@leemour/cli-core 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Viacheslav Ptsarev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,106 @@
+# @leemour/cli-core
+
+The parts every command line tool needs and nobody enjoys writing twice: the two output streams,
+a renderer for people and for machines, a closed error model with stable exit codes, the OS
+keyring behind a testable seam, and injectable clocks.
+
+Extracted from [`brazecli`](https://github.com/leemour/brazecli), where each piece earned its
+shape, and shared with [`max-cli`](https://github.com/leemour/max-cli).
+
+**Status: 0.1.0, not published yet.** Both extraction steps have landed: the files that move
+unchanged, and the ones that needed a parameter threaded through. 73 tests.
+
+## The rule this package exists to keep
+
+**In a machine mode, stdout carries data and nothing else.** No spinner, no `✓`, no warning, no
+ANSI. Diagnostics go to stderr, in every mode including the pretty one. That is the contract a
+script or an agent depends on, and `captureStreams` exists so a test can prove nothing leaked
+across.
+
+```ts
+import { captureStreams, createRenderer } from "@leemour/cli-core"
+
+const streams = captureStreams()
+createRenderer({ format: "json", color: false, streams }).result({ chats: 2 })
+
+streams.stdout // ['{"chats":2}']
+streams.stderr // []
+```
+
+## What is in it
+
+| | |
+|---|---|
+| `streams` | the stdout/stderr split, and the capture used to test it |
+| `renderer` · `pretty` | `pretty` / `json` / `jsonl`; tables for lists, labelled lines for objects |
+| `errors` · `exit-codes` | 14 closed error codes, one exit number each, so a script can branch on `$?` |
+| `keyring` | `KeyringStore` with the system, memory and deliberately-broken implementations |
+| `time` | monotonic and wall clocks, and the one sleep that both timeouts and backoff use |
+| `logger` | the four-method interface a host adapts Pino to — this package logs nothing itself |
+| `paths` | `env-paths` for config, state and cache, each overridable by environment variable |
+| `config` | JSON config loading that names the bad field, and an atomic write that locks the directory down |
+| `credentials` | environment → keyring → file, warning once and falling through when the keyring refuses |
+| `logging` | a Pino adapter writing JSON lines with secrets redacted by field name |
+| `retry` | full-jitter backoff, and the distinction between "no answer came" and "safe to repeat" |
+| `/testing` | `captureStreams`, `memoryKeyring`, `brokenKeyring`, `fakeClock` |
+
+**Nothing in the root export is HTTP.** Status classification, `Retry-After` parsing and the fetch
+seam live in `@leemour/cli-core/http`, so a CLI that speaks a socket never depends on a stack it
+does not call:
+
+```ts
+import { providerWaitMs, statusToCode } from "@leemour/cli-core/http"
+```
+
+**Two traps worth knowing before you use the credential store.** The OS keyring is global: an entry
+is addressed by service and account and knows nothing about which config directory asked for it, so
+a throwaway config directory silently overwrites the real secret unless you pass `isolated: true`.
+And a secret should never be handed to a logger in the first place — redaction by field name is the
+second line of defence, not the first.
+
+**Everything the environment knows is passed in.** No `process.env` reads, no config file paths,
+no ambient clock. That is what makes a timeout test finish instantly and a keyring test incapable
+of reaching a real keychain.
+
+## Where secrets actually go, per platform
+
+The keyring is real on every desktop and absent on most servers, so the fallback is not an edge
+case — it is the normal path in CI and containers. Checked against `@napi-rs/keyring` 2.1.0 on
+2026-09-19.
+
+| Platform | Backing store | Needs installing |
+|---|---|---|
+| macOS | Keychain, via the Security framework | nothing — part of the OS |
+| Windows | Credential Manager | nothing — part of the OS |
+| Linux desktop (GNOME, KDE) | Secret Service over D-Bus — `gnome-keyring`, `kwallet` | nothing on a normal desktop; the keyring must be **unlocked** |
+| Linux headless, container, WSL, CI | usually **nothing** — no session bus, no secrets daemon | falls back to a `0600` file, with one warning on stderr |
+| FreeBSD | Secret Service, same as Linux | same |
+
+**No compiler is involved.** The package ships prebuilt binaries for twelve platform triples —
+macOS arm64/x64, Windows x64/ia32/arm64, Linux x64 and arm64 in both glibc and musl, armv7,
+riscv64, FreeBSD x64 — so there is no Rust toolchain and no node-gyp on any mainstream target.
+The Linux binary links only against libc: it speaks D-Bus itself rather than through libsecret,
+so *libsecret is not a requirement* — a running Secret Service provider is.
+
+Two consequences worth designing for rather than discovering:
+
+- **`auto` is the right default and `file` must stay available.** `credentialStorage: "file"` skips
+  the keyring entirely, which is what a container wants and what a locked keyring makes necessary.
+- **A locked Linux keyring can block on a prompt** rather than failing. That is the one case the
+  fallback does not rescue, and a CLI that hangs looks broken rather than locked.
+
+## Both runtimes
+
+Node 22+ and Bun, and the Bun half is executed rather than assumed:
+
+```sh
+pnpm test        # vitest, Node
+pnpm smoke:bun   # the same exports, actually run under Bun
+pnpm lint
+pnpm typecheck
+pnpm build
+```
+
+## Licence
+
+MIT.

package/dist/config.d.ts

@@ -0,0 +1,20 @@
+import * as v from "valibot";
+/**
+ * Atomic, and the directory is locked down before the first write.
+ *
+ * Atomic because a partial credential file loses **every** profile's secret, not just the one
+ * being written, and the window for that is exactly a Ctrl+C mid-write. The directory mode matters
+ * as much as the file's: `0o600` on a file inside a world-readable directory is worth little.
+ * ⚠ Both modes are ignored on Windows.
+ */
+export declare const writeSecurely: (path: string, contents: string, mode: number) => void;
+/**
+ * Reads and validates a JSON config. A missing file is not an error — it is a program that has not
+ * been configured yet — but a malformed one is, and it says which field and why.
+ *
+ * The schema belongs to the host: what a profile holds is the one thing no shared package can know.
+ */
+export declare const loadConfigFile: <TSchema extends v.GenericSchema>(path: string, schema: TSchema, fallback: () => v.InferOutput<TSchema>) => v.InferOutput<TSchema>;
+/** Config is not a secret, so it is `0644`; the credential file next to it is not. */
+export declare const saveConfigFile: (path: string, config: unknown) => void;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,EAAE,UAAU,MAAM,EAAE,MAAM,MAAM,KAAG,IAQ5E,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,SAAS,CAAC,CAAC,aAAa,EAC5D,MAAM,MAAM,EACZ,QAAQ,OAAO,EACf,UAAU,MAAM,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KACrC,CAAC,CAAC,WAAW,CAAC,OAAO,CAqBvB,CAAA;AAED,sFAAsF;AACtF,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,EAAE,QAAQ,OAAO,KAAG,IAE9D,CAAA"}

package/dist/config.js

@@ -0,0 +1,52 @@
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import * as v from "valibot";
+/**
+ * Atomic, and the directory is locked down before the first write.
+ *
+ * Atomic because a partial credential file loses **every** profile's secret, not just the one
+ * being written, and the window for that is exactly a Ctrl+C mid-write. The directory mode matters
+ * as much as the file's: `0o600` on a file inside a world-readable directory is worth little.
+ * ⚠ Both modes are ignored on Windows.
+ */
+export const writeSecurely = (path, contents, mode) => {
+    const dir = dirname(path);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const temp = join(dir, `.${Date.now()}-${process.pid}.tmp`);
+    writeFileSync(temp, contents, { mode });
+    // A rename within one directory is atomic on every platform we target.
+    renameSync(temp, path);
+};
+/**
+ * Reads and validates a JSON config. A missing file is not an error — it is a program that has not
+ * been configured yet — but a malformed one is, and it says which field and why.
+ *
+ * The schema belongs to the host: what a profile holds is the one thing no shared package can know.
+ */
+export const loadConfigFile = (path, schema, fallback) => {
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch {
+        return fallback();
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${path} is not valid JSON`);
+    }
+    const result = v.safeParse(schema, parsed);
+    if (!result.success) {
+        const problems = result.issues.map((issue) => `${v.getDotPath(issue) ?? "(root)"}: ${issue.message}`);
+        throw new Error(`${path} is not a valid config:\n  ${problems.join("\n  ")}`);
+    }
+    return result.output;
+};
+/** Config is not a secret, so it is `0644`; the credential file next to it is not. */
+export const saveConfigFile = (path, config) => {
+    writeSecurely(path, `${JSON.stringify(config, null, 2)}\n`, 0o644);
+};
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAE,IAAY,EAAQ,EAAE;IAClF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAEhD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC,CAAA;IAC3D,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IACvC,uEAAuE;IACvE,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AACxB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,IAAY,EACZ,MAAe,EACf,QAAsC,EACd,EAAE;IAC1B,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,EAAE,CAAA;IACnB,CAAC;IAED,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QACrG,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAA;AACtB,CAAC,CAAA;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,MAAe,EAAQ,EAAE;IACpE,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACpE,CAAC,CAAA"}

package/dist/credentials.d.ts

@@ -0,0 +1,48 @@
+import { type KeyringStore } from "./keyring.js";
+export declare const CREDENTIAL_STORAGE: readonly ["auto", "keyring", "file"];
+export type CredentialStorage = (typeof CREDENTIAL_STORAGE)[number];
+export type CredentialSource = "environment" | "keyring" | "file";
+export interface StoredCredential {
+    secret: string;
+    source: CredentialSource;
+}
+export interface CredentialsOptions {
+    /** Where the fallback file lives when the keyring cannot be used. */
+    configDir: string;
+    /** The keyring service name — the command's name, e.g. `max-cli`. */
+    service: string;
+    /**
+     * **True when the config directory came from the environment rather than the OS convention.**
+     *
+     * The OS keyring is global: an entry is addressed by service and account and knows nothing about
+     * which config directory asked for it. So a throwaway config directory looks isolated and is
+     * not — it overwrites the real secret for that account. In `brazecli` that destroyed two working
+     * keys on 2026-09-14, and a keyring entry cannot be read back out. Passing `true` here scopes the
+     * service name to the directory, making the isolation people already assume they have real.
+     */
+    isolated?: boolean;
+    /** Read before the keyring, for CI. */
+    envVar?: string;
+    storage?: CredentialStorage;
+    keyring?: KeyringStore;
+    env?: NodeJS.ProcessEnv;
+    fileName?: string;
+    /** Where the one-line warning goes when the keyring is unavailable. Never stdout. */
+    warn?: (message: string) => void;
+}
+export declare const keyringService: (service: string, configDir: string, isolated?: boolean) => string;
+/**
+ * Environment first, then the OS keyring, then a file.
+ *
+ * `auto` does not probe whether a keyring exists: it attempts the operation, and on failure warns
+ * once and falls through. A probe would touch the user's keychain for nothing and could still
+ * succeed where the real operation fails.
+ */
+export declare class Credentials {
+    #private;
+    constructor(options: CredentialsOptions);
+    read(account: string): StoredCredential | undefined;
+    write(account: string, secret: string): CredentialSource;
+    remove(account: string): CredentialSource[];
+}
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,YAAY,EAAiB,MAAM,cAAc,CAAA;AAE/D,eAAO,MAAM,kBAAkB,sCAAuC,CAAA;AACtE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEnE,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,SAAS,GAAG,MAAM,CAAA;AAEjE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,gBAAgB,CAAA;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAA;IACf;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,iBAAiB,CAAA;IAC3B,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qFAAqF;IACrF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACjC;AAED,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,EAAE,WAAW,MAAM,EAAE,kBAAgB,KAAG,MACtC,CAAA;AAIhD;;;;;;GAMG;AACH,qBAAa,WAAW;;gBAWV,OAAO,EAAE,kBAAkB;IAWvC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAanD,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB;IAexD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,EAAE;CAiD5C"}

package/dist/credentials.js

@@ -0,0 +1,103 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { writeSecurely } from "./config.js";
+import { systemKeyring } from "./keyring.js";
+export const CREDENTIAL_STORAGE = ["auto", "keyring", "file"];
+export const keyringService = (service, configDir, isolated = false) => isolated ? `${service}:${configDir}` : service;
+/**
+ * Environment first, then the OS keyring, then a file.
+ *
+ * `auto` does not probe whether a keyring exists: it attempts the operation, and on failure warns
+ * once and falls through. A probe would touch the user's keychain for nothing and could still
+ * succeed where the real operation fails.
+ */
+export class Credentials {
+    #configDir;
+    #storage;
+    #keyring;
+    #env;
+    #service;
+    #envVar;
+    #fileName;
+    #warn;
+    #warned = false;
+    constructor(options) {
+        this.#configDir = options.configDir;
+        this.#storage = options.storage ?? "auto";
+        this.#keyring = options.keyring ?? systemKeyring;
+        this.#env = options.env ?? process.env;
+        this.#envVar = options.envVar;
+        this.#fileName = options.fileName ?? "credentials.json";
+        this.#warn = options.warn ?? ((message) => process.stderr.write(`${message}\n`));
+        this.#service = keyringService(options.service, options.configDir, options.isolated);
+    }
+    read(account) {
+        const fromEnv = this.#envVar ? this.#env[this.#envVar]?.trim() : undefined;
+        if (fromEnv)
+            return { secret: fromEnv, source: "environment" };
+        if (this.#storage !== "file") {
+            const fromKeyring = this.#tryKeyring(() => this.#keyring.get(this.#service, account));
+            if (fromKeyring)
+                return { secret: fromKeyring, source: "keyring" };
+        }
+        const fromFile = this.#readFile()[account]?.secret;
+        return fromFile ? { secret: fromFile, source: "file" } : undefined;
+    }
+    write(account, secret) {
+        if (this.#storage !== "file") {
+            const stored = this.#tryKeyring(() => {
+                this.#keyring.set(this.#service, account, secret);
+                return true;
+            });
+            if (stored)
+                return "keyring";
+        }
+        const store = this.#readFile();
+        store[account] = { secret };
+        this.#writeFile(store);
+        return "file";
+    }
+    remove(account) {
+        const removed = [];
+        if (this.#storage !== "file" && this.#tryKeyring(() => this.#keyring.delete(this.#service, account))) {
+            removed.push("keyring");
+        }
+        const store = this.#readFile();
+        if (store[account] !== undefined) {
+            delete store[account];
+            this.#writeFile(store);
+            removed.push("file");
+        }
+        return removed;
+    }
+    #path() {
+        return join(this.#configDir, this.#fileName);
+    }
+    #readFile() {
+        try {
+            return JSON.parse(readFileSync(this.#path(), "utf8"));
+        }
+        catch {
+            return {};
+        }
+    }
+    #writeFile(store) {
+        writeSecurely(this.#path(), `${JSON.stringify(store, null, 2)}\n`, 0o600);
+    }
+    #tryKeyring(operation) {
+        if (this.#storage === "keyring")
+            return operation();
+        try {
+            return operation();
+        }
+        catch (error) {
+            if (!this.#warned) {
+                this.#warned = true;
+                this.#warn(`the OS keyring is unavailable (${error instanceof Error ? error.message : String(error)}); ` +
+                    `storing in ${this.#path()} instead, readable only by you`);
+            }
+            return undefined;
+        }
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAqB,aAAa,EAAE,MAAM,cAAc,CAAA;AAE/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAU,CAAA;AAmCtE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,SAAiB,EAAE,QAAQ,GAAG,KAAK,EAAU,EAAE,CAC7F,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;AAIhD;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACb,UAAU,CAAQ;IAClB,QAAQ,CAAmB;IAC3B,QAAQ,CAAc;IACtB,IAAI,CAAmB;IACvB,QAAQ,CAAQ;IAChB,OAAO,CAAoB;IAC3B,SAAS,CAAQ;IACjB,KAAK,CAA2B;IACzC,OAAO,GAAG,KAAK,CAAA;IAEf,YAAY,OAA2B;QACrC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAA;QACnC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAA;QACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAA;QAChD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;QACtC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAA;QACvD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC,CAAA;QAChF,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IACtF,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1E,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;QAE9D,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;YACrF,IAAI,WAAW;gBAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACpE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;QAClD,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACpE,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,MAAc;QACnC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;gBACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;gBACjD,OAAO,IAAI,CAAA;YACb,CAAC,CAAC,CAAA;YACF,IAAI,MAAM;gBAAE,OAAO,SAAS,CAAA;QAC9B,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;QAC9B,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,CAAA;QAC3B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACtB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,MAAM,OAAO,GAAuB,EAAE,CAAA;QAEtC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACrG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAA;YACrB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;YACtB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtB,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAC9C,CAAC;IAED,SAAS;QACP,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAc,CAAA;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAED,UAAU,CAAC,KAAgB;QACzB,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC3E,CAAC;IAED,WAAW,CAAI,SAAkB;QAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,EAAE,CAAA;QAEnD,IAAI,CAAC;YACH,OAAO,SAAS,EAAE,CAAA;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;gBACnB,IAAI,CAAC,KAAK,CACR,kCAAkC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK;oBAC3F,cAAc,IAAI,CAAC,KAAK,EAAE,gCAAgC,CAC7D,CAAA;YACH,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;CACF"}

package/dist/errors.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Every failure a CLI built on this package, and anything consuming its output, can see. The list
+ * is closed on purpose: an agent branches on `code`, and a new code is a contract change.
+ *
+ * "provider" is whatever the CLI talks to — an HTTP API, a socket, a messenger. The word is
+ * deliberately not "server": a provider that answered with a refusal is not the same as one that
+ * never answered.
+ */
+export declare const errorCodes: readonly ["validation_error", "configuration_error", "authentication_error", "permission_error", "not_found", "confirmation_required", "rate_limited", "timeout", "network_error", "provider_error", "provider_unavailable", "invalid_response", "outcome_unknown", "cancelled"];
+export type ErrorCode = (typeof errorCodes)[number];
+/**
+ * Anything a caller may attach. Everything is optional because these are diagnostics, not a
+ * contract — the contract is `code`.
+ *
+ * `retryable` says whether **this** failure could be retried, not whether the operation is safe to
+ * retry. Those are different questions and conflating them is how a duplicate write happens.
+ */
+export interface CliErrorDetails {
+    readonly status?: number;
+    readonly retryable?: boolean;
+    readonly attempts?: number;
+    readonly requestId?: string;
+    readonly runId?: string;
+    readonly retryAfterMs?: number;
+    readonly operation?: string;
+    readonly [key: string]: unknown;
+}
+export declare class CliError extends Error {
+    readonly code: ErrorCode;
+    readonly details: CliErrorDetails;
+    constructor(code: ErrorCode, message: string, details?: CliErrorDetails);
+}
+export declare const isCliError: (value: unknown) => value is CliError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,kRAeb,CAAA;AAEV,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAChC;AAED,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;gBAErB,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAM5E;AAED,eAAO,MAAM,UAAU,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,QAAqC,CAAA"}

package/dist/errors.js

@@ -0,0 +1,36 @@
+/**
+ * Every failure a CLI built on this package, and anything consuming its output, can see. The list
+ * is closed on purpose: an agent branches on `code`, and a new code is a contract change.
+ *
+ * "provider" is whatever the CLI talks to — an HTTP API, a socket, a messenger. The word is
+ * deliberately not "server": a provider that answered with a refusal is not the same as one that
+ * never answered.
+ */
+export const errorCodes = [
+    "validation_error",
+    "configuration_error",
+    "authentication_error",
+    "permission_error",
+    "not_found",
+    "confirmation_required",
+    "rate_limited",
+    "timeout",
+    "network_error",
+    "provider_error",
+    "provider_unavailable",
+    "invalid_response",
+    "outcome_unknown",
+    "cancelled",
+];
+export class CliError extends Error {
+    code;
+    details;
+    constructor(code, message, details = {}) {
+        super(message);
+        this.name = "CliError";
+        this.code = code;
+        this.details = details;
+    }
+}
+export const isCliError = (value) => value instanceof CliError;
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,kBAAkB;IAClB,qBAAqB;IACrB,sBAAsB;IACtB,kBAAkB;IAClB,WAAW;IACX,uBAAuB;IACvB,cAAc;IACd,SAAS;IACT,eAAe;IACf,gBAAgB;IAChB,sBAAsB;IACtB,kBAAkB;IAClB,iBAAiB;IACjB,WAAW;CACH,CAAA;AAsBV,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAW;IACf,OAAO,CAAiB;IAEjC,YAAY,IAAe,EAAE,OAAe,EAAE,UAA2B,EAAE;QACzE,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAc,EAAqB,EAAE,CAAC,KAAK,YAAY,QAAQ,CAAA"}

package/dist/exit-codes.d.ts

@@ -0,0 +1,11 @@
+import type { ErrorCode } from "./errors.js";
+/**
+ * One mapping, so a script can branch on `$?` without parsing text. Defined here rather than at
+ * each command site: numbers invented per command are how two of them end up disagreeing.
+ *
+ * 130 for a cancellation is the shell's convention for SIGINT.
+ */
+export declare const EXIT_CODES: Record<ErrorCode, number>;
+export declare const exitCodeFor: (code: ErrorCode) => number;
+export declare const GENERIC_FAILURE = 1;
+//# sourceMappingURL=exit-codes.d.ts.map

package/dist/exit-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit-codes.d.ts","sourceRoot":"","sources":["../src/exit-codes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAehD,CAAA;AAED,eAAO,MAAM,WAAW,GAAI,MAAM,SAAS,KAAG,MAA0B,CAAA;AAExE,eAAO,MAAM,eAAe,IAAI,CAAA"}

package/dist/exit-codes.js

@@ -0,0 +1,25 @@
+/**
+ * One mapping, so a script can branch on `$?` without parsing text. Defined here rather than at
+ * each command site: numbers invented per command are how two of them end up disagreeing.
+ *
+ * 130 for a cancellation is the shell's convention for SIGINT.
+ */
+export const EXIT_CODES = {
+    validation_error: 2,
+    configuration_error: 3,
+    authentication_error: 4,
+    permission_error: 5,
+    not_found: 6,
+    confirmation_required: 7,
+    rate_limited: 8,
+    timeout: 9,
+    network_error: 10,
+    provider_error: 11,
+    provider_unavailable: 12,
+    invalid_response: 13,
+    outcome_unknown: 14,
+    cancelled: 130,
+};
+export const exitCodeFor = (code) => EXIT_CODES[code];
+export const GENERIC_FAILURE = 1;
+//# sourceMappingURL=exit-codes.js.map

package/dist/exit-codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit-codes.js","sourceRoot":"","sources":["../src/exit-codes.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAA8B;IACnD,gBAAgB,EAAE,CAAC;IACnB,mBAAmB,EAAE,CAAC;IACtB,oBAAoB,EAAE,CAAC;IACvB,gBAAgB,EAAE,CAAC;IACnB,SAAS,EAAE,CAAC;IACZ,qBAAqB,EAAE,CAAC;IACxB,YAAY,EAAE,CAAC;IACf,OAAO,EAAE,CAAC;IACV,aAAa,EAAE,EAAE;IACjB,cAAc,EAAE,EAAE;IAClB,oBAAoB,EAAE,EAAE;IACxB,gBAAgB,EAAE,EAAE;IACpB,eAAe,EAAE,EAAE;IACnB,SAAS,EAAE,GAAG;CACf,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAe,EAAU,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;AAExE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAA"}

package/dist/http/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The HTTP layer, deliberately behind its own entry point.
+ *
+ * A CLI that speaks a socket, a message bus or a local database has no business depending on
+ * status-code semantics and `Retry-After` parsing. Import `@leemour/cli-core/http` only when
+ * the thing on the other end is actually HTTP.
+ */
+import type { ErrorCode } from "../errors.js";
+import type { WallClock } from "../time.js";
+/** The one function an HTTP client needs from its environment. A Worker, a browser, a test and Node all satisfy it. */
+export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+/** `Retry-After` is either a number of seconds or an HTTP date. Both forms occur in the wild. */
+export declare const parseRetryAfter: (header: string | null | undefined, now: WallClock) => number | undefined;
+/** A Unix timestamp in seconds, the shape several providers use for `X-RateLimit-Reset`. */
+export declare const parseRateLimitReset: (header: string | null | undefined, now: WallClock) => number | undefined;
+/** What the provider asked us to wait, if it asked at all. Its timing beats our own backoff. */
+export declare const providerWaitMs: (headers: Headers, now: WallClock) => number | undefined;
+export declare const retryableStatus: (status: number) => boolean;
+export declare const statusToCode: (status: number) => ErrorCode;
+//# sourceMappingURL=index.d.ts.map

package/dist/http/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,uHAAuH;AACvH,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhG,iGAAiG;AACjG,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,SAAS,KAAG,MAAM,GAAG,SAa5F,CAAA;AAED,4FAA4F;AAC5F,eAAO,MAAM,mBAAmB,GAAI,QAAQ,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,SAAS,KAAG,MAAM,GAAG,SAQhG,CAAA;AAED,gGAAgG;AAChG,eAAO,MAAM,cAAc,GAAI,SAAS,OAAO,EAAE,KAAK,SAAS,KAAG,MAAM,GAAG,SACqC,CAAA;AAEhH,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAA4D,CAAA;AAE7G,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,SAS7C,CAAA"}

package/dist/http/index.js

@@ -0,0 +1,46 @@
+/** `Retry-After` is either a number of seconds or an HTTP date. Both forms occur in the wild. */
+export const parseRetryAfter = (header, now) => {
+    if (!header)
+        return undefined;
+    const trimmed = header.trim();
+    if (/^\d+$/.test(trimmed))
+        return Number(trimmed) * 1000;
+    const at = Date.parse(trimmed);
+    if (Number.isNaN(at))
+        return undefined;
+    const delta = at - now().getTime();
+    // A date already in the past would otherwise become a zero wait, and a zero wait against a rate
+    // limit is a hot loop.
+    return delta > 0 ? delta : undefined;
+};
+/** A Unix timestamp in seconds, the shape several providers use for `X-RateLimit-Reset`. */
+export const parseRateLimitReset = (header, now) => {
+    if (!header)
+        return undefined;
+    const seconds = Number(header.trim());
+    if (!Number.isFinite(seconds))
+        return undefined;
+    const delta = seconds * 1000 - now().getTime();
+    return delta > 0 ? delta : undefined;
+};
+/** What the provider asked us to wait, if it asked at all. Its timing beats our own backoff. */
+export const providerWaitMs = (headers, now) => parseRetryAfter(headers.get("retry-after"), now) ?? parseRateLimitReset(headers.get("x-ratelimit-reset"), now);
+export const retryableStatus = (status) => status === 408 || status === 429 || status >= 500;
+export const statusToCode = (status) => {
+    if (status === 400 || status === 422)
+        return "validation_error";
+    if (status === 401)
+        return "authentication_error";
+    if (status === 403)
+        return "permission_error";
+    if (status === 404)
+        return "not_found";
+    if (status === 408)
+        return "timeout";
+    if (status === 429)
+        return "rate_limited";
+    if (status === 502 || status === 503 || status === 504)
+        return "provider_unavailable";
+    return "provider_error";
+};
+//# sourceMappingURL=index.js.map

package/dist/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAaA,iGAAiG;AACjG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAiC,EAAE,GAAc,EAAsB,EAAE;IACvG,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;IAC7B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAA;IAExD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC9B,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,SAAS,CAAA;IAEtC,MAAM,KAAK,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;IAClC,gGAAgG;IAChG,uBAAuB;IACvB,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACtC,CAAC,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAiC,EAAE,GAAc,EAAsB,EAAE;IAC3G,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IAE/C,MAAM,KAAK,GAAG,OAAO,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;IAC9C,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACtC,CAAC,CAAA;AAED,gGAAgG;AAChG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAE,GAAc,EAAsB,EAAE,CACrF,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC,CAAA;AAEhH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAA;AAE7G,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAa,EAAE;IACxD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,kBAAkB,CAAA;IAC/D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,sBAAsB,CAAA;IACjD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,kBAAkB,CAAA;IAC7C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAA;IACtC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,cAAc,CAAA;IACzC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,sBAAsB,CAAA;IACrF,OAAO,gBAAgB,CAAA;AACzB,CAAC,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+export { loadConfigFile, saveConfigFile, writeSecurely } from "./config.js";
+export type { CredentialSource, CredentialStorage, CredentialsOptions, StoredCredential } from "./credentials.js";
+export { CREDENTIAL_STORAGE, Credentials, keyringService } from "./credentials.js";
+export { CliError, type CliErrorDetails, type ErrorCode, errorCodes, isCliError } from "./errors.js";
+export { EXIT_CODES, exitCodeFor, GENERIC_FAILURE } from "./exit-codes.js";
+export { brokenKeyring, type KeyringStore, memoryKeyring, systemKeyring } from "./keyring.js";
+export { type Logger, noopLogger } from "./logger.js";
+export { createFileLogger, type FileLogger, type FileLoggerOptions, REDACTED_FIELDS } from "./logging.js";
+export { configFilePath, type Paths, type PathsOptions, pathsAreOverridden, resolvePaths } from "./paths.js";
+export { type PrettyOptions, renderPretty } from "./pretty.js";
+export { createRenderer, RENDER_FORMATS, type Renderer, type RendererOptions, type RenderFormat, } from "./renderer.js";
+export { backoffMs, DEFAULT_RETRY, isTransportFailure, type RetryConfig } from "./retry.js";
+export { captureStreams, processStreams, type Streams } from "./streams.js";
+export { abortError, type MonotonicClock, monotonic, realSleep, type SleepLike, type SleepReason, type WallClock, wallClock, } from "./time.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3E,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACjH,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,KAAK,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC7F,OAAO,EAAE,KAAK,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AACzG,OAAO,EAAE,cAAc,EAAE,KAAK,KAAK,EAAE,KAAK,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC5G,OAAO,EAAE,KAAK,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EACL,cAAc,EACd,cAAc,EACd,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAA;AAC3F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,OAAO,EAAE,MAAM,cAAc,CAAA;AAC3E,OAAO,EACL,UAAU,EACV,KAAK,cAAc,EACnB,SAAS,EACT,SAAS,EACT,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,SAAS,GACV,MAAM,WAAW,CAAA"}

package/dist/index.js

@@ -0,0 +1,14 @@
+export { loadConfigFile, saveConfigFile, writeSecurely } from "./config.js";
+export { CREDENTIAL_STORAGE, Credentials, keyringService } from "./credentials.js";
+export { CliError, errorCodes, isCliError } from "./errors.js";
+export { EXIT_CODES, exitCodeFor, GENERIC_FAILURE } from "./exit-codes.js";
+export { brokenKeyring, memoryKeyring, systemKeyring } from "./keyring.js";
+export { noopLogger } from "./logger.js";
+export { createFileLogger, REDACTED_FIELDS } from "./logging.js";
+export { configFilePath, pathsAreOverridden, resolvePaths } from "./paths.js";
+export { renderPretty } from "./pretty.js";
+export { createRenderer, RENDER_FORMATS, } from "./renderer.js";
+export { backoffMs, DEFAULT_RETRY, isTransportFailure } from "./retry.js";
+export { captureStreams, processStreams } from "./streams.js";
+export { abortError, monotonic, realSleep, wallClock, } from "./time.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3E,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EAAE,QAAQ,EAAwC,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAqB,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC7F,OAAO,EAAe,UAAU,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAA2C,eAAe,EAAE,MAAM,cAAc,CAAA;AACzG,OAAO,EAAE,cAAc,EAAiC,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC5G,OAAO,EAAsB,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EACL,cAAc,EACd,cAAc,GAIf,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,kBAAkB,EAAoB,MAAM,YAAY,CAAA;AAC3F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAgB,MAAM,cAAc,CAAA;AAC3E,OAAO,EACL,UAAU,EAEV,SAAS,EACT,SAAS,EAIT,SAAS,GACV,MAAM,WAAW,CAAA"}