@cef-ai/cli 0.3.0 → 0.4.1

package/dist/cli-program.d.ts

@@ -0,0 +1,14 @@
+import { Command } from "commander";
+export declare const DEFAULT_MARKETPLACE_URL = "https://agent-marketplace.compute.dev.ddcdragon.com";
+export interface BuildProgramOptions {
+    /** Optional fetch override threaded into `cef publish`. Tests use this. */
+    fetchImpl?: typeof fetch;
+    /**
+     * How to surface unrecoverable command errors. The bin entry uses the
+     * default (log + process.exit(1)); tests pass a function that throws so
+     * vitest's `await program.parseAsync()` rejects observably.
+     */
+    onError?: (err: unknown) => never;
+}
+export declare function buildProgram(opts?: BuildProgramOptions): Command;
+//# sourceMappingURL=cli-program.d.ts.map

package/dist/cli-program.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-program.d.ts","sourceRoot":"","sources":["../src/cli-program.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,eAAO,MAAM,uBAAuB,wDACmB,CAAC;AAExD,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,KAAK,CAAC;CACnC;AAQD,wBAAgB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CA0MpE"}

package/dist/cli-program.js

@@ -0,0 +1,171 @@
+/**
+ * Commander program factory shared by `./cli.ts` (the bin entry) and the
+ * integration tests. Splitting it out keeps the binary itself a thin
+ * wrapper that just calls `buildProgram().parseAsync(argv)` while letting
+ * tests construct the same wiring without triggering top-level argv
+ * parsing on import.
+ */
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { Command } from "commander";
+import { cefBuild } from "./commands/build.js";
+import { cefInspect } from "./commands/inspect.js";
+import { cefKeypairGenerate } from "./commands/keypair.js";
+import { cefPublish } from "./commands/publish.js";
+import { cefTypegen } from "./commands/typegen.js";
+export const DEFAULT_MARKETPLACE_URL = "https://agent-marketplace.compute.dev.ddcdragon.com";
+function defaultOnError(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(msg);
+    process.exit(1);
+}
+export function buildProgram(opts = {}) {
+    const onError = opts.onError ?? defaultOnError;
+    // dist/cli-program.js → ../package.json (when running compiled).
+    // src/cli-program.ts → ../package.json (when running via vitest in src/).
+    const __dirname = path.dirname(fileURLToPath(import.meta.url));
+    const pkg = JSON.parse(readFileSync(path.join(__dirname, "..", "package.json"), "utf8"));
+    const program = new Command();
+    program
+        .name("cef")
+        .description("CEF agent build & test CLI")
+        .version(pkg.version);
+    program
+        .command("build")
+        .description("Build agent bundle.js + manifest.json")
+        .option("--config <path>", "Path to cef.config.ts")
+        .option("--out <dir>", "Output directory", "dist")
+        .action(async (subOpts) => {
+        try {
+            const result = await cefBuild({
+                configPath: subOpts.config,
+                outDir: subOpts.out,
+            });
+            for (const a of result.agents) {
+                console.log(`[ok] ${a.agentId} -> ${a.bundlePath} (${a.bundleBytes} bytes)`);
+                console.log(`[ok] ${a.agentId} -> ${a.manifestPath}`);
+            }
+        }
+        catch (e) {
+            onError(e);
+        }
+    });
+    program
+        .command("typegen")
+        .description("Generate .cef/generated.d.ts and update cef.lock.json")
+        .option("--config <path>", "Path to cef.config.ts")
+        .action(async (subOpts) => {
+        try {
+            const result = await cefTypegen({ configPath: subOpts.config });
+            console.log(`[ok] ${result.generatedPath}`);
+            console.log(`[ok] ${result.lockfilePath}`);
+        }
+        catch (e) {
+            onError(e);
+        }
+    });
+    program
+        .command("inspect <agentDir>")
+        .description("Inspect a built bundle + manifest")
+        .action(async (agentDir) => {
+        try {
+            const result = await cefInspect({ agentDir });
+            const anyMissing = result.engagements.some((e) => e.missingMethods.length > 0);
+            if (anyMissing)
+                process.exit(2);
+        }
+        catch (e) {
+            onError(e);
+        }
+    });
+    // Stubs — implemented in subsequent milestones.
+    program
+        .command("test")
+        .description("(stub) run agent tests")
+        .action(() => {
+        console.log("cef test: not yet implemented (use vitest directly for now)");
+    });
+    program
+        .command("publish")
+        .description("Publish a built agent's manifest to the marketplace")
+        .option("--marketplace <url>", "Marketplace base URL (overrides $CEF_MARKETPLACE_URL)")
+        .option("--agent <id>", "Which dist/<id>/ to publish (defaults to the only built agent)")
+        .option("--privkey <hex>", "AS private key (hex, 64 chars). Pair with --pubkey.")
+        .option("--pubkey <hex>", "AS public key (hex, 64 chars). Pair with --privkey.")
+        .option("--keystore <path>", "Path to a JSON keystore file `{ pubkey, privkey }`")
+        .option("--profile <name>", "Profile section in ~/.config/cef/credentials (default: 'default')")
+        .option("--out <dir>", "Output directory the build wrote to (defaults to dist)", "dist")
+        .action(async (subOpts) => {
+        try {
+            const marketplaceUrl = subOpts.marketplace ??
+                process.env.CEF_MARKETPLACE_URL ??
+                DEFAULT_MARKETPLACE_URL;
+            const publishOpts = {
+                marketplaceUrl,
+                ...(subOpts.agent !== undefined ? { agentId: subOpts.agent } : {}),
+                ...(subOpts.privkey !== undefined ? { privkey: subOpts.privkey } : {}),
+                ...(subOpts.pubkey !== undefined ? { pubkey: subOpts.pubkey } : {}),
+                ...(subOpts.keystore !== undefined ? { keystore: subOpts.keystore } : {}),
+                ...(subOpts.profile !== undefined ? { profile: subOpts.profile } : {}),
+                ...(subOpts.out !== undefined ? { distDir: subOpts.out } : {}),
+                ...(opts.fetchImpl !== undefined ? { fetchImpl: opts.fetchImpl } : {}),
+            };
+            const result = await cefPublish(publishOpts);
+            console.log(`✓ Published ${result.agentId}@${result.version}`);
+            console.log(`  agentId:     ${result.agentId}`);
+            console.log(`  pubkey:      ${result.pubkey}`);
+            console.log(`  manifestCid: ${result.manifestCid}`);
+        }
+        catch (e) {
+            // CredentialsError carries either a single-line typo message or
+            // the canonical multi-line "no AS credentials configured" guidance
+            // block. Both ship through `onError` unchanged — the default impl
+            // writes to stderr, which is what we want.
+            onError(e);
+        }
+    });
+    const keypair = program
+        .command("keypair")
+        .description("Manage AS Ed25519 keypairs (Agent Service identity)");
+    keypair
+        .command("generate")
+        .description("Generate a new AS keypair (stdout, --out file, or --profile)")
+        .option("--out <path>", "Write the JSON keypair to <path> (mode 0600); refuses existing unless --force")
+        .option("--profile <name>", "Write/merge into ~/.config/cef/credentials under [<name>] (mode 0600)")
+        .option("--force", "Overwrite an existing --out file or --profile section")
+        .action(async (subOpts) => {
+        try {
+            const result = await cefKeypairGenerate({
+                ...(subOpts.out !== undefined ? { out: subOpts.out } : {}),
+                ...(subOpts.profile !== undefined ? { profile: subOpts.profile } : {}),
+                ...(subOpts.force !== undefined ? { force: subOpts.force } : {}),
+            });
+            if (result.path === undefined && result.profile === undefined) {
+                // Default sink: print the JSON to stdout.
+                process.stdout.write(JSON.stringify({ pubkey: result.pubkey, privkey: result.privkey }) +
+                    "\n");
+                return;
+            }
+            const profileSuffix = result.profile
+                ? ` [profile: ${result.profile}]`
+                : "";
+            console.log(`✓ AS keypair written to ${result.path}${profileSuffix}`);
+            console.log(`  Pubkey: ${result.pubkey}`);
+            console.log("  This keypair is your Agent Service identity. Keep the private key safe.");
+            console.log("  To share with your team, hand them the file or sync it through your team's");
+            console.log("  secrets manager — do NOT generate a new one for each developer.");
+        }
+        catch (e) {
+            onError(e);
+        }
+    });
+    program
+        .command("dev")
+        .description("(stub) run dev loop")
+        .action(() => {
+        console.log("cef dev: not yet implemented");
+    });
+    return program;
+}
+//# sourceMappingURL=cli-program.js.map

package/dist/cli-program.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-program.js","sourceRoot":"","sources":["../src/cli-program.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAA0B,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,CAAC,MAAM,uBAAuB,GAClC,qDAAqD,CAAC;AAaxD,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAA4B,EAAE;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC/C,iEAAiE;IACjE,0EAA0E;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAC1C,CAAC;IAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO;SACJ,IAAI,CAAC,KAAK,CAAC;SACX,WAAW,CAAC,4BAA4B,CAAC;SACzC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAExB,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;SAClD,MAAM,CAAC,aAAa,EAAE,kBAAkB,EAAE,MAAM,CAAC;SACjD,MAAM,CAAC,KAAK,EAAE,OAA0C,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;gBAC5B,UAAU,EAAE,OAAO,CAAC,MAAM;gBAC1B,MAAM,EAAE,OAAO,CAAC,GAAG;aACpB,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CACT,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,WAAW,SAAS,CAChE,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,OAA4B,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CACnC,CAAC;YACF,IAAI,UAAU;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,gDAAgD;IAChD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CACL,qBAAqB,EACrB,uDAAuD,CACxD;SACA,MAAM,CACL,cAAc,EACd,gEAAgE,CACjE;SACA,MAAM,CAAC,iBAAiB,EAAE,qDAAqD,CAAC;SAChF,MAAM,CAAC,gBAAgB,EAAE,qDAAqD,CAAC;SAC/E,MAAM,CACL,mBAAmB,EACnB,oDAAoD,CACrD;SACA,MAAM,CACL,kBAAkB,EAClB,mEAAmE,CACpE;SACA,MAAM,CACL,aAAa,EACb,wDAAwD,EACxD,MAAM,CACP;SACA,MAAM,CACL,KAAK,EAAE,OAQN,EAAE,EAAE;QACH,IAAI,CAAC;YACH,MAAM,cAAc,GAClB,OAAO,CAAC,WAAW;gBACnB,OAAO,CAAC,GAAG,CAAC,mBAAmB;gBAC/B,uBAAuB,CAAC;YAC1B,MAAM,WAAW,GAAsB;gBACrC,cAAc;gBACd,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvE,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,gEAAgE;YAChE,mEAAmE;YACnE,kEAAkE;YAClE,2CAA2C;YAC3C,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,qDAAqD,CAAC,CAAC;IAEtE,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,8DAA8D,CAAC;SAC3E,MAAM,CACL,cAAc,EACd,+EAA+E,CAChF;SACA,MAAM,CACL,kBAAkB,EAClB,uEAAuE,CACxE;SACA,MAAM,CAAC,SAAS,EAAE,uDAAuD,CAAC;SAC1E,MAAM,CACL,KAAK,EAAE,OAA4D,EAAE,EAAE;QACrE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;gBACtC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC9D,0CAA0C;gBAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;oBAChE,IAAI,CACP,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO;gBAClC,CAAC,CAAC,cAAc,MAAM,CAAC,OAAO,GAAG;gBACjC,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CACT,2BAA2B,MAAM,CAAC,IAAI,GAAG,aAAa,EAAE,CACzD,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CACT,2EAA2E,CAC5E,CAAC;YACF,OAAO,CAAC,GAAG,CACT,8EAA8E,CAC/E,CAAC;YACF,OAAO,CAAC,GAAG,CACT,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,qBAAqB,CAAC;SAClC,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cli.js

@@ -3,106 +3,21 @@
  * `cef` CLI binary entry point. Wires the programmatic command functions
  * (re-exported from `./lib.ts`) into commander subcommands.
  *
- * Subcommands implemented for v1:
+ * Subcommands implemented:
  *   - build    : bundle agents per cef.config.ts
  *   - typegen  : generate .cef/generated.d.ts + cef.lock.json
  *   - inspect  : print manifest routing + bundle methods for a built agent
+ *   - publish  : sign + POST a built manifest to the marketplace API
  *
  * Stubs (planned for the next phase):
- *   - test, publish, dev
+ *   - test, dev
  */
-import { readFileSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { Command } from "commander";
-import { cefBuild } from "./commands/build.js";
-import { cefInspect } from "./commands/inspect.js";
-import { cefTypegen } from "./commands/typegen.js";
-// dist/cli.js → ../package.json. Read at runtime so `cef --version` always
-// reflects the published package version rather than a hardcoded literal.
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const pkg = JSON.parse(readFileSync(path.join(__dirname, "..", "package.json"), "utf8"));
+import { buildProgram } from "./cli-program.js";
 function fail(err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.error(msg);
     process.exit(1);
 }
-function buildProgram() {
-    const program = new Command();
-    program
-        .name("cef")
-        .description("CEF agent build & test CLI")
-        .version(pkg.version);
-    program
-        .command("build")
-        .description("Build agent bundle.js + manifest.json")
-        .option("--config <path>", "Path to cef.config.ts")
-        .option("--out <dir>", "Output directory", "dist")
-        .action(async (opts) => {
-        try {
-            const result = await cefBuild({
-                configPath: opts.config,
-                outDir: opts.out,
-            });
-            for (const a of result.agents) {
-                console.log(`[ok] ${a.agentId} -> ${a.bundlePath} (${a.bundleBytes} bytes)`);
-                console.log(`[ok] ${a.agentId} -> ${a.manifestPath}`);
-            }
-        }
-        catch (e) {
-            fail(e);
-        }
-    });
-    program
-        .command("typegen")
-        .description("Generate .cef/generated.d.ts and update cef.lock.json")
-        .option("--config <path>", "Path to cef.config.ts")
-        .action(async (opts) => {
-        try {
-            const result = await cefTypegen({ configPath: opts.config });
-            console.log(`[ok] ${result.generatedPath}`);
-            console.log(`[ok] ${result.lockfilePath}`);
-        }
-        catch (e) {
-            fail(e);
-        }
-    });
-    program
-        .command("inspect <agentDir>")
-        .description("Inspect a built bundle + manifest")
-        .action(async (agentDir) => {
-        try {
-            const result = await cefInspect({ agentDir });
-            const anyMissing = result.engagements.some((e) => e.missingMethods.length > 0);
-            if (anyMissing)
-                process.exit(2);
-        }
-        catch (e) {
-            fail(e);
-        }
-    });
-    // Stubs for v1 — implemented in the next phase. They print and exit 0
-    // so a CI step that calls them does not fail (placeholder behaviour).
-    program
-        .command("test")
-        .description("(stub) run agent tests")
-        .action(() => {
-        console.log("cef test: not yet implemented (use vitest directly for now)");
-    });
-    program
-        .command("publish")
-        .description("(stub) publish to marketplace")
-        .action(() => {
-        console.log("cef publish: not yet implemented");
-    });
-    program
-        .command("dev")
-        .description("(stub) run dev loop")
-        .action(() => {
-        console.log("cef dev: not yet implemented");
-    });
-    return program;
-}
 // Top-level await is fine: the package is "type": "module" with
 // "module": "NodeNext" which targets ES2022.
 try {

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAC1C,CAAC;AAEzB,SAAS,IAAI,CAAC,GAAY;IACxB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO;SACJ,IAAI,CAAC,KAAK,CAAC;SACX,WAAW,CAAC,4BAA4B,CAAC;SACzC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAExB,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;SAClD,MAAM,CAAC,aAAa,EAAE,kBAAkB,EAAE,MAAM,CAAC;SACjD,MAAM,CAAC,KAAK,EAAE,IAAuC,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;gBAC5B,UAAU,EAAE,IAAI,CAAC,MAAM;gBACvB,MAAM,EAAE,IAAI,CAAC,GAAG;aACjB,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CACT,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,WAAW,SAAS,CAChE,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,IAAyB,EAAE,EAAE;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CACnC,CAAC;YACF,IAAI,UAAU;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,sEAAsE;IACtE,sEAAsE;IACtE,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IACL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IACL,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,qBAAqB,CAAC;SAClC,MAAM,CAAC,GAAG,EAAE;QACX,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gEAAgE;AAChE,6CAA6C;AAC7C,IAAI,CAAC;IACH,MAAM,YAAY,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAAC,OAAO,CAAC,EAAE,CAAC;IACX,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,SAAS,IAAI,CAAC,GAAY;IACxB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,gEAAgE;AAChE,6CAA6C;AAC7C,IAAI,CAAC;IACH,MAAM,YAAY,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAAC,OAAO,CAAC,EAAE,CAAC;IACX,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC"}

package/dist/commands/keypair.d.ts

@@ -0,0 +1,21 @@
+export interface CefKeypairGenerateOptions {
+    /** Write the JSON keypair to this path. Mutually exclusive with `profile`. */
+    out?: string;
+    /** Write/merge into the shared credentials file under this section. */
+    profile?: string;
+    /** Allow overwriting an existing file or profile. */
+    force?: boolean;
+    /** Override the credentials file path (tests). */
+    configFilePath?: string;
+}
+export interface CefKeypairGenerateResult {
+    pubkey: string;
+    /** Hex-encoded private seed. */
+    privkey: string;
+    /** File path written, when `out` or `profile` was set. */
+    path?: string;
+    /** Profile name written, when `profile` was set. */
+    profile?: string;
+}
+export declare function cefKeypairGenerate(opts?: CefKeypairGenerateOptions): Promise<CefKeypairGenerateResult>;
+//# sourceMappingURL=keypair.d.ts.map

package/dist/commands/keypair.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keypair.d.ts","sourceRoot":"","sources":["../../src/commands/keypair.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,yBAAyB;IACxC,8EAA8E;IAC9E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAiCD,wBAAsB,kBAAkB,CACtC,IAAI,GAAE,yBAA8B,GACnC,OAAO,CAAC,wBAAwB,CAAC,CA8CnC"}

package/dist/commands/keypair.js

@@ -0,0 +1,91 @@
+/**
+ * `cef keypair generate` — explicit AS Ed25519 keypair provisioning.
+ *
+ * The AS keypair represents an Agent Service identity, potentially shared
+ * across a team. This command is the *only* place a keypair is materialised;
+ * `cef publish` never auto-generates. Output sinks:
+ *
+ *   - stdout (default): JSON `{ pubkey, privkey }`. Useful for `| pbcopy` or
+ *     piping into a secrets manager.
+ *   - `--out <path>`: writes the JSON to a file with mode 0600. Refuses
+ *     existing files unless `--force`.
+ *   - `--profile <name>`: writes/merges into the shared
+ *     `~/.config/cef/credentials` INI file, mode 0600. Refuses to overwrite
+ *     an existing profile unless `--force`. Atomic via temp + rename.
+ *
+ * The post-write banner reminds the developer this is identity material
+ * meant to be shared with their team, not generated per-developer.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { defaultCredentialsFilePath, parseConfigFile, serializeConfigFile, } from "../lib/credentials.js";
+import { generateKeypair } from "../lib/signing.js";
+function bytesToHex(b) {
+    let s = "";
+    for (let i = 0; i < b.length; i++)
+        s += b[i].toString(16).padStart(2, "0");
+    return s;
+}
+async function exists(p) {
+    try {
+        await fs.stat(p);
+        return true;
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return false;
+        throw e;
+    }
+}
+async function atomicWrite(filePath, content) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    // Temp in the same dir so rename stays atomic across the same fs.
+    const tmp = `${filePath}.tmp.${process.pid}.${Date.now()}`;
+    await fs.writeFile(tmp, content, { encoding: "utf8", mode: 0o600 });
+    try {
+        await fs.rename(tmp, filePath);
+    }
+    catch (e) {
+        await fs.rm(tmp, { force: true });
+        throw e;
+    }
+    // chmod after rename in case the file pre-existed with looser perms.
+    await fs.chmod(filePath, 0o600).catch(() => { });
+}
+export async function cefKeypairGenerate(opts = {}) {
+    if (opts.out !== undefined && opts.profile !== undefined) {
+        throw new Error("cef keypair generate: --out and --profile are mutually exclusive");
+    }
+    const { pubkey, privkeyBytes } = await generateKeypair();
+    const privkey = bytesToHex(privkeyBytes);
+    // Profile sink: merge into the shared credentials file.
+    if (opts.profile !== undefined) {
+        const filePath = opts.configFilePath ?? defaultCredentialsFilePath();
+        let parsed = {};
+        try {
+            const existing = await fs.readFile(filePath, "utf8");
+            parsed = parseConfigFile(existing);
+        }
+        catch (e) {
+            if (e.code !== "ENOENT")
+                throw e;
+        }
+        if (parsed[opts.profile] && !opts.force) {
+            throw new Error(`cef keypair generate: profile [${opts.profile}] already exists in ${filePath} (pass --force to overwrite)`);
+        }
+        parsed[opts.profile] = { pubkey, privkey };
+        await atomicWrite(filePath, serializeConfigFile(parsed));
+        return { pubkey, privkey, path: filePath, profile: opts.profile };
+    }
+    // File sink: write the JSON keystore to `out`.
+    if (opts.out !== undefined) {
+        if ((await exists(opts.out)) && !opts.force) {
+            throw new Error(`cef keypair generate: ${opts.out} already exists (pass --force to overwrite)`);
+        }
+        await atomicWrite(opts.out, JSON.stringify({ pubkey, privkey }, null, 2) + "\n");
+        return { pubkey, privkey, path: opts.out };
+    }
+    // Default sink: stdout. Caller (CLI wrapper) prints the JSON.
+    return { pubkey, privkey };
+}
+//# sourceMappingURL=keypair.js.map

package/dist/commands/keypair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keypair.js","sourceRoot":"","sources":["../../src/commands/keypair.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAuBpD,SAAS,UAAU,CAAC,CAAa;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAK,CAAC,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACjE,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,OAAe;IAC1D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,kEAAkE;IAClE,MAAM,GAAG,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC3D,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC;IACV,CAAC;IACD,qEAAqE;IACrE,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAkC,EAAE;IAEpC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAEzC,wDAAwD;IACxD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,IAAI,0BAA0B,EAAE,CAAC;QACrE,IAAI,MAAM,GAA2C,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,CAAC,OAAO,uBAAuB,QAAQ,8BAA8B,CAC5G,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,WAAW,CAAC,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACpE,CAAC;IAED,+CAA+C;IAC/C,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,GAAG,6CAA6C,CAC/E,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,CACf,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CACpD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7C,CAAC;IAED,8DAA8D;IAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}

package/dist/commands/publish.d.ts

@@ -0,0 +1,40 @@
+import { type AsCredentials, type ResolveCredentialsOptions } from "../lib/credentials.js";
+export interface CefPublishOptions {
+    /** Resolved marketplace base URL — no trailing slash assumed. */
+    marketplaceUrl: string;
+    /** Which `dist/<id>/` to publish; auto-detected when undefined. */
+    agentId?: string;
+    /** Hex private seed (pairs with `pubkey`); highest-priority credential source. */
+    privkey?: string;
+    /** Hex public key paired with `privkey`. */
+    pubkey?: string;
+    /** Path to a JSON keystore file `{ pubkey, privkey }`. */
+    keystore?: string;
+    /** Profile name within the shared `~/.config/cef/credentials` file. */
+    profile?: string;
+    /** Defaults to `<cwd>/dist`. */
+    distDir?: string;
+    /** Defaults to `process.cwd()`. */
+    cwd?: string;
+    /**
+     * `fetch` override — defaults to `globalThis.fetch`. Tests pass a stub so
+     * the integration spec can assert on the wire shape without touching the
+     * network.
+     */
+    fetchImpl?: typeof fetch;
+    /**
+     * Override the credential resolver. Tests inject a fixed keypair this way
+     * so they don't have to set up flags/env/files.
+     */
+    resolveCredentialsImpl?: (opts: ResolveCredentialsOptions) => Promise<AsCredentials>;
+}
+export interface CefPublishResult {
+    /** Whatever `agentId` the marketplace returned (plain alias today). */
+    agentId: string;
+    version: string;
+    manifestCid: string;
+    /** Pubkey the manifest was published as (hex). */
+    pubkey: string;
+}
+export declare function cefPublish(opts: CefPublishOptions): Promise<CefPublishResult>;
+//# sourceMappingURL=publish.d.ts.map

package/dist/commands/publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/commands/publish.ts"],"names":[],"mappings":"AA8BA,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAI/B,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,cAAc,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,yBAAyB,KAC5B,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB;AAqBD,wBAAsB,UAAU,CAC9B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAgI3B"}

package/dist/commands/publish.js

@@ -0,0 +1,199 @@
+/**
+ * `cef publish` — POSTs a built agent's manifest to the CEF marketplace.
+ *
+ * Wire contract (matches `marketplace/scripts/smoke-publish.ts`):
+ *
+ *   POST <marketplaceUrl>/api/v1/marketplace/agents
+ *   Headers:
+ *     Content-Type: application/json
+ *     X-AS-Pubkey:    <hex Ed25519 pubkey>
+ *     X-AS-Signature: <hex Ed25519 signature over canonical body bytes>
+ *   Body (JCS-canonicalized JSON):
+ *     {
+ *       agentId:  <composite "<asPubKey>:<alias>">,
+ *       version:  <semver>,
+ *       manifest: <full AgentManifest, with agentId + agentServicePubkey filled>,
+ *       issuedAt: <ISO 8601>,
+ *       nonce:    <base64url 16 random bytes>
+ *     }
+ *
+ * `cef build` emits the manifest with `agentId` / `agentServicePubkey` left
+ * as empty strings; this command stamps them in (composite `<asPubKey>:<alias>`
+ * for `agentId`, the loaded AS pubkey for `agentServicePubkey`) before signing
+ * so the manifest the server hashes is byte-for-byte the manifest the publisher
+ * signs. Vault enforces the `<asPubKey>:` prefix on connect, so the canonical
+ * form is composite — the plain alias is recorded only in `manifest.alias`.
+ */
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { resolveCredentials, } from "../lib/credentials.js";
+import { canonicalize } from "../lib/jcs.js";
+import { signBody } from "../lib/signing.js";
+const DEFAULT_DIST = "dist";
+export async function cefPublish(opts) {
+    const cwd = opts.cwd ? path.resolve(opts.cwd) : process.cwd();
+    const distDir = opts.distDir
+        ? path.resolve(cwd, opts.distDir)
+        : path.join(cwd, DEFAULT_DIST);
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    if (!fetchImpl) {
+        throw new Error("[cef publish] no fetch implementation available (pass opts.fetchImpl or run on Node ≥18)");
+    }
+    const agentId = opts.agentId ?? (await autodetectAgentId(distDir));
+    const agentDir = path.join(distDir, agentId);
+    const manifestPath = path.join(agentDir, "manifest.json");
+    let manifestRaw;
+    try {
+        manifestRaw = await fs.readFile(manifestPath, "utf8");
+    }
+    catch (e) {
+        const code = e.code;
+        if (code === "ENOENT") {
+            throw new Error(`[cef publish] manifest not found at ${manifestPath} — run \`cef build\` first`);
+        }
+        throw e;
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(manifestRaw);
+    }
+    catch (e) {
+        throw new Error(`[cef publish] manifest at ${manifestPath} is not valid JSON: ${e.message}`);
+    }
+    validateManifestShape(manifest, manifestPath);
+    // The plain alias is the wire identity. `cef build` writes it to
+    // `manifest.alias` (per `prototype.md` §"AgentManifest.Alias") and
+    // leaves `manifest.agentId` blank for `cef publish` to fill in.
+    const alias = (manifest.alias ?? manifest.agentId);
+    const resolver = opts.resolveCredentialsImpl ?? resolveCredentials;
+    const credResolveOpts = {
+        ...(opts.privkey !== undefined ? { privkeyFlag: opts.privkey } : {}),
+        ...(opts.pubkey !== undefined ? { pubkeyFlag: opts.pubkey } : {}),
+        ...(opts.keystore !== undefined ? { keystoreFlag: opts.keystore } : {}),
+        ...(opts.profile !== undefined ? { profileFlag: opts.profile } : {}),
+    };
+    const { pubkey, privkeyBytes } = await resolver(credResolveOpts);
+    // Stamp the manifest's identity fields. The marketplace verifies
+    // `manifest.agentId === body.agentId` and we want the persisted manifest
+    // bytes to record the AS pubkey too — so the published artifact carries
+    // its own provenance even though the wire-level signature is detached.
+    //
+    // Composite `<pubkey>:<alias>` is the canonical form. Plain-alias was a
+    // CLI bug that resulted in vault-side connect failures (`agentId prefix
+    // does not match agentServicePubKey`); SDK 0.3.4 normalizes defensively,
+    // this stamps canonical at publish time so the marketplace record is
+    // correct. Strip a leading `0x` on the pubkey to mirror vault-sdk's
+    // `getCompositeAgentId` helper — the credential resolver already requires
+    // 64 bare hex chars, but defending here keeps the two helpers symmetric.
+    const cleanPubkey = pubkey.startsWith("0x") ? pubkey.slice(2) : pubkey;
+    const compositeAgentId = `${cleanPubkey}:${alias}`;
+    const stampedManifest = {
+        ...manifest,
+        agentId: compositeAgentId,
+        agentServicePubkey: pubkey,
+    };
+    const body = {
+        agentId: compositeAgentId,
+        version: stampedManifest.version,
+        manifest: stampedManifest,
+        issuedAt: new Date().toISOString(),
+        nonce: randomBase64UrlNonce(16),
+    };
+    const canonical = canonicalize(body);
+    const signature = await signBody(canonical, privkeyBytes);
+    const url = `${opts.marketplaceUrl.replace(/\/+$/, "")}/api/v1/marketplace/agents`;
+    const res = await fetchImpl(url, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "X-AS-Pubkey": pubkey,
+            "X-AS-Signature": signature,
+        },
+        body: canonical,
+    });
+    if (res.status === 201) {
+        const json = (await res.json());
+        if (typeof json.agentId !== "string" ||
+            typeof json.version !== "string" ||
+            typeof json.manifestCid !== "string") {
+            throw new Error(`[cef publish] unexpected 201 body: ${JSON.stringify(json)}`);
+        }
+        return {
+            agentId: json.agentId,
+            version: json.version,
+            manifestCid: json.manifestCid,
+            pubkey,
+        };
+    }
+    // Friendly error path for replays. The marketplace returns
+    // `{ error: "REPLAY", ... }` on 409 (see `recordNonce`).
+    const text = await res.text();
+    if (res.status === 409) {
+        throw new Error(`[cef publish] REPLAY: nonce already used (${text})`);
+    }
+    throw new Error(`[cef publish] marketplace returned HTTP ${res.status}: ${text}`);
+}
+async function autodetectAgentId(distDir) {
+    let entries;
+    try {
+        entries = await fs.readdir(distDir);
+    }
+    catch (e) {
+        const code = e.code;
+        if (code === "ENOENT") {
+            throw new Error(`[cef publish] dist directory ${distDir} not found — run \`cef build\` first`);
+        }
+        throw e;
+    }
+    const candidates = [];
+    for (const name of entries) {
+        const stat = await fs.stat(path.join(distDir, name)).catch(() => null);
+        if (!stat?.isDirectory())
+            continue;
+        // Only consider dirs that actually contain a manifest.json.
+        const has = await fs
+            .stat(path.join(distDir, name, "manifest.json"))
+            .then(() => true)
+            .catch(() => false);
+        if (has)
+            candidates.push(name);
+    }
+    if (candidates.length === 0) {
+        throw new Error(`[cef publish] no built agents found in ${distDir} — run \`cef build\` first`);
+    }
+    if (candidates.length > 1) {
+        throw new Error(`[cef publish] multiple built agents in ${distDir} (${candidates
+            .sort()
+            .join(", ")}) — pass \`--agent <id>\` to pick one`);
+    }
+    return candidates[0];
+}
+function validateManifestShape(m, source) {
+    const missing = [];
+    // Build emits both `alias` and (placeholder) `agentId`; treat presence of
+    // either as the alias. Spec calls this out as `id (alias)`.
+    if (!m.alias && !m.agentId)
+        missing.push("alias|agentId");
+    if (!m.version)
+        missing.push("version");
+    if (!m.card)
+        missing.push("card");
+    else {
+        if (!m.card.name)
+            missing.push("card.name");
+        if (!m.card.description)
+            missing.push("card.description");
+    }
+    if (!Array.isArray(m.handles))
+        missing.push("handles[]");
+    if (!Array.isArray(m.publishes))
+        missing.push("publishes[]");
+    if (missing.length > 0) {
+        throw new Error(`[cef publish] manifest at ${source} is missing required fields: ${missing.join(", ")}`);
+    }
+}
+function randomBase64UrlNonce(numBytes) {
+    return crypto.randomBytes(numBytes).toString("base64url");
+}
+//# sourceMappingURL=publish.js.map

package/dist/commands/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/commands/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,kBAAkB,GAGnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AA4D7C,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO;QAC1B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACrD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAE1D,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,uCAAuC,YAAY,4BAA4B,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IAED,IAAI,QAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAiB,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,6BAA6B,YAAY,uBAAwB,CAAW,CAAC,OAAO,EAAE,CACvF,CAAC;IACJ,CAAC;IACD,qBAAqB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAE9C,iEAAiE;IACjE,mEAAmE;IACnE,gEAAgE;IAChE,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAE,CAAC;IAEpD,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,IAAI,kBAAkB,CAAC;IACnE,MAAM,eAAe,GAA8B;QACjD,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;IACF,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,CAAC;IAEjE,iEAAiE;IACjE,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,EAAE;IACF,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,qEAAqE;IACrE,oEAAoE;IACpE,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,gBAAgB,GAAG,GAAG,WAAW,IAAI,KAAK,EAAE,CAAC;IAEnD,MAAM,eAAe,GAAiB;QACpC,GAAG,QAAQ;QACX,OAAO,EAAE,gBAAgB;QACzB,kBAAkB,EAAE,MAAM;KAC3B,CAAC;IAEF,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,gBAAgB;QACzB,OAAO,EAAE,eAAe,CAAC,OAAQ;QACjC,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,KAAK,EAAE,oBAAoB,CAAC,EAAE,CAAC;KAChC,CAAC;IAEF,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAE1D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,CAAC;IACnF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,MAAM;YACrB,gBAAgB,EAAE,SAAS;SAC5B;QACD,IAAI,EAAE,SAAS;KAChB,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,IACE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAChC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAChC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EACpC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC7D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM;SACP,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,yDAAyD;IACzD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,KAAK,CACb,2CAA2C,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CACjE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAe;IAC9C,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,sCAAsC,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE;YAAE,SAAS;QACnC,4DAA4D;QAC5D,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;aAC/C,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aAChB,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,GAAG;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,4BAA4B,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,KAAK,UAAU;aAC7D,IAAI,EAAE;aACN,IAAI,CAAC,IAAI,CAAC,uCAAuC,CACrD,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAE,CAAC;AACxB,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAe,EAAE,MAAc;IAC5D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,0EAA0E;IAC1E,4DAA4D;IAC5D,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;SAC7B,CAAC;QACJ,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,6BAA6B,MAAM,gCAAgC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC5D,CAAC"}

package/dist/lib/cid.d.ts

@@ -0,0 +1,3 @@
+export declare const MANIFEST_CID_PREFIX = "blake3:";
+export declare function computeManifestCid(manifest: object): string;
+//# sourceMappingURL=cid.d.ts.map

package/dist/lib/cid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cid.d.ts","sourceRoot":"","sources":["../../src/lib/cid.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAI7C,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI3D"}

package/dist/lib/cid.js

@@ -0,0 +1,43 @@
+/**
+ * Manifest CID (`blake3:<base32>`) — the content-addressed identifier the
+ * marketplace stores for each published manifest.
+ *
+ * Mirrors the marketplace's `lib/manifest/cid.ts`:
+ *   - JCS-canonicalize the manifest object,
+ *   - BLAKE3-hash the UTF-8 bytes,
+ *   - base32-encode (RFC 4648 lowercase alphabet, NO padding),
+ *   - prefix with `blake3:`.
+ *
+ * The cef CLI computes this locally so it can echo the expected CID back to
+ * the user (and so a future smoke test could compare against the server's
+ * returned `manifestCid` without round-tripping the network).
+ */
+import { blake3 } from "@noble/hashes/blake3.js";
+import { canonicalizeBytes } from "./jcs.js";
+export const MANIFEST_CID_PREFIX = "blake3:";
+const BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+export function computeManifestCid(manifest) {
+    const bytes = canonicalizeBytes(manifest);
+    const digest = blake3(bytes);
+    return MANIFEST_CID_PREFIX + base32EncodeNoPadding(digest);
+}
+function base32EncodeNoPadding(bytes) {
+    let out = "";
+    let buffer = 0;
+    let bits = 0;
+    for (let i = 0; i < bytes.length; i++) {
+        buffer = (buffer << 8) | bytes[i];
+        bits += 8;
+        while (bits >= 5) {
+            bits -= 5;
+            const idx = (buffer >> bits) & 0b11111;
+            out += BASE32_ALPHABET[idx];
+        }
+    }
+    if (bits > 0) {
+        const idx = (buffer << (5 - bits)) & 0b11111;
+        out += BASE32_ALPHABET[idx];
+    }
+    return out;
+}
+//# sourceMappingURL=cid.js.map

package/dist/lib/cid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cid.js","sourceRoot":"","sources":["../../src/lib/cid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,mBAAmB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAiB;IAC9C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAI,KAAK,CAAC,CAAC,CAAY,CAAC;QAC9C,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,CAAC;YACV,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC;YACvC,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC;QAC7C,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/credentials.d.ts

@@ -0,0 +1,43 @@
+export type CredentialSource = "flags" | "env" | "keystore-flag" | "keystore-env" | "config-profile";
+export interface AsCredentials {
+    /** 64-char lowercase hex (32 bytes), matches the wire format. */
+    pubkey: string;
+    /** Raw 32-byte Ed25519 seed. */
+    privkeyBytes: Uint8Array;
+    source: CredentialSource;
+    /** Set only when `source === 'config-profile'`. */
+    profileName?: string;
+}
+export interface ResolveCredentialsOptions {
+    privkeyFlag?: string;
+    pubkeyFlag?: string;
+    keystoreFlag?: string;
+    profileFlag?: string;
+    /** Defaults to `process.env`. Tests pass an isolated map. */
+    env?: NodeJS.ProcessEnv;
+    /** Defaults to `<XDG_CONFIG_HOME|~/.config>/cef/credentials`. */
+    configFilePath?: string;
+}
+export declare class CredentialsError extends Error {
+    constructor(message: string);
+}
+export declare function defaultCredentialsFilePath(): string;
+/**
+ * Parse a minimal INI file: section headers `[name]`, `key = value` pairs,
+ * `;` and `#` line comments. No nested sections, no quoting, no escapes —
+ * the credentials file shape is trivial and that's all we need.
+ *
+ * Returns a map of `{ section: { key: value } }`. Keys/values are trimmed.
+ * Pre-section keys live under the empty-string section; the credentials
+ * loader only reads named sections so those are ignored.
+ */
+export declare function parseConfigFile(content: string): Record<string, Record<string, string>>;
+/**
+ * Render a parsed INI map back to text. Sections are emitted in insertion
+ * order; the empty-string section (if any) is dropped — this writer only
+ * supports section-scoped credentials. Used by `cef keypair generate
+ * --profile` when merging into the shared credentials file.
+ */
+export declare function serializeConfigFile(data: Record<string, Record<string, string>>): string;
+export declare function resolveCredentials(opts: ResolveCredentialsOptions): Promise<AsCredentials>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/lib/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/lib/credentials.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,gBAAgB,GACxB,OAAO,GACP,KAAK,GACL,eAAe,GACf,cAAc,GACd,gBAAgB,CAAC;AAErB,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,YAAY,EAAE,UAAU,CAAC;IACzB,MAAM,EAAE,gBAAgB,CAAC;IACzB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAgBD,wBAAgB,0BAA0B,IAAI,MAAM,CAInD;AAgED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA+BvF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC3C,MAAM,CAYR;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,aAAa,CAAC,CAqHxB"}

package/dist/lib/credentials.js

@@ -0,0 +1,241 @@
+/**
+ * Resolves the AS Ed25519 keypair `cef publish` (and any future signing
+ * subcommand) needs to sign the publish envelope. The AS keypair represents
+ * the Agent Service identity — potentially shared across a team — so it is
+ * never silently auto-generated. Callers must explicitly provision it.
+ *
+ * Resolution follows AWS-CLI conventions and walks these sources in priority
+ * order, returning the first one that produces a complete keypair:
+ *
+ *   1. CLI flags             (`--privkey` + `--pubkey`)
+ *   2. Env vars              (`CEF_AS_PRIVATE_KEY` + `CEF_AS_PUBLIC_KEY`)
+ *   3. Keystore file via flag(`--keystore <path>`)
+ *   4. Keystore file via env (`CEF_AS_KEYSTORE`)
+ *   5. Profile in shared config (`~/.config/cef/credentials`, INI, profile
+ *      selected by `--profile` / `CEF_PROFILE`, default `default`).
+ *
+ * If none produces credentials, a `CredentialsError` is thrown carrying the
+ * canonical multi-line guidance message — the CLI surfaces that verbatim on
+ * stderr before exiting non-zero.
+ */
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+export class CredentialsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CredentialsError";
+    }
+}
+const NO_CREDENTIALS_MESSAGE = `Error: no AS credentials configured.
+
+Provide credentials via one of:
+  - flags: --privkey <hex> --pubkey <hex>
+  - env:   CEF_AS_PRIVATE_KEY=<hex> CEF_AS_PUBLIC_KEY=<hex>
+  - file:  --keystore <path>  (or CEF_AS_KEYSTORE env)
+  - file:  ~/.config/cef/credentials  (with [default] or another profile via --profile)
+
+Generate a new keypair with:
+  cef keypair generate
+
+Note: the AS keypair represents your Agent Service identity. If you're publishing for an
+existing team, ask your team for the existing keypair — don't generate a new one.`;
+export function defaultCredentialsFilePath() {
+    const xdg = process.env.XDG_CONFIG_HOME;
+    const base = xdg && xdg.length > 0 ? xdg : path.join(os.homedir(), ".config");
+    return path.join(base, "cef", "credentials");
+}
+const HEX_RE = /^[0-9a-fA-F]{64}$/;
+function normalizePubkey(hex, ctx) {
+    if (!HEX_RE.test(hex)) {
+        throw new CredentialsError(`${ctx}: pubkey must be 64 hex chars (32 bytes), got ${hex.length} chars`);
+    }
+    return hex.toLowerCase();
+}
+function hexToBytes(hex, ctx) {
+    if (!HEX_RE.test(hex)) {
+        throw new CredentialsError(`${ctx}: privkey must be 64 hex chars (32 bytes Ed25519 seed), got ${hex.length} chars`);
+    }
+    const out = new Uint8Array(32);
+    for (let i = 0; i < 32; i++) {
+        out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+async function readKeystoreFile(filePath, ctx) {
+    let raw;
+    try {
+        raw = await fs.readFile(filePath, "utf8");
+    }
+    catch (e) {
+        const code = e.code;
+        if (code === "ENOENT")
+            return null;
+        throw e;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (e) {
+        throw new CredentialsError(`${ctx}: ${filePath} is not valid JSON: ${e.message}`);
+    }
+    if (!parsed ||
+        typeof parsed !== "object" ||
+        typeof parsed.pubkey !== "string" ||
+        typeof parsed.privkey !== "string") {
+        throw new CredentialsError(`${ctx}: ${filePath} is missing pubkey/privkey hex fields`);
+    }
+    return parsed;
+}
+/**
+ * Parse a minimal INI file: section headers `[name]`, `key = value` pairs,
+ * `;` and `#` line comments. No nested sections, no quoting, no escapes —
+ * the credentials file shape is trivial and that's all we need.
+ *
+ * Returns a map of `{ section: { key: value } }`. Keys/values are trimmed.
+ * Pre-section keys live under the empty-string section; the credentials
+ * loader only reads named sections so those are ignored.
+ */
+export function parseConfigFile(content) {
+    const out = {};
+    let current = "";
+    out[current] = {};
+    const lines = content.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i] ?? "";
+        const line = raw.trim();
+        if (line.length === 0)
+            continue;
+        if (line.startsWith(";") || line.startsWith("#"))
+            continue;
+        if (line.startsWith("[") && line.endsWith("]")) {
+            current = line.slice(1, -1).trim();
+            if (!out[current])
+                out[current] = {};
+            continue;
+        }
+        const eq = line.indexOf("=");
+        if (eq < 0) {
+            throw new CredentialsError(`credentials file: malformed line ${i + 1}: ${raw}`);
+        }
+        const key = line.slice(0, eq).trim();
+        const value = line.slice(eq + 1).trim();
+        if (key.length === 0) {
+            throw new CredentialsError(`credentials file: empty key on line ${i + 1}`);
+        }
+        (out[current] ??= {})[key] = value;
+    }
+    return out;
+}
+/**
+ * Render a parsed INI map back to text. Sections are emitted in insertion
+ * order; the empty-string section (if any) is dropped — this writer only
+ * supports section-scoped credentials. Used by `cef keypair generate
+ * --profile` when merging into the shared credentials file.
+ */
+export function serializeConfigFile(data) {
+    const parts = [];
+    for (const section of Object.keys(data)) {
+        if (section.length === 0)
+            continue;
+        parts.push(`[${section}]`);
+        const kv = data[section] ?? {};
+        for (const key of Object.keys(kv)) {
+            parts.push(`${key} = ${kv[key]}`);
+        }
+        parts.push("");
+    }
+    return parts.join("\n");
+}
+export async function resolveCredentials(opts) {
+    const env = opts.env ?? process.env;
+    // (1) Flags. If either privkey or pubkey is set, both must be set.
+    if (opts.privkeyFlag !== undefined || opts.pubkeyFlag !== undefined) {
+        if (opts.privkeyFlag === undefined || opts.pubkeyFlag === undefined) {
+            throw new CredentialsError("credentials: --privkey and --pubkey must be provided together");
+        }
+        return {
+            pubkey: normalizePubkey(opts.pubkeyFlag, "--pubkey"),
+            privkeyBytes: hexToBytes(opts.privkeyFlag, "--privkey"),
+            source: "flags",
+        };
+    }
+    // (2) Env vars. Same pairing rule — if one is set, both must be.
+    const envPriv = env.CEF_AS_PRIVATE_KEY;
+    const envPub = env.CEF_AS_PUBLIC_KEY;
+    if (envPriv !== undefined || envPub !== undefined) {
+        if (envPriv === undefined || envPub === undefined) {
+            throw new CredentialsError("credentials: CEF_AS_PRIVATE_KEY and CEF_AS_PUBLIC_KEY must both be set");
+        }
+        return {
+            pubkey: normalizePubkey(envPub, "CEF_AS_PUBLIC_KEY"),
+            privkeyBytes: hexToBytes(envPriv, "CEF_AS_PRIVATE_KEY"),
+            source: "env",
+        };
+    }
+    // (3) --keystore <path>. Missing file is a hard error here — the user
+    // explicitly named a path, so silently falling through to the next source
+    // would mask a typo.
+    if (opts.keystoreFlag !== undefined) {
+        const file = await readKeystoreFile(opts.keystoreFlag, "--keystore");
+        if (file === null) {
+            throw new CredentialsError(`--keystore: ${opts.keystoreFlag} does not exist`);
+        }
+        return {
+            pubkey: normalizePubkey(file.pubkey, opts.keystoreFlag),
+            privkeyBytes: hexToBytes(file.privkey, opts.keystoreFlag),
+            source: "keystore-flag",
+        };
+    }
+    // (4) CEF_AS_KEYSTORE env. Same: if set, the file must exist.
+    const envKeystore = env.CEF_AS_KEYSTORE;
+    if (envKeystore !== undefined && envKeystore.length > 0) {
+        const file = await readKeystoreFile(envKeystore, "CEF_AS_KEYSTORE");
+        if (file === null) {
+            throw new CredentialsError(`CEF_AS_KEYSTORE: ${envKeystore} does not exist`);
+        }
+        return {
+            pubkey: normalizePubkey(file.pubkey, envKeystore),
+            privkeyBytes: hexToBytes(file.privkey, envKeystore),
+            source: "keystore-env",
+        };
+    }
+    // (5) Shared credentials file → profile section. A missing file with no
+    // explicit `--profile` flag is "no credentials", not an error. With
+    // `--profile <name>` set we always require either the file or the
+    // section to exist — silent fallthrough would mask the typo.
+    const configFilePath = opts.configFilePath ?? defaultCredentialsFilePath();
+    const profileName = opts.profileFlag ?? env.CEF_PROFILE ?? "default";
+    const profileExplicit = opts.profileFlag !== undefined ||
+        (env.CEF_PROFILE !== undefined && env.CEF_PROFILE.length > 0);
+    let configText = null;
+    try {
+        configText = await fs.readFile(configFilePath, "utf8");
+    }
+    catch (e) {
+        const code = e.code;
+        if (code !== "ENOENT")
+            throw e;
+    }
+    if (configText !== null) {
+        const parsed = parseConfigFile(configText);
+        const section = parsed[profileName];
+        if (section && section.pubkey && section.privkey) {
+            return {
+                pubkey: normalizePubkey(section.pubkey, `${configFilePath} [${profileName}]`),
+                privkeyBytes: hexToBytes(section.privkey, `${configFilePath} [${profileName}]`),
+                source: "config-profile",
+                profileName,
+            };
+        }
+        if (profileExplicit) {
+            throw new CredentialsError(`--profile: ${profileName} not found in ${configFilePath}`);
+        }
+    }
+    else if (profileExplicit) {
+        throw new CredentialsError(`--profile: credentials file ${configFilePath} does not exist`);
+    }
+    throw new CredentialsError(NO_CREDENTIALS_MESSAGE);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/lib/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/lib/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA+B7B,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,sBAAsB,GAAG;;;;;;;;;;;;kFAYmD,CAAC;AAEnF,MAAM,UAAU,0BAA0B;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,MAAM,GAAG,mBAAmB,CAAC;AAEnC,SAAS,eAAe,CAAC,GAAW,EAAE,GAAW;IAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CACxB,GAAG,GAAG,iDAAiD,GAAG,CAAC,MAAM,QAAQ,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,GAAW;IAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CACxB,GAAG,GAAG,+DAA+D,GAAG,CAAC,MAAM,QAAQ,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAOD,KAAK,UAAU,gBAAgB,CAC7B,QAAgB,EAChB,GAAW;IAEX,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CACxB,GAAG,GAAG,KAAK,QAAQ,uBAAwB,CAAW,CAAC,OAAO,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM;QACP,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAQ,MAA4B,CAAC,MAAM,KAAK,QAAQ;QACxD,OAAQ,MAA4B,CAAC,OAAO,KAAK,QAAQ,EACzD,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,GAAG,GAAG,KAAK,QAAQ,uCAAuC,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,MAA2B,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAClB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC3D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACrC,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,gBAAgB,CACxB,oCAAoC,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,gBAAgB,CACxB,uCAAuC,CAAC,GAAG,CAAC,EAAE,CAC/C,CAAC;QACJ,CAAC;QACD,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA4C;IAE5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA+B;IAE/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEpC,mEAAmE;IACnE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACpE,MAAM,IAAI,gBAAgB,CACxB,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC;YACpD,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC;YACvD,MAAM,EAAE,OAAO;SAChB,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,MAAM,OAAO,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,gBAAgB,CACxB,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,mBAAmB,CAAC;YACpD,YAAY,EAAE,UAAU,CAAC,OAAO,EAAE,oBAAoB,CAAC;YACvD,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,qBAAqB;IACrB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CACjC,IAAI,CAAC,YAAY,EACjB,YAAY,CACb,CAAC;QACF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAgB,CACxB,eAAe,IAAI,CAAC,YAAY,iBAAiB,CAClD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC;YACvD,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC;YACzD,MAAM,EAAE,eAAe;SACxB,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,MAAM,WAAW,GAAG,GAAG,CAAC,eAAe,CAAC;IACxC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACpE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,WAAW,iBAAiB,CACjD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;YACjD,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;YACnD,MAAM,EAAE,cAAc;SACvB,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,6DAA6D;IAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,0BAA0B,EAAE,CAAC;IAC3E,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,SAAS,CAAC;IACnD,MAAM,eAAe,GACnB,IAAI,CAAC,WAAW,KAAK,SAAS;QAC9B,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEhE,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACjD,OAAO;gBACL,MAAM,EAAE,eAAe,CACrB,OAAO,CAAC,MAAM,EACd,GAAG,cAAc,KAAK,WAAW,GAAG,CACrC;gBACD,YAAY,EAAE,UAAU,CACtB,OAAO,CAAC,OAAO,EACf,GAAG,cAAc,KAAK,WAAW,GAAG,CACrC;gBACD,MAAM,EAAE,gBAAgB;gBACxB,WAAW;aACZ,CAAC;QACJ,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,IAAI,gBAAgB,CACxB,cAAc,WAAW,iBAAiB,cAAc,EAAE,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,eAAe,EAAE,CAAC;QAC3B,MAAM,IAAI,gBAAgB,CACxB,+BAA+B,cAAc,iBAAiB,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;AACrD,CAAC"}

package/dist/lib/jcs.d.ts

@@ -0,0 +1,3 @@
+export declare function canonicalize(value: unknown): string;
+export declare function canonicalizeBytes(value: unknown): Uint8Array;
+//# sourceMappingURL=jcs.d.ts.map

package/dist/lib/jcs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jcs.d.ts","sourceRoot":"","sources":["../../src/lib/jcs.ts"],"names":[],"mappings":"AAeA,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOnD;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAE5D"}

package/dist/lib/jcs.js

@@ -0,0 +1,48 @@
+/**
+ * RFC 8785 JSON Canonicalization Scheme (JCS).
+ *
+ * Thin wrapper over the `canonicalize` npm package — the same library the
+ * marketplace API uses. Re-exposed here as `canonicalize()` returning a
+ * string (and `canonicalizeBytes()` returning the UTF-8 bytes that get
+ * signed / hashed) so call sites in `cef publish` mirror the marketplace's
+ * `lib/jcs.ts` one-to-one.
+ *
+ * RFC 8785 leaves the encoding of non-finite numbers / BigInt undefined; we
+ * reject them up front rather than rely on the package's silent coercion,
+ * matching the marketplace's behaviour.
+ */
+import canonicalizePkg from "canonicalize";
+export function canonicalize(value) {
+    assertJcsCompatible(value);
+    const out = canonicalizePkg(value);
+    if (out === undefined) {
+        throw new TypeError("JCS: canonicalize() returned undefined");
+    }
+    return out;
+}
+export function canonicalizeBytes(value) {
+    return new TextEncoder().encode(canonicalize(value));
+}
+function assertJcsCompatible(value) {
+    if (typeof value === "number") {
+        if (!Number.isFinite(value)) {
+            throw new TypeError(`JCS: non-finite number ${String(value)}`);
+        }
+        return;
+    }
+    if (typeof value === "bigint") {
+        throw new TypeError("JCS: bigint not supported by RFC 8785");
+    }
+    if (Array.isArray(value)) {
+        for (const item of value)
+            assertJcsCompatible(item);
+        return;
+    }
+    if (value !== null && typeof value === "object") {
+        for (const v of Object.values(value)) {
+            if (v !== undefined)
+                assertJcsCompatible(v);
+        }
+    }
+}
+//# sourceMappingURL=jcs.js.map

package/dist/lib/jcs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jcs.js","sourceRoot":"","sources":["../../src/lib/jcs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,eAAe,MAAM,cAAc,CAAC;AAE3C,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,SAAS,CAAC,0BAA0B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,KAAK,SAAS;gBAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib/signing.d.ts

@@ -0,0 +1,13 @@
+export interface Ed25519Keypair {
+    /** Hex-encoded public key (32-byte Ed25519 pubkey, lowercase, no prefix). */
+    pubkey: string;
+    /** Raw 32-byte private seed. */
+    privkeyBytes: Uint8Array;
+}
+export declare function generateKeypair(): Promise<Ed25519Keypair>;
+/**
+ * Sign the UTF-8 bytes of `canonicalJson` with `privkeyBytes`. Returns
+ * lowercase-hex signature (64 bytes → 128 hex chars).
+ */
+export declare function signBody(canonicalJson: string, privkeyBytes: Uint8Array): Promise<string>;
+//# sourceMappingURL=signing.d.ts.map

package/dist/lib/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/lib/signing.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,YAAY,EAAE,UAAU,CAAC;CAC1B;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,cAAc,CAAC,CAI/D;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,UAAU,GACvB,OAAO,CAAC,MAAM,CAAC,CAIjB"}

package/dist/lib/signing.js

@@ -0,0 +1,34 @@
+/**
+ * Ed25519 keypair generation + body signing for `cef publish`. Produces the
+ * lowercase-hex pubkey + signature pair that the marketplace's
+ * `X-AS-Pubkey` / `X-AS-Signature` headers expect (raw hex, no `0x` prefix,
+ * no encoding wrapper).
+ *
+ * Mirrors the marketplace's `lib/signing/sign.ts`. Signing input is the
+ * UTF-8 bytes of the JCS-canonical body — callers are expected to pass the
+ * exact string they place in the HTTP request body, so the signature
+ * covers byte-for-byte what the server will re-canonicalize and verify.
+ */
+import * as ed25519 from "@noble/ed25519";
+function bytesToHex(b) {
+    let s = "";
+    for (let i = 0; i < b.length; i++) {
+        s += b[i].toString(16).padStart(2, "0");
+    }
+    return s;
+}
+export async function generateKeypair() {
+    const privkeyBytes = ed25519.utils.randomPrivateKey();
+    const pubkeyBytes = await ed25519.getPublicKeyAsync(privkeyBytes);
+    return { pubkey: bytesToHex(pubkeyBytes), privkeyBytes };
+}
+/**
+ * Sign the UTF-8 bytes of `canonicalJson` with `privkeyBytes`. Returns
+ * lowercase-hex signature (64 bytes → 128 hex chars).
+ */
+export async function signBody(canonicalJson, privkeyBytes) {
+    const message = new TextEncoder().encode(canonicalJson);
+    const sig = await ed25519.signAsync(message, privkeyBytes);
+    return bytesToHex(sig);
+}
+//# sourceMappingURL=signing.js.map

package/dist/lib/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/lib/signing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAE1C,SAAS,UAAU,CAAC,CAAa;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,CAAC,IAAK,CAAC,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,aAAqB,EACrB,YAAwB;IAExB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC"}

package/dist/lib.d.ts

@@ -9,4 +9,10 @@ export { cefTypegen } from "./commands/typegen.js";
 export type { CefTypegenOptions, CefTypegenResult, } from "./commands/typegen.js";
 export { cefInspect } from "./commands/inspect.js";
 export type { CefInspectOptions, CefInspectResult } from "./commands/inspect.js";
+export { cefPublish } from "./commands/publish.js";
+export type { CefPublishOptions, CefPublishResult, } from "./commands/publish.js";
+export { cefKeypairGenerate } from "./commands/keypair.js";
+export type { CefKeypairGenerateOptions, CefKeypairGenerateResult, } from "./commands/keypair.js";
+export { resolveCredentials, CredentialsError, defaultCredentialsFilePath, } from "./lib/credentials.js";
+export type { AsCredentials, CredentialSource, ResolveCredentialsOptions, } from "./lib/credentials.js";
 //# sourceMappingURL=lib.d.ts.map

package/dist/lib.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EACV,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EACV,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EACV,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EACV,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC"}

package/dist/lib.js

@@ -6,4 +6,7 @@
 export { cefBuild } from "./commands/build.js";
 export { cefTypegen } from "./commands/typegen.js";
 export { cefInspect } from "./commands/inspect.js";
+export { cefPublish } from "./commands/publish.js";
+export { cefKeypairGenerate } from "./commands/keypair.js";
+export { resolveCredentials, CredentialsError, defaultCredentialsFilePath, } from "./lib/credentials.js";
 //# sourceMappingURL=lib.js.map

package/dist/lib.js.map

@@ -1 +1 @@
-{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAG/C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAMnD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAG/C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAMnD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAMnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAM3D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cef-ai/cli",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -14,6 +14,9 @@
     "access": "public"
   },
   "dependencies": {
+    "@noble/ed25519": "^2.1.0",
+    "@noble/hashes": "^2.2.0",
+    "canonicalize": "^3.0.0",
     "commander": "^12.0.0",
     "esbuild": "^0.21.0",
     "json-schema-to-typescript": "^14.0.0",