@cef-ai/cli 0.2.7 → 0.4.0

package/dist/lib/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/lib/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA+B7B,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,sBAAsB,GAAG;;;;;;;;;;;;kFAYmD,CAAC;AAEnF,MAAM,UAAU,0BAA0B;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,MAAM,GAAG,mBAAmB,CAAC;AAEnC,SAAS,eAAe,CAAC,GAAW,EAAE,GAAW;IAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CACxB,GAAG,GAAG,iDAAiD,GAAG,CAAC,MAAM,QAAQ,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,GAAW;IAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CACxB,GAAG,GAAG,+DAA+D,GAAG,CAAC,MAAM,QAAQ,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAOD,KAAK,UAAU,gBAAgB,CAC7B,QAAgB,EAChB,GAAW;IAEX,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CACxB,GAAG,GAAG,KAAK,QAAQ,uBAAwB,CAAW,CAAC,OAAO,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM;QACP,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAQ,MAA4B,CAAC,MAAM,KAAK,QAAQ;QACxD,OAAQ,MAA4B,CAAC,OAAO,KAAK,QAAQ,EACzD,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,GAAG,GAAG,KAAK,QAAQ,uCAAuC,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,MAA2B,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAClB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC3D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACrC,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,gBAAgB,CACxB,oCAAoC,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,gBAAgB,CACxB,uCAAuC,CAAC,GAAG,CAAC,EAAE,CAC/C,CAAC;QACJ,CAAC;QACD,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA4C;IAE5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA+B;IAE/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEpC,mEAAmE;IACnE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACpE,MAAM,IAAI,gBAAgB,CACxB,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC;YACpD,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC;YACvD,MAAM,EAAE,OAAO;SAChB,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,MAAM,OAAO,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,gBAAgB,CACxB,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,mBAAmB,CAAC;YACpD,YAAY,EAAE,UAAU,CAAC,OAAO,EAAE,oBAAoB,CAAC;YACvD,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,qBAAqB;IACrB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CACjC,IAAI,CAAC,YAAY,EACjB,YAAY,CACb,CAAC;QACF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAgB,CACxB,eAAe,IAAI,CAAC,YAAY,iBAAiB,CAClD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC;YACvD,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC;YACzD,MAAM,EAAE,eAAe;SACxB,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,MAAM,WAAW,GAAG,GAAG,CAAC,eAAe,CAAC;IACxC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACpE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,WAAW,iBAAiB,CACjD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;YACjD,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;YACnD,MAAM,EAAE,cAAc;SACvB,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,6DAA6D;IAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,0BAA0B,EAAE,CAAC;IAC3E,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,SAAS,CAAC;IACnD,MAAM,eAAe,GACnB,IAAI,CAAC,WAAW,KAAK,SAAS;QAC9B,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEhE,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACjD,OAAO;gBACL,MAAM,EAAE,eAAe,CACrB,OAAO,CAAC,MAAM,EACd,GAAG,cAAc,KAAK,WAAW,GAAG,CACrC;gBACD,YAAY,EAAE,UAAU,CACtB,OAAO,CAAC,OAAO,EACf,GAAG,cAAc,KAAK,WAAW,GAAG,CACrC;gBACD,MAAM,EAAE,gBAAgB;gBACxB,WAAW;aACZ,CAAC;QACJ,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,IAAI,gBAAgB,CACxB,cAAc,WAAW,iBAAiB,cAAc,EAAE,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,eAAe,EAAE,CAAC;QAC3B,MAAM,IAAI,gBAAgB,CACxB,+BAA+B,cAAc,iBAAiB,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;AACrD,CAAC"}

package/dist/lib/jcs.d.ts

@@ -0,0 +1,3 @@
+export declare function canonicalize(value: unknown): string;
+export declare function canonicalizeBytes(value: unknown): Uint8Array;
+//# sourceMappingURL=jcs.d.ts.map

package/dist/lib/jcs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jcs.d.ts","sourceRoot":"","sources":["../../src/lib/jcs.ts"],"names":[],"mappings":"AAeA,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOnD;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAE5D"}

package/dist/lib/jcs.js

@@ -0,0 +1,48 @@
+/**
+ * RFC 8785 JSON Canonicalization Scheme (JCS).
+ *
+ * Thin wrapper over the `canonicalize` npm package — the same library the
+ * marketplace API uses. Re-exposed here as `canonicalize()` returning a
+ * string (and `canonicalizeBytes()` returning the UTF-8 bytes that get
+ * signed / hashed) so call sites in `cef publish` mirror the marketplace's
+ * `lib/jcs.ts` one-to-one.
+ *
+ * RFC 8785 leaves the encoding of non-finite numbers / BigInt undefined; we
+ * reject them up front rather than rely on the package's silent coercion,
+ * matching the marketplace's behaviour.
+ */
+import canonicalizePkg from "canonicalize";
+export function canonicalize(value) {
+    assertJcsCompatible(value);
+    const out = canonicalizePkg(value);
+    if (out === undefined) {
+        throw new TypeError("JCS: canonicalize() returned undefined");
+    }
+    return out;
+}
+export function canonicalizeBytes(value) {
+    return new TextEncoder().encode(canonicalize(value));
+}
+function assertJcsCompatible(value) {
+    if (typeof value === "number") {
+        if (!Number.isFinite(value)) {
+            throw new TypeError(`JCS: non-finite number ${String(value)}`);
+        }
+        return;
+    }
+    if (typeof value === "bigint") {
+        throw new TypeError("JCS: bigint not supported by RFC 8785");
+    }
+    if (Array.isArray(value)) {
+        for (const item of value)
+            assertJcsCompatible(item);
+        return;
+    }
+    if (value !== null && typeof value === "object") {
+        for (const v of Object.values(value)) {
+            if (v !== undefined)
+                assertJcsCompatible(v);
+        }
+    }
+}
+//# sourceMappingURL=jcs.js.map

package/dist/lib/jcs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jcs.js","sourceRoot":"","sources":["../../src/lib/jcs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,eAAe,MAAM,cAAc,CAAC;AAE3C,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,SAAS,CAAC,0BAA0B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,KAAK,SAAS;gBAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib/signing.d.ts

@@ -0,0 +1,13 @@
+export interface Ed25519Keypair {
+    /** Hex-encoded public key (32-byte Ed25519 pubkey, lowercase, no prefix). */
+    pubkey: string;
+    /** Raw 32-byte private seed. */
+    privkeyBytes: Uint8Array;
+}
+export declare function generateKeypair(): Promise<Ed25519Keypair>;
+/**
+ * Sign the UTF-8 bytes of `canonicalJson` with `privkeyBytes`. Returns
+ * lowercase-hex signature (64 bytes → 128 hex chars).
+ */
+export declare function signBody(canonicalJson: string, privkeyBytes: Uint8Array): Promise<string>;
+//# sourceMappingURL=signing.d.ts.map

package/dist/lib/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/lib/signing.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,YAAY,EAAE,UAAU,CAAC;CAC1B;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,cAAc,CAAC,CAI/D;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,UAAU,GACvB,OAAO,CAAC,MAAM,CAAC,CAIjB"}

package/dist/lib/signing.js

@@ -0,0 +1,34 @@
+/**
+ * Ed25519 keypair generation + body signing for `cef publish`. Produces the
+ * lowercase-hex pubkey + signature pair that the marketplace's
+ * `X-AS-Pubkey` / `X-AS-Signature` headers expect (raw hex, no `0x` prefix,
+ * no encoding wrapper).
+ *
+ * Mirrors the marketplace's `lib/signing/sign.ts`. Signing input is the
+ * UTF-8 bytes of the JCS-canonical body — callers are expected to pass the
+ * exact string they place in the HTTP request body, so the signature
+ * covers byte-for-byte what the server will re-canonicalize and verify.
+ */
+import * as ed25519 from "@noble/ed25519";
+function bytesToHex(b) {
+    let s = "";
+    for (let i = 0; i < b.length; i++) {
+        s += b[i].toString(16).padStart(2, "0");
+    }
+    return s;
+}
+export async function generateKeypair() {
+    const privkeyBytes = ed25519.utils.randomPrivateKey();
+    const pubkeyBytes = await ed25519.getPublicKeyAsync(privkeyBytes);
+    return { pubkey: bytesToHex(pubkeyBytes), privkeyBytes };
+}
+/**
+ * Sign the UTF-8 bytes of `canonicalJson` with `privkeyBytes`. Returns
+ * lowercase-hex signature (64 bytes → 128 hex chars).
+ */
+export async function signBody(canonicalJson, privkeyBytes) {
+    const message = new TextEncoder().encode(canonicalJson);
+    const sig = await ed25519.signAsync(message, privkeyBytes);
+    return bytesToHex(sig);
+}
+//# sourceMappingURL=signing.js.map

package/dist/lib/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/lib/signing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE1C,SAAS,UAAU,CAAC,CAAa;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,CAAC,IAAK,CAAC,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,aAAqB,EACrB,YAAwB;IAExB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC"}

package/dist/lib.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Programmatic API for `@cef-ai/cli`. Other packages and tests can import the
+ * underlying command functions directly without going through the CLI
+ * binary. The CLI entry point (`./cli.ts`) wires these into commander.
+ */
+export { cefBuild } from "./commands/build.js";
+export type { CefBuildOptions, CefBuildResult } from "./commands/build.js";
+export { cefTypegen } from "./commands/typegen.js";
+export type { CefTypegenOptions, CefTypegenResult, } from "./commands/typegen.js";
+export { cefInspect } from "./commands/inspect.js";
+export type { CefInspectOptions, CefInspectResult } from "./commands/inspect.js";
+export { cefPublish } from "./commands/publish.js";
+export type { CefPublishOptions, CefPublishResult, } from "./commands/publish.js";
+export { cefKeypairGenerate } from "./commands/keypair.js";
+export type { CefKeypairGenerateOptions, CefKeypairGenerateResult, } from "./commands/keypair.js";
+export { resolveCredentials, CredentialsError, defaultCredentialsFilePath, } from "./lib/credentials.js";
+export type { AsCredentials, CredentialSource, ResolveCredentialsOptions, } from "./lib/credentials.js";
+//# sourceMappingURL=lib.d.ts.map

package/dist/lib.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EACV,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EACV,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EACV,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC"}

package/dist/lib.js

@@ -0,0 +1,12 @@
+/**
+ * Programmatic API for `@cef-ai/cli`. Other packages and tests can import the
+ * underlying command functions directly without going through the CLI
+ * binary. The CLI entry point (`./cli.ts`) wires these into commander.
+ */
+export { cefBuild } from "./commands/build.js";
+export { cefTypegen } from "./commands/typegen.js";
+export { cefInspect } from "./commands/inspect.js";
+export { cefPublish } from "./commands/publish.js";
+export { cefKeypairGenerate } from "./commands/keypair.js";
+export { resolveCredentials, CredentialsError, defaultCredentialsFilePath, } from "./lib/credentials.js";
+//# sourceMappingURL=lib.js.map

package/dist/lib.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAG/C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAMnD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAMnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAM3D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC"}

package/dist/typegen/augment.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Parsed slice of `model.json` we care about. Per `agent-sdk.md` §5 a model
+ * spec also carries `name` / `version` etc., but for typegen we only need
+ * the I/O schemas.
+ */
+export interface ModelSpec {
+    /** Alias under which the agent declares this model in `cef.config.ts`. */
+    alias: string;
+    input: unknown;
+    output: unknown;
+}
+/**
+ * Parsed slice of a peer agent's `manifest.json`. Per the contract §2.1 a
+ * peer's `publishes[]` is what *consumers* react to, so those become the
+ * payload types in `KnownEventTypes`. (`handles[]` would feed the inverse
+ * relationship — payload types for `ctx.publish(toPeer, ...)` — which we
+ * defer to a later iteration.)
+ */
+export interface PeerSpec {
+    /** Alias under which the agent declares this peer in `cef.config.ts`. */
+    alias: string;
+    publishes: Array<{
+        type: string;
+        schema?: unknown;
+    }>;
+}
+/**
+ * Convert a snake_case / kebab-case / mixed identifier into PascalCase.
+ *
+ * Used for two things:
+ *  - model alias → `ChatInput` / `ChatOutput` interface names
+ *  - event type  → `ResearchComplete` payload interface names
+ *
+ * We strip non-alphanumeric runs and uppercase the first letter of each
+ * remaining segment. Leading digits get a `_` prefix so the result is a
+ * valid TS identifier.
+ */
+export declare function pascalCase(s: string): string;
+/**
+ * Build the full `.cef/generated.d.ts` content from the fetched model and
+ * peer specs.
+ *
+ * Output structure:
+ *  1. Banner.
+ *  2. `export interface <Alias>Input { ... }` / `<Alias>Output { ... }`
+ *     per model.
+ *  3. `export interface <PascalCasedEventType> { ... }` per peer-published
+ *     event that carries a JSON schema.
+ *  4. `declare module "@cef-ai/agent-sdk"` block augmenting `KnownEventTypes`
+ *     with `"<event_type>": <PascalCasedEventType>` entries.
+ *
+ * Models augmentation (so `ctx.models[alias]` becomes typed) is intentionally
+ * deferred to a follow-up — the agent-sdk surface for that needs a
+ * `KnownModels` map analogous to `KnownEventTypes`, which doesn't exist yet.
+ */
+export declare function buildGeneratedDts(models: ModelSpec[], peers: PeerSpec[]): Promise<string>;
+//# sourceMappingURL=augment.d.ts.map

package/dist/typegen/augment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"augment.d.ts","sourceRoot":"","sources":["../../src/typegen/augment.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtD;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAO5C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EAAE,EACnB,KAAK,EAAE,QAAQ,EAAE,GAChB,OAAO,CAAC,MAAM,CAAC,CAiDjB"}

package/dist/typegen/augment.js

@@ -0,0 +1,87 @@
+import { schemaToTsInterface } from "./schema-to-ts.js";
+const HEADER = `// Auto-generated by \`cef typegen\` — do not edit.
+// To regenerate: run \`cef typegen\`.
+`;
+/**
+ * Convert a snake_case / kebab-case / mixed identifier into PascalCase.
+ *
+ * Used for two things:
+ *  - model alias → `ChatInput` / `ChatOutput` interface names
+ *  - event type  → `ResearchComplete` payload interface names
+ *
+ * We strip non-alphanumeric runs and uppercase the first letter of each
+ * remaining segment. Leading digits get a `_` prefix so the result is a
+ * valid TS identifier.
+ */
+export function pascalCase(s) {
+    const parts = s.split(/[^A-Za-z0-9]+/).filter(Boolean);
+    if (parts.length === 0)
+        return "_";
+    const joined = parts
+        .map((p) => p.charAt(0).toUpperCase() + p.slice(1))
+        .join("");
+    return /^[0-9]/.test(joined) ? "_" + joined : joined;
+}
+/**
+ * Build the full `.cef/generated.d.ts` content from the fetched model and
+ * peer specs.
+ *
+ * Output structure:
+ *  1. Banner.
+ *  2. `export interface <Alias>Input { ... }` / `<Alias>Output { ... }`
+ *     per model.
+ *  3. `export interface <PascalCasedEventType> { ... }` per peer-published
+ *     event that carries a JSON schema.
+ *  4. `declare module "@cef-ai/agent-sdk"` block augmenting `KnownEventTypes`
+ *     with `"<event_type>": <PascalCasedEventType>` entries.
+ *
+ * Models augmentation (so `ctx.models[alias]` becomes typed) is intentionally
+ * deferred to a follow-up — the agent-sdk surface for that needs a
+ * `KnownModels` map analogous to `KnownEventTypes`, which doesn't exist yet.
+ */
+export async function buildGeneratedDts(models, peers) {
+    const sections = [HEADER];
+    // 1. Per-model I/O interfaces.
+    if (models.length > 0) {
+        sections.push("// ---- Models ----");
+        for (const m of models) {
+            const base = pascalCase(m.alias);
+            const inputTs = await schemaToTsInterface(`${base}Input`, m.input);
+            const outputTs = await schemaToTsInterface(`${base}Output`, m.output);
+            sections.push(inputTs);
+            sections.push(outputTs);
+        }
+    }
+    // 2. Per-peer-event payload interfaces + collect KnownEventTypes entries.
+    const knownEvents = [];
+    if (peers.length > 0) {
+        sections.push("// ---- Peer events ----");
+        for (const p of peers) {
+            for (const pub of p.publishes) {
+                const tsName = pascalCase(pub.type);
+                if (pub.schema) {
+                    const ts = await schemaToTsInterface(tsName, pub.schema);
+                    sections.push(ts);
+                }
+                else {
+                    // No schema → fall back to `unknown` payload.
+                    sections.push(`export type ${tsName} = unknown;`);
+                }
+                knownEvents.push({ eventType: pub.type, tsName });
+            }
+        }
+    }
+    // 3. Module augmentation block.
+    if (knownEvents.length > 0) {
+        const lines = knownEvents
+            .map(({ eventType, tsName }) => `    ${JSON.stringify(eventType)}: ${tsName};`)
+            .join("\n");
+        sections.push(`declare module "@cef-ai/agent-sdk" {
+  interface KnownEventTypes {
+${lines}
+  }
+}`);
+    }
+    return sections.join("\n\n") + "\n";
+}
+//# sourceMappingURL=augment.js.map

package/dist/typegen/augment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"augment.js","sourceRoot":"","sources":["../../src/typegen/augment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AA2BxD,MAAM,MAAM,GAAG;;CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAmB,EACnB,KAAiB;IAEjB,MAAM,QAAQ,GAAa,CAAC,MAAM,CAAC,CAAC;IAEpC,+BAA+B;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YACtE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,WAAW,GAAiD,EAAE,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;oBACf,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;oBACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpB,CAAC;qBAAM,CAAC;oBACN,8CAA8C;oBAC9C,QAAQ,CAAC,IAAI,CAAC,eAAe,MAAM,aAAa,CAAC,CAAC;gBACpD,CAAC;gBACD,WAAW,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,WAAW;aACtB,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,MAAM,GAAG,CAAC;aAC9E,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CACX;;EAEJ,KAAK;;EAEL,CACG,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;AACtC,CAAC"}

package/dist/typegen/fetch.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Result of a single typegen fetch. The body is kept verbatim so the
+ * caller can hash exactly what came over the wire (we use the raw bytes
+ * for the lockfile integrity field — re-stringifying after parse would
+ * be lossy and order-sensitive).
+ */
+export interface FetchResult {
+    /** Raw response body as text. */
+    body: string;
+    /** `JSON.parse(body)` result. */
+    parsed: unknown;
+    /** Final URL after redirects (Node's `fetch` exposes this on `Response.url`). */
+    resolvedUrl: string;
+    /** `sha256-<base64(sha256(body))>` integrity tag — matches lockfile §C.5 form. */
+    integrity: string;
+}
+/**
+ * GET `<baseUrl>/<suffix>` and validate the response. Used by `cef typegen`
+ * to fetch model and peer-agent manifests declared in `cef.config.ts`.
+ *
+ * - Redirects are followed transparently (Node's built-in `fetch` does this
+ *   by default with `redirect: "follow"`).
+ * - Content-Type is required to include `json` — anything else (HTML
+ *   error page, plain text) is treated as a typegen failure rather than
+ *   blindly trying to JSON.parse the bytes.
+ * - Non-2xx status codes throw with a `[cef typegen] fetch <url> → <status>`
+ *   message so the CLI surfaces the failing URL to the author.
+ */
+export declare function fetchJson(baseUrl: string, suffix: "model.json" | "manifest.json"): Promise<FetchResult>;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/typegen/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/typegen/fetch.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,YAAY,GAAG,eAAe,GACrC,OAAO,CAAC,WAAW,CAAC,CA+BtB"}

package/dist/typegen/fetch.js

@@ -0,0 +1,38 @@
+import crypto from "node:crypto";
+/**
+ * GET `<baseUrl>/<suffix>` and validate the response. Used by `cef typegen`
+ * to fetch model and peer-agent manifests declared in `cef.config.ts`.
+ *
+ * - Redirects are followed transparently (Node's built-in `fetch` does this
+ *   by default with `redirect: "follow"`).
+ * - Content-Type is required to include `json` — anything else (HTML
+ *   error page, plain text) is treated as a typegen failure rather than
+ *   blindly trying to JSON.parse the bytes.
+ * - Non-2xx status codes throw with a `[cef typegen] fetch <url> → <status>`
+ *   message so the CLI surfaces the failing URL to the author.
+ */
+export async function fetchJson(baseUrl, suffix) {
+    // `new URL(rel, base)` requires the base to end with `/` for the path to
+    // be appended rather than replacing the last segment.
+    const baseWithSlash = baseUrl.endsWith("/") ? baseUrl : baseUrl + "/";
+    const url = new URL(suffix, baseWithSlash).href;
+    const res = await fetch(url, { redirect: "follow" });
+    if (!res.ok) {
+        throw new Error(`[cef typegen] fetch ${url} → ${res.status}`);
+    }
+    const ct = res.headers.get("content-type") ?? "";
+    if (!ct.toLowerCase().includes("json")) {
+        throw new Error(`[cef typegen] fetch ${url} → non-JSON content-type "${ct}"`);
+    }
+    const body = await res.text();
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch (err) {
+        throw new Error(`[cef typegen] fetch ${url} → invalid JSON: ${err.message}`);
+    }
+    const integrity = "sha256-" + crypto.createHash("sha256").update(body).digest("base64");
+    return { body, parsed, resolvedUrl: res.url, integrity };
+}
+//# sourceMappingURL=fetch.js.map

package/dist/typegen/fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../src/typegen/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAmBjC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAe,EACf,MAAsC;IAEtC,yEAAyE;IACzE,sDAAsD;IACtD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC;IAEhD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,6BAA6B,EAAE,GAAG,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,oBAAqB,GAAa,CAAC,OAAO,EAAE,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAExE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;AAC3D,CAAC"}

package/dist/typegen/lockfile.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `cef.lock.json` schema, version 1.
+ *
+ * Modelled after the lockfile shape sketched in the SDK proposal: every
+ * fetched artefact (model spec, peer manifest) gets one entry keyed by the
+ * alias the user gave it in `cef.config.ts`. The entry records both the
+ * declared URL (which may carry a semver range like `agent@^1`) and the
+ * post-resolution / post-redirect URL the runtime should pin to.
+ *
+ * `integrity` is `sha256-<base64>` over the raw fetched bytes — same form
+ * Subresource Integrity uses, so existing tooling can validate it.
+ */
+export interface CefLockfile {
+    version: 1;
+    models: Record<string, LockEntry>;
+    uses: Record<string, LockEntry>;
+}
+export interface LockEntry {
+    /** URL exactly as declared in `cef.config.ts`. */
+    url: string;
+    /** Post-redirect / post-semver-resolution URL. */
+    resolvedUrl: string;
+    /** `sha256-<base64>` of the fetched body. */
+    integrity: string;
+    /** ISO 8601 timestamp at which the artefact was fetched. */
+    fetchedAt: string;
+}
+/**
+ * Read a lockfile from disk. Returns `null` if the file does not exist
+ * (first run) or fails to parse (corrupt — caller decides whether to
+ * regenerate or surface). The `version` field is verified; future format
+ * bumps will live behind explicit migration code rather than silently
+ * accepting older shapes.
+ */
+export declare function readLockfile(path: string): Promise<CefLockfile | null>;
+/**
+ * Write the lockfile as pretty-printed, key-sorted JSON with a trailing
+ * newline. Sorted keys keep diffs stable across runs even when the
+ * iteration order of `models` / `uses` differs.
+ */
+export declare function writeLockfile(path: string, lock: CefLockfile): Promise<void>;
+//# sourceMappingURL=lockfile.d.ts.map

package/dist/typegen/lockfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/typegen/lockfile.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,SAAS;IACxB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAsB5E;AAeD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/typegen/lockfile.js

@@ -0,0 +1,58 @@
+import fs from "node:fs/promises";
+/**
+ * Read a lockfile from disk. Returns `null` if the file does not exist
+ * (first run) or fails to parse (corrupt — caller decides whether to
+ * regenerate or surface). The `version` field is verified; future format
+ * bumps will live behind explicit migration code rather than silently
+ * accepting older shapes.
+ */
+export async function readLockfile(path) {
+    let raw;
+    try {
+        raw = await fs.readFile(path, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed ||
+        typeof parsed !== "object" ||
+        parsed.version !== 1) {
+        return null;
+    }
+    return parsed;
+}
+/**
+ * Sort an object's keys for stable JSON output. We do this recursively for
+ * `models` / `uses` records so a re-run with no changes produces a
+ * byte-identical lockfile (good for diffs and content-addressing).
+ */
+function sortKeys(obj) {
+    const sorted = {};
+    for (const k of Object.keys(obj).sort()) {
+        sorted[k] = obj[k];
+    }
+    return sorted;
+}
+/**
+ * Write the lockfile as pretty-printed, key-sorted JSON with a trailing
+ * newline. Sorted keys keep diffs stable across runs even when the
+ * iteration order of `models` / `uses` differs.
+ */
+export async function writeLockfile(path, lock) {
+    const out = {
+        version: 1,
+        models: sortKeys(lock.models),
+        uses: sortKeys(lock.uses),
+    };
+    await fs.writeFile(path, JSON.stringify(out, null, 2) + "\n", "utf8");
+}
+//# sourceMappingURL=lockfile.js.map

package/dist/typegen/lockfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.js","sourceRoot":"","sources":["../../src/typegen/lockfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AA+BlC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,CAAC,MAAM;QACP,OAAO,MAAM,KAAK,QAAQ;QACzB,MAAgC,CAAC,OAAO,KAAK,CAAC,EAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAqB,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAoC,GAAM;IACzD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,IAAiB;IAEjB,MAAM,GAAG,GAAgB;QACvB,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7B,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;KAC1B,CAAC;IACF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACxE,CAAC"}

package/dist/typegen/schema-to-ts.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Compile a JSON Schema into a TypeScript interface declaration string.
+ *
+ * Wraps `json-schema-to-typescript`'s `compile` with the defaults the rest
+ * of the CLI assumes:
+ *
+ * - `bannerComment: ""` — we add our own banner once at the top of the
+ *   generated file rather than per interface.
+ * - `additionalProperties: false` — typegen output should be strict by
+ *   default; if a schema permits extra properties it can declare them
+ *   itself with `additionalProperties: true`.
+ * - `format: false` — we already format the assembled output once at the
+ *   end of `buildGeneratedDts`, so per-interface prettier passes are wasted
+ *   work (and a perf cost on big schemas).
+ *
+ * Returns the raw output string (one or more `export interface` blocks,
+ * potentially with helper aliases for nested objects). Callers concatenate
+ * the returned strings into the final `.cef/generated.d.ts` body.
+ */
+export declare function schemaToTsInterface(name: string, schema: unknown): Promise<string>;
+//# sourceMappingURL=schema-to-ts.d.ts.map

package/dist/typegen/schema-to-ts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-to-ts.d.ts","sourceRoot":"","sources":["../../src/typegen/schema-to-ts.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,MAAM,CAAC,CAOjB"}

package/dist/typegen/schema-to-ts.js

@@ -0,0 +1,29 @@
+import { compile } from "json-schema-to-typescript";
+/**
+ * Compile a JSON Schema into a TypeScript interface declaration string.
+ *
+ * Wraps `json-schema-to-typescript`'s `compile` with the defaults the rest
+ * of the CLI assumes:
+ *
+ * - `bannerComment: ""` — we add our own banner once at the top of the
+ *   generated file rather than per interface.
+ * - `additionalProperties: false` — typegen output should be strict by
+ *   default; if a schema permits extra properties it can declare them
+ *   itself with `additionalProperties: true`.
+ * - `format: false` — we already format the assembled output once at the
+ *   end of `buildGeneratedDts`, so per-interface prettier passes are wasted
+ *   work (and a perf cost on big schemas).
+ *
+ * Returns the raw output string (one or more `export interface` blocks,
+ * potentially with helper aliases for nested objects). Callers concatenate
+ * the returned strings into the final `.cef/generated.d.ts` body.
+ */
+export async function schemaToTsInterface(name, schema) {
+    const out = await compile(schema, name, {
+        bannerComment: "",
+        additionalProperties: false,
+        format: false,
+    });
+    return out.trim();
+}
+//# sourceMappingURL=schema-to-ts.js.map

package/dist/typegen/schema-to-ts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-to-ts.js","sourceRoot":"","sources":["../../src/typegen/schema-to-ts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAmB,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,MAAe;IAEf,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAoB,EAAE,IAAI,EAAE;QACpD,aAAa,EAAE,EAAE;QACjB,oBAAoB,EAAE,KAAK;QAC3B,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC"}