@kya-os/cli 1.8.1 → 1.8.3

package/dist/utils/github-credential.js

@@ -0,0 +1,308 @@
+import { execFile } from "node:child_process";
+import { createHash, randomBytes as nodeRandomBytes } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { promisify } from "node:util";
+import { ensureSecureDir, stateDir, writeFileAtomicSafe, writeSecureFile, } from "./cli-kit/index.js";
+import { GhNotInstalledError, isGhAuthenticated, isGhInstalled } from "./dco/github.js";
+const execFileAsync = promisify(execFile);
+/** Absolute path to the credential directory, e.g. ~/.mcpi/github. Overridable for tests via MCPI_GITHUB_DIR. */
+export function credentialsDir() {
+    return resolve(process.env.MCPI_GITHUB_DIR || stateDir("mcpi", "github"));
+}
+/** Absolute path to the credential store file. */
+export function credentialsPath() {
+    return join(credentialsDir(), "credentials.json");
+}
+/**
+ * sha256 hex digest of a secret's raw bytes (the token, or the webhook
+ * secret). GitHub PATs and this module's hex-encoded webhook secrets are
+ * always ASCII, so UTF-8 encoding is exact-byte equivalent to hashing the
+ * secret's actual byte representation. This is the ONLY form either secret
+ * is ever allowed to leave this module in -- the anchor (see
+ * `github-credential-anchor.ts`) carries fingerprints exclusively.
+ */
+export function fingerprintSecret(secret) {
+    return createHash("sha256").update(secret, "utf8").digest("hex");
+}
+/** Runtime shape guard: a corrupt or hand-edited file must never crash a caller. */
+function isStoredGithubCredential(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    return (typeof v.githubLogin === "string" &&
+        typeof v.token === "string" &&
+        typeof v.webhookSecret === "string" &&
+        typeof v.createdAt === "string" &&
+        Array.isArray(v.scopes) &&
+        v.scopes.every((s) => typeof s === "string"));
+}
+/** The currently stored credential, or undefined if none exists (or the file is unreadable/corrupt). */
+export function readStoredCredential() {
+    const path = credentialsPath();
+    if (!existsSync(path))
+        return undefined;
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf-8"));
+        return isStoredGithubCredential(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Persist `credential` at {@link credentialsPath}, 0600 inside a 0700
+ * directory ({@link credentialsDir}).
+ *
+ * A pre-existing file is never silently overwritten (sentinel `8297a1e`'s
+ * lesson, transposed: operate only on YOUR OWN prior credential, and only
+ * once that's been confirmed, never by assuming the file is stale). This
+ * check is on FILE PRESENCE, not on `readStoredCredential`'s shape-validated
+ * result: a file that exists but fails the shape guard (corrupt, truncated
+ * by an interrupted prior write, or a future incompatible format) still has
+ * a live token sitting in it and must still gate on confirmation -- treating
+ * "can't parse it" the same as "nothing here" would silently discard that
+ * token with no rotation record, exactly the audit-trail gap anchoring
+ * exists to close. On a confirmed rotation the old file is replaced
+ * atomically (write temp + rename, `writeFileAtomicSafe`) and, when the
+ * prior file WAS well-formed, the result carries its token's fingerprint as
+ * `supersedesFingerprint` for the caller to bind into the next anchor's
+ * `supersedes` field -- absent when the prior file was corrupt, since there
+ * is no valid token to fingerprint.
+ */
+export async function saveGithubCredential(credential, options) {
+    const path = credentialsPath();
+    const fileExists = existsSync(path);
+    const existing = readStoredCredential();
+    if (fileExists) {
+        const confirmed = await options.confirmRotateImpl();
+        if (!confirmed) {
+            return { status: "declined" };
+        }
+        ensureSecureDir(credentialsDir());
+        writeFileAtomicSafe(path, JSON.stringify(credential, null, 2) + "\n", 0o600);
+        return {
+            status: "saved",
+            credential,
+            ...(existing ? { supersedesFingerprint: fingerprintSecret(existing.token) } : {}),
+        };
+    }
+    ensureSecureDir(credentialsDir());
+    writeSecureFile(path, JSON.stringify(credential, null, 2) + "\n");
+    return { status: "saved", credential };
+}
+// ── Acquisition ─────────────────────────────────────────────────────────
+/** Sentinel's proven classic-token grant list (README:33-35, `Know-That-Ai/sentinel` @ 83c0ed5). */
+export const CLASSIC_REQUIRED_SCOPES = ["repo", "admin:repo_hook"];
+/** Sentinel's proven fine-grained equivalent, printed verbatim for the user to grant. */
+export const FINE_GRAINED_GRANTS = [
+    "Metadata: Read",
+    "Pull requests: Read & Write",
+    "Contents: Read",
+    "Webhooks: Read & Write",
+];
+export const GITHUB_PAT_SETTINGS_URL = "https://github.com/settings/personal-access-tokens/new";
+/**
+ * Parse `gh api user -i` output (headers followed by a blank line, then the
+ * JSON body) into a {@link ScopeProbeResult}. Pure -- no process spawning --
+ * so this is unit-testable directly against canned `gh` output without a
+ * live GitHub call or even a `gh` binary on PATH.
+ */
+export function parseGhApiUserWithHeaders(raw) {
+    const normalized = raw.replace(/\r\n/g, "\n");
+    const blankIndex = normalized.indexOf("\n\n");
+    const headerBlock = blankIndex === -1 ? normalized : normalized.slice(0, blankIndex);
+    const bodyBlock = blankIndex === -1 ? "" : normalized.slice(blankIndex + 2);
+    let login;
+    try {
+        const parsedBody = JSON.parse(bodyBlock.trim());
+        if (parsedBody &&
+            typeof parsedBody === "object" &&
+            typeof parsedBody.login === "string") {
+            login = parsedBody.login;
+        }
+    }
+    catch {
+        // Body isn't parseable JSON -- login stays undefined; handled below.
+    }
+    const scopesLine = headerBlock
+        .split("\n")
+        .find((line) => /^x-oauth-scopes:/i.test(line.trim()));
+    if (scopesLine) {
+        const value = scopesLine.slice(scopesLine.indexOf(":") + 1).trim();
+        const scopes = value.length === 0
+            ? []
+            : value
+                .split(",")
+                .map((s) => s.trim())
+                .filter((s) => s.length > 0);
+        const missing = CLASSIC_REQUIRED_SCOPES.filter((required) => !scopes.includes(required));
+        if (missing.length > 0) {
+            return {
+                probe: "classic-x-oauth-scopes",
+                ok: false,
+                login,
+                scopes,
+                missing,
+                detail: `classic token via gh is missing required scope(s): ${missing.join(", ")}`,
+            };
+        }
+        return {
+            probe: "classic-x-oauth-scopes",
+            ok: true,
+            login,
+            scopes,
+            detail: `classic token scopes verified via X-OAuth-Scopes: ${scopes.join(", ")}`,
+        };
+    }
+    if (login) {
+        return {
+            probe: "fine-grained-user-read",
+            ok: true,
+            login,
+            detail: "fine-grained token does not report scopes over the API; verified only that it authenticates via a GET /user probe",
+        };
+    }
+    return {
+        probe: "fine-grained-user-read",
+        ok: false,
+        detail: "fine-grained probe (GET /user) did not return a usable login",
+    };
+}
+async function runGh(args, env) {
+    try {
+        const { stdout } = await execFileAsync("gh", args, {
+            encoding: "utf8",
+            maxBuffer: 10 * 1024 * 1024,
+            env: env ? { ...process.env, ...env } : process.env,
+        });
+        return stdout;
+    }
+    catch (error) {
+        if (error?.code === "ENOENT") {
+            throw new GhNotInstalledError();
+        }
+        throw error;
+    }
+}
+async function defaultApiUserWithHeaders() {
+    return runGh(["api", "user", "-i"]);
+}
+/** Same probe, but authenticated as a specific pasted token rather than gh's own stored auth -- never as a CLI arg (visible in `ps`), only via env. */
+async function defaultApiUserWithHeadersForToken(token) {
+    return runGh(["api", "user", "-i"], { GH_TOKEN: token });
+}
+async function defaultGhAuthToken() {
+    return (await runGh(["auth", "token"])).trim();
+}
+/** Masked paste prompt -- inquirer's "password" type never echoes input. */
+async function defaultPromptForToken() {
+    const inquirer = (await import("inquirer")).default;
+    const { token } = await inquirer.prompt([
+        {
+            type: "password",
+            name: "token",
+            message: "Paste your fine-grained GitHub PAT (input hidden):",
+            mask: "*",
+        },
+    ]);
+    return token.trim();
+}
+async function tryExistingGhCredential(options) {
+    const installed = await options.isGhInstalledImpl().catch(() => false);
+    if (!installed)
+        return undefined;
+    const authenticated = await options.isGhAuthenticatedImpl().catch(() => false);
+    if (!authenticated)
+        return undefined;
+    const raw = await options.apiUserWithHeadersImpl();
+    const probe = parseGhApiUserWithHeaders(raw);
+    options.onNotice(probe.detail);
+    if (!probe.ok || !probe.login)
+        return undefined;
+    const token = await options.ghAuthTokenImpl();
+    return {
+        githubLogin: probe.login,
+        token,
+        scopes: probe.scopes ?? [...FINE_GRAINED_GRANTS],
+    };
+}
+/** Verify a specific token (pasted, or supplied via --github-token-env) and derive its login/scopes. Shared by both paths so neither can drift. */
+async function verifyAndDeriveFromToken(token, options, failureContext) {
+    const raw = await options.apiUserWithHeadersForTokenImpl(token);
+    const probe = parseGhApiUserWithHeaders(raw);
+    options.onNotice(probe.detail);
+    if (!probe.ok || !probe.login) {
+        throw new Error(`Could not verify the ${failureContext}: ${probe.detail}`);
+    }
+    return {
+        githubLogin: probe.login,
+        token,
+        scopes: probe.scopes ?? [...FINE_GRAINED_GRANTS],
+    };
+}
+async function acquireViaPaste(options) {
+    options.onNotice([
+        "Create a fine-grained personal access token with exactly these grants, then paste it below:",
+        ...FINE_GRAINED_GRANTS.map((g) => `  - ${g}`),
+        `Create one at: ${GITHUB_PAT_SETTINGS_URL}`,
+    ].join("\n"));
+    const token = await options.promptForTokenImpl();
+    if (!token) {
+        throw new Error("No GitHub token provided.");
+    }
+    return verifyAndDeriveFromToken(token, options, "pasted GitHub token");
+}
+/**
+ * Acquire the single GitHub credential for this person on this machine.
+ *
+ * Acquisition order:
+ *   0. `options.presetToken`, when supplied (`kya-os init --github-token-env
+ *      NAME`) -- skips both of the below entirely, for a fully
+ *      non-interactive run. Verified the same way a pasted token is.
+ *   1. `gh auth token`, when `gh` is installed, authenticated, and the
+ *      scope probe against its stored token passes (classic: all of
+ *      {@link CLASSIC_REQUIRED_SCOPES} present via `X-OAuth-Scopes`;
+ *      fine-grained: the `GET /user` probe authenticates).
+ *   2. Otherwise, prompt for a pasted fine-grained PAT created with
+ *      {@link FINE_GRAINED_GRANTS}, verified the same way.
+ *
+ * Always generates a fresh `webhookSecret` (32 random bytes, hex) even
+ * though the webhook receiver itself ships in P17 -- the anchor binds it
+ * from day one so the rotation history the hub sees is complete from the
+ * very first anchor.
+ */
+export async function acquireGithubCredential(options = {}) {
+    const isGhInstalledImpl = options.isGhInstalledImpl ?? isGhInstalled;
+    const isGhAuthenticatedImpl = options.isGhAuthenticatedImpl ?? isGhAuthenticated;
+    const apiUserWithHeadersImpl = options.apiUserWithHeadersImpl ?? defaultApiUserWithHeaders;
+    const apiUserWithHeadersForTokenImpl = options.apiUserWithHeadersForTokenImpl ?? defaultApiUserWithHeadersForToken;
+    const ghAuthTokenImpl = options.ghAuthTokenImpl ?? defaultGhAuthToken;
+    const promptForTokenImpl = options.promptForTokenImpl ?? defaultPromptForToken;
+    const randomBytesImpl = options.randomBytesImpl ?? nodeRandomBytes;
+    const now = options.now ?? (() => new Date().toISOString());
+    const onNotice = options.onNotice ?? (() => { });
+    let acquired;
+    if (options.presetToken) {
+        acquired = await verifyAndDeriveFromToken(options.presetToken, { apiUserWithHeadersForTokenImpl, onNotice }, "GitHub token from the environment");
+    }
+    else {
+        const existing = await tryExistingGhCredential({
+            isGhInstalledImpl,
+            isGhAuthenticatedImpl,
+            apiUserWithHeadersImpl,
+            ghAuthTokenImpl,
+            onNotice,
+        });
+        acquired =
+            existing ?? (await acquireViaPaste({ apiUserWithHeadersForTokenImpl, promptForTokenImpl, onNotice }));
+    }
+    return {
+        githubLogin: acquired.githubLogin,
+        token: acquired.token,
+        webhookSecret: randomBytesImpl(32).toString("hex"),
+        scopes: acquired.scopes,
+        createdAt: now(),
+    };
+}
+//# sourceMappingURL=github-credential.js.map

package/dist/utils/github-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-credential.js","sourceRoot":"","sources":["../../src/utils/github-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAExF,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAwC1C,iHAAiH;AACjH,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,kBAAkB,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,oFAAoF;AACpF,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACvB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,oBAAoB;IAClC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAqBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkC,EAClC,OAAoC;IAEpC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IAExC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChC,CAAC;QACD,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;QAClC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7E,OAAO;YACL,MAAM,EAAE,OAAO;YACf,UAAU;YACV,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;IAClC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAClE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,2EAA2E;AAE3E,oGAAoG;AACpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAU,CAAC;AAE5E,yFAAyF;AACzF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,gBAAgB;IAChB,6BAA6B;IAC7B,gBAAgB;IAChB,wBAAwB;CAChB,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAClC,wDAAwD,CAAC;AAqB3D;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAE5E,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,UAAU,GAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,IACE,UAAU;YACV,OAAO,UAAU,KAAK,QAAQ;YAC9B,OAAQ,UAAsC,CAAC,KAAK,KAAK,QAAQ,EACjE,CAAC;YACD,KAAK,GAAI,UAAsC,CAAC,KAAe,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,WAAW;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEzD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnE,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,KAAK,CAAC;YAChB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,KAAK;iBACF,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,KAAK,EAAE,wBAAwB;gBAC/B,EAAE,EAAE,KAAK;gBACT,KAAK;gBACL,MAAM;gBACN,OAAO;gBACP,MAAM,EAAE,sDAAsD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACnF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,wBAAwB;YAC/B,EAAE,EAAE,IAAI;YACR,KAAK;YACL,MAAM;YACN,MAAM,EAAE,qDAAqD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACjF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO;YACL,KAAK,EAAE,wBAAwB;YAC/B,EAAE,EAAE,IAAI;YACR,KAAK;YACL,MAAM,EACJ,mHAAmH;SACtH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,wBAAwB;QAC/B,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,8DAA8D;KACvE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,IAAc,EAAE,GAAuB;IAC1D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE;YACjD,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;SACpD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB;IACtC,OAAO,KAAK,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,uJAAuJ;AACvJ,KAAK,UAAU,iCAAiC,CAAC,KAAa;IAC5D,OAAO,KAAK,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,qBAAqB;IAClC,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IACpD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACtC;YACE,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,oDAAoD;YAC7D,IAAI,EAAE,GAAG;SACV;KACF,CAAC,CAAC;IACH,OAAQ,KAAgB,CAAC,IAAI,EAAE,CAAC;AAClC,CAAC;AAyBD,KAAK,UAAU,uBAAuB,CACpC,OAKC;IAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAC/E,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAErC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,sBAAsB,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAEhD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;IAC9C,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,mBAAmB,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,mJAAmJ;AACnJ,KAAK,UAAU,wBAAwB,CACrC,KAAa,EACb,OAAsG,EACtG,cAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wBAAwB,cAAc,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,mBAAmB,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAEC;IAED,OAAO,CAAC,QAAQ,CACd;QACE,6FAA6F;QAC7F,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,kBAAkB,uBAAuB,EAAE;KAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAA0C,EAAE;IAE5C,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,aAAa,CAAC;IACrE,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,iBAAiB,CAAC;IACjF,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,yBAAyB,CAAC;IAC3F,MAAM,8BAA8B,GAClC,OAAO,CAAC,8BAA8B,IAAI,iCAAiC,CAAC;IAC9E,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,kBAAkB,CAAC;IACtE,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,qBAAqB,CAAC;IAC/E,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,eAAe,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEhD,IAAI,QAAkE,CAAC;IACvE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,QAAQ,GAAG,MAAM,wBAAwB,CACvC,OAAO,CAAC,WAAW,EACnB,EAAE,8BAA8B,EAAE,QAAQ,EAAE,EAC5C,mCAAmC,CACpC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;YAC7C,iBAAiB;YACjB,qBAAqB;YACrB,sBAAsB;YACtB,eAAe;YACf,QAAQ;SACT,CAAC,CAAC;QACH,QAAQ;YACN,QAAQ,IAAI,CAAC,MAAM,eAAe,CAAC,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,SAAS,EAAE,GAAG,EAAE;KACjB,CAAC;AACJ,CAAC"}

package/dist/utils/gitignore.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Adds `entry` to .gitignore if no existing pattern already covers it,
+ * including a trailing-`*` wildcard pattern (e.g. `.env*`, create-next-app's
+ * own default), the same glob EnvManager.checkGitignore() already honors, so
+ * this doesn't append a redundant, already-covered line.
+ *
+ * Shared by every command that writes a credential-bearing path into a
+ * project directory it doesn't fully control (`.env.local`, `.checkpoint/`,
+ * `.mcpi/`). Neither write is safe to leave ungitignored: a repo whose
+ * `.gitignore` doesn't already cover it (hand-rolled apps, a pruned/custom
+ * .gitignore, a repo that was never scaffolded by this CLI) would otherwise
+ * let `git add .` stage a real credential straight into history. Callers
+ * should call this BEFORE writing the secret, not after, so there's no
+ * window where the file exists ungitignored.
+ */
+export declare function ensureGitignored(projectRoot: string, entry: string, label: string): void;
+//# sourceMappingURL=gitignore.d.ts.map

package/dist/utils/gitignore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.d.ts","sourceRoot":"","sources":["../../src/utils/gitignore.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,IAAI,CAwBN"}

package/dist/utils/gitignore.js

@@ -0,0 +1,40 @@
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+/**
+ * Adds `entry` to .gitignore if no existing pattern already covers it,
+ * including a trailing-`*` wildcard pattern (e.g. `.env*`, create-next-app's
+ * own default), the same glob EnvManager.checkGitignore() already honors, so
+ * this doesn't append a redundant, already-covered line.
+ *
+ * Shared by every command that writes a credential-bearing path into a
+ * project directory it doesn't fully control (`.env.local`, `.checkpoint/`,
+ * `.mcpi/`). Neither write is safe to leave ungitignored: a repo whose
+ * `.gitignore` doesn't already cover it (hand-rolled apps, a pruned/custom
+ * .gitignore, a repo that was never scaffolded by this CLI) would otherwise
+ * let `git add .` stage a real credential straight into history. Callers
+ * should call this BEFORE writing the secret, not after, so there's no
+ * window where the file exists ungitignored.
+ */
+export function ensureGitignored(projectRoot, entry, label) {
+    const gitignorePath = join(projectRoot, ".gitignore");
+    const bare = entry.replace(/\/$/, "");
+    let content = existsSync(gitignorePath)
+        ? readFileSync(gitignorePath, "utf-8")
+        : "";
+    const alreadyIgnored = content
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line && !line.startsWith("#"))
+        .some((line) => line === entry ||
+        line === bare ||
+        line === `/${bare}` ||
+        line === `/${entry}` ||
+        (line.endsWith("*") && bare.startsWith(line.slice(0, -1))));
+    if (alreadyIgnored)
+        return;
+    if (content && !content.endsWith("\n"))
+        content += "\n";
+    content += `${content ? "\n" : ""}# ${label}\n${entry}\n`;
+    writeFileSync(gitignorePath, content, "utf-8");
+}
+//# sourceMappingURL=gitignore.js.map

package/dist/utils/gitignore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.js","sourceRoot":"","sources":["../../src/utils/gitignore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,KAAa,EACb,KAAa;IAEb,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,UAAU,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,cAAc,GAAG,OAAO;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAC/C,IAAI,CACH,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,IAAI;QACb,IAAI,KAAK,IAAI,IAAI,EAAE;QACnB,IAAI,KAAK,IAAI,KAAK,EAAE;QACpB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAC7D,CAAC;IACJ,IAAI,cAAc;QAAE,OAAO;IAE3B,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,IAAI,CAAC;IACxD,OAAO,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC;IAC1D,aAAa,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC"}

package/dist/utils/hub-config.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Reads `~/.mcpi/hub.json`, written by review-loop P17's hub-context stage
+ * (`packages/cli/src/utils/hub-context.ts`, not yet on `main`). This file
+ * is deliberately READ-ONLY and does not write that shape: P17 owns the
+ * resolution order (explicit endpoint, reachable production hub, local
+ * hub offer) and the write side. This exists so anything that only needs
+ * to know "is a hub configured, and where" -- today, the TUI agents view's
+ * hub-connection column and dispatch gate -- does not have to wait for
+ * P17 to land to read a file P17's own prompt already pins the shape of.
+ *
+ * @module cli/utils/hub-config
+ */
+export interface HubConfig {
+    endpoint: string;
+    mode: "remote" | "local";
+    installedService?: string;
+}
+export declare function hubConfigPath(): string;
+/** Undefined for a missing, unreadable, or malformed file -- never throws. */
+export declare function readHubConfig(): HubConfig | undefined;
+//# sourceMappingURL=hub-config.d.ts.map

package/dist/utils/hub-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-config.d.ts","sourceRoot":"","sources":["../../src/utils/hub-config.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAaD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,IAAI,SAAS,GAAG,SAAS,CASrD"}

package/dist/utils/hub-config.js

@@ -0,0 +1,28 @@
+import { existsSync, readFileSync } from "fs";
+import { stateDir } from "./cli-kit/index.js";
+function isHubConfig(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    return (typeof v.endpoint === "string" &&
+        v.endpoint.length > 0 &&
+        (v.mode === "remote" || v.mode === "local") &&
+        (v.installedService === undefined || typeof v.installedService === "string"));
+}
+export function hubConfigPath() {
+    return process.env.MCPI_HUB_CONFIG_PATH || stateDir("mcpi", "hub.json");
+}
+/** Undefined for a missing, unreadable, or malformed file -- never throws. */
+export function readHubConfig() {
+    const path = hubConfigPath();
+    if (!existsSync(path))
+        return undefined;
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf-8"));
+        return isHubConfig(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=hub-config.js.map

package/dist/utils/hub-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-config.js","sourceRoot":"","sources":["../../src/utils/hub-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAqB9C,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;QAC3C,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/utils/identity-heal.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Patches only the `did` field of an on-disk `.mcpi/identity.json`,
+ * preserving every other field (privateKey, publicKey, kid, createdAt, ...).
+ *
+ * Both `init` and `register` mint or accept a locally-generated placeholder
+ * did before the registry assigns the real did:web record; once the
+ * canonical did is known, this heals identity.json in place so it never
+ * drifts from agent.json (dco setup.ts throws "for a different agent" the
+ * moment they disagree).
+ *
+ * Returns false, without writing anything, when the file does not exist or
+ * already has the target did. Read/parse/write errors are left to THROW:
+ * callers each keep their own catch-and-warn behavior around this call.
+ */
+export declare function patchIdentityDidInPlace(identityFilePath: string, newDid: string): boolean;
+//# sourceMappingURL=identity-heal.d.ts.map

package/dist/utils/identity-heal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-heal.d.ts","sourceRoot":"","sources":["../../src/utils/identity-heal.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAsBT"}

package/dist/utils/identity-heal.js

@@ -0,0 +1,37 @@
+import { existsSync, readFileSync, chmodSync } from "fs";
+import { writeFileAtomicSafe } from "./cli-kit/index.js";
+/**
+ * Patches only the `did` field of an on-disk `.mcpi/identity.json`,
+ * preserving every other field (privateKey, publicKey, kid, createdAt, ...).
+ *
+ * Both `init` and `register` mint or accept a locally-generated placeholder
+ * did before the registry assigns the real did:web record; once the
+ * canonical did is known, this heals identity.json in place so it never
+ * drifts from agent.json (dco setup.ts throws "for a different agent" the
+ * moment they disagree).
+ *
+ * Returns false, without writing anything, when the file does not exist or
+ * already has the target did. Read/parse/write errors are left to THROW:
+ * callers each keep their own catch-and-warn behavior around this call.
+ */
+export function patchIdentityDidInPlace(identityFilePath, newDid) {
+    if (!existsSync(identityFilePath)) {
+        return false;
+    }
+    const existing = JSON.parse(readFileSync(identityFilePath, "utf-8"));
+    if (!existing || typeof existing !== "object" || existing.did === newDid) {
+        return false;
+    }
+    // Atomic + symlink-safe: identity.json holds a private key, so a crash
+    // mid-write must never truncate it, and a planted symlink at the write's
+    // temp sibling must never be followed into an arbitrary file.
+    writeFileAtomicSafe(identityFilePath, JSON.stringify({ ...existing, did: newDid }, null, 2), 0o600);
+    try {
+        chmodSync(identityFilePath, 0o600);
+    }
+    catch {
+        // Best-effort; e.g. unsupported on Windows.
+    }
+    return true;
+}
+//# sourceMappingURL=identity-heal.js.map

package/dist/utils/identity-heal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-heal.js","sourceRoot":"","sources":["../../src/utils/identity-heal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,gBAAwB,EACxB,MAAc;IAEd,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,uEAAuE;IACvE,yEAAyE;IACzE,8DAA8D;IAC9D,mBAAmB,CACjB,gBAAgB,EAChB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EACrD,KAAK,CACN,CAAC;IACF,IAAI,CAAC;QACH,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/utils/init/pipeline.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The stage pipeline `kya-os init` runs.
+ *
+ * `init.ts`'s flow is seven ordered stages (readiness/install, identity,
+ * claim, agent profiles, GitHub credentials, hub context, summary+TUI
+ * handoff). Each stage decides for itself whether it applies at all
+ * (`when`) and reports one summary line plus any warnings (`run`) instead
+ * of printing ad hoc -- the pipeline collects every stage's report so the
+ * caller can print one consolidated block before the TUI handoff question,
+ * which is what makes a re-run ("already set up" in one line each, per
+ * stage) possible without every stage re-implementing that summary itself.
+ *
+ * `when` is also the seam P16/P17 runtime-optionality depends on: a guard
+ * that checks whether the stage's own module exists (a dynamic import
+ * wrapped in try/catch) rather than a hardcoded flag means a stage
+ * activates itself the moment its dependency lands on `main`, with zero
+ * code change here.
+ *
+ * A stage's `run` is expected to catch its own recoverable failures and
+ * report them as `{ ok: false, warnings: [...] }` -- exactly how init.ts's
+ * existing non-fatal error handling already works. A `run` that needs to
+ * stop the whole pipeline (today: only a missing `git` or an identity
+ * failure) throws a {@link StageFatalError}; anything else it throws is
+ * treated as an unexpected bug, not a modeled failure, and propagates
+ * uncaught. This module never touches `process.exit` itself -- the caller
+ * owns the NODE_ENV=test guard and the exit code, which is what keeps this
+ * file trivially unit-testable on its own.
+ *
+ * @module cli/utils/init/pipeline
+ */
+export interface StageResult {
+    ok: boolean;
+    summaryLine: string;
+    warnings?: string[];
+}
+/** Raised by a stage's `run` to stop the pipeline with a specific exit code. */
+export declare class StageFatalError extends Error {
+    readonly exitCode: number;
+    constructor(exitCode: number, message: string);
+}
+export interface Stage<Ctx> {
+    name: string;
+    /**
+     * Whether this stage applies at all. A stage that returns false is
+     * omitted from the report entirely -- reserved for a stage whose
+     * dependency genuinely does not exist yet (P16/P17 modules absent) or
+     * whose skip flag was passed. A stage that DOES apply but finds nothing
+     * new to do still runs and reports that itself via `run`'s
+     * `summaryLine` (e.g. "already set up"), so the caller sees one line
+     * either way.
+     */
+    when: (ctx: Ctx) => boolean | Promise<boolean>;
+    run: (ctx: Ctx) => Promise<StageResult>;
+}
+export interface RanStage {
+    name: string;
+    result: StageResult;
+}
+export interface RunStagesReport {
+    ran: RanStage[];
+    /** Names of stages whose `when` returned false. */
+    omitted: string[];
+}
+/**
+ * Runs every applicable stage in order, stopping immediately (and
+ * rethrowing) if a stage throws. Callers that want a "skipped" line for an
+ * omitted stage build it from {@link RunStagesReport.omitted} themselves --
+ * this function does not synthesize one, since a stage's own `when` is the
+ * only place that knows WHY it does not apply (module absent vs. a --skip
+ * flag vs. platform mismatch).
+ */
+export declare function runStages<Ctx>(stages: ReadonlyArray<Stage<Ctx>>, ctx: Ctx): Promise<RunStagesReport>;
+export declare function moduleExists(specifier: string, fromUrl: string): Promise<boolean>;
+//# sourceMappingURL=pipeline.d.ts.map

package/dist/utils/init/pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../src/utils/init/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,gFAAgF;AAChF,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK9C;AAED,MAAM,WAAW,KAAK,CAAC,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,QAAQ,EAAE,CAAC;IAChB,mDAAmD;IACnD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,GAAG,EACjC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EACjC,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,eAAe,CAAC,CAY1B;AA6BD,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAWvF"}