@intutic/cli 1.10.0 → 1.10.1

package/dist/lib/decisionsLogRefresh.d.ts

@@ -0,0 +1,28 @@
+/**
+ * decisionsLogRefresh.ts — best-effort, one-shot refresh of the governed
+ * decisions log, triggered by the optional post-merge git hook
+ * (`gitHooks.ts`'s `POST_MERGE_CONTENT`) so a developer sees fresh decisions
+ * right after a merge rather than waiting for the daemon's next ~30s poll.
+ * Never throws — a backgrounded hook must not surface a failure to the shell,
+ * same posture as `deviceReport.ts`'s "best-effort phone-home".
+ *
+ * Reuses `@intutic/sync-daemon`'s `refreshDecisionsDigest` directly rather
+ * than re-implementing the fetch/render/write.
+ *
+ * @module
+ */
+export interface DecisionsLogRefreshResult {
+    refreshed: boolean;
+    reason?: string;
+}
+/**
+ * Checks `WorkspaceSettings.decisionsLogEnabled` before writing anything.
+ *
+ * This is a manually-triggered, one-shot refresh, not the daemon's own gated
+ * poll-cycle call — it has to re-check the opt-in itself rather than
+ * inheriting the daemon's own gate, or a developer merging a branch would
+ * cause files to be written into a workspace that never turned this feature
+ * on.
+ */
+export declare function refreshDecisionsLog(workspaceRoot: string): Promise<DecisionsLogRefreshResult>;
+//# sourceMappingURL=decisionsLogRefresh.d.ts.map

package/dist/lib/decisionsLogRefresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisionsLogRefresh.d.ts","sourceRoot":"","sources":["../../src/lib/decisionsLogRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA4BnG"}

package/dist/lib/decisionsLogRefresh.js

@@ -0,0 +1,54 @@
+/**
+ * decisionsLogRefresh.ts — best-effort, one-shot refresh of the governed
+ * decisions log, triggered by the optional post-merge git hook
+ * (`gitHooks.ts`'s `POST_MERGE_CONTENT`) so a developer sees fresh decisions
+ * right after a merge rather than waiting for the daemon's next ~30s poll.
+ * Never throws — a backgrounded hook must not surface a failure to the shell,
+ * same posture as `deviceReport.ts`'s "best-effort phone-home".
+ *
+ * Reuses `@intutic/sync-daemon`'s `refreshDecisionsDigest` directly rather
+ * than re-implementing the fetch/render/write.
+ *
+ * @module
+ */
+import { loadCredentials } from '../config/store.js';
+import { createApiClient } from './api.js';
+import { refreshDecisionsDigest } from '@intutic/sync-daemon';
+import { HarnessType } from '@intutic/shared-types';
+/**
+ * Checks `WorkspaceSettings.decisionsLogEnabled` before writing anything.
+ *
+ * This is a manually-triggered, one-shot refresh, not the daemon's own gated
+ * poll-cycle call — it has to re-check the opt-in itself rather than
+ * inheriting the daemon's own gate, or a developer merging a branch would
+ * cause files to be written into a workspace that never turned this feature
+ * on.
+ */
+export async function refreshDecisionsLog(workspaceRoot) {
+    try {
+        const creds = await loadCredentials();
+        if (!creds)
+            return { refreshed: false, reason: 'not authenticated' };
+        const client = createApiClient(creds.controlPlaneUrl, creds.apiKey);
+        const { settings } = await client.get('/api/v1/workspace/settings');
+        if (!settings?.decisionsLogEnabled) {
+            return { refreshed: false, reason: 'decisionsLogEnabled is off' };
+        }
+        // The claude-code harness is the sole injection target (see
+        // decisionsDigest.ts's own doc comment) — passed unconditionally here
+        // since this one-shot trigger has no live harness-detection cycle to
+        // draw from the way the daemon's sync loop does.
+        const result = await refreshDecisionsDigest({
+            controlPlaneUrl: creds.controlPlaneUrl,
+            apiKey: creds.apiKey,
+            workspaceId: creds.workspaceId,
+            workspaceRoot,
+            harnesses: [HarnessType.CLAUDE_CODE],
+        });
+        return result ? { refreshed: true } : { refreshed: false, reason: 'digest fetch failed' };
+    }
+    catch (err) {
+        return { refreshed: false, reason: err instanceof Error ? err.message : String(err) };
+    }
+}
+//# sourceMappingURL=decisionsLogRefresh.js.map

package/dist/lib/decisionsLogRefresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisionsLogRefresh.js","sourceRoot":"","sources":["../../src/lib/decisionsLogRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAOnD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,aAAqB;IAC7D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;QAEpE,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QACnE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CACnC,4BAA4B,CAC7B,CAAA;QACD,IAAI,CAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;YACnC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAA;QACnE,CAAC;QAED,4DAA4D;QAC5D,sEAAsE;QACtE,qEAAqE;QACrE,iDAAiD;QACjD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa;YACb,SAAS,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC;SACrC,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAC3F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACvF,CAAC;AACH,CAAC"}

package/dist/lib/deviceReport.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Best-effort phone-home: reads local enforcement state (A4) and reports it
+ * to the control plane's `/api/v1/devices/report` (A6) — the "continuous"
+ * half of "continuous compliance and enforcement". Never throws: the
+ * underlying privileged action (`enforce apply/remove`, `enterprise
+ * install`) already succeeded or failed on its own merits before this runs;
+ * a report failure must not turn that into a command failure.
+ *
+ * @module
+ */
+export interface DeviceReportResult {
+    reported: boolean;
+    reason?: string;
+}
+export interface ReportDeviceStateOptions {
+    dev?: boolean;
+}
+/**
+ * Reads `~/.intutic/` credentials and the local enforcement state file, and
+ * POSTs whatever legs are present. A `sudo`-elevated caller with no
+ * readable credentials (root can't read a Keychain-backed API key) simply
+ * reports `reported: false` — the caller decides whether that's worth
+ * surfacing, this function never throws over it.
+ */
+export declare function reportDeviceState(opts?: ReportDeviceStateOptions): Promise<DeviceReportResult>;
+//# sourceMappingURL=deviceReport.d.ts.map

package/dist/lib/deviceReport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceReport.d.ts","sourceRoot":"","sources":["../../src/lib/deviceReport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE,OAAO,CAAA;CACd;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,GAAE,wBAA6B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8BxG"}

package/dist/lib/deviceReport.js

@@ -0,0 +1,55 @@
+/**
+ * Best-effort phone-home: reads local enforcement state (A4) and reports it
+ * to the control plane's `/api/v1/devices/report` (A6) — the "continuous"
+ * half of "continuous compliance and enforcement". Never throws: the
+ * underlying privileged action (`enforce apply/remove`, `enterprise
+ * install`) already succeeded or failed on its own merits before this runs;
+ * a report failure must not turn that into a command failure.
+ *
+ * @module
+ */
+import { createRequire } from 'node:module';
+import { loadCredentials } from '../config/store.js';
+import { resolveControlPlaneUrl } from '../config/paths.js';
+import { createApiClient } from './api.js';
+import { readEnforcementState } from './enforcementState.js';
+const { version: cliVersion } = createRequire(import.meta.url)('../../package.json');
+/**
+ * Reads `~/.intutic/` credentials and the local enforcement state file, and
+ * POSTs whatever legs are present. A `sudo`-elevated caller with no
+ * readable credentials (root can't read a Keychain-backed API key) simply
+ * reports `reported: false` — the caller decides whether that's worth
+ * surfacing, this function never throws over it.
+ */
+export async function reportDeviceState(opts = {}) {
+    try {
+        const creds = await loadCredentials();
+        if (!creds)
+            return { reported: false, reason: 'not authenticated' };
+        const state = await readEnforcementState();
+        if (!state)
+            return { reported: false, reason: 'no local enforcement state recorded yet' };
+        const body = {
+            fingerprint: state.fingerprint,
+            hostname: state.hostname,
+            platform: state.platform,
+            cliVersion: state.cliVersion ?? cliVersion,
+        };
+        if (state.firewall) {
+            body.firewall = { active: state.firewall.active, backend: state.firewall.backend, detail: state.firewall.detail };
+        }
+        if (state.caTrust) {
+            body.caTrust = { installed: state.caTrust.installed, scope: state.caTrust.scope };
+        }
+        if (state.systemHooks) {
+            body.systemHooks = { installed: state.systemHooks.installed, path: state.systemHooks.path };
+        }
+        const client = createApiClient(resolveControlPlaneUrl(opts.dev), creds.apiKey);
+        await client.post('/api/v1/devices/report', body);
+        return { reported: true };
+    }
+    catch (err) {
+        return { reported: false, reason: err instanceof Error ? err.message : String(err) };
+    }
+}
+//# sourceMappingURL=deviceReport.js.map

package/dist/lib/deviceReport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceReport.js","sourceRoot":"","sources":["../../src/lib/deviceReport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAE5D,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAwB,CAAA;AAW3G;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAiC,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;QAEnE,MAAM,KAAK,GAAG,MAAM,oBAAoB,EAAE,CAAA;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAA;QAEzF,MAAM,IAAI,GAA4B;YACpC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,UAAU;SAC3C,CAAA;QACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAA;QACnH,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;QACnF,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;QAC7F,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QAC9E,MAAM,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAA;QACjD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IACtF,CAAC;AACH,CAAC"}

package/dist/lib/elevation.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Privilege + invoking-user-home resolution, shared by `enterprise install`
+ * (`commands/enterprise.ts`) and `enforce`'s reporting leg (`commands/enforce.ts`).
+ *
+ * Two bugs in the deleted `enterprise-install.ts` motivate this module rather
+ * than a copy of what it did:
+ *
+ * 1. Its Windows elevation check was `process.env.USERNAME === 'Administrator'
+ *    || process.env.IS_ADMIN === '1'` — wrong on essentially every real
+ *    machine (the built-in Administrator account is disabled by default, and
+ *    `IS_ADMIN` is not a variable Windows or any installer sets). It would
+ *    have reported "not elevated" for every real admin session.
+ * 2. It read `~/.intutic/ca.crt` via `os.homedir()`. Under `sudo`,
+ *    `os.homedir()` resolves to `/var/root` (macOS) or `/root` (Linux) — the
+ *    invoking user's home, not root's — so that read always threw ENOENT and
+ *    the command silently skipped CA installation. Confirmed: zero
+ *    `SUDO_USER`/`SUDO_UID` references exist anywhere else in this tree.
+ *
+ * @module
+ */
+/**
+ * `'unknown'` on platforms/paths where no reliable synchronous check exists
+ * (Windows) — callers should attempt-and-report on `'unknown'`, matching
+ * `enforce.ts`'s existing "warn, but still try; the OS gives the precise
+ * error if privilege really is missing" discipline, rather than pre-blocking
+ * on a guess.
+ */
+export type Elevation = 'elevated' | 'unelevated' | 'unknown';
+/** Synchronous, POSIX-only (real euid check). Always `'unknown'` on Windows. */
+export declare function isElevatedSync(): Elevation;
+/**
+ * Resolves `'unknown'` into a real answer on Windows by probing `net
+ * session`, which only an elevated process can run (it fails with "Access is
+ * denied" otherwise). No dependency on environment variables an installer or
+ * shell may or may not set.
+ */
+export declare function isElevatedAsync(): Promise<Elevation>;
+/**
+ * The real invoking user's home directory, even when running as root under
+ * `sudo`. `os.homedir()` under `sudo` resolves to root's home
+ * (`/var/root`/`/root`), not the real user's — the deleted `enterprise-install.ts`
+ * never handled this and its CA-cert read (`~/.intutic/ca.crt`) always threw
+ * ENOENT when actually run elevated.
+ *
+ * Node's `os.userInfo()` cannot look up an arbitrary user by uid — despite
+ * accepting a `uid` option at the type level in some environments, it always
+ * returns the CALLING process's own identity regardless of what's passed
+ * (verified: `userInfo({ uid: 0 })` as a non-root user still returns that
+ * user's own info, not root's). So the only real option without shelling out
+ * to `dscl`/`getent` is the path convention every real deployment follows:
+ * `/Users/$SUDO_USER` on macOS, `/home/$SUDO_USER` on Linux. This is a
+ * correctness improvement over the status quo (silently resolving to root's
+ * home) even though it is a convention, not a guaranteed-correct lookup.
+ */
+export declare function invokingUserHome(): string;
+/** The invoking user's `~/.intutic` (or platform equivalent), sudo-aware. */
+export declare function invokingUserIntuticDir(): string;
+//# sourceMappingURL=elevation.d.ts.map

package/dist/lib/elevation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elevation.d.ts","sourceRoot":"","sources":["../../src/lib/elevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAA;AAE7D,gFAAgF;AAChF,wBAAgB,cAAc,IAAI,SAAS,CAK1C;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,SAAS,CAAC,CAa1D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAQzC;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C"}

package/dist/lib/elevation.js

@@ -0,0 +1,83 @@
+/**
+ * Privilege + invoking-user-home resolution, shared by `enterprise install`
+ * (`commands/enterprise.ts`) and `enforce`'s reporting leg (`commands/enforce.ts`).
+ *
+ * Two bugs in the deleted `enterprise-install.ts` motivate this module rather
+ * than a copy of what it did:
+ *
+ * 1. Its Windows elevation check was `process.env.USERNAME === 'Administrator'
+ *    || process.env.IS_ADMIN === '1'` — wrong on essentially every real
+ *    machine (the built-in Administrator account is disabled by default, and
+ *    `IS_ADMIN` is not a variable Windows or any installer sets). It would
+ *    have reported "not elevated" for every real admin session.
+ * 2. It read `~/.intutic/ca.crt` via `os.homedir()`. Under `sudo`,
+ *    `os.homedir()` resolves to `/var/root` (macOS) or `/root` (Linux) — the
+ *    invoking user's home, not root's — so that read always threw ENOENT and
+ *    the command silently skipped CA installation. Confirmed: zero
+ *    `SUDO_USER`/`SUDO_UID` references exist anywhere else in this tree.
+ *
+ * @module
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { homedir } from 'node:os';
+import { getIntuticDirFor } from '../config/paths.js';
+const execFileAsync = promisify(execFile);
+/** Synchronous, POSIX-only (real euid check). Always `'unknown'` on Windows. */
+export function isElevatedSync() {
+    if (typeof process.getuid === 'function') {
+        return process.getuid() === 0 ? 'elevated' : 'unelevated';
+    }
+    return 'unknown';
+}
+/**
+ * Resolves `'unknown'` into a real answer on Windows by probing `net
+ * session`, which only an elevated process can run (it fails with "Access is
+ * denied" otherwise). No dependency on environment variables an installer or
+ * shell may or may not set.
+ */
+export async function isElevatedAsync() {
+    const sync = isElevatedSync();
+    if (sync !== 'unknown')
+        return sync;
+    if (process.platform === 'win32') {
+        try {
+            await execFileAsync('net', ['session'], { timeout: 3000 });
+            return 'elevated';
+        }
+        catch {
+            return 'unelevated';
+        }
+    }
+    return 'unknown';
+}
+/**
+ * The real invoking user's home directory, even when running as root under
+ * `sudo`. `os.homedir()` under `sudo` resolves to root's home
+ * (`/var/root`/`/root`), not the real user's — the deleted `enterprise-install.ts`
+ * never handled this and its CA-cert read (`~/.intutic/ca.crt`) always threw
+ * ENOENT when actually run elevated.
+ *
+ * Node's `os.userInfo()` cannot look up an arbitrary user by uid — despite
+ * accepting a `uid` option at the type level in some environments, it always
+ * returns the CALLING process's own identity regardless of what's passed
+ * (verified: `userInfo({ uid: 0 })` as a non-root user still returns that
+ * user's own info, not root's). So the only real option without shelling out
+ * to `dscl`/`getent` is the path convention every real deployment follows:
+ * `/Users/$SUDO_USER` on macOS, `/home/$SUDO_USER` on Linux. This is a
+ * correctness improvement over the status quo (silently resolving to root's
+ * home) even though it is a convention, not a guaranteed-correct lookup.
+ */
+export function invokingUserHome() {
+    const isRoot = typeof process.getuid === 'function' && process.getuid() === 0;
+    const sudoUser = process.env.SUDO_USER;
+    if (!isRoot || !sudoUser) {
+        return homedir();
+    }
+    return process.platform === 'darwin' ? `/Users/${sudoUser}` : `/home/${sudoUser}`;
+}
+/** The invoking user's `~/.intutic` (or platform equivalent), sudo-aware. */
+export function invokingUserIntuticDir() {
+    return getIntuticDirFor(invokingUserHome());
+}
+//# sourceMappingURL=elevation.js.map

package/dist/lib/elevation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elevation.js","sourceRoot":"","sources":["../../src/lib/elevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAErD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAWzC,gFAAgF;AAChF,MAAM,UAAU,cAAc;IAC5B,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAA;IAC3D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAA;IAC7B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAEnC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YAC1D,OAAO,UAAU,CAAA;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAA;IACtC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,OAAO,EAAE,CAAA;IAClB,CAAC;IAED,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,QAAQ,EAAE,CAAA;AACnF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB;IACpC,OAAO,gBAAgB,CAAC,gBAAgB,EAAE,CAAC,CAAA;AAC7C,CAAC"}

package/dist/lib/enforcementState.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Local, unprivileged-readable record of a machine's enforcement posture —
+ * firewall, CA trust, system hooks. Solves two problems together:
+ *
+ * 1. `intutic enforce status` needs root to query the underlying firewall
+ *    tool (e.g. `pfctl`) on macOS, so an unprivileged run can't truthfully
+ *    answer "is enforcement actually on?".
+ * 2. A `sudo`-elevated process can't read the real user's stored API
+ *    credentials (Keychain-backed on macOS), so it can't itself report
+ *    posture to the control plane.
+ *
+ * So: the privileged action (`enforce apply/remove`, `enterprise install`)
+ * records the truth here, locally, as it happens; a separate, unprivileged
+ * step (`enforce report`, `connect.ts`'s periodic loop — see A7) reads this
+ * file and ships it.
+ *
+ * World-readable, no secrets in it — device posture only.
+ *
+ * @module
+ */
+export interface FirewallLeg {
+    active: boolean;
+    backend?: string;
+    detail?: string;
+    reportedAt: string;
+}
+export interface CaTrustLeg {
+    installed: boolean;
+    scope: 'user' | 'system';
+    mechanism?: string;
+    reportedAt: string;
+}
+export interface SystemHooksLeg {
+    installed: boolean;
+    path?: string;
+    reportedAt: string;
+}
+export interface EnforcementState {
+    fingerprint: string;
+    hostname: string;
+    platform: string;
+    cliVersion: string;
+    firewall?: FirewallLeg;
+    caTrust?: CaTrustLeg;
+    systemHooks?: SystemHooksLeg;
+}
+/** The legs a single write can update. Omitted legs are preserved from the existing file, not blanked. */
+export type EnforcementStateLegs = Pick<EnforcementState, 'firewall' | 'caTrust' | 'systemHooks'>;
+/** Machine-wide (not per-user) system-config location, per platform convention. */
+export declare function enforcementStatePath(platform?: NodeJS.Platform): string;
+/**
+ * Stable per-machine fingerprint: sha256 of hostname + platform + a
+ * platform machine-id source, truncated to 32 hex chars. Falls back to
+ * hostname + platform alone when the machine-id source is unavailable
+ * (sandboxed CI, no `ioreg`/`reg`, missing `/etc/machine-id`) — still
+ * stable across calls on the same box, just weaker at distinguishing two
+ * machines that happen to share a hostname.
+ */
+export declare function computeFingerprint(platform?: NodeJS.Platform): Promise<string>;
+/** Reads the local enforcement state file, if present. */
+export declare function readEnforcementState(path?: string): Promise<EnforcementState | null>;
+/**
+ * Merge-writes one or more legs into the local enforcement state file.
+ * Never overwrites a leg the caller didn't pass — a firewall-only write
+ * (from `enforce apply`) must not blank out a previously-recorded
+ * CA-trust leg (from `enterprise install`), and vice versa.
+ */
+export declare function writeEnforcementState(legs: EnforcementStateLegs, cliVersion: string, path?: string): Promise<EnforcementState>;
+//# sourceMappingURL=enforcementState.d.ts.map

package/dist/lib/enforcementState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcementState.d.ts","sourceRoot":"","sources":["../../src/lib/enforcementState.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAWH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,WAAW,CAAA;IACtB,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB,WAAW,CAAC,EAAE,cAAc,CAAA;CAC7B;AAED,0GAA0G;AAC1G,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC,CAAA;AAEjG,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,MAAM,CAMzF;AA6BD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,CAItG;AAUD,0DAA0D;AAC1D,wBAAsB,oBAAoB,CAAC,IAAI,GAAE,MAA+B,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAElH;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,oBAAoB,EAC1B,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAA+B,GACpC,OAAO,CAAC,gBAAgB,CAAC,CAoB3B"}

package/dist/lib/enforcementState.js

@@ -0,0 +1,113 @@
+/**
+ * Local, unprivileged-readable record of a machine's enforcement posture —
+ * firewall, CA trust, system hooks. Solves two problems together:
+ *
+ * 1. `intutic enforce status` needs root to query the underlying firewall
+ *    tool (e.g. `pfctl`) on macOS, so an unprivileged run can't truthfully
+ *    answer "is enforcement actually on?".
+ * 2. A `sudo`-elevated process can't read the real user's stored API
+ *    credentials (Keychain-backed on macOS), so it can't itself report
+ *    posture to the control plane.
+ *
+ * So: the privileged action (`enforce apply/remove`, `enterprise install`)
+ * records the truth here, locally, as it happens; a separate, unprivileged
+ * step (`enforce report`, `connect.ts`'s periodic loop — see A7) reads this
+ * file and ships it.
+ *
+ * World-readable, no secrets in it — device posture only.
+ *
+ * @module
+ */
+import { readFile, writeFile, mkdir, rename } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { hostname } from 'node:os';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { createHash } from 'node:crypto';
+const execFileAsync = promisify(execFile);
+/** Machine-wide (not per-user) system-config location, per platform convention. */
+export function enforcementStatePath(platform = process.platform) {
+    if (platform === 'darwin')
+        return '/Library/Application Support/Intutic/enforcement-state.json';
+    if (platform === 'win32') {
+        return `${process.env.ProgramData ?? 'C:\\ProgramData'}\\Intutic\\enforcement-state.json`;
+    }
+    return '/var/lib/intutic/enforcement-state.json';
+}
+async function readMachineId(platform) {
+    try {
+        if (platform === 'linux') {
+            const id = (await readFile('/etc/machine-id', 'utf-8')).trim();
+            return id || null;
+        }
+        if (platform === 'darwin') {
+            const { stdout } = await execFileAsync('ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice']);
+            const match = stdout.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
+            return match?.[1] ?? null;
+        }
+        if (platform === 'win32') {
+            const { stdout } = await execFileAsync('reg', [
+                'query',
+                'HKLM\\SOFTWARE\\Microsoft\\Cryptography',
+                '/v',
+                'MachineGuid',
+            ]);
+            const match = stdout.match(/MachineGuid\s+REG_SZ\s+([0-9a-fA-F-]+)/);
+            return match?.[1] ?? null;
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+/**
+ * Stable per-machine fingerprint: sha256 of hostname + platform + a
+ * platform machine-id source, truncated to 32 hex chars. Falls back to
+ * hostname + platform alone when the machine-id source is unavailable
+ * (sandboxed CI, no `ioreg`/`reg`, missing `/etc/machine-id`) — still
+ * stable across calls on the same box, just weaker at distinguishing two
+ * machines that happen to share a hostname.
+ */
+export async function computeFingerprint(platform = process.platform) {
+    const machineId = await readMachineId(platform);
+    const material = machineId ? `${hostname()}:${platform}:${machineId}` : `${hostname()}:${platform}`;
+    return createHash('sha256').update(material).digest('hex').slice(0, 32);
+}
+async function readState(path) {
+    try {
+        return JSON.parse(await readFile(path, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Reads the local enforcement state file, if present. */
+export async function readEnforcementState(path = enforcementStatePath()) {
+    return readState(path);
+}
+/**
+ * Merge-writes one or more legs into the local enforcement state file.
+ * Never overwrites a leg the caller didn't pass — a firewall-only write
+ * (from `enforce apply`) must not blank out a previously-recorded
+ * CA-trust leg (from `enterprise install`), and vice versa.
+ */
+export async function writeEnforcementState(legs, cliVersion, path = enforcementStatePath()) {
+    const existing = await readState(path);
+    const fingerprint = existing?.fingerprint ?? (await computeFingerprint());
+    const next = {
+        fingerprint,
+        hostname: hostname(),
+        platform: process.platform,
+        cliVersion,
+        firewall: legs.firewall ?? existing?.firewall,
+        caTrust: legs.caTrust ?? existing?.caTrust,
+        systemHooks: legs.systemHooks ?? existing?.systemHooks,
+    };
+    await mkdir(dirname(path), { recursive: true });
+    const tmp = `${path}.intutic-tmp`;
+    await writeFile(tmp, JSON.stringify(next, null, 2) + '\n', { mode: 0o644 });
+    await rename(tmp, path);
+    return next;
+}
+//# sourceMappingURL=enforcementState.js.map

package/dist/lib/enforcementState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcementState.js","sourceRoot":"","sources":["../../src/lib/enforcementState.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAmCzC,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAAC,WAA4B,OAAO,CAAC,QAAQ;IAC/E,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,6DAA6D,CAAA;IAC/F,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,iBAAiB,mCAAmC,CAAA;IAC3F,CAAC;IACD,OAAO,yCAAyC,CAAA;AAClD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAyB;IACpD,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC9D,OAAO,EAAE,IAAI,IAAI,CAAA;QACnB,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAA;YACzF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;YAC9D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;QAC3B,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE;gBAC5C,OAAO;gBACP,yCAAyC;gBACzC,IAAI;gBACJ,aAAa;aACd,CAAC,CAAA;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAA;YACpE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAA4B,OAAO,CAAC,QAAQ;IACnF,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAA;IACnG,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACzE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAqB,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe,oBAAoB,EAAE;IAC9E,OAAO,SAAS,CAAC,IAAI,CAAC,CAAA;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA0B,EAC1B,UAAkB,EAClB,OAAe,oBAAoB,EAAE;IAErC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,WAAW,GAAG,QAAQ,EAAE,WAAW,IAAI,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAA;IAEzE,MAAM,IAAI,GAAqB;QAC7B,WAAW;QACX,QAAQ,EAAE,QAAQ,EAAE;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU;QACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ;QAC7C,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO;QAC1C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW;KACvD,CAAA;IAED,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,GAAG,IAAI,cAAc,CAAA;IACjC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3E,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAEvB,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/lib/ensureValkey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensureValkey.d.ts","sourceRoot":"","sources":["../../src/lib/ensureValkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,IAAI,SAAO,EAAE,IAAI,SAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAajF;AAoBD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,yEAAyE;IACzE,GAAG,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAA;CAC/C;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,SAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA+E3E;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,IAAI,SAAO,GAAG,MAAM,CAQrD"}
+{"version":3,"file":"ensureValkey.d.ts","sourceRoot":"","sources":["../../src/lib/ensureValkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,IAAI,SAAO,EAAE,IAAI,SAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAajF;AAoBD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,yEAAyE;IACzE,GAAG,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAA;CAC/C;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,SAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiF3E;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,IAAI,SAAO,GAAG,MAAM,CAQrD"}

package/dist/lib/ensureValkey.js

@@ -94,7 +94,7 @@ export async function ensureValkey(port = 6379) {
                 log.warn('Started the container but nothing answered on the port.');
             }
             catch (err) {
-                log.warn(`Could not start Valkey via Docker: ${err.message}`);
+                log.warn(`Could not start Valkey via Docker: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
     }
@@ -122,7 +122,7 @@ export async function ensureValkey(port = 6379) {
             log.warn(`Spawned ${nativeCmd} but nothing answered on the port.`);
         }
         catch (err) {
-            log.warn(`Could not spawn ${nativeCmd}: ${err.message}`);
+            log.warn(`Could not spawn ${nativeCmd}: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
     return { running: false, via: 'none' };

package/dist/lib/ensureValkey.js.map

@@ -1 +1 @@
-{"version":3,"file":"ensureValkey.js","sourceRoot":"","sources":["../../src/lib/ensureValkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAA;AACpC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAEjC,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,GAAG,WAAW;IAC7D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAA;QACpC,MAAM,IAAI,GAAG,CAAC,MAAe,EAAE,EAAE;YAC/B,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAO,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC,CAAA;QACD,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACxB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QACzC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QACvC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,0DAA0D;AAC1D,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAQ,GAAG,EAAE;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,MAAM,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAC5C,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,QAAQ,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC7F,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAI,GAAG,IAAI;IAC5C,IAAI,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAA;IAC3C,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,8BAA8B,IAAI,wBAAwB,CAAC,CAAA;IAEpE,6EAA6E;IAC7E,8EAA8E;IAC9E,wBAAwB;IACxB,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,CAAC;YACH,QAAQ,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC5C,QAAQ,GAAG,IAAI,CAAA;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAA;QAC3E,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,QAAQ,CACvB,oEAAoE,EACpE,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC,IAAI,EAAE,CAAA;gBAER,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;oBAClC,GAAG,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAA;oBACvD,QAAQ,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;gBAC9D,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAA;oBAC3E,QAAQ,CACN,0CAA0C,IAAI,8BAA8B,EAC5E,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAA;gBACH,CAAC;gBAED,IAAI,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,GAAG,CAAC,OAAO,CAAC,qDAAqD,IAAI,GAAG,CAAC,CAAA;oBACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;gBACzC,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAA;YACrE,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,sCAAsC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/D,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,0DAA0D;IAC1D,MAAM,SAAS,GAAG,aAAa,CAAC,eAAe,CAAC;QAC9C,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC;YAC7B,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,IAAI,CAAA;IAEV,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,SAAS,SAAS,2CAA2C,CAAC,CAAA;QACvE,IAAI,CAAC;YACH,gEAAgE;YAChE,MAAM,IAAI,GACR,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC1B,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;YACpD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;YACxE,IAAI,CAAC,KAAK,EAAE,CAAA;YAEZ,IAAI,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,GAAG,CAAC,OAAO,CAAC,sBAAsB,SAAS,YAAY,IAAI,GAAG,CAAC,CAAA;gBAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;YACzC,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,WAAW,SAAS,oCAAoC,CAAC,CAAA;QACpE,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,mBAAmB,SAAS,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;AACxC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAG,IAAI;IAC3C,OAAO,CACL,6CAA6C,IAAI,OAAO;QACxD,sDAAsD,IAAI,gCAAgC;QAC1F,2DAA2D,IAAI,oBAAoB;QACnF,2EAA2E,IAAI,sBAAsB;QACrG,4EAA4E,CAC7E,CAAA;AACH,CAAC"}
+{"version":3,"file":"ensureValkey.js","sourceRoot":"","sources":["../../src/lib/ensureValkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAA;AACpC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAEjC,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,GAAG,WAAW;IAC7D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAA;QACpC,MAAM,IAAI,GAAG,CAAC,MAAe,EAAE,EAAE;YAC/B,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAO,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC,CAAA;QACD,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACxB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QACzC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QACvC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,0DAA0D;AAC1D,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAQ,GAAG,EAAE;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,MAAM,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAC5C,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,QAAQ,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC7F,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAI,GAAG,IAAI;IAC5C,IAAI,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAA;IAC3C,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,8BAA8B,IAAI,wBAAwB,CAAC,CAAA;IAEpE,6EAA6E;IAC7E,8EAA8E;IAC9E,wBAAwB;IACxB,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,CAAC;YACH,QAAQ,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC5C,QAAQ,GAAG,IAAI,CAAA;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAA;QAC3E,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,QAAQ,CACvB,oEAAoE,EACpE,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC,IAAI,EAAE,CAAA;gBAER,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;oBAClC,GAAG,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAA;oBACvD,QAAQ,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;gBAC9D,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAA;oBAC3E,QAAQ,CACN,0CAA0C,IAAI,8BAA8B,EAC5E,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAA;gBACH,CAAC;gBAED,IAAI,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,GAAG,CAAC,OAAO,CAAC,qDAAqD,IAAI,GAAG,CAAC,CAAA;oBACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;gBACzC,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAA;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACzF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,0DAA0D;IAC1D,MAAM,SAAS,GAAG,aAAa,CAAC,eAAe,CAAC;QAC9C,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC;YAC7B,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,IAAI,CAAA;IAEV,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,SAAS,SAAS,2CAA2C,CAAC,CAAA;QACvE,IAAI,CAAC;YACH,gEAAgE;YAChE,MAAM,IAAI,GACR,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC1B,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;YACpD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;YACxE,IAAI,CAAC,KAAK,EAAE,CAAA;YAEZ,IAAI,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,GAAG,CAAC,OAAO,CAAC,sBAAsB,SAAS,YAAY,IAAI,GAAG,CAAC,CAAA;gBAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;YACzC,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,WAAW,SAAS,oCAAoC,CAAC,CAAA;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,mBAAmB,SAAS,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC/F,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;AACxC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAG,IAAI;IAC3C,OAAO,CACL,6CAA6C,IAAI,OAAO;QACxD,sDAAsD,IAAI,gCAAgC;QAC1F,2DAA2D,IAAI,oBAAoB;QACnF,2EAA2E,IAAI,sBAAsB;QACrG,4EAA4E,CAC7E,CAAA;AACH,CAAC"}

package/dist/lib/envInjector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envInjector.d.ts","sourceRoot":"","sources":["../../src/lib/envInjector.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAG,MAAM,CAAC,QAAQ,CAAA;IAC1B,KAAK,EAAM,QAAQ,GAAG,MAAM,CAAA;IAC5B,IAAI,EAAO,MAAM,EAAE,CAAA;IACnB,MAAM,EAAK,MAAM,CAAA;CAClB;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,QAAQ,EAAE,MAAM;CAI7B;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,IAAI,EAAE,MAAM;CAIzB;AA8CD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAwCrF;AAED;;GAEG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAiB1D"}
+{"version":3,"file":"envInjector.d.ts","sourceRoot":"","sources":["../../src/lib/envInjector.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAG,MAAM,CAAC,QAAQ,CAAA;IAC1B,KAAK,EAAM,QAAQ,GAAG,MAAM,CAAA;IAC5B,IAAI,EAAO,MAAM,EAAE,CAAA;IACnB,MAAM,EAAK,MAAM,CAAA;CAClB;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,QAAQ,EAAE,MAAM;CAI7B;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,IAAI,EAAE,MAAM;CAIzB;AAsED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAwCrF;AAED;;GAEG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAiB1D"}

package/dist/lib/envInjector.js

@@ -41,7 +41,11 @@ function macosRemove(key) {
     try {
         execSync(`launchctl unsetenv ${key}`, { stdio: 'pipe' });
     }
-    catch { }
+    catch {
+        // Removal is idempotent by contract: `launchctl unsetenv` exits non-zero when
+        // the key was never set (or the user session has no launchd domain, e.g. over
+        // ssh). Both mean "already absent", which is the state the caller asked for.
+    }
 }
 function linuxInjectUser(key, value) {
     const rcFile = path.join(os.homedir(), '.bashrc');
@@ -51,7 +55,14 @@ function linuxInjectUser(key, value) {
     try {
         content = fs.readFileSync(rcFile, 'utf8');
     }
-    catch { }
+    catch {
+        // A missing ~/.bashrc is the normal first-run case: `content` stays '' and the
+        // write below creates the file.
+        // CAUTION: this also swallows non-ENOENT read failures (EACCES, EISDIR, a
+        // symlink loop), and the write below then replaces the user's .bashrc with the
+        // single export line. Narrowing this to ENOENT would be a behaviour change, so
+        // it is deliberately left alone here rather than fixed as lint cleanup.
+    }
     // Remove existing entry for this key
     const lines = content.split('\n').filter(l => !l.includes(marker));
     lines.push(line);
@@ -65,7 +76,11 @@ function linuxRemoveUser(key) {
         const filtered = content.split('\n').filter(l => !l.includes(marker)).join('\n');
         fs.writeFileSync(rcFile, filtered + '\n', { mode: 0o644 });
     }
-    catch { }
+    catch {
+        // Nothing to remove if ~/.bashrc does not exist, and an unwritable rc file must
+        // not fail an uninstall: the marker line is inert shell state, so leaving it in
+        // place is strictly better than aborting the rest of the removal sequence.
+    }
 }
 function windowsInject(key, value) {
     execSync(`setx ${key} "${sanitizeShellValue(value)}"`, { stdio: 'pipe' });
@@ -74,7 +89,10 @@ function windowsRemove(key) {
     try {
         execSync(`reg delete HKCU\\Environment /v ${key} /f`, { stdio: 'pipe' });
     }
-    catch { }
+    catch {
+        // `reg delete` exits 1 with "unable to find the specified registry key or value"
+        // when the value is already gone. Removal is idempotent, so absence is success.
+    }
 }
 /**
  * Injects ANTHROPIC_BASE_URL and OPENAI_BASE_URL as persistent env vars.