@inboxychat/sdk 0.0.0-stage → 0.1.0

package/dist/credentials.js

@@ -0,0 +1,323 @@
+/**
+ * Local credentials for the Inboxy MCP server and CLI.
+ *
+ * Where the key may live, in the order it is read:
+ *   1. INBOXY_API_KEY (environment) — what an MCP client config passes.
+ *   2. The OS keychain: macOS Keychain (`security`), Linux Secret Service
+ *      (`secret-tool`). One entry per profile, service "inboxy-cli".
+ *   3. The config file, only when no keychain exists (`keyStorage: "file"`),
+ *      and only if the file is private (mode 0600, directory 0700). A config
+ *      file that group or others can read is refused, like ssh does.
+ *
+ * The API URL: INBOXY_API_URL, then the profile's `apiUrl`, then
+ * https://api.inboxy.chat.
+ *
+ * Nothing here logs. Keychain tools run through `spawn` with an argument
+ * array (no shell), and the secret reaches them on stdin, never on argv.
+ */
+import { spawn } from 'node:child_process';
+import { promises as fs } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { DEFAULT_API_URL } from './client.js';
+import { InboxyError } from './errors.js';
+export const KEYCHAIN_SERVICE = 'inboxy-cli';
+export const CONFIG_FILE_NAME = 'config.json';
+const PROFILE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+export function validateProfileName(profile) {
+    if (!PROFILE_PATTERN.test(profile)) {
+        throw new InboxyError({
+            kind: 'config',
+            code: 'INVALID_PROFILE',
+            message: 'Profile names are 1-64 characters of letters, digits, ".", "_" or "-", starting with a letter or digit.',
+        });
+    }
+    return profile;
+}
+// ============================================
+// Config file
+// ============================================
+export function configDir(env = process.env) {
+    if (env.INBOXY_CONFIG_DIR)
+        return env.INBOXY_CONFIG_DIR;
+    const base = env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
+    return path.join(base, 'inboxy');
+}
+export function configPath(env = process.env) {
+    return path.join(configDir(env), CONFIG_FILE_NAME);
+}
+function emptyConfig() {
+    return { version: 1, profiles: {} };
+}
+export async function loadConfig(env = process.env) {
+    const file = configPath(env);
+    let raw;
+    let mode = null;
+    try {
+        const stat = await fs.stat(file);
+        mode = process.platform === 'win32' ? null : stat.mode & 0o777;
+        raw = await fs.readFile(file, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return { path: file, exists: false, mode: null, config: emptyConfig() };
+        }
+        throw new InboxyError({
+            kind: 'config',
+            code: 'CONFIG_UNREADABLE',
+            message: `Cannot read ${file}.`,
+        });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new InboxyError({
+            kind: 'config',
+            code: 'CONFIG_INVALID',
+            message: `${file} is not valid JSON.`,
+        });
+    }
+    const obj = (parsed && typeof parsed === 'object' ? parsed : {});
+    const profiles = obj.profiles && typeof obj.profiles === 'object'
+        ? obj.profiles
+        : {};
+    return {
+        path: file,
+        exists: true,
+        mode,
+        config: {
+            version: 1,
+            defaultProfile: typeof obj.defaultProfile === 'string' ? obj.defaultProfile : undefined,
+            profiles,
+        },
+    };
+}
+/** True when group or others have any access to the file. */
+export function isModeTooOpen(mode) {
+    return mode !== null && (mode & 0o077) !== 0;
+}
+/**
+ * Writes the config with 0700 on the directory and 0600 on the file. The
+ * temporary file is created 0600 before any byte is written, then renamed, so
+ * there is no moment where the content is world-readable.
+ */
+export async function saveConfig(config, env = process.env) {
+    const dir = configDir(env);
+    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    if (process.platform !== 'win32')
+        await fs.chmod(dir, 0o700);
+    const file = path.join(dir, CONFIG_FILE_NAME);
+    const tmp = path.join(dir, `.${CONFIG_FILE_NAME}.${process.pid}.${Date.now()}.tmp`);
+    const handle = await fs.open(tmp, 'wx', 0o600);
+    try {
+        await handle.writeFile(`${JSON.stringify(config, null, 2)}\n`, 'utf8');
+    }
+    finally {
+        await handle.close();
+    }
+    await fs.rename(tmp, file);
+    if (process.platform !== 'win32')
+        await fs.chmod(file, 0o600);
+    return file;
+}
+export const spawnRunner = (command, args, input) => new Promise((resolve) => {
+    let child;
+    try {
+        child = spawn(command, [...args], { shell: false, stdio: ['pipe', 'pipe', 'pipe'] });
+    }
+    catch {
+        resolve({ code: null, stdout: '', stderr: 'spawn failed' });
+        return;
+    }
+    let stdout = '';
+    let stderr = '';
+    const timer = setTimeout(() => child.kill('SIGKILL'), 15_000);
+    child.stdout.on('data', (d) => (stdout += d.toString('utf8')));
+    child.stderr.on('data', (d) => (stderr += d.toString('utf8')));
+    child.on('error', () => {
+        clearTimeout(timer);
+        resolve({ code: null, stdout, stderr: 'not available' });
+    });
+    child.on('close', (code) => {
+        clearTimeout(timer);
+        resolve({ code, stdout, stderr });
+    });
+    child.stdin.on('error', () => undefined);
+    child.stdin.end(input ?? '');
+});
+function keychainError(name, action) {
+    return new InboxyError({
+        kind: 'config',
+        code: 'KEYCHAIN_ERROR',
+        message: `Could not ${action} the key in the ${name}.`,
+    });
+}
+/** macOS Keychain through /usr/bin/security. */
+export function macosKeychain(run = spawnRunner) {
+    const name = 'macOS Keychain';
+    return {
+        name,
+        async get(account) {
+            validateProfileName(account);
+            const r = await run('security', [
+                'find-generic-password',
+                '-s',
+                KEYCHAIN_SERVICE,
+                '-a',
+                account,
+                '-w',
+            ]);
+            if (r.code === 0)
+                return r.stdout.replace(/\r?\n$/, '') || null;
+            if (r.code === 44)
+                return null; // errSecItemNotFound
+            throw keychainError(name, 'read');
+        },
+        async set(account, secret) {
+            validateProfileName(account);
+            // `security -i` reads commands from stdin; the secret goes as hex (-X),
+            // so it is never on argv (visible in `ps`) and needs no quoting.
+            const hex = Buffer.from(secret, 'utf8').toString('hex');
+            const command = `add-generic-password -U -s ${KEYCHAIN_SERVICE} -a ${account} -l ${KEYCHAIN_SERVICE} -X ${hex}\n`;
+            const r = await run('security', ['-i'], command);
+            if (r.code !== 0 || /error/i.test(r.stderr))
+                throw keychainError(name, 'store');
+        },
+        async delete(account) {
+            validateProfileName(account);
+            const r = await run('security', [
+                'delete-generic-password',
+                '-s',
+                KEYCHAIN_SERVICE,
+                '-a',
+                account,
+            ]);
+            if (r.code === 0)
+                return true;
+            if (r.code === 44)
+                return false;
+            throw keychainError(name, 'delete');
+        },
+    };
+}
+/** Linux Secret Service (GNOME Keyring, KWallet) through `secret-tool`. */
+export function secretServiceKeychain(run = spawnRunner) {
+    const name = 'Secret Service keyring';
+    const attrs = (account) => ['service', KEYCHAIN_SERVICE, 'account', account];
+    return {
+        name,
+        async get(account) {
+            validateProfileName(account);
+            const r = await run('secret-tool', ['lookup', ...attrs(account)]);
+            if (r.code === 0)
+                return r.stdout.replace(/\r?\n$/, '') || null;
+            if (r.code === 1 && !r.stderr.trim())
+                return null;
+            throw keychainError(name, 'read');
+        },
+        async set(account, secret) {
+            validateProfileName(account);
+            const r = await run('secret-tool', ['store', `--label=Inboxy CLI (${account})`, ...attrs(account)], secret);
+            if (r.code !== 0)
+                throw keychainError(name, 'store');
+        },
+        async delete(account) {
+            validateProfileName(account);
+            const r = await run('secret-tool', ['clear', ...attrs(account)]);
+            return r.code === 0;
+        },
+    };
+}
+/**
+ * The keychain for this machine, or null when there is none (Windows, a Linux
+ * box without secret-tool, or INBOXY_KEYCHAIN=off).
+ */
+export async function systemKeychain(env = process.env, platform = process.platform, run = spawnRunner) {
+    if ((env.INBOXY_KEYCHAIN ?? '').toLowerCase() === 'off')
+        return null;
+    if (platform === 'darwin')
+        return macosKeychain(run);
+    if (platform === 'linux') {
+        const probe = await run('secret-tool', ['--version']);
+        return probe.code === 0 ? secretServiceKeychain(run) : null;
+    }
+    return null;
+}
+export async function resolveCredentials(options = {}) {
+    const env = options.env ?? process.env;
+    const loaded = await loadConfig(env);
+    const profile = validateProfileName(options.profile || env.INBOXY_PROFILE || loaded.config.defaultProfile || 'default');
+    const profileConfig = loaded.config.profiles[profile] ?? {};
+    const warnings = [];
+    let apiUrl = DEFAULT_API_URL;
+    let urlSource = 'default';
+    if (env.INBOXY_API_URL) {
+        apiUrl = env.INBOXY_API_URL;
+        urlSource = 'env';
+    }
+    else if (profileConfig.apiUrl) {
+        apiUrl = profileConfig.apiUrl;
+        urlSource = 'config';
+    }
+    if (env.INBOXY_API_KEY) {
+        return {
+            profile,
+            apiKey: env.INBOXY_API_KEY.trim(),
+            keySource: 'env',
+            apiUrl,
+            urlSource,
+            configPath: loaded.path,
+            warnings,
+        };
+    }
+    const keychain = options.keychain === undefined ? await systemKeychain(env) : options.keychain;
+    if (keychain && profileConfig.keyStorage !== 'file') {
+        try {
+            const fromKeychain = await keychain.get(profile);
+            if (fromKeychain) {
+                return {
+                    profile,
+                    apiKey: fromKeychain,
+                    keySource: 'keychain',
+                    apiUrl,
+                    urlSource,
+                    configPath: loaded.path,
+                    warnings,
+                };
+            }
+        }
+        catch {
+            warnings.push(`Could not read the ${keychain.name}.`);
+        }
+    }
+    if (profileConfig.apiKey) {
+        if (isModeTooOpen(loaded.mode)) {
+            throw new InboxyError({
+                kind: 'config',
+                code: 'CONFIG_PERMISSIONS_TOO_OPEN',
+                message: `${loaded.path} holds an API key but is readable by other users (mode ${(loaded.mode ?? 0).toString(8)}). Run: chmod 600 "${loaded.path}"`,
+            });
+        }
+        return {
+            profile,
+            apiKey: profileConfig.apiKey,
+            keySource: 'config-file',
+            apiUrl,
+            urlSource,
+            configPath: loaded.path,
+            warnings,
+        };
+    }
+    return {
+        profile,
+        apiKey: null,
+        keySource: 'none',
+        apiUrl,
+        urlSource,
+        configPath: loaded.path,
+        warnings,
+    };
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAC7C,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAC9C,MAAM,eAAe,GAAG,mCAAmC,CAAC;AA8B5D,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,WAAW,CAAC;YACpB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,iBAAiB;YACvB,OAAO,EACL,yGAAyG;SAC5G,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+CAA+C;AAC/C,cAAc;AACd,+CAA+C;AAE/C,MAAM,UAAU,SAAS,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5D,IAAI,GAAG,CAAC,iBAAiB;QAAE,OAAO,GAAG,CAAC,iBAAiB,CAAC;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACrD,CAAC;AAUD,SAAS,WAAW;IAClB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAW,CAAC;IAChB,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/D,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,WAAW,CAAC;YACpB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,eAAe,IAAI,GAAG;SAChC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC;YACpB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,GAAG,IAAI,qBAAqB;SACtC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAA8B,CAAC;IAC9F,MAAM,QAAQ,GACZ,GAAG,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAC9C,CAAC,CAAE,GAAG,CAAC,QAA0C;QACjD,CAAC,CAAC,EAAE,CAAC;IACT,OAAO;QACL,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QACZ,IAAI;QACJ,MAAM,EAAE;YACN,OAAO,EAAE,CAAC;YACV,cAAc,EAAE,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;YACvF,QAAQ;SACT;KACF,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAAC,IAAmB;IAC/C,OAAO,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAwB,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,gBAAgB,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAmBD,MAAM,CAAC,MAAM,WAAW,GAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CACjE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACrB,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QACzB,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AASL,SAAS,aAAa,CAAC,IAAY,EAAE,MAAc;IACjD,OAAO,IAAI,WAAW,CAAC;QACrB,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,aAAa,MAAM,mBAAmB,IAAI,GAAG;KACvD,CAAC,CAAC;AACL,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,aAAa,CAAC,MAAqB,WAAW;IAC5D,MAAM,IAAI,GAAG,gBAAgB,CAAC;IAC9B,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,GAAG,CAAC,OAAO;YACf,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE;gBAC9B,uBAAuB;gBACvB,IAAI;gBACJ,gBAAgB;gBAChB,IAAI;gBACJ,OAAO;gBACP,IAAI;aACL,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;YAChE,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;YACrD,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM;YACvB,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC7B,wEAAwE;YACxE,iEAAiE;YACjE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,8BAA8B,gBAAgB,OAAO,OAAO,OAAO,gBAAgB,OAAO,GAAG,IAAI,CAAC;YAClH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClF,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE;gBAC9B,yBAAyB;gBACzB,IAAI;gBACJ,gBAAgB;gBAChB,IAAI;gBACJ,OAAO;aACR,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE;gBAAE,OAAO,KAAK,CAAC;YAChC,MAAM,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CAAC,MAAqB,WAAW;IACpE,MAAM,IAAI,GAAG,wBAAwB,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrF,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,GAAG,CAAC,OAAO;YACf,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;YAChE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC;YAClD,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM;YACvB,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,GAAG,CACjB,aAAa,EACb,CAAC,OAAO,EAAE,uBAAuB,OAAO,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,EAC/D,MAAM,CACP,CAAC;YACF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,MAAqB,WAAW;IAEhC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAA0B,EAAE;IAE5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,mBAAmB,CACjC,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,SAAS,CACnF,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,MAAM,GAAG,eAAe,CAAC;IAC7B,IAAI,SAAS,GAAc,SAAS,CAAC;IACrC,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;QAC5B,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;SAAM,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;QAC9B,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;IAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,OAAO;YACL,OAAO;YACP,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;YACjC,SAAS,EAAE,KAAK;YAChB,MAAM;YACN,SAAS;YACT,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/F,IAAI,QAAQ,IAAI,aAAa,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO;oBACP,MAAM,EAAE,YAAY;oBACpB,SAAS,EAAE,UAAU;oBACrB,MAAM;oBACN,SAAS;oBACT,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,QAAQ;iBACT,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,sBAAsB,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,0DAA0D,CAC/E,MAAM,CAAC,IAAI,IAAI,CAAC,CACjB,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,MAAM,CAAC,IAAI,GAAG;aAClD,CAAC,CAAC;QACL,CAAC;QACD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,SAAS,EAAE,aAAa;YACxB,MAAM;YACN,SAAS;YACT,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO;QACP,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,MAAM;QACjB,MAAM;QACN,SAAS;QACT,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Error kinds a caller can branch on without parsing messages.
+ *
+ * - `auth`        401: missing, unknown, revoked or expired key (or a dashboard JWT)
+ * - `forbidden`   403: scope missing, company paused, key owner no longer admin
+ * - `not_found`   404
+ * - `rate_limited` 429: per-key or per-company budget; see `retryAfterSeconds`
+ * - `invalid_request` 400 / other 4xx
+ * - `server`      5xx
+ * - `timeout`     no response before the client's timeout
+ * - `cancelled`   the caller aborted (MCP cancellation, Ctrl-C)
+ * - `network`     DNS, TLS, connection refused, redirect refused
+ * - `invalid_response` the server answered something that is not the envelope
+ * - `config`      no key / bad URL — nothing was sent
+ */
+export type InboxyErrorKind = 'auth' | 'forbidden' | 'not_found' | 'rate_limited' | 'invalid_request' | 'server' | 'timeout' | 'cancelled' | 'network' | 'invalid_response' | 'config';
+export declare class InboxyError extends Error {
+    readonly kind: InboxyErrorKind;
+    /** HTTP status; 0 when no response was received. */
+    readonly status: number;
+    /** The envelope's `error.code`, or a local code (TIMEOUT, NETWORK_ERROR, ...). */
+    readonly code: string;
+    readonly details: Record<string, unknown>;
+    readonly retryAfterSeconds: number | null;
+    constructor(init: {
+        kind: InboxyErrorKind;
+        status?: number;
+        code: string;
+        message: string;
+        details?: Record<string, unknown>;
+        retryAfterSeconds?: number | null;
+    });
+    toJSON(): {
+        kind: InboxyErrorKind;
+        status: number;
+        code: string;
+        message: string;
+        details: Record<string, unknown>;
+        retryAfterSeconds: number | null;
+    };
+}
+export declare function kindForStatus(status: number): InboxyErrorKind;
+/**
+ * A short, human explanation for an error, with the next step. Used by both
+ * the CLI and the MCP tool errors so they say the same thing.
+ */
+export declare function describeError(error: InboxyError): string;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,WAAW,GACX,WAAW,GACX,cAAc,GACd,iBAAiB,GACjB,QAAQ,GACR,SAAS,GACT,WAAW,GACX,SAAS,GACT,kBAAkB,GAClB,QAAQ,CAAC;AAEb,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;gBAE9B,IAAI,EAAE;QAChB,IAAI,EAAE,eAAe,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACnC;IAYD,MAAM;;;;;;;;CAUP;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAO7D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CA+BxD"}

package/dist/errors.js

@@ -0,0 +1,78 @@
+import { redactSecrets } from './redact.js';
+export class InboxyError extends Error {
+    kind;
+    /** HTTP status; 0 when no response was received. */
+    status;
+    /** The envelope's `error.code`, or a local code (TIMEOUT, NETWORK_ERROR, ...). */
+    code;
+    details;
+    retryAfterSeconds;
+    constructor(init) {
+        // Every message is redacted at construction, so no later formatting step
+        // can forget to.
+        super(redactSecrets(init.message));
+        this.name = 'InboxyError';
+        this.kind = init.kind;
+        this.status = init.status ?? 0;
+        this.code = init.code;
+        this.details = init.details ?? {};
+        this.retryAfterSeconds = init.retryAfterSeconds ?? null;
+    }
+    toJSON() {
+        return {
+            kind: this.kind,
+            status: this.status,
+            code: this.code,
+            message: this.message,
+            details: this.details,
+            retryAfterSeconds: this.retryAfterSeconds,
+        };
+    }
+}
+export function kindForStatus(status) {
+    if (status === 401)
+        return 'auth';
+    if (status === 403)
+        return 'forbidden';
+    if (status === 404)
+        return 'not_found';
+    if (status === 429)
+        return 'rate_limited';
+    if (status >= 500)
+        return 'server';
+    return 'invalid_request';
+}
+/**
+ * A short, human explanation for an error, with the next step. Used by both
+ * the CLI and the MCP tool errors so they say the same thing.
+ */
+export function describeError(error) {
+    const scope = typeof error.details.requiredScope === 'string' ? error.details.requiredScope : null;
+    switch (error.kind) {
+        case 'auth':
+            return `Inboxy refused the API key (${error.code}). The key is missing, unknown, revoked or expired. Create a new key on the API page of the Inboxy dashboard.`;
+        case 'forbidden':
+            if (error.code === 'INSUFFICIENT_PERMISSIONS' && scope) {
+                return `This API key does not have the "${scope}" scope. Create a key that includes it on the API page of the Inboxy dashboard.`;
+            }
+            if (error.code === 'COMPANY_PAUSED') {
+                return 'This Inboxy company is paused, so its API keys cannot read data.';
+            }
+            return `Inboxy denied access (${error.code}): ${error.message}`;
+        case 'not_found':
+            return `Not found in this company (${error.code}). The id may be wrong or belong to another company.`;
+        case 'rate_limited':
+            return `Rate limited by Inboxy (${error.code}).${error.retryAfterSeconds !== null ? ` Retry after ${error.retryAfterSeconds} s.` : ''}`;
+        case 'timeout':
+            return `Inboxy did not answer in time (${error.message}).`;
+        case 'cancelled':
+            return 'The request was cancelled.';
+        case 'network':
+            return `Could not reach Inboxy: ${error.message}`;
+        case 'config':
+            return error.message;
+        default:
+            return `${error.message} (${error.code}${error.status ? `, HTTP ${error.status}` : ''})`;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA8B5C,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,CAAkB;IAC/B,oDAAoD;IAC3C,MAAM,CAAS;IACxB,kFAAkF;IACzE,IAAI,CAAS;IACb,OAAO,CAA0B;IACjC,iBAAiB,CAAgB;IAE1C,YAAY,IAOX;QACC,yEAAyE;QACzE,iBAAiB;QACjB,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC;IAC1D,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,cAAc,CAAC;IAC1C,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,QAAQ,CAAC;IACnC,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAkB;IAC9C,MAAM,KAAK,GACT,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,+BAA+B,KAAK,CAAC,IAAI,+GAA+G,CAAC;QAClK,KAAK,WAAW;YACd,IAAI,KAAK,CAAC,IAAI,KAAK,0BAA0B,IAAI,KAAK,EAAE,CAAC;gBACvD,OAAO,mCAAmC,KAAK,iFAAiF,CAAC;YACnI,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACpC,OAAO,kEAAkE,CAAC;YAC5E,CAAC;YACD,OAAO,yBAAyB,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QAClE,KAAK,WAAW;YACd,OAAO,8BAA8B,KAAK,CAAC,IAAI,sDAAsD,CAAC;QACxG,KAAK,cAAc;YACjB,OAAO,2BAA2B,KAAK,CAAC,IAAI,KAC1C,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,iBAAiB,KAAK,CAAC,CAAC,CAAC,EACpF,EAAE,CAAC;QACL,KAAK,SAAS;YACZ,OAAO,kCAAkC,KAAK,CAAC,OAAO,IAAI,CAAC;QAC7D,KAAK,WAAW;YACd,OAAO,4BAA4B,CAAC;QACtC,KAAK,SAAS;YACZ,OAAO,2BAA2B,KAAK,CAAC,OAAO,EAAE,CAAC;QACpD,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB;YACE,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IAC7F,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export * from './types.js';
+export * from './routes.js';
+export * from './errors.js';
+export * from './redact.js';
+export * from './client.js';
+export * from './credentials.js';
+export * from './capabilities.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+export * from './types.js';
+export * from './routes.js';
+export * from './errors.js';
+export * from './redact.js';
+export * from './client.js';
+export * from './credentials.js';
+export * from './capabilities.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC"}

package/dist/redact.d.ts

@@ -0,0 +1,6 @@
+export declare function redactSecrets(text: string, extraSecrets?: readonly string[]): string;
+/** True when the value has the shape of an Inboxy API key. */
+export declare function looksLikeInboxyKey(value: string): boolean;
+/** Display form: the prefix the dashboard also shows. */
+export declare function maskKey(value: string): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AASA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAMxF;AAED,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,yDAAyD;AACzD,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7C"}

package/dist/redact.js

@@ -0,0 +1,25 @@
+/**
+ * Secret redaction. Inboxy keys look like `inboxy_` + 64 hex characters. Any
+ * text that leaves this package for a terminal, a log or an MCP client passes
+ * through `redactSecrets` so a key can never be echoed back, even when a
+ * server message or an exception happens to quote it.
+ */
+const KEY_PATTERN = /inboxy_[A-Za-z0-9]{6,}/g;
+const BEARER_PATTERN = /(Bearer\s+)[^\s"']+/gi;
+export function redactSecrets(text, extraSecrets = []) {
+    let out = text;
+    for (const secret of extraSecrets) {
+        if (secret && secret.length >= 6)
+            out = out.split(secret).join('[REDACTED]');
+    }
+    return out.replace(KEY_PATTERN, 'inboxy_[REDACTED]').replace(BEARER_PATTERN, '$1[REDACTED]');
+}
+/** True when the value has the shape of an Inboxy API key. */
+export function looksLikeInboxyKey(value) {
+    return /^inboxy_[0-9a-f]{64}$/.test(value);
+}
+/** Display form: the prefix the dashboard also shows. */
+export function maskKey(value) {
+    return value.length > 8 ? `${value.slice(0, 8)}…` : '…';
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAE/C,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,eAAkC,EAAE;IAC9E,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;AAC/F,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC"}

package/dist/routes.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The public API v1 allowlist as this client knows it. Must equal
+ * `PUBLIC_API_V1_ROUTES` in apps/api/src/modules/api-public/api-public.contract.ts
+ * (method, path and scope) — `test/contract-drift.test.ts` checks it.
+ */
+export declare const PUBLIC_API_PREFIX = "/api/v1/public";
+export interface PublicRoute {
+    method: 'GET';
+    path: string;
+    /** Scope the key must carry; null = any valid key. */
+    scope: string | null;
+}
+export declare const PUBLIC_ROUTES: readonly [{
+    readonly method: "GET";
+    readonly path: "/company";
+    readonly scope: null;
+}, {
+    readonly method: "GET";
+    readonly path: "/usage";
+    readonly scope: "analytics:read";
+}, {
+    readonly method: "GET";
+    readonly path: "/contacts";
+    readonly scope: "contacts:read";
+}, {
+    readonly method: "GET";
+    readonly path: "/contacts/:id";
+    readonly scope: "contacts:read";
+}, {
+    readonly method: "GET";
+    readonly path: "/conversations";
+    readonly scope: "conversations:read";
+}, {
+    readonly method: "GET";
+    readonly path: "/conversations/:id";
+    readonly scope: "conversations:read";
+}, {
+    readonly method: "GET";
+    readonly path: "/conversations/:id/messages";
+    readonly scope: "messages:read";
+}, {
+    readonly method: "GET";
+    readonly path: "/orders";
+    readonly scope: "orders:read";
+}, {
+    readonly method: "GET";
+    readonly path: "/orders/:id";
+    readonly scope: "orders:read";
+}, {
+    readonly method: "GET";
+    readonly path: "/products";
+    readonly scope: "products:read";
+}, {
+    readonly method: "GET";
+    readonly path: "/products/:id";
+    readonly scope: "products:read";
+}];
+export type PublicRoutePath = (typeof PUBLIC_ROUTES)[number]['path'];
+export declare function scopeFor(path: PublicRoutePath): string | null;
+//# sourceMappingURL=routes.d.ts.map

package/dist/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAElD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYiB,CAAC;AAE5C,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAG7D"}

package/dist/routes.js

@@ -0,0 +1,24 @@
+/**
+ * The public API v1 allowlist as this client knows it. Must equal
+ * `PUBLIC_API_V1_ROUTES` in apps/api/src/modules/api-public/api-public.contract.ts
+ * (method, path and scope) — `test/contract-drift.test.ts` checks it.
+ */
+export const PUBLIC_API_PREFIX = '/api/v1/public';
+export const PUBLIC_ROUTES = [
+    { method: 'GET', path: '/company', scope: null },
+    { method: 'GET', path: '/usage', scope: 'analytics:read' },
+    { method: 'GET', path: '/contacts', scope: 'contacts:read' },
+    { method: 'GET', path: '/contacts/:id', scope: 'contacts:read' },
+    { method: 'GET', path: '/conversations', scope: 'conversations:read' },
+    { method: 'GET', path: '/conversations/:id', scope: 'conversations:read' },
+    { method: 'GET', path: '/conversations/:id/messages', scope: 'messages:read' },
+    { method: 'GET', path: '/orders', scope: 'orders:read' },
+    { method: 'GET', path: '/orders/:id', scope: 'orders:read' },
+    { method: 'GET', path: '/products', scope: 'products:read' },
+    { method: 'GET', path: '/products/:id', scope: 'products:read' },
+];
+export function scopeFor(path) {
+    const route = PUBLIC_ROUTES.find((r) => r.path === path);
+    return route ? route.scope : null;
+}
+//# sourceMappingURL=routes.js.map

package/dist/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AASlD,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE;IAChD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAC1D,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE;IAC5D,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE;IAChE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACtE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,EAAE;IAC1E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,eAAe,EAAE;IAC9E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE;IACxD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE;IAC5D,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE;IAC5D,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE;CACvB,CAAC;AAI5C,MAAM,UAAU,QAAQ,CAAC,IAAqB;IAC5C,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC"}