@dharma-ai-labs/agent-fabric 0.2.132 → 0.2.133

package/dist/onboardingContract.test.js

@@ -10,8 +10,19 @@ test('the installed onboarding contract forbids product-code workarounds', async
     assert.match(contract, /do not bypass enrollment/i);
     assert.match(contract, /exact failed stage, non-sensitive error, and correlation ID/i);
     assert.match(contract, /supported retry, reconciliation, rollback, or browser-authorized re-enrollment/i);
-    assert.match(contract, /one retry of the unchanged command is permitted before grant expiry/i);
-    assert.match(contract, /Never retry a grant after redemption/i);
+    assert.match(contract, /retry the unchanged command once before expiry when the receipt explicitly proves non-redemption/i);
+    assert.match(contract, /After redemption, approval or another error, use only the supported cause-specific grant-free recovery; never replay the grant/i);
+});
+test('the installed contract separates agent instructions from recipient-only private terminal entry', async () => {
+    const contract = await readFile(contractUrl, 'utf8');
+    assert.match(contract, /short-lived grant is a separate recipient-only private field, not part of the agent prompt/i);
+    assert.match(contract, /exact generated grant-free `--grant-prompt` command directly in their own private, unrecorded interactive terminal/i);
+    assert.match(contract, /Never receive, print, save, commit, place in argv or environment, send through agent tools or transport, or record that grant/i);
+    assert.match(contract, /cannot detect an external recorder or prove the human owns a TTY/i);
+    assert.match(contract, /no supplementary manual setup command/i);
+    assert.match(contract, /Join existing[\s\S]*No GitHub permission or source checkout is needed/i);
+    assert.match(contract, /legacy Demo command contract does not establish `--grant-prompt` support/i);
+    assert.doesNotMatch(contract, /only routine human action|setup envelope contains[\s\S]*one-time grant/i);
 });
 test('the installed guide names the supported knowledge and peer workflow', async () => {
     const contract = await readFile(contractUrl, 'utf8');

package/dist/onboardingContract.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"onboardingContract.test.js","sourceRoot":"","sources":["../src/onboardingContract.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,+BAA+B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE9E,IAAI,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;IACpF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAErD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,gDAAgD,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,0CAA0C,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,8DAA8D,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,iFAAiF,CAAC,CAAC;IAC1G,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,sEAAsE,CAAC,CAAC;IAC/F,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,uCAAuC,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACrF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAErD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,kHAAkH,CAAC,CAAC;IAC3I,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,gFAAgF,CAAC,CAAC;IACzG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,oHAAoH,CAAC,CAAC;IAC7I,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,8EAA8E,CAAC,CAAC;IACvG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,qDAAqD,CAAC,CAAC;IAC9E,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,iDAAiD,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,sDAAsD,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,wDAAwD,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,4EAA4E,CAAC,CAAC;IACrG,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC"}
+{"version":3,"file":"onboardingContract.test.js","sourceRoot":"","sources":["../src/onboardingContract.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,+BAA+B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE9E,IAAI,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;IACpF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAErD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,gDAAgD,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,0CAA0C,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,8DAA8D,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,iFAAiF,CAAC,CAAC;IAC1G,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,mGAAmG,CAAC,CAAC;IAC5H,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,iIAAiI,CAAC,CAAC;AAC5J,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;IAChH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,6FAA6F,CAAC,CAAC;IACtH,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,qHAAqH,CAAC,CAAC;IAC9I,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,gIAAgI,CAAC,CAAC;IACzJ,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,mEAAmE,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,wEAAwE,CAAC,CAAC;IACjG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,2EAA2E,CAAC,CAAC;IACpG,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,yEAAyE,CAAC,CAAC;AAC3G,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACrF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAErD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,kHAAkH,CAAC,CAAC;IAC3I,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,gFAAgF,CAAC,CAAC;IACzG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,oHAAoH,CAAC,CAAC;IAC7I,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,8EAA8E,CAAC,CAAC;IACvG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,qDAAqD,CAAC,CAAC;IAC9E,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,iDAAiD,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,sDAAsD,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,wDAAwD,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,4EAA4E,CAAC,CAAC;IACrG,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC"}

package/dist/privateGrantInput.d.ts

@@ -0,0 +1,27 @@
+import type { EventEmitter } from 'node:events';
+type TerminalInput = Pick<EventEmitter, 'on' | 'removeListener' | 'listenerCount'> & {
+    isTTY: boolean;
+    isRaw: boolean;
+    fd: number;
+    readableFlowing: boolean | null;
+    setRawMode(raw: boolean): unknown;
+    resume(): unknown;
+    pause(): unknown;
+};
+type TerminalOutput = {
+    isTTY: boolean;
+    fd: number;
+    write(value: string): unknown;
+};
+type Signals = Pick<EventEmitter, 'on' | 'removeListener'>;
+interface PrivateGrantTerminal {
+    input: TerminalInput;
+    output: TerminalOutput;
+    signals: Signals;
+    isTerminal: (fd: number) => boolean;
+}
+export declare function bootstrapGrantMode(flags: Map<string, string | boolean>): 'resume' | 'argument' | 'prompt';
+/** Read only from the user's own terminal. No pipe, environment, file or echo fallback. */
+export declare function readPrivateBootstrapGrant(terminal?: PrivateGrantTerminal): Promise<string>;
+export {};
+//# sourceMappingURL=privateGrantInput.d.ts.map

package/dist/privateGrantInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privateGrantInput.d.ts","sourceRoot":"","sources":["../src/privateGrantInput.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,KAAK,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,gBAAgB,GAAG,eAAe,CAAC,GAAG;IACnF,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5E,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;IAAC,MAAM,IAAI,OAAO,CAAC;IAAC,KAAK,IAAI,OAAO,CAAC;CACxE,CAAC;AACF,KAAK,cAAc,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AACpF,KAAK,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,gBAAgB,CAAC,CAAC;AAC3D,UAAU,oBAAoB;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;CACrC;AAKD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAYzG;AAED,2FAA2F;AAC3F,wBAAsB,yBAAyB,CAAC,QAAQ,GAAE,oBAGzD,GAAG,OAAO,CAAC,MAAM,CAAC,CAmFlB"}

package/dist/privateGrantInput.js

@@ -0,0 +1,159 @@
+import { isatty } from 'node:tty';
+const MAX_GRANT_BYTES = 16_384;
+const CANCEL_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT', 'SIGTSTP'];
+export function bootstrapGrantMode(flags) {
+    const grant = flags.get('grant');
+    const prompt = flags.get('grant-prompt');
+    if ((flags.has('resume') && (flags.has('grant') || flags.has('grant-prompt')))
+        || (flags.has('grant') && flags.has('grant-prompt'))
+        || (flags.has('grant-prompt') && prompt !== true)) {
+        throw new Error('bootstrap_grant_options_invalid: --grant-prompt takes no value and cannot be combined with --grant or --resume.');
+    }
+    if (flags.has('resume'))
+        return 'resume';
+    if (prompt === true)
+        return 'prompt';
+    if (typeof grant === 'string' && grant.length > 0)
+        return 'argument';
+    throw new Error('bootstrap_grant_options_invalid: use --grant-prompt for private terminal entry, or an existing supported --grant invocation.');
+}
+/** Read only from the user's own terminal. No pipe, environment, file or echo fallback. */
+export async function readPrivateBootstrapGrant(terminal = {
+    input: process.stdin, output: process.stderr,
+    signals: process, isTerminal: isatty,
+}) {
+    const { input, output, signals, isTerminal } = terminal;
+    if (!input.isTTY || !output.isTTY || !isTerminal(input.fd) || !isTerminal(output.fd)
+        || input.isRaw || input.listenerCount('data') !== 0) {
+        throw new Error('private_grant_terminal_required: run this command directly in your own interactive terminal; do not pipe, redirect or send the grant through an agent.');
+    }
+    const wasFlowing = input.readableFlowing;
+    const bytes = Buffer.alloc(MAX_GRANT_BYTES);
+    let length = 0;
+    let finished = false;
+    let escape = '';
+    let pasting = false;
+    let escapeTimer;
+    let inputTimer;
+    return new Promise((resolve, reject) => {
+        const restore = () => {
+            clearTimeout(escapeTimer);
+            clearTimeout(inputTimer);
+            input.removeListener('data', onData);
+            input.removeListener('end', onFailure);
+            input.removeListener('close', onFailure);
+            input.removeListener('error', onFailure);
+            for (const signal of CANCEL_SIGNALS)
+                signals.removeListener(signal, onCancel);
+            signals.removeListener('exit', onExit);
+            bytes.fill(0);
+            length = 0;
+            try {
+                if (input.isRaw)
+                    input.setRawMode(false);
+                if (wasFlowing === true)
+                    input.resume();
+                else
+                    input.pause();
+                return true;
+            }
+            catch {
+                return false;
+            }
+        };
+        const finish = (code, value) => {
+            if (finished)
+                return;
+            finished = true;
+            const restored = restore();
+            try {
+                output.write('\n');
+            }
+            catch { /* Never print input or an underlying error. */ }
+            if (code || !restored)
+                reject(new Error(code || 'private_grant_input_failed'));
+            else
+                resolve(value);
+        };
+        const onCancel = () => finish('private_grant_cancelled');
+        const onFailure = () => finish('private_grant_input_failed');
+        const onExit = () => { finished = true; restore(); };
+        const onData = (data) => {
+            const chunk = Buffer.isBuffer(data) ? data : Buffer.from(data);
+            if (chunk.length > MAX_GRANT_BYTES + 14) {
+                finish('private_grant_too_large');
+                return;
+            }
+            for (let index = 0; index < chunk.length; index += 1) {
+                const byte = chunk[index];
+                if (escape || byte === 27) {
+                    escape += String.fromCharCode(byte);
+                    const start = '\x1b[200~';
+                    const end = '\x1b[201~';
+                    if (escape === start && !pasting && length === 0) {
+                        pasting = true;
+                        escape = '';
+                        clearTimeout(escapeTimer);
+                    }
+                    else if (escape === end && pasting) {
+                        pasting = false;
+                        escape = '';
+                        clearTimeout(escapeTimer);
+                    }
+                    else if (!start.startsWith(escape) && !end.startsWith(escape)) {
+                        onCancel();
+                        return;
+                    }
+                    else {
+                        clearTimeout(escapeTimer);
+                        escapeTimer = setTimeout(onCancel, 1_000);
+                    }
+                    continue;
+                }
+                if ([3, 4, 26].includes(byte)) {
+                    onCancel();
+                    return;
+                }
+                if (byte === 10 || byte === 13) {
+                    if (pasting || length === 0 || chunk.subarray(index + 1).some((next) => next !== 10 && next !== 13)) {
+                        finish('private_grant_invalid');
+                        return;
+                    }
+                    finish(undefined, bytes.subarray(0, length).toString('ascii'));
+                    return;
+                }
+                if (byte === 8 || byte === 127) {
+                    if (length > 0)
+                        bytes[--length] = 0;
+                    continue;
+                }
+                if (byte < 33 || byte > 126) {
+                    finish('private_grant_invalid');
+                    return;
+                }
+                if (length === MAX_GRANT_BYTES) {
+                    finish('private_grant_too_large');
+                    return;
+                }
+                bytes[length++] = byte;
+            }
+        };
+        input.on('data', onData);
+        input.on('end', onFailure);
+        input.on('close', onFailure);
+        input.on('error', onFailure);
+        for (const signal of CANCEL_SIGNALS)
+            signals.on(signal, onCancel);
+        signals.on('exit', onExit);
+        try {
+            input.setRawMode(true);
+            output.write('Paste your short-lived setup grant here, then press Enter (input hidden; Ctrl+C cancels): ');
+            inputTimer = setTimeout(() => finish('private_grant_cancelled'), 300_000);
+            input.resume();
+        }
+        catch {
+            onFailure();
+        }
+    });
+}
+//# sourceMappingURL=privateGrantInput.js.map

package/dist/privateGrantInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privateGrantInput.js","sourceRoot":"","sources":["../src/privateGrantInput.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAgBlC,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAEtF,MAAM,UAAU,kBAAkB,CAAC,KAAoC;IACrE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;WACzE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;WACjD,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iHAAiH,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACrE,MAAM,IAAI,KAAK,CAAC,8HAA8H,CAAC,CAAC;AAClJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,WAAiC;IAC/E,KAAK,EAAE,OAAO,CAAC,KAAsB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAwB;IAC/E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM;CACrC;IACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;WAC/E,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,wJAAwJ,CAAC,CAAC;IAC5K,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAsD,CAAC;IAC3D,IAAI,UAAqD,CAAC;IAC1D,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,OAAO,GAAG,GAAY,EAAE;YAC5B,YAAY,CAAC,WAAW,CAAC,CAAC;YAC1B,YAAY,CAAC,UAAU,CAAC,CAAC;YACzB,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACvC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACzC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACzC,KAAK,MAAM,MAAM,IAAI,cAAc;gBAAE,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC9E,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,CAAC,CAAC;YACX,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,KAAK;oBAAE,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBACzC,IAAI,UAAU,KAAK,IAAI;oBAAE,KAAK,CAAC,MAAM,EAAE,CAAC;;oBAAM,KAAK,CAAC,KAAK,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;QAC3B,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,IAAa,EAAE,KAAc,EAAE,EAAE;YAC/C,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,+CAA+C,CAAC,CAAC;YACrF,IAAI,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,4BAA4B,CAAC,CAAC,CAAC;;gBAC1E,OAAO,CAAC,KAAM,CAAC,CAAC;QACvB,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,CAAC,IAAqB,EAAE,EAAE;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,GAAG,EAAE,EAAE,CAAC;gBAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACvF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;gBAC3B,IAAI,MAAM,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;oBAC1B,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBACpC,MAAM,KAAK,GAAG,WAAW,CAAC;oBAAC,MAAM,GAAG,GAAG,WAAW,CAAC;oBACnD,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,OAAO,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;wBAAC,OAAO,GAAG,IAAI,CAAC;wBAAC,MAAM,GAAG,EAAE,CAAC;wBAAC,YAAY,CAAC,WAAW,CAAC,CAAC;oBAAC,CAAC;yBACxG,IAAI,MAAM,KAAK,GAAG,IAAI,OAAO,EAAE,CAAC;wBAAC,OAAO,GAAG,KAAK,CAAC;wBAAC,MAAM,GAAG,EAAE,CAAC;wBAAC,YAAY,CAAC,WAAW,CAAC,CAAC;oBAAC,CAAC;yBAC3F,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;wBAAC,QAAQ,EAAE,CAAC;wBAAC,OAAO;oBAAC,CAAC;yBACjF,CAAC;wBAAC,YAAY,CAAC,WAAW,CAAC,CAAC;wBAAC,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;oBAAC,CAAC;oBAC9E,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAAC,QAAQ,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACtD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;oBAC/B,IAAI,OAAO,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC;wBACpG,MAAM,CAAC,uBAAuB,CAAC,CAAC;wBAAC,OAAO;oBAC1C,CAAC;oBACD,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;oBAAC,OAAO;gBACzE,CAAC;gBACD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBAAC,IAAI,MAAM,GAAG,CAAC;wBAAE,KAAK,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAClF,IAAI,IAAI,GAAG,EAAE,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;oBAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACzE,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;oBAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC9E,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;YACzB,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzB,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,cAAc;YAAE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,CAAC,KAAK,CAAC,4FAA4F,CAAC,CAAC;YAC3G,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1E,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS,EAAE,CAAC;QAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/privateGrantInput.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=privateGrantInput.test.d.ts.map

package/dist/privateGrantInput.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privateGrantInput.test.d.ts","sourceRoot":"","sources":["../src/privateGrantInput.test.ts"],"names":[],"mappings":""}

package/dist/privateGrantInput.test.js

@@ -0,0 +1,136 @@
+import assert from 'node:assert/strict';
+import { EventEmitter } from 'node:events';
+import test from 'node:test';
+import { bootstrapGrantMode, readPrivateBootstrapGrant } from './privateGrantInput.js';
+class Terminal extends EventEmitter {
+    isTTY = true;
+    isRaw = false;
+    readableFlowing = false;
+    fd = 0;
+    modes = [];
+    setRawMode(raw) { this.isRaw = raw; this.modes.push(raw); return this; }
+    resume() { this.readableFlowing = true; return this; }
+    pause() { this.readableFlowing = false; return this; }
+}
+function fixture() {
+    const input = new Terminal();
+    const signals = new EventEmitter();
+    const writes = [];
+    const output = { isTTY: true, fd: 2, write(value) { writes.push(value); return true; } };
+    return { input, output, signals, writes, isTerminal: () => true };
+}
+const fakeGrant = 'synthetic-not-a-real-grant';
+function restored(io) {
+    assert.equal(io.input.isRaw, false);
+    assert.equal(io.input.readableFlowing, false);
+    assert.equal(io.input.listenerCount('data'), 0);
+    for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT', 'SIGTSTP', 'exit'])
+        assert.equal(io.signals.listenerCount(signal), 0);
+    assert.equal(io.writes.join('').includes(fakeGrant), false);
+}
+test('private grant succeeds with raw input, no echo and terminal restoration', async () => {
+    const io = fixture();
+    const pending = readPrivateBootstrapGrant(io);
+    assert.equal(io.input.isRaw, true);
+    io.input.emit('data', Buffer.from(fakeGrant + '\r'));
+    assert.equal(await pending, fakeGrant);
+    assert.deepEqual(io.input.modes, [true, false]);
+    restored(io);
+});
+test('prompt rejects pipe/redirected output and already-owned terminal before changing it', async () => {
+    for (const change of [(io) => { io.input.isTTY = false; },
+        (io) => { io.output.isTTY = false; },
+        (io) => { io.input.isRaw = true; },
+        (io) => { io.input.on('data', () => { }); }]) {
+        const io = fixture();
+        change(io);
+        await assert.rejects(readPrivateBootstrapGrant(io), /private_grant_terminal_required/);
+        assert.deepEqual(io.input.modes, []);
+    }
+    const io = fixture();
+    io.isTerminal = () => false;
+    await assert.rejects(readPrivateBootstrapGrant(io), /private_grant_terminal_required/);
+});
+test('cancel, EOF, signals, stream failure and oversize restore without exposing input', async () => {
+    for (const event of ['ctrl-c', 'ctrl-d', 'escape', 'end', 'close', 'error', 'SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT', 'SIGTSTP', 'oversize']) {
+        const io = fixture();
+        const pending = readPrivateBootstrapGrant(io);
+        io.input.emit('data', Buffer.from(fakeGrant));
+        if (event === 'ctrl-c')
+            io.input.emit('data', Buffer.from([3]));
+        else if (event === 'ctrl-d')
+            io.input.emit('data', Buffer.from([4]));
+        else if (event === 'escape')
+            io.input.emit('data', Buffer.from([27]));
+        else if (event === 'oversize')
+            io.input.emit('data', Buffer.alloc(16_385, 65));
+        else if (['end', 'close', 'error'].includes(event))
+            io.input.emit(event, new Error(fakeGrant));
+        else
+            io.signals.emit(event);
+        await assert.rejects(pending, /private_grant_(cancelled|input_failed|too_large)/);
+        restored(io);
+    }
+});
+test('private entry rejects empty, multiline, whitespace, non-ASCII and control content', async () => {
+    for (const text of ['\r', fakeGrant + '\nsecond-command', 'bad token\r', 'é\r', '\x00\r']) {
+        const io = fixture();
+        const pending = readPrivateBootstrapGrant(io);
+        io.input.emit('data', Buffer.from(text));
+        await assert.rejects(pending, /private_grant_invalid/);
+        restored(io);
+    }
+});
+test('private entry handles backspace and split paste without echo', async () => {
+    const io = fixture();
+    const pending = readPrivateBootstrapGrant(io);
+    io.input.emit('data', Buffer.from('synthetic-not-a-real-grantX\x7f'));
+    io.input.emit('data', Buffer.from('\r\n'));
+    assert.equal(await pending, fakeGrant);
+    restored(io);
+});
+test('bracketed paste boundaries may be split without accepting a pasted command or newline', async () => {
+    const io = fixture();
+    const pending = readPrivateBootstrapGrant(io);
+    for (const piece of ['\x1b', '[20', '0~', fakeGrant, '\x1b[2', '01~', '\r']) {
+        io.input.emit('data', Buffer.from(piece));
+    }
+    assert.equal(await pending, fakeGrant);
+    restored(io);
+    const bad = fixture();
+    const rejected = readPrivateBootstrapGrant(bad);
+    bad.input.emit('data', Buffer.from('\x1b[200~' + fakeGrant + '\ncommand\x1b[201~'));
+    await assert.rejects(rejected, /private_grant_invalid/);
+    restored(bad);
+});
+test('process exit restores terminal without emitting private input', () => {
+    const io = fixture();
+    void readPrivateBootstrapGrant(io);
+    io.input.emit('data', Buffer.from(fakeGrant));
+    io.signals.emit('exit');
+    restored(io);
+});
+test('raw-mode setup and prompt-write failures are sanitized and restored', async () => {
+    for (const where of ['raw', 'write']) {
+        const io = fixture();
+        if (where === 'raw')
+            io.input.setRawMode = () => { throw new Error(fakeGrant); };
+        else
+            io.output.write = () => { throw new Error(fakeGrant); };
+        await assert.rejects(readPrivateBootstrapGrant(io), /private_grant_input_failed/);
+        assert.equal(io.input.listenerCount('data'), 0);
+        assert.equal(io.input.isRaw, false);
+    }
+});
+test('supported grant modes preserve legacy and resume while rejecting conflict/value confusion', () => {
+    const flags = (...values) => new Map(values);
+    assert.equal(bootstrapGrantMode(flags(['grant-prompt', true])), 'prompt');
+    assert.equal(bootstrapGrantMode(flags(['grant', fakeGrant])), 'argument');
+    assert.equal(bootstrapGrantMode(flags(['resume', true])), 'resume');
+    for (const values of [[['grant', fakeGrant], ['grant-prompt', true]],
+        [['resume', true], ['grant-prompt', true]], [['resume', true], ['grant', fakeGrant]],
+        [['grant-prompt', fakeGrant]], [['grant-prompt', 'false']], [['grant', true]], []]) {
+        assert.throws(() => bootstrapGrantMode(flags(...values)), /bootstrap_grant_options_invalid/);
+    }
+});
+//# sourceMappingURL=privateGrantInput.test.js.map

package/dist/privateGrantInput.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privateGrantInput.test.js","sourceRoot":"","sources":["../src/privateGrantInput.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAEvF,MAAM,QAAS,SAAQ,YAAY;IACjC,KAAK,GAAG,IAAI,CAAC;IACb,KAAK,GAAG,KAAK,CAAC;IACd,eAAe,GAAmB,KAAK,CAAC;IACxC,EAAE,GAAG,CAAC,CAAC;IACP,KAAK,GAAc,EAAE,CAAC;IACtB,UAAU,CAAC,GAAY,IAAI,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;IACjF,MAAM,KAAK,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;IACtD,KAAK,KAAK,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;CACvD;AACD,SAAS,OAAO;IACd,MAAM,KAAK,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,YAAY,EAAE,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,KAAa,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;AACpE,CAAC;AACD,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAC/C,SAAS,QAAQ,CAAC,EAA8B;IAC9C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACtI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,IAAI,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;IACzF,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;IACrB,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,MAAM,OAAO,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,CAAC,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;IACrG,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,EAA8B,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;QACnF,CAAC,EAA8B,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC,EAA8B,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC,EAA8B,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,iCAAiC,CAAC,CAAC;QACvF,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;IAAC,EAAE,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC;IAClD,MAAM,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,iCAAiC,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;IAClG,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7I,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QAAC,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,CAAC,CAAC;QACpE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,QAAQ;YAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAC3D,IAAI,KAAK,KAAK,QAAQ;YAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAChE,IAAI,KAAK,KAAK,QAAQ;YAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;aACjE,IAAI,KAAK,KAAK,UAAU;YAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;aAC1E,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;;YAC1F,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,kDAAkD,CAAC,CAAC;QAClF,QAAQ,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;IACnG,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,kBAAkB,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1F,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QAAC,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,CAAC,CAAC;QACpE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;QACvD,QAAQ,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;IAC9E,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;IAAC,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,CAAC,CAAC;IACpE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,CAAC;IACtE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,OAAO,EAAE,SAAS,CAAC,CAAC;IACvC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;IACvG,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;IAAC,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,CAAC,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5E,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,MAAM,OAAO,EAAE,SAAS,CAAC,CAAC;IACvC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACb,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAAC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IACvE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,GAAG,SAAS,GAAG,oBAAoB,CAAC,CAAC,CAAC;IACpF,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IACxD,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;IAAC,KAAK,yBAAyB,CAAC,EAAE,CAAC,CAAC;IACzD,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9C,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,QAAQ,CAAC,EAAE,CAAC,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACrF,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QACrB,IAAI,KAAK,KAAK,KAAK;YAAE,EAAE,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;;YAC5E,EAAE,CAAC,MAAM,CAAC,KAAK,GAAG,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAClF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2FAA2F,EAAE,GAAG,EAAE;IACrG,MAAM,KAAK,GAAG,CAAC,GAAG,MAAyC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpE,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAClE,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpF,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAA6C,EAAE,CAAC;QACjI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/repositoryOnboardingCaller.test.js

@@ -7,6 +7,7 @@ import { runInNewContext } from 'node:vm';
 import test from 'node:test';
 import ts from 'typescript';
 import { appendRecoveredWorkspace, resolveRegistryRecoveryProjection } from './workspaceRegistryRecovery.js';
+import { bootstrapGrantMode } from './privateGrantInput.js';
 // Execute the actual function body, parsed by TypeScript rather than extracted
 // by text matching. All I/O boundaries are injected: no enrollment, paid work,
 // secret-store writes, daemon processes, or external requests can occur.
@@ -28,6 +29,8 @@ function bootstrapDependencies(onboarding) {
     const calls = [];
     const record = async (name) => { calls.push(name); };
     const dependencies = {
+        bootstrapGrantMode,
+        readPrivateBootstrapGrant: async () => { await record('private_grant'); return 'fixture_private_grant'; },
         normalizeHqUrl: (value) => value,
         portalUrl: () => 'https://fixture.invalid',
         required: (flags, key) => {
@@ -367,6 +370,63 @@ function bootstrapFlags(complete = false) {
         flags.set('complete', true);
     return flags;
 }
+test('private grant entry follows preflight, uses the unchanged redemption scope and stays out of onboard flags', async () => {
+    const f = bootstrapDependencies({ ok: true, stage: 'ready', localStage: 'ready', sharedRepositoryReady: true });
+    const flags = bootstrapFlags();
+    flags.delete('grant');
+    flags.set('grant-prompt', true);
+    const originalOnboard = f.dependencies.onboard;
+    f.dependencies.onboard = async (onboardFlags) => {
+        assert.equal(onboardFlags.has('grant'), false);
+        assert.equal(onboardFlags.has('grant-prompt'), false);
+        return originalOnboard(onboardFlags);
+    };
+    f.dependencies.redeemBootstrapGrant = async (input) => {
+        assert.equal(input.bootstrapToken, 'fixture_private_grant');
+        assert.equal(input.organizationId, 'org_fixture');
+        assert.equal(input.hqUrl, 'https://fixture.invalid');
+        assert.equal(input.repositoryFingerprint, `sha256:${'e'.repeat(64)}`);
+        assert.equal(typeof input.onRecipientApprovalRequired, 'function');
+        f.calls.push('redeem');
+        return { deviceId: 'fixture_device', serverPublicKeyEd25519: 'fixture_server_key',
+            relayUrl: 'wss://fixture.invalid', organizationApiToken: 'fixture_token', organizationApiTokenScopes: [] };
+    };
+    await (await caller('bootstrap', f.dependencies))(flags);
+    assert.ok(f.calls.indexOf('preflight') < f.calls.indexOf('private_grant'));
+    assert.ok(f.calls.indexOf('private_grant') < f.calls.indexOf('redeem'));
+});
+test('foreign enrollment and grant-option conflict stop before private entry or redemption', async () => {
+    for (const conflict of [false, true]) {
+        const f = bootstrapDependencies({ ok: true });
+        const flags = bootstrapFlags();
+        flags.set('grant-prompt', true);
+        if (!conflict) {
+            flags.delete('grant');
+            f.dependencies.readDeviceConfig = async () => ({ organizationId: 'org_other', hqUrl: 'https://fixture.invalid' });
+        }
+        f.dependencies.redeemBootstrapGrant = async () => { throw new Error('must not redeem'); };
+        await assert.rejects((await caller('bootstrap', f.dependencies))(flags), conflict
+            ? /bootstrap_grant_options_invalid/ : /another organization or portal/);
+        assert.equal(f.calls.includes('private_grant'), false);
+    }
+});
+test('redemption failure never reflects private terminal input into an error', async () => {
+    for (const message of ['reflected fixture_private_grant', 'grant_expired']) {
+        const f = bootstrapDependencies({ ok: true });
+        const flags = bootstrapFlags();
+        flags.delete('grant');
+        flags.set('grant-prompt', true);
+        f.dependencies.redeemBootstrapGrant = async () => { throw new Error(message); };
+        // The actual function runs in a separate VM realm; the Error need not share its constructor.
+        await assert.rejects((await caller('bootstrap', f.dependencies))(flags), (error) => {
+            const text = String(error);
+            assert.equal(text.includes('fixture_private_grant'), false);
+            assert.match(text, message === 'grant_expired' ? /grant_expired/ : /bootstrap_redemption_failed/);
+            return true;
+        });
+        assert.equal(f.calls.includes('save_device'), false);
+    }
+});
 async function resumeFixture() {
     const f = bootstrapDependencies({ ok: true, stage: 'ready', localStage: 'ready',
         sharedRepositoryReady: true, workspaceId: 'workspace_fixture' });