@cuna_labs/cli 0.1.0

package/dist/core/instant.js

@@ -0,0 +1,90 @@
+/**
+ * The one authority in this CLI for reading a timestamp another system wrote.
+ *
+ * This file exists because the same defect was found four times on 2026-08-18,
+ * in three languages, and each one was first fixed locally as if it were a typo:
+ *
+ *   infra edge/src/supervisor-attachment-authority.ts  ticket.expires_at !== expiresAt
+ *   infra assets/agent-session-supervisor.py           value.endswith("Z")
+ *   cuna-cli src/workspace/binding-store.ts            new Date(t).toISOString() !== t
+ *   cuna-cli src/runtime/terminal-transport.ts         /\.[0-9]{3}Z$/
+ *
+ * Every one compares an ENCODING where it means to compare an INSTANT, and every
+ * one is correct wherever a single process both writes and reads the value —
+ * which is exactly why they survived review. Nothing in the code separated "we
+ * minted this" from "they minted this", so one idiom was harmless in one file
+ * and fatal in the next.
+ *
+ * The two encodings, both measured against production 2026-08-18:
+ *
+ *   JavaScript toISOString()    2026-08-18T21:00:00.000Z          3 digits, `Z`
+ *   PostgREST over timestamptz  2026-08-18T20:49:24.458909+00:00  up to 6, `+00:00`
+ *
+ * They are never string-equal. The API contract settles which is correct: 36
+ * properties carry `format: "date-time"`, which in OpenAPI 3.1 is RFC 3339 §5.6
+ * and admits both, at any fractional precision. So neither renderer was wrong;
+ * every one of those comparisons was NARROWER THAN THE CONTRACT it implements.
+ *
+ * `infra` carries the mirror of this module at `edge/src/instant.ts`. Two copies
+ * of one rule is itself the shape this workspace keeps closing, and it is
+ * accepted here only because the CLI ships as a standalone npm package with no
+ * dependency on the service repository. If a shared package ever exists, this is
+ * one of the first things that should move into it.
+ *
+ * What this module is NOT for: a value this CLI minted itself. Where the CLI is
+ * both writer and reader — `src/auth/human-session.ts`, whose stored
+ * `login_code_expires_at` is normalized to canonical form by
+ * `src/auth/human-contracts.ts` before it is ever written — an exact-encoding
+ * check is a correct integrity check on our own file, and widening it would
+ * weaken it for nothing.
+ */
+/**
+ * RFC 3339 §5.6 `date-time`: any fractional precision, and an explicit offset —
+ * `Z` or `+hh:mm`/`-hh:mm`.
+ *
+ * The one thing it refuses is the one thing that is genuinely ambiguous. A value
+ * with NO offset is not an instant: `Date.parse` reads it in the HOST's local
+ * zone, so the same bytes name different moments on two machines in different
+ * regions and each is certain it is right. Measured on this host,
+ * `2026-08-18T20:49:24.458909` parses six hours away from the same digits with
+ * `+00:00`. Refused, never guessed.
+ *
+ * It is otherwise exactly as wide as the contract, on purpose. `infra`'s mirror
+ * at `edge/src/instant.ts` restricts the offset to zero (`Z` or `±00:00`), which
+ * is narrower than `format: "date-time"` admits — the same class of narrowing
+ * this module exists to repair, merely one step further out. Nothing produces a
+ * non-zero offset today, and "nothing produces it today" is the reasoning that
+ * put four of these in the tree. This regex is character-identical to the
+ * `RFC3339` already in `src/auth/human-contracts.ts`, which is the other place
+ * this repo reads a service-rendered instant.
+ */
+const RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/u;
+/**
+ * The epoch milliseconds of an RFC 3339 instant, or `null` if the value is not
+ * one.
+ *
+ * Note the deliberate lossiness: `Date.parse` truncates below the millisecond,
+ * so `…458909+00:00` and `…458+00:00` are the same number here. That is the
+ * right resolution for these call sites — each is checking that a store echoed
+ * back a moment, and the sub-millisecond digits are the store's own precision,
+ * never information the CLI supplied. A caller that genuinely needs exact bytes
+ * should compare bytes and say why.
+ */
+export function instantOrNull(value) {
+    if (typeof value !== "string" || !RFC3339.test(value))
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : null;
+}
+/**
+ * True when both arguments name the same moment, whatever rendered them.
+ *
+ * `false` whenever either side is not an RFC 3339 instant, so an unparseable
+ * value never compares equal to anything, including itself.
+ */
+export function sameInstant(left, right) {
+    const a = instantOrNull(left);
+    const b = instantOrNull(right);
+    return a !== null && b !== null && a === b;
+}
+//# sourceMappingURL=instant.js.map

package/dist/core/instant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instant.js","sourceRoot":"","sources":["../../src/core/instant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,GAAG,uEAAuE,CAAC;AAExF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAa,EAAE,KAAc;IACvD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC"}

package/dist/core/namespace.d.ts

@@ -0,0 +1,171 @@
+/**
+ * The single authority on every namespace this CLI accepts.
+ *
+ * A namespace is minted by the service and accepted by the client. When the two
+ * are written independently, a rename lands on one side only and the client
+ * starts rejecting values the service still issues — with no compile error and
+ * no test failure. That is exactly how the CLI came to reject every issued
+ * `runa_sk_` API key, throw on every stored key row, and silently discard every
+ * Problem document minted at `api.runacode.io`.
+ *
+ * Every accepted brand, credential family, service origin and configuration
+ * environment-variable name is therefore enumerated here exactly once, and
+ * every call site tests through a predicate exported from this module. Widening
+ * the product's acceptance is a one-line edit in this file; a one-sided edit
+ * somewhere else is no longer expressible.
+ *
+ * These lists may only ever GROW. Removing a brand, a family infix, or an
+ * origin silently rejects credentials and documents that are still live in
+ * production, and for the secret detector it silently starts uploading material
+ * that is blocked today.
+ */
+/**
+ * Every brand the product has minted credentials under. `cuna` is the current
+ * mint; `runa` predates the rename and remains valid indefinitely because keys
+ * issued under it were never revoked.
+ */
+export declare const CREDENTIAL_BRANDS: readonly ["cuna", "runa"];
+export type CredentialBrand = (typeof CREDENTIAL_BRANDS)[number];
+/**
+ * Configuration names are Cuna-only except for `RUNA_API_KEY`, the published
+ * automation alias from the earlier CLI. The canonical name is first so its
+ * presence always wins, including when its value is empty or malformed; a
+ * broken canonical credential must never fall through to stale legacy
+ * authority. No other earlier-brand configuration name is admitted.
+ */
+export declare function brandedEnvironmentNames(suffix: string): readonly string[];
+/** One environment read, carrying the name that actually supplied the value. */
+export interface BrandedEnvironmentValue {
+    readonly name: string;
+    readonly value: string;
+}
+/**
+ * The value of `suffix` under the highest-precedence brand that sets it, with
+ * the variable name that supplied it. The name is returned rather than
+ * discarded so a diagnostic can tell the user which of the accepted spellings
+ * it actually read — with two live names, "correct your configuration" without
+ * a name is not actionable.
+ */
+export declare function readBrandedEnvironment(environment: Readonly<Record<string, string | undefined>>, suffix: string): BrandedEnvironmentValue | undefined;
+/**
+ * Every credential family infix the product has ever issued. Families without a
+ * wire validator below still belong here: the workspace secret detector is a
+ * denylist and must recognize all of them.
+ */
+export declare const CREDENTIAL_FAMILY_INFIXES: readonly ["sk", "at", "rt", "ct", "tc", "se", "sc", "cb", "cr", "login"];
+export type CredentialFamilyInfix = (typeof CREDENTIAL_FAMILY_INFIXES)[number];
+/**
+ * Every origin the service has minted absolute URLs under. `api.runacode.io` is
+ * what production mints today; `api.getcuna.com` is the renamed origin the
+ * contract declares. Both must decode.
+ */
+export declare const API_ORIGINS: readonly ["https://api.getcuna.com", "https://api.runacode.io"];
+export type ApiOrigin = (typeof API_ORIGINS)[number];
+/** The same origins as WebSocket authorities, for stream URLs. */
+export declare const API_WEBSOCKET_ORIGINS: readonly string[];
+/**
+ * Wire grammar per validated family. The infix is drawn from
+ * `CREDENTIAL_FAMILY_INFIXES` so a family can never be validated under a
+ * spelling the detector does not also recognize.
+ */
+declare const CREDENTIAL_GRAMMAR: Readonly<{
+    secretKey: Readonly<{
+        infix: "sk";
+        suffix: "[A-Za-z0-9_-]{16,256}";
+    }>;
+    accessToken: Readonly<{
+        infix: "at";
+        suffix: "[A-Za-z0-9_-]{43}";
+    }>;
+    loginCode: Readonly<{
+        infix: "login";
+        suffix: "[A-Za-z0-9_-]{43}";
+    }>;
+    terminalConnect: Readonly<{
+        infix: "tc";
+        suffix: "[A-Za-z0-9_-]{43}";
+    }>;
+    browserCallbackNonce: Readonly<{
+        infix: "cb";
+        suffix: "[A-Za-z0-9_-]{43}";
+    }>;
+    browserResumeHandle: Readonly<{
+        infix: "cr";
+        suffix: "[A-Za-z0-9_-]{43}";
+    }>;
+    supervisorControl: Readonly<{
+        infix: "sc";
+        suffix: "[A-Za-z0-9_-]{43}";
+    }>;
+}>;
+export type CredentialFamily = keyof typeof CREDENTIAL_GRAMMAR;
+/**
+ * Families that are minted but have no wire grammar here yet. This list is the
+ * reason the hand-rolled copies existed: `cb` was in the infix list with no
+ * grammar entry, so a call site that needed to validate a callback nonce had
+ * nothing to import and wrote its own regex. Every entry here is therefore a
+ * standing invitation to repeat that, and the accompanying test forces a family
+ * to be either validated or explicitly listed — never silently absent.
+ *
+ * `se` remains here because its minted suffix shape has not been observed. Do
+ * not guess one: a grammar narrower than the mint rejects live credentials.
+ */
+export declare const CREDENTIAL_FAMILIES_WITHOUT_WIRE_GRAMMAR: readonly ["rt", "ct", "se"];
+/**
+ * Unanchored source matching the brand and family opening of any credential the
+ * product issues. Exported for the workspace secret detector, which needs its
+ * own boundary guard around this fragment.
+ */
+export declare const CREDENTIAL_OPENING_SOURCE: string;
+/** A programmatic API key as the service mints it, in any brand. */
+export declare function isSecretApiKey(value: string): boolean;
+/** The non-secret `*_sk_` display prefix carried by a stored API key row. */
+export declare function isApiKeyDisplayPrefix(value: string): boolean;
+/** Any credential the HTTP transport may present as a bearer. */
+export declare function isTransportCredential(value: string): boolean;
+/** An interactive CLI access token. */
+export declare function isAccessToken(value: string): boolean;
+/** Durable browser-issued CLI login credential; never a product API bearer. */
+export declare function isLoginCode(value: string): boolean;
+/** A one-use terminal connection token. */
+export declare function isTerminalConnectToken(value: string): boolean;
+/** The nonce the browser carries back from a human sign-in handoff. */
+export declare function isBrowserCallbackNonce(value: string): boolean;
+/**
+ * The validator for one family infix, or `undefined` when that family has no
+ * wire grammar yet. Prefer the named predicates above at fixed call sites; this
+ * exists so a test can prove every minted family is either validated here or
+ * explicitly recorded as unvalidated.
+ */
+export declare function credentialFamilyValidator(infix: string): ((value: string) => boolean) | undefined;
+/**
+ * Unanchored source matching a complete credential value of ANY brand and ANY
+ * family, with the shortest suffix a leaked secret could plausibly carry.
+ *
+ * This is the denylist half of the authority. It exists because the public
+ * response decoder previously carried its own hand-written copy of the family
+ * list that had gone stale at five of eight families — it did not know `se`,
+ * `sc` or `cb`, so an audit summary containing a live `runa_sc_…` supervisor
+ * bearer decoded cleanly and was printed to the operator's terminal and, under
+ * `--json`, into CI logs. A denylist assembled anywhere but here is the same
+ * bug waiting for the next family.
+ */
+export declare const CREDENTIAL_VALUE_SOURCE: string;
+/**
+ * Whether `value` contains a credential of any brand and any family, anywhere
+ * inside it. Use this — never a local regex — before printing, forwarding or
+ * persisting a string the service controls.
+ */
+export declare function containsCredentialValue(value: string): boolean;
+/**
+ * A canonical Problem `type` URI under any origin the service mints. A miss
+ * here discards `code`, `request_id` and `retryable` from a server error, so
+ * retry and backoff degrade with no signal — never narrow it.
+ */
+export declare function isProblemType(value: string): boolean;
+/** The Problem `type` URI that exactly names `code`, under any minted origin. */
+export declare function isProblemTypeForCode(value: string, code: string): boolean;
+/** The terminal stream URL for `terminalSessionId`, under any minted origin. */
+export declare function isTerminalStreamUrl(value: string, terminalSessionId: string): boolean;
+export {};
+//# sourceMappingURL=namespace.d.ts.map

package/dist/core/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/core/namespace.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,2BAAgF,CAAC;AAE/G,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAIzE;AAED,gFAAgF;AAChF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACzD,MAAM,EAAE,MAAM,GACb,uBAAuB,GAAG,SAAS,CAMrC;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,0EAe3B,CAAC;AAEZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,WAAW,iEAGb,CAAC;AAEZ,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,mBAEjC,CAAC;AAKF;;;;GAIG;AACH,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQiF,CAAC;AAE1G,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,kBAAkB,CAAC;AAE/D;;;;;;;;;;GAUG;AAIH,eAAO,MAAM,wCAAwC,6BAA6C,CAAC;AAInG;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,QACuB,CAAC;AAyB9D,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,uCAAuC;AACvC,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,2CAA2C;AAC3C,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,uEAAuE;AACvE,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7D;AAOD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,SAAS,CAGjG;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,QAAmD,CAAC;AAIxF;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9D;AAUD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAIrF"}

package/dist/core/namespace.js

@@ -0,0 +1,227 @@
+import { DEPLOYED_WIRE_COMPATIBILITY } from "./deployed-wire-compatibility.js";
+/**
+ * The single authority on every namespace this CLI accepts.
+ *
+ * A namespace is minted by the service and accepted by the client. When the two
+ * are written independently, a rename lands on one side only and the client
+ * starts rejecting values the service still issues — with no compile error and
+ * no test failure. That is exactly how the CLI came to reject every issued
+ * `runa_sk_` API key, throw on every stored key row, and silently discard every
+ * Problem document minted at `api.runacode.io`.
+ *
+ * Every accepted brand, credential family, service origin and configuration
+ * environment-variable name is therefore enumerated here exactly once, and
+ * every call site tests through a predicate exported from this module. Widening
+ * the product's acceptance is a one-line edit in this file; a one-sided edit
+ * somewhere else is no longer expressible.
+ *
+ * These lists may only ever GROW. Removing a brand, a family infix, or an
+ * origin silently rejects credentials and documents that are still live in
+ * production, and for the secret detector it silently starts uploading material
+ * that is blocked today.
+ */
+/**
+ * Every brand the product has minted credentials under. `cuna` is the current
+ * mint; `runa` predates the rename and remains valid indefinitely because keys
+ * issued under it were never revoked.
+ */
+export const CREDENTIAL_BRANDS = Object.freeze(["cuna", DEPLOYED_WIRE_COMPATIBILITY.credentialBrand]);
+/**
+ * Configuration names are Cuna-only except for `RUNA_API_KEY`, the published
+ * automation alias from the earlier CLI. The canonical name is first so its
+ * presence always wins, including when its value is empty or malformed; a
+ * broken canonical credential must never fall through to stale legacy
+ * authority. No other earlier-brand configuration name is admitted.
+ */
+export function brandedEnvironmentNames(suffix) {
+    return suffix === "API_KEY"
+        ? Object.freeze(["CUNA_API_KEY", DEPLOYED_WIRE_COMPATIBILITY.apiKeyEnvironment])
+        : Object.freeze([`CUNA_${suffix}`]);
+}
+/**
+ * The value of `suffix` under the highest-precedence brand that sets it, with
+ * the variable name that supplied it. The name is returned rather than
+ * discarded so a diagnostic can tell the user which of the accepted spellings
+ * it actually read — with two live names, "correct your configuration" without
+ * a name is not actionable.
+ */
+export function readBrandedEnvironment(environment, suffix) {
+    for (const name of brandedEnvironmentNames(suffix)) {
+        const value = environment[name];
+        if (value !== undefined)
+            return Object.freeze({ name, value });
+    }
+    return undefined;
+}
+/**
+ * Every credential family infix the product has ever issued. Families without a
+ * wire validator below still belong here: the workspace secret detector is a
+ * denylist and must recognize all of them.
+ */
+export const CREDENTIAL_FAMILY_INFIXES = Object.freeze([
+    // sk secret key · at access token · rt refresh token · ct continuation
+    // tc terminal connect · se/sc session credentials · cb browser callback nonce
+    // cr browser continuation resume handle
+    //
+    // `cb` was absent while the service minted `cuna_cb_…` for every human
+    // sign-in, so the workspace secret detector uploaded it instead of blocking
+    // it — exactly the failure this module's header warns about.
+    //
+    // `cr` repeated that failure one family later, in a repository this module
+    // does not reach: the console mints `cuna_cr_…` from 32 random bytes as a
+    // continuation resume handle and puts it in localStorage, a BroadcastChannel
+    // name and a URL fragment. It is a bearer capability, so a resume link pasted
+    // into a synced workspace was uploaded rather than blocked.
+    "sk", "at", "rt", "ct", "tc", "se", "sc", "cb", "cr", "login",
+]);
+/**
+ * Every origin the service has minted absolute URLs under. `api.runacode.io` is
+ * what production mints today; `api.getcuna.com` is the renamed origin the
+ * contract declares. Both must decode.
+ */
+export const API_ORIGINS = Object.freeze([
+    "https://api.getcuna.com",
+    DEPLOYED_WIRE_COMPATIBILITY.apiOrigin,
+]);
+/** The same origins as WebSocket authorities, for stream URLs. */
+export const API_WEBSOCKET_ORIGINS = Object.freeze(API_ORIGINS.map((origin) => `wss://${new URL(origin).host}`));
+/** Opaque suffix of every 32-byte base64url secret the service mints. */
+const OPAQUE_SECRET = "[A-Za-z0-9_-]{43}";
+/**
+ * Wire grammar per validated family. The infix is drawn from
+ * `CREDENTIAL_FAMILY_INFIXES` so a family can never be validated under a
+ * spelling the detector does not also recognize.
+ */
+const CREDENTIAL_GRAMMAR = Object.freeze({
+    secretKey: Object.freeze({ infix: "sk", suffix: "[A-Za-z0-9_-]{16,256}" }),
+    accessToken: Object.freeze({ infix: "at", suffix: OPAQUE_SECRET }),
+    loginCode: Object.freeze({ infix: "login", suffix: OPAQUE_SECRET }),
+    terminalConnect: Object.freeze({ infix: "tc", suffix: OPAQUE_SECRET }),
+    browserCallbackNonce: Object.freeze({ infix: "cb", suffix: OPAQUE_SECRET }),
+    browserResumeHandle: Object.freeze({ infix: "cr", suffix: OPAQUE_SECRET }),
+    supervisorControl: Object.freeze({ infix: "sc", suffix: OPAQUE_SECRET }),
+});
+/**
+ * Families that are minted but have no wire grammar here yet. This list is the
+ * reason the hand-rolled copies existed: `cb` was in the infix list with no
+ * grammar entry, so a call site that needed to validate a callback nonce had
+ * nothing to import and wrote its own regex. Every entry here is therefore a
+ * standing invitation to repeat that, and the accompanying test forces a family
+ * to be either validated or explicitly listed — never silently absent.
+ *
+ * `se` remains here because its minted suffix shape has not been observed. Do
+ * not guess one: a grammar narrower than the mint rejects live credentials.
+ */
+// `ct` remains a denylist-only historical family: detecting a leaked former
+// continuation credential is necessary, but this CLI no longer authenticates
+// or transports one.
+export const CREDENTIAL_FAMILIES_WITHOUT_WIRE_GRAMMAR = Object.freeze(["rt", "ct", "se"]);
+const BRAND_GROUP = `(?:${CREDENTIAL_BRANDS.join("|")})`;
+/**
+ * Unanchored source matching the brand and family opening of any credential the
+ * product issues. Exported for the workspace secret detector, which needs its
+ * own boundary guard around this fragment.
+ */
+export const CREDENTIAL_OPENING_SOURCE = `${BRAND_GROUP}_(?:${CREDENTIAL_FAMILY_INFIXES.join("|")})`;
+function credentialPattern(...families) {
+    const alternatives = families
+        .map((family) => `${CREDENTIAL_GRAMMAR[family].infix}_${CREDENTIAL_GRAMMAR[family].suffix}`)
+        .join("|");
+    return new RegExp(`^${BRAND_GROUP}_(?:${alternatives})$`, "u");
+}
+const SECRET_API_KEY = credentialPattern("secretKey");
+const TRANSPORT_CREDENTIAL = credentialPattern("secretKey", "accessToken");
+const ACCESS_TOKEN = credentialPattern("accessToken");
+const LOGIN_CODE = credentialPattern("loginCode");
+const TERMINAL_CONNECT_TOKEN = credentialPattern("terminalConnect");
+const BROWSER_CALLBACK_NONCE = credentialPattern("browserCallbackNonce");
+/**
+ * The non-secret display prefix stored on an API key row and returned by
+ * `key list`. Pre-rename rows carry `runa_sk_`; both spellings are live.
+ */
+const API_KEY_DISPLAY_PREFIX = new RegExp(`^${BRAND_GROUP}_${CREDENTIAL_GRAMMAR.secretKey.infix}_[A-Za-z0-9_-]{0,12}$`, "u");
+/** A programmatic API key as the service mints it, in any brand. */
+export function isSecretApiKey(value) {
+    return SECRET_API_KEY.test(value);
+}
+/** The non-secret `*_sk_` display prefix carried by a stored API key row. */
+export function isApiKeyDisplayPrefix(value) {
+    return API_KEY_DISPLAY_PREFIX.test(value);
+}
+/** Any credential the HTTP transport may present as a bearer. */
+export function isTransportCredential(value) {
+    return TRANSPORT_CREDENTIAL.test(value);
+}
+/** An interactive CLI access token. */
+export function isAccessToken(value) {
+    return ACCESS_TOKEN.test(value);
+}
+/** Durable browser-issued CLI login credential; never a product API bearer. */
+export function isLoginCode(value) {
+    return LOGIN_CODE.test(value) && value.startsWith("cuna_login_");
+}
+/** A one-use terminal connection token. */
+export function isTerminalConnectToken(value) {
+    return TERMINAL_CONNECT_TOKEN.test(value);
+}
+/** The nonce the browser carries back from a human sign-in handoff. */
+export function isBrowserCallbackNonce(value) {
+    return BROWSER_CALLBACK_NONCE.test(value) && value.startsWith("cuna_cb_");
+}
+const FAMILY_VALIDATORS = new Map(Object.keys(CREDENTIAL_GRAMMAR)
+    .map((family) => [CREDENTIAL_GRAMMAR[family].infix, credentialPattern(family)]));
+/**
+ * The validator for one family infix, or `undefined` when that family has no
+ * wire grammar yet. Prefer the named predicates above at fixed call sites; this
+ * exists so a test can prove every minted family is either validated here or
+ * explicitly recorded as unvalidated.
+ */
+export function credentialFamilyValidator(infix) {
+    const pattern = FAMILY_VALIDATORS.get(infix);
+    return pattern === undefined ? undefined : (value) => pattern.test(value);
+}
+/**
+ * Unanchored source matching a complete credential value of ANY brand and ANY
+ * family, with the shortest suffix a leaked secret could plausibly carry.
+ *
+ * This is the denylist half of the authority. It exists because the public
+ * response decoder previously carried its own hand-written copy of the family
+ * list that had gone stale at five of eight families — it did not know `se`,
+ * `sc` or `cb`, so an audit summary containing a live `runa_sc_…` supervisor
+ * bearer decoded cleanly and was printed to the operator's terminal and, under
+ * `--json`, into CI logs. A denylist assembled anywhere but here is the same
+ * bug waiting for the next family.
+ */
+export const CREDENTIAL_VALUE_SOURCE = `${CREDENTIAL_OPENING_SOURCE}_[A-Za-z0-9_-]{8,}`;
+const CREDENTIAL_VALUE = new RegExp(CREDENTIAL_VALUE_SOURCE, "u");
+/**
+ * Whether `value` contains a credential of any brand and any family, anywhere
+ * inside it. Use this — never a local regex — before printing, forwarding or
+ * persisting a string the service controls.
+ */
+export function containsCredentialValue(value) {
+    return CREDENTIAL_VALUE.test(value);
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+const ORIGIN_GROUP = `(?:${API_ORIGINS.map(escapeRegExp).join("|")})`;
+const PROBLEM_CODE_SOURCE = "[a-z][a-z0-9_]{2,63}";
+const PROBLEM_TYPE = new RegExp(`^${ORIGIN_GROUP}/problems/${PROBLEM_CODE_SOURCE}$`, "u");
+/**
+ * A canonical Problem `type` URI under any origin the service mints. A miss
+ * here discards `code`, `request_id` and `retryable` from a server error, so
+ * retry and backoff degrade with no signal — never narrow it.
+ */
+export function isProblemType(value) {
+    return PROBLEM_TYPE.test(value);
+}
+/** The Problem `type` URI that exactly names `code`, under any minted origin. */
+export function isProblemTypeForCode(value, code) {
+    return API_ORIGINS.some((origin) => value === `${origin}/problems/${code}`);
+}
+/** The terminal stream URL for `terminalSessionId`, under any minted origin. */
+export function isTerminalStreamUrl(value, terminalSessionId) {
+    return API_WEBSOCKET_ORIGINS.some((origin) => value === `${origin}/v1/terminal-connections/${terminalSessionId}/stream`);
+}
+//# sourceMappingURL=namespace.js.map

package/dist/core/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../src/core/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,2BAA2B,CAAC,eAAe,CAAU,CAAC,CAAC;AAI/G;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;QAChF,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAyD,EACzD,MAAc;IAEd,KAAK,MAAM,IAAI,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC;IACrD,uEAAuE;IACvE,8EAA8E;IAC9E,wCAAwC;IACxC,EAAE;IACF,uEAAuE;IACvE,4EAA4E;IAC5E,6DAA6D;IAC7D,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,4DAA4D;IAC5D,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;CACrD,CAAC,CAAC;AAIZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;IACvC,yBAAyB;IACzB,2BAA2B,CAAC,SAAS;CAC7B,CAAC,CAAC;AAIZ,kEAAkE;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAChD,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAC7D,CAAC;AAEF,yEAAyE;AACzE,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC1E,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAClE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtE,oBAAoB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC3E,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC1E,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;CACzE,CAAwG,CAAC;AAI1G;;;;;;;;;;GAUG;AACH,4EAA4E;AAC5E,6EAA6E;AAC7E,qBAAqB;AACrB,MAAM,CAAC,MAAM,wCAAwC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC,CAAC;AAEnG,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GACpC,GAAG,WAAW,OAAO,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAE9D,SAAS,iBAAiB,CAAC,GAAG,QAAqC;IACjE,MAAM,YAAY,GAAG,QAAQ;SAC1B,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;SAC3F,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,IAAI,MAAM,CAAC,IAAI,WAAW,OAAO,YAAY,IAAI,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,cAAc,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;AACtD,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAC3E,MAAM,YAAY,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;AACtD,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;AAClD,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;AACpE,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,sBAAsB,GAAG,IAAI,MAAM,CACvC,IAAI,WAAW,IAAI,kBAAkB,CAAC,SAAS,CAAC,KAAK,uBAAuB,EAC5E,GAAG,CACJ,CAAC;AAEF,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AACnE,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,iBAAiB,GAAgC,IAAI,GAAG,CAC3D,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAiC;KAC7D,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAU,CAAC,CAC3F,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,yBAAyB,oBAAoB,CAAC;AAExF,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;AAElE;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACtE,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AACnD,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,IAAI,YAAY,aAAa,mBAAmB,GAAG,EAAE,GAAG,CAAC,CAAC;AAE1F;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,IAAY;IAC9D,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,MAAM,aAAa,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,iBAAyB;IAC1E,OAAO,qBAAqB,CAAC,IAAI,CAC/B,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,MAAM,4BAA4B,iBAAiB,SAAS,CACtF,CAAC;AACJ,CAAC"}