@kodycodes/cli 1.7.0 → 1.8.1

package/README.md

@@ -60,8 +60,9 @@ Or run via `npx @kodycodes/cli` without a global install.
 | `kody install` | Detect running local MCP clients, write their config, and start host OAuth. **Recommended long-term path.** |
 | `kody skill install` | Copies the getting-started skill into Claude Code / Cursor / Agents. |
 | `kody login` | Browser OAuth (CIMD + PKCE) for the CLI itself. Stores access and refresh tokens. |
-| `kody logout` | Deletes stored CLI credentials. |
-| `kody status` | Shows CLI login state without printing secrets. |
+| `kody logout` | Deletes stored CLI OAuth credentials and any stored bootstrap/API token. |
+| `kody status` | Shows CLI login / stored API token state without printing secrets. |
+| `kody auth bootstrap --code` | Redeems a one-shot `kody_bc_…` from MCP `cliCredentialBootstrap` and stores the resulting `kody_at_…` for `execute --local` (never prints the token). |
 | `kody whoami` | Confirms the CLI MCP connection and lists tools. With a scoped API token (and no login), shows token identity via the Open API. |
 | `kody search [query]` | Calls Kody `search` from the CLI (prefer the host MCP tool). Token-only auth uses Open API `GET /v1/search`. |
 | `kody execute` | Calls Kody `execute` from the CLI (`--invoke`, `--code`, `--file`, or stdin via `--file -`). With a scoped API token and no login (or with `--token`), cloud execute goes through CapabilityProxy → `kody.execute` — no `kody login`. Add `--local` to run the module (and static `kody:@…` package modules) on this machine instead. |
@@ -70,13 +71,21 @@ Or run via `npx @kodycodes/cli` without a global install.
 
 ## Token-authenticated execute (no `kody login`)
 
-Scoped API tokens (`kody_at_…`, from the MCP `api` tool `tokenCreate` or
-`POST /v1/tokens`) authenticate the Open API and CapabilityProxy. They never
-replace MCP OAuth on `/mcp`. The CLI uses that token path when you pass
-`--token` / `KODY_API_TOKEN` and are not logged in (or when you pass `--token`
-explicitly):
+Agents already on Kody MCP should prefer `cliCredentialBootstrap` →
+`kody auth bootstrap --code …` (ADR 0056) so a one-shot `kody_bc_…` seeds the
+CLI store without pasting `kody_at_…` into chat. Interactive humans can use
+`kody login`. Scoped API tokens (`kody_at_…`, from bootstrap redeem,
+`tokenCreate`, or `POST /v1/tokens`) authenticate the Open API and
+CapabilityProxy. They never replace MCP OAuth on `/mcp`. The CLI uses that
+token path when you pass `--token` / `KODY_API_TOKEN` and are not logged in
+(or when you pass `--token` explicitly):
 
 ```bash
+# Preferred for agents on MCP (no tokenCreate, no second OAuth):
+# 1. MCP api / kody.cliCredentialBootstrap → { bootstrap_code, cli_command }
+npx @kodycodes/cli auth bootstrap --code 'kody_bc_…'
+npx @kodycodes/cli execute --local --file ./task.js
+
 export KODY_API_TOKEN=…   # scopes: local-execute (+ search:read for search)
 # Cloud execute — module runs in Kody's sandbox via CapabilityProxy → kody.execute
 npx @kodycodes/cli execute --code 'export default async () => ({ ok: true })'
@@ -86,16 +95,16 @@ npx @kodycodes/cli search "what can you do"
 npx @kodycodes/cli whoami
 ```
 
-- Neither `kody login` nor a token → the error tells you to mint one with the
-  MCP `api` tool `tokenCreate` (scopes: `local-execute` plus the capability
-  scopes the module will call) and pass `--token` / `KODY_API_TOKEN`, or run
-  `kody login` (for cloud MCP commands and for login-backed `execute --local`).
+- Neither bootstrap store, `kody login`, nor a token → the error prefers
+  `cliCredentialBootstrap` → `auth bootstrap`, then `kody login`, then
+  `tokenCreate` for CI/headless (`--token` / `KODY_API_TOKEN`).
 - For `execute --local` specifically: `--token` / `KODY_API_TOKEN` wins when
-  set; otherwise the CLI uses the stored `kody login` OAuth access token as
-  the Bearer (no under-the-hood `tokenCreate`). The Open API must accept that
-  OAuth bearer on CapabilityProxy / package-graph
+  set; else a stored bootstrap/API token from `auth bootstrap`; else the
+  stored `kody login` OAuth access token as Bearer (no under-the-hood
+  `tokenCreate`). The Open API must accept that OAuth bearer on
+  CapabilityProxy / package-graph
   ([kentcdodds/kody#2812](https://github.com/kentcdodds/kody/issues/2812));
-  until then mint a scoped `kody_at_…` token.
+  until then use bootstrap or a scoped `kody_at_…` token.
 - Wrong/expired token → 401 with a mint-fresh-token message (or the OAuth
   platform-gap message when the bearer is login OAuth).
 - Wrong scopes → the error includes `insufficient_scope` and the required
@@ -103,6 +112,7 @@ npx @kodycodes/cli whoami
 - Account flag off → the error includes `feature_disabled` and the
   `local-execute` feature flag. Another token does not bypass that flag.
 - Prefer the env var so the token stays out of shell history and `ps`.
+- Never scavenge host MCP OAuth tokens from disk (ADR 0053).
 
 ## Local execute
 
@@ -121,19 +131,24 @@ CapabilityProxy → `kody.execute` defer). There is no author-facing
 npx @kodycodes/cli login
 npx @kodycodes/cli execute --local --file ./task.js --params '{"to":"me@example.com"}'
 
-# Or a scoped API token (still wins over login when set):
+# Agents on MCP: bootstrap code → store (no tokenCreate, no second OAuth):
+npx @kodycodes/cli auth bootstrap --code 'kody_bc_…'
+npx @kodycodes/cli execute --local --file ./task.js --params '{"to":"me@example.com"}'
+
+# Or a scoped API token (still wins over login / bootstrap store when set):
 export KODY_API_TOKEN=…   # minted through the Kody `api` tool
 npx @kodycodes/cli execute --local --file ./task.js --params '{"to":"me@example.com"}'
 ```
 
-- **Auth:** `--token` / `KODY_API_TOKEN` when set; else a valid `kody login`
-  session (OAuth access token as Bearer — never printed, never exchanged via
-  `tokenCreate`). Prefer the env var for API tokens so they stay out of shell
-  history and `ps`. The bearer stays in the CLI process; the sandbox only
-  talks to a loopback bridge. Host MCP OAuth from other clients is never
-  read. Until [kentcdodds/kody#2812](https://github.com/kentcdodds/kody/issues/2812)
-  ships, login-only Bearer is rejected by the Open API — use a `kody_at_…`
-  token in that case.
+- **Auth:** `--token` / `KODY_API_TOKEN` when set; else stored `auth bootstrap`
+  API token; else a valid `kody login` session (OAuth access token as Bearer —
+  never printed, never exchanged via `tokenCreate`). Prefer the env var for
+  API tokens so they stay out of shell history and `ps`. The bearer stays in
+  the CLI process; the sandbox only talks to a loopback bridge. Host MCP OAuth
+  from other clients is never read. Until
+  [kentcdodds/kody#2812](https://github.com/kentcdodds/kody/issues/2812)
+  ships, login-only Bearer is rejected by the Open API — use bootstrap or a
+  `kody_at_…` token in that case.
 - **Node.js:** 22 or newer (`package.json` `engines` is `>=22`). Older Node
   fails immediately with that requirement, before workerd is downloaded or
   started.

package/dist/api-token-store.d.ts

@@ -0,0 +1,29 @@
+import { type SecretBackend, type StoreResolution } from './store.js';
+/**
+ * Scoped API token stored by `auth bootstrap` (ADR 0056) for
+ * `execute --local`, Open API search/whoami, and token-auth cloud execute.
+ * Separate from `kody login` OAuth credentials.
+ */
+export type StoredApiToken = {
+    version: 1;
+    apiUrl: string;
+    token: string;
+    tokenId: string;
+    name?: string;
+    scopes?: Array<string>;
+    expiresAt?: string | null;
+    maxExpiresAt?: string | null;
+    createdVia?: string;
+};
+export declare function accountForApiUrl(apiUrl: string): string;
+export declare function apiTokenFileStorePath(apiUrl: string, home?: string): string;
+export declare function createApiTokenKeyringBackend(apiUrl: string): SecretBackend;
+export declare function parseStoredApiToken(raw: string): StoredApiToken;
+export declare function loadStoredApiToken(apiUrl?: string, backend?: SecretBackend, resolution?: StoreResolution): StoredApiToken | null;
+export declare function saveStoredApiToken(credentials: StoredApiToken, backend?: SecretBackend, resolution?: StoreResolution): {
+    backend: SecretBackend;
+};
+export declare function deleteStoredApiToken(apiUrl?: string, backend?: SecretBackend, resolution?: StoreResolution): {
+    deleted: boolean;
+    backend: SecretBackend;
+};

package/dist/api-token-store.js

@@ -0,0 +1,120 @@
+import { Entry } from '@napi-rs/keyring';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { defaultApiUrl, keyringService } from './defaults.js';
+import { createFileBackend, secretServiceKeyringOptions, } from './store.js';
+export function accountForApiUrl(apiUrl) {
+    return `cli-api-token:${new URL(apiUrl).origin}`;
+}
+export function apiTokenFileStorePath(apiUrl, home = homedir()) {
+    const origin = new URL(apiUrl).host.replace(/[^a-zA-Z0-9.-]/g, '_');
+    const base = process.platform === 'win32'
+        ? join(process.env.APPDATA || join(home, 'AppData', 'Roaming'), 'kody')
+        : process.platform === 'darwin'
+            ? join(home, 'Library', 'Application Support', 'kody')
+            : join(process.env.XDG_CONFIG_HOME || join(home, '.config'), 'kody');
+    return join(base, `api-token-${origin}.json`);
+}
+export function createApiTokenKeyringBackend(apiUrl) {
+    const entry = new Entry(keyringService, accountForApiUrl(apiUrl), secretServiceKeyringOptions);
+    return {
+        kind: 'keyring',
+        get() {
+            try {
+                return entry.getPassword();
+            }
+            catch {
+                return null;
+            }
+        },
+        set(value) {
+            entry.setPassword(value);
+        },
+        delete() {
+            try {
+                return entry.deleteCredential();
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}
+function fileBackendFor(apiUrl, resolution) {
+    const path = resolution?.fileStorePath?.(apiUrl) ?? apiTokenFileStorePath(apiUrl);
+    return createFileBackend(path);
+}
+function resolveApiTokenBackend(apiUrl, preferred, resolution) {
+    if (preferred)
+        return preferred;
+    try {
+        return (resolution?.createKeyring ?? createApiTokenKeyringBackend)(apiUrl);
+    }
+    catch {
+        return fileBackendFor(apiUrl, resolution);
+    }
+}
+export function parseStoredApiToken(raw) {
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 1 ||
+        typeof parsed.token !== 'string' ||
+        !parsed.token.startsWith('kody_at_') ||
+        typeof parsed.apiUrl !== 'string' ||
+        typeof parsed.tokenId !== 'string') {
+        throw new Error('Stored Kody API token is invalid. Run `kody auth bootstrap --code …` again.');
+    }
+    return parsed;
+}
+function readParsed(store) {
+    const raw = store.get();
+    if (!raw)
+        return null;
+    return parseStoredApiToken(raw);
+}
+export function loadStoredApiToken(apiUrl = defaultApiUrl, backend, resolution) {
+    const store = resolveApiTokenBackend(apiUrl, backend, resolution);
+    try {
+        const loaded = readParsed(store);
+        if (loaded)
+            return loaded;
+    }
+    catch (error) {
+        if (!(store.kind === 'keyring' && !backend))
+            throw error;
+    }
+    if (store.kind === 'keyring' && !backend) {
+        return readParsed(fileBackendFor(apiUrl, resolution));
+    }
+    return null;
+}
+export function saveStoredApiToken(credentials, backend, resolution) {
+    const store = resolveApiTokenBackend(credentials.apiUrl, backend, resolution);
+    try {
+        store.set(JSON.stringify(credentials));
+        return { backend: store };
+    }
+    catch (error) {
+        if (store.kind === 'keyring' && !backend) {
+            const fallback = fileBackendFor(credentials.apiUrl, resolution);
+            fallback.set(JSON.stringify(credentials));
+            return { backend: fallback };
+        }
+        throw error;
+    }
+}
+export function deleteStoredApiToken(apiUrl = defaultApiUrl, backend, resolution) {
+    const store = resolveApiTokenBackend(apiUrl, backend, resolution);
+    let deleted = false;
+    try {
+        deleted = store.delete();
+    }
+    catch {
+        deleted = false;
+    }
+    if (store.kind === 'keyring' && !backend) {
+        const file = fileBackendFor(apiUrl, resolution);
+        deleted = file.delete() || deleted;
+    }
+    return { deleted, backend: store };
+}
+//# sourceMappingURL=api-token-store.js.map

package/dist/api-token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token-store.js","sourceRoot":"","sources":["../src/api-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EACN,iBAAiB,EACjB,2BAA2B,GAG3B,MAAM,YAAY,CAAA;AAmBnB,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC9C,OAAO,iBAAiB,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAA;AACjD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,MAAc,EACd,OAAe,OAAO,EAAE;IAExB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;IACnE,MAAM,IAAI,GACT,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC3B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QACvE,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,CAAC;YACtD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAA;IACvE,OAAO,IAAI,CAAC,IAAI,EAAE,aAAa,MAAM,OAAO,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAc;IAC1D,MAAM,KAAK,GAAG,IAAI,KAAK,CACtB,cAAc,EACd,gBAAgB,CAAC,MAAM,CAAC,EACxB,2BAA2B,CAC3B,CAAA;IACD,OAAO;QACN,IAAI,EAAE,SAAS;QACf,GAAG;YACF,IAAI,CAAC;gBACJ,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,IAAI,CAAA;YACZ,CAAC;QACF,CAAC;QACD,GAAG,CAAC,KAAa;YAChB,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACzB,CAAC;QACD,MAAM;YACL,IAAI,CAAC;gBACJ,OAAO,KAAK,CAAC,gBAAgB,EAAE,CAAA;YAChC,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,KAAK,CAAA;YACb,CAAC;QACF,CAAC;KACD,CAAA;AACF,CAAC;AAED,SAAS,cAAc,CACtB,MAAc,EACd,UAA4B;IAE5B,MAAM,IAAI,GACT,UAAU,EAAE,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAA;IACrE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,sBAAsB,CAC9B,MAAc,EACd,SAAyB,EACzB,UAA4B;IAE5B,IAAI,SAAS;QAAE,OAAO,SAAS,CAAA;IAC/B,IAAI,CAAC;QACJ,OAAO,CAAC,UAAU,EAAE,aAAa,IAAI,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAA;IAC3E,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAC1C,CAAC;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAA;IAChD,IACC,MAAM,CAAC,OAAO,KAAK,CAAC;QACpB,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;QACpC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EACjC,CAAC;QACF,MAAM,IAAI,KAAK,CACd,6EAA6E,CAC7E,CAAA;IACF,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED,SAAS,UAAU,CAAC,KAAoB;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACvB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAA;AAChC,CAAC;AAED,MAAM,UAAU,kBAAkB,CACjC,SAAiB,aAAa,EAC9B,OAAuB,EACvB,UAA4B;IAE5B,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;IACjE,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC;YAAE,MAAM,KAAK,CAAA;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,kBAAkB,CACjC,WAA2B,EAC3B,OAAuB,EACvB,UAA4B;IAE5B,MAAM,KAAK,GAAG,sBAAsB,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;IAC7E,IAAI,CAAC;QACJ,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;YAC/D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;YACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;QAC7B,CAAC;QACD,MAAM,KAAK,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,SAAiB,aAAa,EAC9B,OAAuB,EACvB,UAA4B;IAE5B,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;IACjE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,CAAC;QACJ,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,GAAG,KAAK,CAAA;IAChB,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QAC/C,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,OAAO,CAAA;IACnC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;AACnC,CAAC"}

package/dist/api-token.d.ts

@@ -1,5 +1,18 @@
+import { loadStoredApiToken } from './api-token-store.js';
+import type { SecretBackend, StoreResolution } from './store.js';
 /** Platform tracking for login OAuth as CapabilityProxy / package-graph Bearer. */
 export declare const localExecuteOauthPlatformIssueUrl = "https://github.com/kentcdodds/kody/issues/2812";
+export type ResolveScopedApiTokenInput = {
+    tokenValues?: {
+        token?: string;
+    };
+    env?: NodeJS.ProcessEnv;
+    apiUrl?: string;
+    apiTokenBackend?: SecretBackend;
+    apiTokenResolution?: StoreResolution;
+    /** Test seam. */
+    loadApiToken?: typeof loadStoredApiToken;
+};
 /**
  * Scoped Open API / CapabilityProxy token (`kody_at_…`). Same source for
  * `execute --local`, token-only cloud execute, and Open API search/whoami.
@@ -7,17 +20,25 @@ export declare const localExecuteOauthPlatformIssueUrl = "https://github.com/ken
 export declare function readApiToken(values?: {
     token?: string;
 }, env?: NodeJS.ProcessEnv): string | null;
+/**
+ * Resolve a scoped API token without falling back to `kody login` OAuth.
+ * Priority: `--token` / `KODY_API_TOKEN` → stored bootstrap/API token.
+ */
+export declare function resolveScopedApiToken(input?: ResolveScopedApiTokenInput): string | null;
 /** True when the bearer looks like a minted Open API token (not MCP OAuth). */
 export declare function isScopedApiToken(token: string): boolean;
 /**
- * How to mint the scoped token this CLI already accepts. There is no second
- * auth flow here — callers use the MCP `api` tool they already have.
+ * How to mint a scoped token for CI/headless. Interactive agents on MCP should
+ * prefer `cliCredentialBootstrap` → `auth bootstrap` instead.
  */
 export declare function apiTokenMintInstructions(): string;
+/** Preferred interactive path for agents already on Kody MCP (ADR 0056). */
+export declare function cliBootstrapInstructions(): string;
 /** Token-only Open API paths (search / whoami / cloud token execute) with no token. */
 export declare function missingApiTokenMessage(purpose: string): string;
 /**
- * `execute --local` with neither `--token` / `KODY_API_TOKEN` nor `kody login`.
+ * `execute --local` with neither env/`--token`, stored bootstrap token, nor
+ * `kody login`. Prefer bootstrap (MCP) → login → tokenCreate (CI).
  */
 export declare function missingLocalExecuteAuthMessage(purpose?: string): string;
 /** Cloud search / whoami / execute when the process has neither a session nor a token. */
@@ -32,7 +53,7 @@ export declare function insufficientScopeMessage(input: {
 export declare function featureDisabledMessage(): string;
 export declare function requireApiToken(values?: {
     token?: string;
-}, env?: NodeJS.ProcessEnv, purpose?: string): string;
+}, env?: NodeJS.ProcessEnv, purpose?: string, options?: Omit<ResolveScopedApiTokenInput, 'tokenValues' | 'env'>): string;
 /** True when the user passed `--token` (not only the env var). */
 export declare function hasExplicitTokenFlag(values: {
     token?: string;

package/dist/api-token.js

@@ -1,4 +1,5 @@
-import { apiTokenEnvVar } from './defaults.js';
+import { loadStoredApiToken } from './api-token-store.js';
+import { apiTokenEnvVar, defaultApiUrl } from './defaults.js';
 /** Platform tracking for login OAuth as CapabilityProxy / package-graph Bearer. */
 export const localExecuteOauthPlatformIssueUrl = 'https://github.com/kentcdodds/kody/issues/2812';
 /**
@@ -9,30 +10,47 @@ export function readApiToken(values = {}, env = process.env) {
     const token = (values.token ?? env[apiTokenEnvVar] ?? '').trim();
     return token.length > 0 ? token : null;
 }
+/**
+ * Resolve a scoped API token without falling back to `kody login` OAuth.
+ * Priority: `--token` / `KODY_API_TOKEN` → stored bootstrap/API token.
+ */
+export function resolveScopedApiToken(input = {}) {
+    const token = readApiToken(input.tokenValues, input.env);
+    if (token)
+        return token;
+    const apiUrl = input.apiUrl || defaultApiUrl;
+    const loadApi = input.loadApiToken ?? loadStoredApiToken;
+    return loadApi(apiUrl, input.apiTokenBackend, input.apiTokenResolution)?.token ?? null;
+}
 /** True when the bearer looks like a minted Open API token (not MCP OAuth). */
 export function isScopedApiToken(token) {
     return token.startsWith('kody_at_');
 }
 /**
- * How to mint the scoped token this CLI already accepts. There is no second
- * auth flow here — callers use the MCP `api` tool they already have.
+ * How to mint a scoped token for CI/headless. Interactive agents on MCP should
+ * prefer `cliCredentialBootstrap` → `auth bootstrap` instead.
  */
 export function apiTokenMintInstructions() {
     return `Mint one with the Kody MCP \`api\` tool \`tokenCreate\` (include the \`local-execute\` scope plus the capability scopes this command needs) and pass --token or set ${apiTokenEnvVar}.`;
 }
+/** Preferred interactive path for agents already on Kody MCP (ADR 0056). */
+export function cliBootstrapInstructions() {
+    return `From MCP, call \`cliCredentialBootstrap\` (MCP \`api\` / \`kody.cliCredentialBootstrap\`), then run \`npx @kodycodes/cli auth bootstrap --code <kody_bc_…>\``;
+}
 /** Token-only Open API paths (search / whoami / cloud token execute) with no token. */
 export function missingApiTokenMessage(purpose) {
-    return `${purpose} needs a scoped Kody API token. ${apiTokenMintInstructions()}`;
+    return `${purpose} needs a scoped Kody API token. ${cliBootstrapInstructions()}, or ${apiTokenMintInstructions()}`;
 }
 /**
- * `execute --local` with neither `--token` / `KODY_API_TOKEN` nor `kody login`.
+ * `execute --local` with neither env/`--token`, stored bootstrap token, nor
+ * `kody login`. Prefer bootstrap (MCP) → login → tokenCreate (CI).
  */
 export function missingLocalExecuteAuthMessage(purpose = 'execute --local') {
-    return `${purpose} needs auth. Run \`kody login\`, or ${apiTokenMintInstructions()}`;
+    return `${purpose} needs auth. ${cliBootstrapInstructions()}; or run \`kody login\`; or for CI/headless, ${apiTokenMintInstructions()}`;
 }
 /** Cloud search / whoami / execute when the process has neither a session nor a token. */
 export function missingCliAuthMessage() {
-    return `Not logged in, and no API token is set. ${apiTokenMintInstructions()} Or run \`kody login\` for browser OAuth (search, whoami, cloud execute, and login-backed \`execute --local\`).`;
+    return `Not logged in, and no API token is set. ${cliBootstrapInstructions()}; or run \`kody login\` for browser OAuth (search, whoami, cloud execute, and login-backed \`execute --local\`); or for CI/headless, ${apiTokenMintInstructions()}`;
 }
 /** 401 when CapabilityProxy rejected a non-`kody_at_` bearer (typically CLI OAuth). */
 export function rejectedOauthBearerMessage() {
@@ -50,8 +68,12 @@ export function insufficientScopeMessage(input) {
 export function featureDisabledMessage() {
     return 'Kody returned feature_disabled: CapabilityProxy is not enabled for this Kody account (feature flag `local-execute`). `execute --local` and token-auth cloud execute both stop here; minting another token does not bypass the flag. Browser `kody login` can still run cloud execute over MCP.';
 }
-export function requireApiToken(values = {}, env = process.env, purpose = 'this command') {
-    const token = readApiToken(values, env);
+export function requireApiToken(values = {}, env = process.env, purpose = 'this command', options = {}) {
+    const token = resolveScopedApiToken({
+        tokenValues: values,
+        env,
+        ...options,
+    });
     if (!token)
         throw new Error(missingApiTokenMessage(purpose));
     return token;

package/dist/api-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token.js","sourceRoot":"","sources":["../src/api-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,mFAAmF;AACnF,MAAM,CAAC,MAAM,iCAAiC,GAC7C,gDAAgD,CAAA;AAEjD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC3B,SAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAChE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACvC,OAAO,uKAAuK,cAAc,GAAG,CAAA;AAChM,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACrD,OAAO,GAAG,OAAO,mCAAmC,wBAAwB,EAAE,EAAE,CAAA;AACjF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAC7C,UAAkB,iBAAiB;IAEnC,OAAO,GAAG,OAAO,uCAAuC,wBAAwB,EAAE,EAAE,CAAA;AACrF,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,qBAAqB;IACpC,OAAO,2CAA2C,wBAAwB,EAAE,iHAAiH,CAAA;AAC9L,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,0BAA0B;IACzC,OAAO,yKAAyK,iCAAiC,uBAAuB,wBAAwB,EAAE,EAAE,CAAA;AACrQ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAIxC;IACA,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5F,MAAM,IAAI,GAAG,KAAK,CAAC,mBAAmB;QACrC,CAAC,CAAC,wBAAwB,EAAE;QAC5B,CAAC,CAAC,8DACA,KAAK,CAAC,aAAa;YAClB,CAAC,CAAC,mBAAmB,KAAK,CAAC,aAAa,GAAG;YAC3C,CAAC,CAAC,mCACJ,8BAA8B,cAAc,GAAG,CAAA;IACjD,OAAO,oCAAoC,QAAQ,IAAI,IAAI,EAAE,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,OAAO,gSAAgS,CAAA;AACxS,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,SAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAkB,cAAc;IAEhC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5D,OAAO,KAAK,CAAA;AACb,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC9D,OAAO,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC1E,CAAC"}
+{"version":3,"file":"api-token.js","sourceRoot":"","sources":["../src/api-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAG7D,mFAAmF;AACnF,MAAM,CAAC,MAAM,iCAAiC,GAC7C,gDAAgD,CAAA;AAYjD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC3B,SAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAChE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACpC,QAAoC,EAAE;IAEtC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACxD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAA;IACxD,OAAO,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,KAAK,IAAI,IAAI,CAAA;AACvF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACvC,OAAO,uKAAuK,cAAc,GAAG,CAAA;AAChM,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,wBAAwB;IACvC,OAAO,8JAA8J,CAAA;AACtK,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACrD,OAAO,GAAG,OAAO,mCAAmC,wBAAwB,EAAE,QAAQ,wBAAwB,EAAE,EAAE,CAAA;AACnH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC7C,UAAkB,iBAAiB;IAEnC,OAAO,GAAG,OAAO,gBAAgB,wBAAwB,EAAE,gDAAgD,wBAAwB,EAAE,EAAE,CAAA;AACxI,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,qBAAqB;IACpC,OAAO,2CAA2C,wBAAwB,EAAE,wIAAwI,wBAAwB,EAAE,EAAE,CAAA;AACjP,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,0BAA0B;IACzC,OAAO,yKAAyK,iCAAiC,uBAAuB,wBAAwB,EAAE,EAAE,CAAA;AACrQ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAIxC;IACA,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5F,MAAM,IAAI,GAAG,KAAK,CAAC,mBAAmB;QACrC,CAAC,CAAC,wBAAwB,EAAE;QAC5B,CAAC,CAAC,8DACA,KAAK,CAAC,aAAa;YAClB,CAAC,CAAC,mBAAmB,KAAK,CAAC,aAAa,GAAG;YAC3C,CAAC,CAAC,mCACJ,8BAA8B,cAAc,GAAG,CAAA;IACjD,OAAO,oCAAoC,QAAQ,IAAI,IAAI,EAAE,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,OAAO,gSAAgS,CAAA;AACxS,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,SAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAkB,cAAc,EAChC,UAAmE,EAAE;IAErE,MAAM,KAAK,GAAG,qBAAqB,CAAC;QACnC,WAAW,EAAE,MAAM;QACnB,GAAG;QACH,GAAG,OAAO;KACV,CAAC,CAAA;IACF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5D,OAAO,KAAK,CAAA;AACb,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC9D,OAAO,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC1E,CAAC"}

package/dist/auth-bootstrap.d.ts

@@ -0,0 +1,51 @@
+import { type StoredApiToken } from './api-token-store.js';
+import type { SecretBackend, StoreResolution } from './store.js';
+/** ADR 0056 one-shot bootstrap code prefix (`kody_bc_…`). */
+export declare const cliBootstrapCodePrefix = "kody_bc_";
+export declare const bootstrapRedeemPath = "v1/tokens/bootstrap/redeem";
+export type BootstrapRedeemResponse = {
+    token: string;
+    token_type?: string;
+    id: string;
+    name?: string | null;
+    scopes?: Array<string>;
+    status?: string;
+    idle_ttl_seconds?: number;
+    expires_at?: string | null;
+    max_expires_at?: string | null;
+    created_via?: string;
+};
+export declare function parseCliBootstrapCode(value: string): {
+    codeId: string;
+    secret: string;
+} | null;
+export declare function assertCliBootstrapCode(code: string): string;
+/**
+ * POST /v1/tokens/bootstrap/redeem with JSON `{ code }` and **no** Authorization
+ * header (ADR 0056). Returns the minted `kody_at_…` once.
+ */
+export declare function redeemBootstrapCode(input: {
+    code: string;
+    apiUrl?: string;
+    fetchFn?: typeof fetch;
+}): Promise<BootstrapRedeemResponse>;
+export declare function storedApiTokenFromRedeem(input: {
+    apiUrl: string;
+    redeemed: BootstrapRedeemResponse;
+}): StoredApiToken;
+/**
+ * Redeem a one-shot `kody_bc_…` and persist the resulting API token for
+ * `execute --local`. Never returns the token string to callers that print
+ * success output — use `stored.tokenId` / backend kind only.
+ */
+export declare function authBootstrap(input: {
+    code: string;
+    apiUrl?: string;
+    fetchFn?: typeof fetch;
+    backend?: SecretBackend;
+    resolution?: StoreResolution;
+}): Promise<{
+    stored: StoredApiToken;
+    backendKind: SecretBackend['kind'];
+    backendPath?: string;
+}>;

package/dist/auth-bootstrap.js

@@ -0,0 +1,157 @@
+import { assertTokenSafeApiUrl, capabilityProxyUrl } from './capability-proxy.js';
+import { cliName, defaultApiUrl } from './defaults.js';
+import { describeNetworkError } from './network-error.js';
+import { readPackageVersion } from './package-info.js';
+import { saveStoredApiToken, } from './api-token-store.js';
+/** ADR 0056 one-shot bootstrap code prefix (`kody_bc_…`). */
+export const cliBootstrapCodePrefix = 'kody_bc_';
+/** Platform shape: `kody_bc_<16 alnum>_<32 base64url>`. */
+const bootstrapCodePattern = /^kody_bc_([a-z0-9]{16})_([A-Za-z0-9_-]{32})$/;
+export const bootstrapRedeemPath = 'v1/tokens/bootstrap/redeem';
+export function parseCliBootstrapCode(value) {
+    const match = bootstrapCodePattern.exec(value.trim());
+    if (!match)
+        return null;
+    const [, codeId, secret] = match;
+    if (!codeId || !secret)
+        return null;
+    return { codeId, secret };
+}
+export function assertCliBootstrapCode(code) {
+    const trimmed = code.trim();
+    if (!parseCliBootstrapCode(trimmed)) {
+        throw new Error(`Invalid bootstrap code. Expected a one-shot ${cliBootstrapCodePrefix}… from cliCredentialBootstrap (MCP api / kody.cliCredentialBootstrap).`);
+    }
+    return trimmed;
+}
+/**
+ * POST /v1/tokens/bootstrap/redeem with JSON `{ code }` and **no** Authorization
+ * header (ADR 0056). Returns the minted `kody_at_…` once.
+ */
+export async function redeemBootstrapCode(input) {
+    const code = assertCliBootstrapCode(input.code);
+    const apiUrl = input.apiUrl || defaultApiUrl;
+    assertTokenSafeApiUrl(apiUrl);
+    const url = capabilityProxyUrl(apiUrl, bootstrapRedeemPath);
+    const fetchFn = input.fetchFn ?? fetch;
+    let response;
+    try {
+        response = await fetchFn(url, {
+            method: 'POST',
+            headers: {
+                accept: 'application/json',
+                'content-type': 'application/json',
+                'user-agent': `${cliName}/${readPackageVersion()}`,
+            },
+            body: JSON.stringify({ code }),
+        });
+    }
+    catch (error) {
+        const reason = describeNetworkError(error);
+        throw new Error(`Could not reach the Kody API at ${url.origin} (${reason}). Check --api-url / KODY_API_URL and your network.`);
+    }
+    const body = await readJson(response);
+    if (!response.ok) {
+        throw describeRedeemFailure(response.status, body, url);
+    }
+    return parseRedeemResponse(body);
+}
+export function storedApiTokenFromRedeem(input) {
+    const token = input.redeemed.token.trim();
+    if (!token.startsWith('kody_at_')) {
+        throw new Error('Bootstrap redeem did not return a scoped kody_at_… API token.');
+    }
+    return {
+        version: 1,
+        apiUrl: input.apiUrl,
+        token,
+        tokenId: input.redeemed.id,
+        ...(input.redeemed.name ? { name: input.redeemed.name } : {}),
+        ...(Array.isArray(input.redeemed.scopes) ? { scopes: input.redeemed.scopes } : {}),
+        expiresAt: input.redeemed.expires_at ?? null,
+        maxExpiresAt: input.redeemed.max_expires_at ?? null,
+        createdVia: input.redeemed.created_via ?? 'cli-bootstrap',
+    };
+}
+/**
+ * Redeem a one-shot `kody_bc_…` and persist the resulting API token for
+ * `execute --local`. Never returns the token string to callers that print
+ * success output — use `stored.tokenId` / backend kind only.
+ */
+export async function authBootstrap(input) {
+    const apiUrl = input.apiUrl || defaultApiUrl;
+    const redeemed = await redeemBootstrapCode({
+        code: input.code,
+        apiUrl,
+        fetchFn: input.fetchFn,
+    });
+    const stored = storedApiTokenFromRedeem({ apiUrl, redeemed });
+    const saved = saveStoredApiToken(stored, input.backend, input.resolution);
+    return {
+        stored,
+        backendKind: saved.backend.kind,
+        ...(saved.backend.path ? { backendPath: saved.backend.path } : {}),
+    };
+}
+function parseRedeemResponse(body) {
+    if (!isRecord(body) || typeof body.token !== 'string' || typeof body.id !== 'string') {
+        throw new Error('Bootstrap redeem returned an unexpected response.');
+    }
+    return {
+        token: body.token,
+        token_type: typeof body.token_type === 'string' ? body.token_type : undefined,
+        id: body.id,
+        name: typeof body.name === 'string' ? body.name : null,
+        scopes: Array.isArray(body.scopes)
+            ? body.scopes.filter((scope) => typeof scope === 'string')
+            : undefined,
+        status: typeof body.status === 'string' ? body.status : undefined,
+        idle_ttl_seconds: typeof body.idle_ttl_seconds === 'number' ? body.idle_ttl_seconds : undefined,
+        expires_at: typeof body.expires_at === 'string' ? body.expires_at : null,
+        max_expires_at: typeof body.max_expires_at === 'string' ? body.max_expires_at : null,
+        created_via: typeof body.created_via === 'string' ? body.created_via : undefined,
+    };
+}
+function describeRedeemFailure(status, body, url) {
+    const failure = readErrorBody(body);
+    const detail = failure?.message ? ` Server said: ${failure.message}` : '';
+    if (status === 400 || status === 401 || status === 403 || status === 404) {
+        return new Error(`Bootstrap redeem failed (HTTP ${status}). The code may be invalid, expired, or already used. Call cliCredentialBootstrap again for a fresh code.${detail}`);
+    }
+    return new Error(failure?.message ??
+        `Bootstrap redeem failed with HTTP ${status} (${url.pathname}).${detail}`);
+}
+async function readJson(response) {
+    const text = await response.text();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function readErrorBody(body) {
+    if (!isRecord(body) || body.error == null) {
+        if (typeof body === 'string' && body.trim())
+            return { code: null, message: body };
+        if (isRecord(body) && typeof body.message === 'string') {
+            return { code: null, message: body.message };
+        }
+        return null;
+    }
+    const { error } = body;
+    if (typeof error === 'string')
+        return { code: null, message: error };
+    if (isRecord(error)) {
+        const code = typeof error.code === 'string' ? error.code : null;
+        const message = typeof error.message === 'string' ? error.message : code ?? JSON.stringify(error);
+        return { code, message };
+    }
+    return { code: null, message: String(error) };
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=auth-bootstrap.js.map

package/dist/auth-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bootstrap.js","sourceRoot":"","sources":["../src/auth-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EACN,kBAAkB,GAElB,MAAM,sBAAsB,CAAA;AAG7B,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAA;AAEhD,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,8CAA8C,CAAA;AAE3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAA;AAe/D,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAClD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;IAChC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACnC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACd,+CAA+C,sBAAsB,wEAAwE,CAC7I,CAAA;IACF,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAIzC;IACA,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAA;IACtC,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,GAAG,OAAO,IAAI,kBAAkB,EAAE,EAAE;aAClD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC9B,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QAC1C,MAAM,IAAI,KAAK,CACd,mCAAmC,GAAG,CAAC,MAAM,KAAK,MAAM,qDAAqD,CAC7G,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,qBAAqB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAGxC;IACA,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;IACzC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IACjF,CAAC;IACD,OAAO;QACN,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;QAC1B,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI;QAC5C,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,IAAI,IAAI;QACnD,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe;KACzD,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAMnC;IAKA,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;KACtB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IACzE,OAAO;QACN,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;QAC/B,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAA;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACrE,CAAC;IACD,OAAO;QACN,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC7E,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACtD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC3E,CAAC,CAAC,SAAS;QACZ,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACjE,gBAAgB,EACf,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QAC9E,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QACxE,cAAc,EAAE,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QACpF,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;KAChF,CAAA;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc,EAAE,IAAa,EAAE,GAAQ;IACrE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1E,OAAO,IAAI,KAAK,CACf,iCAAiC,MAAM,4GAA4G,MAAM,EAAE,CAC3J,CAAA;IACF,CAAC;IACD,OAAO,IAAI,KAAK,CACf,OAAO,EAAE,OAAO;QACf,qCAAqC,MAAM,KAAK,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAC1E,CAAA;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QACjF,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;QAC7C,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACpE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/D,MAAM,OAAO,GACZ,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAClF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACzB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC"}

package/dist/cli.d.ts

@@ -1,6 +1,8 @@
-export { readApiToken, requireApiToken as resolveApiToken } from './api-token.js';
+import { resolveScopedApiToken } from './api-token.js';
+export { readApiToken, requireApiToken as resolveApiToken, resolveScopedApiToken, } from './api-token.js';
 export { resolveLocalExecuteBearer } from './local-execute-auth.js';
-export type CommandName = 'login' | 'logout' | 'status' | 'whoami' | 'search' | 'execute' | 'install' | 'skill' | 'help' | 'version';
+export { authBootstrap, redeemBootstrapCode } from './auth-bootstrap.js';
+export type CommandName = 'login' | 'logout' | 'status' | 'auth' | 'whoami' | 'search' | 'execute' | 'install' | 'skill' | 'help' | 'version';
 export declare function apiUrlFrom(values: {
     apiUrl?: string;
 }, env?: NodeJS.ProcessEnv): string;
@@ -58,9 +60,10 @@ export declare function buildExecuteToolArgs(input: {
 }): Record<string, unknown>;
 /**
  * Prefer a scoped API token when the user passed `--token`, or when
- * `KODY_API_TOKEN` is set and there is no stored `kody login` session.
- * Logged-in MCP OAuth still wins over an env-only token so a leftover
- * `KODY_API_TOKEN` does not hijack cloud MCP commands.
+ * `KODY_API_TOKEN` / a stored bootstrap token is available and there is no
+ * stored `kody login` session. Logged-in MCP OAuth still wins over an
+ * env-only or stored token so a leftover token does not hijack cloud MCP
+ * commands.
  */
 export declare function shouldUseApiToken(input: {
     tokenValues: {
@@ -69,6 +72,9 @@ export declare function shouldUseApiToken(input: {
     mcpUrl: string;
     allowEnvWithoutLogin: boolean;
     env?: NodeJS.ProcessEnv;
+    apiUrl?: string;
     /** Override session detection (tests). */
     hasSession?: boolean;
+    /** Test seam for stored bootstrap/API token lookup. */
+    loadApiToken?: NonNullable<Parameters<typeof resolveScopedApiToken>[0]>['loadApiToken'];
 }): boolean;

package/dist/cli.js

@@ -1,6 +1,8 @@
 import { parseArgs } from 'node:util';
 import { readFile } from 'node:fs/promises';
-import { hasExplicitTokenFlag, readApiToken, requireApiToken, } from './api-token.js';
+import { hasExplicitTokenFlag, requireApiToken, resolveScopedApiToken, } from './api-token.js';
+import { deleteStoredApiToken, loadStoredApiToken, } from './api-token-store.js';
+import { authBootstrap } from './auth-bootstrap.js';
 import { defaultApiUrl, defaultMcpUrl, modernMcpProtocolVersion } from './defaults.js';
 import { usage } from './help.js';
 import { ensureFreshCredentials, login } from './auth.js';
@@ -15,8 +17,9 @@ import { runRemoteExecuteWithToken } from './remote-execute.js';
 import { installSkill } from './skill.js';
 import { readPackageVersion } from './package-info.js';
 import { redactError } from './redact.js';
-export { readApiToken, requireApiToken as resolveApiToken } from './api-token.js';
+export { readApiToken, requireApiToken as resolveApiToken, resolveScopedApiToken, } from './api-token.js';
 export { resolveLocalExecuteBearer } from './local-execute-auth.js';
+export { authBootstrap, redeemBootstrapCode } from './auth-bootstrap.js';
 function mcpUrlFrom(values) {
     return values.mcpUrl || process.env.KODY_MCP_URL || defaultMcpUrl;
 }
@@ -66,6 +69,7 @@ export function resolveCommand(argv) {
         case 'login':
         case 'logout':
         case 'status':
+        case 'auth':
         case 'whoami':
         case 'search':
         case 'execute':
@@ -125,39 +129,103 @@ async function dispatch(parsed, write, writeErr) {
             return 0;
         }
         case 'logout': {
-            const result = deleteCredentials(mcpUrl);
-            write(result.deleted ? 'Logged out.\n' : 'No stored credentials.\n');
+            const apiUrl = apiUrlFrom({
+                apiUrl: typeof parsed.values['api-url'] === 'string'
+                    ? parsed.values['api-url']
+                    : undefined,
+            });
+            const oauth = deleteCredentials(mcpUrl);
+            const apiToken = deleteStoredApiToken(apiUrl);
+            if (!oauth.deleted && !apiToken.deleted) {
+                write('No stored credentials.\n');
+                return 0;
+            }
+            const parts = [];
+            if (oauth.deleted)
+                parts.push('Logged out of kody login.');
+            if (apiToken.deleted)
+                parts.push('Cleared stored bootstrap/API token.');
+            write(`${parts.join(' ')}\n`);
             return 0;
         }
         case 'status': {
+            const apiUrl = apiUrlFrom({
+                apiUrl: typeof parsed.values['api-url'] === 'string'
+                    ? parsed.values['api-url']
+                    : undefined,
+            });
             const credentials = loadCredentials(mcpUrl);
-            if (!credentials) {
+            const storedApi = loadStoredApiToken(apiUrl);
+            if (!credentials && !storedApi) {
                 write('Not logged in.\n');
                 return 1;
             }
-            const expires = credentials.expiresAt
-                ? new Date(credentials.expiresAt).toISOString()
-                : 'unknown';
+            const lines = [];
+            if (credentials) {
+                const expires = credentials.expiresAt
+                    ? new Date(credentials.expiresAt).toISOString()
+                    : 'unknown';
+                lines.push(`mcp: ${credentials.mcpUrl}`, `logged in: yes`, `access token expires: ${expires}`, `refresh token: ${credentials.refreshToken ? 'yes' : 'no'}`, `scope: ${credentials.scope ?? 'unknown'}`);
+            }
+            else {
+                lines.push(`mcp: ${mcpUrl}`, `logged in: no`);
+            }
+            if (storedApi) {
+                const scopes = storedApi.scopes?.join(', ') || '(unknown)';
+                lines.push(`api: ${storedApi.apiUrl}`, `stored API token: yes (${storedApi.tokenId})`, `API token scopes: ${scopes}`, `API token expires: ${storedApi.expiresAt ?? 'unknown'}`, `API token via: ${storedApi.createdVia ?? 'unknown'}`);
+            }
+            else {
+                lines.push(`api: ${apiUrl}`, `stored API token: no`);
+            }
+            lines.push('');
+            write(lines.join('\n'));
+            return 0;
+        }
+        case 'auth': {
+            const action = parsed.positionals[0];
+            if (action !== 'bootstrap') {
+                throw new Error('Usage: kody auth bootstrap --code <kody_bc_…> [--api-url <url>]');
+            }
+            const code = typeof parsed.values.code === 'string' ? parsed.values.code.trim() : '';
+            if (!code) {
+                throw new Error('Provide --code <kody_bc_…> from cliCredentialBootstrap (MCP api / kody.cliCredentialBootstrap).');
+            }
+            const apiUrl = apiUrlFrom({
+                apiUrl: typeof parsed.values['api-url'] === 'string'
+                    ? parsed.values['api-url']
+                    : undefined,
+            });
+            const result = await authBootstrap({ code, apiUrl });
+            const scopes = result.stored.scopes?.join(', ') || '(none)';
             write([
-                `mcp: ${credentials.mcpUrl}`,
-                `logged in: yes`,
-                `access token expires: ${expires}`,
-                `refresh token: ${credentials.refreshToken ? 'yes' : 'no'}`,
-                `scope: ${credentials.scope ?? 'unknown'}`,
+                `Bootstrap API token stored for execute --local, search, whoami, and token-auth cloud execute.`,
+                `api: ${result.stored.apiUrl}`,
+                `token id: ${result.stored.tokenId}`,
+                `scopes: ${scopes}`,
+                `expires: ${result.stored.expiresAt ?? 'unknown'}`,
+                result.backendKind === 'file' && result.backendPath
+                    ? `OS keychain was unavailable; token saved at ${result.backendPath} (mode 0600).`
+                    : 'Token stored in the OS keychain.',
                 '',
             ].join('\n'));
             return 0;
         }
         case 'whoami': {
             const tokenValues = tokenFlagValues(parsed.values);
-            if (shouldUseApiToken({ tokenValues, mcpUrl, allowEnvWithoutLogin: true })) {
+            const apiUrl = apiUrlFrom({
+                apiUrl: typeof parsed.values['api-url'] === 'string'
+                    ? parsed.values['api-url']
+                    : undefined,
+            });
+            if (shouldUseApiToken({
+                tokenValues,
+                mcpUrl,
+                apiUrl,
+                allowEnvWithoutLogin: true,
+            })) {
                 const identity = await whoamiWithApiToken({
-                    token: requireApiToken(tokenValues, process.env, 'whoami'),
-                    apiUrl: apiUrlFrom({
-                        apiUrl: typeof parsed.values['api-url'] === 'string'
-                            ? parsed.values['api-url']
-                            : undefined,
-                    }),
+                    token: requireApiToken(tokenValues, process.env, 'whoami', { apiUrl }),
+                    apiUrl,
                 });
                 if (json) {
                     write(`${JSON.stringify(identity, null, 2)}\n`);
@@ -194,14 +262,20 @@ async function dispatch(parsed, write, writeErr) {
         case 'search': {
             const query = parsed.positionals.join(' ').trim();
             const tokenValues = tokenFlagValues(parsed.values);
-            if (shouldUseApiToken({ tokenValues, mcpUrl, allowEnvWithoutLogin: true })) {
+            const apiUrl = apiUrlFrom({
+                apiUrl: typeof parsed.values['api-url'] === 'string'
+                    ? parsed.values['api-url']
+                    : undefined,
+            });
+            if (shouldUseApiToken({
+                tokenValues,
+                mcpUrl,
+                apiUrl,
+                allowEnvWithoutLogin: true,
+            })) {
                 const result = await searchWithApiToken({
-                    token: requireApiToken(tokenValues, process.env, 'search'),
-                    apiUrl: apiUrlFrom({
-                        apiUrl: typeof parsed.values['api-url'] === 'string'
-                            ? parsed.values['api-url']
-                            : undefined,
-                    }),
+                    token: requireApiToken(tokenValues, process.env, 'search', { apiUrl }),
+                    apiUrl,
                     query: query || undefined,
                     entity: typeof parsed.values.entity === 'string' ? parsed.values.entity : undefined,
                     domain: typeof parsed.values.domain === 'string' ? parsed.values.domain : undefined,
@@ -266,6 +340,7 @@ async function dispatch(parsed, write, writeErr) {
                 shouldUseApiToken({
                     tokenValues,
                     mcpUrl,
+                    apiUrl,
                     allowEnvWithoutLogin: true,
                 });
             const result = local
@@ -276,6 +351,7 @@ async function dispatch(parsed, write, writeErr) {
                     token: await resolveLocalExecuteBearer({
                         tokenValues,
                         mcpUrl,
+                        apiUrl,
                         purpose: 'execute --local',
                     }),
                     apiUrl,
@@ -287,7 +363,7 @@ async function dispatch(parsed, write, writeErr) {
                         invoke,
                         params: args.params,
                         conversationId: args.conversationId,
-                        token: requireApiToken(tokenValues, process.env, 'execute with an API token'),
+                        token: requireApiToken(tokenValues, process.env, 'execute with an API token', { apiUrl }),
                         apiUrl,
                     })
                     : await callKodyTool({ name: 'execute', args, mcpUrl });
@@ -368,17 +444,24 @@ function tokenFlagValues(values) {
 }
 /**
  * Prefer a scoped API token when the user passed `--token`, or when
- * `KODY_API_TOKEN` is set and there is no stored `kody login` session.
- * Logged-in MCP OAuth still wins over an env-only token so a leftover
- * `KODY_API_TOKEN` does not hijack cloud MCP commands.
+ * `KODY_API_TOKEN` / a stored bootstrap token is available and there is no
+ * stored `kody login` session. Logged-in MCP OAuth still wins over an
+ * env-only or stored token so a leftover token does not hijack cloud MCP
+ * commands.
  */
 export function shouldUseApiToken(input) {
     if (hasExplicitTokenFlag(input.tokenValues))
         return true;
     if (!input.allowEnvWithoutLogin)
         return false;
-    if (!readApiToken(input.tokenValues, input.env))
+    if (!resolveScopedApiToken({
+        tokenValues: input.tokenValues,
+        env: input.env,
+        apiUrl: input.apiUrl,
+        loadApiToken: input.loadApiToken,
+    })) {
         return false;
+    }
     const loggedIn = input.hasSession ?? loadCredentials(input.mcpUrl) != null;
     return !loggedIn;
 }

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EACN,oBAAoB,EACpB,YAAY,EACZ,eAAe,GACf,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AACtF,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,EAAE,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAcnE,SAAS,UAAU,CAAC,MAA2B;IAC9C,OAAO,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,aAAa,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,UAAU,CACzB,MAA2B,EAC3B,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,YAAY,IAAI,aAAa,CAAA;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,IAAmB;IACtC,OAAO,SAAS,CAAC;QAChB,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACR,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACxC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACrC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACpC;KACD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAmB;IAKjD,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAChD,IAAI,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAC1B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IACzD,QAAQ,GAAG,EAAE,CAAC;QACb,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,SAAS,CAAC;QACf,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACb,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAA;QACnE;YACC,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,SAAS,KAAK,EAAE,CAAC,CAAA;IAC1D,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC3B,OAAsB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAC3C,KAA2E,EAAE;IAE7E,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACzE,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5E,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YACrD,KAAK,CAAC,KAAK,CAAC,CAAA;YACZ,OAAO,CAAC,CAAA;QACT,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,QAAQ,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAA;QAC3C,OAAO,CAAC,CAAA;IACT,CAAC;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CACtB,MAAyC,EACzC,KAA6B,EAC7B,QAAgC;IAEhC,MAAM,MAAM,GAAG,UAAU,CAAC;QACzB,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;KAC3F,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAA;IAExC,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM;YACV,KAAK,CAAC,KAAK,CAAC,CAAA;YACZ,OAAO,CAAC,CAAA;QACT,KAAK,SAAS;YACb,KAAK,CAAC,GAAG,kBAAkB,EAAE,IAAI,CAAC,CAAA;YAClC,OAAO,CAAC,CAAA;QACT,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,KAAK,CAAC,gDAAgD,CAAC,CAAA;YACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;gBAC1B,MAAM;gBACN,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,IAAI;gBACjD,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;oBAC3B,KAAK,CAAC,yCAAyC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAA;gBAC7D,CAAC;aACD,CAAC,CAAA;YACF,KAAK,CAAC,gBAAgB,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAA;YACrD,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACzD,KAAK,CACJ,qDAAqD,MAAM,CAAC,WAAW,iBAAiB,CACxF,CAAA;YACF,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,0CAA0C,CAAC,CAAA;YAClD,CAAC;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;YACxC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAA;YACpE,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;YAC3C,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,KAAK,CAAC,kBAAkB,CAAC,CAAA;gBACzB,OAAO,CAAC,CAAA;YACT,CAAC;YACD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS;gBACpC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;gBAC/C,CAAC,CAAC,SAAS,CAAA;YACZ,KAAK,CACJ;gBACC,QAAQ,WAAW,CAAC,MAAM,EAAE;gBAC5B,gBAAgB;gBAChB,yBAAyB,OAAO,EAAE;gBAClC,kBAAkB,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;gBAC3D,UAAU,WAAW,CAAC,KAAK,IAAI,SAAS,EAAE;gBAC1C,EAAE;aACF,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAA;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAClD,IAAI,iBAAiB,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5E,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC;oBACzC,KAAK,EAAE,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC;oBAC1D,MAAM,EAAE,UAAU,CAAC;wBAClB,MAAM,EACL,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ;4BAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;4BAC1B,CAAC,CAAC,SAAS;qBACb,CAAC;iBACF,CAAC,CAAA;gBACF,IAAI,IAAI,EAAE,CAAC;oBACV,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;oBAC/C,OAAO,CAAC,CAAA;gBACT,CAAC;gBACD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAA;gBAC9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI;oBAC7B,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG;oBACzD,CAAC,CAAC,kCAAkC,CAAA;gBACrC,KAAK,CACJ;oBACC,QAAQ,QAAQ,CAAC,MAAM,EAAE;oBACzB,oBAAoB,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG;oBACxC,SAAS,QAAQ,EAAE;oBACnB,WAAW,SAAS,EAAE;oBACtB,YAAY,QAAQ,CAAC,KAAK,CAAC,SAAS,IAAI,SAAS,EAAE;oBACnD,EAAE;iBACF,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAA;gBACD,OAAO,CAAC,CAAA;YACT,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;YAC5D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;YAC7C,IAAI,IAAI,EAAE,CAAC;gBACV,KAAK,CACJ,GAAG,IAAI,CAAC,SAAS,CAChB;oBACC,MAAM,EAAE,WAAW,CAAC,MAAM;oBAC1B,QAAQ,EAAE,wBAAwB;oBAClC,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,IAAI;oBAChC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;iBACrC,EACD,IAAI,EACJ,CAAC,CACD,IAAI,CACL,CAAA;gBACD,OAAO,CAAC,CAAA;YACT,CAAC;YACD,KAAK,CACJ,gBAAgB,WAAW,CAAC,MAAM,KAAK,wBAAwB,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI,CACrI,CAAA;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;YACjD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAClD,IAAI,iBAAiB,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5E,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;oBACvC,KAAK,EAAE,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC;oBAC1D,MAAM,EAAE,UAAU,CAAC;wBAClB,MAAM,EACL,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ;4BAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;4BAC1B,CAAC,CAAC,SAAS;qBACb,CAAC;oBACF,KAAK,EAAE,KAAK,IAAI,SAAS;oBACzB,MAAM,EACL,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;oBAC5E,MAAM,EACL,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;oBAC5E,KAAK,EACJ,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;wBACtC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;wBAC7B,CAAC,CAAC,SAAS;iBACb,CAAC,CAAA;gBACF,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;gBACrC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC9B,CAAC;YACD,MAAM,IAAI,GAA4B,EAAE,CAAA;YACxC,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;YAC7B,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAA;YAChF,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAA;YAChF,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YACnE,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YACrC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YAChB,MAAM,MAAM,GACX,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5E,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC1D,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;YAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAA;YAC1C,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAClD,IAAI,KAAK,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACd,uHAAuH,CACvH,CAAA;YACF,CAAC;YACD,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CACd,sEAAsE,CACtE,CAAA;YACF,CAAC;YACD,IAAI,KAAK;gBAAE,4BAA4B,EAAE,CAAA;YACzC,MAAM,IAAI,GACT,MAAM,KAAK,SAAS;gBACnB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,WAAW;oBACZ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI;oBACpB,CAAC,CAAC,WAAW;wBACZ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG;4BAC3B,CAAC,CAAC,MAAM,SAAS,EAAE;4BACnB,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAc,EAAE,MAAM,CAAC;wBACvD,CAAC,CAAC,gBAAgB,IAAI,SAAS,CAAA;YACnC,MAAM,IAAI,GAAG,oBAAoB,CAAC;gBACjC,MAAM;gBACN,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBACjD,UAAU,EACT,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC5E,cAAc,EACb,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,QAAQ;oBACnD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;oBAClC,CAAC,CAAC,SAAS;aACb,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,UAAU,CAAC;gBACzB,MAAM,EACL,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ;oBAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;oBAC1B,CAAC,CAAC,SAAS;aACb,CAAC,CAAA;YACF,MAAM,QAAQ,GACb,KAAK;gBACL,iBAAiB,CAAC;oBACjB,WAAW;oBACX,MAAM;oBACN,oBAAoB,EAAE,IAAI;iBAC1B,CAAC,CAAA;YACH,MAAM,MAAM,GAAG,KAAK;gBACnB,CAAC,CAAC,MAAM,eAAe,CAAC;oBACtB,IAAI,EAAE,IAAI,CAAC,IAAc;oBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc,EAAE,IAAI,CAAC,cAAoC;oBACzD,KAAK,EAAE,MAAM,yBAAyB,CAAC;wBACtC,WAAW;wBACX,MAAM;wBACN,OAAO,EAAE,iBAAiB;qBAC1B,CAAC;oBACF,MAAM;oBACN,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,OAAO,IAAI,CAAC;iBAC/C,CAAC;gBACH,CAAC,CAAC,QAAQ;oBACT,CAAC,CAAC,MAAM,yBAAyB,CAAC;wBAChC,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;wBAC3D,MAAM;wBACN,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,cAAc,EAAE,IAAI,CAAC,cAAoC;wBACzD,KAAK,EAAE,eAAe,CACrB,WAAW,EACX,OAAO,CAAC,GAAG,EACX,2BAA2B,CAC3B;wBACD,MAAM;qBACN,CAAC;oBACH,CAAC,CAAC,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YACzD,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YACrC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,UAAU,CAC9B;gBACC,MAAM;gBACN,OAAO,EACN,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAC9E,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI;gBAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI;gBACvC,IAAI;aACJ,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,CACjB,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,CAAA;QACnB,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,SAAS,CAAA;YACjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;YACzD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAA;YAC/E,KAAK,CACJ,iCAAiC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC3G,CAAA;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,UAAU,GAAU,MAAM,CAAC,OAAO,CAAA;YACxC,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QAC5D,CAAC;IACF,CAAC;AACF,CAAC;AAED,KAAK,UAAU,SAAS;IACvB,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC9C,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CAAC,KAKtC;IACA,OAAO,CACN,KAAK,CAAC,MAAM,KAAK,SAAS;QAC1B,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAC7E,CAAA;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACA,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACvB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACvD,CAAC;QACD,OAAO,uBAAuB,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAA;IAClD,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACV,OAAO,uBAAuB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAA;IAChD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,uBAAuB,CAC/B,IAA6B,EAC7B,KAAuD;IAEvD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,MAA+C;IAGvE,OAAO;QACN,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAClE,CAAA;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAOjC;IACA,IAAI,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IACxD,IAAI,CAAC,KAAK,CAAC,oBAAoB;QAAE,OAAO,KAAK,CAAA;IAC7C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,QAAQ,GACb,KAAK,CAAC,UAAU,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAA;IAC1D,OAAO,CAAC,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EACN,oBAAoB,EACpB,eAAe,EACf,qBAAqB,GACrB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACN,oBAAoB,EACpB,kBAAkB,GAClB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AACtF,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,EACN,YAAY,EACZ,eAAe,IAAI,eAAe,EAClC,qBAAqB,GACrB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAexE,SAAS,UAAU,CAAC,MAA2B;IAC9C,OAAO,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,aAAa,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,UAAU,CACzB,MAA2B,EAC3B,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,YAAY,IAAI,aAAa,CAAA;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,IAAmB;IACtC,OAAO,SAAS,CAAC;QAChB,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACR,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACxC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACrC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACpC;KACD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAmB;IAKjD,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAChD,IAAI,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAC1B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;IACzD,QAAQ,GAAG,EAAE,CAAC;QACb,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,SAAS,CAAC;QACf,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACb,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAA;QACnE;YACC,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,SAAS,KAAK,EAAE,CAAC,CAAA;IAC1D,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC3B,OAAsB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAC3C,KAA2E,EAAE;IAE7E,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACzE,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5E,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YACrD,KAAK,CAAC,KAAK,CAAC,CAAA;YACZ,OAAO,CAAC,CAAA;QACT,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,QAAQ,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAA;QAC3C,OAAO,CAAC,CAAA;IACT,CAAC;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CACtB,MAAyC,EACzC,KAA6B,EAC7B,QAAgC;IAEhC,MAAM,MAAM,GAAG,UAAU,CAAC;QACzB,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;KAC3F,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAA;IAExC,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM;YACV,KAAK,CAAC,KAAK,CAAC,CAAA;YACZ,OAAO,CAAC,CAAA;QACT,KAAK,SAAS;YACb,KAAK,CAAC,GAAG,kBAAkB,EAAE,IAAI,CAAC,CAAA;YAClC,OAAO,CAAC,CAAA;QACT,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,KAAK,CAAC,gDAAgD,CAAC,CAAA;YACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;gBAC1B,MAAM;gBACN,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,IAAI;gBACjD,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;oBAC3B,KAAK,CAAC,yCAAyC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAA;gBAC7D,CAAC;aACD,CAAC,CAAA;YACF,KAAK,CAAC,gBAAgB,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAA;YACrD,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACzD,KAAK,CACJ,qDAAqD,MAAM,CAAC,WAAW,iBAAiB,CACxF,CAAA;YACF,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,0CAA0C,CAAC,CAAA;YAClD,CAAC;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,UAAU,CAAC;gBACzB,MAAM,EACL,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ;oBAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;oBAC1B,CAAC,CAAC,SAAS;aACb,CAAC,CAAA;YACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;YACvC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;YAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzC,KAAK,CAAC,0BAA0B,CAAC,CAAA;gBACjC,OAAO,CAAC,CAAA;YACT,CAAC;YACD,MAAM,KAAK,GAAkB,EAAE,CAAA;YAC/B,IAAI,KAAK,CAAC,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;YAC1D,IAAI,QAAQ,CAAC,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;YACvE,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC7B,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,UAAU,CAAC;gBACzB,MAAM,EACL,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ;oBAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;oBAC1B,CAAC,CAAC,SAAS;aACb,CAAC,CAAA;YACF,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;YAC3C,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;YAC5C,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,KAAK,CAAC,kBAAkB,CAAC,CAAA;gBACzB,OAAO,CAAC,CAAA;YACT,CAAC;YACD,MAAM,KAAK,GAAkB,EAAE,CAAA;YAC/B,IAAI,WAAW,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS;oBACpC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;oBAC/C,CAAC,CAAC,SAAS,CAAA;gBACZ,KAAK,CAAC,IAAI,CACT,QAAQ,WAAW,CAAC,MAAM,EAAE,EAC5B,gBAAgB,EAChB,yBAAyB,OAAO,EAAE,EAClC,kBAAkB,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAC3D,UAAU,WAAW,CAAC,KAAK,IAAI,SAAS,EAAE,CAC1C,CAAA;YACF,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,IAAI,CAAC,QAAQ,MAAM,EAAE,EAAE,eAAe,CAAC,CAAA;YAC9C,CAAC;YACD,IAAI,SAAS,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAA;gBAC1D,KAAK,CAAC,IAAI,CACT,QAAQ,SAAS,CAAC,MAAM,EAAE,EAC1B,0BAA0B,SAAS,CAAC,OAAO,GAAG,EAC9C,qBAAqB,MAAM,EAAE,EAC7B,sBAAsB,SAAS,CAAC,SAAS,IAAI,SAAS,EAAE,EACxD,kBAAkB,SAAS,CAAC,UAAU,IAAI,SAAS,EAAE,CACrD,CAAA;YACF,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,IAAI,CAAC,QAAQ,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAA;YACrD,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACd,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YACvB,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;YACpC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACd,iEAAiE,CACjE,CAAA;YACF,CAAC;YACD,MAAM,IAAI,GACT,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YACxE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CACd,iGAAiG,CACjG,CAAA;YACF,CAAC;YACD,MAAM,MAAM,GAAG,UAAU,CAAC;gBACzB,MAAM,EACL,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ;oBAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;oBAC1B,CAAC,CAAC,SAAS;aACb,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YACpD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAA;YAC3D,KAAK,CACJ;gBACC,+FAA+F;gBAC/F,QAAQ,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;gBAC9B,aAAa,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;gBACpC,WAAW,MAAM,EAAE;gBACnB,YAAY,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE;gBAClD,MAAM,CAAC,WAAW,KAAK,MAAM,IAAI,MAAM,CAAC,WAAW;oBAClD,CAAC,CAAC,+CAA+C,MAAM,CAAC,WAAW,eAAe;oBAClF,CAAC,CAAC,kCAAkC;gBACrC,EAAE;aACF,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAA;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAClD,MAAM,MAAM,GAAG,UAAU,CAAC;gBACzB,MAAM,EACL,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ;oBAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;oBAC1B,CAAC,CAAC,SAAS;aACb,CAAC,CAAA;YACF,IACC,iBAAiB,CAAC;gBACjB,WAAW;gBACX,MAAM;gBACN,MAAM;gBACN,oBAAoB,EAAE,IAAI;aAC1B,CAAC,EACD,CAAC;gBACF,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC;oBACzC,KAAK,EAAE,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC;oBACtE,MAAM;iBACN,CAAC,CAAA;gBACF,IAAI,IAAI,EAAE,CAAC;oBACV,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;oBAC/C,OAAO,CAAC,CAAA;gBACT,CAAC;gBACD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAA;gBAC9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI;oBAC7B,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG;oBACzD,CAAC,CAAC,kCAAkC,CAAA;gBACrC,KAAK,CACJ;oBACC,QAAQ,QAAQ,CAAC,MAAM,EAAE;oBACzB,oBAAoB,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG;oBACxC,SAAS,QAAQ,EAAE;oBACnB,WAAW,SAAS,EAAE;oBACtB,YAAY,QAAQ,CAAC,KAAK,CAAC,SAAS,IAAI,SAAS,EAAE;oBACnD,EAAE;iBACF,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAA;gBACD,OAAO,CAAC,CAAA;YACT,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;YAC5D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;YAC7C,IAAI,IAAI,EAAE,CAAC;gBACV,KAAK,CACJ,GAAG,IAAI,CAAC,SAAS,CAChB;oBACC,MAAM,EAAE,WAAW,CAAC,MAAM;oBAC1B,QAAQ,EAAE,wBAAwB;oBAClC,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,IAAI;oBAChC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;iBACrC,EACD,IAAI,EACJ,CAAC,CACD,IAAI,CACL,CAAA;gBACD,OAAO,CAAC,CAAA;YACT,CAAC;YACD,KAAK,CACJ,gBAAgB,WAAW,CAAC,MAAM,KAAK,wBAAwB,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI,CACrI,CAAA;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;YACjD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAClD,MAAM,MAAM,GAAG,UAAU,CAAC;gBACzB,MAAM,EACL,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ;oBAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;oBAC1B,CAAC,CAAC,SAAS;aACb,CAAC,CAAA;YACF,IACC,iBAAiB,CAAC;gBACjB,WAAW;gBACX,MAAM;gBACN,MAAM;gBACN,oBAAoB,EAAE,IAAI;aAC1B,CAAC,EACD,CAAC;gBACF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;oBACvC,KAAK,EAAE,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC;oBACtE,MAAM;oBACN,KAAK,EAAE,KAAK,IAAI,SAAS;oBACzB,MAAM,EACL,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;oBAC5E,MAAM,EACL,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;oBAC5E,KAAK,EACJ,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;wBACtC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;wBAC7B,CAAC,CAAC,SAAS;iBACb,CAAC,CAAA;gBACF,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;gBACrC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC9B,CAAC;YACD,MAAM,IAAI,GAA4B,EAAE,CAAA;YACxC,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;YAC7B,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAA;YAChF,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAA;YAChF,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YACnE,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YACrC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YAChB,MAAM,MAAM,GACX,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5E,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC1D,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;YAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAA;YAC1C,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAClD,IAAI,KAAK,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACd,uHAAuH,CACvH,CAAA;YACF,CAAC;YACD,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CACd,sEAAsE,CACtE,CAAA;YACF,CAAC;YACD,IAAI,KAAK;gBAAE,4BAA4B,EAAE,CAAA;YACzC,MAAM,IAAI,GACT,MAAM,KAAK,SAAS;gBACnB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,WAAW;oBACZ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI;oBACpB,CAAC,CAAC,WAAW;wBACZ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG;4BAC3B,CAAC,CAAC,MAAM,SAAS,EAAE;4BACnB,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAc,EAAE,MAAM,CAAC;wBACvD,CAAC,CAAC,gBAAgB,IAAI,SAAS,CAAA;YACnC,MAAM,IAAI,GAAG,oBAAoB,CAAC;gBACjC,MAAM;gBACN,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBACjD,UAAU,EACT,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC5E,cAAc,EACb,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,QAAQ;oBACnD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;oBAClC,CAAC,CAAC,SAAS;aACb,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,UAAU,CAAC;gBACzB,MAAM,EACL,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ;oBAC3C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;oBAC1B,CAAC,CAAC,SAAS;aACb,CAAC,CAAA;YACF,MAAM,QAAQ,GACb,KAAK;gBACL,iBAAiB,CAAC;oBACjB,WAAW;oBACX,MAAM;oBACN,MAAM;oBACN,oBAAoB,EAAE,IAAI;iBAC1B,CAAC,CAAA;YACH,MAAM,MAAM,GAAG,KAAK;gBACnB,CAAC,CAAC,MAAM,eAAe,CAAC;oBACtB,IAAI,EAAE,IAAI,CAAC,IAAc;oBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc,EAAE,IAAI,CAAC,cAAoC;oBACzD,KAAK,EAAE,MAAM,yBAAyB,CAAC;wBACtC,WAAW;wBACX,MAAM;wBACN,MAAM;wBACN,OAAO,EAAE,iBAAiB;qBAC1B,CAAC;oBACF,MAAM;oBACN,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,OAAO,IAAI,CAAC;iBAC/C,CAAC;gBACH,CAAC,CAAC,QAAQ;oBACT,CAAC,CAAC,MAAM,yBAAyB,CAAC;wBAChC,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;wBAC3D,MAAM;wBACN,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,cAAc,EAAE,IAAI,CAAC,cAAoC;wBACzD,KAAK,EAAE,eAAe,CACrB,WAAW,EACX,OAAO,CAAC,GAAG,EACX,2BAA2B,EAC3B,EAAE,MAAM,EAAE,CACV;wBACD,MAAM;qBACN,CAAC;oBACH,CAAC,CAAC,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YACzD,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YACrC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,UAAU,CAC9B;gBACC,MAAM;gBACN,OAAO,EACN,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAC9E,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI;gBAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI;gBACvC,IAAI;aACJ,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,CACjB,CAAA;YACD,OAAO,MAAM,CAAC,IAAI,CAAA;QACnB,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,SAAS,CAAA;YACjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;YACzD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAA;YAC/E,KAAK,CACJ,iCAAiC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC3G,CAAA;YACD,OAAO,CAAC,CAAA;QACT,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,UAAU,GAAU,MAAM,CAAC,OAAO,CAAA;YACxC,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QAC5D,CAAC;IACF,CAAC;AACF,CAAC;AAED,KAAK,UAAU,SAAS;IACvB,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC9C,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CAAC,KAKtC;IACA,OAAO,CACN,KAAK,CAAC,MAAM,KAAK,SAAS;QAC1B,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAC7E,CAAA;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACA,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACvB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACvD,CAAC;QACD,OAAO,uBAAuB,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAA;IAClD,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACV,OAAO,uBAAuB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAA;IAChD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,uBAAuB,CAC/B,IAA6B,EAC7B,KAAuD;IAEvD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,MAA+C;IAGvE,OAAO;QACN,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAClE,CAAA;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAYjC;IACA,IAAI,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IACxD,IAAI,CAAC,KAAK,CAAC,oBAAoB;QAAE,OAAO,KAAK,CAAA;IAC7C,IACC,CAAC,qBAAqB,CAAC;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;KAChC,CAAC,EACD,CAAC;QACF,OAAO,KAAK,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GACb,KAAK,CAAC,UAAU,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAA;IAC1D,OAAO,CAAC,QAAQ,CAAA;AACjB,CAAC"}

package/dist/help.js

@@ -7,8 +7,9 @@ Install Kody as a remote MCP server in local agents, or use this CLI as a local
 
 Usage:
   kody login [--mcp-url <url>] [--no-browser]
-  kody logout [--mcp-url <url>]
-  kody status [--mcp-url <url>]
+  kody logout [--mcp-url <url>] [--api-url <url>]
+  kody status [--mcp-url <url>] [--api-url <url>]
+  kody auth bootstrap --code <kody_bc_…> [--api-url <url>]
   kody whoami [--mcp-url <url>] [--token <token>] [--api-url <url>] [--json]
   kody search [query] [--entity <ref>] [--domain <id>] [--limit <n>] [--token <token>] [--api-url <url>] [--json]
   kody execute [--invoke <ref> | --code <esm> | --file <path>] [--params <json>] [--conversation-id <id>] [--json]
@@ -22,25 +23,37 @@ Usage:
 
   --clients  Comma-separated ids: ${hostIds.join(', ')}
 
+  auth bootstrap
+             Redeem a one-shot \`kody_bc_…\` from MCP \`cliCredentialBootstrap\`
+             (POST /v1/tokens/bootstrap/redeem, no Authorization header).
+             Stores the resulting \`kody_at_…\` for \`execute --local\`,
+             search, whoami, and token-auth cloud execute without printing
+             the token. Prefer this over tokenCreate for agents already on
+             MCP. Interactive humans can use \`kody login\` instead.
+
   --token / ${apiTokenEnvVar}
              Scoped API token (preferred via env). With no \`kody login\`
              session, search / whoami / execute use the Open API and
              CapabilityProxy — including cloud execute without --local.
+             Auth priority matches \`execute --local\`: \`--token\` /
+             ${apiTokenEnvVar}; stored bootstrap/API token from
+             \`auth bootstrap\`; then \`kody login\` where applicable.
              Mint with the MCP \`api\` tool \`tokenCreate\` (include
-             \`local-execute\` plus the capability scopes you need).
-             For \`execute --local\`, \`--token\` / ${apiTokenEnvVar} wins
-             when set; otherwise a valid \`kody login\` session is used as
-             the Bearer (no tokenCreate exchange).
+             \`local-execute\` plus the capability scopes you need), or use
+             \`auth bootstrap\` after \`cliCredentialBootstrap\`.
+             For \`execute --local\`, a valid \`kody login\` session can also
+             supply Bearer when no scoped token is available (no tokenCreate
+             exchange).
 
   --local    Run the execute module on this machine (workerd, Linux/macOS).
              Requires Node.js 22 or newer. Auth: \`--token\` /
-             ${apiTokenEnvVar}, or else \`kody login\`. Static kody:@…
-             imports are fetched via POST /v1/local-execute/package-graph
-             and embedded in local workerd (CapabilityProxy only for
-             per-call kody:runtime hops — never a whole-module cloud
-             kody.execute defer). Fails clearly when that package-graph
-             API is unavailable. Cloud token execute (no --local) uses
-             CapabilityProxy → kody.execute for every module.
+             ${apiTokenEnvVar}, else stored \`auth bootstrap\` token, else
+             \`kody login\`. Static kody:@… imports are fetched via POST
+             /v1/local-execute/package-graph and embedded in local workerd
+             (CapabilityProxy only for per-call kody:runtime hops — never a
+             whole-module cloud kody.execute defer). Fails clearly when that
+             package-graph API is unavailable. Cloud token execute (no
+             --local) uses CapabilityProxy → kody.execute for every module.
 
 Environment:
   KODY_MCP_URL        Override the default MCP URL (${defaultMcpUrl})

package/dist/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEtD,MAAM,CAAC,MAAM,KAAK,GAAG,YAAY,kBAAkB,EAAE;;;;;;;;;;;;;;;;;QAiB7C,aAAa,CAAC,aAAa,CAAC;;oCAEA,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;;cAExC,cAAc;;;;;;sDAM0B,cAAc;;;;;;eAMrD,cAAc;;;;;;;;;sDASyB,aAAa;IAC/D,cAAc;mDACiC,aAAa;;;CAG/D,CAAA"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEtD,MAAM,CAAC,MAAM,KAAK,GAAG,YAAY,kBAAkB,EAAE;;;;;;;;;;;;;;;;;;QAkB7C,aAAa,CAAC,aAAa,CAAC;;oCAEA,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;cAUxC,cAAc;;;;;eAKb,cAAc;;;;;;;;;;;eAWd,cAAc;;;;;;;;;sDASyB,aAAa;IAC/D,cAAc;mDACiC,aAAa;;;CAG/D,CAAA"}

package/dist/local-execute-auth.d.ts

@@ -1,20 +1,18 @@
 import { ensureFreshCredentials } from './auth.js';
+import { type ResolveScopedApiTokenInput } from './api-token.js';
 import type { SecretBackend } from './store.js';
 /**
  * Bearer for CapabilityProxy / package-graph under `execute --local`.
  *
- * Priority: `--token` / `KODY_API_TOKEN`, else a fresh `kody login` OAuth
- * access token (never printed). No under-the-hood `tokenCreate` exchange.
+ * Priority:
+ * 1. `--token` / `KODY_API_TOKEN`
+ * 2. Stored bootstrap/API token from `auth bootstrap --code`
+ * 3. Fresh `kody login` OAuth access token (never printed)
  *
- * Platform must accept MCP/user OAuth on those Open API routes
- * (https://github.com/kentcdodds/kody/issues/2812); until then a login-only
- * bearer gets 401 and the CLI surfaces that gap.
+ * No under-the-hood `tokenCreate` exchange. Do not scavenge host MCP tokens
+ * (ADR 0053).
  */
-export declare function resolveLocalExecuteBearer(input: {
-    tokenValues?: {
-        token?: string;
-    };
-    env?: NodeJS.ProcessEnv;
+export declare function resolveLocalExecuteBearer(input: ResolveScopedApiTokenInput & {
     mcpUrl?: string;
     backend?: SecretBackend;
     fetchFn?: typeof fetch;

package/dist/local-execute-auth.js

@@ -1,17 +1,18 @@
 import { ensureFreshCredentials } from './auth.js';
-import { missingLocalExecuteAuthMessage, readApiToken, } from './api-token.js';
+import { missingLocalExecuteAuthMessage, resolveScopedApiToken, } from './api-token.js';
 /**
  * Bearer for CapabilityProxy / package-graph under `execute --local`.
  *
- * Priority: `--token` / `KODY_API_TOKEN`, else a fresh `kody login` OAuth
- * access token (never printed). No under-the-hood `tokenCreate` exchange.
+ * Priority:
+ * 1. `--token` / `KODY_API_TOKEN`
+ * 2. Stored bootstrap/API token from `auth bootstrap --code`
+ * 3. Fresh `kody login` OAuth access token (never printed)
  *
- * Platform must accept MCP/user OAuth on those Open API routes
- * (https://github.com/kentcdodds/kody/issues/2812); until then a login-only
- * bearer gets 401 and the CLI surfaces that gap.
+ * No under-the-hood `tokenCreate` exchange. Do not scavenge host MCP tokens
+ * (ADR 0053).
  */
 export async function resolveLocalExecuteBearer(input) {
-    const token = readApiToken(input.tokenValues, input.env);
+    const token = resolveScopedApiToken(input);
     if (token)
         return token;
     const ensure = input.ensureCredentials ?? ensureFreshCredentials;

package/dist/local-execute-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-execute-auth.js","sourceRoot":"","sources":["../src/local-execute-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EACN,8BAA8B,EAC9B,YAAY,GACZ,MAAM,gBAAgB,CAAA;AAGvB;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAU/C;IACA,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACxD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IAEvB,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,IAAI,sBAAsB,CAAA;IAChE,IAAI,CAAC;QACJ,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,EAAE,KAAK,CAAC,GAAG;SACd,CAAC,CAAA;QACF,OAAO,WAAW,CAAC,WAAW,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,KAAK,CAAC,OAAO,IAAI,iBAAiB,CAAC,CAAC,CAAA;IACpF,CAAC;AACF,CAAC"}
+{"version":3,"file":"local-execute-auth.js","sourceRoot":"","sources":["../src/local-execute-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EACN,8BAA8B,EAC9B,qBAAqB,GAErB,MAAM,gBAAgB,CAAA;AAGvB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,KAQC;IAED,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC1C,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IAEvB,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,IAAI,sBAAsB,CAAA;IAChE,IAAI,CAAC;QACJ,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,EAAE,KAAK,CAAC,GAAG;SACd,CAAC,CAAA;QACF,OAAO,WAAW,CAAC,WAAW,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,KAAK,CAAC,OAAO,IAAI,iBAAiB,CAAC,CAAC,CAAA;IACpF,CAAC;AACF,CAAC"}

package/dist/redact.js

@@ -1,6 +1,10 @@
 const secretPattern = /(access_token|refresh_token|client_secret|authorization)["']?\s*[:=]\s*["']?[^\s"',}]+/gi;
+/** Never leak minted API tokens or one-shot bootstrap codes in CLI output. */
+const kodySecretPattern = /\bkody_(?:at|bc)_[A-Za-z0-9_-]+\b/g;
 export function redact(value) {
-    return value.replace(secretPattern, '$1=[redacted]');
+    return value
+        .replace(secretPattern, '$1=[redacted]')
+        .replace(kodySecretPattern, 'kody_[redacted]');
 }
 export function redactError(error) {
     if (error instanceof Error) {

package/dist/redact.js.map

@@ -1 +1 @@
-{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA,MAAM,aAAa,GAClB,0FAA0F,CAAA;AAE3F,MAAM,UAAU,MAAM,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;AACrD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACzC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC5B,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACrC,OAAO,KAAK,CAAA;IACb,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACxC,CAAC"}
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA,MAAM,aAAa,GAClB,0FAA0F,CAAA;AAE3F,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,oCAAoC,CAAA;AAE9D,MAAM,UAAU,MAAM,CAAC,KAAa;IACnC,OAAO,KAAK;SACV,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC;SACvC,OAAO,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACzC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC5B,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACrC,OAAO,KAAK,CAAA;IACb,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACxC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@kodycodes/cli",
-	"version": "1.7.0",
+	"version": "1.8.1",
 	"description": "Official Kody MCP client CLI: login, secure token storage, search, and execute.",
 	"type": "module",
 	"bin": {

package/skills/kody/SKILL.md

@@ -81,19 +81,28 @@ whole-module cloud defer). If that package-graph API is missing, `--local`
 fails clearly rather than silently billing a remote execute.
 
 For `execute --local` auth: `--token` / `KODY_API_TOKEN` wins when set;
-otherwise use a valid `kody login` session (OAuth access token as Bearer —
-never print it, never mint via `tokenCreate` under the hood). Until the Open
-API accepts MCP OAuth on CapabilityProxy / package-graph
-(https://github.com/kentcdodds/kody/issues/2812), mint a scoped token with
-the MCP `api` tool `tokenCreate` — include `local-execute` plus the capability
-scopes the module calls — and pass `--token` or `KODY_API_TOKEN`. If neither
-login nor a token is set, the CLI error says that. `insufficient_scope` means
-the token is missing a scope; `feature_disabled` means the account
+otherwise a stored token from `kody auth bootstrap --code` (after MCP
+`cliCredentialBootstrap`); otherwise a valid `kody login` session (OAuth
+access token as Bearer — never print it, never mint via `tokenCreate` under
+the hood). Prefer bootstrap over `tokenCreate` for agents already on MCP so
+`kody_at_…` never appears in chat. Until the Open API accepts MCP OAuth on
+CapabilityProxy / package-graph
+(https://github.com/kentcdodds/kody/issues/2812), use bootstrap or mint a
+scoped token with the MCP `api` tool `tokenCreate` — include `local-execute`
+plus the capability scopes the module calls — and pass `--token` or
+`KODY_API_TOKEN`. If none of those are available, the CLI error says that
+(bootstrap → login → tokenCreate for CI). `insufficient_scope` means the
+token is missing a scope; `feature_disabled` means the account
 `local-execute` flag is off. Never read MCP OAuth tokens from the host.
 
 ```bash
+# Agents on MCP:
+# cliCredentialBootstrap → { bootstrap_code, cli_command }
+npx @kodycodes/cli auth bootstrap --code 'kody_bc_…'
+npx @kodycodes/cli execute --local --file ./task.js --params '{"q":"email"}'
+
 npx @kodycodes/cli login
 npx @kodycodes/cli execute --local --file ./task.js --params '{"q":"email"}'
-# Or with an explicit scoped token (wins over login):
+# Or with an explicit scoped token (wins over login / bootstrap store):
 KODY_API_TOKEN=… npx @kodycodes/cli execute --local --file ./task.js --params '{"q":"email"}'
 ```