@intutic/cli 1.10.0 → 2.0.0

package/dist/lib/api.js

@@ -7,6 +7,8 @@
  * LLD #8 — Sync Daemon / CLI
  * @module
  */
+import { toonDecode as sharedToonDecode } from '@intutic/shared-types';
+import { injectTraceHeaders } from './otelPropagation.js';
 /**
  * Create an API client bound to a control plane URL and API key.
  *
@@ -14,12 +16,16 @@
  * @param apiKey - API key (vk_*) or JWT access token
  */
 export function createApiClient(controlPlaneUrl, apiKey) {
-    const headers = {
+    const baseHeaders = {
         'Content-Type': 'application/json',
         'Authorization': `Bearer ${apiKey}`,
     };
     async function request(method, path, body) {
         const url = `${controlPlaneUrl}${path}`;
+        // Per-request copy: injectTraceHeaders mutates in place, and baseHeaders
+        // is shared across every call this client makes.
+        const headers = { ...baseHeaders };
+        injectTraceHeaders(headers);
         const res = await fetch(url, {
             method,
             headers,
@@ -29,20 +35,7 @@ export function createApiClient(controlPlaneUrl, apiKey) {
             const text = await res.text().catch(() => 'Unknown error');
             throw new Error(`API ${method} ${path} failed (${res.status}): ${text}`);
         }
-        const data = await res.json();
-        if (data &&
-            typeof data === 'object' &&
-            'format' in data &&
-            data.format === 'toon' &&
-            typeof data.data === 'string' &&
-            typeof data.listProperty === 'string') {
-            const decoded = toonDecode(data.data);
-            data[data.listProperty] = decoded;
-            delete data.format;
-            delete data.data;
-            delete data.listProperty;
-        }
-        return data;
+        return unwrapToonEnvelope(await res.json());
     }
     return {
         async fetchConfig(workspaceId) {
@@ -63,66 +56,114 @@ export function createApiClient(controlPlaneUrl, apiKey) {
         async get(path) {
             return request('GET', path);
         },
+        async getWithStatus(path) {
+            const headers = { ...baseHeaders };
+            injectTraceHeaders(headers);
+            const res = await fetch(`${controlPlaneUrl}${path}`, { method: 'GET', headers });
+            const text = await res.text();
+            let body;
+            try {
+                body = JSON.parse(text);
+            }
+            catch {
+                // Kept rather than discarded: a proxy's HTML error page is the thing
+                // that explains a status the caller did not expect.
+                body = { error: text };
+            }
+            return { status: res.status, body: body };
+        },
         async post(path, body) {
             return request('POST', path, body);
         },
+        async postWithStatus(path, body) {
+            const headers = { ...baseHeaders };
+            injectTraceHeaders(headers);
+            const res = await fetch(`${controlPlaneUrl}${path}`, {
+                method: 'POST',
+                headers,
+                body: body ? JSON.stringify(body) : undefined,
+            });
+            const text = await res.text();
+            let parsed;
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parsed = { error: text };
+            }
+            return { status: res.status, body: unwrapToonEnvelope(parsed) };
+        },
+        async postForm(path, form) {
+            const headers = { Authorization: baseHeaders.Authorization };
+            injectTraceHeaders(headers);
+            const res = await fetch(`${controlPlaneUrl}${path}`, { method: 'POST', headers, body: form });
+            const text = await res.text();
+            let parsed;
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parsed = { error: text };
+            }
+            return { status: res.status, body: unwrapToonEnvelope(parsed) };
+        },
         async put(path, body) {
             return request('PUT', path, body);
         },
+        async patch(path, body) {
+            return request('PATCH', path, body);
+        },
+        async del(path, body) {
+            return request('DELETE', path, body);
+        },
     };
 }
-function toonDecode(toon) {
-    const lines = toon.trimEnd().split('\n');
-    if (lines.length < 1)
-        return [];
-    const header = lines[0];
-    if (!header.startsWith('TOON|'))
-        return [];
-    const colsStr = header.slice(5); // 'TOON|'.length
-    if (colsStr === '(empty)')
-        return [];
-    const cols = colsStr.split(',');
-    const rows = [];
-    for (const line of lines.slice(1)) {
-        if (!line.trim())
-            continue;
-        const cells = line
-            .replace(/\\\|/g, '\x00')
-            .split('|')
-            .map((c) => c.split('\x00').join('|').replace(/\\n/g, '\n'));
-        const obj = {};
-        for (let i = 0; i < cols.length; i++) {
-            const raw = cells[i] ?? '-';
-            if (raw === '-') {
-                obj[cols[i]] = null;
-                continue;
-            }
-            if (raw === 't') {
-                obj[cols[i]] = true;
-                continue;
-            }
-            if (raw === 'f') {
-                obj[cols[i]] = false;
-                continue;
-            }
-            const num = Number(raw);
-            if (!isNaN(num) && raw !== '') {
-                obj[cols[i]] = num;
-                continue;
-            }
-            if (raw.startsWith('{') || raw.startsWith('[')) {
-                try {
-                    obj[cols[i]] = JSON.parse(raw);
-                    continue;
-                }
-                catch {
-                    /* fall through */
-                }
-            }
-            obj[cols[i]] = raw;
-        }
-        rows.push(obj);
+/**
+ * Decodes a TOON payload, normalising "not TOON" to an empty list.
+ *
+ * The format lives in `@intutic/shared-types`, imported rather than copied. It
+ * used to be a private `splitCells` here, byte-identical to one in the dashboard
+ * and a third in the control plane, with a comment in each saying they must not
+ * diverge. They did — an escaping fix reached the encoder and the control
+ * plane's own decoder, which nothing calls, while these two kept the old code
+ * and a CRITICAL incident carried on printing as its trace id.
+ *
+ * The shared decoder returns `null` for input that is not TOON; this surface has
+ * always returned a list, and its caller assigns the result straight onto the
+ * response object, so the shape is preserved here rather than pushed outward.
+ */
+export function toonDecode(toon) {
+    return sharedToonDecode(toon) ?? [];
+}
+/**
+ * Move a TOON-encoded list out of its envelope and onto `listProperty`.
+ *
+ * Extracted from `request` because it was inline and therefore untestable, and
+ * it was wrong: the old code assigned the decoded rows and only THEN deleted
+ * `data`. `listProperty` names where the rows should land, and for
+ * `/api/v1/incidents` that name IS `data` — so the rows were written and
+ * immediately deleted, and any incidents response over the 20-row TOON
+ * threshold arrived as `{meta:{total:22}}`. Zero rows, no error.
+ * `/api/v1/traces` escaped only because its listProperty is `traces`.
+ *
+ * Non-TOON bodies pass through untouched.
+ */
+export function unwrapToonEnvelope(data) {
+    if (!data ||
+        typeof data !== 'object' ||
+        !('format' in data) ||
+        data['format'] !== 'toon') {
+        return data;
     }
-    return rows;
+    const body = data;
+    const listProperty = body['listProperty'];
+    if (typeof body['data'] !== 'string' || typeof listProperty !== 'string')
+        return data;
+    const decoded = toonDecode(body['data']);
+    delete body['format'];
+    delete body['data'];
+    delete body['listProperty'];
+    body[listProperty] = decoded;
+    return body;
 }
 //# sourceMappingURL=api.js.map

package/dist/lib/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuBH;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,eAAuB,EAAE,MAAc;IACrE,MAAM,OAAO,GAAG;QACd,cAAc,EAAE,kBAAkB;QAClC,eAAe,EAAE,UAAU,MAAM,EAAE;KACpC,CAAA;IAED,KAAK,UAAU,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACpE,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,IAAI,EAAE,CAAA;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAA;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAA;YAC1D,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,IAAI,IAAI,YAAY,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,IACE,IAAI;YACJ,OAAO,IAAI,KAAK,QAAQ;YACxB,QAAQ,IAAI,IAAI;YAChB,IAAI,CAAC,MAAM,KAAK,MAAM;YACtB,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAC7B,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EACrC,CAAC;YACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACrC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,OAAO,CAAA;YACjC,OAAO,IAAI,CAAC,MAAM,CAAA;YAClB,OAAO,IAAI,CAAC,IAAI,CAAA;YAChB,OAAO,IAAI,CAAC,YAAY,CAAA;QAC1B,CAAC;QAED,OAAO,IAAS,CAAA;IAClB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,WAAmB;YACnC,OAAO,OAAO,CAAoB,MAAM,EAAE,qBAAqB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;QACnF,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAoB;YACrC,OAAO,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAA;QACvD,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAqB;YACtC,OAAO,OAAO,CAAC,MAAM,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAA;QACzD,CAAC;QAED,KAAK,CAAC,KAAK;YACT,OAAO,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAA;QAC1C,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,QAAgB;YACzC,OAAO,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACnE,CAAC;QAED,KAAK,CAAC,GAAG,CAAI,IAAY;YACvB,OAAO,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAA;QAChC,CAAC;QAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAc;YACxC,OAAO,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACvC,CAAC;QAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc;YACvC,OAAO,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACtC,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAA;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC,iBAAiB;IACjD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,MAAM,IAAI,GAA8B,EAAE,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAQ;QAC1B,MAAM,KAAK,GAAG,IAAI;aACf,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;aACxB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC9D,MAAM,GAAG,GAA4B,EAAE,CAAA;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAA;YAC3B,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;gBACnB,SAAQ;YACV,CAAC;YACD,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;gBACnB,SAAQ;YACV,CAAC;YACD,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;gBACpB,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;YACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC9B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAA;gBAClB,SAAQ;YACV,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBACH,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC9B,SAAQ;gBACV,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAA;QACpB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAChB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AA+CzD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,eAAuB,EAAE,MAAc;IACrE,MAAM,WAAW,GAAG;QAClB,cAAc,EAAE,kBAAkB;QAClC,eAAe,EAAE,UAAU,MAAM,EAAE;KACpC,CAAA;IAED,KAAK,UAAU,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACpE,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,IAAI,EAAE,CAAA;QACvC,yEAAyE;QACzE,iDAAiD;QACjD,MAAM,OAAO,GAA2B,EAAE,GAAG,WAAW,EAAE,CAAA;QAC1D,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAA;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAA;YAC1D,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,IAAI,IAAI,YAAY,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;IAClD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,WAAmB;YACnC,OAAO,OAAO,CAAoB,MAAM,EAAE,qBAAqB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;QACnF,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAoB;YACrC,OAAO,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAA;QACvD,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAqB;YACtC,OAAO,OAAO,CAAC,MAAM,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAA;QACzD,CAAC;QAED,KAAK,CAAC,KAAK;YACT,OAAO,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAA;QAC1C,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,QAAgB;YACzC,OAAO,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACnE,CAAC;QAED,KAAK,CAAC,GAAG,CAAI,IAAY;YACvB,OAAO,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAA;QAChC,CAAC;QAED,KAAK,CAAC,aAAa,CAAI,IAAY;YACjC,MAAM,OAAO,GAA2B,EAAE,GAAG,WAAW,EAAE,CAAA;YAC1D,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YAChF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,IAAI,IAAa,CAAA;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,oDAAoD;gBACpD,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YACxB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAS,EAAE,CAAA;QAChD,CAAC;QAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAc;YACxC,OAAO,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACvC,CAAC;QAED,KAAK,CAAC,cAAc,CAAI,IAAY,EAAE,IAAc;YAClD,MAAM,OAAO,GAA2B,EAAE,GAAG,WAAW,EAAE,CAAA;YAC1D,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;aAC9C,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,IAAI,MAAe,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YAC1B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAM,EAAE,CAAA;QACtE,CAAC;QAED,KAAK,CAAC,QAAQ,CAAI,IAAY,EAAE,IAAc;YAC5C,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAA;YACpF,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,IAAI,MAAe,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YAC1B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAM,EAAE,CAAA;QACtE,CAAC;QAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc;YACvC,OAAO,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACtC,CAAC;QAED,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAc;YACzC,OAAO,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACxC,CAAC;QAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc;YACvC,OAAO,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACzC,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IACE,CAAC,IAAI;QACL,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC;QAClB,IAAgC,CAAC,QAAQ,CAAC,KAAK,MAAM,EACtD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,IAA+B,CAAA;IAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAA;IACzC,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAErF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAA;IACrB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;IACnB,OAAO,IAAI,CAAC,cAAc,CAAC,CAAA;IAC3B,IAAI,CAAC,YAAY,CAAC,GAAG,OAAO,CAAA;IAC5B,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/lib/authMessages.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The refusal a control-plane command prints when no credentials are set.
+ *
+ * Nine command files carried this exact string as an independent literal —
+ * `skill.ts`'s `getClient()` a tenth, `integrity.ts` an eleventh (its own
+ * file-local const, reused four times internally) — with zero drift between
+ * them, which is the good case of a message that should have been one
+ * constant from the start. Extracted here rather than left duplicated.
+ *
+ * `init.ts`, `connect.ts` and `traces.ts` deliberately do NOT use this: each
+ * has its own more specific message (`connect.ts`'s carries an inline
+ * comment explaining why the generic "run `intutic login`" framing sent
+ * standalone users looking for an account that doesn't exist). Do not fold
+ * those in.
+ *
+ * @module
+ */
+export declare const NOT_AUTHENTICATED: string;
+//# sourceMappingURL=authMessages.d.ts.map

package/dist/lib/authMessages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authMessages.d.ts","sourceRoot":"","sources":["../../src/lib/authMessages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,iBAAiB,QAEgG,CAAA"}

package/dist/lib/authMessages.js

@@ -0,0 +1,20 @@
+/**
+ * The refusal a control-plane command prints when no credentials are set.
+ *
+ * Nine command files carried this exact string as an independent literal —
+ * `skill.ts`'s `getClient()` a tenth, `integrity.ts` an eleventh (its own
+ * file-local const, reused four times internally) — with zero drift between
+ * them, which is the good case of a message that should have been one
+ * constant from the start. Extracted here rather than left duplicated.
+ *
+ * `init.ts`, `connect.ts` and `traces.ts` deliberately do NOT use this: each
+ * has its own more specific message (`connect.ts`'s carries an inline
+ * comment explaining why the generic "run `intutic login`" framing sent
+ * standalone users looking for an account that doesn't exist). Do not fold
+ * those in.
+ *
+ * @module
+ */
+export const NOT_AUTHENTICATED = 'Not authenticated. This command needs an Intutic control plane, which open core does not include. ' +
+    'To run the proxy without one: `intutic start`. See https://docs.intutic.ai/guide/tier-matrix for what standalone includes.';
+//# sourceMappingURL=authMessages.js.map

package/dist/lib/authMessages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authMessages.js","sourceRoot":"","sources":["../../src/lib/authMessages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,oGAAoG;IACpG,4HAA4H,CAAA"}

package/dist/lib/binaryChecksum.d.ts

@@ -0,0 +1,12 @@
+/** `sha256:<hex>` of `buffer` — the shape publish.yml's checksums.json values use. */
+export declare function sha256Hex(buffer: Buffer): string;
+/** Parses a checksums.json body into a plain name→digest map. Throws on any other shape. */
+export declare function parseChecksums(text: string): Record<string, string>;
+/**
+ * Throws unless `buffer`'s digest matches `checksums[assetName]`. A missing entry
+ * fails the same as a mismatch — an asset absent from the manifest is exactly as
+ * unverifiable as one that fails it, and treating it as "nothing to check" would
+ * make the whole guard optional for any release that forgot to list an asset.
+ */
+export declare function verifyChecksum(buffer: Buffer, checksums: Record<string, string>, assetName: string): void;
+//# sourceMappingURL=binaryChecksum.d.ts.map

package/dist/lib/binaryChecksum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binaryChecksum.d.ts","sourceRoot":"","sources":["../../src/lib/binaryChecksum.ts"],"names":[],"mappings":"AAcA,sFAAsF;AACtF,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAczG"}

package/dist/lib/binaryChecksum.js

@@ -0,0 +1,45 @@
+/**
+ * Checksum verification for downloaded release binaries.
+ *
+ * Mirrors packages/proxy/bin/proxy.js's own copy of these three functions
+ * (same names, same behavior, same `sha256:<hex>` digest shape) — that file
+ * has no build step and deliberately no dependencies beyond Node builtins, so
+ * it cannot import this package; the logic is kept in lockstep by hand
+ * instead, same as this file's caller already mirrors that one's asset-name
+ * resolution and download flow.
+ *
+ * @module
+ */
+import { createHash } from 'node:crypto';
+/** `sha256:<hex>` of `buffer` — the shape publish.yml's checksums.json values use. */
+export function sha256Hex(buffer) {
+    return 'sha256:' + createHash('sha256').update(buffer).digest('hex');
+}
+/** Parses a checksums.json body into a plain name→digest map. Throws on any other shape. */
+export function parseChecksums(text) {
+    const data = JSON.parse(text);
+    if (typeof data !== 'object' || data === null || Array.isArray(data)) {
+        throw new Error('checksums.json did not parse to an object');
+    }
+    return data;
+}
+/**
+ * Throws unless `buffer`'s digest matches `checksums[assetName]`. A missing entry
+ * fails the same as a mismatch — an asset absent from the manifest is exactly as
+ * unverifiable as one that fails it, and treating it as "nothing to check" would
+ * make the whole guard optional for any release that forgot to list an asset.
+ */
+export function verifyChecksum(buffer, checksums, assetName) {
+    const expected = checksums[assetName];
+    const actual = sha256Hex(buffer);
+    if (!expected) {
+        throw new Error(`checksums.json has no entry for ${assetName} — refusing to install an unverified binary.`);
+    }
+    if (actual !== expected) {
+        throw new Error(`Checksum mismatch for ${assetName}:\n` +
+            `  expected: ${expected}\n` +
+            `  actual:   ${actual}\n` +
+            `This could mean a corrupted download or a tampered release asset — refusing to install it. Do not retry blindly.`);
+    }
+}
+//# sourceMappingURL=binaryChecksum.js.map

package/dist/lib/binaryChecksum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binaryChecksum.js","sourceRoot":"","sources":["../../src/lib/binaryChecksum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,sFAAsF;AACtF,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACtE,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,IAA8B,CAAA;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,SAAiC,EAAE,SAAiB;IACjG,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,8CAA8C,CAAC,CAAA;IAC7G,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,yBAAyB,SAAS,KAAK;YACrC,eAAe,QAAQ,IAAI;YAC3B,eAAe,MAAM,IAAI;YACzB,kHAAkH,CACrH,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/lib/binaryOnPath.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Cross-platform "is this binary on PATH" check, without invoking the binary
+ * itself.
+ *
+ * Hoisted out of `sandbox/firecracker.ts` — originally a private helper
+ * there, checking for the `firecracker` binary — once a second external-tool
+ * integration (`ciscoScanner.ts`, the opt-in Cisco `skill-scanner`
+ * integration, Phase S3) needed the identical check. A shared, single
+ * implementation here, rather than a second copy that could quietly drift
+ * from the first (different shell quoting, different exit-code handling).
+ *
+ * @module
+ */
+/**
+ * Resolves `true` iff `bin` is found on PATH.
+ *
+ * Uses `command -v`, a POSIX shell builtin, via `sh -c` rather than spawning
+ * `bin` itself with `--version` or similar — a lookup-only check must never
+ * actually execute the tool being probed. `bin` is expected to be a fixed,
+ * code-controlled binary name (`firecracker`, `skill-scanner`), never
+ * user-supplied input threaded into this shell string.
+ */
+export declare function binaryOnPath(bin: string): Promise<boolean>;
+//# sourceMappingURL=binaryOnPath.d.ts.map

package/dist/lib/binaryOnPath.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binaryOnPath.d.ts","sourceRoot":"","sources":["../../src/lib/binaryOnPath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAM1D"}

package/dist/lib/binaryOnPath.js

@@ -0,0 +1,31 @@
+/**
+ * Cross-platform "is this binary on PATH" check, without invoking the binary
+ * itself.
+ *
+ * Hoisted out of `sandbox/firecracker.ts` — originally a private helper
+ * there, checking for the `firecracker` binary — once a second external-tool
+ * integration (`ciscoScanner.ts`, the opt-in Cisco `skill-scanner`
+ * integration, Phase S3) needed the identical check. A shared, single
+ * implementation here, rather than a second copy that could quietly drift
+ * from the first (different shell quoting, different exit-code handling).
+ *
+ * @module
+ */
+import { spawn } from 'node:child_process';
+/**
+ * Resolves `true` iff `bin` is found on PATH.
+ *
+ * Uses `command -v`, a POSIX shell builtin, via `sh -c` rather than spawning
+ * `bin` itself with `--version` or similar — a lookup-only check must never
+ * actually execute the tool being probed. `bin` is expected to be a fixed,
+ * code-controlled binary name (`firecracker`, `skill-scanner`), never
+ * user-supplied input threaded into this shell string.
+ */
+export function binaryOnPath(bin) {
+    return new Promise((resolve) => {
+        const child = spawn('sh', ['-c', `command -v ${bin}`], { stdio: 'ignore' });
+        child.on('error', () => resolve(false));
+        child.on('exit', (code) => resolve(code === 0));
+    });
+}
+//# sourceMappingURL=binaryOnPath.js.map

package/dist/lib/binaryOnPath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binaryOnPath.js","sourceRoot":"","sources":["../../src/lib/binaryOnPath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,cAAc,GAAG,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC3E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;QACvC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/lib/caTrust.d.ts

@@ -0,0 +1,69 @@
+/**
+ * OS trust-store injection for the Intutic proxy CA certificate.
+ *
+ * Two trust scopes:
+ * - `'user'` — per-user, non-elevated. Already shipping today via
+ *   `commands/connect.ts` (macOS login keychain, Windows `certutil`), run
+ *   silently on every `intutic connect`.
+ * - `'system'` — machine-wide, requires root/admin. New here — this is the
+ *   half `enterprise install` (`commands/enterprise.ts`) needs and the
+ *   deleted `enterprise-install.ts` (commit `8481b5d9`) used to provide.
+ *
+ * `caTrustCommandFor` is exported specifically so `doctor.ts`'s remediation
+ * strings can be generated from the same source as what actually runs here,
+ * rather than hand-duplicated — which is exactly how they already drifted
+ * once (the check there looks in three Linux cert-anchor directories; the
+ * remediation only ever names one).
+ *
+ * @module
+ */
+export type TrustScope = 'user' | 'system';
+export interface CaTrustCommand {
+    /** A short label for what this step does, used in logs. */
+    step: string;
+    cmd: string;
+    args: string[];
+}
+export interface CaTrustResult {
+    installed: boolean;
+    scope: TrustScope;
+    /** e.g. 'security', 'update-ca-certificates', 'update-ca-trust', 'certutil'. */
+    mechanism: string;
+    detail: string;
+}
+/**
+ * The command(s) that trust `caCertPath` at the given scope, for the given
+ * platform. Pure — no I/O — so it doubles as the source of truth for
+ * `doctor.ts`'s remediation text.
+ *
+ * Linux `'user'` scope returns `null`: there is no single per-user NSS/OS
+ * trust-store equivalent worth building (each browser/runtime keeps its
+ * own), unlike macOS (login keychain) and Windows (`certutil`, which is
+ * elevation-agnostic — the same command works either way).
+ *
+ * Linux returns TWO commands (copy, then update) rather than one, since
+ * `execFile` can't run a shell pipeline — callers must run both in order.
+ */
+export declare function caTrustCommandFor(platform: NodeJS.Platform, scope: TrustScope, caCertPath: string): CaTrustCommand[] | null;
+/**
+ * Installs `caCertPath` into the OS trust store at `scope`.
+ *
+ * Uses `execFile` with array arguments throughout — never `execSync` with
+ * string interpolation, which `connect.ts`'s existing per-user calls use and
+ * which is unsafe if a path ever contained a shell metacharacter. Does not
+ * throw on a failed underlying command; surfaces it as `installed: false`
+ * with the OS error text in `detail`, so a caller (e.g. `enterprise install`)
+ * can report it and continue rather than crashing the whole run over one
+ * platform-specific step.
+ */
+export declare function installCaTrust(caCertPath: string, scope: TrustScope): Promise<CaTrustResult>;
+/**
+ * Best-effort check for whether `caCertPath` is already trusted — read-only,
+ * never installs anything. Used to skip a redundant (and log-noisy)
+ * re-install. Only implemented where a cheap, real check exists (macOS
+ * `security verify-cert`); returns `false` elsewhere rather than guessing,
+ * so a caller falls through to attempting installation, which is itself
+ * idempotent.
+ */
+export declare function verifyCaTrust(caCertPath: string): Promise<boolean>;
+//# sourceMappingURL=caTrust.d.ts.map

package/dist/lib/caTrust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caTrust.d.ts","sourceRoot":"","sources":["../../src/lib/caTrust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAA;AAE1C,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,UAAU,CAAA;IACjB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf;AAKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,MAAM,GACjB,cAAc,EAAE,GAAG,IAAI,CA8BzB;AAkCD;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CA8BlG;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBxE"}