@getrift/rift 0.1.0-beta.17 → 0.1.0-beta.19

package/dist/src/cli/feedback/feedback-relay.d.ts

@@ -1,4 +1,4 @@
-import type { FeedbackPayload } from "./feedback-payload.js";
+import type { FeedbackPayload, SignupPayload } from "./feedback-payload.js";
 export interface RelayResult {
     attempted: boolean;
     ok: boolean;
@@ -11,5 +11,5 @@ export interface RelayOpts {
     fetchFn?: typeof fetch;
     timeoutMs?: number;
 }
-export declare function postFeedback(payload: FeedbackPayload, opts: RelayOpts): Promise<RelayResult>;
+export declare function postFeedback(payload: FeedbackPayload | SignupPayload, opts: RelayOpts): Promise<RelayResult>;
 //# sourceMappingURL=feedback-relay.d.ts.map

package/dist/src/cli/feedback/feedback-relay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feedback-relay.d.ts","sourceRoot":"","sources":["../../../../src/cli/feedback/feedback-relay.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,WAAW,CAAC,CA+BtB"}
+{"version":3,"file":"feedback-relay.d.ts","sourceRoot":"","sources":["../../../../src/cli/feedback/feedback-relay.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE5E,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,eAAe,GAAG,aAAa,EACxC,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,WAAW,CAAC,CA+BtB"}

package/dist/src/cli/feedback/feedback-relay.js.map

@@ -1 +1 @@
-{"version":3,"file":"feedback-relay.js","sourceRoot":"","sources":["../../../../src/cli/feedback/feedback-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiBzC,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAwB,EACxB,IAAe;IAEf,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7E,OAAO,CAAC,kBAAkB,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE;YACX,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;YACnD,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,SAAS,EAAE,IAAI;YACf,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}
+{"version":3,"file":"feedback-relay.js","sourceRoot":"","sources":["../../../../src/cli/feedback/feedback-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiBzC,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAwC,EACxC,IAAe;IAEf,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7E,OAAO,CAAC,kBAAkB,CAAC,GAAG,UAAU,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE;YACX,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;YACnD,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,SAAS,EAAE,IAAI;YACf,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/src/cli/feedback/invite.d.ts

@@ -0,0 +1,17 @@
+export interface RiftInvite {
+    url: string;
+    secret: string;
+    label?: string;
+}
+/**
+ * Decode an invite code into its parts. Throws a `validation` CliError on any
+ * malformation (bad prefix, bad base64, bad JSON, missing/invalid fields) with
+ * one friend-facing message — never leaks the decode internals.
+ */
+export declare function parseInvite(raw: string): RiftInvite;
+/**
+ * Build an invite code from its parts. The operator-side counterpart to
+ * `parseInvite` (used to mint codes and to round-trip in tests).
+ */
+export declare function formatInvite(invite: RiftInvite): string;
+//# sourceMappingURL=invite.d.ts.map

package/dist/src/cli/feedback/invite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.d.ts","sourceRoot":"","sources":["../../../../src/cli/feedback/invite.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAKD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAmBnD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAWvD"}

package/dist/src/cli/feedback/invite.js

@@ -0,0 +1,67 @@
+/**
+ * Feedback-relay invite codes.
+ *
+ * An invite is a single opaque string the operator hands a friend. It carries
+ * the relay URL + the HMAC secret so the friend never sees or types a raw
+ * secret — they paste ONE blob and Rift does the rest (URL → config, secret →
+ * Keychain). Shape:
+ *
+ *   rift-invite_<base64url(JSON)>   where JSON = { v: 1, url, secret, label? }
+ *
+ * NOTE (deferred, tracked): the invite embeds the *shared* beta secret, so it
+ * is only as revocable as that secret. Acceptable for beta (it signs feedback
+ * to Clem, low stakes); the revocable per-install token is the future upgrade.
+ */
+import { z } from "zod";
+import { CliError } from "../http-client.js";
+const INVITE_PREFIX = "rift-invite_";
+const InvitePayloadSchema = z
+    .object({
+    v: z.literal(1),
+    url: z.string().url(),
+    secret: z.string().min(1),
+    label: z.string().min(1).optional(),
+})
+    .strict();
+const INVALID = "That invite code is not valid. Ask Clem for a fresh `rift-invite_…` code.";
+/**
+ * Decode an invite code into its parts. Throws a `validation` CliError on any
+ * malformation (bad prefix, bad base64, bad JSON, missing/invalid fields) with
+ * one friend-facing message — never leaks the decode internals.
+ */
+export function parseInvite(raw) {
+    const code = raw.trim();
+    if (!code.startsWith(INVITE_PREFIX)) {
+        throw new CliError(INVALID, "validation");
+    }
+    const encoded = code.slice(INVITE_PREFIX.length);
+    let json;
+    try {
+        const decoded = Buffer.from(encoded, "base64url").toString("utf8");
+        json = JSON.parse(decoded);
+    }
+    catch {
+        throw new CliError(INVALID, "validation");
+    }
+    const parsed = InvitePayloadSchema.safeParse(json);
+    if (!parsed.success) {
+        throw new CliError(INVALID, "validation");
+    }
+    const { url, secret, label } = parsed.data;
+    return { url, secret, ...(label ? { label } : {}) };
+}
+/**
+ * Build an invite code from its parts. The operator-side counterpart to
+ * `parseInvite` (used to mint codes and to round-trip in tests).
+ */
+export function formatInvite(invite) {
+    const payload = {
+        v: 1,
+        url: invite.url,
+        secret: invite.secret,
+        ...(invite.label ? { label: invite.label } : {}),
+    };
+    const encoded = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+    return `${INVITE_PREFIX}${encoded}`;
+}
+//# sourceMappingURL=invite.js.map

package/dist/src/cli/feedback/invite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.js","sourceRoot":"","sources":["../../../../src/cli/feedback/invite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,MAAM,aAAa,GAAG,cAAc,CAAC;AAErC,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAQZ,MAAM,OAAO,GACX,2EAA2E,CAAC;AAE9E;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,MAAM,OAAO,GAAG;QACd,CAAC,EAAE,CAAU;QACb,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CACnE,WAAW,CACZ,CAAC;IACF,OAAO,GAAG,aAAa,GAAG,OAAO,EAAE,CAAC;AACtC,CAAC"}

package/dist/src/cli/feedback/relay-secret-store.d.ts

@@ -0,0 +1,32 @@
+/** Minimal shape of the promisified `execFile` we depend on (stdout only). */
+type ExecFn = (file: string, args: string[]) => Promise<{
+    stdout: string;
+}>;
+/**
+ * Storage for the relay HMAC secret. Abstracted so the feedback paths can be
+ * tested with an in-memory implementation that never shells out to `security`.
+ */
+export interface RelaySecretStore {
+    /** The stored secret, or null when none is set. */
+    read(): Promise<string | null>;
+    /** Write (or overwrite) the secret. */
+    write(secret: string): Promise<void>;
+    /** Remove the secret. No-op when already absent. */
+    delete(): Promise<void>;
+}
+/**
+ * Production store backed by the macOS `security` CLI. `exec` is injectable so
+ * tests can drive the error mapping (locked keychain, item-not-found) without
+ * a real Keychain. There is deliberately NO plaintext fallback — if the secret
+ * cannot be stored securely, relay signing is simply unavailable.
+ */
+export declare function createMacRelaySecretStore(exec?: ExecFn): RelaySecretStore;
+/** Production store backed by the real macOS `security` CLI. */
+export declare const macRelaySecretStore: RelaySecretStore;
+/**
+ * In-memory store for tests and any non-Keychain injection point. Holds the
+ * secret in a closure — never persisted. Production code never reaches for it.
+ */
+export declare function createInMemoryRelaySecretStore(initial?: string | null): RelaySecretStore;
+export {};
+//# sourceMappingURL=relay-secret-store.d.ts.map

package/dist/src/cli/feedback/relay-secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-secret-store.d.ts","sourceRoot":"","sources":["../../../../src/cli/feedback/relay-secret-store.ts"],"names":[],"mappings":"AAmBA,8EAA8E;AAC9E,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA2C5E;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/B,uCAAuC;IACvC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,oDAAoD;IACpD,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,GAAE,MAAoB,GAAG,gBAAgB,CAmDtF;AAED,gEAAgE;AAChE,eAAO,MAAM,mBAAmB,EAAE,gBAA8C,CAAC;AAEjF;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GACtB,gBAAgB,CAalB"}

package/dist/src/cli/feedback/relay-secret-store.js

@@ -0,0 +1,137 @@
+/**
+ * Secure storage for the feedback-relay HMAC secret.
+ *
+ * The secret proves a feedback POST came from a configured Rift install (the
+ * Cloudflare Worker validates the `X-Rift-Signature` HMAC). It is a real
+ * secret, so it must NOT sit in plaintext `feedback-config.json`. It lives in
+ * the macOS Keychain instead, under the same service as the daemon auth token
+ * (`com.getrift.daemon`) so all Rift secrets share one keychain service.
+ *
+ * The store is an injectable interface: production uses the `security` CLI;
+ * tests inject `createInMemoryRelaySecretStore()` (no real Keychain, no GUI
+ * session) or `createMacRelaySecretStore(fakeExec)` to exercise the error
+ * mapping without shelling out.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { LockedKeychainError } from "../../auth/keychain.js";
+const defaultExec = promisify(execFile);
+/** Same keychain service as the daemon auth token — one service per app. */
+const SERVICE = "com.getrift.daemon";
+/** Single (non-versioned) generic-password account for the relay secret. */
+const ACCOUNT = "RELAY_HMAC_SECRET";
+/** macOS `security` exit code for errSecItemNotFound — the only swallowed one. */
+const ERR_SEC_ITEM_NOT_FOUND = 44;
+/** Substring the `security` CLI emits when the login keychain is locked. */
+const LOCKED_KEYCHAIN_SUBSTRING = "User interaction is not allowed";
+// Predicates mirror the private helpers in ../../auth/keychain.ts. Kept local
+// (not exported from there) to avoid refactoring the heavily-tested auth path;
+// the auth token store remains the single owner of those internals.
+function isItemNotFound(err) {
+    if (!(err instanceof Error))
+        return false;
+    return err.code === ERR_SEC_ITEM_NOT_FOUND;
+}
+function isLockedKeychain(err) {
+    if (!(err instanceof Error))
+        return false;
+    if (err.message.includes(LOCKED_KEYCHAIN_SUBSTRING))
+        return true;
+    const stderr = err.stderr;
+    return typeof stderr === "string" && stderr.includes(LOCKED_KEYCHAIN_SUBSTRING);
+}
+/**
+ * Normalize a `security` failure: a locked keychain becomes the typed
+ * `LockedKeychainError` (so callers render the unlock hint instead of leaking
+ * raw `security` output); every other error propagates unchanged. Applied on
+ * EVERY path — read, write, and delete — so write failures during invite
+ * setup map the same way reads do.
+ */
+function rethrowKeychainError(err) {
+    if (isLockedKeychain(err)) {
+        throw new LockedKeychainError(err instanceof Error ? err.message : String(err));
+    }
+    throw err;
+}
+/**
+ * Production store backed by the macOS `security` CLI. `exec` is injectable so
+ * tests can drive the error mapping (locked keychain, item-not-found) without
+ * a real Keychain. There is deliberately NO plaintext fallback — if the secret
+ * cannot be stored securely, relay signing is simply unavailable.
+ */
+export function createMacRelaySecretStore(exec = defaultExec) {
+    return {
+        async read() {
+            try {
+                const { stdout } = await exec("security", [
+                    "find-generic-password",
+                    "-a",
+                    ACCOUNT,
+                    "-s",
+                    SERVICE,
+                    "-w",
+                ]);
+                return stdout.trim() || null;
+            }
+            catch (err) {
+                if (isItemNotFound(err))
+                    return null;
+                rethrowKeychainError(err);
+            }
+        },
+        async write(secret) {
+            try {
+                await exec("security", [
+                    "add-generic-password",
+                    "-a",
+                    ACCOUNT,
+                    "-s",
+                    SERVICE,
+                    "-w",
+                    secret,
+                    "-U", // update in place if it already exists
+                ]);
+            }
+            catch (err) {
+                rethrowKeychainError(err);
+            }
+        },
+        async delete() {
+            try {
+                await exec("security", [
+                    "delete-generic-password",
+                    "-a",
+                    ACCOUNT,
+                    "-s",
+                    SERVICE,
+                ]);
+            }
+            catch (err) {
+                if (isItemNotFound(err))
+                    return; // already gone — fine
+                rethrowKeychainError(err);
+            }
+        },
+    };
+}
+/** Production store backed by the real macOS `security` CLI. */
+export const macRelaySecretStore = createMacRelaySecretStore();
+/**
+ * In-memory store for tests and any non-Keychain injection point. Holds the
+ * secret in a closure — never persisted. Production code never reaches for it.
+ */
+export function createInMemoryRelaySecretStore(initial) {
+    let secret = initial ?? null;
+    return {
+        async read() {
+            return secret;
+        },
+        async write(value) {
+            secret = value;
+        },
+        async delete() {
+            secret = null;
+        },
+    };
+}
+//# sourceMappingURL=relay-secret-store.js.map

package/dist/src/cli/feedback/relay-secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-secret-store.js","sourceRoot":"","sources":["../../../../src/cli/feedback/relay-secret-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAK7D,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAsB,CAAC;AAE7D,4EAA4E;AAC5E,MAAM,OAAO,GAAG,oBAAoB,CAAC;AACrC,4EAA4E;AAC5E,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAEpC,kFAAkF;AAClF,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,4EAA4E;AAC5E,MAAM,yBAAyB,GAAG,iCAAiC,CAAC;AAEpE,8EAA8E;AAC9E,+EAA+E;AAC/E,oEAAoE;AACpE,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAQ,GAAyB,CAAC,IAAI,KAAK,sBAAsB,CAAC;AACpE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,CAAC;IACnD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,mBAAmB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAeD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe,WAAW;IAClE,OAAO;QACL,KAAK,CAAC,IAAI;YACR,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;oBACxC,uBAAuB;oBACvB,IAAI;oBACJ,OAAO;oBACP,IAAI;oBACJ,OAAO;oBACP,IAAI;iBACL,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,cAAc,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACrC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,MAAM;YAChB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,EAAE;oBACrB,sBAAsB;oBACtB,IAAI;oBACJ,OAAO;oBACP,IAAI;oBACJ,OAAO;oBACP,IAAI;oBACJ,MAAM;oBACN,IAAI,EAAE,uCAAuC;iBAC9C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM;YACV,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,EAAE;oBACrB,yBAAyB;oBACzB,IAAI;oBACJ,OAAO;oBACP,IAAI;oBACJ,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,cAAc,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,sBAAsB;gBACvD,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAqB,yBAAyB,EAAE,CAAC;AAEjF;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAuB;IAEvB,IAAI,MAAM,GAAkB,OAAO,IAAI,IAAI,CAAC;IAC5C,OAAO;QACL,KAAK,CAAC,IAAI;YACR,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,KAAa;YACvB,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,MAAM;YACV,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/cli/http-client.d.ts

@@ -56,10 +56,23 @@ export declare function requireExistingConfigPath(globalOpts: {
     config?: string;
 }): string;
 /**
- * No-config, no-auth direct probe of the daemon's /health endpoint.
- * Used by `rift status` only — every other command needs config and
- * auth. Per A-2.3a/A-2.3b: `rift status` MUST NOT hard-fail when the
- * config is absent; it renders "config missing" instead, with the
+ * No-auth probe of a daemon's /health endpoint at an explicit base URL.
+ * `/health` is unauthenticated by design, so this needs neither a token nor
+ * a round-trip through the authenticated client. Returns the daemon's own
+ * ground truth for `voyage_key_present` — the only correct source for any
+ * "is a Voyage key loaded?" gate, since the daemon (not the calling shell)
+ * is the process that saves and embeds.
+ */
+export declare function probeDaemonHealth(baseUrl: string): Promise<{
+    up: boolean;
+    uptimeSeconds?: number;
+    voyageKeyPresent?: boolean;
+}>;
+/**
+ * No-config, no-auth direct probe of the daemon's /health endpoint at the
+ * default loopback URL. Used by `rift status` only — every other command
+ * needs config and auth. Per A-2.3a/A-2.3b: `rift status` MUST NOT hard-fail
+ * when the config is absent; it renders "config missing" instead, with the
  * daemon's actual up/down state taken from this probe.
  */
 export declare function probeDefaultDaemonHealth(): Promise<{

package/dist/src/cli/http-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../../src/cli/http-client.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,cAAc,GACd,WAAW,GACX,SAAS,GACT,UAAU,GACV,cAAc,GACd,YAAY,GACZ,cAAc,GACd,SAAS,CAAC;AAEd,qBAAa,QAAS,SAAQ,KAAK;aAGf,IAAI,EAAE,YAAY;aAClB,UAAU,CAAC,EAAE,MAAM;aACnB,IAAI,CAAC,EAAE,OAAO;gBAH9B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,YAAY,EAClB,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,IAAI,CAAC,EAAE,OAAO,YAAA;CAKjC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9C,aAAa,CACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/D;AA6ED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,CAqGjE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAezE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAqBT;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC;IACxD,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC,CAuBD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAqBzD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,GAAE,WAAyB,GAClC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqBxB"}
+{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../../src/cli/http-client.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,cAAc,GACd,WAAW,GACX,SAAS,GACT,UAAU,GACV,cAAc,GACd,YAAY,GACZ,cAAc,GACd,SAAS,CAAC;AAEd,qBAAa,QAAS,SAAQ,KAAK;aAGf,IAAI,EAAE,YAAY;aAClB,UAAU,CAAC,EAAE,MAAM;aACnB,IAAI,CAAC,EAAE,OAAO;gBAH9B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,YAAY,EAClB,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,IAAI,CAAC,EAAE,OAAO,YAAA;CAKjC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9C,aAAa,CACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/D;AA6ED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,CAqGjE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAezE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAqBT;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAChE,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC,CAuBD;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC;IACxD,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC,CAED;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAqBzD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,GAAE,WAAyB,GAClC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqBxB"}

package/dist/src/cli/http-client.js

@@ -186,17 +186,18 @@ export function requireExistingConfigPath(globalOpts) {
     return resolved;
 }
 /**
- * No-config, no-auth direct probe of the daemon's /health endpoint.
- * Used by `rift status` only — every other command needs config and
- * auth. Per A-2.3a/A-2.3b: `rift status` MUST NOT hard-fail when the
- * config is absent; it renders "config missing" instead, with the
- * daemon's actual up/down state taken from this probe.
+ * No-auth probe of a daemon's /health endpoint at an explicit base URL.
+ * `/health` is unauthenticated by design, so this needs neither a token nor
+ * a round-trip through the authenticated client. Returns the daemon's own
+ * ground truth for `voyage_key_present` — the only correct source for any
+ * "is a Voyage key loaded?" gate, since the daemon (not the calling shell)
+ * is the process that saves and embeds.
  */
-export async function probeDefaultDaemonHealth() {
+export async function probeDaemonHealth(baseUrl) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), 2000);
     try {
-        const res = await fetch("http://127.0.0.1:3577/health", {
+        const res = await fetch(`${baseUrl.replace(/\/$/, "")}/health`, {
             signal: controller.signal,
         });
         if (!res.ok)
@@ -218,6 +219,16 @@ export async function probeDefaultDaemonHealth() {
         clearTimeout(timer);
     }
 }
+/**
+ * No-config, no-auth direct probe of the daemon's /health endpoint at the
+ * default loopback URL. Used by `rift status` only — every other command
+ * needs config and auth. Per A-2.3a/A-2.3b: `rift status` MUST NOT hard-fail
+ * when the config is absent; it renders "config missing" instead, with the
+ * daemon's actual up/down state taken from this probe.
+ */
+export async function probeDefaultDaemonHealth() {
+    return probeDaemonHealth("http://127.0.0.1:3577");
+}
 /**
  * resolveBaseUrl stays strict — only commands that actually need the
  * daemon URL call it, and they all need a real config. Per A-2.3a:

package/dist/src/cli/http-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-client.js","sourceRoot":"","sources":["../../../src/cli/http-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EACL,WAAW,EACX,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAa7D,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IACA;IACA;IAJlB,YACE,OAAe,EACC,IAAkB,EAClB,UAAmB,EACnB,IAAc;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAc;QAClB,eAAU,GAAV,UAAU,CAAS;QACnB,SAAI,GAAJ,IAAI,CAAU;QAG9B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAuBD,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,KAAK,GAAI,GAAqC,CAAC,KAAK,CAAC;QAC3D,IAAI,KAAK,EAAE,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;QAC7C,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,OAAQ,IAA4B,CAAC,KAAK,KAAK,QAAQ,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,IAAa;IACrD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,IAAI,QAAQ,CACjB,8CAA8C,EAC9C,cAAc,EACd,MAAM,EACN,IAAI,CACL,CAAC;QACJ,KAAK,GAAG;YACN,oEAAoE;YACpE,qEAAqE;YACrE,mEAAmE;YACnE,OAAO,IAAI,QAAQ,CACjB,aAAa,CAAC,IAAI,CAAC;gBACjB,CAAC,CAAC,cAAc,eAAe,CAAC,IAAI,CAAC,EAAE;gBACvC,CAAC,CAAC,wBAAwB,EAC5B,WAAW,EACX,MAAM,EACN,IAAI,CACL,CAAC;QACJ,KAAK,GAAG;YACN,gEAAgE;YAChE,iEAAiE;YACjE,OAAO,IAAI,QAAQ,CACjB,aAAa,CAAC,IAAI,CAAC;gBACjB,CAAC,CAAC,aAAa,eAAe,CAAC,IAAI,CAAC,EAAE;gBACtC,CAAC,CAAC,wCAAwC,EAC5C,UAAU,EACV,MAAM,EACN,IAAI,CACL,CAAC;QACJ,KAAK,GAAG;YACN,OAAO,IAAI,QAAQ,CAAC,4BAA4B,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAClF;YACE,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBAClC,OAAO,IAAI,QAAQ,CACjB,mBAAmB,MAAM,GAAG,EAC5B,YAAY,EACZ,MAAM,EACN,IAAI,CACL,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,QAAQ,CACjB,iBAAiB,MAAM,GAAG,EAC1B,cAAc,EACd,MAAM,EACN,IAAI,CACL,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IAChC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAY,EACZ,OAKC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG;YACnB,GAAG,OAAO;YACV,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;SAC5B,CAAC;QACF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,OAAO,YAAY,CAAC,cAAc,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;gBACjB,MAAM;gBACN,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;gBAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,QAAQ,CAChB,+BAA+B,IAAI,CAAC,OAAO,kBAAkB,EAC7D,oBAAoB,CACrB,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC/D,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACpE,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAY;YACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,IAAI,CACR,IAAY,EACZ,IAAc,EACd,OAA8C;YAE9C,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC3B,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBACtD,SAAS,EAAE,OAAO;gBAClB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,IAAc,EACd,OAA8C;YAE9C,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC3B,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,IAAI;gBACf,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,IAAY;YACpB,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA+B;IAC/D,iEAAiE;IACjE,sEAAsE;IACtE,gEAAgE;IAChE,8DAA8D;IAC9D,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC;IACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,kEAAkE;IAClE,mEAAmE;IACnE,qCAAqC;IACrC,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAEzC;IACC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,KAAK;YACnB,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,uBAAuB,QAAQ,0EAA0E,EACzG,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,QAAQ,CAChB,qBAAqB,QAAQ,KAAK,MAAM,GAAG,EAC3C,SAAS,CACV,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAK5C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,8BAA8B,EAAE;YACtD,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAwE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACjG,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;YAAE,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC;QACxF,IAAI,OAAO,IAAI,CAAC,kBAAkB,KAAK,SAAS;YAAE,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACpG,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,KAAK;YACnB,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,uBAAuB,UAAU,0EAA0E,EAC3G,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,QAAQ,CAChB,qBAAqB,UAAU,KAAK,MAAM,GAAG,EAC7C,SAAS,CACV,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,WAAwB,WAAW;IAEnC,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,MAAM,sBAAsB,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,MAAM,sBAAsB,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,IAAI,QAAQ,CACjB,oDAAoD;QAClD,mEAAmE;QACnE,yEAAyE;QACzE,uFAAuF,EACzF,cAAc,CACf,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;QACjC,sEAAsE;QACtE,sEAAsE;QACtE,sCAAsC;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC;KACxC,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"http-client.js","sourceRoot":"","sources":["../../../src/cli/http-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EACL,WAAW,EACX,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAa7D,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IACA;IACA;IAJlB,YACE,OAAe,EACC,IAAkB,EAClB,UAAmB,EACnB,IAAc;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAc;QAClB,eAAU,GAAV,UAAU,CAAS;QACnB,SAAI,GAAJ,IAAI,CAAU;QAG9B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAuBD,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,KAAK,GAAI,GAAqC,CAAC,KAAK,CAAC;QAC3D,IAAI,KAAK,EAAE,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;QAC7C,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,OAAQ,IAA4B,CAAC,KAAK,KAAK,QAAQ,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,IAAa;IACrD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,IAAI,QAAQ,CACjB,8CAA8C,EAC9C,cAAc,EACd,MAAM,EACN,IAAI,CACL,CAAC;QACJ,KAAK,GAAG;YACN,oEAAoE;YACpE,qEAAqE;YACrE,mEAAmE;YACnE,OAAO,IAAI,QAAQ,CACjB,aAAa,CAAC,IAAI,CAAC;gBACjB,CAAC,CAAC,cAAc,eAAe,CAAC,IAAI,CAAC,EAAE;gBACvC,CAAC,CAAC,wBAAwB,EAC5B,WAAW,EACX,MAAM,EACN,IAAI,CACL,CAAC;QACJ,KAAK,GAAG;YACN,gEAAgE;YAChE,iEAAiE;YACjE,OAAO,IAAI,QAAQ,CACjB,aAAa,CAAC,IAAI,CAAC;gBACjB,CAAC,CAAC,aAAa,eAAe,CAAC,IAAI,CAAC,EAAE;gBACtC,CAAC,CAAC,wCAAwC,EAC5C,UAAU,EACV,MAAM,EACN,IAAI,CACL,CAAC;QACJ,KAAK,GAAG;YACN,OAAO,IAAI,QAAQ,CAAC,4BAA4B,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAClF;YACE,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBAClC,OAAO,IAAI,QAAQ,CACjB,mBAAmB,MAAM,GAAG,EAC5B,YAAY,EACZ,MAAM,EACN,IAAI,CACL,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,QAAQ,CACjB,iBAAiB,MAAM,GAAG,EAC1B,cAAc,EACd,MAAM,EACN,IAAI,CACL,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IAChC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAY,EACZ,OAKC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG;YACnB,GAAG,OAAO;YACV,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;SAC5B,CAAC;QACF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,OAAO,YAAY,CAAC,cAAc,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;gBACjB,MAAM;gBACN,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;gBAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,QAAQ,CAChB,+BAA+B,IAAI,CAAC,OAAO,kBAAkB,EAC7D,oBAAoB,CACrB,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC/D,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACpE,SAAS,CACV,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAY;YACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,IAAI,CACR,IAAY,EACZ,IAAc,EACd,OAA8C;YAE9C,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC3B,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBACtD,SAAS,EAAE,OAAO;gBAClB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,IAAc,EACd,OAA8C;YAE9C,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC3B,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,IAAI;gBACf,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,IAAY;YACpB,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA+B;IAC/D,iEAAiE;IACjE,sEAAsE;IACtE,gEAAgE;IAChE,8DAA8D;IAC9D,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC;IACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,kEAAkE;IAClE,mEAAmE;IACnE,qCAAqC;IACrC,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAEzC;IACC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,KAAK;YACnB,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,uBAAuB,QAAQ,0EAA0E,EACzG,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,QAAQ,CAChB,qBAAqB,QAAQ,KAAK,MAAM,GAAG,EAC3C,SAAS,CACV,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe;IAKrD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAwE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACjG,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;YAAE,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC;QACxF,IAAI,OAAO,IAAI,CAAC,kBAAkB,KAAK,SAAS;YAAE,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACpG,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAK5C,OAAO,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,KAAK;YACnB,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,uBAAuB,UAAU,0EAA0E,EAC3G,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,QAAQ,CAChB,qBAAqB,UAAU,KAAK,MAAM,GAAG,EAC7C,SAAS,CACV,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,WAAwB,WAAW;IAEnC,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,MAAM,sBAAsB,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,MAAM,sBAAsB,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,IAAI,QAAQ,CACjB,oDAAoD;QAClD,mEAAmE;QACnE,yEAAyE;QACzE,uFAAuF,EACzF,cAAc,CACf,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;QACjC,sEAAsE;QACtE,sEAAsE;QACtE,sCAAsC;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC;KACxC,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/cli/status/friend-header.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"friend-header.d.ts","sourceRoot":"","sources":["../../../../src/cli/status/friend-header.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,sCAAsC,CAAC;AAG9C,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,yEAAyE;IACzE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qDAAqD;IACrD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAuFrE;AAkSD,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI1D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,sBAAsB,GAAG,SAAS,EAC9C,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,IAAI,CAef;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUtD"}
+{"version":3,"file":"friend-header.d.ts","sourceRoot":"","sources":["../../../../src/cli/status/friend-header.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,sCAAsC,CAAC;AAG9C,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,yEAAyE;IACzE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qDAAqD;IACrD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAiFrE;AA+VD,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI1D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,sBAAsB,GAAG,SAAS,EAC9C,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,IAAI,CAef;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUtD"}

package/dist/src/cli/status/friend-header.js

@@ -15,7 +15,7 @@ export function renderFriendHeader(input) {
     // healthy respawn.
     const daemonStartMs = now - status.daemon.uptime_seconds * 1000;
     // 1. version + daemon
-    lines.push(`Rift v${status.build.version}  ·  daemon: running (uptime ${formatDuration(status.daemon.uptime_seconds)})  ·  port ${status.daemon.port} ${status.daemon.voyage_key_present ? "✓" : "✗"}`);
+    lines.push(`Rift v${status.build.version}  ·  daemon: running (uptime ${formatDuration(status.daemon.uptime_seconds)})  ·  port ${status.daemon.port}${status.daemon.voyage_key_present ? " ✓" : status.daemon.capture_enabled ? " ✗" : ""}`);
     // 2. voyage
     lines.push(renderVoyageLine(input, now));
     // 3. index — distinct from voyage: an embed can succeed but the
@@ -43,9 +43,7 @@ export function renderFriendHeader(input) {
     // 7. MCP
     lines.push(renderMcpLine(input.mcpClients));
     // 8. feedback
-    lines.push(`Feedback:    ${status.feedback.relay_enabled
-        ? "relay on (local JSONL + Clem-side relay)"
-        : "relay off (local JSONL only) — opt in via rift onboard"}`);
+    lines.push(`Feedback:    ${renderFeedbackLine(status.feedback)}`);
     // 9. update — surfaced only when the daemon's last probe found a
     //    newer beta. Probe failures and up-to-date installs print nothing
     //    so npm reachability cannot make Rift look broken.
@@ -99,6 +97,17 @@ function humanizeErrorClass(reason) {
             return reason;
     }
 }
+function renderFeedbackLine(feedback) {
+    if (feedback.relay_enabled) {
+        return "relay on (local JSONL + Clem-side relay)";
+    }
+    if (feedback.contact_opted_in) {
+        // Opted in for updates, but no relay endpoint is wired yet — be honest
+        // that nothing is transmitting, without telling them to "opt in" again.
+        return "opted in — stays local until the beta relay is live";
+    }
+    return "relay off (local JSONL only) — opt in via rift onboard";
+}
 function renderUpdateLine(update) {
     if (!update.available)
         return null;
@@ -111,7 +120,13 @@ function renderVoyageLine(input, now) {
     if (!status)
         return "Voyage:      unknown";
     if (!status.daemon.voyage_key_present) {
-        return "Voyage:      key missing — run: rift onboard --reconfigure-voyage";
+        // No key is an intentional local mode, not a fault: keyword (lexical)
+        // search is fully on; only semantic search is off. We only nudge toward a
+        // Voyage key when a feature that actually needs one (auto-capture) is
+        // enabled — otherwise the line must read as "working as configured."
+        return status.daemon.capture_enabled
+            ? "Search:      keyword on, semantic off — auto-capture needs a Voyage key: rift onboard --reconfigure-voyage"
+            : "Search:      keyword on · semantic off (no Voyage key — local mode)";
     }
     const last4 = voyageLast4 ? `last 4 …${voyageLast4}` : "key valid";
     const labelSuffix = status.voyage.project_label
@@ -167,7 +182,13 @@ function renderCodexLine(codex, now) {
     if (codex.last_preflight_ok === true) {
         return `Codex CLI:   authed ✓ (last checked: ${formatAge(codex.last_preflight_at, now)})`;
     }
-    return `Codex CLI:   auth expired ✗ (last checked: ${formatAge(codex.last_preflight_at, now)}) — run: codex login`;
+    const checked = `last checked: ${formatAge(codex.last_preflight_at, now)}`;
+    if (codex.last_preflight_error_class === "auth") {
+        return `Codex CLI:   auth expired ✗ (${checked}) — run: codex login`;
+    }
+    // Not auth — say what actually failed and don't nag about login.
+    const summary = codex.last_preflight_error_summary ?? "Codex preflight failed.";
+    return `Codex CLI:   probe failing ✗ (${checked}) — ${summary}`;
 }
 /**
  * True when the daemon's own scheduled loop last failed (during this
@@ -190,6 +211,20 @@ function isDaemonCaptureStale(capture, daemonStartMs) {
         capture.last_run_ok === true &&
         capture.last_errors === 0);
 }
+/**
+ * Split the parked-oversized count into "still self-repairing" vs. "exhausted
+ * retries, needs a manual save". The daemon ships explicit `oversized_repairing`
+ * / `oversized_repair_failed`; an older daemon omits them, so we fall back to
+ * treating every parked session as still-repairing (`parked - failed`, with
+ * failed defaulting to 0) — the calm, accurate read for a daemon that simply
+ * hasn't reported a budget yet.
+ */
+function deriveParkedState(capture) {
+    const parked = capture.oversized_parked ?? 0;
+    const failed = capture.oversized_repair_failed ?? 0;
+    const repairing = capture.oversized_repairing ?? Math.max(parked - failed, 0);
+    return { parked, repairing, failed };
+}
 function renderCaptureLine(capture, now, daemonStale) {
     if (capture.last_run_at === null) {
         const nextOnly = formatNextRunSuffix(capture.next_run_at, now);
@@ -202,11 +237,16 @@ function renderCaptureLine(capture, now, daemonStale) {
     // Driven by the parked-session count (state of the world), NOT
     // `last_quarantined` (the last run's count) — otherwise this visible line
     // flickers between showing and hiding as a stable oversized file dedups on
-    // one run and re-quarantines on the next.
-    const parked = capture.oversized_parked ?? 0;
-    const parkedSuffix = parked > 0
-        ? ` · ${parked} large session${parked === 1 ? "" : "s"} to recover`
-        : "";
+    // one run and re-quarantines on the next. Large sessions now self-repair in
+    // the background, so the suffix reports honest state: "saving …" while Rift
+    // is still recovering them, "need a manual save" only once retries are
+    // exhausted — never a bare "run the repair command" on a self-healing path.
+    const { repairing, failed } = deriveParkedState(capture);
+    const parkedSuffix = failed > 0
+        ? ` · ${failed} large session${failed === 1 ? "" : "s"} need a manual save`
+        : repairing > 0
+            ? ` · saving ${repairing} large session${repairing === 1 ? "" : "s"} to memory`
+            : "";
     // When the split "Automatic:" line is shown it carries the daemon's next
     // tick, so keep it off this line — otherwise a manual run would look
     // scheduled. With no split, this line keeps the next-tick hint.
@@ -251,11 +291,20 @@ function renderMcpLine(clients) {
 }
 function decideNextLine(input) {
     const { status, mcpClients, daemonStartMs } = input;
-    if (!status.daemon.voyage_key_present) {
-        return "Voyage key missing or revoked → run: rift onboard --reconfigure-voyage";
+    // A missing key is only an action item when something needs it. With
+    // auto-capture off, no-key is the intended local mode, so it must not claim
+    // the Next: line — that would read as "broken" on a healthy local install.
+    if (!status.daemon.voyage_key_present && status.daemon.capture_enabled) {
+        return "Auto-capture is on but has no Voyage key to embed with → run: rift onboard --reconfigure-voyage";
     }
     if (status.codex.last_preflight_ok === false) {
-        return "Codex auth expired → run: codex login";
+        if (status.codex.last_preflight_error_class === "auth") {
+            return "Codex auth expired → run: codex login";
+        }
+        if (status.codex.last_preflight_error_class === "model") {
+            return "Codex rejected the model → set codex_cli.model, then: rift capture";
+        }
+        return "Codex capture probe failing → re-run: rift capture";
     }
     // Recency gating: only errors stamped *after* the current daemon
     // start can drive the Next: action. A 20h-old schema_mismatch from a
@@ -295,15 +344,18 @@ function decideNextLine(input) {
     if (missing.length > 0) {
         return `MCP not installed for ${missing.join(", ")} → run: rift mcp install --client=${missing[0]}`;
     }
-    // Oversized Codex sessions parked in quarantine are a graceful skip, not
-    // an error — so they don't bump `last_errors`. They stay out of memory
-    // until recovered, so the Next: line surfaces them and points at the
-    // friend-facing repair (`rift doctor repair capture-large-sessions`), not
-    // the obscure engine command. Keyed off the parked count, not
-    // `last_quarantined`, so it doesn't flicker between runs.
-    const parked = status.capture.oversized_parked ?? 0;
-    if (parked > 0) {
-        return `${parked} large Codex session${parked === 1 ? "" : "s"} not in memory yet → run: rift doctor repair capture-large-sessions`;
+    // Oversized Codex sessions parked in quarantine are a graceful skip, not an
+    // error — and they now SELF-REPAIR in the background. So the default copy is
+    // the honest in-progress state ("Rift is saving N … to memory"), with NO
+    // command for the friend to run. The manual `rift doctor repair
+    // capture-large-sessions` is surfaced only once a session has exhausted its
+    // bounded retry budget — the genuine "Rift couldn't, you take over" case.
+    const { repairing, failed } = deriveParkedState(status.capture);
+    if (failed > 0) {
+        return `${failed} large Codex session${failed === 1 ? "" : "s"} could not be saved automatically → run: rift doctor repair capture-large-sessions`;
+    }
+    if (repairing > 0) {
+        return `Rift is saving ${repairing} large Codex session${repairing === 1 ? "" : "s"} to memory — no action needed`;
     }
     // Update available wins over "nothing broken" — a friend who runs
     // status precisely to find out what to do next should see the update