@kodycodes/cli 1.26.2 → 1.27.0

package/dist/chunk-OZDWOZLV.js

@@ -0,0 +1,964 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  which
+} from "./chunk-6ZYUGXVW.js";
+import {
+  OpenApiError,
+  openApiGet,
+  openApiRequest
+} from "./chunk-W2SAFAT4.js";
+import {
+  assertTokenSafeApiUrl,
+  capabilityProxyUrl,
+  deleteStoredApiToken,
+  loadStoredApiToken,
+  readPackageVersion,
+  saveStoredApiToken
+} from "./chunk-5JIRHJQP.js";
+import {
+  describeNetworkError
+} from "./chunk-4GIFJVGT.js";
+import {
+  apiTokenEnvVar,
+  cliName,
+  defaultApiUrl,
+  defaultMcpUrl
+} from "./chunk-BTL3PJ2H.js";
+
+// src/setup-git.ts
+import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+
+// src/http-error-body.ts
+var nonJsonErrorBodyMaxChars = 200;
+function summarizeNonJsonErrorBody(text) {
+  const trimmed = text.trim();
+  const looksLikeHtml = /^<(?:!doctype|html|head|body)\b/i.test(trimmed);
+  const title = looksLikeHtml ? trimmed.match(/<title[^>]*>([\s\S]*?)<\/title>/i)?.[1] : void 0;
+  const excerpt = collapseWhitespace(
+    looksLikeHtml ? stripHtml(title?.trim() ? title : trimmed) : trimmed
+  );
+  const kind = looksLikeHtml ? "HTML" : "non-JSON";
+  const bytes = Buffer.byteLength(text);
+  if (excerpt.length <= nonJsonErrorBodyMaxChars && !looksLikeHtml)
+    return excerpt;
+  const shortened = excerpt.length > nonJsonErrorBodyMaxChars ? `${excerpt.slice(0, nonJsonErrorBodyMaxChars).trimEnd()}\u2026` : excerpt;
+  return `${shortened ? `${shortened} ` : ""}(${kind} response, ${bytes} bytes; check --api-url / KODY_API_URL points at the Kody API host)`;
+}
+function stripHtml(html) {
+  return html.replace(/<(script|style)\b[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&amp;/g, "&");
+}
+function collapseWhitespace(text) {
+  return text.replace(/\s+/g, " ").trim();
+}
+
+// src/auth-bootstrap.ts
+var cliBootstrapCodePrefix = "kody_bc_";
+var bootstrapCodePattern = /^kody_bc_([a-z0-9]{16})_([A-Za-z0-9_-]{32})$/;
+var bootstrapRedeemPath = "v1/tokens/bootstrap/redeem";
+var cliTokenLifetimePolicy = {
+  minIdleTtlSeconds: 60,
+  /** Idle timeout at most 14 days. */
+  maxIdleTtlSeconds: 14 * 24 * 60 * 60,
+  /** Absolute lifetime at most 3 months. */
+  maxMaxLifetimeSeconds: 90 * 24 * 60 * 60
+};
+var cliTokenLifetimeAliases = {
+  short: {
+    idleTtlSeconds: 60 * 60,
+    maxLifetimeSeconds: 24 * 60 * 60
+  },
+  long: {
+    idleTtlSeconds: cliTokenLifetimePolicy.maxIdleTtlSeconds,
+    maxLifetimeSeconds: cliTokenLifetimePolicy.maxMaxLifetimeSeconds
+  }
+};
+function parseCliBootstrapCode(value) {
+  const match = bootstrapCodePattern.exec(value.trim());
+  if (!match) return null;
+  const [, codeId, secret] = match;
+  if (!codeId || !secret) return null;
+  return { codeId, secret };
+}
+function assertCliBootstrapCode(code) {
+  const trimmed = code.trim();
+  if (!parseCliBootstrapCode(trimmed)) {
+    throw new Error(
+      `Invalid bootstrap code. Expected a one-shot ${cliBootstrapCodePrefix}\u2026 from cliCredentialBootstrap (MCP api / kody.cliCredentialBootstrap).`
+    );
+  }
+  return trimmed;
+}
+function cliTokenLifetimeMissingError() {
+  return `Token lifetime is required. Pass --lifetime short|long, or both --idle-ttl-seconds <n> and --max-lifetime-seconds <n> (idle ${cliTokenLifetimePolicy.minIdleTtlSeconds}-${cliTokenLifetimePolicy.maxIdleTtlSeconds}s, max age up to ${cliTokenLifetimePolicy.maxMaxLifetimeSeconds}s). Single-task agents should use --lifetime short.`;
+}
+function resolveCliTokenLifetime(input) {
+  const aliasRaw = typeof input.lifetime === "string" ? input.lifetime.trim() : "";
+  const hasAlias = aliasRaw.length > 0;
+  const hasIdle = input.idleTtlSeconds !== void 0;
+  const hasMax = input.maxLifetimeSeconds !== void 0;
+  if (!hasAlias && !hasIdle && !hasMax) {
+    throw new Error(cliTokenLifetimeMissingError());
+  }
+  if (hasAlias && (hasIdle || hasMax)) {
+    throw new Error(
+      "Pass --lifetime short|long, or both --idle-ttl-seconds and --max-lifetime-seconds, not both forms."
+    );
+  }
+  if (hasAlias) {
+    if (!(aliasRaw in cliTokenLifetimeAliases)) {
+      throw new Error(
+        `--lifetime must be short or long (got ${JSON.stringify(aliasRaw)}).`
+      );
+    }
+    const lifetime = aliasRaw;
+    const resolved = cliTokenLifetimeAliases[lifetime];
+    return {
+      kind: "alias",
+      lifetime,
+      idleTtlSeconds: resolved.idleTtlSeconds,
+      maxLifetimeSeconds: resolved.maxLifetimeSeconds
+    };
+  }
+  if (!hasIdle || !hasMax) {
+    throw new Error(
+      "When not using --lifetime short|long, both --idle-ttl-seconds and --max-lifetime-seconds are required."
+    );
+  }
+  const idleTtlSeconds = readRequiredInteger({
+    value: input.idleTtlSeconds,
+    min: cliTokenLifetimePolicy.minIdleTtlSeconds,
+    max: cliTokenLifetimePolicy.maxIdleTtlSeconds,
+    field: "--idle-ttl-seconds"
+  });
+  const maxLifetimeSeconds = readRequiredInteger({
+    value: input.maxLifetimeSeconds,
+    min: idleTtlSeconds,
+    max: cliTokenLifetimePolicy.maxMaxLifetimeSeconds,
+    field: "--max-lifetime-seconds"
+  });
+  return {
+    kind: "explicit",
+    idleTtlSeconds,
+    maxLifetimeSeconds
+  };
+}
+function bootstrapRedeemRequestBody(code, lifetime) {
+  if (lifetime.kind === "alias") {
+    return { code, lifetime: lifetime.lifetime };
+  }
+  return {
+    code,
+    idle_ttl_seconds: lifetime.idleTtlSeconds,
+    max_lifetime_seconds: lifetime.maxLifetimeSeconds
+  };
+}
+function parseCliLifetimeSecondsFlag(raw, flag) {
+  if (raw === void 0) return void 0;
+  const trimmed = raw.trim();
+  if (!/^-?\d+$/.test(trimmed)) {
+    throw new Error(`${flag} must be an integer.`);
+  }
+  return Number(trimmed);
+}
+function resolveMintedRedeemLifetime(minted) {
+  const maxLifetimeSeconds = minted.max_lifetime_seconds;
+  const idleTtlSeconds = Math.min(minted.idle_ttl_seconds, maxLifetimeSeconds);
+  return {
+    kind: "explicit",
+    idleTtlSeconds,
+    maxLifetimeSeconds
+  };
+}
+async function redeemBootstrapCode(input) {
+  const code = assertCliBootstrapCode(input.code);
+  const lifetime = input.trustedMintLifetime ? resolveMintedRedeemLifetime(input.trustedMintLifetime) : resolveCliTokenLifetime({
+    lifetime: input.lifetime,
+    idleTtlSeconds: input.idleTtlSeconds,
+    maxLifetimeSeconds: input.maxLifetimeSeconds
+  });
+  const apiUrl = input.apiUrl || defaultApiUrl;
+  assertTokenSafeApiUrl(apiUrl);
+  const url = capabilityProxyUrl(apiUrl, bootstrapRedeemPath);
+  const fetchFn = input.fetchFn ?? fetch;
+  let response;
+  try {
+    response = await fetchFn(url, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json",
+        "user-agent": `${cliName}/${readPackageVersion()}`
+      },
+      body: JSON.stringify(bootstrapRedeemRequestBody(code, lifetime))
+    });
+  } catch (error) {
+    const reason = describeNetworkError(error);
+    throw new Error(
+      `Could not reach the Kody API at ${url.origin} (${reason}). Check --api-url / KODY_API_URL and your network.`
+    );
+  }
+  const body = await readJson(response);
+  if (!response.ok) {
+    throw describeRedeemFailure(response.status, body, url);
+  }
+  return parseRedeemResponse(body);
+}
+function storedApiTokenFromRedeem(input) {
+  const token = input.redeemed.token.trim();
+  if (!token.startsWith("kody_at_")) {
+    throw new Error(
+      "Bootstrap redeem did not return a scoped kody_at_\u2026 API token."
+    );
+  }
+  return {
+    version: 1,
+    apiUrl: input.apiUrl,
+    token,
+    tokenId: input.redeemed.id,
+    ...input.redeemed.name ? { name: input.redeemed.name } : {},
+    ...Array.isArray(input.redeemed.scopes) ? { scopes: input.redeemed.scopes } : {},
+    expiresAt: input.redeemed.expires_at ?? null,
+    maxExpiresAt: input.redeemed.max_expires_at ?? null,
+    createdVia: input.redeemed.created_via ?? "cli-bootstrap"
+  };
+}
+async function authBootstrap(input) {
+  const apiUrl = input.apiUrl || defaultApiUrl;
+  const redeemed = await redeemBootstrapCode({
+    code: input.code,
+    lifetime: input.lifetime,
+    idleTtlSeconds: input.idleTtlSeconds,
+    maxLifetimeSeconds: input.maxLifetimeSeconds,
+    apiUrl,
+    fetchFn: input.fetchFn
+  });
+  const stored = storedApiTokenFromRedeem({ apiUrl, redeemed });
+  const saved = saveStoredApiToken(stored, input.backend, input.resolution);
+  return {
+    stored,
+    backendKind: saved.backend.kind,
+    ...saved.backend.path ? { backendPath: saved.backend.path } : {}
+  };
+}
+var cliCredentialBootstrapOperationId = "cliCredentialBootstrap";
+function parseCliScopesFlag(raw) {
+  if (raw === void 0) return void 0;
+  const scopes = [
+    ...new Set(
+      raw.split(/[\s,]+/).map((scope) => scope.trim()).filter(Boolean)
+    )
+  ];
+  if (scopes.length === 0) {
+    throw new Error(
+      "--scopes needs at least one scope (e.g. --scopes org:execute,package:write)."
+    );
+  }
+  return scopes;
+}
+function bootstrapMintParams(scopes, lifetime) {
+  return {
+    scopes: [...scopes],
+    ...bootstrapMintLifetimeFields(lifetime)
+  };
+}
+function bootstrapMintLifetimeFields(lifetime) {
+  return lifetime.kind === "alias" ? { lifetime: lifetime.lifetime } : {
+    idle_ttl_seconds: lifetime.idleTtlSeconds,
+    max_lifetime_seconds: lifetime.maxLifetimeSeconds
+  };
+}
+function parseBootstrapMintResponse(body) {
+  if (!isRecord(body) || typeof body.bootstrap_code !== "string" || typeof body.idle_ttl_seconds !== "number" || typeof body.max_lifetime_seconds !== "number") {
+    throw new Error("cliCredentialBootstrap returned an unexpected response.");
+  }
+  return {
+    bootstrap_code: body.bootstrap_code,
+    scopes: Array.isArray(body.scopes) ? body.scopes.filter(
+      (scope) => typeof scope === "string"
+    ) : [],
+    idle_ttl_seconds: body.idle_ttl_seconds,
+    max_lifetime_seconds: body.max_lifetime_seconds
+  };
+}
+async function authBootstrapWithScopes(input) {
+  const minted = parseBootstrapMintResponse(
+    await input.mint(bootstrapMintParams(input.scopes, input.lifetime))
+  );
+  const apiUrl = input.apiUrl || defaultApiUrl;
+  const redeemed = await redeemBootstrapCode({
+    code: minted.bootstrap_code,
+    trustedMintLifetime: {
+      idle_ttl_seconds: minted.idle_ttl_seconds,
+      max_lifetime_seconds: minted.max_lifetime_seconds
+    },
+    apiUrl,
+    fetchFn: input.fetchFn
+  });
+  const stored = storedApiTokenFromRedeem({ apiUrl, redeemed });
+  const saved = saveStoredApiToken(stored, input.backend, input.resolution);
+  return {
+    stored,
+    backendKind: saved.backend.kind,
+    ...saved.backend.path ? { backendPath: saved.backend.path } : {}
+  };
+}
+function readRequiredInteger(input) {
+  if (!Number.isInteger(input.value) || input.value < input.min || input.value > input.max) {
+    throw new Error(
+      `${input.field} must be an integer between ${input.min} and ${input.max}.`
+    );
+  }
+  return input.value;
+}
+function parseRedeemResponse(body) {
+  if (!isRecord(body) || typeof body.token !== "string" || typeof body.id !== "string") {
+    throw new Error("Bootstrap redeem returned an unexpected response.");
+  }
+  return {
+    token: body.token,
+    token_type: typeof body.token_type === "string" ? body.token_type : void 0,
+    id: body.id,
+    name: typeof body.name === "string" ? body.name : null,
+    scopes: Array.isArray(body.scopes) ? body.scopes.filter(
+      (scope) => typeof scope === "string"
+    ) : void 0,
+    status: typeof body.status === "string" ? body.status : void 0,
+    idle_ttl_seconds: typeof body.idle_ttl_seconds === "number" ? body.idle_ttl_seconds : void 0,
+    expires_at: typeof body.expires_at === "string" ? body.expires_at : null,
+    max_expires_at: typeof body.max_expires_at === "string" ? body.max_expires_at : null,
+    created_via: typeof body.created_via === "string" ? body.created_via : void 0
+  };
+}
+function describeRedeemFailure(status, body, url) {
+  const failure = readErrorBody(body);
+  const detail = failure?.message ? ` Server said: ${failure.message}` : "";
+  if (status === 400 || status === 401 || status === 403 || status === 404) {
+    return new Error(
+      `Bootstrap redeem failed (HTTP ${status}). The code may be invalid, expired, or already used. Call cliCredentialBootstrap again for a fresh code.${detail}`
+    );
+  }
+  return new Error(
+    failure?.message ?? `Bootstrap redeem failed with HTTP ${status} (${url.pathname}).${detail}`
+  );
+}
+async function readJson(response) {
+  const text = await response.text();
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+function readErrorBody(body) {
+  if (!isRecord(body) || body.error == null) {
+    if (typeof body === "string" && body.trim()) {
+      return { code: null, message: summarizeNonJsonErrorBody(body) };
+    }
+    if (isRecord(body) && typeof body.message === "string") {
+      return { code: null, message: body.message };
+    }
+    return null;
+  }
+  const { error } = body;
+  if (typeof error === "string") return { code: null, message: error };
+  if (isRecord(error)) {
+    const code = typeof error.code === "string" ? error.code : null;
+    const message = typeof error.message === "string" ? error.message : code ?? JSON.stringify(error);
+    return { code, message };
+  }
+  return { code: null, message: String(error) };
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/setup-git.ts
+var setupGitRequiredScopes = ["package:read", "package:write"];
+var setupGitDefaultScopes = [
+  "app:execute",
+  "app:read",
+  "email:read",
+  "email:send",
+  "integration:read",
+  "integration:use",
+  "job:execute",
+  "job:read",
+  "memory:read",
+  "org:execute",
+  "org:read",
+  "package:execute",
+  "package:read",
+  "package:write",
+  "secret:use",
+  "token:delete"
+];
+function gitCredentialHostFromMcpUrl(mcpUrl = defaultMcpUrl) {
+  return new URL(mcpUrl).host;
+}
+function scopesIncludeRequired(scopes, required = setupGitRequiredScopes) {
+  if (!scopes) return false;
+  const held = new Set(scopes);
+  return required.every((scope) => held.has(scope));
+}
+function ensureSetupGitScopes(base = setupGitDefaultScopes) {
+  const out = [...base];
+  for (const required of setupGitRequiredScopes) {
+    if (!out.includes(required)) out.push(required);
+  }
+  return out;
+}
+async function fetchTokenCurrentMetadata(input) {
+  const apiUrl = input.apiUrl || defaultApiUrl;
+  const current = await openApiGet({
+    token: input.token,
+    apiUrl,
+    path: "v1/tokens/current",
+    fetchFn: input.fetchFn
+  });
+  const orgBindingRaw = current.org_binding;
+  const orgBinding = orgBindingRaw === "user" || orgBindingRaw === "org" ? orgBindingRaw : null;
+  return {
+    id: String(current.id ?? ""),
+    orgBinding,
+    scopes: Array.isArray(current.scopes) ? current.scopes.filter(
+      (scope) => typeof scope === "string"
+    ) : [],
+    expiresAt: typeof current.expires_at === "string" ? current.expires_at : null
+  };
+}
+function assertUserOwnedTokensLive(metadata) {
+  if (metadata.orgBinding === null) {
+    throw new Error(
+      "This Kody origin does not advertise user-owned API tokens (`org_binding` missing on GET /v1/tokens/current). Upgrade the server (kody auth setup-git / persistent git HTTPS) before installing the credential helper."
+    );
+  }
+}
+function decideSetupGitToken(input) {
+  const lifetime = input.lifetime ?? resolveCliTokenLifetime({ lifetime: "long" });
+  if (input.stored && input.metadata && input.metadata.orgBinding === "user" && scopesIncludeRequired(input.metadata.scopes) && !input.scopesOverride) {
+    return { action: "reuse", stored: input.stored, metadata: input.metadata };
+  }
+  const scopes = ensureSetupGitScopes(
+    input.scopesOverride ?? input.metadata?.scopes ?? input.stored?.scopes ?? setupGitDefaultScopes
+  );
+  const reason = !input.stored ? "No stored API token yet." : input.metadata?.orgBinding !== "user" ? "Stored token is not user-owned (`org_binding` must be `user`)." : !scopesIncludeRequired(input.metadata?.scopes) ? "Stored token is missing package:read and/or package:write." : "Minting with the requested --scopes list.";
+  return { action: "mint", scopes, lifetime, reason };
+}
+function defaultGitConfigRunner(args) {
+  const result = spawnSync("git", [...args], {
+    encoding: "utf8",
+    env: process.env
+  });
+  if (result.error) {
+    return { status: 1, stderr: result.error.message };
+  }
+  return {
+    status: result.status ?? 1,
+    stderr: (result.stderr || "").trim()
+  };
+}
+function installGitCredentialConfig(input) {
+  const runGit = input.runGit ?? defaultGitConfigRunner;
+  const scope = input.global === false ? "--local" : "--global";
+  const helperKey = `credential.https://${input.host}.helper`;
+  const pathKey = `credential.https://${input.host}.useHttpPath`;
+  for (const [key, value] of [
+    [helperKey, input.helperCommand],
+    [pathKey, "true"]
+  ]) {
+    const result = runGit(["config", scope, key, value]);
+    if (result.status !== 0) {
+      throw new Error(
+        `git config ${scope} ${key} failed${result.stderr ? `: ${result.stderr}` : ""}. Is git installed?`
+      );
+    }
+  }
+  return { host: input.host, helperCommand: input.helperCommand, scope };
+}
+var gitApiTokenRefreshSkewMs = 60 * 60 * 1e3;
+var gitCredentialMinCliVersion = "1.16.0";
+var gitCredentialHelperPinFallbackVersion = "1.18.0";
+var requireFromSetupGit = createRequire(import.meta.url);
+function readCliPackageVersion() {
+  try {
+    const pkg = requireFromSetupGit("../package.json");
+    return typeof pkg.version === "string" ? pkg.version : gitCredentialHelperPinFallbackVersion;
+  } catch {
+    return gitCredentialHelperPinFallbackVersion;
+  }
+}
+function isEphemeralNpxEntryPath(entryPath) {
+  const normalized = entryPath.replace(/\\/g, "/");
+  return normalized.includes("/.npm/_npx/") || normalized.includes("/npm/_npx/") || /\/_npx\//.test(normalized);
+}
+function parseCliSemver(version) {
+  const match = /^(\d+)\.(\d+)\.(\d+)/.exec(version.trim());
+  if (!match) return null;
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3])
+  };
+}
+function compareCliSemver(a, b) {
+  if (a.major !== b.major) return a.major < b.major ? -1 : 1;
+  if (a.minor !== b.minor) return a.minor < b.minor ? -1 : 1;
+  if (a.patch !== b.patch) return a.patch < b.patch ? -1 : 1;
+  return 0;
+}
+function cliVersionGte(version, minimum) {
+  const left = parseCliSemver(version);
+  const right = parseCliSemver(minimum);
+  if (!left || !right) return false;
+  return compareCliSemver(left, right) >= 0;
+}
+function cliVersionGt(version, other) {
+  const left = parseCliSemver(version);
+  const right = parseCliSemver(other);
+  if (!left || !right) return false;
+  return compareCliSemver(left, right) > 0;
+}
+function cliVersionSupportsGitCredential(version) {
+  return cliVersionGte(version, gitCredentialMinCliVersion);
+}
+function cliExactVersionForNpx(packageVersion) {
+  const parsed = parseCliSemver(packageVersion);
+  if (parsed && parsed.major >= 1) {
+    return `${parsed.major}.${parsed.minor}.${parsed.patch}`;
+  }
+  return gitCredentialHelperPinFallbackVersion;
+}
+function cliMajorVersionForNpx(packageVersion) {
+  return cliExactVersionForNpx(packageVersion);
+}
+function apiTokenNeedsRefresh(stored, nowMs = Date.now(), skewMs = gitApiTokenRefreshSkewMs) {
+  if (!stored) return true;
+  if (stored.expiresAt == null || stored.expiresAt === "") return false;
+  const expiresMs = Date.parse(stored.expiresAt);
+  if (!Number.isFinite(expiresMs)) return true;
+  return expiresMs - nowMs <= skewMs;
+}
+function readVersionFromKodyBinary(binPath, args = ["--version"]) {
+  const result = spawnSync(binPath, [...args], {
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      KODY_SKIP_GIT_HELPER_REFRESH: "1"
+    },
+    timeout: 8e3
+  });
+  if (result.error || (result.status ?? 1) !== 0) return null;
+  const text = `${result.stdout || ""}
+${result.stderr || ""}`;
+  const match = /(\d+\.\d+\.\d+)/.exec(text);
+  return match?.[1] ?? null;
+}
+function defaultReadGlobalKodyVersion(binPath) {
+  return readVersionFromKodyBinary(binPath);
+}
+function gitCredentialHelperCommand(input) {
+  const env = input?.env ?? process.env;
+  const whichFn = input?.which ?? which;
+  const entryPath = input?.entryPath ?? process.argv[1];
+  const readVersion = input?.readKodyVersion ?? defaultReadGlobalKodyVersion;
+  const globalKody = whichFn("kody", env);
+  if (globalKody && !isEphemeralNpxEntryPath(globalKody)) {
+    const globalVersion = readVersion(globalKody);
+    if (globalVersion && cliVersionSupportsGitCredential(globalVersion)) {
+      return `!${shellQuote(globalKody)} git-credential`;
+    }
+  }
+  if (entryPath && entryPath.length > 0 && !isEphemeralNpxEntryPath(entryPath)) {
+    const execPath = input?.execPath ?? process.execPath;
+    return `!${shellQuote(execPath)} ${shellQuote(entryPath)} git-credential`;
+  }
+  const exact = cliExactVersionForNpx(
+    input?.packageVersion ?? readCliPackageVersion()
+  );
+  return `!npx -y ${cliName}@${exact} git-credential`;
+}
+function shellQuote(value) {
+  if (/^[A-Za-z0-9_./:@+=,-]+$/.test(value)) return value;
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function isMajorOnlyNpxHelper(helper) {
+  return /@kodycodes\/cli@\d+(?![.\d])/.test(helper);
+}
+function exactNpxHelperVersion(helper) {
+  const match = /@kodycodes\/cli@(\d+\.\d+\.\d+)/.exec(helper);
+  return match?.[1] ?? null;
+}
+function gitCredentialHelperNeedsRepair(input) {
+  const helper = input.helper?.trim();
+  if (!helper) return false;
+  if (isEphemeralNpxEntryPath(helper)) return true;
+  if (isMajorOnlyNpxHelper(helper)) return true;
+  const pinned = exactNpxHelperVersion(helper);
+  if (pinned) {
+    if (!cliVersionSupportsGitCredential(pinned)) return true;
+    const current = cliExactVersionForNpx(
+      input.packageVersion ?? readCliPackageVersion()
+    );
+    return cliVersionGt(current, pinned);
+  }
+  if (input.probeBinaryVersion !== true) {
+    return false;
+  }
+  const readVersion = input.readKodyVersion ?? defaultReadGlobalKodyVersion;
+  const bang = helper.startsWith("!") ? helper.slice(1).trim() : helper.trim();
+  const parts = bang.split(/\s+/).filter(Boolean);
+  if (parts.length >= 2 && parts[parts.length - 1] === "git-credential") {
+    const invocation = parts.slice(0, -1);
+    if (invocation.length === 1) {
+      const version = readVersion(invocation[0]);
+      if (version && !cliVersionSupportsGitCredential(version)) return true;
+    } else if (invocation.length >= 2) {
+      const version = readVersionFromKodyBinary(invocation[0], [
+        ...invocation.slice(1),
+        "--version"
+      ]);
+      if (version && !cliVersionSupportsGitCredential(version)) return true;
+    }
+  }
+  return false;
+}
+function defaultGitConfigGetRunner(args) {
+  const result = spawnSync("git", [...args], {
+    encoding: "utf8",
+    env: process.env
+  });
+  if (result.error) {
+    return { status: 1, stdout: "", stderr: result.error.message };
+  }
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout || "").trim(),
+    stderr: (result.stderr || "").trim()
+  };
+}
+function refreshGitCredentialHelperPinIfNeeded(input) {
+  const mcpUrl = input?.mcpUrl || defaultMcpUrl;
+  const host = gitCredentialHostFromMcpUrl(mcpUrl);
+  const scope = input?.global === false ? "--local" : "--global";
+  const runGet = input?.runGitGet ?? defaultGitConfigGetRunner;
+  const helperKey = `credential.https://${host}.helper`;
+  const got = runGet(["config", scope, "--get", helperKey]);
+  if (got.status !== 0 || !got.stdout) return false;
+  const packageVersion = input?.packageVersion ?? readCliPackageVersion();
+  if (!gitCredentialHelperNeedsRepair({
+    helper: got.stdout,
+    packageVersion,
+    readKodyVersion: input?.readKodyVersion,
+    probeBinaryVersion: input?.probeBinaryVersion === true
+  })) {
+    return false;
+  }
+  const helperCommand = input?.helperCommand ?? gitCredentialHelperCommand({
+    packageVersion,
+    which: input?.which,
+    execPath: input?.execPath,
+    entryPath: input?.entryPath,
+    env: input?.env,
+    readKodyVersion: input?.readKodyVersion
+  });
+  if (helperCommand === got.stdout) return false;
+  installGitCredentialConfig({
+    host,
+    helperCommand,
+    global: input?.global,
+    runGit: input?.runGit
+  });
+  return true;
+}
+async function authSetupGit(input) {
+  const apiUrl = input.apiUrl || defaultApiUrl;
+  const mcpUrl = input.mcpUrl || defaultMcpUrl;
+  const host = gitCredentialHostFromMcpUrl(mcpUrl);
+  const storedExisting = loadStoredApiToken(
+    apiUrl,
+    input.backend,
+    input.resolution
+  );
+  const probeToken = input.token || storedExisting?.token;
+  const hasLoginSession = input.hasLoginSession === true;
+  if (!probeToken && !hasLoginSession) {
+    throw new Error(
+      `setup-git needs a Kody credential to detect server support and mint a token. Run \`kody login\`, or set ${apiTokenEnvVar}, or pass --token.`
+    );
+  }
+  let probeMetadata = null;
+  if (probeToken) {
+    try {
+      probeMetadata = await fetchTokenCurrentMetadata({
+        token: probeToken,
+        apiUrl,
+        fetchFn: input.fetchFn
+      });
+    } catch (error) {
+      if (error instanceof OpenApiError && error.status === 401) {
+        throw new Error(
+          `Could not read token metadata from ${apiUrl} (unauthorized). Run \`kody login\` or pass a valid --token / ${apiTokenEnvVar}.`
+        );
+      }
+      throw error;
+    }
+    assertUserOwnedTokensLive(probeMetadata);
+  }
+  let storedMetadata = null;
+  if (storedExisting) {
+    if (probeMetadata && storedExisting.token === probeToken) {
+      storedMetadata = probeMetadata;
+    } else {
+      try {
+        storedMetadata = await fetchTokenCurrentMetadata({
+          token: storedExisting.token,
+          apiUrl,
+          fetchFn: input.fetchFn
+        });
+      } catch {
+        storedMetadata = null;
+      }
+    }
+  }
+  const decision = decideSetupGitToken({
+    stored: storedExisting,
+    metadata: storedMetadata,
+    scopesOverride: input.scopesOverride,
+    lifetime: input.lifetime
+  });
+  let stored;
+  let minted = false;
+  let backendKind;
+  let backendPath;
+  let finalMetadata;
+  if (decision.action === "reuse") {
+    stored = decision.stored;
+    backendKind = "existing";
+    finalMetadata = decision.metadata;
+  } else {
+    const result = await authBootstrapWithScopes({
+      scopes: decision.scopes,
+      lifetime: decision.lifetime,
+      mint: input.mint,
+      apiUrl,
+      fetchFn: input.fetchFn,
+      backend: input.backend,
+      resolution: input.resolution
+    });
+    stored = result.stored;
+    minted = true;
+    backendKind = result.backendKind;
+    backendPath = result.backendPath;
+    const after = await fetchTokenCurrentMetadata({
+      token: stored.token,
+      apiUrl,
+      fetchFn: input.fetchFn
+    });
+    assertUserOwnedTokensLive(after);
+    if (after.orgBinding !== "user") {
+      throw new Error(
+        `Minted token ${stored.tokenId} has org_binding=${JSON.stringify(after.orgBinding)}; expected "user". Refusing to install the git helper.`
+      );
+    }
+    if (!scopesIncludeRequired(after.scopes)) {
+      throw new Error(
+        `Minted token ${stored.tokenId} is missing package:read and/or package:write. Pass --scopes that include both.`
+      );
+    }
+    finalMetadata = after;
+  }
+  const helperCommand = input.helperCommand ?? gitCredentialHelperCommand();
+  installGitCredentialConfig({
+    host,
+    helperCommand,
+    global: input.global,
+    runGit: input.runGit
+  });
+  return {
+    host,
+    helperCommand,
+    tokenId: stored.tokenId,
+    scopes: finalMetadata.scopes,
+    orgBinding: "user",
+    minted,
+    backendKind,
+    ...backendPath ? { backendPath } : {},
+    expiresAt: finalMetadata.expiresAt
+  };
+}
+var setupGitConfigScopes = ["--global", "--local"];
+function isKodyGitCredentialHelperValue(value) {
+  const v = value.trim();
+  if (!v) return false;
+  if (v.includes("@kodycodes/cli")) return true;
+  if (isEphemeralNpxEntryPath(v)) return true;
+  if (/\bgit-credential\b/.test(v) && /(^|[/\s!])kody(\s|$)/.test(v))
+    return true;
+  if (/\bgit-credential\b/.test(v) && /kody/i.test(v)) return true;
+  return false;
+}
+async function authRemoveGit(input) {
+  const apiUrl = input.apiUrl || defaultApiUrl;
+  const mcpUrl = input.mcpUrl || defaultMcpUrl;
+  const host = gitCredentialHostFromMcpUrl(mcpUrl);
+  const runGet = input.runGitGet ?? defaultGitConfigGetRunner;
+  const runGit = input.runGit ?? defaultGitConfigRunner;
+  const helperKey = `credential.https://${host}.helper`;
+  const pathKey = `credential.https://${host}.useHttpPath`;
+  const removedHelpers = [];
+  const removedPathKeys = [];
+  for (const scope of setupGitConfigScopes) {
+    const helpers = runGet(["config", scope, "--get-all", helperKey]);
+    if (helpers.status === 0 && helpers.stdout.trim()) {
+      const values = helpers.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+      const unset = runGit(["config", scope, "--unset-all", helperKey]);
+      if (unset.status === 0) {
+        for (const value of values) {
+          removedHelpers.push({ scope, key: helperKey, value });
+        }
+      }
+    }
+    const pathGot = runGet(["config", scope, "--get-all", pathKey]);
+    if (pathGot.status === 0 && pathGot.stdout.trim()) {
+      const unset = runGit(["config", scope, "--unset-all", pathKey]);
+      if (unset.status === 0) {
+        removedPathKeys.push({
+          scope,
+          key: pathKey,
+          value: pathGot.stdout.trim().split(/\r?\n/)[0]
+        });
+      }
+    }
+  }
+  const stored = loadStoredApiToken(apiUrl, input.backend, input.resolution);
+  let tokenRevoked = "skipped";
+  let tokenRevokeError;
+  let tokenId = stored?.tokenId ?? null;
+  if (stored?.token) {
+    try {
+      await openApiRequest({
+        token: stored.token,
+        apiUrl,
+        method: "DELETE",
+        path: "v1/tokens/current",
+        fetchFn: input.fetchFn
+      });
+      tokenRevoked = "yes";
+    } catch (error) {
+      if (error instanceof OpenApiError && (error.status === 401 || error.status === 404)) {
+        tokenRevoked = "already";
+      } else {
+        tokenRevoked = "failed";
+        tokenRevokeError = error instanceof Error ? error.message : String(error);
+      }
+    }
+  }
+  const deleted = deleteStoredApiToken(apiUrl, input.backend, input.resolution);
+  return {
+    host,
+    removedHelpers,
+    removedPathKeys,
+    tokenId,
+    tokenRevoked,
+    ...tokenRevokeError ? { tokenRevokeError } : {},
+    tokenDeletedLocally: deleted.deleted
+  };
+}
+function formatAuthRemoveGitReport(result) {
+  const lines = [];
+  const removedAnything = result.removedHelpers.length > 0 || result.removedPathKeys.length > 0 || result.tokenDeletedLocally || result.tokenRevoked === "yes" || result.tokenRevoked === "already";
+  if (!removedAnything) {
+    return [
+      `No Kody Git HTTPS credential helper or stored API token found for https://${result.host}/.`,
+      "Nothing to remove. (kody login sessions were not touched.)",
+      ""
+    ].join("\n");
+  }
+  lines.push(`Removed Kody Git HTTPS setup for https://${result.host}/`);
+  for (const entry of result.removedHelpers) {
+    lines.push(`  ${entry.scope} ${entry.key}: ${entry.value}`);
+  }
+  for (const entry of result.removedPathKeys) {
+    lines.push(
+      `  ${entry.scope} ${entry.key}${entry.value ? `: ${entry.value}` : ""}`
+    );
+  }
+  if (result.tokenRevoked === "yes") {
+    lines.push(
+      `Revoked API token${result.tokenId ? ` ${result.tokenId}` : ""} on the server (token:delete).`
+    );
+  } else if (result.tokenRevoked === "already") {
+    lines.push(
+      `API token${result.tokenId ? ` ${result.tokenId}` : ""} already revoked or expired on the server.`
+    );
+  } else if (result.tokenRevoked === "failed") {
+    lines.push(
+      `Could not revoke API token on the server${result.tokenRevokeError ? `: ${result.tokenRevokeError}` : "."}`
+    );
+  } else if (result.tokenRevoked === "skipped") {
+    lines.push("No stored API token to revoke.");
+  }
+  if (result.tokenDeletedLocally) {
+    lines.push(
+      "Deleted stored API token from the OS keychain (and file fallback)."
+    );
+  } else if (result.tokenRevoked !== "skipped") {
+    lines.push("Stored API token was already absent from the local store.");
+  }
+  lines.push("Left kody login sessions alone.");
+  lines.push("");
+  return lines.join("\n");
+}
+
+export {
+  cliTokenLifetimePolicy,
+  cliTokenLifetimeAliases,
+  cliTokenLifetimeMissingError,
+  resolveCliTokenLifetime,
+  bootstrapRedeemRequestBody,
+  parseCliLifetimeSecondsFlag,
+  redeemBootstrapCode,
+  authBootstrap,
+  cliCredentialBootstrapOperationId,
+  parseCliScopesFlag,
+  bootstrapMintLifetimeFields,
+  authBootstrapWithScopes,
+  setupGitRequiredScopes,
+  setupGitDefaultScopes,
+  gitCredentialHostFromMcpUrl,
+  scopesIncludeRequired,
+  ensureSetupGitScopes,
+  fetchTokenCurrentMetadata,
+  assertUserOwnedTokensLive,
+  decideSetupGitToken,
+  defaultGitConfigRunner,
+  installGitCredentialConfig,
+  gitApiTokenRefreshSkewMs,
+  gitCredentialMinCliVersion,
+  gitCredentialHelperPinFallbackVersion,
+  readCliPackageVersion,
+  isEphemeralNpxEntryPath,
+  parseCliSemver,
+  compareCliSemver,
+  cliVersionGte,
+  cliVersionGt,
+  cliVersionSupportsGitCredential,
+  cliExactVersionForNpx,
+  cliMajorVersionForNpx,
+  apiTokenNeedsRefresh,
+  readVersionFromKodyBinary,
+  gitCredentialHelperCommand,
+  isMajorOnlyNpxHelper,
+  exactNpxHelperVersion,
+  gitCredentialHelperNeedsRepair,
+  defaultGitConfigGetRunner,
+  refreshGitCredentialHelperPinIfNeeded,
+  authSetupGit,
+  setupGitConfigScopes,
+  isKodyGitCredentialHelperValue,
+  authRemoveGit,
+  formatAuthRemoveGitReport
+};
+//# sourceMappingURL=chunk-OZDWOZLV.js.map