@blogic-cz/agent-tools 1.6.19 → 1.7.0

package/README.md

@@ -1,6 +1,8 @@
 # @blogic-cz/agent-tools
 
-Safe CLI wrappers for AI coding agents. 9 tools for GitHub, observability, databases, Kubernetes, Azure platform, Azure DevOps, logs, OpenCode sessions, and audit history — with JSON5 config and a credential guard that blocks agents from touching secrets.
+Safe CLI wrappers for AI coding agents. Tools for GitHub, observability, databases, Kubernetes, Azure platform, Azure DevOps, logs, OpenCode sessions, audit history and generic JSON REST requests.
+
+The [REST credential proxy](docs/rest-api-proxy.md) adds `api-tool`, an exported TypeScript client and the operator-only `api-proxy` runtime. Deploy its private credential store under a separate service identity outside agent authority, with verified TLS. Its client configuration is separate from `agent-tools.json5`.
 
 ## Why
 
@@ -273,6 +275,8 @@ approval permits exact nonsensitive reads, not script execution or environment f
 | `azdo-tool`          | Azure DevOps tool — pipelines, builds, repos                                                                     |
 | `logs-tool`          | Application logs — read local and remote (k8s pod) logs                                                          |
 | `session-tool`       | OpenCode session browser — list, read, search sessions                                                           |
+| `api-tool`           | JSON REST client using an operator-issued capability                                                             |
+| `api-proxy`          | Isolated operator service holding upstream REST credentials                                                      |
 
 All tools support `--help` for full usage documentation. Legacy `agent-tools-*` binary names (e.g. `agent-tools-gh`) still work for backwards compatibility.
 
@@ -534,8 +538,10 @@ Each tool uses its own auth method — no unified token store:
 | `azdo-tool`          | `az` CLI session (`az login`)                                                                |
 | `db-tool`            | Password from env var defined by `passwordEnvVar` in config (e.g. `AGENT_TOOLS_DB_PASSWORD`) |
 | `logs-tool`          | No auth — reads local files or uses k8s-tool for remote access                               |
+| `api-tool`           | Caller capability and proxy HTTPS origin in client configuration                             |
+| `api-proxy`          | Private operator store and policy under a separated service identity                         |
 
-Secrets are **never** stored in the config file. The `db-tool` config references env var **names** only:
+The REST proxy uses its separate private operator store described in [REST proxy setup](docs/rest-api-proxy.md). Other tool configs reference credential sources. Provider secrets are **never** stored in the caller client config file. The `db-tool` config references env var **names** only:
 
 ```json5
 {

package/dist/api-tool/client.d.ts

@@ -0,0 +1,8 @@
+import type { ApiRequest, ApiResult, ClientConfig } from "./types";
+import type { Transport } from "./transport";
+export declare function createApiClient(value: ClientConfig, transport?: Transport): {
+    request: (input: ApiRequest) => Promise<ApiResult>;
+};
+export type { ApiRequest, ApiResult, ClientConfig } from "./types";
+export { ApiError } from "./errors";
+//# sourceMappingURL=client.d.ts.map

package/dist/api-tool/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api-tool/client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,GAAE,SAA2B;IAKvF,OAAO,UAAgB,UAAU,KAAG,OAAO,CAAC,SAAS,CAAC;EAkCzD;AACD,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC"}

package/dist/api-tool/errors.d.ts

@@ -0,0 +1,14 @@
+import { Schema } from "effect";
+export declare const ErrorCode: Schema.Literals<readonly ["CONFIG_INVALID", "CREDENTIAL_UNAVAILABLE", "UNAUTHORIZED", "POLICY_DENIED", "BUDGET_EXHAUSTED", "DESTINATION_DENIED", "UPSTREAM_FAILED", "LIMIT_EXCEEDED", "DEADLINE_EXCEEDED", "DISCLOSURE_DENIED", "GRANT_ALREADY_USED", "GRANT_STORE_UNAVAILABLE"]>;
+declare const ApiError_base: Schema.Class<ApiError, Schema.TaggedStruct<"ApiError", {
+    readonly code: Schema.Literals<readonly ["CONFIG_INVALID", "CREDENTIAL_UNAVAILABLE", "UNAUTHORIZED", "POLICY_DENIED", "BUDGET_EXHAUSTED", "DESTINATION_DENIED", "UPSTREAM_FAILED", "LIMIT_EXCEEDED", "DEADLINE_EXCEEDED", "DISCLOSURE_DENIED", "GRANT_ALREADY_USED", "GRANT_STORE_UNAVAILABLE"]>;
+    readonly message: Schema.String;
+    readonly hint: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ApiError extends ApiError_base {
+}
+export type ErrorCode = typeof ErrorCode.Type;
+export declare const apiError: (code: ErrorCode) => ApiError;
+export declare const safeError: (error: unknown) => ApiError;
+export {};
+//# sourceMappingURL=errors.d.ts.map

package/dist/api-tool/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/api-tool/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,eAAO,MAAM,SAAS,mRAapB,CAAC;;;;;;AACH,qBAAa,QAAS,SAAQ,aAI5B;CAAG;AACL,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAC;AAgB9C,eAAO,MAAM,QAAQ,SAAU,SAAS,KAAG,QACe,CAAC;AAC3D,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,QACqC,CAAC"}

package/dist/api-tool/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env bun
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/api-tool/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api-tool/index.ts"],"names":[],"mappings":""}

package/dist/api-tool/main.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/api-tool/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/api-tool/main.ts"],"names":[],"mappings":""}

package/dist/api-tool/proxy-entry.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env bun
+export {};
+//# sourceMappingURL=proxy-entry.d.ts.map

package/dist/api-tool/proxy-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-entry.d.ts","sourceRoot":"","sources":["../../src/api-tool/proxy-entry.ts"],"names":[],"mappings":""}

package/dist/api-tool/proxy.d.ts

@@ -0,0 +1,15 @@
+import type { ApiResult } from "./types";
+import type { Transport } from "./transport";
+export declare const capabilityDigest: (capability: string) => string;
+export declare function createProxy(options: {
+    config: unknown;
+    secrets: Readonly<Record<string, string>>;
+    transport: Transport;
+    now?: () => number;
+}): {
+    authorize: (capability: string) => void;
+    revoke: (digest: string) => void;
+    request: (capability: string, input: unknown) => Promise<ApiResult>;
+    requestSerialized: (capability: string, input: unknown) => Promise<string>;
+};
+//# sourceMappingURL=proxy.d.ts.map

package/dist/api-tool/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/api-tool/proxy.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAkB,MAAM,SAAS,CAAC;AAGzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,eAAO,MAAM,gBAAgB,eAAgB,MAAM,KAAG,MACC,CAAC;AASxD,wBAAgB,WAAW,CAAC,OAAO,EAAE;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;IA6PG,SAAS,eAAe,MAAM,KAAG,IAAI;IAGrC,MAAM,WAAW,MAAM,KAAG,IAAI;IAI9B,OAAO,eAAqB,MAAM,SAAS,OAAO,KAAG,OAAO,CAAC,SAAS,CAAC;IAEvE,iBAAiB,eAAqB,MAAM,SAAS,OAAO,KAAG,OAAO,CAAC,MAAM,CAAC;EAGjF"}

package/dist/api-tool/retention.d.ts

@@ -0,0 +1,9 @@
+export declare const MAX_RETAINED_CREDENTIALS = 128;
+export declare function createCredentialRetention(initial: readonly string[]): {
+    protects: (serialized: string) => boolean;
+    reserve: () => {
+        release: () => void;
+        retain: (value: string) => void;
+    };
+};
+//# sourceMappingURL=retention.d.ts.map

package/dist/api-tool/retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../../src/api-tool/retention.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAK5C,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE;2BAoBzC,MAAM,KAAG,OAAO;;uBAcjB,IAAI;wBAQN,MAAM,KAAG,IAAI;;EAQpC"}

package/dist/api-tool/server.d.ts

@@ -0,0 +1,6 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { createProxy } from "./proxy";
+import type { Transport } from "./transport";
+export declare function createRequestHandler(proxy: ReturnType<typeof createProxy>, maxConcurrent: number): (request: IncomingMessage, response: ServerResponse) => void;
+export declare function startProxy(configValue: unknown, transport?: Transport): Promise<import("node:http").Server<typeof IncomingMessage, typeof ServerResponse>>;
+//# sourceMappingURL=server.d.ts.map

package/dist/api-tool/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/api-tool/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAM7C,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,EAAE,aAAa,EAAE,MAAM,aAE9E,eAAe,YAAY,cAAc,KAAG,IAAI,CAiElE;AAED,wBAAsB,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,GAAE,SAA2B,sFAiC5F"}

package/dist/api-tool/store.d.ts

@@ -0,0 +1,5 @@
+import type { OperatorConfig } from "./types";
+export declare function readPrivateFile(path: string): Promise<string>;
+export declare function readSecretStore(path: string): Promise<Readonly<Record<string, string>>>;
+export declare function claimGrants(config: OperatorConfig): Promise<void>;
+//# sourceMappingURL=store.d.ts.map

package/dist/api-tool/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/api-tool/store.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAS9C,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBnE;AACD,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAqB7F;AACD,wBAAsB,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCvE"}

package/dist/api-tool/transport.d.ts

@@ -0,0 +1,26 @@
+import type { SecureContextOptions } from "node:tls";
+export type TransportRequest = {
+    url: URL;
+    method: string;
+    headers: Readonly<Record<string, string>>;
+    body: string;
+    maxBytes: number;
+    signal: AbortSignal;
+    allowedPrivateAddresses: readonly string[];
+    developmentLoopback?: boolean;
+};
+export type TransportResult = {
+    status: number;
+    body: string;
+};
+export type Transport = (request: TransportRequest) => Promise<TransportResult>;
+export type Resolver = (host: string) => Promise<readonly {
+    address: string;
+    family: number;
+}[]>;
+export declare function beforeAbort<T>(operation: Promise<T>, signal: AbortSignal): Promise<T>;
+export declare function allowedAddress(address: string, privateAllow: readonly string[], developmentLoopback?: boolean): boolean;
+export declare const MAX_PENDING_DNS_LOOKUPS = 64;
+export declare function makePinnedTransport(resolve?: Resolver, trust?: Pick<SecureContextOptions, "ca">): Transport;
+export declare const pinnedTransport: Transport;
+//# sourceMappingURL=transport.d.ts.map

package/dist/api-tool/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/api-tool/transport.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAIrD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AACF,MAAM,MAAM,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAC/D,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAChF,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,CAAC;AAEjG,wBAAgB,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAmBrF;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,mBAAmB,UAAQ,GAC1B,OAAO,CAmCT;AAED,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,QAAgE,EACzE,KAAK,GAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAM,GAC3C,SAAS,CA8EX;AACD,eAAO,MAAM,eAAe,WAAwB,CAAC"}

package/dist/api-tool/types.d.ts

@@ -0,0 +1,136 @@
+import { Schema } from "effect";
+export declare const Method: Schema.Literals<readonly ["GET", "POST", "PUT", "PATCH", "DELETE"]>;
+export declare const ProfileSchema: Schema.Struct<{
+    readonly origin: Schema.String;
+    readonly auth: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"bearer">;
+        readonly secretRef: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"apiKey">;
+        readonly header: Schema.String;
+        readonly secretRef: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"basic">;
+        readonly usernameRef: Schema.String;
+        readonly passwordRef: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"login">;
+        readonly path: Schema.String;
+        readonly fields: Schema.$Record<Schema.String, Schema.String>;
+        readonly tokenField: Schema.String;
+    }>]>;
+    readonly methods: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["GET", "POST", "PUT", "PATCH", "DELETE"]>>>;
+    readonly pathPrefixes: Schema.$Array<Schema.String>;
+    readonly deniedPathPrefixes: Schema.$Array<Schema.String>;
+    readonly allowedPrivateAddresses: Schema.$Array<Schema.String>;
+    readonly disclosure: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"raw">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"fields">;
+        readonly fields: Schema.$Array<Schema.String>;
+    }>]>;
+    readonly maxRequestBytes: Schema.Number;
+    readonly maxResponseBytes: Schema.Number;
+    readonly timeoutMs: Schema.Number;
+}>;
+declare const GrantSchema: Schema.Struct<{
+    readonly digest: Schema.String;
+    readonly expiresAt: Schema.Number;
+    readonly revoked: Schema.Boolean;
+    readonly profiles: Schema.$Array<Schema.String>;
+    readonly maxRequests: Schema.Number;
+    readonly maxBytes: Schema.Number;
+    readonly maxConcurrent: Schema.Number;
+    readonly lifetimeMs: Schema.Number;
+}>;
+export declare const OperatorSchema: Schema.Struct<{
+    readonly listen: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"tls">;
+        readonly host: Schema.String;
+        readonly port: Schema.Number;
+        readonly certFile: Schema.String;
+        readonly keyFile: Schema.String;
+        readonly separateIdentityAcknowledged: Schema.Literal<true>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"developmentLoopback">;
+        readonly host: Schema.Literal<"127.0.0.1">;
+        readonly port: Schema.Number;
+    }>]>;
+    readonly secretsFile: Schema.String;
+    readonly grantUseDirectory: Schema.String;
+    readonly profiles: Schema.$Record<Schema.String, Schema.Struct<{
+        readonly origin: Schema.String;
+        readonly auth: Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"bearer">;
+            readonly secretRef: Schema.String;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"apiKey">;
+            readonly header: Schema.String;
+            readonly secretRef: Schema.String;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"basic">;
+            readonly usernameRef: Schema.String;
+            readonly passwordRef: Schema.String;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"login">;
+            readonly path: Schema.String;
+            readonly fields: Schema.$Record<Schema.String, Schema.String>;
+            readonly tokenField: Schema.String;
+        }>]>;
+        readonly methods: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["GET", "POST", "PUT", "PATCH", "DELETE"]>>>;
+        readonly pathPrefixes: Schema.$Array<Schema.String>;
+        readonly deniedPathPrefixes: Schema.$Array<Schema.String>;
+        readonly allowedPrivateAddresses: Schema.$Array<Schema.String>;
+        readonly disclosure: Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"raw">;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"fields">;
+            readonly fields: Schema.$Array<Schema.String>;
+        }>]>;
+        readonly maxRequestBytes: Schema.Number;
+        readonly maxResponseBytes: Schema.Number;
+        readonly timeoutMs: Schema.Number;
+    }>>;
+    readonly grants: Schema.$Array<Schema.Struct<{
+        readonly digest: Schema.String;
+        readonly expiresAt: Schema.Number;
+        readonly revoked: Schema.Boolean;
+        readonly profiles: Schema.$Array<Schema.String>;
+        readonly maxRequests: Schema.Number;
+        readonly maxBytes: Schema.Number;
+        readonly maxConcurrent: Schema.Number;
+        readonly lifetimeMs: Schema.Number;
+    }>>;
+    readonly maxConcurrent: Schema.Number;
+}>;
+export declare const ClientSchema: Schema.Struct<{
+    readonly proxyOrigin: Schema.String;
+    readonly capability: Schema.String;
+    readonly developmentLoopback: Schema.optionalKey<Schema.Boolean>;
+}>;
+export declare const RequestSchema: Schema.Struct<{
+    readonly profile: Schema.String;
+    readonly method: Schema.Literals<readonly ["GET", "POST", "PUT", "PATCH", "DELETE"]>;
+    readonly path: Schema.String;
+    readonly query: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+    readonly body: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+}>;
+export declare const ResultSchema: Schema.Struct<{
+    readonly status: Schema.Number;
+    readonly data: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+}>;
+export type OperatorConfig = typeof OperatorSchema.Type;
+export type ClientConfig = typeof ClientSchema.Type;
+export type ApiRequest = typeof RequestSchema.Type;
+export type ApiResult = typeof ResultSchema.Type;
+export type Profile = typeof ProfileSchema.Type;
+export type Grant = typeof GrantSchema.Type;
+export declare function decode<S extends Schema.ConstraintDecoder<unknown>>(schema: S, value: unknown): S["Type"];
+export declare const MAX_PATH_BYTES = 16384;
+export declare const MAX_RESULT_ENVELOPE_BYTES = 10000000;
+export declare function relativePath(path: string): string;
+export declare const matchesPrefix: (path: string, prefix: string) => boolean;
+export declare function originUrl(origin: string, developmentLoopback?: boolean): URL;
+export declare function validateOperator(value: unknown): OperatorConfig;
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/api-tool/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/api-tool/types.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGhC,eAAO,MAAM,MAAM,qEAA6D,CAAC;AAoBjF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcxB,CAAC;AACH,QAAA,MAAM,WAAW;;;;;;;;;EASf,CAAC;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBzB,CAAC;AACH,eAAO,MAAM,YAAY;;;;EAIvB,CAAC;AACH,eAAO,MAAM,aAAa;;;;;;EAMxB,CAAC;AACH,eAAO,MAAM,YAAY;;;EAA8D,CAAC;AACxF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAC;AACxD,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;AACpD,MAAM,MAAM,UAAU,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AACnD,MAAM,MAAM,SAAS,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;AACjD,MAAM,MAAM,OAAO,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAChD,MAAM,MAAM,KAAK,GAAG,OAAO,WAAW,CAAC,IAAI,CAAC;AAE5C,wBAAgB,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAChE,MAAM,EAAE,CAAC,EACT,KAAK,EAAE,OAAO,GACb,CAAC,CAAC,MAAM,CAAC,CAMX;AACD,eAAO,MAAM,cAAc,QAAS,CAAC;AACrC,eAAO,MAAM,yBAAyB,WAAa,CAAC;AACpD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASjD;AACD,eAAO,MAAM,aAAa,SAAU,MAAM,UAAU,MAAM,KAAG,OAG5D,CAAC;AACF,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,mBAAmB,UAAQ,GAAG,GAAG,CAgB1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAiE/D"}

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAM5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA83GF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA6hBrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAr8HD,SAAS,UAAU,UAAU,KAAK,IAq8HM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAv8HC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAu8HjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAz8HE,MAAM,KAAK,OAy8HgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA38HE,MAAM,KAAK,OA28HgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA78HC,MAAM,KAAK,OA68H0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YA/8HC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IA+8Hf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAj9HC,MAAM,KAAK,OAi9HsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAn9HC,MAAM,KAAK,MAAM,GAAG,IAm9Ha,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAM5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAw7GF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA6hBrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UA//HD,SAAS,UAAU,UAAU,KAAK,IA+/HM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAjgIC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAigIjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAngIE,MAAM,KAAK,OAmgIgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aArgIE,MAAM,KAAK,OAqgIgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAvgIC,MAAM,KAAK,OAugI0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAzgIC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAygIf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA3gIC,MAAM,KAAK,OA2gIsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YA7gIC,MAAM,KAAK,MAAM,GAAG,IA6gIa,CAAC"}

package/dist/gh-tool/issue/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/issue/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,KAAK,EAAyB,YAAY,EAAgC,MAAM,WAAW,CAAC;AAGnG,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChC,SAAS,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AA0DF,eAAO,MAAM,UAAU;WACd,MAAM;YACL,MAAM,GAAG,IAAI;WACd,MAAM;kFAoBb,CAAC;AAEH,eAAO,MAAM,SAAS,iGAUpB,CAAC;AAEH,eAAO,MAAM,kBAAkB,gLAiC7B,CAAC;AAEH,eAAO,MAAM,UAAU;WACd,MAAM;aACJ,MAAM,GAAG,IAAI;YACd,MAAM;4EAmBd,CAAC;AAEH,eAAO,MAAM,WAAW;WACf,MAAM;aACJ,MAAM,GAAG,IAAI;4EAmBtB,CAAC;AAEH,eAAO,MAAM,cAAc;WAClB,MAAM;UACP,MAAM;;;;;;;gDA4CZ,CAAC;AAEH,eAAO,MAAM,WAAW;WACf,MAAM;UACP,MAAM;cACF,MAAM,GAAG,IAAI;YACf,MAAM,GAAG,IAAI;4EA4BrB,CAAC;AAEH,eAAO,MAAM,SAAS;WACb,MAAM;WACN,MAAM,GAAG,IAAI;UACd,MAAM,GAAG,IAAI;eACR,MAAM,GAAG,IAAI;kBACV,MAAM,GAAG,IAAI;iBACd,MAAM,GAAG,IAAI;oBACV,MAAM,GAAG,IAAI;4EAkC7B,CAAC"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/issue/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,KAAK,EAAyB,YAAY,EAAgC,MAAM,WAAW,CAAC;AAGnG,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChC,SAAS,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AA0DF,eAAO,MAAM,UAAU;WACd,MAAM;YACL,MAAM,GAAG,IAAI;WACd,MAAM;kFAoBb,CAAC;AAEH,eAAO,MAAM,SAAS,iGAUpB,CAAC;AAEH,eAAO,MAAM,kBAAkB,gLAiC7B,CAAC;AAEH,eAAO,MAAM,UAAU;WACd,MAAM;aACJ,MAAM,GAAG,IAAI;YACd,MAAM;4EAmBd,CAAC;AAEH,eAAO,MAAM,WAAW;WACf,MAAM;aACJ,MAAM,GAAG,IAAI;4EAmBtB,CAAC;AAEH,eAAO,MAAM,cAAc;WAClB,MAAM;UACP,MAAM;;;;;;;gDA2CZ,CAAC;AAEH,eAAO,MAAM,WAAW;WACf,MAAM;UACP,MAAM;cACF,MAAM,GAAG,IAAI;YACf,MAAM,GAAG,IAAI;4EA4BrB,CAAC;AAEH,eAAO,MAAM,SAAS;WACb,MAAM;WACN,MAAM,GAAG,IAAI;UACd,MAAM,GAAG,IAAI;eACR,MAAM,GAAG,IAAI;kBACV,MAAM,GAAG,IAAI;iBACd,MAAM,GAAG,IAAI;oBACV,MAAM,GAAG,IAAI;4EAkC7B,CAAC"}

package/dist/gh-tool/pr/review.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/review.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,KAAK,EAEV,YAAY,EAGZ,iBAAiB,EACjB,aAAa,EACb,YAAY,EAEb,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAkf5C;;;GAGG;AACH,eAAO,MAAM,YAAY,gMAcvB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,uKAoCxB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kBAAkB,8KAmC7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,YAAY,+NA+CvB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;gDAaxB,CAAC;AAEH,eAAO,MAAM,uBAAuB,6JAgBlC,CAAC;AAEH,eAAO,MAAM,gBAAgB,gHA0C3B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;gDA4CjC,CAAC;AAeH,eAAO,MAAM,WAAW;;;;;;gDAmGtB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,cAAc;;;gDA4FzB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;gDA0FjC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,aAAa;;;gDAWxB,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAgCzD;;;GAGG;AACH,eAAO,MAAM,YAAY;QACnB,MAAM,GAAG,IAAI;WACV,WAAW;UACZ,MAAM;aACH,OAAO;;;;;;;gDAmDhB,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;gDAyM9B,CAAC;AAeH,eAAO,MAAM,sBAAsB;;;;gDA8CjC,CAAC"}
+{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/review.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,KAAK,EAEV,YAAY,EAGZ,iBAAiB,EACjB,aAAa,EACb,YAAY,EAEb,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAkf5C;;;GAGG;AACH,eAAO,MAAM,YAAY,gMAcvB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,uKAoCxB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kBAAkB,8KAmC7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,YAAY,+NA+CvB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;gDAaxB,CAAC;AAEH,eAAO,MAAM,uBAAuB,6JAgBlC,CAAC;AAEH,eAAO,MAAM,gBAAgB,gHAyC3B,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;gDA4CjC,CAAC;AAeH,eAAO,MAAM,WAAW;;;;;;gDAmGtB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,cAAc;;;gDA2FzB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;gDA0FjC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,aAAa;;;gDAWxB,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAgCzD;;;GAGG;AACH,eAAO,MAAM,YAAY;QACnB,MAAM,GAAG,IAAI;WACV,WAAW;UACZ,MAAM;aACH,OAAO;;;;;;;gDAmDhB,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;gDAyM9B,CAAC;AAeH,eAAO,MAAM,sBAAsB;;;;gDA8CjC,CAAC"}

package/docs/rest-api-proxy.md

@@ -0,0 +1,136 @@
+# REST credential proxy
+
+`api-tool` and the exported TypeScript client submit JSON REST requests to an operator-owned proxy. The proxy loads provider credentials, authenticates against a fixed HTTPS origin, and returns approved JSON. It runs no uploaded scripts. Profiles configure services without adding endpoint-specific wrapper code.
+
+## Required deployment boundary
+
+Deploy the proxy under a separate Unix service identity or on a remote host. The requesting agent must have no access to that identity's files, process memory, administrative controls, service configuration, grant-use markers or upstream credential sources. Remove or isolate any old provider credentials in the agent's shell exports, startup files and accessible stores. The `separateIdentityAcknowledged` configuration field records operator acknowledgment. The application cannot prove OS isolation.
+
+Production clients use verified TLS. The runtime serves TLS directly. It refuses external plaintext HTTP; explicit `developmentLoopback` binds only `127.0.0.1` and protects against accidental output only. A daemon under the same user does not prevent that user reading its credentials. Unix ownership and permissions are required by this first version's private-file backend. Windows operators can use a remote Unix proxy; no Windows store backend is implemented.
+
+The private store is plaintext operator configuration, protected by OS ownership and permissions. It is not an encrypted vault. No provider secret belongs in client configuration, command arguments, client environment or agent-readable files.
+
+## Operator setup
+
+Run these steps as the isolated service owner, outside the agent's authority. Create an absolute canonical private directory with mode `0700`, and keep every configuration, private store, TLS key and certificate file mode `0600` and owned by that identity. Use a trusted operator editor or provisioning system to write the files. The runtime checks the immediate private parent directory and rejects direct symlink files, other ownership, public file permissions, missing credentials and malformed configuration. Ancestor ownership, symlinks and replacement races are operator responsibilities; these checks do not certify a whole path against an administrator. Files are limited to 1 MB.
+
+Provision a cryptographically random caller capability with at least 32 URL-safe characters, for example through the operator's existing secret generator. Give the caller only the capability and the proxy HTTPS origin. Compute its SHA-256 digest with standard tooling and put only the digest in the operator grant. The capability authorizes allowed use; it is not an upstream credential. It must be kept private from other callers.
+
+Create a private `grant-use` directory with mode `0700`. Before listening, the runtime exclusively creates and fsyncs a marker for every configured grant digest, then fsyncs the directory. A marker means that grant can never be used by another runtime. Restart, a crash, or partial startup requires issuing fresh capabilities and digests. Never delete or reuse markers, restore stale marker backups, or share grants across multiple proxy instances. Grant-store errors refuse startup. File and directory fsync establish the available filesystem flush contract, not universal power-loss durability. This backend does not use macOS F_FULLFSYNC. After uncertain power loss, filesystem rollback or backup restoration, provision fresh capabilities and retain existing markers before starting; never trust an absent marker as evidence an old grant is fresh. Failed startup can burn some grants. This deliberately small first version has no persistent request ledger, automatic retries, token refresh cache or automatic pagination.
+
+Example private store, entered by the operator:
+
+```json
+{ "sample-token": "OPERATOR_PROVISIONS_PROVIDER_SECRET" }
+```
+
+Example operator configuration. Replace the digest, expiry, paths and service policy before use. The sample expiry is illustrative and must be a future epoch timestamp in milliseconds.
+
+```json
+{
+  "listen": {
+    "kind": "tls",
+    "host": "0.0.0.0",
+    "port": 8443,
+    "certFile": "/operator/private/cert.pem",
+    "keyFile": "/operator/private/key.pem",
+    "separateIdentityAcknowledged": true
+  },
+  "secretsFile": "/operator/private/store.json",
+  "grantUseDirectory": "/operator/private/grant-use",
+  "maxConcurrent": 4,
+  "profiles": {
+    "sample": {
+      "origin": "https://service.example.invalid",
+      "auth": { "kind": "bearer", "secretRef": "sample-token" },
+      "pathPrefixes": ["/v1"],
+      "deniedPathPrefixes": ["/v1/auth"],
+      "allowedPrivateAddresses": [],
+      "disclosure": { "kind": "fields", "fields": ["items", "total"] },
+      "maxRequestBytes": 10000,
+      "maxResponseBytes": 100000,
+      "timeoutMs": 10000
+    }
+  },
+  "grants": [
+    {
+      "digest": "OPERATOR_SUPPLIES_64_LOWERCASE_HEX_DIGEST",
+      "expiresAt": 1799999999000,
+      "revoked": false,
+      "profiles": ["sample"],
+      "maxRequests": 20,
+      "maxBytes": 2200000,
+      "maxConcurrent": 2,
+      "lifetimeMs": 600000
+    }
+  ]
+}
+```
+
+Start the service using its service manager and identity:
+
+```sh
+api-proxy --config /operator/private/operator.json
+```
+
+For development with synthetic credentials only, use `"listen": { "kind": "developmentLoopback", "host": "127.0.0.1", "port": 8443 }`. The client must separately enable `developmentLoopback: true`. Upstream profiles still require HTTPS.
+
+Rotate credentials by replacing the private store through operator provisioning and restarting with fresh grants. Revoke grants by stopping the service and restarting with fresh grants for callers who retain access. Configuration is immutable during a runtime. There is no caller-facing administration endpoint. Operator code embedding the engine can call its `revoke(digest)` method. An already dispatched provider request may finish, but its result is refused after revocation; a login cannot dispatch the subsequent API operation after revocation or expiry.
+
+## Client usage
+
+Client configuration contains only the proxy origin and caller capability:
+
+```json
+{
+  "proxyOrigin": "https://proxy.example.invalid:8443",
+  "capability": "OPERATOR_ISSUES_RANDOM_CALLER_CAPABILITY"
+}
+```
+
+```sh
+api-tool request --config ./api-client.json --profile sample --path /v1/items
+api-tool request --config ./api-client.json --profile sample --path /v1/items --query '{"limit":"10"}'
+api-tool request --config ./api-client.json --profile sample --method POST --path /v1/search --body '{"name":"example"}'
+api-tool request --help
+bun run api-tool request --config ./api-client.json --profile sample --path /v1/items
+```
+
+GET is the default policy when `methods` is absent. An operator can explicitly approve `GET`, `POST`, `PUT`, `PATCH`, `DELETE`. GET itself is not evidence that an endpoint has no side effects. The operator approves service semantics and uses provider-side least privilege.
+
+```ts
+import { createApiClient } from "@blogic-cz/agent-tools/api";
+
+const api = createApiClient(clientConfig);
+const result = await api.request({
+  profile: "sample",
+  method: "GET",
+  path: "/v1/items",
+  query: { limit: "10" },
+});
+```
+
+`ApiError` has stable `code`, `message` and safe `hint` fields. Provider bodies, headers, URLs, tokens and underlying exception details never become public errors. Client requests cannot change targets, headers, credentials, methods policy or disclosure rules. Successful responses with an empty body return `data: null`, including 204/205 responses, without retrying the provider operation. The CLI prints JSON and does not add requests or response data to the existing audit log.
+
+## Authentication and disclosure
+
+Supported profile auth shapes:
+
+```json
+{ "kind": "bearer", "secretRef": "token" }
+{ "kind": "apiKey", "header": "x-api-key", "secretRef": "api-key" }
+{ "kind": "basic", "usernameRef": "username", "passwordRef": "password" }
+{ "kind": "login", "path": "/auth/login", "fields": { "username": "username", "password": "password" }, "tokenField": "access_token" }
+```
+
+Login is one configured JSON POST at the exact profile origin. Its fixed fields reference the private store. The response's configured top-level string token becomes a Bearer header inside the proxy. Login output never goes to callers, and the login path and descendants are denied to client requests. Login and API requests share a single deadline; the budget reserves both requests' maximum bytes. Failed login refuses the operation. Unsupported cookie, OAuth browser, multipart and executable authentication flows refuse configuration instead of executing custom code.
+
+Choose `disclosure: { "kind": "fields", "fields": [...] }` to project top-level object fields. Choose `disclosure: { "kind": "raw" }` only when the operator authorizes the service's complete JSON response. Neither mode promises that application data are nonsensitive. Exact stored-secret and minted-token echoes, including JSON-escaped, URI-component, form URL-encoded and base64 variants, refuse disclosure. URL percent escapes match without regard to their hexadecimal letter case; credential letters remain case-sensitive. This does not detect arbitrary transformed secrets or establish universal privacy. At most 128 distinct stored secrets, deterministic Basic credentials and retained auth tokens are allowed per runtime. Pending logins reserve retention slots before dispatch, and reaching the retention bound refuses new logins. Failed exchanges release their slots; a token already known releases its extra reservation without evicting any credential. An aborted exchange keeps its slot until the transport settles, and any valid token it returns is retained before the operation can continue. Tokens are never evicted from echo checks.
+
+## Transport and budgets
+
+The proxy permits only the exact configured HTTPS origin and strict relative paths. It refuses all percent-encoded paths, traversal, semicolons, segments ending with a dot, double slash, query/fragment embedded in paths and absolute URLs. Supply query strings through the `query` object. Prefix checks respect path segment boundaries. Denied and login paths also match without case distinctions to protect services that normalize case. Configure denied auth paths for services with other authentication endpoints.
+
+The transport ignores ambient HTTP proxy variables, creates direct connections, never follows redirects, resolves every DNS answer, refuses unknown/mixed forbidden addresses, and pins the actual socket lookup to a checked address while retaining TLS hostname verification. Private addresses require an exact normalized IP allowance; link-local/cloud metadata and mapped IPv6 addresses are always refused. The public-address classifier is conservative, so some special-use addresses are refused. The public client currently supports a publicly addressed HTTPS proxy or explicit loopback development; it has no private-proxy IP allowance.
+
+Admission synchronously checks cumulative requests, reserved bytes, concurrency, grant expiry and runtime lifetime before I/O. The runtime never refunds failed requests or unused byte reservations. There are finite per-request streamed response and input limits, DNS/request deadlines and server connection limits. At most 64 unresolved DNS operations remain outstanding per trusted transport instance; aborted lookups retain those slots until they settle. Unknown, revoked, expired and lifetime-exhausted capabilities refuse before reading request bodies. Connection and network saturation still require deployment controls. The configuration caps profiles/grants at 100, requests at 10000 per grant, concurrency at 64, request JSON at 1 MB, response JSON at 10 MB, serialized result envelopes at 10 MB, paths at 16,384 ASCII bytes, per-request time at 60 seconds and grant runtime lifetime at 24 hours. Callers implement bounded loops themselves and never pass provider pagination URLs as targets. The 10 MB serialized result-envelope limit includes status and JSON wrapping and is separate from the configured upstream response-body limit. JSON numbers may expand during serialization; a response exceeding the envelope limit refuses with `LIMIT_EXCEEDED` before output. Server request envelopes and network protocol overhead are separately bounded; grant byte accounting covers configured provider payload/path maxima, not total TCP/TLS wire bytes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.6.19",
+  "version": "1.7.0",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",
@@ -20,6 +20,7 @@
     "url": "https://github.com/blogic-cz/agent-tools.git"
   },
   "bin": {
+    "agent-tools-api": "./src/api-tool/index.ts",
     "agent-tools-audit": "./src/audit-tool/index.ts",
     "agent-tools-az": "./src/az-tool/index.ts",
     "agent-tools-azdo": "./src/azdo-tool/index.ts",
@@ -29,6 +30,8 @@
     "agent-tools-logs": "./src/logs-tool/index.ts",
     "agent-tools-observability": "./src/observability-tool/index.ts",
     "agent-tools-session": "./src/session-tool/index.ts",
+    "api-proxy": "./src/api-tool/proxy-entry.ts",
+    "api-tool": "./src/api-tool/index.ts",
     "audit-tool": "./src/audit-tool/index.ts",
     "az-tool": "./src/az-tool/index.ts",
     "azdo-tool": "./src/azdo-tool/index.ts",
@@ -43,6 +46,7 @@
     "dist/",
     "src/",
     "schemas/",
+    "docs/rest-api-proxy.md",
     "README.md",
     "LICENSE"
   ],
@@ -100,6 +104,10 @@
     "#session/*": {
       "types": "./dist/session-tool/*.d.ts",
       "default": "./src/session-tool/*.ts"
+    },
+    "#api/*": {
+      "types": "./dist/api-tool/*.d.ts",
+      "default": "./src/api-tool/*.ts"
     }
   },
   "exports": {
@@ -126,6 +134,10 @@
     "./prerequisites": {
       "types": "./dist/shared/prerequisites/index.d.ts",
       "default": "./src/shared/prerequisites/index.ts"
+    },
+    "./api": {
+      "types": "./dist/api-tool/client.d.ts",
+      "default": "./src/api-tool/client.ts"
     }
   },
   "publishConfig": {
@@ -145,7 +157,9 @@
     "session-tool": "bun src/session-tool/index.ts",
     "update:packages": "bun update -i -r",
     "update:skills": "bun run .agents/skills/update-packages/references/skills-update-local.ts",
-    "test": "vitest run"
+    "test": "vitest run",
+    "api-tool": "bun src/api-tool/index.ts",
+    "api-proxy": "bun src/api-tool/proxy-entry.ts"
   },
   "dependencies": {
     "@effect/platform-bun": "4.0.0-rc.117",

package/src/api-tool/client.ts

@@ -0,0 +1,56 @@
+import {
+  ClientSchema,
+  decode,
+  originUrl,
+  RequestSchema,
+  ResultSchema,
+  MAX_RESULT_ENVELOPE_BYTES,
+} from "./types";
+import type { ApiRequest, ApiResult, ClientConfig } from "./types";
+import { apiError, ErrorCode, safeError } from "./errors";
+import { pinnedTransport } from "./transport";
+import type { Transport } from "./transport";
+import { Schema } from "effect";
+
+export function createApiClient(value: ClientConfig, transport: Transport = pinnedTransport) {
+  const config = decode(ClientSchema, value);
+  originUrl(config.proxyOrigin, config.developmentLoopback);
+  if (!/^[A-Za-z0-9_-]{32,256}$/.test(config.capability)) throw apiError("CONFIG_INVALID");
+  return {
+    request: async (input: ApiRequest): Promise<ApiResult> => {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 65000);
+      try {
+        const request = decode(RequestSchema, input);
+        const body = JSON.stringify(request);
+        if (Buffer.byteLength(body) > 1_000_000) throw apiError("LIMIT_EXCEEDED");
+        const response = await transport({
+          url: new URL("/request", config.proxyOrigin),
+          method: "POST",
+          headers: {
+            authorization: `Bearer ${config.capability}`,
+            "content-type": "application/json",
+          },
+          body,
+          maxBytes: MAX_RESULT_ENVELOPE_BYTES,
+          signal: controller.signal,
+          allowedPrivateAddresses: [],
+          developmentLoopback: config.developmentLoopback,
+        });
+        if (Buffer.byteLength(response.body) > MAX_RESULT_ENVELOPE_BYTES)
+          throw apiError("LIMIT_EXCEEDED");
+        if (response.status !== 200) {
+          const parsed = decode(Schema.Struct({ code: ErrorCode }), JSON.parse(response.body));
+          throw apiError(parsed.code);
+        }
+        return decode(ResultSchema, JSON.parse(response.body));
+      } catch (error) {
+        throw safeError(error);
+      } finally {
+        clearTimeout(timer);
+      }
+    },
+  };
+}
+export type { ApiRequest, ApiResult, ClientConfig } from "./types";
+export { ApiError } from "./errors";