@lawrencehui/citio 0.2.0

package/dist/utils/claude.js

@@ -0,0 +1,65 @@
+import { execFileSync } from "child_process";
+import { mkdtempSync, rmSync, readFileSync } from "fs";
+import os from "os";
+import path from "path";
+const CLAUDE_AUTH_PROMPT = "Reply with exactly OK";
+export function normalizeClaudeOauthToken(token) {
+    const compact = token.replace(/\s+/g, "");
+    const match = compact.match(/sk-ant-oat01-[A-Za-z0-9_-]+/);
+    return match ? match[0] : compact;
+}
+function stripAnsi(text) {
+    return text
+        .replace(/\u001B\[[0-9;?]*[ -/]*[@-~]/g, "")
+        .replace(/\u001B[@-_]/g, "")
+        .replace(/\r/g, "\n");
+}
+export function extractClaudeOauthTokenFromTranscript(transcriptPath) {
+    const raw = readFileSync(transcriptPath, "utf-8");
+    const cleaned = stripAnsi(raw);
+    const startMarker = "Your OAuth token";
+    const endMarker = "Store this token securely";
+    const startIndex = cleaned.indexOf(startMarker);
+    if (startIndex === -1) {
+        return null;
+    }
+    const afterStart = cleaned.slice(startIndex);
+    const endIndex = afterStart.indexOf(endMarker);
+    const tokenBlock = endIndex === -1 ? afterStart : afterStart.slice(0, endIndex);
+    const lines = tokenBlock
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean);
+    const tokenLines = lines.filter((line) => line.includes("sk-ant-oat01-") || /^[A-Za-z0-9_-]+$/.test(line));
+    if (tokenLines.length === 0) {
+        return null;
+    }
+    const candidate = normalizeClaudeOauthToken(tokenLines.join(""));
+    return candidate.startsWith("sk-ant-oat01-") ? candidate : null;
+}
+export function validateClaudeOauthToken(token) {
+    const normalizedToken = normalizeClaudeOauthToken(token);
+    const tempHome = mkdtempSync(path.join(os.tmpdir(), "citio-claude-token-"));
+    try {
+        const output = execFileSync("claude", ["-p", "--output-format", "text", CLAUDE_AUTH_PROMPT], {
+            encoding: "utf-8",
+            env: {
+                HOME: tempHome,
+                PATH: process.env.PATH || "/usr/local/bin:/usr/bin:/bin",
+                TERM: process.env.TERM || "xterm-256color",
+                NODE_ENV: process.env.NODE_ENV || "production",
+                CLAUDE_CODE_OAUTH_TOKEN: normalizedToken,
+            },
+            timeout: 120000,
+            maxBuffer: 1024 * 1024,
+        }).trim();
+        return output === "OK";
+    }
+    catch {
+        return false;
+    }
+    finally {
+        rmSync(tempHome, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=claude.js.map

package/dist/utils/claude.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.js","sourceRoot":"","sources":["../../src/utils/claude.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACvD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAEnD,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACpC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI;SACR,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC;SAC3C,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,qCAAqC,CAAC,cAAsB;IAC1E,MAAM,GAAG,GAAG,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,kBAAkB,CAAC;IACvC,MAAM,SAAS,GAAG,2BAA2B,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAEhD,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,UAAU;SACrB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3G,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,yBAAyB,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,eAAe,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAE5E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CACzB,QAAQ,EACR,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,kBAAkB,CAAC,EACrD;YACE,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,8BAA8B;gBACxD,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,gBAAgB;gBAC1C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY;gBAC9C,uBAAuB,EAAE,eAAe;aACzC;YACD,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,IAAI,GAAG,IAAI;SACvB,CACF,CAAC,IAAI,EAAE,CAAC;QAET,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/utils/codex.d.ts

@@ -0,0 +1,5 @@
+export declare function getCodexAuthPath(home?: string): string;
+export declare function hasCodexCredentials(env?: NodeJS.ProcessEnv): boolean;
+export declare function formatCodexAuthHint(home?: string): string;
+export declare function isLikelyCodexAuthError(text: string): boolean;
+//# sourceMappingURL=codex.d.ts.map

package/dist/utils/codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/utils/codex.ts"],"names":[],"mappings":"AAEA,wBAAgB,gBAAgB,CAAC,IAAI,SAAoC,GAAG,MAAM,CAEjF;AAED,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAMjF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,SAAoC,GAAG,MAAM,CAEpF;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D"}

package/dist/utils/codex.js

@@ -0,0 +1,17 @@
+import { existsSync } from "fs";
+export function getCodexAuthPath(home = process.env.HOME || "/home/citio") {
+    return `${home}/.codex/auth.json`;
+}
+export function hasCodexCredentials(env = process.env) {
+    if (env.OPENAI_API_KEY) {
+        return true;
+    }
+    return existsSync(getCodexAuthPath(env.HOME || "/home/citio"));
+}
+export function formatCodexAuthHint(home = process.env.HOME || "/home/citio") {
+    return `Codex credentials not found. Expected OAuth credentials at ${getCodexAuthPath(home)} or OPENAI_API_KEY in the container environment.`;
+}
+export function isLikelyCodexAuthError(text) {
+    return /auth|login|logged in|token|OPENAI_API_KEY|credential/i.test(text);
+}
+//# sourceMappingURL=codex.js.map

package/dist/utils/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/utils/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAEhC,MAAM,UAAU,gBAAgB,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,aAAa;IACvE,OAAO,GAAG,IAAI,mBAAmB,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,aAAa;IAC1E,OAAO,8DAA8D,gBAAgB,CAAC,IAAI,CAAC,kDAAkD,CAAC;AAChJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC"}

package/dist/utils/env.d.ts

@@ -0,0 +1,2 @@
+export declare function resolveEnvVars(obj: unknown): unknown;
+//# sourceMappingURL=env.d.ts.map

package/dist/utils/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/utils/env.ts"],"names":[],"mappings":"AAAA,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAapD"}

package/dist/utils/env.js

@@ -0,0 +1,16 @@
+export function resolveEnvVars(obj) {
+    if (typeof obj === "string") {
+        return obj.replace(/\$\{(\w+)\}/g, (_, key) => process.env[key] || "");
+    }
+    if (Array.isArray(obj))
+        return obj.map(resolveEnvVars);
+    if (obj && typeof obj === "object") {
+        const result = {};
+        for (const [key, value] of Object.entries(obj)) {
+            result[key] = resolveEnvVars(value);
+        }
+        return result;
+    }
+    return obj;
+}
+//# sourceMappingURL=env.js.map

package/dist/utils/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/utils/env.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/utils/installer-state.d.ts

@@ -0,0 +1,33 @@
+import { type InstallerSecrets, type SecretStore } from "./secret-store.js";
+export interface SavedInstallerState {
+    provider?: "codex" | "claude";
+    authMethod?: "oauth" | "api_key";
+    slackBotToken?: string;
+    slackAppToken?: string;
+    slackChannelId?: string;
+    githubToken?: string;
+    repos: Array<{
+        url: string;
+        branch: string;
+    }>;
+    rules: string[];
+    skills: string[];
+    gitUserEmail?: string;
+    awsRegion?: string;
+    awsProfile?: string;
+    enableEfs?: boolean;
+    claudeOauthToken?: string;
+    openAiApiKey?: string;
+    anthropicApiKey?: string;
+    secretBackend: "keychain" | "file";
+}
+interface InstallerStateOptions {
+    statePath?: string;
+    localYamlPath?: string;
+    localEnvPath?: string;
+    secretStore?: SecretStore;
+}
+export declare function loadSavedInstallerState(cwd: string, options?: InstallerStateOptions): Promise<SavedInstallerState>;
+export declare function saveInstallerState(state: Omit<SavedInstallerState, "secretBackend" | keyof InstallerSecrets>, secrets: InstallerSecrets, options?: InstallerStateOptions): Promise<"keychain" | "file">;
+export {};
+//# sourceMappingURL=installer-state.d.ts.map

package/dist/utils/installer-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer-state.d.ts","sourceRoot":"","sources":["../../src/utils/installer-state.ts"],"names":[],"mappings":"AAKA,OAAO,EAA8C,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAExH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC9B,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,UAAU,GAAG,MAAM,CAAC;CACpC;AAED,UAAU,qBAAqB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAuGD,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgC5H;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,eAAe,GAAG,MAAM,gBAAgB,CAAC,EAC1E,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,CAuB9B"}

package/dist/utils/installer-state.js

@@ -0,0 +1,152 @@
+import { existsSync, readFileSync, writeFileSync, chmodSync } from "fs";
+import path from "path";
+import { parse as parseDotenv } from "dotenv";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { getInstallerStatePath } from "./app-state.js";
+import { loadInstallerSecrets, saveInstallerSecrets } from "./secret-store.js";
+function asString(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function asBoolean(value) {
+    return typeof value === "boolean" ? value : undefined;
+}
+function asStringArray(value) {
+    return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function asRepoArray(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.flatMap((item) => {
+        if (!item || typeof item !== "object") {
+            return [];
+        }
+        const repo = item;
+        const url = asString(repo.url);
+        if (!url) {
+            return [];
+        }
+        return [{
+                url,
+                branch: asString(repo.branch) || "main",
+            }];
+    });
+}
+function loadYamlState(filePath) {
+    if (!existsSync(filePath)) {
+        return {};
+    }
+    try {
+        const parsed = parseYaml(readFileSync(filePath, "utf-8"));
+        const slack = parsed?.slack;
+        const engine = parsed?.engine;
+        const workspace = parsed?.workspace;
+        const skills = parsed?.skills;
+        const deploy = parsed?.deploy;
+        const aws = deploy?.aws;
+        const git = workspace?.git;
+        const repos = asRepoArray(parsed?.repos);
+        const workspaceRepos = asRepoArray(workspace?.repos);
+        const rules = asStringArray(parsed?.rules);
+        const workspaceRules = asStringArray(workspace?.rules);
+        const installedSkills = asStringArray(parsed?.skills);
+        const configSkills = asStringArray(skills?.installed);
+        return {
+            provider: parsed?.provider === "codex" || parsed?.provider === "claude"
+                ? parsed.provider
+                : engine?.default_provider === "codex" || engine?.default_provider === "claude"
+                    ? engine.default_provider
+                    : undefined,
+            authMethod: parsed?.authMethod === "oauth" || parsed?.authMethod === "api_key"
+                ? parsed.authMethod
+                : engine?.auth_method === "oauth" || engine?.auth_method === "api_key"
+                    ? engine.auth_method
+                    : undefined,
+            slackChannelId: asString(parsed?.slackChannelId) || asString(slack?.channel_id),
+            repos: repos.length > 0 ? repos : workspaceRepos,
+            rules: rules.length > 0 ? rules : workspaceRules,
+            skills: installedSkills.length > 0 ? installedSkills : configSkills,
+            gitUserEmail: asString(parsed?.gitUserEmail) || asString(git?.user_email),
+            awsRegion: asString(parsed?.awsRegion) || asString(aws?.region),
+            awsProfile: asString(parsed?.awsProfile) || asString(aws?.profile),
+            enableEfs: asBoolean(parsed?.enableEfs) ?? asBoolean(aws?.enable_efs),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+function loadLocalEnvSecrets(envPath) {
+    if (!existsSync(envPath)) {
+        return {};
+    }
+    try {
+        const parsed = parseDotenv(readFileSync(envPath, "utf-8"));
+        return {
+            slackBotToken: asString(parsed.SLACK_BOT_TOKEN),
+            slackAppToken: asString(parsed.SLACK_APP_TOKEN),
+            githubToken: asString(parsed.GH_TOKEN),
+            claudeOauthToken: asString(parsed.CLAUDE_CODE_OAUTH_TOKEN),
+            openAiApiKey: asString(parsed.OPENAI_API_KEY),
+            anthropicApiKey: asString(parsed.ANTHROPIC_API_KEY),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+export async function loadSavedInstallerState(cwd, options = {}) {
+    const statePath = options.statePath || getInstallerStatePath();
+    const localYamlPath = options.localYamlPath || path.join(cwd, "citio.yaml");
+    const localEnvPath = options.localEnvPath || path.join(cwd, ".env");
+    const secretStore = options.secretStore || {
+        loadInstallerSecrets,
+        saveInstallerSecrets,
+    };
+    const stateFromAppDir = loadYamlState(statePath);
+    const localYamlFallback = loadYamlState(localYamlPath);
+    const { secrets, backend } = await secretStore.loadInstallerSecrets();
+    const localEnvFallback = loadLocalEnvSecrets(localEnvPath);
+    return {
+        provider: stateFromAppDir.provider || localYamlFallback.provider,
+        authMethod: stateFromAppDir.authMethod || localYamlFallback.authMethod,
+        slackChannelId: stateFromAppDir.slackChannelId || localYamlFallback.slackChannelId,
+        repos: stateFromAppDir.repos?.length ? stateFromAppDir.repos : (localYamlFallback.repos || []),
+        rules: stateFromAppDir.rules?.length ? stateFromAppDir.rules : (localYamlFallback.rules || []),
+        skills: stateFromAppDir.skills?.length ? stateFromAppDir.skills : (localYamlFallback.skills || []),
+        gitUserEmail: stateFromAppDir.gitUserEmail || localYamlFallback.gitUserEmail,
+        awsRegion: stateFromAppDir.awsRegion || localYamlFallback.awsRegion,
+        awsProfile: stateFromAppDir.awsProfile || localYamlFallback.awsProfile,
+        enableEfs: stateFromAppDir.enableEfs ?? localYamlFallback.enableEfs,
+        slackBotToken: secrets.slackBotToken || localEnvFallback.slackBotToken,
+        slackAppToken: secrets.slackAppToken || localEnvFallback.slackAppToken,
+        githubToken: secrets.githubToken || localEnvFallback.githubToken,
+        claudeOauthToken: secrets.claudeOauthToken || localEnvFallback.claudeOauthToken,
+        openAiApiKey: secrets.openAiApiKey || localEnvFallback.openAiApiKey,
+        anthropicApiKey: secrets.anthropicApiKey || localEnvFallback.anthropicApiKey,
+        secretBackend: backend,
+    };
+}
+export async function saveInstallerState(state, secrets, options = {}) {
+    const statePath = options.statePath || getInstallerStatePath();
+    const secretStore = options.secretStore || {
+        loadInstallerSecrets,
+        saveInstallerSecrets,
+    };
+    const yaml = stringifyYaml({
+        provider: state.provider,
+        authMethod: state.authMethod,
+        slackChannelId: state.slackChannelId,
+        repos: state.repos,
+        rules: state.rules,
+        skills: state.skills,
+        gitUserEmail: state.gitUserEmail,
+        awsRegion: state.awsRegion,
+        awsProfile: state.awsProfile,
+        enableEfs: state.enableEfs,
+    });
+    writeFileSync(statePath, yaml, "utf-8");
+    chmodSync(statePath, 0o600);
+    return secretStore.saveInstallerSecrets(secrets);
+}
+//# sourceMappingURL=installer-state.js.map

package/dist/utils/installer-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer-state.js","sourceRoot":"","sources":["../../src/utils/installer-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAA2C,MAAM,mBAAmB,CAAC;AA6BxH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtG,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAG,IAA2C,CAAC;QACzD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,CAAC;gBACN,GAAG;gBACH,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM;aACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAmC,CAAC;QAC5F,MAAM,KAAK,GAAG,MAAM,EAAE,KAA4C,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,EAAE,MAA6C,CAAC;QACrE,MAAM,SAAS,GAAG,MAAM,EAAE,SAAgD,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,EAAE,MAA6C,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,EAAE,MAA6C,CAAC;QACrE,MAAM,GAAG,GAAG,MAAM,EAAE,GAA0C,CAAC;QAC/D,MAAM,GAAG,GAAG,SAAS,EAAE,GAA0C,CAAC;QAClE,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,cAAc,GAAG,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAEtD,OAAO;YACL,QAAQ,EAAE,MAAM,EAAE,QAAQ,KAAK,OAAO,IAAI,MAAM,EAAE,QAAQ,KAAK,QAAQ;gBACrE,CAAC,CAAC,MAAM,CAAC,QAAQ;gBACjB,CAAC,CAAC,MAAM,EAAE,gBAAgB,KAAK,OAAO,IAAI,MAAM,EAAE,gBAAgB,KAAK,QAAQ;oBAC/E,CAAC,CAAC,MAAM,CAAC,gBAAgB;oBACzB,CAAC,CAAC,SAAS;YACb,UAAU,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,IAAI,MAAM,EAAE,UAAU,KAAK,SAAS;gBAC5E,CAAC,CAAC,MAAM,CAAC,UAAU;gBACnB,CAAC,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS;oBACtE,CAAC,CAAC,MAAM,CAAC,WAAW;oBACpB,CAAC,CAAC,SAAS;YACb,cAAc,EAAE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;YAC/E,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc;YAChD,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc;YAChD,MAAM,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY;YACnE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;YACzE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;YAC/D,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;YAClE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC;SACtE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3D,OAAO;YACL,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC;YAC/C,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC;YAC/C,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;YACtC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,uBAAuB,CAAC;YAC1D,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC;YAC7C,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC;SACpD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAW,EAAE,UAAiC,EAAE;IAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,qBAAqB,EAAE,CAAC;IAC/D,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI;QACzC,oBAAoB;QACpB,oBAAoB;KACrB,CAAC;IACF,MAAM,eAAe,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,iBAAiB,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IACvD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,WAAW,CAAC,oBAAoB,EAAE,CAAC;IACtE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAE3D,OAAO;QACL,QAAQ,EAAE,eAAe,CAAC,QAAQ,IAAI,iBAAiB,CAAC,QAAQ;QAChE,UAAU,EAAE,eAAe,CAAC,UAAU,IAAI,iBAAiB,CAAC,UAAU;QACtE,cAAc,EAAE,eAAe,CAAC,cAAc,IAAI,iBAAiB,CAAC,cAAc;QAClF,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9F,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9F,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,IAAI,EAAE,CAAC;QAClG,YAAY,EAAE,eAAe,CAAC,YAAY,IAAI,iBAAiB,CAAC,YAAY;QAC5E,SAAS,EAAE,eAAe,CAAC,SAAS,IAAI,iBAAiB,CAAC,SAAS;QACnE,UAAU,EAAE,eAAe,CAAC,UAAU,IAAI,iBAAiB,CAAC,UAAU;QACtE,SAAS,EAAE,eAAe,CAAC,SAAS,IAAI,iBAAiB,CAAC,SAAS;QACnE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,aAAa;QACtE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,aAAa;QACtE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,gBAAgB,CAAC,WAAW;QAChE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,gBAAgB;QAC/E,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC,YAAY;QACnE,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,gBAAgB,CAAC,eAAe;QAC5E,aAAa,EAAE,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA0E,EAC1E,OAAyB,EACzB,UAAiC,EAAE;IAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,qBAAqB,EAAE,CAAC;IAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI;QACzC,oBAAoB;QACpB,oBAAoB;KACrB,CAAC;IACF,MAAM,IAAI,GAAG,aAAa,CAAC;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IAEH,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE5B,OAAO,WAAW,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC"}

package/dist/utils/runtime-env.d.ts

@@ -0,0 +1,3 @@
+export declare function pickDefinedEnv(keys: readonly string[]): Record<string, string>;
+export declare function getTaskRoleEnv(): Record<string, string>;
+//# sourceMappingURL=runtime-env.d.ts.map

package/dist/utils/runtime-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-env.d.ts","sourceRoot":"","sources":["../../src/utils/runtime-env.ts"],"names":[],"mappings":"AAWA,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW9E;AAED,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEvD"}

package/dist/utils/runtime-env.js

@@ -0,0 +1,24 @@
+const TASK_ROLE_ENV_KEYS = [
+    "AWS_DEFAULT_REGION",
+    "AWS_REGION",
+    "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",
+    "AWS_CONTAINER_CREDENTIALS_FULL_URI",
+    "AWS_CONTAINER_AUTHORIZATION_TOKEN",
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY",
+    "AWS_SESSION_TOKEN",
+];
+export function pickDefinedEnv(keys) {
+    const picked = {};
+    for (const key of keys) {
+        const value = process.env[key];
+        if (value) {
+            picked[key] = value;
+        }
+    }
+    return picked;
+}
+export function getTaskRoleEnv() {
+    return pickDefinedEnv(TASK_ROLE_ENV_KEYS);
+}
+//# sourceMappingURL=runtime-env.js.map

package/dist/utils/runtime-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-env.js","sourceRoot":"","sources":["../../src/utils/runtime-env.ts"],"names":[],"mappings":"AAAA,MAAM,kBAAkB,GAAG;IACzB,oBAAoB;IACpB,YAAY;IACZ,wCAAwC;IACxC,oCAAoC;IACpC,mCAAmC;IACnC,mBAAmB;IACnB,uBAAuB;IACvB,mBAAmB;CACX,CAAC;AAEX,MAAM,UAAU,cAAc,CAAC,IAAuB;IACpD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,cAAc,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC"}

package/dist/utils/secret-store.d.ts

@@ -0,0 +1,18 @@
+export interface InstallerSecrets {
+    slackBotToken?: string;
+    slackAppToken?: string;
+    githubToken?: string;
+    claudeOauthToken?: string;
+    openAiApiKey?: string;
+    anthropicApiKey?: string;
+}
+export declare function loadInstallerSecrets(): Promise<{
+    secrets: InstallerSecrets;
+    backend: "keychain" | "file";
+}>;
+export declare function saveInstallerSecrets(secrets: InstallerSecrets): Promise<"keychain" | "file">;
+export interface SecretStore {
+    loadInstallerSecrets: typeof loadInstallerSecrets;
+    saveInstallerSecrets: typeof saveInstallerSecrets;
+}
+//# sourceMappingURL=secret-store.d.ts.map

package/dist/utils/secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.d.ts","sourceRoot":"","sources":["../../src/utils/secret-store.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAwDD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC;IAAE,OAAO,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAAA;CAAE,CAAC,CAcjH;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,CAiBlG;AAED,MAAM,WAAW,WAAW;IAC1B,oBAAoB,EAAE,OAAO,oBAAoB,CAAC;IAClD,oBAAoB,EAAE,OAAO,oBAAoB,CAAC;CACnD"}

package/dist/utils/secret-store.js

@@ -0,0 +1,78 @@
+import { chmodSync, existsSync, readFileSync, writeFileSync } from "fs";
+import { getFallbackSecretsPath } from "./app-state.js";
+const SERVICE_NAME = "citio";
+const SECRET_KEYS = [
+    "slackBotToken",
+    "slackAppToken",
+    "githubToken",
+    "claudeOauthToken",
+    "openAiApiKey",
+    "anthropicApiKey",
+];
+const SECRET_ACCOUNT_NAMES = {
+    slackBotToken: "slack_bot_token",
+    slackAppToken: "slack_app_token",
+    githubToken: "github_token",
+    claudeOauthToken: "claude_oauth_token",
+    openAiApiKey: "openai_api_key",
+    anthropicApiKey: "anthropic_api_key",
+};
+async function loadKeytar() {
+    try {
+        const module = await import("keytar");
+        return module.default ?? module;
+    }
+    catch {
+        return null;
+    }
+}
+function loadFallbackSecrets() {
+    const secretsPath = getFallbackSecretsPath();
+    if (!existsSync(secretsPath)) {
+        return {};
+    }
+    try {
+        return JSON.parse(readFileSync(secretsPath, "utf-8"));
+    }
+    catch {
+        return {};
+    }
+}
+function persistFallbackSecrets(secrets) {
+    const secretsPath = getFallbackSecretsPath();
+    writeFileSync(secretsPath, JSON.stringify(secrets, null, 2), "utf-8");
+    chmodSync(secretsPath, 0o600);
+}
+export async function loadInstallerSecrets() {
+    const keytar = await loadKeytar();
+    if (keytar) {
+        const secrets = {};
+        for (const key of SECRET_KEYS) {
+            const value = await keytar.getPassword(SERVICE_NAME, SECRET_ACCOUNT_NAMES[key]);
+            if (value) {
+                secrets[key] = value;
+            }
+        }
+        return { secrets, backend: "keychain" };
+    }
+    return { secrets: loadFallbackSecrets(), backend: "file" };
+}
+export async function saveInstallerSecrets(secrets) {
+    const keytar = await loadKeytar();
+    if (keytar) {
+        for (const key of SECRET_KEYS) {
+            const value = secrets[key];
+            const account = SECRET_ACCOUNT_NAMES[key];
+            if (value) {
+                await keytar.setPassword(SERVICE_NAME, account, value);
+            }
+            else {
+                await keytar.deletePassword(SERVICE_NAME, account);
+            }
+        }
+        return "keychain";
+    }
+    persistFallbackSecrets(secrets);
+    return "file";
+}
+//# sourceMappingURL=secret-store.js.map

package/dist/utils/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../src/utils/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,YAAY,GAAG,OAAO,CAAC;AAa7B,MAAM,WAAW,GAAgB;IAC/B,eAAe;IACf,eAAe;IACf,aAAa;IACb,kBAAkB;IAClB,cAAc;IACd,iBAAiB;CAClB,CAAC;AAEF,MAAM,oBAAoB,GAA8B;IACtD,aAAa,EAAE,iBAAiB;IAChC,aAAa,EAAE,iBAAiB;IAChC,WAAW,EAAE,cAAc;IAC3B,gBAAgB,EAAE,oBAAoB;IACtC,YAAY,EAAE,gBAAgB;IAC9B,eAAe,EAAE,mBAAmB;CACrC,CAAC;AAQF,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,WAAW,GAAG,sBAAsB,EAAE,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAqB,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAyB;IACvD,MAAM,WAAW,GAAG,sBAAsB,EAAE,CAAC;IAC7C,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACtE,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;YAChF,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAyB;IAClE,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/slack-onboarding.d.ts

@@ -0,0 +1,22 @@
+export interface SlackManifestCreateResult {
+    appId: string;
+    oauthAuthorizeUrl: string;
+    settingsUrl: string;
+}
+interface SlackManifestOptions {
+    appName?: string;
+}
+export declare function buildCitioSlackManifest(options?: SlackManifestOptions): Record<string, unknown>;
+export declare function createCitioSlackApp(configToken: string, options?: SlackManifestOptions): Promise<SlackManifestCreateResult>;
+export declare function openBrowser(url: string): boolean;
+export declare function validateSlackBotToken(token: string | undefined): string | Error | undefined;
+export declare function validateSlackAppToken(token: string | undefined): string | Error | undefined;
+export declare function validateSlackConfigToken(token: string | undefined): string | Error | undefined;
+/** Live-check a saved bot token via auth.test. Returns workspace/bot identity when valid. */
+export declare function testSlackBotToken(token: string): Promise<{
+    ok: boolean;
+    team?: string;
+    botUser?: string;
+}>;
+export {};
+//# sourceMappingURL=slack-onboarding.d.ts.map

package/dist/utils/slack-onboarding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-onboarding.d.ts","sourceRoot":"","sources":["../../src/utils/slack-onboarding.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB;AAeD,UAAU,oBAAoB;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,oBAAyB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0EnG;AAsDD,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAyBrI;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAgBhD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAQ3F;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAQ3F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAQ9F;AAED,6FAA6F;AAC7F,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAWhH"}