@axtary/cli 0.0.1 → 0.2.0

package/dist/oauth.js

@@ -0,0 +1,339 @@
+import { spawn } from "node:child_process";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer, } from "node:http";
+import {} from "node:net";
+// Local-loopback OAuth 2.0 Authorization Code flow (with PKCE when the provider
+// supports it). This is the `gh auth login` model: the browser does the consent,
+// the provider redirects to 127.0.0.1, the CLI captures the code and exchanges
+// it locally. The resulting token never leaves the machine and is never pasted.
+//
+// Axtary never holds the customer's OAuth client secret: the user registers
+// their own OAuth app (or GitHub App) and the secret is read from local env.
+// That keeps the credential broker fully local, per PRD §10.1.
+export const DEFAULT_OAUTH_REDIRECT_PORT = 7878;
+export const DEFAULT_OAUTH_REDIRECT_PATH = "/callback";
+export const OAUTH_PROVIDERS = {
+    slack: {
+        provider: "slack",
+        authorizeUrl: "https://slack.com/oauth/v2/authorize",
+        tokenUrl: "https://slack.com/api/oauth.v2.access",
+        scopes: ["chat:write"],
+        scopeSeparator: ",",
+        pkce: false,
+        requiresClientSecret: true,
+        requiresHttpsRedirect: true,
+    },
+    linear: {
+        provider: "linear",
+        authorizeUrl: "https://linear.app/oauth/authorize",
+        tokenUrl: "https://api.linear.app/oauth/token",
+        scopes: ["read", "write"],
+        scopeSeparator: ",",
+        pkce: false,
+        requiresClientSecret: true,
+        requiresHttpsRedirect: false,
+        extraAuthParams: { prompt: "consent" },
+    },
+    jira: {
+        provider: "jira",
+        authorizeUrl: "https://auth.atlassian.com/authorize",
+        tokenUrl: "https://auth.atlassian.com/oauth/token",
+        scopes: ["read:jira-work", "write:jira-work", "read:me", "offline_access"],
+        scopeSeparator: " ",
+        pkce: false,
+        requiresClientSecret: true,
+        tokenRequestFormat: "json",
+        requiresHttpsRedirect: true,
+        extraAuthParams: {
+            audience: "api.atlassian.com",
+            prompt: "consent",
+        },
+    },
+    drive: {
+        provider: "drive",
+        authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+        tokenUrl: "https://oauth2.googleapis.com/token",
+        scopes: ["https://www.googleapis.com/auth/drive.file"],
+        scopeSeparator: " ",
+        pkce: true,
+        // Google's `trigger_onepick` Picker flow requires a custom HTTPS redirect,
+        // which only a Google **Web application** OAuth client can register — and a
+        // Web client is confidential, so Google's token endpoint requires the client
+        // secret at exchange (alongside PKCE). A Desktop/public client (no secret)
+        // cannot register a non-loopback redirect, so the secret is required here.
+        requiresClientSecret: true,
+        requiresHttpsRedirect: true,
+        extraAuthParams: {
+            access_type: "offline",
+            prompt: "consent",
+            trigger_onepick: "true",
+            allow_multiple: "false",
+            mimetypes: "application/vnd.google-apps.document,text/plain,text/markdown,text/html,text/csv,application/json,application/xml",
+        },
+    },
+};
+function base64Url(buffer) {
+    return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export async function runLoopbackOAuth(input) {
+    const fetchImpl = input.fetch ?? fetch;
+    const now = input.now ?? (() => Date.now());
+    const redirectPath = input.redirectPath ?? DEFAULT_OAUTH_REDIRECT_PATH;
+    const state = (input.randomState ?? (() => base64Url(randomBytes(24))))();
+    const verifier = input.descriptor.pkce
+        ? (input.pkceVerifier ?? (() => base64Url(randomBytes(32))))()
+        : null;
+    const challenge = verifier ? base64Url(createHash("sha256").update(verifier).digest()) : null;
+    const { server, port } = await listen(input.redirectPort ?? DEFAULT_OAUTH_REDIRECT_PORT);
+    input.onListening?.(port);
+    // The advertised redirect (sent to the provider and used in the exchange) may
+    // be a tunnel HTTPS URL; the local server matches on its path either way.
+    const redirectUri = input.redirectUri ?? `http://127.0.0.1:${port}${redirectPath}`;
+    const matchPath = new URL(redirectUri).pathname;
+    try {
+        const authorization = await captureAuthorizationCode({
+            server,
+            redirectPath: matchPath,
+            state,
+            timeoutMs: input.timeoutMs ?? 300_000,
+            start: async () => {
+                const authorizeUrl = buildAuthorizeUrl({
+                    descriptor: input.descriptor,
+                    clientId: input.clientId,
+                    redirectUri,
+                    state,
+                    challenge,
+                });
+                await input.openBrowser(authorizeUrl);
+            },
+        });
+        const json = await exchangeCode({
+            descriptor: input.descriptor,
+            clientId: input.clientId,
+            clientSecret: input.clientSecret,
+            code: authorization.code,
+            redirectUri,
+            verifier,
+            fetchImpl,
+        });
+        return mapTokenResponse(input.descriptor, json, now(), authorization.selectedResourceIds);
+    }
+    finally {
+        server.close();
+    }
+}
+function buildAuthorizeUrl(input) {
+    const url = new URL(input.descriptor.authorizeUrl);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", input.clientId);
+    url.searchParams.set("redirect_uri", input.redirectUri);
+    url.searchParams.set("scope", input.descriptor.scopes.join(input.descriptor.scopeSeparator));
+    url.searchParams.set("state", input.state);
+    if (input.challenge) {
+        url.searchParams.set("code_challenge", input.challenge);
+        url.searchParams.set("code_challenge_method", "S256");
+    }
+    for (const [key, value] of Object.entries(input.descriptor.extraAuthParams ?? {})) {
+        url.searchParams.set(key, value);
+    }
+    return url.toString();
+}
+async function exchangeCode(input) {
+    const values = {
+        grant_type: "authorization_code",
+        code: input.code,
+        redirect_uri: input.redirectUri,
+        client_id: input.clientId,
+        ...(input.clientSecret ? { client_secret: input.clientSecret } : {}),
+        ...(input.verifier ? { code_verifier: input.verifier } : {}),
+    };
+    const json = input.descriptor.tokenRequestFormat === "json";
+    const body = json
+        ? JSON.stringify(values)
+        : new URLSearchParams(values).toString();
+    const response = await input.fetchImpl(input.descriptor.tokenUrl, {
+        method: "POST",
+        headers: {
+            "content-type": json
+                ? "application/json"
+                : "application/x-www-form-urlencoded",
+            accept: "application/json",
+        },
+        body,
+    });
+    if (!response.ok) {
+        throw new Error(`oauth_token_exchange_failed:${response.status}`);
+    }
+    return (await response.json());
+}
+export async function discoverAtlassianAccessibleResources(accessToken, fetchImpl = fetch) {
+    const response = await fetchImpl("https://api.atlassian.com/oauth/token/accessible-resources", {
+        headers: {
+            authorization: `Bearer ${accessToken}`,
+            accept: "application/json",
+        },
+    });
+    if (!response.ok) {
+        throw new Error(`jira_accessible_resources_failed:${response.status}`);
+    }
+    const resources = (await response.json());
+    return resources.filter((resource) => typeof resource.id === "string" &&
+        typeof resource.url === "string" &&
+        typeof resource.name === "string");
+}
+export async function refreshOAuthAccessToken(input) {
+    const fetchImpl = input.fetch ?? fetch;
+    const values = {
+        grant_type: "refresh_token",
+        client_id: input.clientId,
+        refresh_token: input.refreshToken,
+        ...(input.clientSecret ? { client_secret: input.clientSecret } : {}),
+    };
+    const json = input.descriptor.tokenRequestFormat === "json";
+    const response = await fetchImpl(input.descriptor.tokenUrl, {
+        method: "POST",
+        headers: {
+            "content-type": json
+                ? "application/json"
+                : "application/x-www-form-urlencoded",
+            accept: "application/json",
+        },
+        body: json
+            ? JSON.stringify(values)
+            : new URLSearchParams(values).toString(),
+    });
+    if (!response.ok) {
+        throw new Error(`oauth_refresh_failed:${response.status}`);
+    }
+    return mapTokenResponse(input.descriptor, (await response.json()), (input.now ?? (() => Date.now()))());
+}
+function mapTokenResponse(descriptor, json, nowMs, selectedResourceIds = []) {
+    // Slack returns { ok: false, error } on failure and nests team info.
+    if (descriptor.provider === "slack" && json.ok === false) {
+        throw new Error(`oauth_token_error:${String(json.error ?? "unknown")}`);
+    }
+    if (typeof json.error === "string") {
+        throw new Error(`oauth_token_error:${json.error}`);
+    }
+    const accessToken = typeof json.access_token === "string" ? json.access_token : null;
+    if (!accessToken) {
+        throw new Error("oauth_token_missing_access_token");
+    }
+    const scopeRaw = typeof json.scope === "string" ? json.scope : "";
+    const scope = scopeRaw ? scopeRaw.split(/[ ,]/).filter(Boolean) : [];
+    const expiresIn = typeof json.expires_in === "number" ? json.expires_in : null;
+    const team = json.team;
+    return {
+        accessToken,
+        refreshToken: typeof json.refresh_token === "string" ? json.refresh_token : null,
+        tokenType: typeof json.token_type === "string" ? json.token_type : null,
+        scope,
+        expiresAt: expiresIn ? new Date(nowMs + expiresIn * 1000).toISOString() : null,
+        account: team?.name ?? team?.id ?? null,
+        selectedResourceIds,
+    };
+}
+export function listen(port) {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        server.on("error", reject);
+        server.listen(port, "127.0.0.1", () => {
+            const address = server.address();
+            resolve({ server, port: address.port });
+        });
+    });
+}
+export function captureAuthorizationCode(input) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            cleanup();
+            reject(new Error("oauth_timeout"));
+        }, input.timeoutMs);
+        function cleanup() {
+            clearTimeout(timer);
+            input.server.removeListener("request", onRequest);
+        }
+        function onRequest(req, res) {
+            const url = new URL(req.url ?? "/", "http://127.0.0.1");
+            if (url.pathname !== input.redirectPath) {
+                res.statusCode = 404;
+                res.end("not found");
+                return;
+            }
+            const error = url.searchParams.get("error");
+            const code = url.searchParams.get("code");
+            const returnedState = url.searchParams.get("state");
+            const finish = (status, message) => {
+                res.statusCode = status;
+                res.setHeader("content-type", "text/html; charset=utf-8");
+                res.end(`<!doctype html><meta charset="utf-8"><title>Axtary</title><body style="font:14px ui-monospace,monospace;background:#0a0a0a;color:#e5e5e5;padding:40px"><h1 style="font-size:16px">Axtary</h1><p>${message}</p><p style="color:#888">You can close this tab and return to your terminal.</p></body>`);
+            };
+            if (error) {
+                finish(400, `Authorization failed: ${escapeHtml(error)}.`);
+                cleanup();
+                reject(new Error(`oauth_authorization_error:${error}`));
+                return;
+            }
+            if (!constantTimeEquals(returnedState, input.state)) {
+                finish(400, "State mismatch — possible CSRF. Aborted.");
+                cleanup();
+                reject(new Error("oauth_state_mismatch"));
+                return;
+            }
+            if (!code) {
+                finish(400, "No authorization code received.");
+                cleanup();
+                reject(new Error("oauth_missing_code"));
+                return;
+            }
+            finish(200, "Connected. Token stored locally.");
+            cleanup();
+            resolve({
+                code,
+                selectedResourceIds: (url.searchParams.get("picked_file_ids") ?? "")
+                    .split(",")
+                    .map((value) => value.trim())
+                    .filter(Boolean),
+            });
+        }
+        input.server.on("request", onRequest);
+        input.start().catch((startError) => {
+            cleanup();
+            reject(startError);
+        });
+    });
+}
+/**
+ * Constant-time comparison of the returned `state` against the expected nonce,
+ * so a mismatch cannot be probed byte-by-byte via response timing. Lengths are
+ * compared first (a length difference is not secret), then the bytes.
+ */
+function constantTimeEquals(actual, expected) {
+    if (actual === null) {
+        return false;
+    }
+    const a = Buffer.from(actual);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (char) => char === "&"
+        ? "&amp;"
+        : char === "<"
+            ? "&lt;"
+            : char === ">"
+                ? "&gt;"
+                : char === '"'
+                    ? "&quot;"
+                    : "&#39;");
+}
+export function defaultOpenBrowser(url) {
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    const child = spawn(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+        // Browser launch is best-effort; the CLI also prints the URL to paste manually.
+    });
+    child.unref();
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EACL,YAAY,GAIb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAoB,MAAM,UAAU,CAAC;AAE5C,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAC/E,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,+DAA+D;AAE/D,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAyBvD,MAAM,CAAC,MAAM,eAAe,GAA4C;IACtE,KAAK,EAAE;QACL,QAAQ,EAAE,OAAO;QACjB,YAAY,EAAE,sCAAsC;QACpD,QAAQ,EAAE,uCAAuC;QACjD,MAAM,EAAE,CAAC,YAAY,CAAC;QACtB,cAAc,EAAE,GAAG;QACnB,IAAI,EAAE,KAAK;QACX,oBAAoB,EAAE,IAAI;QAC1B,qBAAqB,EAAE,IAAI;KAC5B;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,QAAQ;QAClB,YAAY,EAAE,oCAAoC;QAClD,QAAQ,EAAE,oCAAoC;QAC9C,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,cAAc,EAAE,GAAG;QACnB,IAAI,EAAE,KAAK;QACX,oBAAoB,EAAE,IAAI;QAC1B,qBAAqB,EAAE,KAAK;QAC5B,eAAe,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;KACvC;IACD,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM;QAChB,YAAY,EAAE,sCAAsC;QACpD,QAAQ,EAAE,wCAAwC;QAClD,MAAM,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,CAAC;QAC1E,cAAc,EAAE,GAAG;QACnB,IAAI,EAAE,KAAK;QACX,oBAAoB,EAAE,IAAI;QAC1B,kBAAkB,EAAE,MAAM;QAC1B,qBAAqB,EAAE,IAAI;QAC3B,eAAe,EAAE;YACf,QAAQ,EAAE,mBAAmB;YAC7B,MAAM,EAAE,SAAS;SAClB;KACF;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,OAAO;QACjB,YAAY,EAAE,8CAA8C;QAC5D,QAAQ,EAAE,qCAAqC;QAC/C,MAAM,EAAE,CAAC,4CAA4C,CAAC;QACtD,cAAc,EAAE,GAAG;QACnB,IAAI,EAAE,IAAI;QACV,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,oBAAoB,EAAE,IAAI;QAC1B,qBAAqB,EAAE,IAAI;QAC3B,eAAe,EAAE;YACf,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,SAAS;YACjB,eAAe,EAAE,MAAM;YACvB,cAAc,EAAE,OAAO;YACvB,SAAS,EACP,mHAAmH;SACtH;KACF;CACF,CAAC;AAmCF,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAyB;IAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,2BAA2B,CAAC;IACvE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI;QACpC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QAC9D,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,2BAA2B,CAAC,CAAC;IACzF,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1B,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,oBAAoB,IAAI,GAAG,YAAY,EAAE,CAAC;IACnF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC;YACnD,MAAM;YACN,YAAY,EAAE,SAAS;YACvB,KAAK;YACL,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,OAAO;YACrC,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,YAAY,GAAG,iBAAiB,CAAC;oBACrC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,WAAW;oBACX,KAAK;oBACL,SAAS;iBACV,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YACxC,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC;YAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,IAAI,EAAE,aAAa,CAAC,IAAI;YACxB,WAAW;YACX,QAAQ;YACR,SAAS;SACV,CAAC,CAAC;QAEH,OAAO,gBAAgB,CACrB,KAAK,CAAC,UAAU,EAChB,IAAI,EACJ,GAAG,EAAE,EACL,aAAa,CAAC,mBAAmB,CAClC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAM1B;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7F,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAQ3B;IACC,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,kBAAkB,KAAK,MAAM,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI;QACf,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACxB,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAE3C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;QAChE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,IAAI;gBAClB,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,mCAAmC;YACvC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI;KACL,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;AAC5D,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,WAAmB,EACnB,YAA0B,KAAK;IAE/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,4DAA4D,EAC5D;QACE,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,MAAM,EAAE,kBAAkB;SAC3B;KACF,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkC,CAAC;IAC3E,OAAO,SAAS,CAAC,MAAM,CACrB,CAAC,QAAQ,EAAE,EAAE,CACX,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ;QAC/B,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;QAChC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAO7C;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,kBAAkB,KAAK,MAAM,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,IAAI;gBAClB,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,mCAAmC;YACvC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI;YACR,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACxB,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,gBAAgB,CACrB,KAAK,CAAC,UAAU,EAChB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,EAClD,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAmC,EACnC,IAA6B,EAC7B,KAAa,EACb,sBAAgC,EAAE;IAElC,qEAAqE;IACrE,IAAI,UAAU,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAkD,CAAC;IAErE,OAAO;QACL,WAAW;QACX,YAAY,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;QAChF,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QACvE,KAAK;QACL,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QAC9E,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI;QACvC,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;YAChD,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAMxC;IACC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QACrC,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAEpB,SAAS,OAAO;YACd,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,CAAC;QAED,SAAS,SAAS,CAAC,GAAoB,EAAE,GAAmB;YAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;gBACxC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAEpD,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,OAAe,EAAQ,EAAE;gBACvD,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;gBACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBAC1D,GAAG,CAAC,GAAG,CACL,mMAAmM,OAAO,0FAA0F,CACrS,CAAC;YACJ,CAAC,CAAC;YAEF,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,GAAG,EAAE,yBAAyB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3D,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,GAAG,EAAE,0CAA0C,CAAC,CAAC;gBACxD,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;gBAC/C,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YAED,MAAM,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;YAChD,OAAO,EAAE,CAAC;YACV,OAAO,CAAC;gBACN,IAAI;gBACJ,mBAAmB,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;qBACjE,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;qBAC5B,MAAM,CAAC,OAAO,CAAC;aACnB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACtC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE;YACjC,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,UAAU,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,MAAqB,EAAE,QAAgB;IACjE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CACxC,IAAI,KAAK,GAAG;QACV,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,IAAI,KAAK,GAAG;YACZ,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,KAAK,GAAG;gBACZ,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI,KAAK,GAAG;oBACZ,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,OAAO,CAClB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7F,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACrB,gFAAgF;IAClF,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/dist/render.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Cinematic-restraint rendering primitives for the Axtary human CLI.
+ *
+ * Design contract (product/skills/design.md + clig.dev + AGENTS.md):
+ * - Color communicates STATE only; everything else stays neutral.
+ * - Color auto-disables off a real terminal, under NO_COLOR / TERM=dumb, and
+ *   when `--no-color` is passed — so piped/`--json`/CI output is plain text.
+ * - Output is status-first: a one-line plain-English verdict, then aligned
+ *   fields. Hashes are truncated for the eye; full values stay in `--json`.
+ *
+ * These are pure string helpers. The `--json` path never calls them, so the
+ * machine-readable contract is unaffected by anything here.
+ */
+/**
+ * Decide whether color should render. Pure so it is unit-testable; the CLI
+ * entrypoint calls this once with the real stdout/env and feeds the result to
+ * {@link setColorEnabled}.
+ */
+export declare function resolveColor(opts: {
+    isTTY?: boolean;
+    env?: Record<string, string | undefined>;
+    noColorFlag?: boolean;
+}): boolean;
+export declare function setColorEnabled(value: boolean): void;
+export declare function isColorEnabled(): boolean;
+export declare const style: {
+    bold: (t: string) => string;
+    dim: (t: string) => string;
+    green: (t: string) => string;
+    red: (t: string) => string;
+    yellow: (t: string) => string;
+    cyan: (t: string) => string;
+};
+/**
+ * The states the CLI renders. Authorization decisions (allow/deny/step_up) and
+ * workflow/connection outcomes (executed/blocked/failed/completed) collapse to
+ * one of three semantic colors: positive, attention, negative.
+ */
+export type RenderState = "allow" | "executed" | "completed" | "ok" | "deny" | "blocked" | "failed" | "error" | "step_up" | "warn" | "info";
+/** A single colored glyph that encodes the state (and nothing else carries color by default). */
+export declare function stateGlyph(state: RenderState): string;
+/** Quiet wordmark header: `  axtary  <command>`. The mark stays dim; the command is the subject. */
+export declare function wordmark(command: string): string;
+/** Status-first one-line verdict: glyph + plain-English sentence. */
+export declare function verdict(state: RenderState, sentence: string): string;
+/**
+ * Aligned label/value block. Labels are dimmed and padded to a common width so
+ * values form a clean column. Falsy values are dropped so a field never renders
+ * an empty or `undefined` line.
+ */
+export declare function fields(rows: Array<[string, string | number | null | undefined]>): string;
+/**
+ * A list of decision steps (a multi-step workflow or a demo's actions). Each
+ * row is a glyph + a name padded to a common width + a trailing detail, so the
+ * steps read as a scannable column.
+ */
+export declare function steps(rows: Array<{
+    state: RenderState;
+    name: string;
+    detail: string;
+}>): string;
+/** Truncate a hash-like string for the eye: `sha256:9f3a1c…b1`. Non-hashes pass through. */
+export declare function shortHash(value: string | null | undefined, head?: number, tail?: number): string | null;
+/**
+ * Assemble a standard decision/result block:
+ *   axtary  <command>
+ *
+ *   <glyph>  <verdict sentence>
+ *
+ *      label  value
+ *      ...
+ * Trailing newline included so callers can `stdout(...)` directly.
+ */
+export declare function block(input: {
+    command: string;
+    state: RenderState;
+    verdict: string;
+    rows?: Array<[string, string | number | null | undefined]>;
+}): string;
+/**
+ * Axtary brand spinner. Keep the circled-A brand mark fixed while a quadrant
+ * arc orbits it; the mark is bolded because terminal fonts can render enclosed
+ * letters thinly.
+ */
+export declare const SPINNER_FRAMES: string[];
+export declare const SPINNER_BRAND = "\u24B6";
+export type Spinner = {
+    /** Stop the spinner, clear its transient line, and resolve to a final state + message. */
+    stop: (state: RenderState, message: string) => void;
+    /** Clear the transient line without printing a resolution (caller prints its own result). */
+    clear: () => void;
+};
+/**
+ * A truthful spinner: it renders only when its stream is a TTY (never into a
+ * pipe or CI log) and only exists for the duration of genuine async work. On
+ * stop it resolves to the real terminal state — it never implies work that did
+ * not run. No-ops (returns a stop/clear that print nothing) when not on a TTY.
+ */
+export declare function startSpinner(text: string, io?: {
+    stream?: NodeJS.WriteStream;
+    intervalMs?: number;
+}): Spinner;
+//# sourceMappingURL=render.d.ts.map

package/dist/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAcH;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAMV;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAEpD;AAED,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAMD,eAAO,MAAM,KAAK;cACN,MAAM;aACP,MAAM;eACJ,MAAM;aACR,MAAM;gBACH,MAAM;cACR,MAAM;CACjB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB,OAAO,GACP,UAAU,GACV,WAAW,GACX,IAAI,GACJ,MAAM,GACN,SAAS,GACT,QAAQ,GACR,OAAO,GACP,SAAS,GACT,MAAM,GACN,MAAM,CAAC;AAMX,iGAAiG;AACjG,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAKrD;AAED,oGAAoG;AACpG,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GAAG,MAAM,CASxF;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CACnB,IAAI,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAChE,MAAM,CASR;AAED,4FAA4F;AAC5F,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,SAAI,EAAE,IAAI,SAAI,GAAG,MAAM,GAAG,IAAI,CAO7F;AAED;;;;;;;;;GASG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC;CAC5D,GAAG,MAAM,CAOT;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,UAAuB,CAAC;AACnD,eAAO,MAAM,aAAa,WAAM,CAAC;AAEjC,MAAM,MAAM,OAAO,GAAG;IACpB,0FAA0F;IAC1F,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpD,6FAA6F;IAC7F,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,EAAE,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5D,OAAO,CA0BT"}

package/dist/render.js

@@ -0,0 +1,172 @@
+/**
+ * Cinematic-restraint rendering primitives for the Axtary human CLI.
+ *
+ * Design contract (product/skills/design.md + clig.dev + AGENTS.md):
+ * - Color communicates STATE only; everything else stays neutral.
+ * - Color auto-disables off a real terminal, under NO_COLOR / TERM=dumb, and
+ *   when `--no-color` is passed — so piped/`--json`/CI output is plain text.
+ * - Output is status-first: a one-line plain-English verdict, then aligned
+ *   fields. Hashes are truncated for the eye; full values stay in `--json`.
+ *
+ * These are pure string helpers. The `--json` path never calls them, so the
+ * machine-readable contract is unaffected by anything here.
+ */
+const ANSI = {
+    reset: "\x1b[0m",
+    bold: "\x1b[1m",
+    dim: "\x1b[2m",
+    green: "\x1b[32m",
+    red: "\x1b[31m",
+    yellow: "\x1b[33m",
+    cyan: "\x1b[36m",
+};
+let colorEnabled = false;
+/**
+ * Decide whether color should render. Pure so it is unit-testable; the CLI
+ * entrypoint calls this once with the real stdout/env and feeds the result to
+ * {@link setColorEnabled}.
+ */
+export function resolveColor(opts) {
+    const env = opts.env ?? process.env;
+    if (opts.noColorFlag)
+        return false;
+    if (typeof env.NO_COLOR === "string" && env.NO_COLOR !== "")
+        return false;
+    if (env.TERM === "dumb")
+        return false;
+    return Boolean(opts.isTTY);
+}
+export function setColorEnabled(value) {
+    colorEnabled = value;
+}
+export function isColorEnabled() {
+    return colorEnabled;
+}
+function paint(code, text) {
+    return colorEnabled ? `${code}${text}${ANSI.reset}` : text;
+}
+export const style = {
+    bold: (t) => paint(ANSI.bold, t),
+    dim: (t) => paint(ANSI.dim, t),
+    green: (t) => paint(ANSI.green, t),
+    red: (t) => paint(ANSI.red, t),
+    yellow: (t) => paint(ANSI.yellow, t),
+    cyan: (t) => paint(ANSI.cyan, t),
+};
+const POSITIVE = new Set(["allow", "executed", "completed", "ok"]);
+const NEGATIVE = new Set(["deny", "blocked", "failed", "error"]);
+const ATTENTION = new Set(["step_up", "warn"]);
+/** A single colored glyph that encodes the state (and nothing else carries color by default). */
+export function stateGlyph(state) {
+    if (POSITIVE.has(state))
+        return style.green("✓");
+    if (NEGATIVE.has(state))
+        return style.red("✕");
+    if (ATTENTION.has(state))
+        return style.yellow("▲");
+    return style.dim("·");
+}
+/** Quiet wordmark header: `  axtary  <command>`. The mark stays dim; the command is the subject. */
+export function wordmark(command) {
+    return `  ${style.dim("axtary")}  ${command}`;
+}
+/** Status-first one-line verdict: glyph + plain-English sentence. */
+export function verdict(state, sentence) {
+    return `  ${stateGlyph(state)}  ${sentence}`;
+}
+/**
+ * Aligned label/value block. Labels are dimmed and padded to a common width so
+ * values form a clean column. Falsy values are dropped so a field never renders
+ * an empty or `undefined` line.
+ */
+export function fields(rows) {
+    const present = rows.filter(([, value]) => value !== null && value !== undefined && value !== "");
+    if (present.length === 0)
+        return "";
+    const width = Math.max(...present.map(([label]) => label.length));
+    return present
+        .map(([label, value]) => `     ${style.dim(label.padEnd(width))}  ${value}`)
+        .join("\n");
+}
+/**
+ * A list of decision steps (a multi-step workflow or a demo's actions). Each
+ * row is a glyph + a name padded to a common width + a trailing detail, so the
+ * steps read as a scannable column.
+ */
+export function steps(rows) {
+    if (rows.length === 0)
+        return "";
+    const width = Math.max(...rows.map((row) => row.name.length));
+    return rows
+        .map((row) => `     ${stateGlyph(row.state)}  ${style.dim(row.name.padEnd(width))}  ${row.detail}`)
+        .join("\n");
+}
+/** Truncate a hash-like string for the eye: `sha256:9f3a1c…b1`. Non-hashes pass through. */
+export function shortHash(value, head = 6, tail = 2) {
+    if (!value)
+        return null;
+    const match = /^([a-z0-9]+:)?([0-9a-fA-F]{12,})$/.exec(value);
+    if (!match)
+        return value;
+    const prefix = match[1] ?? "";
+    const hex = match[2];
+    return `${prefix}${hex.slice(0, head)}…${hex.slice(-tail)}`;
+}
+/**
+ * Assemble a standard decision/result block:
+ *   axtary  <command>
+ *
+ *   <glyph>  <verdict sentence>
+ *
+ *      label  value
+ *      ...
+ * Trailing newline included so callers can `stdout(...)` directly.
+ */
+export function block(input) {
+    const parts = [wordmark(input.command), "", verdict(input.state, input.verdict)];
+    const fieldBlock = input.rows ? fields(input.rows) : "";
+    if (fieldBlock) {
+        parts.push("", fieldBlock);
+    }
+    return `${parts.join("\n")}\n`;
+}
+/**
+ * Axtary brand spinner. Keep the circled-A brand mark fixed while a quadrant
+ * arc orbits it; the mark is bolded because terminal fonts can render enclosed
+ * letters thinly.
+ */
+export const SPINNER_FRAMES = ["◜", "◝", "◞", "◟"];
+export const SPINNER_BRAND = "Ⓐ";
+/**
+ * A truthful spinner: it renders only when its stream is a TTY (never into a
+ * pipe or CI log) and only exists for the duration of genuine async work. On
+ * stop it resolves to the real terminal state — it never implies work that did
+ * not run. No-ops (returns a stop/clear that print nothing) when not on a TTY.
+ */
+export function startSpinner(text, io = {}) {
+    const stream = io.stream ?? process.stderr;
+    if (!stream.isTTY) {
+        return { stop: () => { }, clear: () => { } };
+    }
+    let frame = 0;
+    const line = () => `\r${style.bold(SPINNER_BRAND)}${style.dim(SPINNER_FRAMES[frame])} ${text}`;
+    const render = () => {
+        stream.write(line());
+        frame = (frame + 1) % SPINNER_FRAMES.length;
+    };
+    render();
+    const timer = setInterval(render, io.intervalMs ?? 90);
+    const wipe = () => {
+        clearInterval(timer);
+        // Overwrite the transient spinner line with spaces, then return to col 0.
+        stream.write(`\r${" ".repeat(text.length + 4)}\r`);
+    };
+    return {
+        stop: (state, message) => {
+            wipe();
+            stream.write(`${stateGlyph(state)} ${message}\n`);
+        },
+        clear: wipe,
+    };
+}
+//# sourceMappingURL=render.js.map

package/dist/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,IAAI,GAAG;IACX,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,UAAU;IACf,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,UAAU;CACR,CAAC;AAEX,IAAI,YAAY,GAAG,KAAK,CAAC;AAEzB;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAI5B;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,YAAY,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,IAAY;IACvC,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtC,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;CACzC,CAAC;AAoBF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAc,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;AAChF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAc,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5D,iGAAiG;AACjG,MAAM,UAAU,UAAU,CAAC,KAAkB;IAC3C,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,KAAK,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,OAAO,CAAC,KAAkB,EAAE,QAAgB;IAC1D,OAAO,KAAK,UAAU,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,IAAyD;IAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CACzB,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CACjC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;SAC3E,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK,CACnB,IAAiE;IAEjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,OAAO,IAAI;SACR,GAAG,CACF,CAAC,GAAG,EAAE,EAAE,CACN,QAAQ,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CACvF;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,KAAgC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACrB,OAAO,GAAG,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,KAAK,CAAC,KAKrB;IACC,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AASjC;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,KAA2D,EAAE;IAE7D,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,KAAK,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACrB,KAAK,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC;IAC9C,CAAC,CAAC;IACF,MAAM,EAAE,CAAC;IACT,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,0EAA0E;QAC1E,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,CAAC,KAAkB,EAAE,OAAe,EAAE,EAAE;YAC5C,IAAI,EAAE,CAAC;YACP,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC"}