    return output;
+}
+//# sourceMappingURL=deep-merge.js.map

package/dist/utils/deep-merge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-merge.js","sourceRoot":"","sources":["../../src/utils/deep-merge.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,OAAO,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAY,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,SAAS,CAAqC,MAAS,EAAE,MAAS;IAChF,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAW,CAAC;IAEtC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YAChC,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,EAAE,CAAC;oBACrB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChD,CAAC;qBAAM,CAAC;oBACL,MAAkC,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,GAAc,CAA4B,EAAE,MAAM,CAAC,GAAG,CAA4B,CAAC,CAAC;gBAClJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/file-permissions.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Enforce restrictive file permissions (owner-only read/write).
+ * On Linux/macOS: chmod 0o600. On Windows: no-op (NTFS ACLs handle this).
+ *
+ * Centralises the platform check — callers never branch on process.platform.
+ */
+export declare function enforceOwnerOnly(filePath: string): void;
+//# sourceMappingURL=file-permissions.d.ts.map

package/dist/utils/file-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-permissions.d.ts","sourceRoot":"","sources":["../../src/utils/file-permissions.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAGvD"}

package/dist/utils/file-permissions.js

@@ -0,0 +1,13 @@
+import fs from 'node:fs';
+/**
+ * Enforce restrictive file permissions (owner-only read/write).
+ * On Linux/macOS: chmod 0o600. On Windows: no-op (NTFS ACLs handle this).
+ *
+ * Centralises the platform check — callers never branch on process.platform.
+ */
+export function enforceOwnerOnly(filePath) {
+    if (process.platform === 'win32')
+        return;
+    fs.chmodSync(filePath, 0o600);
+}
+//# sourceMappingURL=file-permissions.js.map

package/dist/utils/file-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-permissions.js","sourceRoot":"","sources":["../../src/utils/file-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC"}

package/dist/utils/gpu-parser.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Parse GPU utilization percentage from nvidia-smi stdout.
+ * Returns the integer percentage (0-100) or undefined if non-numeric.
+ */
+export declare function parseGpuUtilization(stdout: string): number | undefined;
+//# sourceMappingURL=gpu-parser.d.ts.map

package/dist/utils/gpu-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gpu-parser.d.ts","sourceRoot":"","sources":["../../src/utils/gpu-parser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQtE"}

package/dist/utils/gpu-parser.js

@@ -0,0 +1,15 @@
+/**
+ * Parse GPU utilization percentage from nvidia-smi stdout.
+ * Returns the integer percentage (0-100) or undefined if non-numeric.
+ */
+export function parseGpuUtilization(stdout) {
+    const trimmed = stdout.trim();
+    if (!trimmed)
+        return undefined;
+    const parsed = parseInt(trimmed, 10);
+    if (isNaN(parsed) || parsed < 0 || parsed > 100) {
+        return undefined;
+    }
+    return parsed;
+}
+//# sourceMappingURL=gpu-parser.js.map

package/dist/utils/gpu-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gpu-parser.js","sourceRoot":"","sources":["../../src/utils/gpu-parser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/log-helpers.d.ts

@@ -0,0 +1,29 @@
+/** Returns the resolved path of the active log file, or null if logging is unavailable. */
+export declare function getActiveLogFile(): string | null;
+type LogAgent = {
+    id: string;
+    friendlyName: string;
+};
+export declare function logLine(tag: string, msg: string, agent?: LogAgent, inv?: string): void;
+export declare function logWarn(tag: string, msg: string, agent?: LogAgent): void;
+export declare function logError(tag: string, msg: string, agent?: LogAgent): void;
+export declare class LogScope {
+    private readonly inv;
+    private readonly start;
+    private readonly tag;
+    private readonly agent?;
+    constructor(tag: string, entryMsg: string, agent?: LogAgent);
+    getInv(): string;
+    info(msg: string): void;
+    warn(msg: string): void;
+    error(msg: string): void;
+    ok(msg?: string): void;
+    fail(msg: string): void;
+    abort(msg: string): void;
+    private _emit;
+    private _exit;
+}
+export declare function maskSecrets(text: string): string;
+export declare function truncateForLog(text: string, maxLen?: number): string;
+export {};
+//# sourceMappingURL=log-helpers.d.ts.map

package/dist/utils/log-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-helpers.d.ts","sourceRoot":"","sources":["../../src/utils/log-helpers.ts"],"names":[],"mappings":"AAOA,2FAA2F;AAC3F,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAGhD;AAgBD,KAAK,QAAQ,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AA4BrD,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAItF;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,IAAI,CAIxE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,IAAI,CAIzE;AAQD,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAW;gBAEtB,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,QAAQ;IAQ3D,MAAM,IAAI,MAAM;IAEhB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAI,IAAI;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAI,IAAI;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAExB,EAAE,CAAC,GAAG,SAAS,GAAK,IAAI;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAI,IAAI;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAExB,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,KAAK;CAGd;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQhD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,SAAK,GAAG,MAAM,CAGhE"}