@ia-qa/self-healing 1.18.0 → 1.19.0

package/dist/cli/secret.d.ts

@@ -0,0 +1 @@
+export declare function runSecret(args: string[]): Promise<void>;

package/dist/cli/secret.js

@@ -0,0 +1,172 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSecret = runSecret;
+const readline = __importStar(require("readline"));
+const secretStore_1 = require("../secretStore");
+/**
+ * `ia-qa-heal secret` — put a value in the OS store, so it stops being ambient.
+ *
+ * There is deliberately **no `get`**. A verb that prints a secret is a verb whose output ends
+ * up in a scrollback, a log, or an agent's transcript — and this whole feature exists to keep
+ * the value out of exactly those. `check` answers the only question worth asking from the
+ * outside: does it resolve, yes or no.
+ *
+ * `set` refuses without a TTY, for the same reason `login` does: it waits for a person. That
+ * refusal is aimed squarely at the agent driving the CLI — it must hand this step to the
+ * human, who types the value into their own terminal.
+ */
+const isTty = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
+/** Read one line with the terminal echo off, so the value is not left on screen. */
+function askHidden(prompt) {
+    return new Promise((resolve, reject) => {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+        const input = process.stdin;
+        const onData = () => {
+            // Repaint the prompt with nothing after it: readline echoes each keystroke otherwise.
+            readline.clearLine(process.stdout, 0);
+            readline.cursorTo(process.stdout, 0);
+            process.stdout.write(prompt);
+        };
+        process.stdout.write(prompt);
+        input.on('data', onData);
+        rl.question('', (answer) => {
+            input.removeListener('data', onData);
+            rl.close();
+            process.stdout.write('\n');
+            resolve(answer);
+        });
+        rl.on('error', reject);
+    });
+}
+function usage() {
+    console.error(`❌ \`ia-qa-heal secret\` needs a subcommand.\n\n` +
+        `   ia-qa-heal secret set <NAME>     store a value in this machine's credential store\n` +
+        `   ia-qa-heal secret list           the names it holds — never the values\n` +
+        `   ia-qa-heal secret check <NAME>   does it resolve? yes or no, never the value\n` +
+        `   ia-qa-heal secret rm <NAME>      forget it\n\n` +
+        `   This machine: ${(0, secretStore_1.storeDescription)()}.\n` +
+        `   Then reference it: { "source": "keychain", "key": "<NAME>" }`);
+    process.exitCode = 2;
+}
+async function runSecret(args) {
+    const [sub, name] = args.filter((a) => !a.startsWith('-'));
+    const json = args.includes('--json');
+    if (!sub)
+        return usage();
+    if (sub === 'list') {
+        const names = (0, secretStore_1.listSecrets)();
+        if (json) {
+            console.log(JSON.stringify({ schema: 'ia-qa-heal/secrets@1', store: (0, secretStore_1.storeDescription)(), names }, null, 2));
+            return;
+        }
+        console.log(`\n🔐 ${(0, secretStore_1.storeDescription)()}\n`);
+        if (names.length === 0)
+            console.log('   Nothing stored yet  →  ia-qa-heal secret set <NAME>\n');
+        else {
+            for (const n of names)
+                console.log(`   ${n}`);
+            console.log('\n   Names only. This command cannot print a value, by design.\n');
+        }
+        return;
+    }
+    if (!name)
+        return usage();
+    if (sub === 'check') {
+        const got = (0, secretStore_1.readSecret)(name);
+        // Never the value, and never its length either: a length narrows a guess.
+        if (json)
+            console.log(JSON.stringify({ name, resolves: got.ok, ...(got.ok ? {} : { reason: got.reason }) }, null, 2));
+        else if (got.ok)
+            console.log(`\n✅ "${name}" resolves from ${(0, secretStore_1.storeDescription)()}.\n`);
+        else
+            console.error(`\n❌ "${name}" does not resolve — ${got.reason}\n`);
+        process.exitCode = got.ok ? 0 : 1;
+        return;
+    }
+    if (sub === 'rm') {
+        const r = (0, secretStore_1.removeSecret)(name);
+        if (!r.ok) {
+            console.error(`❌ ${r.reason}`);
+            process.exitCode = 2;
+            return;
+        }
+        console.log(`\n🗑  "${name}" removed from ${(0, secretStore_1.storeDescription)()}.\n`);
+        return;
+    }
+    if (sub !== 'set')
+        return usage();
+    if ((0, secretStore_1.storeKind)() === 'unsupported') {
+        console.error(`❌ ${(0, secretStore_1.storeDescription)()}.\n   Use { "source": "env", "key": "${name}" } and export the value in your shell.`);
+        process.exitCode = 2;
+        return;
+    }
+    if (!isTty()) {
+        console.error(`❌ \`ia-qa-heal secret set\` needs a terminal: it asks for the value and must not read it\n` +
+            `   from an argument or a pipe — both end up in a shell history, a process list or a log.\n` +
+            `   A human runs this in their own shell. An agent cannot do it for them.\n` +
+            `   For CI, where no person and no store exist: { "source": "env", "key": "${name}" }.`);
+        process.exitCode = 2;
+        return;
+    }
+    console.log(`\n🔐 Storing "${name}" in ${(0, secretStore_1.storeDescription)()}.`);
+    console.log('   The value is not echoed, not logged, and never written to a config file.');
+    const value = (await askHidden(`   Value for ${name}: `)).trim();
+    if (!value) {
+        console.error('❌ Nothing entered — nothing stored.');
+        process.exitCode = 2;
+        return;
+    }
+    const r = (0, secretStore_1.writeSecret)(name, value);
+    if (!r.ok) {
+        console.error(`❌ ${r.reason}`);
+        process.exitCode = 2;
+        return;
+    }
+    // Proven, not assumed: written and read back before it is called stored. The whole package
+    // refuses to print "saved ✅" on anything it has not verified.
+    const back = (0, secretStore_1.readSecret)(name);
+    if (!back.ok || back.value !== value) {
+        console.error(`❌ Written, but reading it back did not return the same value — so it is NOT usable.\n` +
+            `   ${back.ok ? 'The store returned something else.' : back.reason}`);
+        process.exitCode = 2;
+        return;
+    }
+    console.log(`\n✅ Stored and read back. Reference it without the value:\n`);
+    console.log(`   { "source": "keychain", "key": "${name}" }\n`);
+    console.log(`   It is no longer in your environment, so nothing else in this session inherits it.`);
+    console.log(`   An agent can still ask the OS for it — that is now a visible act, not an ambient one.\n`);
+}
+//# sourceMappingURL=secret.js.map

package/dist/cli/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/cli/secret.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,8BA+FC;AArJD,mDAAqC;AACrC,gDAAiH;AAEjH;;;;;;;;;;;GAWG;AAEH,MAAM,KAAK,GAAG,GAAY,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAElF,oFAAoF;AACpF,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgD,CAAC;QACvE,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,sFAAsF;YACtF,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACtC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzB,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;YACzB,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,CAAC,KAAK,CACX,iDAAiD;QAC/C,wFAAwF;QACxF,6EAA6E;QAC7E,mFAAmF;QACnF,mDAAmD;QACnD,oBAAoB,IAAA,8BAAgB,GAAE,KAAK;QAC3C,iEAAiE,CACpE,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,IAAc;IAC5C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAErC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,EAAE,CAAC;IAEzB,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,IAAA,yBAAW,GAAE,CAAC;QAC5B,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,IAAA,8BAAgB,GAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3G,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAA,8BAAgB,GAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;aAC3F,CAAC;YACJ,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAClF,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,EAAE,CAAC;IAE1B,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAA,wBAAU,EAAC,IAAI,CAAC,CAAC;QAC7B,0EAA0E;QAC1E,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;aACjH,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,mBAAmB,IAAA,8BAAgB,GAAE,KAAK,CAAC,CAAC;;YAChF,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,wBAAwB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;QACvE,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IAED,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,IAAA,0BAAY,EAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,kBAAkB,IAAA,8BAAgB,GAAE,KAAK,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,EAAE,CAAC;IAElC,IAAI,IAAA,uBAAS,GAAE,KAAK,aAAa,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAA,8BAAgB,GAAE,wCAAwC,IAAI,yCAAyC,CAAC,CAAC;QAC5H,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,4FAA4F;YAC1F,4FAA4F;YAC5F,4EAA4E;YAC5E,6EAA6E,IAAI,MAAM,CAC1F,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,IAAA,8BAAgB,GAAE,GAAG,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,CAAC,MAAM,SAAS,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,CAAC,GAAG,IAAA,yBAAW,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,2FAA2F;IAC3F,8DAA8D;IAC9D,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CACX,uFAAuF;YACrF,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CACvE,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,sCAAsC,IAAI,OAAO,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAC;AAC5G,CAAC"}

package/dist/cli/session.d.ts

@@ -0,0 +1,24 @@
+import { type SessionFacts, type SessionVerdict } from '../sessionCheck';
+/**
+ * `ia-qa-heal session --check` — does this session still open the app, and if not, why?
+ *
+ * Every other verb here answers a question about the *app*. This one answers a question
+ * about the tool's own credential, which until now was only ever reported as a side effect
+ * of something expensive failing: `map` walked into a wall, printed three possible causes,
+ * and offered no way to choose between them. The field wrote its own script.
+ *
+ * Read-only, and cheap by design: the offline causes (expired, wrong host, empty) are
+ * conclusive from the file, so the browser opens only when the file looks fine and the
+ * question is what the *server* thinks. `--offline` skips it entirely.
+ *
+ * Exit codes follow the package's convention: 0 it holds, 1 it does not, 2 could not tell.
+ * That last one is why "could not open the app" is never folded into "the session is dead" —
+ * a network error is a fact about the network.
+ */
+export interface SessionCheck {
+    file: string;
+    source: string;
+    facts: SessionFacts;
+    verdict: SessionVerdict;
+}
+export declare function runSessionCheck(args: string[]): Promise<void>;

package/dist/cli/session.js

@@ -0,0 +1,119 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSessionCheck = runSessionCheck;
+const fs = __importStar(require("fs"));
+const config_1 = require("../config");
+const launcher_1 = require("../launcher");
+const login_1 = require("./login");
+const sessionCheck_1 = require("../sessionCheck");
+function render(check) {
+    const { facts, verdict } = check;
+    const mark = verdict.holds ? '✅' : verdict.cause === 'unknown' ? '⚠' : '❌';
+    const lines = [
+        `\n🔑 ${check.file}`,
+        `   ${facts.cookies} cookie${facts.cookies === 1 ? '' : 's'}, ${facts.origins} origin${facts.origins === 1 ? '' : 's'} with local storage${facts.domains.length > 0 ? `  ·  ${facts.domains.join(', ')}` : ''}`,
+    ];
+    // Only when it says something. A session cookie with no stated expiry is the ordinary
+    // case and printing "expires: never stated" on every run teaches nothing.
+    if (facts.expiresInSeconds !== null) {
+        lines.push(facts.expiresInSeconds >= 0
+            ? `   First cookie expires in ${(0, sessionCheck_1.describeAge)(facts.expiresInSeconds)}`
+            : `   Expired ${(0, sessionCheck_1.describeAge)(facts.expiresInSeconds)} ago`);
+    }
+    lines.push(`\n${mark} ${verdict.headline}`);
+    for (const line of verdict.remedy)
+        lines.push(`   ${line}`);
+    return lines;
+}
+async function runSessionCheck(args) {
+    const json = args.includes('--json');
+    const offline = args.includes('--offline');
+    const urlIdx = args.indexOf('--url');
+    const wantedUrl = urlIdx !== -1 ? args[urlIdx + 1] : undefined;
+    const sessionIdx = args.indexOf('--session');
+    const wantedSession = sessionIdx !== -1 ? args[sessionIdx + 1] : undefined;
+    const config = (0, config_1.loadConfig)();
+    const choice = (0, config_1.resolveSession)(config, wantedSession);
+    if (!choice) {
+        // Not a failure: a project with no session is the ordinary case for a public app or one
+        // using `config.auth`. Saying "no session is broken" would be a wrong verdict.
+        const message = `No session file to check.\n` +
+            `   This project has none, which is correct for a public app or one using "auth" in\n` +
+            `   config.json. A person makes one with: ia-qa-heal login`;
+        if (json)
+            console.log(JSON.stringify({ schema: 'ia-qa-heal/session@1', present: false, message }, null, 2));
+        else
+            console.log(`\nℹ️  ${message}`);
+        return;
+    }
+    let state;
+    try {
+        state = JSON.parse(fs.readFileSync(choice.file, 'utf8'));
+    }
+    catch (err) {
+        console.error(`❌ ${choice.file} could not be read: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 2;
+        return;
+    }
+    const target = wantedUrl ?? config.baseUrl;
+    const facts = (0, sessionCheck_1.readFacts)(state, target);
+    // The offline causes are conclusive, so the browser is not opened to re-confirm an expiry
+    // date — the cheapest honest answer, not a degraded one.
+    const offlineVerdict = (0, sessionCheck_1.judgeSession)(facts);
+    const decidedOffline = offlineVerdict.cause !== 'unknown';
+    let verdict = offlineVerdict;
+    if (!decidedOffline && !offline) {
+        const { browser } = await (0, launcher_1.launchBrowser)();
+        try {
+            const replay = await (0, login_1.replaySession)(browser, state, target);
+            verdict = (0, sessionCheck_1.judgeSession)(facts, replay);
+        }
+        finally {
+            await browser.close();
+        }
+    }
+    const check = { file: choice.file, source: choice.source, facts, verdict };
+    if (json) {
+        console.log(JSON.stringify({ schema: 'ia-qa-heal/session@1', present: true, ...check }, null, 2));
+    }
+    else {
+        console.log(render(check).join('\n'));
+    }
+    // `unknown` is not `false`: the tool could not answer, and a caller must be able to tell
+    // that from "the session is dead" — the 0/1/2 split every verb here uses.
+    process.exitCode = verdict.holds ? 0 : verdict.cause === 'unknown' ? 2 : 1;
+}
+//# sourceMappingURL=session.js.map

package/dist/cli/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/cli/session.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDA,0CA2DC;AAhHD,uCAAyB;AACzB,sCAAuD;AACvD,0CAA4C;AAC5C,mCAAwC;AACxC,kDAAmI;AA0BnI,SAAS,MAAM,CAAC,KAAmB;IACjC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3E,MAAM,KAAK,GAAG;QACZ,QAAQ,KAAK,CAAC,IAAI,EAAE;QACpB,MAAM,KAAK,CAAC,OAAO,UAAU,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,OAAO,UAC3E,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC7B,sBAAsB,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;KAC3F,CAAC;IACF,sFAAsF;IACtF,0EAA0E;IAC1E,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,gBAAgB,IAAI,CAAC;YACzB,CAAC,CAAC,8BAA8B,IAAA,0BAAW,EAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE;YACrE,CAAC,CAAC,cAAc,IAAA,0BAAW,EAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAC5D,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,IAAc;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3E,MAAM,MAAM,GAAG,IAAA,mBAAU,GAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,wFAAwF;QACxF,+EAA+E;QAC/E,MAAM,OAAO,GACX,6BAA6B;YAC7B,sFAAsF;YACtF,2DAA2D,CAAC;QAC9D,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;YACvG,OAAO,CAAC,GAAG,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IAED,IAAI,KAAoB,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAkB,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,IAAI,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAA,wBAAS,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEvC,0FAA0F;IAC1F,yDAAyD;IACzD,MAAM,cAAc,GAAG,IAAA,2BAAY,EAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,KAAK,SAAS,CAAC;IAE1D,IAAI,OAAO,GAAG,cAAc,CAAC;IAC7B,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,wBAAa,GAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAa,EAAC,OAAO,EAAE,KAAc,EAAE,MAAM,CAAC,CAAC;YACpE,OAAO,GAAG,IAAA,2BAAY,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACzF,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,yFAAyF;IACzF,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC"}

package/dist/cli/skill.d.ts

@@ -13,21 +13,44 @@
  * overreach as `discover --apply` doing more than it says.
  */
 export declare const SKILL_NAME = "ia-qa-heal";
-interface SkillOpts {
-    install: boolean;
-    user: boolean;
-    print: boolean;
-    force: boolean;
-    dir?: string;
+/**
+ * What a skill verb needs to know about its own package.
+ *
+ * A factory, because `@ia-qa/qa-discovery` and `@ia-qa/pal` need the identical verb: a third
+ * copy of a file whose whole point is "agents read `.claude/skills/`, never `node_modules`"
+ * would be the doctrine drifting in the very place that states it. `packageRoot` is passed
+ * in rather than derived — `__dirname` here is heal's own `dist/`, not the caller's.
+ */
+export interface SkillVerbSpec {
+    /** Directory name under `.claude/skills/`, and the skill's identity. */
+    name: string;
+    /** The binary a user types. Messages only. */
+    cli: string;
+    /** The calling package's root: `path.join(__dirname, '..', '..')` from its own `cli/`. */
+    packageRoot: string;
+}
+export interface SkillVerb {
+    skillSourcePath(): string;
+    readSkill(): string;
+    skillTargetDir(opts: {
+        user?: boolean;
+        dir?: string;
+    }): string;
+    runSkill(args: string[]): Promise<void>;
 }
 /**
- * `dist/cli/` and `src/cli/` are both two levels under the package root, so the
- * same relative path resolves whether this runs from the published build or from
- * the TypeScript sources under test.
+ * Build the verb for one package.
+ *
+ * `dist/cli/` and `src/cli/` are both two levels under a package root, so the caller's
+ * `path.join(__dirname, '..', '..')` resolves whether it runs from the published build or
+ * from the TypeScript sources under test.
  */
-export declare function skillSourcePath(): string;
-export declare function readSkill(): string;
+export declare function createSkillVerb(spec: SkillVerbSpec): SkillVerb;
+export declare const skillSourcePath: () => string;
+export declare const readSkill: () => string;
 /** Target is a project (or home) root; the skill always lands in `<root>/.claude/skills/<name>/`. */
-export declare function skillTargetDir(opts: Pick<SkillOpts, 'user' | 'dir'>): string;
-export declare function runSkill(args: string[]): Promise<void>;
-export {};
+export declare const skillTargetDir: (opts: {
+    user?: boolean;
+    dir?: string;
+}) => string;
+export declare const runSkill: (args: string[]) => Promise<void>;

package/dist/cli/skill.js

@@ -33,11 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SKILL_NAME = void 0;
-exports.skillSourcePath = skillSourcePath;
-exports.readSkill = readSkill;
-exports.skillTargetDir = skillTargetDir;
-exports.runSkill = runSkill;
+exports.runSkill = exports.skillTargetDir = exports.readSkill = exports.skillSourcePath = exports.SKILL_NAME = void 0;
+exports.createSkillVerb = createSkillVerb;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -57,26 +54,34 @@ const path = __importStar(require("path"));
  */
 exports.SKILL_NAME = 'ia-qa-heal';
 /**
- * `dist/cli/` and `src/cli/` are both two levels under the package root, so the
- * same relative path resolves whether this runs from the published build or from
- * the TypeScript sources under test.
+ * Build the verb for one package.
+ *
+ * `dist/cli/` and `src/cli/` are both two levels under a package root, so the caller's
+ * `path.join(__dirname, '..', '..')` resolves whether it runs from the published build or
+ * from the TypeScript sources under test.
  */
-function skillSourcePath() {
-    return path.join(__dirname, '..', '..', 'skills', exports.SKILL_NAME, 'SKILL.md');
-}
-function readSkill() {
-    const src = skillSourcePath();
-    if (!fs.existsSync(src)) {
-        throw new Error(`Skill source missing at ${src}.\n` +
-            `The installed @ia-qa/self-healing package is incomplete — reinstall it.`);
-    }
-    return fs.readFileSync(src, 'utf8');
+function createSkillVerb(spec) {
+    const skillSourcePath = () => path.join(spec.packageRoot, 'skills', spec.name, 'SKILL.md');
+    const readSkill = () => {
+        const src = skillSourcePath();
+        if (!fs.existsSync(src)) {
+            throw new Error(`Skill source missing at ${src}.\n` +
+                `The installed package is incomplete — reinstall it. (A tarball that dropped "skills" ` +
+                `from package.json "files" ships exactly like this.)`);
+        }
+        return fs.readFileSync(src, 'utf8');
+    };
+    const skillTargetDir = (opts) => {
+        const root = opts.dir !== undefined ? opts.dir : opts.user ? os.homedir() : process.cwd();
+        return path.join(root, '.claude', 'skills', spec.name);
+    };
+    return { skillSourcePath, readSkill, skillTargetDir, runSkill: (args) => run(spec, { skillSourcePath, readSkill, skillTargetDir }, args) };
 }
+const healVerb = createSkillVerb({ name: exports.SKILL_NAME, cli: 'ia-qa-heal', packageRoot: path.join(__dirname, '..', '..') });
+exports.skillSourcePath = healVerb.skillSourcePath;
+exports.readSkill = healVerb.readSkill;
 /** Target is a project (or home) root; the skill always lands in `<root>/.claude/skills/<name>/`. */
-function skillTargetDir(opts) {
-    const root = opts.dir !== undefined ? opts.dir : opts.user ? os.homedir() : process.cwd();
-    return path.join(root, '.claude', 'skills', exports.SKILL_NAME);
-}
+exports.skillTargetDir = healVerb.skillTargetDir;
 function parseArgs(args) {
     const opts = { install: false, user: false, print: false, force: false };
     for (let i = 0; i < args.length; i++) {
@@ -106,23 +111,23 @@ function parseArgs(args) {
     }
     return opts;
 }
-async function runSkill(args) {
+async function run(spec, io, args) {
     const opts = parseArgs(args);
-    const content = readSkill();
+    const content = io.readSkill();
     if (opts.print) {
         process.stdout.write(content);
         return;
     }
-    const dir = skillTargetDir(opts);
+    const dir = io.skillTargetDir(opts);
     const file = path.join(dir, 'SKILL.md');
     const exists = fs.existsSync(file);
     const current = exists ? fs.readFileSync(file, 'utf8') : null;
     if (!opts.install) {
-        console.log('\n🧠 ia-qa-heal skill — agent instructions for this CLI\n');
-        console.log(`   source:  ${skillSourcePath()}`);
+        console.log(`\n🧠 ${spec.cli} skill — agent instructions for this CLI\n`);
+        console.log(`   source:  ${io.skillSourcePath()}`);
         console.log(`   target:  ${file}`);
         if (!exists)
-            console.log('   status:  not installed  →  ia-qa-heal skill --install');
+            console.log(`   status:  not installed  →  ${spec.cli} skill --install`);
         else if (current === content)
             console.log('   status:  installed, up to date');
         else
@@ -138,12 +143,13 @@ async function runSkill(args) {
     if (exists && !opts.force) {
         throw new Error(`${file} already exists and differs from the version in this package.\n` +
             `It may have been edited on purpose, so this stops rather than overwrite it.\n` +
-            `Compare first  —  ia-qa-heal skill --print > SKILL.new.md\n` +
-            `Then overwrite —  ia-qa-heal skill --install --force`);
+            `Compare first  —  ${spec.cli} skill --print > SKILL.new.md\n` +
+            `Then overwrite —  ${spec.cli} skill --install --force`);
     }
     console.log(`\n📝 Writing ${file}`);
     fs.mkdirSync(dir, { recursive: true });
     fs.writeFileSync(file, content, 'utf8');
     console.log(`✅ ${exists ? 'Updated' : 'Installed'} — start a new agent session to load it.\n`);
 }
+exports.runSkill = healVerb.runSkill;
 //# sourceMappingURL=skill.js.map

package/dist/cli/skill.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill.js","sourceRoot":"","sources":["../../src/cli/skill.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,0CAEC;AAED,8BASC;AAGD,wCAGC;AA2BD,4BA4CC;AA5HD,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAE7B;;;;;;;;;;;;;GAaG;AAEU,QAAA,UAAU,GAAG,YAAY,CAAC;AAUvC;;;;GAIG;AACH,SAAgB,eAAe;IAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAU,EAAE,UAAU,CAAC,CAAC;AAC5E,CAAC;AAED,SAAgB,SAAS;IACvB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,KAAK;YACjC,yEAAyE,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,qGAAqG;AACrG,SAAgB,cAAc,CAAC,IAAqC;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1F,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAU,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,IAAI,GAAc,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,WAAW;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;aACtC,IAAI,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;aACrC,IAAI,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;aACvC,IAAI,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;aACvC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;YAChB,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,IAAc;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAE5B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,eAAe,eAAe,EAAE,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;aAChF,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;;YAC1E,OAAO,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;QACrG,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,IAAI,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,iEAAiE;YACtE,+EAA+E;YAC/E,6DAA6D;YAC7D,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IACpC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,4CAA4C,CAAC,CAAC;AACjG,CAAC"}
+{"version":3,"file":"skill.js","sourceRoot":"","sources":["../../src/cli/skill.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,0CAqBC;AAjFD,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAE7B;;;;;;;;;;;;;GAaG;AAEU,QAAA,UAAU,GAAG,YAAY,CAAC;AAkCvC;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,IAAmB;IACjD,MAAM,eAAe,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAEnG,MAAM,SAAS,GAAG,GAAW,EAAE;QAC7B,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,KAAK;gBACjC,uFAAuF;gBACvF,qDAAqD,CACxD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CAAC,IAAsC,EAAU,EAAE;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC;IAEF,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;AAC7I,CAAC;AAED,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,kBAAU,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;AAE5G,QAAA,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AAC3C,QAAA,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;AAC5C,qGAAqG;AACxF,QAAA,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AAEtD,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,IAAI,GAAc,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,WAAW;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;aACtC,IAAI,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;aACrC,IAAI,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;aACvC,IAAI,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;aACvC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;YAChB,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,IAAmB,EACnB,EAAuE,EACvE,IAAc;IAEd,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAE/B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,4CAA4C,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC;aACjF,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;;YAC1E,OAAO,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;QACrG,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,IAAI,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,iEAAiE;YACtE,+EAA+E;YAC/E,qBAAqB,IAAI,CAAC,GAAG,iCAAiC;YAC9D,qBAAqB,IAAI,CAAC,GAAG,0BAA0B,CAC1D,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IACpC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,4CAA4C,CAAC,CAAC;AACjG,CAAC;AAEY,QAAA,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC"}

package/dist/config.d.ts

@@ -1,3 +1,4 @@
+import type { AiProvider } from './ai/resolver';
 /**
  * Configuration & secret resolution for @ia-qa/self-healing.
  *
@@ -6,7 +7,7 @@
  * resolved at runtime — from `process.env` or from SSM Parameter Store using
  * the developer's local AWS credential chain — and are never written to disk.
  */
-export type SecretSource = 'env' | 'aws-ssm';
+export type SecretSource = 'env' | 'aws-ssm' | 'keychain';
 export interface SecretRef {
     source: SecretSource;
     /** `env`: the environment variable name. `aws-ssm`: the parameter name (e.g. `/staging/app/password`). */
@@ -67,8 +68,17 @@ export interface PageTarget {
  * `model` is pinned by the user (determinism); the call runs at temperature 0.
  */
 export interface AiConfig {
-    provider: 'anthropic' | 'openai' | 'google';
+    /** The four the registry knows. `openai-compatible` is a shape, not a vendor — see `baseUrl`. */
+    provider: AiProvider;
     model: string;
+    /**
+     * Required for `openai-compatible`, meaningless otherwise: where that endpoint lives.
+     *
+     * `https://api.deepseek.com/v1`, `https://api.groq.com/openai/v1`,
+     * `https://openrouter.ai/api/v1`, or `http://localhost:11434/v1` for a model running on
+     * this machine — in which case nothing leaves it at all.
+     */
+    baseUrl?: string;
     apiKey: SecretRef;
     /** Reject a suggestion below this confidence. Default 0.7. */
     minConfidence?: number;
@@ -364,6 +374,17 @@ export declare function envLoadHint(command?: string, version?: string): string;
  *   chain (env vars, `~/.aws/credentials`, SSO, instance profile…).
  * The AWS SDK is imported lazily so env-only users don't need it at runtime.
  */
+/**
+ * Does this look like a credential rather than the NAME of one?
+ *
+ * The shapes providers actually issue, plus a long opaque run. Deliberately narrow: an
+ * environment variable name is short, upper-case and underscore-separated, so a false
+ * positive here would refuse a legitimate name — and the cost of a false negative is only
+ * that the ordinary "not set" message is printed instead.
+ */
+export declare function looksLikeSecret(value: string): boolean;
+/** The first and last few characters only — enough to recognise it, never enough to use it. */
+export declare function maskSecret(value: string): string;
 export declare function resolveSecret(ref: SecretRef): Promise<string>;
 /**
  * The app root the contracts describe, or undefined when config names none.