@kodycodes/cli 1.13.3 → 1.14.0

package/dist/credential-client-runtime-source.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Sandbox source for credential()/credentials() on the local kody:runtime host.
+ * Kept in sync with kentcdodds/kody `createCredentialClientRuntimeSource`
+ * (packages/worker/src/mcp/execute-modules/credential-client-source.ts).
+ * Client fetches carry only `x-kody-credential-client`; origin's fetch gateway
+ * places the credential. Secret values never enter local workerd.
+ */
+export declare const credentialClientRuntimeSource = "function __kodyCreateCredentialRuntime(__kodyCredentialCall) {\n  const handleHeader = \"x-kody-credential-client\";\n  const codePattern = /^\\[([a-z_]+)\\] /;\n  const redirectStatuses = new Set([301, 302, 303, 307, 308]);\n  const maxRedirects = 20;\n  const toError = (body) => {\n    const error = new Error(String(body?.message ?? 'The credential could not be used.'));\n    error.name = 'CredentialError';\n    error.code = typeof body?.code === 'string' ? body.code : 'credential_error';\n    error.retryWith = Array.isArray(body?.retryWith) ? body.retryWith : [];\n    if (Array.isArray(body?.options)) error.options = body.options;\n    if (Array.isArray(body?.possibleMatches)) error.possibleMatches = body.possibleMatches;\n    return error;\n  };\n  const fromThrown = (error) => {\n    const message = String(error?.message ?? error ?? '');\n    const match = codePattern.exec(message);\n    if (!match) return error;\n    return toError({ code: match[1], message: message.slice(match[0].length) });\n  };\n  const invoke = async (name, args) => {\n    let result;\n    try {\n      result = await __kodyCredentialCall(name, args);\n    } catch (error) {\n      throw fromThrown(error);\n    }\n    if (result && result.ok === false) throw toError(result.error);\n    return result?.value;\n  };\n  const hostAllowed = (hosts, host) => {\n    const target = String(host ?? '').toLowerCase();\n    return hosts.some((entry) => {\n      const normalized = String(entry).trim().toLowerCase();\n      if (!normalized.startsWith('*.')) return normalized === target;\n      const suffix = normalized.slice(1);\n      if (!target.endsWith(suffix)) return false;\n      const label = target.slice(0, -suffix.length);\n      return label.length > 0 && !label.includes('.');\n    });\n  };\n  const firstExactHost = (hosts) =>\n    hosts.find((host) => !String(host).startsWith('*.')) ?? null;\n  const resolveUrl = (input, hosts) => {\n    const raw = input instanceof Request ? input.url : String(input);\n    if (/^[a-z][a-z0-9+.-]*:/i.test(raw)) return raw;\n    const host = firstExactHost(hosts);\n    if (!host) {\n      throw toError({\n        code: 'invalid_request',\n        message: 'This credential has no exact host to resolve a relative URL against; pass an absolute https:// URL on one of its hosts.',\n      });\n    }\n    return new URL(raw, 'https://' + host).toString();\n  };\n  const send = async (request, handle) => {\n    const headers = new Headers(request.headers);\n    if (handle) headers.set(handleHeader, handle);\n    else headers.delete(handleHeader);\n    try {\n      return await globalThis.fetch(new Request(request, { headers, redirect: 'manual' }));\n    } catch (error) {\n      throw fromThrown(error);\n    }\n  };\n  const createFetch = (opened) => async (input, init) => {\n    const redirectMode =\n      init?.redirect ?? (input instanceof Request ? input.redirect : 'follow');\n    const url = resolveUrl(input, opened.hosts);\n    let request =\n      input instanceof Request\n        ? new Request(url, new Request(input, init))\n        : new Request(url, init);\n    let carriesCredential = true;\n    for (let hop = 0; ; hop += 1) {\n      const replay = request.body ? request.clone() : request;\n      let response = await send(request, carriesCredential ? opened.handle : null);\n      if (opened.kind === 'oauth' && carriesCredential && response.status === 401) {\n        const refreshed = await invoke(\"credentialClientRefresh\", { handle: opened.handle });\n        if (refreshed?.refreshed) {\n          await response.body?.cancel();\n          const retry = replay.body ? replay.clone() : replay;\n          response = await send(retry, opened.handle);\n        }\n      }\n      if (!redirectStatuses.has(response.status) || redirectMode === 'manual') {\n        return response;\n      }\n      if (redirectMode === 'error') {\n        await response.body?.cancel();\n        throw new TypeError('The response redirected and redirect is \"error\".');\n      }\n      // A url credential owns its whole URL, so its redirects come back as\n      // they are: following one would need the secret URL as the base.\n      if (opened.kind === 'url') return response;\n      const location = response.headers.get('location');\n      if (!location) return response;\n      if (hop >= maxRedirects) {\n        await response.body?.cancel();\n        throw new TypeError('Too many redirects.');\n      }\n      await response.body?.cancel();\n      const next = new URL(location, response.url || request.url);\n      const rewritesToGet =\n        response.status === 303 ||\n        ((response.status === 301 || response.status === 302) && request.method === 'POST');\n      // The credential follows only to its own hosts over https.\n      carriesCredential =\n        next.protocol === 'https:' &&\n        hostAllowed(opened.hosts, next.hostname);\n      const headers = new Headers(replay.headers);\n      if (!carriesCredential) headers.delete('authorization');\n      if (rewritesToGet) {\n        headers.delete('content-type');\n        headers.delete('content-length');\n      }\n      request = new Request(next, {\n        method: rewritesToGet ? 'GET' : replay.method,\n        headers,\n        body: rewritesToGet ? null : replay.body,\n        ...(rewritesToGet || !replay.body ? {} : { duplex: 'half' }),\n      });\n    }\n  };\n  const toClient = (opened) => {\n    const client = { name: opened.name, scope: opened.scope, kind: opened.kind, hosts: [...opened.hosts] };\n    if (opened.kind === 'mcp') {\n      client.callTool = async (tool, args) =>\n        await invoke(\"credentialClientCallTool\", { handle: opened.handle, tool, args: args ?? {} });\n    } else if (opened.kind === 'signing') {\n      client.sign = async (operation) => {\n        const { host, ...rest } = operation ?? {};\n        const result = await invoke(\"credentialClientSign\", {\n          handle: opened.handle,\n          host: host ?? firstExactHost(opened.hosts),\n          operation: rest,\n        });\n        return result?.signature;\n      };\n    } else {\n      client.fetch = createFetch(opened);\n    }\n    return Object.freeze(client);\n  };\n  const open = async (args) => toClient(await invoke(\"credentialClientOpen\", args));\n  const credential = async (key) => await open({ key });\n  credential.named = async (name, options) =>\n    await open({ name, scope: options?.scope ?? null });\n  const credentials = async (key) => [await credential(key)];\n  return { credential: Object.freeze(credential), credentials };\n}";

package/dist/credential-client-runtime-source.js

@@ -0,0 +1,9 @@
+/**
+ * Sandbox source for credential()/credentials() on the local kody:runtime host.
+ * Kept in sync with kentcdodds/kody `createCredentialClientRuntimeSource`
+ * (packages/worker/src/mcp/execute-modules/credential-client-source.ts).
+ * Client fetches carry only `x-kody-credential-client`; origin's fetch gateway
+ * places the credential. Secret values never enter local workerd.
+ */
+export const credentialClientRuntimeSource = "function __kodyCreateCredentialRuntime(__kodyCredentialCall) {\n  const handleHeader = \"x-kody-credential-client\";\n  const codePattern = /^\\[([a-z_]+)\\] /;\n  const redirectStatuses = new Set([301, 302, 303, 307, 308]);\n  const maxRedirects = 20;\n  const toError = (body) => {\n    const error = new Error(String(body?.message ?? 'The credential could not be used.'));\n    error.name = 'CredentialError';\n    error.code = typeof body?.code === 'string' ? body.code : 'credential_error';\n    error.retryWith = Array.isArray(body?.retryWith) ? body.retryWith : [];\n    if (Array.isArray(body?.options)) error.options = body.options;\n    if (Array.isArray(body?.possibleMatches)) error.possibleMatches = body.possibleMatches;\n    return error;\n  };\n  const fromThrown = (error) => {\n    const message = String(error?.message ?? error ?? '');\n    const match = codePattern.exec(message);\n    if (!match) return error;\n    return toError({ code: match[1], message: message.slice(match[0].length) });\n  };\n  const invoke = async (name, args) => {\n    let result;\n    try {\n      result = await __kodyCredentialCall(name, args);\n    } catch (error) {\n      throw fromThrown(error);\n    }\n    if (result && result.ok === false) throw toError(result.error);\n    return result?.value;\n  };\n  const hostAllowed = (hosts, host) => {\n    const target = String(host ?? '').toLowerCase();\n    return hosts.some((entry) => {\n      const normalized = String(entry).trim().toLowerCase();\n      if (!normalized.startsWith('*.')) return normalized === target;\n      const suffix = normalized.slice(1);\n      if (!target.endsWith(suffix)) return false;\n      const label = target.slice(0, -suffix.length);\n      return label.length > 0 && !label.includes('.');\n    });\n  };\n  const firstExactHost = (hosts) =>\n    hosts.find((host) => !String(host).startsWith('*.')) ?? null;\n  const resolveUrl = (input, hosts) => {\n    const raw = input instanceof Request ? input.url : String(input);\n    if (/^[a-z][a-z0-9+.-]*:/i.test(raw)) return raw;\n    const host = firstExactHost(hosts);\n    if (!host) {\n      throw toError({\n        code: 'invalid_request',\n        message: 'This credential has no exact host to resolve a relative URL against; pass an absolute https:// URL on one of its hosts.',\n      });\n    }\n    return new URL(raw, 'https://' + host).toString();\n  };\n  const send = async (request, handle) => {\n    const headers = new Headers(request.headers);\n    if (handle) headers.set(handleHeader, handle);\n    else headers.delete(handleHeader);\n    try {\n      return await globalThis.fetch(new Request(request, { headers, redirect: 'manual' }));\n    } catch (error) {\n      throw fromThrown(error);\n    }\n  };\n  const createFetch = (opened) => async (input, init) => {\n    const redirectMode =\n      init?.redirect ?? (input instanceof Request ? input.redirect : 'follow');\n    const url = resolveUrl(input, opened.hosts);\n    let request =\n      input instanceof Request\n        ? new Request(url, new Request(input, init))\n        : new Request(url, init);\n    let carriesCredential = true;\n    for (let hop = 0; ; hop += 1) {\n      const replay = request.body ? request.clone() : request;\n      let response = await send(request, carriesCredential ? opened.handle : null);\n      if (opened.kind === 'oauth' && carriesCredential && response.status === 401) {\n        const refreshed = await invoke(\"credentialClientRefresh\", { handle: opened.handle });\n        if (refreshed?.refreshed) {\n          await response.body?.cancel();\n          const retry = replay.body ? replay.clone() : replay;\n          response = await send(retry, opened.handle);\n        }\n      }\n      if (!redirectStatuses.has(response.status) || redirectMode === 'manual') {\n        return response;\n      }\n      if (redirectMode === 'error') {\n        await response.body?.cancel();\n        throw new TypeError('The response redirected and redirect is \"error\".');\n      }\n      // A url credential owns its whole URL, so its redirects come back as\n      // they are: following one would need the secret URL as the base.\n      if (opened.kind === 'url') return response;\n      const location = response.headers.get('location');\n      if (!location) return response;\n      if (hop >= maxRedirects) {\n        await response.body?.cancel();\n        throw new TypeError('Too many redirects.');\n      }\n      await response.body?.cancel();\n      const next = new URL(location, response.url || request.url);\n      const rewritesToGet =\n        response.status === 303 ||\n        ((response.status === 301 || response.status === 302) && request.method === 'POST');\n      // The credential follows only to its own hosts over https.\n      carriesCredential =\n        next.protocol === 'https:' &&\n        hostAllowed(opened.hosts, next.hostname);\n      const headers = new Headers(replay.headers);\n      if (!carriesCredential) headers.delete('authorization');\n      if (rewritesToGet) {\n        headers.delete('content-type');\n        headers.delete('content-length');\n      }\n      request = new Request(next, {\n        method: rewritesToGet ? 'GET' : replay.method,\n        headers,\n        body: rewritesToGet ? null : replay.body,\n        ...(rewritesToGet || !replay.body ? {} : { duplex: 'half' }),\n      });\n    }\n  };\n  const toClient = (opened) => {\n    const client = { name: opened.name, scope: opened.scope, kind: opened.kind, hosts: [...opened.hosts] };\n    if (opened.kind === 'mcp') {\n      client.callTool = async (tool, args) =>\n        await invoke(\"credentialClientCallTool\", { handle: opened.handle, tool, args: args ?? {} });\n    } else if (opened.kind === 'signing') {\n      client.sign = async (operation) => {\n        const { host, ...rest } = operation ?? {};\n        const result = await invoke(\"credentialClientSign\", {\n          handle: opened.handle,\n          host: host ?? firstExactHost(opened.hosts),\n          operation: rest,\n        });\n        return result?.signature;\n      };\n    } else {\n      client.fetch = createFetch(opened);\n    }\n    return Object.freeze(client);\n  };\n  const open = async (args) => toClient(await invoke(\"credentialClientOpen\", args));\n  const credential = async (key) => await open({ key });\n  credential.named = async (name, options) =>\n    await open({ name, scope: options?.scope ?? null });\n  const credentials = async (key) => [await credential(key)];\n  return { credential: Object.freeze(credential), credentials };\n}";
+//# sourceMappingURL=credential-client-runtime-source.js.map

package/dist/credential-client-runtime-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-client-runtime-source.js","sourceRoot":"","sources":["../src/credential-client-runtime-source.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,+8MAA+8M,CAAA"}

package/dist/local-runtime-source.d.ts

@@ -6,10 +6,11 @@
  *
  * Stamped `kody:@…` packages also receive a package-graph CapabilityProxy shim
  * from origin. This host module still binds createAuthenticatedFetch /
- * secretHeaders / oauthClientCredentials for ad hoc imports, and the entry
- * installs the shared runtime ALS before evaluating user code so published
- * bundles that inline optional runtime exports (Dropbox-style) see a populated
- * store at module evaluation — matching cloud `__kodyRunInRuntime`.
+ * secretHeaders / oauthClientCredentials / credential / credentials for ad hoc
+ * imports, and the entry installs the shared runtime ALS before evaluating user
+ * code so published bundles that inline optional runtime exports
+ * (Dropbox-style) see a populated store at module evaluation — matching cloud
+ * `__kodyRunInRuntime`.
  */
 export declare const localExecuteCompatibilityDate = "2026-04-16";
 export declare const localExecuteCompatibilityFlags: readonly ["nodejs_compat"];

package/dist/local-runtime-source.js

@@ -6,11 +6,13 @@
  *
  * Stamped `kody:@…` packages also receive a package-graph CapabilityProxy shim
  * from origin. This host module still binds createAuthenticatedFetch /
- * secretHeaders / oauthClientCredentials for ad hoc imports, and the entry
- * installs the shared runtime ALS before evaluating user code so published
- * bundles that inline optional runtime exports (Dropbox-style) see a populated
- * store at module evaluation — matching cloud `__kodyRunInRuntime`.
+ * secretHeaders / oauthClientCredentials / credential / credentials for ad hoc
+ * imports, and the entry installs the shared runtime ALS before evaluating user
+ * code so published bundles that inline optional runtime exports
+ * (Dropbox-style) see a populated store at module evaluation — matching cloud
+ * `__kodyRunInRuntime`.
  */
+import { credentialClientRuntimeSource } from './credential-client-runtime-source.js';
 export const localExecuteCompatibilityDate = '2026-04-16';
 export const localExecuteCompatibilityFlags = ['nodejs_compat'];
 export const localWorkerModuleNames = {
@@ -210,6 +212,17 @@ export async function oauthClientCredentials(input) {
 	return await __kodyCall(['kody', 'oauthClientCredentials'], [input ?? {}]);
 }
 
+// Scoped credential clients (ADR 0068): open/sign/callTool/refresh through
+// CapabilityProxy \`kody.credentialClient*\`. Fetches carry only an opaque
+// handle; origin's gateway places the credential. Secret values never enter
+// local workerd — same security as hosted and the package-graph shim.
+${credentialClientRuntimeSource}
+const __kodyCredentialRuntime = __kodyCreateCredentialRuntime((name, args) =>
+	__kodyCall(['kody', name], [args ?? {}]),
+);
+export const credential = __kodyCredentialRuntime.credential;
+export const credentials = __kodyCredentialRuntime.credentials;
+
 const __kodyRuntimeStorageSymbol = Symbol.for(${JSON.stringify(kodyRuntimeStorageSymbolDescription)});
 const __globalAny = globalThis;
 const __kodyRuntimeStorage =
@@ -222,6 +235,8 @@ const __kodyRuntimeDefault = Object.freeze({
 	createAuthenticatedFetch,
 	secretHeaders,
 	oauthClientCredentials,
+	credential,
+	credentials,
 	packageContext,
 	packageSecrets,
 	email,

package/dist/local-runtime-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-runtime-source.js","sourceRoot":"","sources":["../src/local-runtime-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,YAAY,CAAA;AACzD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,eAAe,CAAU,CAAA;AAExE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACrC,KAAK,EAAE,uBAAuB;IAC9B,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,cAAc;CACd,CAAA;AAEV,qFAAqF;AACrF,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAA;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEhD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mCAAmC,GAAG,qBAAqB,CAAA;AAExE,MAAM,UAAU,8BAA8B;IAC7C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gDA0LwC,IAAI,CAAC,SAAS,CAAC,mCAAmC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BlG,CAAC,SAAS,EAAE,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAEnC,EAAE;IACL,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;SACnE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SACpE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;SAChD,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,MAAM,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,iBAAiB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,OAAO;EACN,eAAe;;;SAGR,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC;;gCAEvB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;;;;;;;uBASxC,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCA8BJ,IAAI,CAAC,SAAS,CAAC,KAAK,sBAAsB,CAAC,IAAI,EAAE,CAAC;;;;;;;;;;;;;;;;;CAiBnF,CAAC,SAAS,EAAE,CAAA;AACb,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAKnC;IACA,MAAM,KAAK,GAAG,8BAA8B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3F,MAAM,YAAY,GAAG,KAAK,CAAC,mBAAmB;QAC7C,CAAC,CAAC,gCAAgC;QAClC,CAAC,CAAC,YAAY,CAAA;IACf,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;SACjD,GAAG,CACH,CAAC,MAAM,EAAE,EAAE,CACV,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAChG;SACA,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChE,OAAO;;;;;8DAKsD,KAAK,CAAC,UAAU;6CACjC,YAAY;;;;;;;cAO3C,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;cACnG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;cACjG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,YAAY;;wBAE9G,IAAI,CAAC,SAAS,CAAC,6BAA6B,CAAC;0BAC3C,KAAK;;;;cAIjB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;CAGlG,CAAA;AACD,CAAC"}
+{"version":3,"file":"local-runtime-source.js","sourceRoot":"","sources":["../src/local-runtime-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAA;AAErF,MAAM,CAAC,MAAM,6BAA6B,GAAG,YAAY,CAAA;AACzD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,eAAe,CAAU,CAAA;AAExE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACrC,KAAK,EAAE,uBAAuB;IAC9B,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,cAAc;CACd,CAAA;AAEV,qFAAqF;AACrF,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAA;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEhD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mCAAmC,GAAG,qBAAqB,CAAA;AAExE,MAAM,UAAU,8BAA8B;IAC7C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8LN,6BAA6B;;;;;;;gDAOiB,IAAI,CAAC,SAAS,CAAC,mCAAmC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BlG,CAAC,SAAS,EAAE,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAEnC,EAAE;IACL,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;SACnE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SACpE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;SAChD,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,MAAM,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,iBAAiB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,OAAO;EACN,eAAe;;;SAGR,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC;;gCAEvB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;;;;;;;uBASxC,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCA8BJ,IAAI,CAAC,SAAS,CAAC,KAAK,sBAAsB,CAAC,IAAI,EAAE,CAAC;;;;;;;;;;;;;;;;;CAiBnF,CAAC,SAAS,EAAE,CAAA;AACb,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAKnC;IACA,MAAM,KAAK,GAAG,8BAA8B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3F,MAAM,YAAY,GAAG,KAAK,CAAC,mBAAmB;QAC7C,CAAC,CAAC,gCAAgC;QAClC,CAAC,CAAC,YAAY,CAAA;IACf,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;SACjD,GAAG,CACH,CAAC,MAAM,EAAE,EAAE,CACV,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAChG;SACA,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChE,OAAO;;;;;8DAKsD,KAAK,CAAC,UAAU;6CACjC,YAAY;;;;;;;cAO3C,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;cACnG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;cACjG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,YAAY;;wBAE9G,IAAI,CAAC,SAAS,CAAC,6BAA6B,CAAC;0BAC3C,KAAK;;;;cAIjB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;CAGlG,CAAA;AACD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@kodycodes/cli",
-	"version": "1.13.3",
+	"version": "1.14.0",
 	"description": "Official Kody MCP client CLI: login, secure token storage, search, and execute.",
 	"type": "module",
 	"bin": {