@ashlr/hub 2.2.0

package/dist/core/integrations/identity.js

@@ -0,0 +1,359 @@
+/**
+ * core/integrations/identity.ts — Phantom identity probe (M18).
+ *
+ * INTENTIONALLY VALUES-FREE: derives only names/status from the phantom CLI.
+ * Never reads, captures, logs, or returns secret values under any code path.
+ *
+ * Public API:
+ *   getIdentity(): Identity
+ *     — reads phantom cloud status + team list to derive who the caller is.
+ *     — NEVER throws; degrades to {loggedIn:false,...null} on any failure.
+ *     — bounded by a short timeout on each probe call.
+ */
+import { spawnSync } from 'node:child_process';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const PHANTOM_BIN = 'phantom';
+/** Hard cap per phantom call — keeps getIdentity() snappy. */
+const TIMEOUT_MS = 4_000;
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+/**
+ * Run a phantom sub-command synchronously.
+ * Never throws — all errors surface in the returned `error` string.
+ */
+function runPhantom(args) {
+    try {
+        const result = spawnSync(PHANTOM_BIN, args, {
+            encoding: 'utf8',
+            timeout: TIMEOUT_MS,
+            // Suppress interactive prompts / update-check noise.
+            env: { ...process.env, PHANTOM_NO_UPDATE_CHECK: '1' },
+        });
+        if (result.error) {
+            return { stdout: '', stderr: '', status: null, error: result.error.message };
+        }
+        return {
+            stdout: result.stdout ?? '',
+            stderr: result.stderr ?? '',
+            status: result.status,
+        };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { stdout: '', stderr: '', status: null, error: msg };
+    }
+}
+// ---------------------------------------------------------------------------
+// Parsers — names/status only, deliberately conservative
+// ---------------------------------------------------------------------------
+/**
+ * Parse `phantom cloud status [--json]` output to extract login state and
+ * optional user name.
+ *
+ * When logged in, phantom typically prints one of:
+ *   ->  Cloud: logged in as <user>  (e.g. mason@evero-consulting.com)
+ *   ->  Cloud: logged in            (no user shown)
+ *
+ * When logged out:
+ *   ->  Cloud: not logged in — run `phantom login`
+ *
+ * JSON form (--json) may yield: { "loggedIn": true, "user": "...", ... }
+ * We try JSON first, then fall back to the human-text heuristic.
+ *
+ * NEVER reads or returns secret values.
+ */
+function parseCloudStatus(raw) {
+    const trimmed = raw.trim();
+    // ── JSON path ─────────────────────────────────────────────────────────────
+    if (trimmed.startsWith('{')) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            // Recognised shapes:
+            //   { "loggedIn": true, "user": "alice" }
+            //   { "authenticated": true, "email": "alice@example.com" }
+            //   { "account": { "email": "..." }, "loggedIn": true }
+            const loggedIn = typeof parsed['loggedIn'] === 'boolean'
+                ? parsed['loggedIn']
+                : typeof parsed['authenticated'] === 'boolean'
+                    ? parsed['authenticated']
+                    : null;
+            if (loggedIn !== null) {
+                const user = extractUserFromJson(parsed);
+                return { loggedIn, user };
+            }
+        }
+        catch {
+            // Fall through to text heuristic.
+        }
+    }
+    // ── Human-text heuristic ──────────────────────────────────────────────────
+    const lc = trimmed.toLowerCase();
+    // "not logged in" / "not authenticated" / "run `phantom login`"
+    if (lc.includes('not logged in') ||
+        lc.includes('not authenticated') ||
+        lc.includes('phantom login')) {
+        return { loggedIn: false, user: null };
+    }
+    // "logged in as <user>" — extract the user handle that follows "as "
+    if (lc.includes('logged in')) {
+        const user = extractUserFromText(trimmed);
+        return { loggedIn: true, user };
+    }
+    // Ambiguous / empty — treat as logged out.
+    return { loggedIn: false, user: null };
+}
+/**
+ * Extract a user identifier from a JSON object.
+ * Only reads fields whose names clearly carry an account handle/email/id.
+ * Returns null when none is found.
+ */
+function extractUserFromJson(obj) {
+    // Direct top-level fields
+    for (const key of ['user', 'email', 'username', 'handle', 'id']) {
+        if (typeof obj[key] === 'string' && obj[key].length > 0) {
+            return obj[key];
+        }
+    }
+    // Nested account/profile object
+    for (const containerKey of ['account', 'profile', 'identity']) {
+        const container = obj[containerKey];
+        if (container !== null && typeof container === 'object') {
+            const inner = container;
+            for (const key of ['user', 'email', 'username', 'handle', 'id']) {
+                if (typeof inner[key] === 'string' && inner[key].length > 0) {
+                    return inner[key];
+                }
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Extract the user handle from a human-text "logged in as <user>" line.
+ * Returns null when no recognisable handle can be found.
+ */
+function extractUserFromText(line) {
+    // Pattern: "logged in as <handle>" or "Logged in as: <handle>"
+    // (case-insensitive; tolerates an optional colon after "as").
+    const inlineMatch = line.match(/logged\s+in\s+as\s*:?\s+(\S+)/i);
+    if (inlineMatch && inlineMatch[1]) {
+        return inlineMatch[1];
+    }
+    // Fallback: a labelled "User: <handle>" line (phantom's verbose text form).
+    const userLineMatch = line.match(/^[\t ]*user\s*:?\s+(\S+)/im);
+    if (userLineMatch && userLineMatch[1]) {
+        return userLineMatch[1];
+    }
+    return null;
+}
+/**
+ * Parse `phantom team list [--json]` to find the caller's active team name.
+ *
+ * JSON form may yield:
+ *   [ { "name": "my-team", "role": "admin", "active": true }, ... ]
+ *   { "teams": [ ... ] }
+ *
+ * Text form: table lines like "my-team   admin   active"
+ *
+ * We return the first team marked active, or the first team when none is
+ * explicitly marked. Returns null on any parse failure.
+ *
+ * NEVER reads or returns secret values.
+ */
+function parseTeamName(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    // ── JSON path ─────────────────────────────────────────────────────────────
+    // When the input is JSON-shaped we ONLY trust the JSON path and never fall
+    // through to the whitespace-token text heuristic — that heuristic would
+    // otherwise return the entire raw JSON blob (potentially leaking embedded
+    // secret-shaped fields) as the "team name".
+    const looksJson = trimmed.startsWith('[') || trimmed.startsWith('{');
+    if (looksJson) {
+        try {
+            let parsed = JSON.parse(trimmed);
+            // Unwrap { "teams": [...] }
+            if (parsed !== null &&
+                typeof parsed === 'object' &&
+                !Array.isArray(parsed)) {
+                const obj = parsed;
+                if (Array.isArray(obj['teams']))
+                    parsed = obj['teams'];
+            }
+            if (Array.isArray(parsed) && parsed.length > 0) {
+                // Prefer an entry explicitly marked active.
+                for (const item of parsed) {
+                    if (item !== null && typeof item === 'object') {
+                        const t = item;
+                        if (t['active'] === true && typeof t['name'] === 'string') {
+                            return t['name'];
+                        }
+                    }
+                }
+                // Fall back to the first entry.
+                const first = parsed[0];
+                if (first !== null && typeof first === 'object') {
+                    const t = first;
+                    if (typeof t['name'] === 'string')
+                        return t['name'];
+                    if (typeof t['slug'] === 'string')
+                        return t['slug'];
+                }
+            }
+        }
+        catch {
+            // Malformed JSON — do not fall through to the text heuristic.
+        }
+        // JSON-shaped input is handled exclusively above; never run the text
+        // heuristic on it (avoids returning a raw JSON blob as a team name).
+        return null;
+    }
+    // ── Human-text heuristic ──────────────────────────────────────────────────
+    // Phantom team list typically renders a table:
+    //   NAME         ROLE    STATUS
+    //   my-team      admin   active
+    //   other-team   member  -
+    //
+    // Strategy: skip header, extract first token from lines that contain "active".
+    const lines = trimmed.split('\n');
+    let firstCandidate = null;
+    for (const rawLine of lines) {
+        const line = rawLine.trim();
+        if (!line)
+            continue;
+        // Skip obvious header lines.
+        const lc = line.toLowerCase();
+        if (lc.startsWith('name') && (lc.includes('role') || lc.includes('status')))
+            continue;
+        if (lc.startsWith('error') || lc.startsWith('!'))
+            continue;
+        const token = line.split(/\s+/)[0];
+        if (!token || token.length === 0)
+            continue;
+        if (firstCandidate === null)
+            firstCandidate = token;
+        if (lc.includes('active'))
+            return token;
+    }
+    return firstCandidate;
+}
+/**
+ * Parse `phantom cloud status [--json]` for a tier/plan name.
+ *
+ * Phantom may include tier in cloud status:
+ *   JSON: { "tier": "pro", ... }  /  { "plan": "free", ... }
+ *   Text: typically not surfaced — we return null unless JSON provides it.
+ */
+function parseTier(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed.startsWith('{'))
+        return null;
+    try {
+        const parsed = JSON.parse(trimmed);
+        for (const key of ['tier', 'plan', 'subscription']) {
+            if (typeof parsed[key] === 'string' && parsed[key].length > 0) {
+                return parsed[key];
+            }
+        }
+        // Nested: { "account": { "tier": "pro" } }
+        for (const containerKey of ['account', 'profile']) {
+            const container = parsed[containerKey];
+            if (container !== null && typeof container === 'object') {
+                const inner = container;
+                for (const key of ['tier', 'plan', 'subscription']) {
+                    if (typeof inner[key] === 'string' && inner[key].length > 0) {
+                        return inner[key];
+                    }
+                }
+            }
+        }
+    }
+    catch {
+        // Not JSON or parse failed — no tier.
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Returns a read-only identity snapshot derived from the `phantom` CLI.
+ *
+ * Guarantees:
+ *  - NEVER throws.
+ *  - NEVER returns secret values — names/status only.
+ *  - Degrades to {loggedIn:false, user:null, tier:null, team:null} when
+ *    phantom is absent, not logged in, or returns unexpected output.
+ *  - Each probe call is bounded by TIMEOUT_MS (4 s).
+ *
+ * Probe sequence:
+ *  1. `phantom cloud status --json` — login state + user + tier. A spawn
+ *     error here (phantom absent) degrades to {loggedIn:false,...}.
+ *  2. `phantom team list --json` — team name (only when logged in).
+ */
+export function getIdentity() {
+    const notLoggedIn = {
+        loggedIn: false,
+        user: null,
+        tier: null,
+        team: null,
+    };
+    // ── 1. Cloud status: login state + user + tier ────────────────────────────
+    //
+    // The first probe is `phantom cloud status` itself — a spawn error here
+    // (ENOENT when phantom is absent) degrades to notLoggedIn below, so no
+    // separate `--version` presence check is needed.
+    //
+    //
+    // Try --json first; fall back to plain text.  Both paths go through the
+    // same parser which handles JSON then falls back to human-text heuristic.
+    let loggedIn = false;
+    let user = null;
+    let tier = null;
+    {
+        // First attempt: structured JSON output.
+        const { stdout: jsonOut, error: jsonErr } = runPhantom(['cloud', 'status', '--json']);
+        if (jsonErr === undefined && jsonOut.trim().length > 0) {
+            const parsed = parseCloudStatus(jsonOut);
+            loggedIn = parsed.loggedIn;
+            user = parsed.user;
+            tier = parseTier(jsonOut);
+        }
+        // If JSON probe gave nothing useful, try plain text.
+        if (!loggedIn && jsonErr !== undefined) {
+            const { stdout: txtOut, stderr: txtErr } = runPhantom(['cloud', 'status']);
+            const combined = txtOut + txtErr;
+            if (combined.trim().length > 0) {
+                const parsed = parseCloudStatus(combined);
+                loggedIn = parsed.loggedIn;
+                user = parsed.user;
+                // Tier not available from plain text — stays null.
+            }
+        }
+    }
+    // Not logged in — return early without probing team.
+    if (!loggedIn) {
+        return notLoggedIn;
+    }
+    // ── 2. Team name (only when logged in) ────────────────────────────────────
+    let team = null;
+    {
+        const { stdout: jsonOut, error: jsonErr } = runPhantom(['team', 'list', '--json']);
+        if (jsonErr === undefined && jsonOut.trim().length > 0) {
+            team = parseTeamName(jsonOut);
+        }
+        // Fallback: plain text team list.
+        if (team === null && jsonErr !== undefined) {
+            const { stdout: txtOut } = runPhantom(['team', 'list']);
+            if (txtOut.trim().length > 0) {
+                team = parseTeamName(txtOut);
+            }
+        }
+    }
+    return { loggedIn, user, tier, team };
+}
+//# sourceMappingURL=identity.js.map

package/dist/core/integrations/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/core/integrations/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,WAAW,GAAG,SAAS,CAAC;AAC9B,8DAA8D;AAC9D,MAAM,UAAU,GAAG,KAAK,CAAC;AAEzB,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,UAAU,CAAC,IAAc;IAMhC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE;YAC1C,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,UAAU;YACnB,qDAAqD;YACrD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,uBAAuB,EAAE,GAAG,EAAE;SACtD,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/E,CAAC;QAED,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAE3B,6EAA6E;IAC7E,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;YAC9D,qBAAqB;YACrB,0CAA0C;YAC1C,4DAA4D;YAC5D,wDAAwD;YACxD,MAAM,QAAQ,GACZ,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS;gBACrC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACpB,CAAC,CAAC,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,SAAS;oBAC5C,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;oBACzB,CAAC,CAAC,IAAI,CAAC;YAEb,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;gBACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAEjC,gEAAgE;IAChE,IACE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC5B,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAChC,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAC5B,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,qEAAqE;IACrE,IAAI,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,2CAA2C;IAC3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAA4B;IACvD,0BAA0B;IAC1B,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QAChE,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAK,GAAG,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,OAAO,GAAG,CAAC,GAAG,CAAW,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,gCAAgC;IAChC,KAAK,MAAM,YAAY,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,SAAoC,CAAC;YACnD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBAChE,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAK,KAAK,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxE,OAAO,KAAK,CAAC,GAAG,CAAW,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,+DAA+D;IAC/D,8DAA8D;IAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACjE,IAAI,WAAW,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,4EAA4E;IAC5E,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC/D,IAAI,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,4CAA4C;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,IAAI,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1C,4BAA4B;YAC5B,IACE,MAAM,KAAK,IAAI;gBACf,OAAO,MAAM,KAAK,QAAQ;gBAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACtB,CAAC;gBACD,MAAM,GAAG,GAAG,MAAiC,CAAC;gBAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAAE,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/C,4CAA4C;gBAC5C,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;oBAC1B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC9C,MAAM,CAAC,GAAG,IAA+B,CAAC;wBAC1C,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;4BAC1D,OAAO,CAAC,CAAC,MAAM,CAAW,CAAC;wBAC7B,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,gCAAgC;gBAChC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACxB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAChD,MAAM,CAAC,GAAG,KAAgC,CAAC;oBAC3C,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;wBAAE,OAAO,CAAC,CAAC,MAAM,CAAW,CAAC;oBAC9D,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;wBAAE,OAAO,CAAC,CAAC,MAAM,CAAW,CAAC;gBAChE,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;QACD,qEAAqE;QACrE,qEAAqE;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,+CAA+C;IAC/C,gCAAgC;IAChC,gCAAgC;IAChC,2BAA2B;IAC3B,EAAE;IACF,+EAA+E;IAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,cAAc,GAAkB,IAAI,CAAC;IAEzC,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,6BAA6B;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAAE,SAAS;QACtF,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAE3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE3C,IAAI,cAAc,KAAK,IAAI;YAAE,cAAc,GAAG,KAAK,CAAC;QACpD,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;IAC1C,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAC9D,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAK,MAAM,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1E,OAAO,MAAM,CAAC,GAAG,CAAW,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,2CAA2C;QAC3C,KAAK,MAAM,YAAY,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YAClD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;YACvC,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,SAAoC,CAAC;gBACnD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;oBACnD,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAK,KAAK,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACxE,OAAO,KAAK,CAAC,GAAG,CAAW,CAAC;oBAC9B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,WAAW,GAAa;QAC5B,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,IAAI;KACX,CAAC;IAEF,6EAA6E;IAC7E,EAAE;IACF,wEAAwE;IACxE,uEAAuE;IACvE,iDAAiD;IACjD,EAAE;IACF,EAAE;IACF,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAE/B,CAAC;QACC,yCAAyC;QACzC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtF,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACzC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACnB,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAED,qDAAqD;QACrD,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;YACjC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBAC1C,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAC3B,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACnB,mDAAmD;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,6EAA6E;IAC7E,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,CAAC;QACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnF,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QAED,kCAAkC;QAClC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC"}

package/dist/core/integrations/notify.d.ts

@@ -0,0 +1,23 @@
+/**
+ * M18 — notify.ts
+ *
+ * Sends a concise completion summary to configured webhook(s).
+ *
+ * CONTRACT GUARANTEES:
+ *  - STRICT NO-OP (returns false, zero network calls) when no webhook is set.
+ *  - Never throws — all errors are caught and returned as false.
+ *  - Never includes secret values in the posted payload; the `text` arg is a
+ *    caller-provided summary string; callers MUST NOT pass secrets in it.
+ *  - Bounded timeout (5 s) on every fetch to avoid hanging the CLI.
+ *  - Posts to Slack and/or Discord independently; partial success returns true
+ *    when at least one webhook succeeds.
+ */
+import type { AshlrConfig } from '../types.js';
+/**
+ * Post `text` to each configured webhook in `cfg.notify`.
+ *
+ * Returns true when at least one webhook received a 2xx response.
+ * Returns false (no network call) when no webhook is configured.
+ * Never throws.
+ */
+export declare function notify(text: string, cfg: AshlrConfig): Promise<boolean>;

package/dist/core/integrations/notify.js

@@ -0,0 +1,96 @@
+/**
+ * M18 — notify.ts
+ *
+ * Sends a concise completion summary to configured webhook(s).
+ *
+ * CONTRACT GUARANTEES:
+ *  - STRICT NO-OP (returns false, zero network calls) when no webhook is set.
+ *  - Never throws — all errors are caught and returned as false.
+ *  - Never includes secret values in the posted payload; the `text` arg is a
+ *    caller-provided summary string; callers MUST NOT pass secrets in it.
+ *  - Bounded timeout (5 s) on every fetch to avoid hanging the CLI.
+ *  - Posts to Slack and/or Discord independently; partial success returns true
+ *    when at least one webhook succeeds.
+ */
+/** Timeout in milliseconds for each webhook POST. */
+const FETCH_TIMEOUT_MS = 5_000;
+/**
+ * Post `text` to each configured webhook in `cfg.notify`.
+ *
+ * Returns true when at least one webhook received a 2xx response.
+ * Returns false (no network call) when no webhook is configured.
+ * Never throws.
+ */
+export async function notify(text, cfg) {
+    const slack = cfg.notify?.slackWebhook;
+    const discord = cfg.notify?.discordWebhook;
+    // Strict no-op when nothing is configured.
+    if (!slack && !discord) {
+        return false;
+    }
+    const results = await Promise.all([
+        slack ? postSlack(slack, text) : Promise.resolve(false),
+        discord ? postDiscord(discord, text) : Promise.resolve(false),
+    ]);
+    return results.some(Boolean);
+}
+// ---------------------------------------------------------------------------
+// Internal helpers — one per webhook flavour
+// ---------------------------------------------------------------------------
+/**
+ * POST to a Slack incoming-webhook URL.
+ * Slack expects `{ "text": "..." }`.
+ * Returns true on HTTP 2xx; false on any error.
+ */
+async function postSlack(url, text) {
+    try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+        try {
+            const res = await fetch(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ text }),
+                signal: controller.signal,
+            });
+            return res.ok;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    catch {
+        // Network error, timeout, or invalid URL — degrade silently.
+        return false;
+    }
+}
+/**
+ * POST to a Discord webhook URL.
+ * Discord expects `{ "content": "..." }`.
+ * Returns true on HTTP 2xx (Discord returns 204 No Content on success);
+ * false on any error.
+ */
+async function postDiscord(url, text) {
+    try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+        try {
+            const res = await fetch(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ content: text }),
+                signal: controller.signal,
+            });
+            // Discord returns 204 on success; treat any 2xx as ok.
+            return res.ok;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    catch {
+        // Network error, timeout, or invalid URL — degrade silently.
+        return false;
+    }
+}
+//# sourceMappingURL=notify.js.map

package/dist/core/integrations/notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../../src/core/integrations/notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,qDAAqD;AACrD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,GAAgB;IACzD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC;IAE3C,2CAA2C;IAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QACvD,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;KAC9D,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAE9E;;;;GAIG;AACH,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,IAAY;IAChD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;gBAC9B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IAClD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACvC,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,uDAAuD;YACvD,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/core/integrations/vercel.d.ts

@@ -0,0 +1,37 @@
+/**
+ * core/integrations/vercel.ts — Read-only Vercel project status via the
+ * `vercel` CLI.
+ *
+ * RULES:
+ *  - READ-ONLY. Deploying stays in `ashlr ship` (already --confirm gated).
+ *  - NEVER throws. Every exported function degrades gracefully on any
+ *    failure (CLI absent, not authed, not linked, malformed output).
+ *  - Uses the installed `vercel` CLI — no raw tokens are read, stored,
+ *    logged, or printed.
+ *  - spawnSync only (no shell prevents shell injection).
+ *  - Bounded timeouts so a slow/hung CLI never blocks the caller.
+ */
+import type { VercelStatus } from '../types.js';
+/** A single deployment summary (read-only). */
+export interface DeploySummary {
+    /** The deployment URL (e.g. my-app-abc123.vercel.app). */
+    url: string;
+    /** Build/deployment state (e.g. READY, BUILDING, ERROR, CANCELED). */
+    state: string;
+    /** ISO-8601 creation timestamp, or null when unavailable. */
+    createdAt: string | null;
+    /** Deployment target: "production" | "preview" | null. */
+    target: string | null;
+}
+/**
+ * Read-only linked-project snapshot via the `vercel` CLI.
+ * NEVER throws — degrades to `{ linked: false, latestState: null, url: null }`
+ * on any failure (CLI absent, not authed, not linked, scope prompt, timeout).
+ */
+export declare function vercelStatus(cwd: string): VercelStatus;
+/**
+ * List recent deployments for the Vercel project linked to `cwd`.
+ * NEVER throws — returns [] on any failure (CLI absent, not authed, not
+ * linked, malformed output, timeout).
+ */
+export declare function listDeploys(cwd: string): DeploySummary[];