@dreamboard-games/cli 0.1.30-alpha.12 → 0.1.30-alpha.13

package/dist/agent-verifier/chunk-CO3BRUD6.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/clerk-oauth.ts","../../src/auth/token-exchange.ts","../../src/auth/user-token-manager.ts","../../src/config/local-harness-auth.ts"],"sourcesContent":["import crypto from \"node:crypto\";\n\nexport type ClerkOAuthConfig = {\n  issuer?: string;\n  clientId?: string;\n  tokenUrl?: string;\n  scope?: string;\n};\n\nexport type ClerkOAuthTokenResponse = {\n  accessToken: string;\n  refreshToken: string;\n  expiresAt?: string;\n  tokenUrl: string;\n};\n\nexport function createPkcePair(): { verifier: string; challenge: string } {\n  const verifier = base64Url(crypto.randomBytes(32));\n  const challenge = base64Url(\n    crypto.createHash(\"sha256\").update(verifier).digest(),\n  );\n  return { verifier, challenge };\n}\n\nexport function buildClerkAuthorizationUrl(input: {\n  config: ClerkOAuthConfig;\n  redirectUri: string;\n  state: string;\n  codeChallenge: string;\n}): URL {\n  const { issuer, clientId, scope } = assertConfigured(input.config);\n  const url = new URL(\"/oauth/authorize\", issuer);\n  url.searchParams.set(\"response_type\", \"code\");\n  url.searchParams.set(\"client_id\", clientId);\n  url.searchParams.set(\"redirect_uri\", input.redirectUri);\n  url.searchParams.set(\"state\", input.state);\n  url.searchParams.set(\"code_challenge\", input.codeChallenge);\n  url.searchParams.set(\"code_challenge_method\", \"S256\");\n  url.searchParams.set(\"scope\", scope ?? \"openid profile email offline_access\");\n  return url;\n}\n\nexport async function exchangeClerkOAuthCode(input: {\n  config: ClerkOAuthConfig;\n  code: string;\n  redirectUri: string;\n  codeVerifier: string;\n}): Promise<ClerkOAuthTokenResponse> {\n  const { clientId, tokenUrl } = assertConfigured(input.config);\n  const body = new URLSearchParams({\n    grant_type: \"authorization_code\",\n    client_id: clientId,\n    code: input.code,\n    redirect_uri: input.redirectUri,\n    code_verifier: input.codeVerifier,\n  });\n  return requestClerkToken(tokenUrl, body);\n}\n\nexport async function refreshClerkOAuthToken(input: {\n  config: ClerkOAuthConfig;\n  refreshToken: string;\n}): Promise<ClerkOAuthTokenResponse> {\n  const { clientId, tokenUrl } = assertConfigured(input.config);\n  const body = new URLSearchParams({\n    grant_type: \"refresh_token\",\n    client_id: clientId,\n    refresh_token: input.refreshToken,\n  });\n  return requestClerkToken(tokenUrl, body);\n}\n\nfunction assertConfigured(config: ClerkOAuthConfig): {\n  issuer: string;\n  clientId: string;\n  tokenUrl: string;\n  scope?: string;\n} {\n  const issuer = config.issuer?.trim().replace(/\\/$/, \"\");\n  const clientId = config.clientId?.trim();\n  if (!issuer || !clientId) {\n    throw new Error(\n      [\n        \"Clerk OAuth CLI is not configured for this environment.\",\n        \"The CLI expects first-party environments to be configured in its built-in registry.\",\n        \"If this environment has no registered public Clerk OAuth client, create one and release a CLI with its client id.\",\n        \"For emergency overrides, set the environment-specific DREAMBOARD_<ENV>_CLERK_OAUTH_* variables or DREAMBOARD_CLERK_OAUTH_*.\",\n        \"For local harness auth, use `pnpm auth:local` or the auto-bootstrapped local harness flows instead.\",\n      ].join(\" \"),\n    );\n  }\n  return {\n    issuer,\n    clientId,\n    tokenUrl:\n      config.tokenUrl?.trim() || new URL(\"/oauth/token\", issuer).toString(),\n    scope: config.scope?.trim() || undefined,\n  };\n}\n\nasync function requestClerkToken(\n  tokenUrl: string,\n  body: URLSearchParams,\n): Promise<ClerkOAuthTokenResponse> {\n  const response = await fetch(tokenUrl, {\n    method: \"POST\",\n    headers: {\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n      Accept: \"application/json\",\n    },\n    body,\n  });\n  if (!response.ok) {\n    const detail = await response.text();\n    throw new Error(\n      `Clerk OAuth token request failed (${response.status}): ${detail}`,\n    );\n  }\n  const payload = (await response.json()) as {\n    access_token?: unknown;\n    refresh_token?: unknown;\n    expires_in?: unknown;\n  };\n  if (typeof payload.access_token !== \"string\") {\n    throw new Error(\"Clerk OAuth token response did not include access_token.\");\n  }\n  if (typeof payload.refresh_token !== \"string\") {\n    throw new Error(\n      \"Clerk OAuth token response did not include refresh_token.\",\n    );\n  }\n  const expiresAt =\n    typeof payload.expires_in === \"number\"\n      ? new Date(Date.now() + payload.expires_in * 1000).toISOString()\n      : undefined;\n  return {\n    accessToken: payload.access_token,\n    refreshToken: payload.refresh_token,\n    expiresAt,\n    tokenUrl,\n  };\n}\n\nfunction base64Url(bytes: Buffer): string {\n  return bytes\n    .toString(\"base64\")\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/g, \"\");\n}\n","export type DreamboardTokenAudience = \"dreamboard-api\" | \"dreamboard-git\";\n\nexport type DreamboardTokenResponse = {\n  accessToken: string;\n  tokenType: \"Bearer\";\n  audience: DreamboardTokenAudience;\n  expiresIn?: number;\n  expiresAt?: string;\n};\n\nexport async function exchangeDreamboardUserToken(input: {\n  apiBaseUrl: string;\n  clerkAccessToken: string;\n  audience: DreamboardTokenAudience;\n  fetchImpl?: typeof fetch;\n}): Promise<DreamboardTokenResponse> {\n  const fetchImpl = input.fetchImpl ?? globalThis.fetch.bind(globalThis);\n  const response = await fetchImpl(\n    new URL(\"/api/auth/token-exchange\", input.apiBaseUrl),\n    {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${input.clerkAccessToken}`,\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n      },\n      body: JSON.stringify({ audience: input.audience }),\n    },\n  );\n\n  if (!response.ok) {\n    throw new Error(\n      `Dreamboard token exchange failed (${response.status}). Run \\`dreamboard login\\` to authenticate again.`,\n    );\n  }\n\n  const payload = (await response.json()) as {\n    accessToken?: unknown;\n    tokenType?: unknown;\n    audience?: unknown;\n    expiresIn?: unknown;\n  };\n\n  if (typeof payload.accessToken !== \"string\" || payload.accessToken === \"\") {\n    throw new Error(\"Dreamboard token exchange response omitted accessToken.\");\n  }\n  if (payload.tokenType !== \"Bearer\") {\n    throw new Error(\n      \"Dreamboard token exchange response had invalid tokenType.\",\n    );\n  }\n  if (payload.audience !== input.audience) {\n    throw new Error(\"Dreamboard token exchange response had wrong audience.\");\n  }\n\n  const expiresIn =\n    typeof payload.expiresIn === \"number\" && Number.isFinite(payload.expiresIn)\n      ? payload.expiresIn\n      : undefined;\n\n  return {\n    accessToken: payload.accessToken,\n    tokenType: \"Bearer\",\n    audience: input.audience,\n    expiresIn,\n    expiresAt:\n      expiresIn === undefined\n        ? undefined\n        : new Date(Date.now() + expiresIn * 1000).toISOString(),\n  };\n}\n","import type {\n  Credentials,\n  StoredSessionSnapshot,\n} from \"../config/credential-store.js\";\nimport { withCredentialLock } from \"../config/credential-store.js\";\nimport { refreshClerkOAuthToken } from \"./clerk-oauth.js\";\nimport {\n  exchangeDreamboardUserToken,\n  type DreamboardTokenAudience,\n} from \"./token-exchange.js\";\nimport type { ResolvedConfig } from \"../types.js\";\n\nconst TOKEN_REFRESH_WINDOW_MS = 60 * 1000;\n\nexport type AccessToken = {\n  readonly token: string;\n  readonly expiresAt?: string;\n  readonly audience: DreamboardTokenAudience;\n};\n\nexport interface UserTokenManager {\n  resolveApiToken(): Promise<AccessToken | null>;\n  resolveGitToken(): Promise<AccessToken>;\n}\n\nexport function createUserTokenManager(\n  config: ResolvedConfig,\n): UserTokenManager {\n  return {\n    async resolveApiToken() {\n      const localOrInjected = resolveNonStoredToken(config, \"dreamboard-api\");\n      if (localOrInjected) return localOrInjected;\n\n      if (!usesStoredSession(config)) return null;\n\n      return withCredentialLock(async (ops) => {\n        const stored = await ops.read();\n        const apiToken = freshStoredApiToken(stored);\n        if (apiToken) return apiToken;\n\n        const clerk = await resolveFreshClerkAccessToken(config, stored);\n        const exchanged = await exchangeDreamboardUserToken({\n          apiBaseUrl: config.apiBaseUrl,\n          clerkAccessToken: clerk.accessToken,\n          audience: \"dreamboard-api\",\n        });\n\n        await ops.writeFull({\n          ...clerk,\n          dreamboardApiToken: exchanged.accessToken,\n          dreamboardApiExpiresAt: exchanged.expiresAt,\n        });\n\n        return {\n          token: exchanged.accessToken,\n          expiresAt: exchanged.expiresAt,\n          audience: \"dreamboard-api\",\n        };\n      });\n    },\n\n    async resolveGitToken() {\n      const localOrInjected = resolveNonStoredToken(config, \"dreamboard-git\");\n      if (localOrInjected) return localOrInjected;\n\n      if (!usesStoredSession(config)) {\n        throw new Error(\n          \"Missing Dreamboard session. Run `dreamboard login` to authenticate.\",\n        );\n      }\n\n      return withCredentialLock(async (ops) => {\n        const stored = await ops.read();\n        const clerk = await resolveFreshClerkAccessToken(config, stored);\n        const exchanged = await exchangeDreamboardUserToken({\n          apiBaseUrl: config.apiBaseUrl,\n          clerkAccessToken: clerk.accessToken,\n          audience: \"dreamboard-git\",\n        });\n\n        await ops.writeFull(clerk);\n\n        return {\n          token: exchanged.accessToken,\n          expiresAt: exchanged.expiresAt,\n          audience: \"dreamboard-git\",\n        };\n      });\n    },\n  };\n}\n\nfunction resolveNonStoredToken(\n  config: ResolvedConfig,\n  audience: DreamboardTokenAudience,\n): AccessToken | null {\n  if (usesStoredSession(config)) return null;\n  if (!config.authToken) return null;\n  return {\n    token: config.authToken,\n    expiresAt: config.tokenExpiresAt,\n    audience,\n  };\n}\n\nfunction freshStoredApiToken(\n  stored: StoredSessionSnapshot | null,\n): AccessToken | null {\n  if (!stored?.dreamboardApiToken) return null;\n  if (isFresh(stored.dreamboardApiExpiresAt, stored.dreamboardApiToken)) {\n    return {\n      token: stored.dreamboardApiToken,\n      expiresAt: stored.dreamboardApiExpiresAt,\n      audience: \"dreamboard-api\",\n    };\n  }\n  return null;\n}\n\nasync function resolveFreshClerkAccessToken(\n  config: ResolvedConfig,\n  stored: StoredSessionSnapshot | null,\n): Promise<Credentials> {\n  const accessToken = stored?.accessToken ?? config.clerkAccessToken;\n  const refreshToken = stored?.refreshToken ?? config.refreshToken;\n  const tokenExpiresAt = stored?.tokenExpiresAt ?? config.clerkAccessExpiresAt;\n\n  if (!refreshToken) {\n    throw new Error(\n      \"Stored Dreamboard session is missing its refresh token. Run `dreamboard login` to authenticate again.\",\n    );\n  }\n\n  if (accessToken && isFresh(tokenExpiresAt, accessToken)) {\n    return {\n      accessToken,\n      refreshToken,\n      tokenExpiresAt,\n      dreamboardApiToken: stored?.dreamboardApiToken,\n      dreamboardApiExpiresAt: stored?.dreamboardApiExpiresAt,\n      clerkOAuthIssuer: stored?.clerkOAuthIssuer ?? config.clerkOAuthIssuer,\n      clerkOAuthClientId:\n        stored?.clerkOAuthClientId ?? config.clerkOAuthClientId,\n      clerkOAuthTokenUrl:\n        stored?.clerkOAuthTokenUrl ?? config.clerkOAuthTokenUrl,\n      environment: stored?.environment ?? config.environment,\n    };\n  }\n\n  const payload = await refreshClerkOAuthToken({\n    config: {\n      issuer: stored?.clerkOAuthIssuer ?? config.clerkOAuthIssuer,\n      clientId: stored?.clerkOAuthClientId ?? config.clerkOAuthClientId,\n      tokenUrl: stored?.clerkOAuthTokenUrl ?? config.clerkOAuthTokenUrl,\n    },\n    refreshToken,\n  });\n\n  return {\n    accessToken: payload.accessToken,\n    refreshToken: payload.refreshToken,\n    tokenExpiresAt: payload.expiresAt,\n    clerkOAuthIssuer: stored?.clerkOAuthIssuer ?? config.clerkOAuthIssuer,\n    clerkOAuthClientId: stored?.clerkOAuthClientId ?? config.clerkOAuthClientId,\n    clerkOAuthTokenUrl: payload.tokenUrl,\n    environment: stored?.environment ?? config.environment,\n  };\n}\n\nfunction isFresh(expiresAt: string | undefined, token: string): boolean {\n  const expiry = expiresAt ? new Date(expiresAt) : getJwtExpiry(token);\n  return (\n    expiry !== null &&\n    Number.isFinite(expiry.getTime()) &&\n    expiry.getTime() > Date.now() + TOKEN_REFRESH_WINDOW_MS\n  );\n}\n\nfunction getJwtExpiry(accessToken: string | undefined): Date | null {\n  if (!accessToken) return null;\n  const parts = accessToken.split(\".\");\n  if (parts.length !== 3) return null;\n  try {\n    const payload = JSON.parse(\n      Buffer.from(parts[1]!, \"base64url\").toString(\"utf8\"),\n    ) as { exp?: unknown };\n    if (typeof payload.exp !== \"number\" || !Number.isFinite(payload.exp)) {\n      return null;\n    }\n    return new Date(payload.exp * 1000);\n  } catch {\n    return null;\n  }\n}\n\nfunction usesStoredSession(config: ResolvedConfig): boolean {\n  return config.refreshTokenSource === \"global\";\n}\n","import { createHmac, randomUUID } from \"node:crypto\";\nimport type { ResolvedConfig } from \"../types.js\";\nimport { IS_PUBLISHED_BUILD } from \"../build-target.js\";\n\ntype LocalHarnessProfile = \"local\" | \"local-aws\";\n\nconst DEFAULT_SUBJECT = \"harness-smoke-local@dreamboard.local\";\nconst DEFAULT_ISSUER = \"dreamboard-local-harness\";\nconst DEFAULT_SECRET = \"dreamboard-local-harness-token-secret\";\nconst LOCAL_AWS_ISSUER = \"dreamboard-local-aws-harness\";\nconst LOCAL_AWS_SECRET = \"dreamboard-local-aws-harness-token-secret\";\nconst DEFAULT_TTL_SECONDS = 8 * 60 * 60;\n\nconst mintedTokens = new Map<string, string>();\n\nexport function resolveLocalHarnessAccessToken(\n  config: ResolvedConfig,\n): string | undefined {\n  if (IS_PUBLISHED_BUILD || config.environment !== \"local\") {\n    return undefined;\n  }\n\n  const profile = inferLocalHarnessProfile(config);\n  if (\n    config.authToken &&\n    (profile !== \"local-aws\" || isExplicitTokenSource(config.authTokenSource))\n  ) {\n    return undefined;\n  }\n\n  const cacheKey = [\n    profile,\n    process.env.LOCAL_HARNESS_TOKEN_ISSUER ?? \"\",\n    process.env.LOCAL_HARNESS_TOKEN_SECRET ?? \"\",\n    process.env.LOCAL_HARNESS_SUBJECT ?? \"\",\n    process.env.HARNESS_USER_EMAIL ?? \"\",\n    process.env.LOCAL_HARNESS_EMAIL ?? \"\",\n    process.env.LOCAL_HARNESS_TOKEN_TTL_SECONDS ?? \"\",\n  ].join(\"\\0\");\n  const cached = mintedTokens.get(cacheKey);\n  if (cached) return cached;\n\n  const token = mintLocalHarnessToken(profile);\n  mintedTokens.set(cacheKey, token);\n  return token;\n}\n\nfunction isExplicitTokenSource(\n  source: ResolvedConfig[\"authTokenSource\"],\n): boolean {\n  return source === \"flag\" || source === \"env\" || source === \"agent-env\";\n}\n\nexport function inferLocalHarnessProfile(\n  config: Pick<ResolvedConfig, \"apiBaseUrl\" | \"webBaseUrl\">,\n): LocalHarnessProfile {\n  return isLocalAwsUrl(config.apiBaseUrl) || isLocalAwsUrl(config.webBaseUrl)\n    ? \"local-aws\"\n    : \"local\";\n}\n\nfunction mintLocalHarnessToken(profile: LocalHarnessProfile): string {\n  const subject =\n    envValue(process.env.LOCAL_HARNESS_SUBJECT) ??\n    envValue(process.env.HARNESS_USER_EMAIL) ??\n    DEFAULT_SUBJECT;\n  const email =\n    envValue(process.env.LOCAL_HARNESS_EMAIL) ??\n    (subject.includes(\"@\") ? subject : undefined);\n  const issuer =\n    envValue(process.env.LOCAL_HARNESS_TOKEN_ISSUER) ??\n    (profile === \"local-aws\" ? LOCAL_AWS_ISSUER : DEFAULT_ISSUER);\n  const secret =\n    envValue(process.env.LOCAL_HARNESS_TOKEN_SECRET) ??\n    (profile === \"local-aws\" ? LOCAL_AWS_SECRET : DEFAULT_SECRET);\n  const ttlSeconds = Number(\n    envValue(process.env.LOCAL_HARNESS_TOKEN_TTL_SECONDS) ??\n      String(DEFAULT_TTL_SECONDS),\n  );\n  if (!Number.isFinite(ttlSeconds) || ttlSeconds <= 0) {\n    throw new Error(\n      \"LOCAL_HARNESS_TOKEN_TTL_SECONDS must be a positive number.\",\n    );\n  }\n\n  const now = Math.floor(Date.now() / 1000);\n  const payload = {\n    typ: \"local_harness_access\",\n    dreamboard_provider: \"local-harness\",\n    dreamboard_provider_subject: subject,\n    ...(email ? { email } : {}),\n    iss: issuer,\n    sub: subject,\n    iat: now,\n    exp: now + Math.floor(ttlSeconds),\n    jti: randomUUID(),\n  };\n\n  const headerPart = base64UrlJson({ alg: \"HS256\", typ: \"JWT\" });\n  const payloadPart = base64UrlJson(payload);\n  const signature = createHmac(\"sha256\", secret)\n    .update(`${headerPart}.${payloadPart}`)\n    .digest(\"base64url\");\n  return `${headerPart}.${payloadPart}.${signature}`;\n}\n\nfunction base64UrlJson(value: unknown): string {\n  return Buffer.from(JSON.stringify(value), \"utf8\").toString(\"base64url\");\n}\n\nfunction envValue(raw: string | undefined): string | undefined {\n  return typeof raw === \"string\" && raw.trim().length > 0\n    ? raw.trim()\n    : undefined;\n}\n\nfunction isLocalAwsUrl(rawUrl: string | undefined): boolean {\n  if (!rawUrl) return false;\n  try {\n    const url = new URL(rawUrl);\n    return (\n      (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") &&\n      (url.port === \"18080\" || url.port === \"8088\")\n    );\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;AAAA,OAAO,YAAY;AA2DnB,eAAsB,uBAAuB,OAGR;AACnC,QAAM,EAAE,UAAU,SAAS,IAAI,iBAAiB,MAAM,MAAM;AAC5D,QAAM,OAAO,IAAI,gBAAgB;AAAA,IAC/B,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,MAAM;AAAA,EACvB,CAAC;AACD,SAAO,kBAAkB,UAAU,IAAI;AACzC;AAEA,SAAS,iBAAiB,QAKxB;AACA,QAAM,SAAS,OAAO,QAAQ,KAAK,EAAE,QAAQ,OAAO,EAAE;AACtD,QAAM,WAAW,OAAO,UAAU,KAAK;AACvC,MAAI,CAAC,UAAU,CAAC,UAAU;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,GAAG;AAAA,IACZ;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,UACE,OAAO,UAAU,KAAK,KAAK,IAAI,IAAI,gBAAgB,MAAM,EAAE,SAAS;AAAA,IACtE,OAAO,OAAO,OAAO,KAAK,KAAK;AAAA,EACjC;AACF;AAEA,eAAe,kBACb,UACA,MACkC;AAClC,QAAM,WAAW,MAAM,MAAM,UAAU;AAAA,IACrC,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,SAAS,MAAM,SAAS,KAAK;AACnC,UAAM,IAAI;AAAA,MACR,qCAAqC,SAAS,MAAM,MAAM,MAAM;AAAA,IAClE;AAAA,EACF;AACA,QAAM,UAAW,MAAM,SAAS,KAAK;AAKrC,MAAI,OAAO,QAAQ,iBAAiB,UAAU;AAC5C,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,MAAI,OAAO,QAAQ,kBAAkB,UAAU;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,YACJ,OAAO,QAAQ,eAAe,WAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,aAAa,GAAI,EAAE,YAAY,IAC7D;AACN,SAAO;AAAA,IACL,aAAa,QAAQ;AAAA,IACrB,cAAc,QAAQ;AAAA,IACtB;AAAA,IACA;AAAA,EACF;AACF;;;ACnIA,eAAsB,4BAA4B,OAKb;AACnC,QAAM,YAAY,MAAM,aAAa,WAAW,MAAM,KAAK,UAAU;AACrE,QAAM,WAAW,MAAM;AAAA,IACrB,IAAI,IAAI,4BAA4B,MAAM,UAAU;AAAA,IACpD;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,MAAM,gBAAgB;AAAA,QAC/C,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,UAAU,MAAM,SAAS,CAAC;AAAA,IACnD;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI;AAAA,MACR,qCAAqC,SAAS,MAAM;AAAA,IACtD;AAAA,EACF;AAEA,QAAM,UAAW,MAAM,SAAS,KAAK;AAOrC,MAAI,OAAO,QAAQ,gBAAgB,YAAY,QAAQ,gBAAgB,IAAI;AACzE,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,MAAI,QAAQ,cAAc,UAAU;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,aAAa,MAAM,UAAU;AACvC,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,QAAM,YACJ,OAAO,QAAQ,cAAc,YAAY,OAAO,SAAS,QAAQ,SAAS,IACtE,QAAQ,YACR;AAEN,SAAO;AAAA,IACL,aAAa,QAAQ;AAAA,IACrB,WAAW;AAAA,IACX,UAAU,MAAM;AAAA,IAChB;AAAA,IACA,WACE,cAAc,SACV,SACA,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI,EAAE,YAAY;AAAA,EAC5D;AACF;;;AC1DA,IAAM,0BAA0B,KAAK;AAa9B,SAAS,uBACd,QACkB;AAClB,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,YAAM,kBAAkB,sBAAsB,QAAQ,gBAAgB;AACtE,UAAI,gBAAiB,QAAO;AAE5B,UAAI,CAAC,kBAAkB,MAAM,EAAG,QAAO;AAEvC,aAAO,mBAAmB,OAAO,QAAQ;AACvC,cAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,cAAM,WAAW,oBAAoB,MAAM;AAC3C,YAAI,SAAU,QAAO;AAErB,cAAM,QAAQ,MAAM,6BAA6B,QAAQ,MAAM;AAC/D,cAAM,YAAY,MAAM,4BAA4B;AAAA,UAClD,YAAY,OAAO;AAAA,UACnB,kBAAkB,MAAM;AAAA,UACxB,UAAU;AAAA,QACZ,CAAC;AAED,cAAM,IAAI,UAAU;AAAA,UAClB,GAAG;AAAA,UACH,oBAAoB,UAAU;AAAA,UAC9B,wBAAwB,UAAU;AAAA,QACpC,CAAC;AAED,eAAO;AAAA,UACL,OAAO,UAAU;AAAA,UACjB,WAAW,UAAU;AAAA,UACrB,UAAU;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,kBAAkB;AACtB,YAAM,kBAAkB,sBAAsB,QAAQ,gBAAgB;AACtE,UAAI,gBAAiB,QAAO;AAE5B,UAAI,CAAC,kBAAkB,MAAM,GAAG;AAC9B,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAEA,aAAO,mBAAmB,OAAO,QAAQ;AACvC,cAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,cAAM,QAAQ,MAAM,6BAA6B,QAAQ,MAAM;AAC/D,cAAM,YAAY,MAAM,4BAA4B;AAAA,UAClD,YAAY,OAAO;AAAA,UACnB,kBAAkB,MAAM;AAAA,UACxB,UAAU;AAAA,QACZ,CAAC;AAED,cAAM,IAAI,UAAU,KAAK;AAEzB,eAAO;AAAA,UACL,OAAO,UAAU;AAAA,UACjB,WAAW,UAAU;AAAA,UACrB,UAAU;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,sBACP,QACA,UACoB;AACpB,MAAI,kBAAkB,MAAM,EAAG,QAAO;AACtC,MAAI,CAAC,OAAO,UAAW,QAAO;AAC9B,SAAO;AAAA,IACL,OAAO,OAAO;AAAA,IACd,WAAW,OAAO;AAAA,IAClB;AAAA,EACF;AACF;AAEA,SAAS,oBACP,QACoB;AACpB,MAAI,CAAC,QAAQ,mBAAoB,QAAO;AACxC,MAAI,QAAQ,OAAO,wBAAwB,OAAO,kBAAkB,GAAG;AACrE,WAAO;AAAA,MACL,OAAO,OAAO;AAAA,MACd,WAAW,OAAO;AAAA,MAClB,UAAU;AAAA,IACZ;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,6BACb,QACA,QACsB;AACtB,QAAM,cAAc,QAAQ,eAAe,OAAO;AAClD,QAAM,eAAe,QAAQ,gBAAgB,OAAO;AACpD,QAAM,iBAAiB,QAAQ,kBAAkB,OAAO;AAExD,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,eAAe,QAAQ,gBAAgB,WAAW,GAAG;AACvD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB,QAAQ;AAAA,MAC5B,wBAAwB,QAAQ;AAAA,MAChC,kBAAkB,QAAQ,oBAAoB,OAAO;AAAA,MACrD,oBACE,QAAQ,sBAAsB,OAAO;AAAA,MACvC,oBACE,QAAQ,sBAAsB,OAAO;AAAA,MACvC,aAAa,QAAQ,eAAe,OAAO;AAAA,IAC7C;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,uBAAuB;AAAA,IAC3C,QAAQ;AAAA,MACN,QAAQ,QAAQ,oBAAoB,OAAO;AAAA,MAC3C,UAAU,QAAQ,sBAAsB,OAAO;AAAA,MAC/C,UAAU,QAAQ,sBAAsB,OAAO;AAAA,IACjD;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,aAAa,QAAQ;AAAA,IACrB,cAAc,QAAQ;AAAA,IACtB,gBAAgB,QAAQ;AAAA,IACxB,kBAAkB,QAAQ,oBAAoB,OAAO;AAAA,IACrD,oBAAoB,QAAQ,sBAAsB,OAAO;AAAA,IACzD,oBAAoB,QAAQ;AAAA,IAC5B,aAAa,QAAQ,eAAe,OAAO;AAAA,EAC7C;AACF;AAEA,SAAS,QAAQ,WAA+B,OAAwB;AACtE,QAAM,SAAS,YAAY,IAAI,KAAK,SAAS,IAAI,aAAa,KAAK;AACnE,SACE,WAAW,QACX,OAAO,SAAS,OAAO,QAAQ,CAAC,KAChC,OAAO,QAAQ,IAAI,KAAK,IAAI,IAAI;AAEpC;AAEA,SAAS,aAAa,aAA8C;AAClE,MAAI,CAAC,YAAa,QAAO;AACzB,QAAM,QAAQ,YAAY,MAAM,GAAG;AACnC,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI;AACF,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,GAAI,WAAW,EAAE,SAAS,MAAM;AAAA,IACrD;AACA,QAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,OAAO,SAAS,QAAQ,GAAG,GAAG;AACpE,aAAO;AAAA,IACT;AACA,WAAO,IAAI,KAAK,QAAQ,MAAM,GAAI;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,QAAiC;AAC1D,SAAO,OAAO,uBAAuB;AACvC;;;ACrMA,SAAS,YAAY,kBAAkB;AAMvC,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;AACvB,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AACzB,IAAM,sBAAsB,IAAI,KAAK;AAErC,IAAM,eAAe,oBAAI,IAAoB;AAEtC,SAAS,+BACd,QACoB;AACpB,MAAI,sBAAsB,OAAO,gBAAgB,SAAS;AACxD,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,yBAAyB,MAAM;AAC/C,MACE,OAAO,cACN,YAAY,eAAe,sBAAsB,OAAO,eAAe,IACxE;AACA,WAAO;AAAA,EACT;AAEA,QAAM,WAAW;AAAA,IACf;AAAA,IACA,QAAQ,IAAI,8BAA8B;AAAA,IAC1C,QAAQ,IAAI,8BAA8B;AAAA,IAC1C,QAAQ,IAAI,yBAAyB;AAAA,IACrC,QAAQ,IAAI,sBAAsB;AAAA,IAClC,QAAQ,IAAI,uBAAuB;AAAA,IACnC,QAAQ,IAAI,mCAAmC;AAAA,EACjD,EAAE,KAAK,IAAI;AACX,QAAM,SAAS,aAAa,IAAI,QAAQ;AACxC,MAAI,OAAQ,QAAO;AAEnB,QAAM,QAAQ,sBAAsB,OAAO;AAC3C,eAAa,IAAI,UAAU,KAAK;AAChC,SAAO;AACT;AAEA,SAAS,sBACP,QACS;AACT,SAAO,WAAW,UAAU,WAAW,SAAS,WAAW;AAC7D;AAEO,SAAS,yBACd,QACqB;AACrB,SAAO,cAAc,OAAO,UAAU,KAAK,cAAc,OAAO,UAAU,IACtE,cACA;AACN;AAEA,SAAS,sBAAsB,SAAsC;AACnE,QAAM,UACJ,SAAS,QAAQ,IAAI,qBAAqB,KAC1C,SAAS,QAAQ,IAAI,kBAAkB,KACvC;AACF,QAAM,QACJ,SAAS,QAAQ,IAAI,mBAAmB,MACvC,QAAQ,SAAS,GAAG,IAAI,UAAU;AACrC,QAAM,SACJ,SAAS,QAAQ,IAAI,0BAA0B,MAC9C,YAAY,cAAc,mBAAmB;AAChD,QAAM,SACJ,SAAS,QAAQ,IAAI,0BAA0B,MAC9C,YAAY,cAAc,mBAAmB;AAChD,QAAM,aAAa;AAAA,IACjB,SAAS,QAAQ,IAAI,+BAA+B,KAClD,OAAO,mBAAmB;AAAA,EAC9B;AACA,MAAI,CAAC,OAAO,SAAS,UAAU,KAAK,cAAc,GAAG;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,UAAU;AAAA,IACd,KAAK;AAAA,IACL,qBAAqB;AAAA,IACrB,6BAA6B;AAAA,IAC7B,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,MAAM,KAAK,MAAM,UAAU;AAAA,IAChC,KAAK,WAAW;AAAA,EAClB;AAEA,QAAM,aAAa,cAAc,EAAE,KAAK,SAAS,KAAK,MAAM,CAAC;AAC7D,QAAM,cAAc,cAAc,OAAO;AACzC,QAAM,YAAY,WAAW,UAAU,MAAM,EAC1C,OAAO,GAAG,UAAU,IAAI,WAAW,EAAE,EACrC,OAAO,WAAW;AACrB,SAAO,GAAG,UAAU,IAAI,WAAW,IAAI,SAAS;AAClD;AAEA,SAAS,cAAc,OAAwB;AAC7C,SAAO,OAAO,KAAK,KAAK,UAAU,KAAK,GAAG,MAAM,EAAE,SAAS,WAAW;AACxE;AAEA,SAAS,SAAS,KAA6C;AAC7D,SAAO,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,SAAS,IAClD,IAAI,KAAK,IACT;AACN;AAEA,SAAS,cAAc,QAAqC;AAC1D,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,YACG,IAAI,aAAa,eAAe,IAAI,aAAa,iBACjD,IAAI,SAAS,WAAW,IAAI,SAAS;AAAA,EAE1C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/agent-verifier/chunk-DPYC2NDB.mjs

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+import {
+  getCredentialFilePath
+} from "./chunk-AXXUGU7Q.mjs";
+import {
+  atomicWriteFile
+} from "./chunk-TAEQKBJB.mjs";
+import {
+  ensureDir,
+  readJsonFile
+} from "./chunk-RDYXWXXC.mjs";
+import {
+  PROJECT_DIR_NAME
+} from "./chunk-M7UVBANQ.mjs";
+
+// src/config/global-config.ts
+import os from "os";
+import path from "path";
+function normalizeCredentialBackend(value) {
+  if (value === "file" || value === "keychain") return value;
+  return void 0;
+}
+function getGlobalConfigPath() {
+  return path.join(os.homedir(), PROJECT_DIR_NAME, "config.json");
+}
+function getGlobalAuthPath() {
+  return getCredentialFilePath();
+}
+async function loadGlobalConfig() {
+  const config = await readJsonFile(getGlobalConfigPath()).catch(
+    () => ({})
+  );
+  return {
+    environment: config.environment,
+    credentialBackend: normalizeCredentialBackend(config.credentialBackend)
+  };
+}
+async function saveGlobalConfig(config) {
+  const configDir = path.join(os.homedir(), PROJECT_DIR_NAME);
+  await ensureDir(configDir);
+  const normalized = {
+    environment: config.environment,
+    credentialBackend: normalizeCredentialBackend(config.credentialBackend)
+  };
+  await atomicWriteFile(
+    getGlobalConfigPath(),
+    `${JSON.stringify(normalized, null, 2)}
+`,
+    { mode: 384 }
+  );
+}
+
+export {
+  getGlobalConfigPath,
+  getGlobalAuthPath,
+  loadGlobalConfig,
+  saveGlobalConfig
+};
+//# sourceMappingURL=chunk-DPYC2NDB.mjs.map

package/dist/agent-verifier/chunk-DPYC2NDB.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/config/global-config.ts"],"sourcesContent":["import os from \"node:os\";\nimport path from \"node:path\";\nimport type { CredentialBackendPreference, GlobalConfig } from \"../types.js\";\nimport { PROJECT_DIR_NAME } from \"../constants.js\";\nimport { ensureDir, readJsonFile } from \"../utils/fs.js\";\nimport { atomicWriteFile } from \"../utils/atomic-file.js\";\nimport { getCredentialFilePath } from \"./credential-store.js\";\n\nfunction normalizeCredentialBackend(\n  value: unknown,\n): CredentialBackendPreference | undefined {\n  if (value === \"file\" || value === \"keychain\") return value;\n  // Tolerate unknown / malformed values rather than refusing to load the\n  // whole config - an unrecognised backend name should degrade to \"use\n  // the default\" instead of locking the user out of their CLI.\n  return undefined;\n}\n\nexport function getGlobalConfigPath(): string {\n  return path.join(os.homedir(), PROJECT_DIR_NAME, \"config.json\");\n}\n\n/**\n * Path to the on-disk credential file used by the file backend of\n * `CredentialStore`. Re-exported here to avoid circular / ad-hoc imports\n * in UI surface (`auth status`, `config show`, etc).\n */\nexport function getGlobalAuthPath(): string {\n  return getCredentialFilePath();\n}\n\n/**\n * Load non-credential CLI configuration.\n *\n * Note: this function used to also load `authToken` / `refreshToken`\n * from `auth.json` and flatten them onto `GlobalConfig`. That shape\n * enabled the refresh-token-wipe bug: `saveGlobalConfig({ ...config })`\n * without explicit auth fields erased the stored refresh token.\n *\n * Credentials are now owned exclusively by `CredentialStore`. Callers\n * that need them must import `getCredentials()` directly.\n */\nexport async function loadGlobalConfig(): Promise<GlobalConfig> {\n  const config = await readJsonFile<GlobalConfig>(getGlobalConfigPath()).catch(\n    () => ({}) as GlobalConfig,\n  );\n  return {\n    environment: config.environment,\n    credentialBackend: normalizeCredentialBackend(config.credentialBackend),\n  };\n}\n\n/**\n * Persist non-credential CLI configuration.\n *\n * This function cannot write credentials, by construction: the\n * `GlobalConfig` type has no credential fields. Credentials must be\n * persisted through `setCredentials` / `clearCredentials` from\n * `credential-store.ts`.\n */\nexport async function saveGlobalConfig(config: GlobalConfig): Promise<void> {\n  const configDir = path.join(os.homedir(), PROJECT_DIR_NAME);\n  await ensureDir(configDir);\n  const normalized: GlobalConfig = {\n    environment: config.environment,\n    credentialBackend: normalizeCredentialBackend(config.credentialBackend),\n  };\n  await atomicWriteFile(\n    getGlobalConfigPath(),\n    `${JSON.stringify(normalized, null, 2)}\\n`,\n    { mode: 0o600 },\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AAOjB,SAAS,2BACP,OACyC;AACzC,MAAI,UAAU,UAAU,UAAU,WAAY,QAAO;AAIrD,SAAO;AACT;AAEO,SAAS,sBAA8B;AAC5C,SAAO,KAAK,KAAK,GAAG,QAAQ,GAAG,kBAAkB,aAAa;AAChE;AAOO,SAAS,oBAA4B;AAC1C,SAAO,sBAAsB;AAC/B;AAaA,eAAsB,mBAA0C;AAC9D,QAAM,SAAS,MAAM,aAA2B,oBAAoB,CAAC,EAAE;AAAA,IACrE,OAAO,CAAC;AAAA,EACV;AACA,SAAO;AAAA,IACL,aAAa,OAAO;AAAA,IACpB,mBAAmB,2BAA2B,OAAO,iBAAiB;AAAA,EACxE;AACF;AAUA,eAAsB,iBAAiB,QAAqC;AAC1E,QAAM,YAAY,KAAK,KAAK,GAAG,QAAQ,GAAG,gBAAgB;AAC1D,QAAM,UAAU,SAAS;AACzB,QAAM,aAA2B;AAAA,IAC/B,aAAa,OAAO;AAAA,IACpB,mBAAmB,2BAA2B,OAAO,iBAAiB;AAAA,EACxE;AACA,QAAM;AAAA,IACJ,oBAAoB;AAAA,IACpB,GAAG,KAAK,UAAU,YAAY,MAAM,CAAC,CAAC;AAAA;AAAA,IACtC,EAAE,MAAM,IAAM;AAAA,EAChB;AACF;","names":[]}