@kya-os/cli 1.8.3 → 2.0.2

package/dist/utils/github-credential.js

@@ -1,308 +0,0 @@
-import { execFile } from "node:child_process";
-import { createHash, randomBytes as nodeRandomBytes } from "node:crypto";
-import { existsSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
-import { promisify } from "node:util";
-import { ensureSecureDir, stateDir, writeFileAtomicSafe, writeSecureFile, } from "./cli-kit/index.js";
-import { GhNotInstalledError, isGhAuthenticated, isGhInstalled } from "./dco/github.js";
-const execFileAsync = promisify(execFile);
-/** Absolute path to the credential directory, e.g. ~/.mcpi/github. Overridable for tests via MCPI_GITHUB_DIR. */
-export function credentialsDir() {
-    return resolve(process.env.MCPI_GITHUB_DIR || stateDir("mcpi", "github"));
-}
-/** Absolute path to the credential store file. */
-export function credentialsPath() {
-    return join(credentialsDir(), "credentials.json");
-}
-/**
- * sha256 hex digest of a secret's raw bytes (the token, or the webhook
- * secret). GitHub PATs and this module's hex-encoded webhook secrets are
- * always ASCII, so UTF-8 encoding is exact-byte equivalent to hashing the
- * secret's actual byte representation. This is the ONLY form either secret
- * is ever allowed to leave this module in -- the anchor (see
- * `github-credential-anchor.ts`) carries fingerprints exclusively.
- */
-export function fingerprintSecret(secret) {
-    return createHash("sha256").update(secret, "utf8").digest("hex");
-}
-/** Runtime shape guard: a corrupt or hand-edited file must never crash a caller. */
-function isStoredGithubCredential(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const v = value;
-    return (typeof v.githubLogin === "string" &&
-        typeof v.token === "string" &&
-        typeof v.webhookSecret === "string" &&
-        typeof v.createdAt === "string" &&
-        Array.isArray(v.scopes) &&
-        v.scopes.every((s) => typeof s === "string"));
-}
-/** The currently stored credential, or undefined if none exists (or the file is unreadable/corrupt). */
-export function readStoredCredential() {
-    const path = credentialsPath();
-    if (!existsSync(path))
-        return undefined;
-    try {
-        const parsed = JSON.parse(readFileSync(path, "utf-8"));
-        return isStoredGithubCredential(parsed) ? parsed : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Persist `credential` at {@link credentialsPath}, 0600 inside a 0700
- * directory ({@link credentialsDir}).
- *
- * A pre-existing file is never silently overwritten (sentinel `8297a1e`'s
- * lesson, transposed: operate only on YOUR OWN prior credential, and only
- * once that's been confirmed, never by assuming the file is stale). This
- * check is on FILE PRESENCE, not on `readStoredCredential`'s shape-validated
- * result: a file that exists but fails the shape guard (corrupt, truncated
- * by an interrupted prior write, or a future incompatible format) still has
- * a live token sitting in it and must still gate on confirmation -- treating
- * "can't parse it" the same as "nothing here" would silently discard that
- * token with no rotation record, exactly the audit-trail gap anchoring
- * exists to close. On a confirmed rotation the old file is replaced
- * atomically (write temp + rename, `writeFileAtomicSafe`) and, when the
- * prior file WAS well-formed, the result carries its token's fingerprint as
- * `supersedesFingerprint` for the caller to bind into the next anchor's
- * `supersedes` field -- absent when the prior file was corrupt, since there
- * is no valid token to fingerprint.
- */
-export async function saveGithubCredential(credential, options) {
-    const path = credentialsPath();
-    const fileExists = existsSync(path);
-    const existing = readStoredCredential();
-    if (fileExists) {
-        const confirmed = await options.confirmRotateImpl();
-        if (!confirmed) {
-            return { status: "declined" };
-        }
-        ensureSecureDir(credentialsDir());
-        writeFileAtomicSafe(path, JSON.stringify(credential, null, 2) + "\n", 0o600);
-        return {
-            status: "saved",
-            credential,
-            ...(existing ? { supersedesFingerprint: fingerprintSecret(existing.token) } : {}),
-        };
-    }
-    ensureSecureDir(credentialsDir());
-    writeSecureFile(path, JSON.stringify(credential, null, 2) + "\n");
-    return { status: "saved", credential };
-}
-// ── Acquisition ─────────────────────────────────────────────────────────
-/** Sentinel's proven classic-token grant list (README:33-35, `Know-That-Ai/sentinel` @ 83c0ed5). */
-export const CLASSIC_REQUIRED_SCOPES = ["repo", "admin:repo_hook"];
-/** Sentinel's proven fine-grained equivalent, printed verbatim for the user to grant. */
-export const FINE_GRAINED_GRANTS = [
-    "Metadata: Read",
-    "Pull requests: Read & Write",
-    "Contents: Read",
-    "Webhooks: Read & Write",
-];
-export const GITHUB_PAT_SETTINGS_URL = "https://github.com/settings/personal-access-tokens/new";
-/**
- * Parse `gh api user -i` output (headers followed by a blank line, then the
- * JSON body) into a {@link ScopeProbeResult}. Pure -- no process spawning --
- * so this is unit-testable directly against canned `gh` output without a
- * live GitHub call or even a `gh` binary on PATH.
- */
-export function parseGhApiUserWithHeaders(raw) {
-    const normalized = raw.replace(/\r\n/g, "\n");
-    const blankIndex = normalized.indexOf("\n\n");
-    const headerBlock = blankIndex === -1 ? normalized : normalized.slice(0, blankIndex);
-    const bodyBlock = blankIndex === -1 ? "" : normalized.slice(blankIndex + 2);
-    let login;
-    try {
-        const parsedBody = JSON.parse(bodyBlock.trim());
-        if (parsedBody &&
-            typeof parsedBody === "object" &&
-            typeof parsedBody.login === "string") {
-            login = parsedBody.login;
-        }
-    }
-    catch {
-        // Body isn't parseable JSON -- login stays undefined; handled below.
-    }
-    const scopesLine = headerBlock
-        .split("\n")
-        .find((line) => /^x-oauth-scopes:/i.test(line.trim()));
-    if (scopesLine) {
-        const value = scopesLine.slice(scopesLine.indexOf(":") + 1).trim();
-        const scopes = value.length === 0
-            ? []
-            : value
-                .split(",")
-                .map((s) => s.trim())
-                .filter((s) => s.length > 0);
-        const missing = CLASSIC_REQUIRED_SCOPES.filter((required) => !scopes.includes(required));
-        if (missing.length > 0) {
-            return {
-                probe: "classic-x-oauth-scopes",
-                ok: false,
-                login,
-                scopes,
-                missing,
-                detail: `classic token via gh is missing required scope(s): ${missing.join(", ")}`,
-            };
-        }
-        return {
-            probe: "classic-x-oauth-scopes",
-            ok: true,
-            login,
-            scopes,
-            detail: `classic token scopes verified via X-OAuth-Scopes: ${scopes.join(", ")}`,
-        };
-    }
-    if (login) {
-        return {
-            probe: "fine-grained-user-read",
-            ok: true,
-            login,
-            detail: "fine-grained token does not report scopes over the API; verified only that it authenticates via a GET /user probe",
-        };
-    }
-    return {
-        probe: "fine-grained-user-read",
-        ok: false,
-        detail: "fine-grained probe (GET /user) did not return a usable login",
-    };
-}
-async function runGh(args, env) {
-    try {
-        const { stdout } = await execFileAsync("gh", args, {
-            encoding: "utf8",
-            maxBuffer: 10 * 1024 * 1024,
-            env: env ? { ...process.env, ...env } : process.env,
-        });
-        return stdout;
-    }
-    catch (error) {
-        if (error?.code === "ENOENT") {
-            throw new GhNotInstalledError();
-        }
-        throw error;
-    }
-}
-async function defaultApiUserWithHeaders() {
-    return runGh(["api", "user", "-i"]);
-}
-/** Same probe, but authenticated as a specific pasted token rather than gh's own stored auth -- never as a CLI arg (visible in `ps`), only via env. */
-async function defaultApiUserWithHeadersForToken(token) {
-    return runGh(["api", "user", "-i"], { GH_TOKEN: token });
-}
-async function defaultGhAuthToken() {
-    return (await runGh(["auth", "token"])).trim();
-}
-/** Masked paste prompt -- inquirer's "password" type never echoes input. */
-async function defaultPromptForToken() {
-    const inquirer = (await import("inquirer")).default;
-    const { token } = await inquirer.prompt([
-        {
-            type: "password",
-            name: "token",
-            message: "Paste your fine-grained GitHub PAT (input hidden):",
-            mask: "*",
-        },
-    ]);
-    return token.trim();
-}
-async function tryExistingGhCredential(options) {
-    const installed = await options.isGhInstalledImpl().catch(() => false);
-    if (!installed)
-        return undefined;
-    const authenticated = await options.isGhAuthenticatedImpl().catch(() => false);
-    if (!authenticated)
-        return undefined;
-    const raw = await options.apiUserWithHeadersImpl();
-    const probe = parseGhApiUserWithHeaders(raw);
-    options.onNotice(probe.detail);
-    if (!probe.ok || !probe.login)
-        return undefined;
-    const token = await options.ghAuthTokenImpl();
-    return {
-        githubLogin: probe.login,
-        token,
-        scopes: probe.scopes ?? [...FINE_GRAINED_GRANTS],
-    };
-}
-/** Verify a specific token (pasted, or supplied via --github-token-env) and derive its login/scopes. Shared by both paths so neither can drift. */
-async function verifyAndDeriveFromToken(token, options, failureContext) {
-    const raw = await options.apiUserWithHeadersForTokenImpl(token);
-    const probe = parseGhApiUserWithHeaders(raw);
-    options.onNotice(probe.detail);
-    if (!probe.ok || !probe.login) {
-        throw new Error(`Could not verify the ${failureContext}: ${probe.detail}`);
-    }
-    return {
-        githubLogin: probe.login,
-        token,
-        scopes: probe.scopes ?? [...FINE_GRAINED_GRANTS],
-    };
-}
-async function acquireViaPaste(options) {
-    options.onNotice([
-        "Create a fine-grained personal access token with exactly these grants, then paste it below:",
-        ...FINE_GRAINED_GRANTS.map((g) => `  - ${g}`),
-        `Create one at: ${GITHUB_PAT_SETTINGS_URL}`,
-    ].join("\n"));
-    const token = await options.promptForTokenImpl();
-    if (!token) {
-        throw new Error("No GitHub token provided.");
-    }
-    return verifyAndDeriveFromToken(token, options, "pasted GitHub token");
-}
-/**
- * Acquire the single GitHub credential for this person on this machine.
- *
- * Acquisition order:
- *   0. `options.presetToken`, when supplied (`kya-os init --github-token-env
- *      NAME`) -- skips both of the below entirely, for a fully
- *      non-interactive run. Verified the same way a pasted token is.
- *   1. `gh auth token`, when `gh` is installed, authenticated, and the
- *      scope probe against its stored token passes (classic: all of
- *      {@link CLASSIC_REQUIRED_SCOPES} present via `X-OAuth-Scopes`;
- *      fine-grained: the `GET /user` probe authenticates).
- *   2. Otherwise, prompt for a pasted fine-grained PAT created with
- *      {@link FINE_GRAINED_GRANTS}, verified the same way.
- *
- * Always generates a fresh `webhookSecret` (32 random bytes, hex) even
- * though the webhook receiver itself ships in P17 -- the anchor binds it
- * from day one so the rotation history the hub sees is complete from the
- * very first anchor.
- */
-export async function acquireGithubCredential(options = {}) {
-    const isGhInstalledImpl = options.isGhInstalledImpl ?? isGhInstalled;
-    const isGhAuthenticatedImpl = options.isGhAuthenticatedImpl ?? isGhAuthenticated;
-    const apiUserWithHeadersImpl = options.apiUserWithHeadersImpl ?? defaultApiUserWithHeaders;
-    const apiUserWithHeadersForTokenImpl = options.apiUserWithHeadersForTokenImpl ?? defaultApiUserWithHeadersForToken;
-    const ghAuthTokenImpl = options.ghAuthTokenImpl ?? defaultGhAuthToken;
-    const promptForTokenImpl = options.promptForTokenImpl ?? defaultPromptForToken;
-    const randomBytesImpl = options.randomBytesImpl ?? nodeRandomBytes;
-    const now = options.now ?? (() => new Date().toISOString());
-    const onNotice = options.onNotice ?? (() => { });
-    let acquired;
-    if (options.presetToken) {
-        acquired = await verifyAndDeriveFromToken(options.presetToken, { apiUserWithHeadersForTokenImpl, onNotice }, "GitHub token from the environment");
-    }
-    else {
-        const existing = await tryExistingGhCredential({
-            isGhInstalledImpl,
-            isGhAuthenticatedImpl,
-            apiUserWithHeadersImpl,
-            ghAuthTokenImpl,
-            onNotice,
-        });
-        acquired =
-            existing ?? (await acquireViaPaste({ apiUserWithHeadersForTokenImpl, promptForTokenImpl, onNotice }));
-    }
-    return {
-        githubLogin: acquired.githubLogin,
-        token: acquired.token,
-        webhookSecret: randomBytesImpl(32).toString("hex"),
-        scopes: acquired.scopes,
-        createdAt: now(),
-    };
-}
-//# sourceMappingURL=github-credential.js.map

package/dist/utils/github-credential.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"github-credential.js","sourceRoot":"","sources":["../../src/utils/github-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAExF,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAwC1C,iHAAiH;AACjH,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,kBAAkB,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,oFAAoF;AACpF,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACvB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,oBAAoB;IAClC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAqBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkC,EAClC,OAAoC;IAEpC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IAExC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChC,CAAC;QACD,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;QAClC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7E,OAAO;YACL,MAAM,EAAE,OAAO;YACf,UAAU;YACV,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;IAClC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAClE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,2EAA2E;AAE3E,oGAAoG;AACpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAU,CAAC;AAE5E,yFAAyF;AACzF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,gBAAgB;IAChB,6BAA6B;IAC7B,gBAAgB;IAChB,wBAAwB;CAChB,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAClC,wDAAwD,CAAC;AAqB3D;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAE5E,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,UAAU,GAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,IACE,UAAU;YACV,OAAO,UAAU,KAAK,QAAQ;YAC9B,OAAQ,UAAsC,CAAC,KAAK,KAAK,QAAQ,EACjE,CAAC;YACD,KAAK,GAAI,UAAsC,CAAC,KAAe,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,WAAW;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEzD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnE,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,KAAK,CAAC;YAChB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,KAAK;iBACF,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,KAAK,EAAE,wBAAwB;gBAC/B,EAAE,EAAE,KAAK;gBACT,KAAK;gBACL,MAAM;gBACN,OAAO;gBACP,MAAM,EAAE,sDAAsD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACnF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,wBAAwB;YAC/B,EAAE,EAAE,IAAI;YACR,KAAK;YACL,MAAM;YACN,MAAM,EAAE,qDAAqD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACjF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO;YACL,KAAK,EAAE,wBAAwB;YAC/B,EAAE,EAAE,IAAI;YACR,KAAK;YACL,MAAM,EACJ,mHAAmH;SACtH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,wBAAwB;QAC/B,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,8DAA8D;KACvE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,IAAc,EAAE,GAAuB;IAC1D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE;YACjD,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;SACpD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB;IACtC,OAAO,KAAK,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,uJAAuJ;AACvJ,KAAK,UAAU,iCAAiC,CAAC,KAAa;IAC5D,OAAO,KAAK,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,qBAAqB;IAClC,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IACpD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACtC;YACE,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,oDAAoD;YAC7D,IAAI,EAAE,GAAG;SACV;KACF,CAAC,CAAC;IACH,OAAQ,KAAgB,CAAC,IAAI,EAAE,CAAC;AAClC,CAAC;AAyBD,KAAK,UAAU,uBAAuB,CACpC,OAKC;IAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAC/E,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAErC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,sBAAsB,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAEhD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;IAC9C,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,mBAAmB,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,mJAAmJ;AACnJ,KAAK,UAAU,wBAAwB,CACrC,KAAa,EACb,OAAsG,EACtG,cAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wBAAwB,cAAc,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,mBAAmB,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAEC;IAED,OAAO,CAAC,QAAQ,CACd;QACE,6FAA6F;QAC7F,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,kBAAkB,uBAAuB,EAAE;KAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAA0C,EAAE;IAE5C,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,aAAa,CAAC;IACrE,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,iBAAiB,CAAC;IACjF,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,yBAAyB,CAAC;IAC3F,MAAM,8BAA8B,GAClC,OAAO,CAAC,8BAA8B,IAAI,iCAAiC,CAAC;IAC9E,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,kBAAkB,CAAC;IACtE,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,qBAAqB,CAAC;IAC/E,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,eAAe,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEhD,IAAI,QAAkE,CAAC;IACvE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,QAAQ,GAAG,MAAM,wBAAwB,CACvC,OAAO,CAAC,WAAW,EACnB,EAAE,8BAA8B,EAAE,QAAQ,EAAE,EAC5C,mCAAmC,CACpC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;YAC7C,iBAAiB;YACjB,qBAAqB;YACrB,sBAAsB;YACtB,eAAe;YACf,QAAQ;SACT,CAAC,CAAC;QACH,QAAQ;YACN,QAAQ,IAAI,CAAC,MAAM,eAAe,CAAC,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,SAAS,EAAE,GAAG,EAAE;KACjB,CAAC;AACJ,CAAC"}

package/dist/utils/gitignore.d.ts

@@ -1,17 +0,0 @@
-/**
- * Adds `entry` to .gitignore if no existing pattern already covers it,
- * including a trailing-`*` wildcard pattern (e.g. `.env*`, create-next-app's
- * own default), the same glob EnvManager.checkGitignore() already honors, so
- * this doesn't append a redundant, already-covered line.
- *
- * Shared by every command that writes a credential-bearing path into a
- * project directory it doesn't fully control (`.env.local`, `.checkpoint/`,
- * `.mcpi/`). Neither write is safe to leave ungitignored: a repo whose
- * `.gitignore` doesn't already cover it (hand-rolled apps, a pruned/custom
- * .gitignore, a repo that was never scaffolded by this CLI) would otherwise
- * let `git add .` stage a real credential straight into history. Callers
- * should call this BEFORE writing the secret, not after, so there's no
- * window where the file exists ungitignored.
- */
-export declare function ensureGitignored(projectRoot: string, entry: string, label: string): void;
-//# sourceMappingURL=gitignore.d.ts.map

package/dist/utils/gitignore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"gitignore.d.ts","sourceRoot":"","sources":["../../src/utils/gitignore.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,IAAI,CAwBN"}

package/dist/utils/gitignore.js

@@ -1,40 +0,0 @@
-import { existsSync, readFileSync, writeFileSync } from "fs";
-import { join } from "path";
-/**
- * Adds `entry` to .gitignore if no existing pattern already covers it,
- * including a trailing-`*` wildcard pattern (e.g. `.env*`, create-next-app's
- * own default), the same glob EnvManager.checkGitignore() already honors, so
- * this doesn't append a redundant, already-covered line.
- *
- * Shared by every command that writes a credential-bearing path into a
- * project directory it doesn't fully control (`.env.local`, `.checkpoint/`,
- * `.mcpi/`). Neither write is safe to leave ungitignored: a repo whose
- * `.gitignore` doesn't already cover it (hand-rolled apps, a pruned/custom
- * .gitignore, a repo that was never scaffolded by this CLI) would otherwise
- * let `git add .` stage a real credential straight into history. Callers
- * should call this BEFORE writing the secret, not after, so there's no
- * window where the file exists ungitignored.
- */
-export function ensureGitignored(projectRoot, entry, label) {
-    const gitignorePath = join(projectRoot, ".gitignore");
-    const bare = entry.replace(/\/$/, "");
-    let content = existsSync(gitignorePath)
-        ? readFileSync(gitignorePath, "utf-8")
-        : "";
-    const alreadyIgnored = content
-        .split("\n")
-        .map((line) => line.trim())
-        .filter((line) => line && !line.startsWith("#"))
-        .some((line) => line === entry ||
-        line === bare ||
-        line === `/${bare}` ||
-        line === `/${entry}` ||
-        (line.endsWith("*") && bare.startsWith(line.slice(0, -1))));
-    if (alreadyIgnored)
-        return;
-    if (content && !content.endsWith("\n"))
-        content += "\n";
-    content += `${content ? "\n" : ""}# ${label}\n${entry}\n`;
-    writeFileSync(gitignorePath, content, "utf-8");
-}
-//# sourceMappingURL=gitignore.js.map

package/dist/utils/gitignore.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gitignore.js","sourceRoot":"","sources":["../../src/utils/gitignore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,KAAa,EACb,KAAa;IAEb,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,UAAU,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,cAAc,GAAG,OAAO;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAC/C,IAAI,CACH,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,IAAI;QACb,IAAI,KAAK,IAAI,IAAI,EAAE;QACnB,IAAI,KAAK,IAAI,KAAK,EAAE;QACpB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAC7D,CAAC;IACJ,IAAI,cAAc;QAAE,OAAO;IAE3B,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,IAAI,CAAC;IACxD,OAAO,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,KAAK,KAAK,IAAI,CAAC;IAC1D,aAAa,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC"}

package/dist/utils/hub-config.d.ts

@@ -1,21 +0,0 @@
-/**
- * Reads `~/.mcpi/hub.json`, written by review-loop P17's hub-context stage
- * (`packages/cli/src/utils/hub-context.ts`, not yet on `main`). This file
- * is deliberately READ-ONLY and does not write that shape: P17 owns the
- * resolution order (explicit endpoint, reachable production hub, local
- * hub offer) and the write side. This exists so anything that only needs
- * to know "is a hub configured, and where" -- today, the TUI agents view's
- * hub-connection column and dispatch gate -- does not have to wait for
- * P17 to land to read a file P17's own prompt already pins the shape of.
- *
- * @module cli/utils/hub-config
- */
-export interface HubConfig {
-    endpoint: string;
-    mode: "remote" | "local";
-    installedService?: string;
-}
-export declare function hubConfigPath(): string;
-/** Undefined for a missing, unreadable, or malformed file -- never throws. */
-export declare function readHubConfig(): HubConfig | undefined;
-//# sourceMappingURL=hub-config.d.ts.map

package/dist/utils/hub-config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hub-config.d.ts","sourceRoot":"","sources":["../../src/utils/hub-config.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAaD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,IAAI,SAAS,GAAG,SAAS,CASrD"}

package/dist/utils/hub-config.js

@@ -1,28 +0,0 @@
-import { existsSync, readFileSync } from "fs";
-import { stateDir } from "./cli-kit/index.js";
-function isHubConfig(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const v = value;
-    return (typeof v.endpoint === "string" &&
-        v.endpoint.length > 0 &&
-        (v.mode === "remote" || v.mode === "local") &&
-        (v.installedService === undefined || typeof v.installedService === "string"));
-}
-export function hubConfigPath() {
-    return process.env.MCPI_HUB_CONFIG_PATH || stateDir("mcpi", "hub.json");
-}
-/** Undefined for a missing, unreadable, or malformed file -- never throws. */
-export function readHubConfig() {
-    const path = hubConfigPath();
-    if (!existsSync(path))
-        return undefined;
-    try {
-        const parsed = JSON.parse(readFileSync(path, "utf-8"));
-        return isHubConfig(parsed) ? parsed : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-//# sourceMappingURL=hub-config.js.map

package/dist/utils/hub-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hub-config.js","sourceRoot":"","sources":["../../src/utils/hub-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAqB9C,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;QAC3C,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/utils/identity-heal.d.ts

@@ -1,16 +0,0 @@
-/**
- * Patches only the `did` field of an on-disk `.mcpi/identity.json`,
- * preserving every other field (privateKey, publicKey, kid, createdAt, ...).
- *
- * Both `init` and `register` mint or accept a locally-generated placeholder
- * did before the registry assigns the real did:web record; once the
- * canonical did is known, this heals identity.json in place so it never
- * drifts from agent.json (dco setup.ts throws "for a different agent" the
- * moment they disagree).
- *
- * Returns false, without writing anything, when the file does not exist or
- * already has the target did. Read/parse/write errors are left to THROW:
- * callers each keep their own catch-and-warn behavior around this call.
- */
-export declare function patchIdentityDidInPlace(identityFilePath: string, newDid: string): boolean;
-//# sourceMappingURL=identity-heal.d.ts.map

package/dist/utils/identity-heal.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-heal.d.ts","sourceRoot":"","sources":["../../src/utils/identity-heal.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAsBT"}

package/dist/utils/identity-heal.js

@@ -1,37 +0,0 @@
-import { existsSync, readFileSync, chmodSync } from "fs";
-import { writeFileAtomicSafe } from "./cli-kit/index.js";
-/**
- * Patches only the `did` field of an on-disk `.mcpi/identity.json`,
- * preserving every other field (privateKey, publicKey, kid, createdAt, ...).
- *
- * Both `init` and `register` mint or accept a locally-generated placeholder
- * did before the registry assigns the real did:web record; once the
- * canonical did is known, this heals identity.json in place so it never
- * drifts from agent.json (dco setup.ts throws "for a different agent" the
- * moment they disagree).
- *
- * Returns false, without writing anything, when the file does not exist or
- * already has the target did. Read/parse/write errors are left to THROW:
- * callers each keep their own catch-and-warn behavior around this call.
- */
-export function patchIdentityDidInPlace(identityFilePath, newDid) {
-    if (!existsSync(identityFilePath)) {
-        return false;
-    }
-    const existing = JSON.parse(readFileSync(identityFilePath, "utf-8"));
-    if (!existing || typeof existing !== "object" || existing.did === newDid) {
-        return false;
-    }
-    // Atomic + symlink-safe: identity.json holds a private key, so a crash
-    // mid-write must never truncate it, and a planted symlink at the write's
-    // temp sibling must never be followed into an arbitrary file.
-    writeFileAtomicSafe(identityFilePath, JSON.stringify({ ...existing, did: newDid }, null, 2), 0o600);
-    try {
-        chmodSync(identityFilePath, 0o600);
-    }
-    catch {
-        // Best-effort; e.g. unsupported on Windows.
-    }
-    return true;
-}
-//# sourceMappingURL=identity-heal.js.map

package/dist/utils/identity-heal.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-heal.js","sourceRoot":"","sources":["../../src/utils/identity-heal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,gBAAwB,EACxB,MAAc;IAEd,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,uEAAuE;IACvE,yEAAyE;IACzE,8DAA8D;IAC9D,mBAAmB,CACjB,gBAAgB,EAChB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EACrD,KAAK,CACN,CAAC;IACF,IAAI,CAAC;QACH,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/utils/identity-manager.d.ts

@@ -1,41 +0,0 @@
-/**
- * Identity management utilities for key rotation and archiving
- */
-import type { CLIIdentityFile } from "@kya-os/contracts/cli";
-/**
- * Generate a new Ed25519 keypair
- */
-export declare function generateKeyPair(): {
-    privateKey: string;
-    publicKey: string;
-    kid: string;
-};
-/**
- * Generate a new DID based on the current environment
- */
-export declare function generateDID(kid: string): string;
-/**
- * Load current identity from file or environment
- */
-export declare function loadCurrentIdentity(): CLIIdentityFile | null;
-/**
- * Archive old key to .mcpi/keys/YYYY-MM-DD.json
- */
-export declare function archiveOldKey(identity: CLIIdentityFile, reason?: string): string;
-/**
- * Generate new identity with optional DID preservation
- */
-export declare function generateNewIdentity(preserveDID?: string): CLIIdentityFile;
-/**
- * Save identity to development file
- */
-export declare function saveIdentityToDev(identity: CLIIdentityFile): void;
-/**
- * Clear development identity file
- */
-export declare function clearDevIdentity(): void;
-/**
- * Generate audit line for key rotation
- */
-export declare function generateAuditLine(oldKeyId: string, newKeyId: string, did: string, mode: "dev" | "prod", delegated: boolean, forced: boolean): string;
-//# sourceMappingURL=identity-manager.d.ts.map

package/dist/utils/identity-manager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-manager.d.ts","sourceRoot":"","sources":["../../src/utils/identity-manager.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D;;GAEG;AACH,wBAAgB,eAAe,IAAI;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb,CAmBA;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAc/C;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,eAAe,GAAG,IAAI,CAsC5D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,eAAe,EACzB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CA8BR;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,eAAe,CAczE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAQjE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAKvC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,KAAK,GAAG,MAAM,EACpB,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,OAAO,GACd,MAAM,CAGR"}