@kya-os/cli 1.8.3 → 2.0.2

package/dist/utils/dco/git-config.js

@@ -1,161 +0,0 @@
-import { execFile } from "child_process";
-import { promisify } from "util";
-import { existsSync, mkdirSync, readFileSync, realpathSync } from "fs";
-import { isAbsolute, join, resolve, sep } from "path";
-import { writeFileAtomicSafe } from "../cli-kit/index.js";
-const execFileAsync = promisify(execFile);
-/** Resolve symlinks when the path exists; fall back to the input otherwise. */
-function realpathIfExists(path) {
-    try {
-        return realpathSync(path);
-    }
-    catch {
-        return resolve(path);
-    }
-}
-export const HOOK_MARKER = "# mcpi-dco-hook";
-async function git(args, cwd) {
-    const { stdout } = await execFileAsync("git", args, {
-        cwd,
-        encoding: "utf8",
-    });
-    return stdout.trim();
-}
-export async function isGitRepo(cwd) {
-    try {
-        return (await git(["rev-parse", "--is-inside-work-tree"], cwd)) === "true";
-    }
-    catch {
-        return false;
-    }
-}
-export async function getGitConfigValue(key, cwd, scope) {
-    const args = ["config"];
-    if (scope) {
-        args.push(`--${scope}`);
-    }
-    args.push("--get", key);
-    try {
-        return await git(args, cwd);
-    }
-    catch {
-        return null;
-    }
-}
-export async function setGitConfig(entries, options) {
-    const scope = options.global ? "--global" : "--local";
-    for (const [key, value] of Object.entries(entries)) {
-        await git(["config", scope, key, value], options.cwd);
-    }
-}
-/**
- * Detect pre-existing signing configuration that our setup would silently
- * override, e.g. a user who already GPG-signs commits. Only differing values
- * count; matching values mean a previous run and are fine to reapply.
- *
- * `scope` selects which config layer to read: the default (undefined) reads
- * the effective value; "local" reads only repo-local entries, which is how a
- * `--global` write detects repo-local values that would still shadow it.
- */
-export async function detectSigningConflicts(cwd, desired, scope) {
-    const conflicts = [];
-    for (const [key, desiredValue] of Object.entries(desired)) {
-        const current = await getGitConfigValue(key, cwd, scope);
-        if (current !== null && current !== desiredValue) {
-            conflicts.push({ key, current, desired: desiredValue });
-        }
-    }
-    return conflicts;
-}
-export async function getHooksDir(cwd) {
-    const hooksPath = await getGitConfigValue("core.hooksPath", cwd);
-    if (hooksPath) {
-        // core.hooksPath is relative to the working-tree root, not cwd.
-        const topLevel = await git(["rev-parse", "--show-toplevel"], cwd);
-        const dir = isAbsolute(hooksPath)
-            ? hooksPath
-            : resolve(topLevel, hooksPath);
-        return { dir, source: "core.hooksPath" };
-    }
-    // --git-path resolves "hooks" against the COMMON git dir (where git actually
-    // runs hooks from, which matters in linked worktrees where the per-worktree
-    // git dir differs), and --path-format=absolute removes the cwd-relative
-    // ambiguity that made a bare --git-path point at the wrong directory from a
-    // subdirectory. Requires git >= 2.31, well below the >= 2.34 that SSH commit
-    // signing (the point of this feature) already needs.
-    const hooksDir = await git(["rev-parse", "--path-format=absolute", "--git-path", "hooks"], cwd);
-    return { dir: hooksDir, source: "default" };
-}
-function shQuote(value) {
-    return `'${value.replace(/'/g, "'\\''")}'`;
-}
-export function buildTrailerHook(human, agent) {
-    const signedOffBy = shQuote(`Signed-off-by: ${human.name} <${human.email}>`);
-    const coAuthoredBy = shQuote(`Co-authored-by: ${agent.name} <${agent.email}>`);
-    return `#!/bin/sh
-${HOOK_MARKER} v1
-# Managed by \`dco setup\`. Appends the DCO sign-off and agent
-# attribution trailers to commit messages when they are missing.
-
-COMMIT_MSG_FILE="$1"
-COMMIT_SOURCE="$2"
-
-case "$COMMIT_SOURCE" in
-  merge|squash)
-    exit 0
-    ;;
-esac
-
-git interpret-trailers --in-place --if-exists addIfDifferent \\
-  --trailer ${signedOffBy} \\
-  --trailer ${coAuthoredBy} \\
-  "$COMMIT_MSG_FILE"
-`;
-}
-/**
- * Install (or refresh) the prepare-commit-msg trailer hook. A hook we did not
- * write is never modified, and a core.hooksPath pointing outside the repo is
- * never written to (a crafted repo config must not make us create files at
- * arbitrary locations); the caller falls back to instruction-based trailers
- * in both cases.
- */
-export async function installTrailerHook(cwd, human, agent, options = {}) {
-    const { dir, source } = await getHooksDir(cwd);
-    const hookPath = join(dir, "prepare-commit-msg");
-    if (source === "core.hooksPath") {
-        const topLevel = realpathIfExists(await git(["rev-parse", "--show-toplevel"], cwd));
-        const gitDir = realpathIfExists(await git(["rev-parse", "--absolute-git-dir"], cwd));
-        const resolvedDir = realpathIfExists(dir);
-        const inside = (parent) => resolvedDir === parent || resolvedDir.startsWith(parent + sep);
-        if (!inside(topLevel) && !inside(gitDir)) {
-            return { result: "unsafe-hooks-path", path: hookPath };
-        }
-    }
-    const content = buildTrailerHook(human, agent);
-    if (existsSync(hookPath)) {
-        const existing = readFileSync(hookPath, "utf-8");
-        if (!existing.includes(HOOK_MARKER)) {
-            return { result: "foreign-hook", path: hookPath };
-        }
-        if (existing === content) {
-            return { result: "unchanged", path: hookPath };
-        }
-        if (options.dryRun) {
-            return { result: "would-change", path: hookPath };
-        }
-        // Symlink-safe: hookPath lives under a possibly-untrusted repo, and a
-        // planted symlink there would otherwise be followed. 0755 so git can
-        // execute the hook.
-        writeFileAtomicSafe(hookPath, content, 0o755);
-        return { result: "updated", path: hookPath };
-    }
-    if (options.dryRun) {
-        return { result: "would-change", path: hookPath };
-    }
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true });
-    }
-    writeFileAtomicSafe(hookPath, content, 0o755);
-    return { result: "installed", path: hookPath };
-}
-//# sourceMappingURL=git-config.js.map

package/dist/utils/dco/git-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"git-config.js","sourceRoot":"","sources":["../../../src/utils/dco/git-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAO7C,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAW;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;QAClD,GAAG;QACH,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,GAAW,EACX,KAA0B;IAE1B,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA+B,EAC/B,OAA0C;IAE1C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,OAA+B,EAC/B,KAA0B;IAE1B,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACjE,IAAI,SAAS,EAAE,CAAC;QACd,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC;YAC/B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3C,CAAC;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,qDAAqD;IACrD,MAAM,QAAQ,GAAG,MAAM,GAAG,CACxB,CAAC,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,OAAO,CAAC,EAC9D,GAAG,CACJ,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAkB,EAClB,KAAkB;IAElB,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,OAAO,CAC1B,mBAAmB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,GAAG,CACjD,CAAC;IACF,OAAO;EACP,WAAW;;;;;;;;;;;;;;cAcC,WAAW;cACX,YAAY;;CAEzB,CAAC;AACF,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,KAAkB,EAClB,KAAkB,EAClB,UAAgC,EAAE;IAElC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAEjD,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CACjD,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAC7B,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,GAAG,CAAC,CACpD,CAAC;QACF,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAChC,WAAW,KAAK,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE/C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpD,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,oBAAoB;QACpB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC"}

package/dist/utils/dco/github.d.ts

@@ -1,150 +0,0 @@
-/**
- * Thin wrapper around the GitHub CLI (`gh`). We deliberately shell out to gh
- * instead of handling OAuth tokens ourselves: the user's existing gh auth is
- * the credential, and it never passes through this process beyond gh's own
- * environment.
- */
-export declare const SIGNING_KEY_SCOPE = "admin:ssh_signing_key";
-export declare const SCOPE_REFRESH_COMMAND = "gh auth refresh -h github.com -s admin:ssh_signing_key";
-export declare class GhNotInstalledError extends Error {
-    constructor();
-}
-/**
- * The default gh token does not include the admin:ssh_signing_key scope, so
- * both listing and uploading signing keys fail until the user refreshes.
- * GitHub reports the missing scope as HTTP 404 on these endpoints.
- */
-export declare class GhScopeError extends Error {
-    readonly refreshCommand = "gh auth refresh -h github.com -s admin:ssh_signing_key";
-    constructor();
-}
-export interface GhUser {
-    login: string;
-    id: number;
-    name?: string | null;
-}
-export interface SigningKeyEntry {
-    id: number;
-    key: string;
-    title: string;
-}
-export declare function isGhInstalled(): Promise<boolean>;
-export declare function isGhAuthenticated(): Promise<boolean>;
-export declare function getGhUser(): Promise<GhUser>;
-/** GitHub's commit-attribution noreply address for the authenticated user. */
-export declare function githubNoreplyEmail(user: GhUser): string;
-export declare function listSigningKeys(): Promise<SigningKeyEntry[]>;
-export declare function uploadSigningKey(publicKeyLine: string, title: string): Promise<void>;
-/**
- * Compare the base64 body of an authorized_keys style line against uploaded
- * keys. GitHub returns keys without comments, so comparing the full line
- * would always miss.
- */
-export declare function signingKeyAlreadyUploaded(keys: SigningKeyEntry[], publicKeyLine: string): boolean;
-/**
- * Run `gh auth refresh` interactively so the user can grant the signing key
- * scope without leaving the flow. Requires a TTY; the caller must check.
- */
-export declare function refreshAuthScope(): Promise<boolean>;
-/**
- * Read a pull request's description. Accepts anything `gh pr view` accepts:
- * a full URL, or a number when run inside the repo.
- *
- * Returns the body verbatim — callers verify its contents rather than trust
- * them, since a PR description is author-controlled text.
- */
-export declare function getPullRequestBody(target: string): Promise<string>;
-export interface PullRequestSummary {
-    number: number;
-    headRefOid: string;
-    headRefName: string;
-    state: string;
-    url: string;
-    isCrossRepository: boolean;
-}
-/**
- * Fetch the PR's current head SHA, state, and other polling-relevant fields
- * in one call — the same fields the `agent task --watch` / `agent review
- * --watch` loops re-fetch on every poll tick to detect a new head or a
- * closed PR.
- */
-export declare function getPullRequestSummary(target: string, repo?: string): Promise<PullRequestSummary>;
-/** Read-only unified diff for the PR. Never mutates anything. */
-export declare function getPullRequestDiff(target: string, repo?: string): Promise<string>;
-export interface PullRequestReview {
-    id: number;
-    author: {
-        login: string;
-    } | null;
-    authorAssociation?: string;
-    body: string;
-    state: string;
-    submittedAt?: string;
-}
-/** Every review posted on the PR, in the order GitHub returns them. */
-export declare function getPullRequestReviews(target: string, repo?: string): Promise<PullRequestReview[]>;
-export interface PullRequestComment {
-    id: number;
-    author: {
-        login: string;
-    } | null;
-    body: string;
-    createdAt?: string;
-}
-/** Every top-level issue comment on the PR (not review comments). */
-export declare function getPullRequestComments(target: string, repo?: string): Promise<PullRequestComment[]>;
-export type PullRequestReviewEvent = "APPROVE" | "REQUEST_CHANGES" | "COMMENT";
-export interface PostPullRequestReviewResult {
-    ok: boolean;
-    /**
-     * True when `gh` rejected the review with GitHub's self-review 422 (the
-     * authenticated token owns the PR, so it cannot APPROVE/REQUEST_CHANGES on
-     * it). The caller decides what to do next — this function only reports
-     * the fact, it does not retry as a COMMENT itself, since the caller is the
-     * one that knows to say so in its own output (see review-loop P13's design
-     * doc).
-     */
-    selfReviewRejected?: boolean;
-}
-/**
- * Post a real GitHub PR review: `APPROVE`, `REQUEST_CHANGES`, or `COMMENT`.
- * `body` carries the human-readable findings section plus the fenced
- * `kya-os-signed-verdict` block — this function is content-agnostic, it
- * just posts whatever string it's given.
- */
-export declare function postPullRequestReview(target: string, options: {
-    event: PullRequestReviewEvent;
-    body: string;
-}, repo?: string): Promise<PostPullRequestReviewResult>;
-/**
- * Distinct from {@link PullRequestReview} above (review-loop P13's richer
- * shape, for `getPullRequestReviews`) — this is the narrower shape
- * `getPullRequestReviewData` below actually needs: just enough to extract
- * and verify a fenced `kya-os-signed-verdict` block, not a full review
- * record. Renamed off the plain `PullRequestReview` it originally shared
- * with P13's type to resolve the naming collision when both PRs' `gh.ts`
- * additions landed on `main`.
- */
-export interface VerdictSourceReview {
-    /** The reviewer's GitHub login, when `gh` reports one (a deleted/bot account can omit it). */
-    login: string;
-    body: string;
-}
-export interface PullRequestReviewData {
-    reviews: VerdictSourceReview[];
-    /** The PR's current head commit SHA — used to flag a signed verdict against a superseded head as stale. */
-    headSha: string;
-}
-/**
- * Read a pull request's reviews and current head SHA (review-loop P9
- * commit 3: `kya-os review verify`). Sibling to {@link getPullRequestBody},
- * same `gh pr view` + ENOENT/scope-error handling via the private `gh()`
- * helper above — review bodies are where the publisher (review-publisher.ts,
- * compute) posts the fenced `kya-os-signed-verdict` block this command
- * extracts and verifies.
- *
- * Review/comment bodies are returned verbatim — callers verify their
- * contents rather than trust them, same as {@link getPullRequestBody}.
- */
-export declare function getPullRequestReviewData(target: string): Promise<PullRequestReviewData>;
-//# sourceMappingURL=github.d.ts.map

package/dist/utils/dco/github.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/github.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AAEH,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AACzD,eAAO,MAAM,qBAAqB,2DAA0D,CAAC;AAE7F,qBAAa,mBAAoB,SAAQ,KAAK;;CAO7C;AAED;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,cAAc,4DAAyB;;CAOjD;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AA+BD,wBAAsB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAOtD;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAU1D;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAYjD;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAalE;AAED,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,eAAe,EAAE,EACvB,aAAa,EAAE,MAAM,GACpB,OAAO,CAMT;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAWzD;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGxE;AAcD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAwBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;AAED,iEAAiE;AACjE,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvF;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,uEAAuE;AACvE,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAK9B;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qEAAqE;AACrE,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAK/B;AAED,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAE/E,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,OAAO,CAAC;IACZ;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAmBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,KAAK,EAAE,sBAAsB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACxD,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,2BAA2B,CAAC,CAmBtC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,2GAA2G;IAC3G,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,qBAAqB,CAAC,CAiBhC"}

package/dist/utils/dco/github.js

@@ -1,287 +0,0 @@
-import { execFile } from "child_process";
-import { promisify } from "util";
-const execFileAsync = promisify(execFile);
-/**
- * Thin wrapper around the GitHub CLI (`gh`). We deliberately shell out to gh
- * instead of handling OAuth tokens ourselves: the user's existing gh auth is
- * the credential, and it never passes through this process beyond gh's own
- * environment.
- */
-export const SIGNING_KEY_SCOPE = "admin:ssh_signing_key";
-export const SCOPE_REFRESH_COMMAND = `gh auth refresh -h github.com -s ${SIGNING_KEY_SCOPE}`;
-export class GhNotInstalledError extends Error {
-    constructor() {
-        super("GitHub CLI (gh) is not installed. Install it from https://cli.github.com and run `gh auth login`.");
-        this.name = "GhNotInstalledError";
-    }
-}
-/**
- * The default gh token does not include the admin:ssh_signing_key scope, so
- * both listing and uploading signing keys fail until the user refreshes.
- * GitHub reports the missing scope as HTTP 404 on these endpoints.
- */
-export class GhScopeError extends Error {
-    constructor() {
-        super(`Your GitHub token is missing the ${SIGNING_KEY_SCOPE} scope. Run: ${SCOPE_REFRESH_COMMAND}`);
-        this.refreshCommand = SCOPE_REFRESH_COMMAND;
-        this.name = "GhScopeError";
-    }
-}
-async function gh(args) {
-    try {
-        const { stdout } = await execFileAsync("gh", args, {
-            encoding: "utf8",
-            maxBuffer: 10 * 1024 * 1024,
-        });
-        return stdout;
-    }
-    catch (error) {
-        if (error?.code === "ENOENT") {
-            throw new GhNotInstalledError();
-        }
-        throw error;
-    }
-}
-function isScopeError(error) {
-    const err = error;
-    const message = `${err?.stderr ?? ""} ${err?.message ?? ""}`;
-    // Deliberately narrow: never key off the bare 403 status, which GitHub
-    // also uses for rate limits and SSO enforcement where scope-refresh advice
-    // would be wrong. Only the explicit scope name, HTTP 404, or a "Resource
-    // not accessible" body count as scope problems.
-    return (message.includes(SIGNING_KEY_SCOPE) ||
-        /HTTP 404/.test(message) ||
-        /Resource not accessible/i.test(message));
-}
-export async function isGhInstalled() {
-    try {
-        await gh(["--version"]);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export async function isGhAuthenticated() {
-    try {
-        await gh(["auth", "status", "--hostname", "github.com"]);
-        return true;
-    }
-    catch (error) {
-        if (error instanceof GhNotInstalledError) {
-            throw error;
-        }
-        return false;
-    }
-}
-export async function getGhUser() {
-    const stdout = await gh([
-        "api",
-        "user",
-        "--jq",
-        "{login: .login, id: .id, name: .name}",
-    ]);
-    const parsed = JSON.parse(stdout);
-    if (!parsed?.login || typeof parsed.id !== "number") {
-        throw new Error("Unexpected response from `gh api user`");
-    }
-    return parsed;
-}
-/** GitHub's commit-attribution noreply address for the authenticated user. */
-export function githubNoreplyEmail(user) {
-    return `${user.id}+${user.login}@users.noreply.github.com`;
-}
-export async function listSigningKeys() {
-    try {
-        const stdout = await gh(["api", "user/ssh_signing_keys", "--paginate"]);
-        return JSON.parse(stdout);
-    }
-    catch (error) {
-        if (error instanceof GhNotInstalledError) {
-            throw error;
-        }
-        if (isScopeError(error)) {
-            throw new GhScopeError();
-        }
-        throw error;
-    }
-}
-export async function uploadSigningKey(publicKeyLine, title) {
-    try {
-        await gh([
-            "api",
-            "user/ssh_signing_keys",
-            "-f",
-            `key=${publicKeyLine}`,
-            "-f",
-            `title=${title}`,
-        ]);
-    }
-    catch (error) {
-        if (error instanceof GhNotInstalledError) {
-            throw error;
-        }
-        if (isScopeError(error)) {
-            throw new GhScopeError();
-        }
-        throw error;
-    }
-}
-/**
- * Compare the base64 body of an authorized_keys style line against uploaded
- * keys. GitHub returns keys without comments, so comparing the full line
- * would always miss.
- */
-export function signingKeyAlreadyUploaded(keys, publicKeyLine) {
-    const body = publicKeyLine.split(/\s+/)[1];
-    if (!body) {
-        return false;
-    }
-    return keys.some((entry) => entry.key.split(/\s+/)[1] === body);
-}
-/**
- * Run `gh auth refresh` interactively so the user can grant the signing key
- * scope without leaving the flow. Requires a TTY; the caller must check.
- */
-export async function refreshAuthScope() {
-    const { spawn } = await import("child_process");
-    return new Promise((resolve) => {
-        const child = spawn("gh", ["auth", "refresh", "-h", "github.com", "-s", SIGNING_KEY_SCOPE], { stdio: "inherit" });
-        child.on("error", () => resolve(false));
-        child.on("close", (code) => resolve(code === 0));
-    });
-}
-/**
- * Read a pull request's description. Accepts anything `gh pr view` accepts:
- * a full URL, or a number when run inside the repo.
- *
- * Returns the body verbatim — callers verify its contents rather than trust
- * them, since a PR description is author-controlled text.
- */
-export async function getPullRequestBody(target) {
-    const stdout = await gh(["pr", "view", target, "--json", "body", "-q", ".body"]);
-    return stdout;
-}
-/**
- * Appends `-R <repo>` when `repo` is given, pinning the call to that repo
- * explicitly rather than relying on `gh`'s ambient cwd-derived resolution
- * (which prefers `GH_REPO`/`gh repo set-default` over cwd's git remote) —
- * same reasoning as `fix.ts`'s `-R targetRepo` calls. `agent task/review/verify`
- * commands run against a fresh clone or no checkout at all, so an explicit
- * repo is the norm here, not the exception.
- */
-function withRepo(args, repo) {
-    return repo ? [...args, "-R", repo] : args;
-}
-function parsePullRequestSummary(stdout) {
-    const parsed = JSON.parse(stdout);
-    if (typeof parsed.number !== "number" ||
-        typeof parsed.headRefOid !== "string" ||
-        typeof parsed.headRefName !== "string" ||
-        typeof parsed.state !== "string" ||
-        typeof parsed.url !== "string" ||
-        typeof parsed.isCrossRepository !== "boolean") {
-        throw new Error("Unexpected response from `gh pr view --json`");
-    }
-    return {
-        number: parsed.number,
-        headRefOid: parsed.headRefOid,
-        headRefName: parsed.headRefName,
-        state: parsed.state,
-        url: parsed.url,
-        isCrossRepository: parsed.isCrossRepository,
-    };
-}
-/**
- * Fetch the PR's current head SHA, state, and other polling-relevant fields
- * in one call — the same fields the `agent task --watch` / `agent review
- * --watch` loops re-fetch on every poll tick to detect a new head or a
- * closed PR.
- */
-export async function getPullRequestSummary(target, repo) {
-    const stdout = await gh(withRepo(["pr", "view", target, "--json", "number,headRefOid,headRefName,state,url,isCrossRepository"], repo));
-    return parsePullRequestSummary(stdout);
-}
-/** Read-only unified diff for the PR. Never mutates anything. */
-export async function getPullRequestDiff(target, repo) {
-    return gh(withRepo(["pr", "diff", target], repo));
-}
-/** Every review posted on the PR, in the order GitHub returns them. */
-export async function getPullRequestReviews(target, repo) {
-    const stdout = await gh(withRepo(["pr", "view", target, "--json", "reviews", "-q", ".reviews"], repo));
-    return JSON.parse(stdout);
-}
-/** Every top-level issue comment on the PR (not review comments). */
-export async function getPullRequestComments(target, repo) {
-    const stdout = await gh(withRepo(["pr", "view", target, "--json", "comments", "-q", ".comments"], repo));
-    return JSON.parse(stdout);
-}
-/**
- * GitHub's self-review rejection names the PR as the requester's own —
- * distinct from a scope/auth/rate-limit failure, neither of which should
- * be silently swallowed as "must be a self-review". Confirmed live against
- * `gh pr review`'s actual error text: `gh`'s GraphQL mutation surfaces this
- * as `GraphQL: Review Can not request changes on your own pull request
- * (addPullRequestReview)` — a GraphQL-level error with no REST-style
- * "HTTP 422" status string anywhere in it, so matching on the phrase alone
- * (not a status code that isn't actually present) is what the real error
- * requires.
- */
-function isSelfReviewError(error) {
-    const err = error;
-    const message = `${err?.stderr ?? ""} ${err?.message ?? ""}`;
-    return /own pull request/i.test(message);
-}
-/**
- * Post a real GitHub PR review: `APPROVE`, `REQUEST_CHANGES`, or `COMMENT`.
- * `body` carries the human-readable findings section plus the fenced
- * `kya-os-signed-verdict` block — this function is content-agnostic, it
- * just posts whatever string it's given.
- */
-export async function postPullRequestReview(target, options, repo) {
-    const flag = options.event === "APPROVE"
-        ? "--approve"
-        : options.event === "REQUEST_CHANGES"
-            ? "--request-changes"
-            : "--comment";
-    try {
-        await gh(withRepo(["pr", "review", target, flag, "--body", options.body], repo));
-        return { ok: true };
-    }
-    catch (error) {
-        if (error instanceof GhNotInstalledError) {
-            throw error;
-        }
-        if (isSelfReviewError(error)) {
-            return { ok: false, selfReviewRejected: true };
-        }
-        throw error;
-    }
-}
-/**
- * Read a pull request's reviews and current head SHA (review-loop P9
- * commit 3: `kya-os review verify`). Sibling to {@link getPullRequestBody},
- * same `gh pr view` + ENOENT/scope-error handling via the private `gh()`
- * helper above — review bodies are where the publisher (review-publisher.ts,
- * compute) posts the fenced `kya-os-signed-verdict` block this command
- * extracts and verifies.
- *
- * Review/comment bodies are returned verbatim — callers verify their
- * contents rather than trust them, same as {@link getPullRequestBody}.
- */
-export async function getPullRequestReviewData(target) {
-    const stdout = await gh([
-        "pr",
-        "view",
-        target,
-        "--json",
-        "reviews,headRefOid",
-    ]);
-    const parsed = JSON.parse(stdout);
-    const reviews = (parsed.reviews ?? []).map((r) => ({
-        login: r.author?.login ?? "unknown",
-        body: r.body ?? "",
-    }));
-    return { reviews, headSha: parsed.headRefOid ?? "" };
-}
-//# sourceMappingURL=github.js.map

package/dist/utils/dco/github.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../src/utils/dco/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AACzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,iBAAiB,EAAE,CAAC;AAE7F,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C;QACE,KAAK,CACH,mGAAmG,CACpG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAErC;QACE,KAAK,CACH,oCAAoC,iBAAiB,gBAAgB,qBAAqB,EAAE,CAC7F,CAAC;QAJK,mBAAc,GAAG,qBAAqB,CAAC;QAK9C,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAcD,KAAK,UAAU,EAAE,CAAC,IAAc;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE;YACjD,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,GAAG,GAAG,KAA8C,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG,GAAG,EAAE,MAAM,IAAI,EAAE,IAAI,GAAG,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;IAC7D,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,gDAAgD;IAChD,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACnC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QACxB,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;QACtB,KAAK;QACL,MAAM;QACN,MAAM;QACN,uCAAuC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAW,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,2BAA2B,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,uBAAuB,EAAE,YAAY,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAsB,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,CAAC;YACP,KAAK;YACL,uBAAuB;YACvB,IAAI;YACJ,OAAO,aAAa,EAAE;YACtB,IAAI;YACJ,SAAS,KAAK,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAuB,EACvB,aAAqB;IAErB,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CACjB,IAAI,EACJ,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,CAAC,EAChE,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,IAAc,EAAE,IAAwB;IACxD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAWD,SAAS,uBAAuB,CAAC,MAAc;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAgC,CAAC;IACjE,IACE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,OAAO,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,IAAa;IAEb,MAAM,MAAM,GAAG,MAAM,EAAE,CACrB,QAAQ,CACN,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,2DAA2D,CAAC,EAC7F,IAAI,CACL,CACF,CAAC;IACF,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAa;IACpE,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC;AAWD,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,IAAa;IAEb,MAAM,MAAM,GAAG,MAAM,EAAE,CACrB,QAAQ,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAC9E,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAwB,CAAC;AACnD,CAAC;AASD,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,IAAa;IAEb,MAAM,MAAM,GAAG,MAAM,EAAE,CACrB,QAAQ,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAChF,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAyB,CAAC;AACpD,CAAC;AAiBD;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,GAAG,GAAG,KAA8C,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG,GAAG,EAAE,MAAM,IAAI,EAAE,IAAI,GAAG,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;IAC7D,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,OAAwD,EACxD,IAAa;IAEb,MAAM,IAAI,GACR,OAAO,CAAC,KAAK,KAAK,SAAS;QACzB,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,iBAAiB;YACnC,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,WAAW,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACjF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAuBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;QACtB,IAAI;QACJ,MAAM;QACN,MAAM;QACN,QAAQ;QACR,oBAAoB;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAG/B,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,SAAS;QACnC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;KACnB,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;AACvD,CAAC"}

package/dist/utils/dco/paths.d.ts

@@ -1,9 +0,0 @@
-export { SLUG_PATTERN, isValidSlug } from "../cli-kit/index.js";
-/** Directory holding converted SSH signing keys, always absolute. */
-export declare function keysDir(): string;
-/**
- * Path for a slug's private key. Throws on slugs that fail validation so a
- * crafted slug can never traverse outside the keys directory.
- */
-export declare function signingKeyPath(slug: string): string;
-//# sourceMappingURL=paths.d.ts.map

package/dist/utils/dco/paths.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/paths.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEhE,qEAAqE;AACrE,wBAAgB,OAAO,IAAI,MAAM,CAEhC;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOnD"}

package/dist/utils/dco/paths.js

@@ -1,18 +0,0 @@
-import { join, resolve } from "path";
-import { SLUG_PATTERN, isValidSlug, stateDir } from "../cli-kit/index.js";
-export { SLUG_PATTERN, isValidSlug } from "../cli-kit/index.js";
-/** Directory holding converted SSH signing keys, always absolute. */
-export function keysDir() {
-    return resolve(process.env.MCPI_KEYS_DIR || stateDir("mcpi", "keys"));
-}
-/**
- * Path for a slug's private key. Throws on slugs that fail validation so a
- * crafted slug can never traverse outside the keys directory.
- */
-export function signingKeyPath(slug) {
-    if (!isValidSlug(slug)) {
-        throw new Error(`Invalid agent slug "${slug}": must match ${SLUG_PATTERN} (lowercase letters, numbers, dashes)`);
-    }
-    return join(keysDir(), slug);
-}
-//# sourceMappingURL=paths.js.map

package/dist/utils/dco/paths.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/utils/dco/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE1E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEhE,qEAAqE;AACrE,MAAM,UAAU,OAAO;IACrB,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,iBAAiB,YAAY,uCAAuC,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC"}