@heyditto/cli 2.5.1 → 2.6.0

package/dist/secret-stores/kubernetes.d.ts

@@ -0,0 +1,8 @@
+import type { SecretStore } from "./types.js";
+/**
+ * Kubernetes. The manifest is built here and piped in, so the plaintext never
+ * reaches argv (`--from-literal` would) and never touches disk. A merge patch
+ * comes first because it leaves the secret's other keys alone; `apply` is the
+ * fallback that creates the secret when it does not exist yet.
+ */
+export declare const kubernetes: SecretStore;

package/dist/secret-stores/kubernetes.js

@@ -0,0 +1,76 @@
+import { PATH_PLACEHOLDER, preflight } from "./exec.js";
+import { resourceName, slug } from "./naming.js";
+/** The merge patch the first attempt sends: adds this key, leaves the rest. */
+function mergePatch(key, value) {
+    return `${JSON.stringify({ stringData: { [key]: value } })}\n`;
+}
+const INSTALL_HINT = "install kubectl from https://kubernetes.io/docs/tasks/tools (brew install kubectl), then point it at a cluster with `kubectl config use-context`";
+function target(options) {
+    const namespace = options.namespace ? slug("--namespace", options.namespace, /^[a-z0-9-]+$/) : "default";
+    const key = options.k8sKey ? slug("--k8s-key", options.k8sKey, /^[A-Za-z0-9_.-]+$/) : "key";
+    return { describe: `Kubernetes secret in namespace ${namespace} (key ${key})`, fields: { namespace, key } };
+}
+/**
+ * Kubernetes. The manifest is built here and piped in, so the plaintext never
+ * reaches argv (`--from-literal` would) and never touches disk. A merge patch
+ * comes first because it leaves the secret's other keys alone; `apply` is the
+ * fallback that creates the secret when it does not exist yet.
+ */
+export const kubernetes = {
+    id: "kubernetes",
+    label: "Kubernetes",
+    bin: "kubectl",
+    shorthand: "--k8s-secret",
+    nameLabel: "NAME",
+    installHint: INSTALL_HINT,
+    versionArgs: ["version", "--client=true"],
+    options: ["namespace", "k8sKey"],
+    validateName: (name) => {
+        const trimmed = name.trim();
+        if (trimmed !== trimmed.toLowerCase()) {
+            throw new Error(`"${name}" is not a valid Kubernetes secret name (lowercase letters, digits, dashes and dots only)`);
+        }
+        return resourceName("Kubernetes secret", trimmed, ".");
+    },
+    preflight: () => preflight({
+        bin: "kubectl",
+        label: "Kubernetes",
+        installHint: INSTALL_HINT,
+        versionArgs: kubernetes.versionArgs,
+        authArgs: ["config", "current-context"],
+        authHint: "Select a cluster with `kubectl config use-context <name>` first.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => {
+        const { namespace, key } = t.fields;
+        return [
+            {
+                note: "kubectl patch secret",
+                kind: "path",
+                args: ["patch", "secret", name, "--namespace", namespace, "--type", "merge", "--patch-file", PATH_PLACEHOLDER],
+                payload: (value) => mergePatch(key, value),
+            },
+            {
+                note: "kubectl apply",
+                kind: "stdin",
+                args: ["apply", "--namespace", namespace, "-f", "-"],
+                payload: (value) => `${JSON.stringify({
+                    apiVersion: "v1",
+                    kind: "Secret",
+                    type: "Opaque",
+                    metadata: { name, namespace },
+                    stringData: { [key]: value },
+                })}\n`,
+            },
+        ];
+    },
+    usage: (name, t, gateway) => [
+        "Mount it into a pod:",
+        "  env:",
+        "    - name: OPENAI_API_KEY",
+        `      valueFrom: { secretKeyRef: { name: ${name}, key: ${t.fields.key} } }`,
+        `    - name: OPENAI_BASE_URL`,
+        `      value: ${gateway.openaiBaseUrl}`,
+    ],
+};
+//# sourceMappingURL=kubernetes.js.map

package/dist/secret-stores/kubernetes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes.js","sourceRoot":"","sources":["../../src/secret-stores/kubernetes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGjD,+EAA+E;AAC/E,SAAS,UAAU,CAAC,GAAW,EAAE,KAAa;IAC5C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,MAAM,YAAY,GAChB,kJAAkJ,CAAC;AAErJ,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5F,OAAO,EAAE,QAAQ,EAAE,kCAAkC,SAAS,SAAS,GAAG,GAAG,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;AAC9G,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAgB;IACrC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,YAAY;IACnB,GAAG,EAAE,SAAS;IACd,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC;IACzC,OAAO,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC;IAChC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,2FAA2F,CAAC,CAAC;QACvH,CAAC;QACD,OAAO,YAAY,CAAC,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,QAAQ,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC;QACvC,QAAQ,EAAE,kEAAkE;KAC7E,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;QACpC,OAAO;YACL;gBACE,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,CAAC;gBAC9G,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC;aAC3C;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC;gBACpD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,GAAG,IAAI,CAAC,SAAS,CAAC;oBAChB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC7B,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE;iBAC7B,CAAC,IAAI;aACT;SACF,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC3B,sBAAsB;QACtB,QAAQ;QACR,4BAA4B;QAC5B,4CAA4C,IAAI,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM;QAC5E,6BAA6B;QAC7B,gBAAgB,OAAO,CAAC,aAAa,EAAE;KACxC;CACF,CAAC"}

package/dist/secret-stores/naming.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Per-platform name rules. Each store rejects names its platform would refuse
+ * anyway, before a key is minted, with a message that says what is allowed.
+ */
+/** Env-var style: letters, digits, underscores; not leading with a digit. */
+export declare function envStyleName(label: string, name: string): string;
+/** GitHub Actions additionally reserves the GITHUB_ prefix. */
+export declare function validateSecretName(name: string): string;
+export declare function validateRepo(repo: string): string;
+/**
+ * RFC 1123-ish resource names used by Google Secret Manager, Azure Key Vault
+ * and Kubernetes: letters, digits, dashes (Google also allows underscores).
+ */
+export declare function resourceName(label: string, name: string, extra?: string): string;
+/** Free-form single-line title (1Password items). */
+export declare function titleName(label: string, name: string): string;
+/** A Vault kv path: slash-separated segments, no leading or trailing slash. */
+export declare function secretPath(label: string, name: string): string;
+/** Rejects a scoping flag's value that the platform would not accept. */
+export declare function slug(flag: string, value: string, pattern?: RegExp): string;

package/dist/secret-stores/naming.js

@@ -0,0 +1,62 @@
+/**
+ * Per-platform name rules. Each store rejects names its platform would refuse
+ * anyway, before a key is minted, with a message that says what is allowed.
+ */
+/** Env-var style: letters, digits, underscores; not leading with a digit. */
+export function envStyleName(label, name) {
+    const trimmed = name.trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(trimmed)) {
+        throw new Error(`"${name}" is not a valid ${label} name (letters, digits and underscores; cannot start with a digit)`);
+    }
+    return trimmed;
+}
+/** GitHub Actions additionally reserves the GITHUB_ prefix. */
+export function validateSecretName(name) {
+    const trimmed = envStyleName("GitHub Actions secret", name);
+    if (/^GITHUB_/i.test(trimmed)) {
+        throw new Error(`"${name}" is reserved: GitHub Actions secret names cannot start with GITHUB_`);
+    }
+    return trimmed;
+}
+export function validateRepo(repo) {
+    const trimmed = repo.trim();
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(trimmed)) {
+        throw new Error(`--repo must be owner/repo, got "${repo}"`);
+    }
+    return trimmed;
+}
+/**
+ * RFC 1123-ish resource names used by Google Secret Manager, Azure Key Vault
+ * and Kubernetes: letters, digits, dashes (Google also allows underscores).
+ */
+export function resourceName(label, name, extra = "") {
+    const trimmed = name.trim();
+    const pattern = new RegExp(`^[A-Za-z0-9][A-Za-z0-9${extra}-]{0,253}$`);
+    if (!pattern.test(trimmed)) {
+        throw new Error(`"${name}" is not a valid ${label} name (letters, digits${extra.includes("_") ? ", underscores" : ""} and dashes, starting with a letter or digit)`);
+    }
+    return trimmed;
+}
+/** Free-form single-line title (1Password items). */
+export function titleName(label, name) {
+    const trimmed = name.trim();
+    if (!trimmed || /[\n\r]/.test(trimmed))
+        throw new Error(`"${name}" is not a valid ${label} (one non-empty line)`);
+    return trimmed;
+}
+/** A Vault kv path: slash-separated segments, no leading or trailing slash. */
+export function secretPath(label, name) {
+    const trimmed = name.trim().replace(/^\/+|\/+$/g, "");
+    if (!/^[A-Za-z0-9][A-Za-z0-9_.\-/]*$/.test(trimmed)) {
+        throw new Error(`"${name}" is not a valid ${label} (letters, digits, dashes, dots, underscores and slashes)`);
+    }
+    return trimmed;
+}
+/** Rejects a scoping flag's value that the platform would not accept. */
+export function slug(flag, value, pattern = /^[A-Za-z0-9_.-]+$/) {
+    const trimmed = value.trim();
+    if (!pattern.test(trimmed))
+        throw new Error(`${flag} must be a valid name, got "${value}"`);
+    return trimmed;
+}
+//# sourceMappingURL=naming.js.map

package/dist/secret-stores/naming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"naming.js","sourceRoot":"","sources":["../../src/secret-stores/naming.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,IAAY;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,oBAAoB,KAAK,oEAAoE,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAG,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,sEAAsE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,IAAY,EAAE,KAAK,GAAG,EAAE;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,yBAAyB,KAAK,YAAY,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,oBAAoB,KAAK,yBAAyB,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,+CAA+C,CAAC,CAAC;IACvK,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,oBAAoB,KAAK,uBAAuB,CAAC,CAAC;IAClH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,IAAY;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,oBAAoB,KAAK,2DAA2D,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,KAAa,EAAE,OAAO,GAAG,mBAAmB;IAC7E,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,+BAA+B,KAAK,GAAG,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/secret-stores/onepassword.d.ts

@@ -0,0 +1,7 @@
+import type { SecretStore } from "./types.js";
+/**
+ * 1Password. Assignment statements (`credential=…`) put the value in argv and
+ * the docs say so explicitly, so this pipes an item JSON template into
+ * `op item create -` instead: the plaintext only ever crosses stdin.
+ */
+export declare const onepassword: SecretStore;

package/dist/secret-stores/onepassword.js

@@ -0,0 +1,50 @@
+import { preflight } from "./exec.js";
+import { slug, titleName } from "./naming.js";
+const INSTALL_HINT = "install the 1Password CLI from https://developer.1password.com/docs/cli/get-started (brew install 1password-cli), then sign in with `op signin`";
+function target(options) {
+    const vault = options.opVault ? slug("--op-vault", options.opVault, /^[^\n\r]+$/) : "Private";
+    return { describe: `1Password vault ${vault}`, fields: { vault } };
+}
+/**
+ * 1Password. Assignment statements (`credential=…`) put the value in argv and
+ * the docs say so explicitly, so this pipes an item JSON template into
+ * `op item create -` instead: the plaintext only ever crosses stdin.
+ */
+export const onepassword = {
+    id: "1password",
+    label: "1Password",
+    bin: "op",
+    shorthand: "--op-item",
+    nameLabel: "TITLE",
+    installHint: INSTALL_HINT,
+    options: ["opVault"],
+    validateName: (name) => titleName("1Password item title", name),
+    preflight: () => preflight({
+        bin: "op",
+        label: "1Password",
+        installHint: INSTALL_HINT,
+        authArgs: ["whoami"],
+        authHint: "Run `op signin` first (or enable the desktop app's CLI integration).",
+    }),
+    resolveTarget: target,
+    deliveries: (title, t) => [
+        {
+            note: "op item create",
+            kind: "stdin",
+            args: ["item", "create", "--vault", t.fields.vault, "-"],
+            payload: (value) => `${JSON.stringify({
+                title,
+                category: "API_CREDENTIAL",
+                fields: [{ id: "credential", label: "credential", type: "CONCEALED", value }],
+            })}\n`,
+        },
+    ],
+    usage: (title, t, gateway) => [
+        "Read it back without ever printing it:",
+        `  op read "op://${t.fields.vault}/${title}/credential"`,
+        `  # op run --env-file=.env -- your-command, with .env holding`,
+        `  #   OPENAI_API_KEY=op://${t.fields.vault}/${title}/credential`,
+        `  #   OPENAI_BASE_URL=${gateway.openaiBaseUrl}`,
+    ],
+};
+//# sourceMappingURL=onepassword.js.map

package/dist/secret-stores/onepassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onepassword.js","sourceRoot":"","sources":["../../src/secret-stores/onepassword.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG9C,MAAM,YAAY,GAChB,iJAAiJ,CAAC;AAEpJ,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,OAAO,EAAE,QAAQ,EAAE,mBAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAgB;IACtC,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,WAAW;IAClB,GAAG,EAAE,IAAI;IACT,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,OAAO;IAClB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,CAAC,SAAS,CAAC;IACpB,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC;IAC/D,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,WAAW;QAClB,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,QAAQ,EAAE,sEAAsE;KACjF,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QACxB;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;YACxD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,GAAG,IAAI,CAAC,SAAS,CAAC;gBAChB,KAAK;gBACL,QAAQ,EAAE,gBAAgB;gBAC1B,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;aAC9E,CAAC,IAAI;SACT;KACF;IACD,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5B,wCAAwC;QACxC,mBAAmB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,cAAc;QACxD,+DAA+D;QAC/D,6BAA6B,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,aAAa;QACjE,yBAAyB,OAAO,CAAC,aAAa,EAAE;KACjD;CACF,CAAC"}

package/dist/secret-stores/types.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Shared shape for every secret store the CLI can hand a freshly minted key to.
+ *
+ * The contract every store must honour: the plaintext key travels to the
+ * platform CLI over stdin (directly, or through a path the CLI reads such as
+ * `/dev/stdin`), never through argv. Anything in argv is visible to every
+ * process on the machine via `ps`, and lands in shell history when a human
+ * copies the command.
+ */
+/** Stable ids, also the values accepted by `--store`. */
+export declare const STORE_IDS: readonly ["github", "gitlab", "aws", "gcloud", "azure", "1password", "vault", "doppler", "cloudflare", "vercel", "kubernetes", "fly"];
+export type StoreId = (typeof STORE_IDS)[number];
+/** Flags that scope where a secret lands. Each store reads the ones it supports. */
+export interface StoreOptions {
+    /** Secret / variable / item name, from --secret or a store shorthand. */
+    secret?: string;
+    repo?: string;
+    env?: string;
+    org?: string;
+    region?: string;
+    project?: string;
+    keyVault?: string;
+    opVault?: string;
+    mount?: string;
+    field?: string;
+    dopplerConfig?: string;
+    worker?: string;
+    vercelTarget?: string;
+    namespace?: string;
+    k8sKey?: string;
+    app?: string;
+}
+/** Every option name a store may claim, for the "unsupported flag" check. */
+export type StoreOptionKey = Exclude<keyof StoreOptions, "secret">;
+/**
+ * Where the secret lands, resolved from the flags (and sometimes the current
+ * directory). `fields` are echoed into `--output json`; `describe` is the human
+ * sentence in the confirmation prompt and the success line.
+ */
+export interface StoreTarget {
+    describe: string;
+    fields: Record<string, string>;
+}
+/**
+ * How the plaintext reaches the platform CLI.
+ *
+ * - `stdin`: the value (or a rendered `payload`) is written to the child's stdin.
+ * - `path`: argv names a file the CLI reads. On POSIX that is `/dev/stdin` with
+ *   the value piped in; on Windows the runner writes a 0600 temp file and
+ *   substitutes its path for the `{}` placeholder.
+ *
+ * `note` explains what the attempt does, for the error message when every
+ * attempt fails.
+ */
+export type Delivery = {
+    note: string;
+    /** Wraps the plaintext (a JSON template, a KEY=VALUE line) before it is sent. */
+    payload?: (value: string) => string;
+} & ({
+    kind: "stdin";
+    args: string[];
+} | {
+    kind: "path";
+    args: string[];
+});
+export interface Gateway {
+    /** OpenAI-compatible base, e.g. https://inference.heyditto.ai/v1 */
+    openaiBaseUrl: string;
+    /** Anthropic base (no /v1), e.g. https://inference.heyditto.ai */
+    anthropicBaseUrl: string;
+}
+export interface SecretStore {
+    id: StoreId;
+    /** Human label, e.g. "GitHub Actions". */
+    label: string;
+    /** Executable the CLI delegates to. */
+    bin: string;
+    /** Other names the same CLI ships under, e.g. flyctl for fly. */
+    altBins?: readonly string[];
+    /** How this CLI reports its version (az and vault do not take --version). */
+    versionArgs?: readonly string[];
+    /** Shorthand flag that both selects this store and names the secret. */
+    shorthand: string;
+    /** What the shorthand's value is called in help text, e.g. "NAME" or "TITLE". */
+    nameLabel: string;
+    /** How to get the CLI and sign in, quoted in errors when it is missing. */
+    installHint: string;
+    /** Scoping options this store understands; anything else is rejected. */
+    options: readonly StoreOptionKey[];
+    /** Rejects names the platform will not accept. Returns the trimmed name. */
+    validateName(name: string): string;
+    /** Cheap failure before anything is minted: binary present and signed in. */
+    preflight(): void;
+    /** Reads the scoping flags; may infer from the cwd the way `gh` does. */
+    resolveTarget(options: StoreOptions): StoreTarget;
+    /**
+     * Attempts, in order, for storing `name` at `target`. Several platforms
+     * separate "create" from "add a new version", so the second attempt runs
+     * only when the first fails (e.g. the secret already exists).
+     */
+    deliveries(name: string, target: StoreTarget): Delivery[];
+    /** How to read the secret back / wire it into a runtime. */
+    usage(name: string, target: StoreTarget, gateway: Gateway): string[];
+    /** Key label in the Ditto app. Defaults to `<store>:<target>:<name>`. */
+    keyName?(name: string, target: StoreTarget): string;
+    /** Platform reference for the stored value, echoed in `--output json`. */
+    snippet?(name: string, target: StoreTarget): string;
+}

package/dist/secret-stores/types.js

@@ -0,0 +1,25 @@
+/**
+ * Shared shape for every secret store the CLI can hand a freshly minted key to.
+ *
+ * The contract every store must honour: the plaintext key travels to the
+ * platform CLI over stdin (directly, or through a path the CLI reads such as
+ * `/dev/stdin`), never through argv. Anything in argv is visible to every
+ * process on the machine via `ps`, and lands in shell history when a human
+ * copies the command.
+ */
+/** Stable ids, also the values accepted by `--store`. */
+export const STORE_IDS = [
+    "github",
+    "gitlab",
+    "aws",
+    "gcloud",
+    "azure",
+    "1password",
+    "vault",
+    "doppler",
+    "cloudflare",
+    "vercel",
+    "kubernetes",
+    "fly",
+];
+//# sourceMappingURL=types.js.map

package/dist/secret-stores/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/secret-stores/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,OAAO;IACP,WAAW;IACX,OAAO;IACP,SAAS;IACT,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,KAAK;CACG,CAAC"}

package/dist/secret-stores/vault.d.ts

@@ -0,0 +1,7 @@
+import type { SecretStore } from "./types.js";
+/**
+ * HashiCorp Vault kv. `FIELD=-` makes Vault read that single field's value
+ * from stdin. `kv patch` leaves the path's other fields alone but needs the
+ * path to exist, so `kv put` is the fallback that creates it.
+ */
+export declare const vault: SecretStore;

package/dist/secret-stores/vault.js

@@ -0,0 +1,47 @@
+import { preflight } from "./exec.js";
+import { secretPath, slug } from "./naming.js";
+const INSTALL_HINT = "install the Vault CLI from https://developer.hashicorp.com/vault/install (brew install hashicorp/tap/vault), then export VAULT_ADDR and run `vault login`";
+function target(options) {
+    const mount = options.mount ? slug("--mount", options.mount, /^[A-Za-z0-9_.\-/]+$/) : "secret";
+    const field = options.field ? slug("--field", options.field, /^[A-Za-z0-9_.-]+$/) : "token";
+    return { describe: `Vault ${mount}/ (field ${field})`, fields: { mount, field } };
+}
+/**
+ * HashiCorp Vault kv. `FIELD=-` makes Vault read that single field's value
+ * from stdin. `kv patch` leaves the path's other fields alone but needs the
+ * path to exist, so `kv put` is the fallback that creates it.
+ */
+export const vault = {
+    id: "vault",
+    label: "HashiCorp Vault",
+    bin: "vault",
+    shorthand: "--vault-secret",
+    nameLabel: "PATH",
+    installHint: INSTALL_HINT,
+    versionArgs: ["version"],
+    options: ["mount", "field"],
+    validateName: (name) => secretPath("Vault kv path", name),
+    preflight: () => preflight({
+        bin: "vault",
+        label: "HashiCorp Vault",
+        installHint: INSTALL_HINT,
+        versionArgs: vault.versionArgs,
+        authArgs: ["token", "lookup"],
+        authHint: "Set VAULT_ADDR and run `vault login` first.",
+    }),
+    resolveTarget: target,
+    deliveries: (path, t) => {
+        const args = (verb) => ["kv", verb, `-mount=${t.fields.mount}`, path, `${t.fields.field}=-`];
+        return [
+            { note: "vault kv patch", kind: "stdin", args: args("patch") },
+            { note: "vault kv put", kind: "stdin", args: args("put") },
+        ];
+    },
+    usage: (path, t, gateway) => [
+        "Read it back at runtime:",
+        `  vault kv get -mount=${t.fields.mount} -field=${t.fields.field} ${path}`,
+        `  # export OPENAI_API_KEY=$(…) with OPENAI_BASE_URL=${gateway.openaiBaseUrl}`,
+        `  # or ANTHROPIC_AUTH_TOKEN with ANTHROPIC_BASE_URL=${gateway.anthropicBaseUrl}`,
+    ],
+};
+//# sourceMappingURL=vault.js.map

package/dist/secret-stores/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/secret-stores/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAG/C,MAAM,YAAY,GAChB,2JAA2J,CAAC;AAE9J,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5F,OAAO,EAAE,QAAQ,EAAE,SAAS,KAAK,YAAY,KAAK,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,KAAK,GAAgB;IAChC,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,iBAAiB;IACxB,GAAG,EAAE,OAAO;IACZ,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,CAAC,SAAS,CAAC;IACxB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,IAAI,CAAC;IACzD,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC7B,QAAQ,EAAE,6CAA6C;KACxD,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QACrG,OAAO;YACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAC9D,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;SAC3D,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC3B,0BAA0B;QAC1B,yBAAyB,CAAC,CAAC,MAAM,CAAC,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE;QAC1E,uDAAuD,OAAO,CAAC,aAAa,EAAE;QAC9E,uDAAuD,OAAO,CAAC,gBAAgB,EAAE;KAClF;CACF,CAAC"}

package/dist/secret-stores/vercel.d.ts

@@ -0,0 +1,9 @@
+import type { SecretStore } from "./types.js";
+/**
+ * Vercel environment variables. `vercel env add NAME <target>` takes the value
+ * from stdin (its `--value` flag is the argv-leaking alternative); `--force`
+ * replaces an existing variable and `--sensitive` hides it from the dashboard.
+ */
+export declare const vercel: SecretStore;
+/** Exported for the flag's help text and tests. */
+export declare const VERCEL_TARGETS: readonly ["production", "preview", "development"];

package/dist/secret-stores/vercel.js

@@ -0,0 +1,49 @@
+import { preflight } from "./exec.js";
+import { envStyleName } from "./naming.js";
+const INSTALL_HINT = "install the Vercel CLI from https://vercel.com/docs/cli (npm i -g vercel), then run `vercel login` and `vercel link`";
+const TARGETS = ["production", "preview", "development"];
+function target(options) {
+    const raw = options.vercelTarget?.trim() ?? "production";
+    if (!TARGETS.includes(raw)) {
+        throw new Error(`--vercel-target must be one of: ${TARGETS.join(", ")}`);
+    }
+    return { describe: `Vercel ${raw} environment`, fields: { target: raw } };
+}
+/**
+ * Vercel environment variables. `vercel env add NAME <target>` takes the value
+ * from stdin (its `--value` flag is the argv-leaking alternative); `--force`
+ * replaces an existing variable and `--sensitive` hides it from the dashboard.
+ */
+export const vercel = {
+    id: "vercel",
+    label: "Vercel",
+    bin: "vercel",
+    shorthand: "--vercel-env",
+    nameLabel: "NAME",
+    installHint: INSTALL_HINT,
+    options: ["vercelTarget"],
+    validateName: (name) => envStyleName("Vercel environment variable", name),
+    preflight: () => preflight({
+        bin: "vercel",
+        label: "Vercel",
+        installHint: INSTALL_HINT,
+        authArgs: ["whoami"],
+        authHint: "Run `vercel login` first, or set VERCEL_TOKEN.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => [
+        {
+            note: "vercel env add",
+            kind: "stdin",
+            args: ["env", "add", name, t.fields.target, "--force", "--sensitive", "--yes", "--non-interactive"],
+        },
+    ],
+    usage: (name, t, gateway) => [
+        `Pull it into a local .env: vercel env pull --environment=${t.fields.target}`,
+        `  # ${name} is in the ${t.fields.target} environment of the linked project`,
+        `  # point clients at OPENAI_BASE_URL=${gateway.openaiBaseUrl}`,
+    ],
+};
+/** Exported for the flag's help text and tests. */
+export const VERCEL_TARGETS = TARGETS;
+//# sourceMappingURL=vercel.js.map

package/dist/secret-stores/vercel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../../src/secret-stores/vercel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,YAAY,GAChB,sHAAsH,CAAC;AAEzH,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAU,CAAC;AAElE,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC;IACzD,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,UAAU,GAAG,cAAc,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAgB;IACjC,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,QAAQ;IACb,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,CAAC,cAAc,CAAC;IACzB,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,6BAA6B,EAAE,IAAI,CAAC;IACzE,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,QAAQ,EAAE,gDAAgD;KAC3D,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QACvB;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,CAAC;SACpG;KACF;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC3B,4DAA4D,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE;QAC7E,OAAO,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,MAAM,oCAAoC;QAC5E,wCAAwC,OAAO,CAAC,aAAa,EAAE;KAChE;CACF,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC"}

package/dist/teleport/harness.d.ts

@@ -8,6 +8,11 @@ export interface HarnessLocation {
     /** Absolute directory the session is keyed under (Claude project dir). */
     keyDir?: string;
 }
+/**
+ * The directory as Claude Code sees it: canonical (symlinks resolved, e.g.
+ * macOS /tmp → /private/tmp) when it exists, else just absolute.
+ */
+export declare function canonicalCwd(cwd: string): string;
 /** Locates Claude Code transcript files for a session recorded under `cwd`. */
 export declare function locateClaude(sessionId: string, cwd: string): Promise<HarnessLocation | null>;
 /** Locates a Codex rollout transcript by thread id. */

package/dist/teleport/harness.js

@@ -1,4 +1,5 @@
 import { spawnSync } from "node:child_process";
+import { realpathSync } from "node:fs";
 import { access, mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -10,9 +11,21 @@ function claudeHome() {
 function codexHome() {
     return process.env.CODEX_HOME?.trim() || path.join(os.homedir(), ".codex");
 }
+/**
+ * The directory as Claude Code sees it: canonical (symlinks resolved, e.g.
+ * macOS /tmp → /private/tmp) when it exists, else just absolute.
+ */
+export function canonicalCwd(cwd) {
+    try {
+        return realpathSync(cwd);
+    }
+    catch {
+        return path.resolve(cwd);
+    }
+}
 /** Locates Claude Code transcript files for a session recorded under `cwd`. */
 export async function locateClaude(sessionId, cwd) {
-    const projectDir = path.join(claudeHome(), "projects", cwdSlug(cwd));
+    const projectDir = path.join(claudeHome(), "projects", cwdSlug(canonicalCwd(cwd)));
     const jsonl = path.join(projectDir, `${sessionId}.jsonl`);
     if (!(await exists(jsonl)))
         return null;
@@ -74,14 +87,17 @@ export async function restoreClaudeTranscript(tarFile, compression, sessionId, o
     const res = spawnSync("tar", ["-x", flag, "-f", tarFile, "-C", home], { maxBuffer: 64 * 1024 * 1024 });
     if (res.status !== 0)
         throw new Error(`tar extract failed: ${res.stderr?.toString().trim()}`);
-    if (path.resolve(originalCwd) === path.resolve(targetCwd))
+    const fromCwd = canonicalCwd(originalCwd);
+    const toCwd = canonicalCwd(targetCwd);
+    if (fromCwd === toCwd)
         return;
-    const fromDir = path.join(claudeHome(), "projects", cwdSlug(originalCwd));
-    const toDir = path.join(claudeHome(), "projects", cwdSlug(targetCwd));
+    const fromDir = path.join(claudeHome(), "projects", cwdSlug(fromCwd));
+    const toDir = path.join(claudeHome(), "projects", cwdSlug(toCwd));
     await mkdir(toDir, { recursive: true });
     const fromJsonl = path.join(fromDir, `${sessionId}.jsonl`);
     if (await exists(fromJsonl)) {
-        const rewritten = (await readFile(fromJsonl, "utf8")).split(originalCwd).join(targetCwd);
+        // Rewrite both the recorded and the canonical spelling of the source path.
+        const rewritten = (await readFile(fromJsonl, "utf8")).split(fromCwd).join(toCwd).split(originalCwd).join(toCwd);
         await writeFile(path.join(toDir, `${sessionId}.jsonl`), rewritten);
     }
     const fromSub = path.join(fromDir, sessionId);

package/dist/teleport/harness.js.map

@@ -1 +1 @@
-{"version":3,"file":"harness.js","sourceRoot":"","sources":["../../src/teleport/harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAsC,OAAO,EAAE,MAAM,YAAY,CAAC;AAYzE,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,GAAW;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,SAAS,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAChD,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACvE,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,UAAU,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACnE,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAiB,EACjB,SAA6B,EAC7B,GAAW;IAEX,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AACnD,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAoB,EACpB,OAAe,EACf,cAA2B,eAAe,EAAE;IAE5C,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE;QACzF,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC5B,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,WAAwB,EACxB,SAAiB,EACjB,WAAmB,EACnB,SAAiB;IAEjB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IACvG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9F,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,SAAS,QAAQ,CAAC,CAAC;IAC3D,IAAI,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzF,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,SAAS,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YACrD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACrD,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAS;IACtC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"harness.js","sourceRoot":"","sources":["../../src/teleport/harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAsC,OAAO,EAAE,MAAM,YAAY,CAAC;AAYzE,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,GAAW;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,SAAS,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAChD,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACvE,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,UAAU,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACnE,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAiB,EACjB,SAA6B,EAC7B,GAAW;IAEX,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AACnD,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAoB,EACpB,OAAe,EACf,cAA2B,eAAe,EAAE;IAE5C,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE;QACzF,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC5B,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,WAAwB,EACxB,SAAiB,EACjB,WAAmB,EACnB,SAAiB;IAEjB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IACvG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,SAAS,QAAQ,CAAC,CAAC;IAC3D,IAAI,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,2EAA2E;QAC3E,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChH,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,SAAS,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YACrD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACrD,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAS;IACtC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9B,CAAC"}

package/dist/teleport/types.d.ts

@@ -91,6 +91,13 @@ export interface Manifest {
 /** Paths that never travel in a capsule: secrets, caches and build output. */
 export declare const DEFAULT_EXCLUDES: readonly string[];
 /** Claude Code keys its project dir on the absolute cwd with `/` and `:` replaced by `-`. */
+/**
+ * Claude Code's project directory name for a working directory: every character
+ * outside [A-Za-z0-9] becomes "-" (underscores, dots, spaces and non-ASCII
+ * included; runs of dashes are kept). Verified empirically against Claude Code
+ * 2.1.x: `/private/tmp/tp slug_test.v1-é` → `-private-tmp-tp-slug-test-v1--`.
+ * Callers pass the canonical (realpath) directory, which is what Claude hashes.
+ */
 export declare function cwdSlug(cwd: string): string;
 export declare function machineInfo(cliVersion: string): Manifest["machine"];
 /** True when a repo-relative path matches one of the exclude globs. */