@cleocode/cleo 2026.10.4 → 2026.10.5

package/dist/cli/service-GLOMZWPQ.js

@@ -0,0 +1,437 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  errorResult,
+  unsupportedOp,
+  wrapResult
+} from "./chunk-XHRZ7OYZ.js";
+
+// packages/cleo/src/dispatch/domains/service.ts
+import {
+  connectService,
+  deleteConnectionCascade,
+  listConnections
+} from "@cleocode/core";
+import {
+  buildAuthUrl,
+  exchangeCode,
+  selfHealConnection
+} from "@cleocode/core/internal";
+var ServiceHandler = class {
+  /**
+   * Handle service queries.
+   *
+   * Supported: `auth-url` — build a PKCE OAuth authorization URL. The result
+   * carries the `codeVerifier` + `state` the caller round-trips into `exchange`;
+   * these are NOT persisted secrets (they are short-lived flow material the user
+   * already controls), so returning them is the contract of the verb.
+   */
+  async query(operation, params) {
+    const startTime = Date.now();
+    switch (operation) {
+      case "auth-url": {
+        const provider = typeof params?.provider === "string" ? params.provider : void 0;
+        if (!provider) {
+          return errorResult(
+            "query",
+            "service",
+            operation,
+            "E_INVALID_INPUT",
+            "provider is required",
+            startTime
+          );
+        }
+        const opts = {
+          ...typeof params?.state === "string" ? { state: params.state } : {},
+          ...typeof params?.scope === "string" ? { scope: params.scope } : {},
+          ...typeof params?.redirectUri === "string" ? { redirectUri: params.redirectUri } : {}
+        };
+        try {
+          const result = await buildAuthUrl(provider, opts);
+          return wrapResult(
+            { success: true, data: result },
+            "query",
+            "service",
+            operation,
+            startTime
+          );
+        } catch (err) {
+          return errorResult(
+            "query",
+            "service",
+            operation,
+            "E_INTERNAL",
+            messageOf(err),
+            startTime
+          );
+        }
+      }
+      case "list":
+        return this.list(params, startTime);
+      case "status":
+        return this.status(params, startTime);
+      default:
+        return unsupportedOp("query", "service", operation, startTime);
+    }
+  }
+  /** Delegate `service.list` to CORE `listConnections` — redacted views only. */
+  async list(params, startTime) {
+    const provider = typeof params?.provider === "string" ? params.provider : void 0;
+    try {
+      const connections = await listConnections(provider);
+      return wrapResult(
+        { success: true, data: { connections } },
+        "query",
+        "service",
+        "list",
+        startTime
+      );
+    } catch (err) {
+      return errorResult("query", "service", "list", "E_INTERNAL", messageOf(err), startTime);
+    }
+  }
+  /** Delegate `service.status` to CORE `listConnections` + map to health views. */
+  async status(params, startTime) {
+    const provider = typeof params?.provider === "string" ? params.provider : void 0;
+    try {
+      const views = await listConnections(provider);
+      const connections = views.map((v) => toHealthView(v));
+      return wrapResult(
+        { success: true, data: { connections } },
+        "query",
+        "service",
+        "status",
+        startTime
+      );
+    } catch (err) {
+      return errorResult("query", "service", "status", "E_INTERNAL", messageOf(err), startTime);
+    }
+  }
+  /**
+   * Handle service mutations.
+   *
+   * Supported: `exchange` (persist tokens), `refresh` (renew tokens),
+   * `self-heal` (resolve + transparent refresh). All delegate to CORE and return
+   * the NON-SECRET result — the plaintext token NEVER crosses this boundary.
+   */
+  async mutate(operation, params) {
+    const startTime = Date.now();
+    switch (operation) {
+      case "connect":
+        return this.connect(params, startTime);
+      case "exchange":
+        return this.exchange(params, startTime);
+      case "refresh":
+        return this.refresh(params, startTime);
+      case "revoke":
+        return this.revoke(params, startTime);
+      case "self-heal":
+        return this.selfHeal(params, startTime);
+      default:
+        return unsupportedOp("mutate", "service", operation, startTime);
+    }
+  }
+  /**
+   * Delegate `service.connect` — store a credential. Two modes:
+   *   - token-direct: `token` (+ optional refreshToken/expiresAt/scopes) →
+   *     CORE `connectService` encrypts + persists the blob.
+   *   - paste-code: `code` + `codeVerifier` + `redirectUri` → CORE `exchangeCode`
+   *     runs the OAuth dance. The plaintext token NEVER crosses this boundary.
+   */
+  async connect(params, startTime) {
+    const provider = typeof params?.provider === "string" ? params.provider : void 0;
+    if (!provider) {
+      return errorResult(
+        "mutate",
+        "service",
+        "connect",
+        "E_INVALID_INPUT",
+        "provider is required",
+        startTime
+      );
+    }
+    const label = typeof params?.label === "string" ? params.label : "default";
+    const token = typeof params?.token === "string" ? params.token : void 0;
+    const code = typeof params?.code === "string" ? params.code : void 0;
+    try {
+      if (token !== void 0) {
+        const connectionId = await connectService(
+          buildConnectParams(provider, label, params, token)
+        );
+        return wrapResult(
+          {
+            success: true,
+            data: {
+              count: 1,
+              created: [String(connectionId)],
+              connection: { connectionId, provider, label, expiresAt: expiryOf(params) }
+            }
+          },
+          "mutate",
+          "service",
+          "connect",
+          startTime
+        );
+      }
+      if (code !== void 0) {
+        const opts = buildExchangeOpts(params, code, label);
+        if (opts === null) {
+          return errorResult(
+            "mutate",
+            "service",
+            "connect",
+            "E_INVALID_INPUT",
+            "paste-code mode requires --code, --code-verifier, and --redirect-uri",
+            startTime
+          );
+        }
+        const result = await exchangeCode(provider, opts);
+        return wrapResult(
+          {
+            success: true,
+            data: { count: 1, created: [String(result.connectionId)], connection: result }
+          },
+          "mutate",
+          "service",
+          "connect",
+          startTime
+        );
+      }
+      return errorResult(
+        "mutate",
+        "service",
+        "connect",
+        "E_INVALID_INPUT",
+        "connect requires either --token (token-direct) or --code + --code-verifier + --redirect-uri (paste-code)",
+        startTime
+      );
+    } catch (err) {
+      return errorResult("mutate", "service", "connect", "E_INTERNAL", messageOf(err), startTime);
+    }
+  }
+  /** Delegate `service.revoke` to CORE `deleteConnectionCascade` (hard delete + cascade). */
+  async revoke(params, startTime) {
+    const provider = typeof params?.provider === "string" ? params.provider : void 0;
+    const label = typeof params?.label === "string" ? params.label : void 0;
+    if (!provider || !label) {
+      return errorResult(
+        "mutate",
+        "service",
+        "revoke",
+        "E_INVALID_INPUT",
+        "provider and label are required",
+        startTime
+      );
+    }
+    try {
+      const result = await deleteConnectionCascade(provider, label);
+      return wrapResult(
+        {
+          success: true,
+          data: {
+            count: result.deleted ? 1 : 0,
+            deleted: result.deleted ? [`${provider}:${label}`] : [],
+            grantsRemoved: result.grantsRemoved
+          }
+        },
+        "mutate",
+        "service",
+        "revoke",
+        startTime
+      );
+    } catch (err) {
+      return errorResult("mutate", "service", "revoke", "E_INTERNAL", messageOf(err), startTime);
+    }
+  }
+  /** Delegate `service.exchange` to CORE `exchangeCode`. */
+  async exchange(params, startTime) {
+    const provider = typeof params?.provider === "string" ? params.provider : void 0;
+    const code = typeof params?.code === "string" ? params.code : void 0;
+    const codeVerifier = typeof params?.codeVerifier === "string" ? params.codeVerifier : void 0;
+    const redirectUri = typeof params?.redirectUri === "string" ? params.redirectUri : void 0;
+    if (!provider || !code || !codeVerifier || !redirectUri) {
+      return errorResult(
+        "mutate",
+        "service",
+        "exchange",
+        "E_INVALID_INPUT",
+        "provider, code, codeVerifier, redirectUri are required",
+        startTime
+      );
+    }
+    const opts = {
+      code,
+      codeVerifier,
+      redirectUri,
+      ...typeof params?.label === "string" ? { label: params.label } : {}
+    };
+    try {
+      const result = await exchangeCode(provider, opts);
+      return wrapResult(
+        {
+          success: true,
+          data: { count: 1, created: [String(result.connectionId)], connection: result }
+        },
+        "mutate",
+        "service",
+        "exchange",
+        startTime
+      );
+    } catch (err) {
+      return errorResult("mutate", "service", "exchange", "E_INTERNAL", messageOf(err), startTime);
+    }
+  }
+  /** Delegate `service.refresh` to CORE `refreshAccessToken` via the self-heal persist path. */
+  async refresh(params, startTime) {
+    const agentId = typeof params?.agentId === "string" ? params.agentId : void 0;
+    const provider = typeof params?.provider === "string" ? params.provider : void 0;
+    const label = typeof params?.label === "string" ? params.label : void 0;
+    if (!agentId || !provider || !label) {
+      return errorResult(
+        "mutate",
+        "service",
+        "refresh",
+        "E_INVALID_INPUT",
+        "agentId, provider, label are required",
+        startTime
+      );
+    }
+    try {
+      const result = await selfHealConnection({
+        agentId,
+        provider,
+        label,
+        skewSeconds: Number.MAX_SAFE_INTEGER / 1e3,
+        ...params?.approved === true ? { approved: true } : {}
+      });
+      if (result.sealed === null) {
+        return errorResult(
+          "mutate",
+          "service",
+          "refresh",
+          "E_NOT_FOUND",
+          "connection not found, not active, or access denied",
+          startTime
+        );
+      }
+      return wrapResult(
+        {
+          success: true,
+          data: {
+            count: 1,
+            updated: [`${provider}:${label}`],
+            refreshed: result.refreshed,
+            expiresAt: result.expiresAt
+          }
+        },
+        "mutate",
+        "service",
+        "refresh",
+        startTime
+      );
+    } catch (err) {
+      return errorResult("mutate", "service", "refresh", "E_INTERNAL", messageOf(err), startTime);
+    }
+  }
+  /** Delegate `service.self-heal` to CORE `selfHealConnection`. */
+  async selfHeal(params, startTime) {
+    const agentId = typeof params?.agentId === "string" ? params.agentId : void 0;
+    const provider = typeof params?.provider === "string" ? params.provider : void 0;
+    const label = typeof params?.label === "string" ? params.label : void 0;
+    if (!agentId || !provider || !label) {
+      return errorResult(
+        "mutate",
+        "service",
+        "self-heal",
+        "E_INVALID_INPUT",
+        "agentId, provider, label are required",
+        startTime
+      );
+    }
+    try {
+      const result = await selfHealConnection({
+        agentId,
+        provider,
+        label,
+        ...params?.approved === true ? { approved: true } : {}
+      });
+      return wrapResult(
+        {
+          success: true,
+          data: {
+            count: result.refreshed ? 1 : 0,
+            updated: result.refreshed ? [`${provider}:${label}`] : [],
+            resolved: result.sealed !== null,
+            refreshed: result.refreshed,
+            expiresAt: result.expiresAt
+          }
+        },
+        "mutate",
+        "service",
+        "self-heal",
+        startTime
+      );
+    } catch (err) {
+      return errorResult("mutate", "service", "self-heal", "E_INTERNAL", messageOf(err), startTime);
+    }
+  }
+  /** Return declared operations for introspection and registry validation. */
+  getSupportedOperations() {
+    return {
+      query: ["auth-url", "list", "status"],
+      mutate: ["connect", "exchange", "refresh", "revoke", "self-heal"]
+    };
+  }
+};
+function messageOf(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function expiryOf(params) {
+  return typeof params?.expiresAt === "string" ? params.expiresAt : null;
+}
+function buildConnectParams(provider, label, params, token) {
+  const refreshToken = typeof params?.refreshToken === "string" ? params.refreshToken : void 0;
+  const scopes = Array.isArray(params?.scopes) ? params.scopes.filter((s) => typeof s === "string") : void 0;
+  return {
+    provider,
+    label,
+    tokens: { accessToken: token, ...refreshToken !== void 0 ? { refreshToken } : {} },
+    ...scopes !== void 0 ? { scopes } : {},
+    ...typeof params?.expiresAt === "string" ? { expiresAt: params.expiresAt } : {}
+  };
+}
+function buildExchangeOpts(params, code, label) {
+  const codeVerifier = typeof params?.codeVerifier === "string" ? params.codeVerifier : void 0;
+  const redirectUri = typeof params?.redirectUri === "string" ? params.redirectUri : void 0;
+  if (codeVerifier === void 0 || redirectUri === void 0) return null;
+  return { code, codeVerifier, redirectUri, label };
+}
+function toHealthView(v) {
+  const expired = v.status === "expired" || v.expiresAt !== null && Number.isFinite(Date.parse(v.expiresAt)) && Date.parse(v.expiresAt) <= Date.now();
+  return {
+    provider: v.provider,
+    label: v.label,
+    status: v.status,
+    expiresAt: v.expiresAt,
+    expired,
+    needsRefresh: expired && v.hasCredentials,
+    hasCredentials: v.hasCredentials
+  };
+}
+export {
+  ServiceHandler
+};
+//# sourceMappingURL=service-GLOMZWPQ.js.map

package/dist/cli/{session-3C6AAC4Y.js → session-HYUXAQGC.js}

@@ -13,25 +13,26 @@
     return _origEmitWarning.call(process, warning, type, code, ctor);
   };
 })();
-import {
-  defineCommand,
-  showUsage
-} from "./chunk-PKKZPOOP.js";
 import {
   dispatchFromCli,
   dispatchRaw,
   handleRawError
-} from "./chunk-3IOQVUO7.js";
-import "./chunk-AWCQH2W5.js";
-import "./chunk-OGV57L4J.js";
-import "./chunk-ZBISIPCK.js";
+} from "./chunk-L7ONYSV6.js";
+import "./chunk-6N6WGLXE.js";
+import "./chunk-4VASFLUW.js";
+import {
+  defineCommand,
+  showUsage
+} from "./chunk-PKKZPOOP.js";
+import "./chunk-QKMBWYAS.js";
 import {
   cliError,
   cliOutput,
   humanWarn
-} from "./chunk-3ZO3M37V.js";
+} from "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
-import "./chunk-QFFQSKRC.js";
+import "./chunk-D7BAQNV2.js";
+import "./chunk-TYC7G5LF.js";
 
 // packages/cleo/src/cli/commands/session.ts
 import { ExitCode } from "@cleocode/contracts";
@@ -704,4 +705,4 @@ var sessionCommand = defineCommand({
 export {
   sessionCommand
 };
-//# sourceMappingURL=session-3C6AAC4Y.js.map
+//# sourceMappingURL=session-HYUXAQGC.js.map