@losthex/scribe 0.1.0

package/dist/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":";;AAoCA,kCAUC;AAkBD,kCAmDC;AAUD,sCA0BC;AAeD,gCAmCC;AAzMD;;;;;;;;;;;GAWG;AACH,qCASiB;AACjB,yCAAiC;AAEjC,+BAAgE;AAChE,iCAOgB;AAIhB,SAAgB,WAAW,CAAC,KAAY;IACtC,MAAM,eAAe,GAAG,IAAA,eAAS,EAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,eAAe,IAAI,KAAK,CAAC,KAAK,CAAC;IACjD,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAClD,OAAO;QACL,eAAe;QACf,gBAAgB,EAAE,KAAK,CAAC,KAAK;QAC7B,kBAAkB,EAAE,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;QACpF,aAAa,EAAE,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,mBAAY,CAAC,CAAC;KACzD,CAAC;AACJ,CAAC;AAkBD,SAAgB,WAAW,CAAC,EAC1B,KAAK,EACL,SAAS,EACT,UAAU,GAAG,IAAI,EACjB,KAAK,GAAG,KAAK,GACM;IACnB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAA,sBAAe,EAAC,MAAM,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAA,mBAAS,EAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAEvD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,8DAA8D;QAC9D,IAAA,oBAAU,EAAC,UAAU,EAAE,IAAA,gBAAI,EAAC,IAAI,CAAC,SAAS,EAAE,mBAAY,CAAC,CAAC,CAAC;QAC3D,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,CAAC,SAAS,EAAE,mBAAY,CAAC,EAAE,KAAK,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CACR,6CAA6C,mBAAY,2BAA2B,CACrF,CAAC;IACJ,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAA,sBAAY,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,uDAAuD,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,qBAAqB,mBAAY,0BAA0B,CAAC,CAAC;IAC1E,CAAC;IAED,IAAA,uBAAa,EAAC,UAAU,EAAE,IAAA,qBAAc,EAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtF,IAAA,mBAAS,EAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAE7B,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,IAAA,kBAAY,EAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,kCAAkC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,IAAI,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAEpE,OAAO;QACL,IAAI;QACJ,KAAK,EAAE;YACL,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,kBAAkB;YACtC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAMD;;;GAGG;AACH,SAAgB,aAAa,CAAC,MAAc,EAAE,KAAY;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,IAAA,eAAS,EAAC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC;IAC5F,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAElD,IAAI,IAAA,oBAAU,EAAC,UAAU,CAAC,IAAI,IAAA,mBAAY,EAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAA,gBAAM,EAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,WAAW,UAAU,EAAE,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,mBAAY,CAAC,CAAC;QAC9C,IAAI,IAAA,oBAAU,EAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAA,oBAAU,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAChC,IAAA,mBAAS,EAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;SAAM,IAAI,IAAA,oBAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,QAAQ,UAAU,6BAA6B,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;QAC/B,IAAA,oBAAc,EAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,8BAA8B,SAAS,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAeD,SAAgB,UAAU,CAAC,MAAc,EAAE,KAAY,EAAE,SAAiB;IACxE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,eAAe,GAAG,IAAA,eAAS,EAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,eAAe,CAAC;IACvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnF,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,MAAM,SAAS,GAAG,QAAQ,KAAK,IAAI,IAAI,IAAA,mBAAY,EAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS;QACZ,QAAQ,CAAC,IAAI,CAAC,iCAAiC,UAAU,2BAA2B,CAAC,CAAC;IACxF,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CACX,qBAAqB,eAAe,IAAI,OAAO,0BAA0B,SAAS,EAAE;YAClF,wBAAwB,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,SAAS,IAAI,QAAQ,KAAK,IAAA,qBAAc,EAAC,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5F,IAAI,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CACX,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS;QACT,IAAI,EAAE,SAAS;QACf,OAAO;QACP,OAAO,EAAE,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,mBAAY,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAY,CAAC,CAAC,CAAC,IAAI;QACxE,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACjE,CAAC"}

package/dist/keychain.js

@@ -0,0 +1,181 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.accountFor = accountFor;
+exports.macKeychainStore = macKeychainStore;
+exports.secretToolStore = secretToolStore;
+exports.fileStore = fileStore;
+exports.tokenStore = tokenStore;
+/**
+ * Token storage — the OS keychain, because a refresh token is a standing
+ * credential for a person's Scribe identity (INFRA-ITD-004: "`scribe
+ * login` runs PKCE loopback once and keeps the refresh token in the OS
+ * keychain").
+ *
+ * macOS gets the real thing through `/usr/bin/security`: a generic
+ * password item, per issuer, that the login keychain encrypts at rest and
+ * unlocks with the engineer's login session. Linux gets `secret-tool`
+ * (libsecret) when it is installed. Anything else falls back to a 0600
+ * file with a printed warning — a fallback that says so is better than a
+ * CLI that refuses to run on a machine without a keyring.
+ *
+ * Known tradeoff on the macOS path: `security add-generic-password` takes
+ * the secret as an argv value, so it is briefly visible to `ps` on the
+ * same machine. The alternative is a native Keychain binding, which means
+ * a compiled dependency in a tool that otherwise has none; on a
+ * single-user laptop, for a token the same user can read from the keychain
+ * anyway, the tradeoff is worth naming rather than paying for.
+ */
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const SERVICE = 'scribe';
+/** One keychain item per issuer, so stages never share credentials. */
+function accountFor(issuer) {
+    try {
+        return new URL(issuer).host;
+    }
+    catch {
+        return issuer;
+    }
+}
+function parse(raw) {
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed.access && parsed.refresh ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function commandExists(command) {
+    try {
+        (0, node_child_process_1.execFileSync)('command', ['-v', command], { shell: '/bin/sh', stdio: 'ignore' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function macKeychainStore(issuer) {
+    const account = accountFor(issuer);
+    const run = (args) => (0, node_child_process_1.execFileSync)('/usr/bin/security', args, {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return {
+        read() {
+            try {
+                return parse(run(['find-generic-password', '-s', SERVICE, '-a', account, '-w']).trim());
+            }
+            catch {
+                return null;
+            }
+        },
+        write(tokens) {
+            // -U updates in place; without it a second login is a duplicate item.
+            run([
+                'add-generic-password',
+                '-U',
+                '-s',
+                SERVICE,
+                '-a',
+                account,
+                '-D',
+                'Scribe issuer tokens',
+                '-j',
+                'Written by `scribe login`',
+                '-w',
+                JSON.stringify(tokens),
+            ]);
+        },
+        clear() {
+            try {
+                run(['delete-generic-password', '-s', SERVICE, '-a', account]);
+            }
+            catch {
+                // Nothing stored — clearing is idempotent.
+            }
+        },
+        describe() {
+            return `macOS keychain (service ${SERVICE}, account ${account})`;
+        },
+    };
+}
+function secretToolStore(issuer) {
+    const account = accountFor(issuer);
+    const attrs = ['service', SERVICE, 'account', account];
+    return {
+        read() {
+            try {
+                return parse((0, node_child_process_1.execFileSync)('secret-tool', ['lookup', ...attrs], {
+                    encoding: 'utf8',
+                    stdio: ['ignore', 'pipe', 'ignore'],
+                }).trim());
+            }
+            catch {
+                return null;
+            }
+        },
+        write(tokens) {
+            (0, node_child_process_1.execFileSync)('secret-tool', ['store', '--label=Scribe issuer tokens', ...attrs], {
+                input: JSON.stringify(tokens),
+                stdio: ['pipe', 'ignore', 'pipe'],
+            });
+        },
+        clear() {
+            try {
+                (0, node_child_process_1.execFileSync)('secret-tool', ['clear', ...attrs], { stdio: 'ignore' });
+            }
+            catch {
+                // Idempotent.
+            }
+        },
+        describe() {
+            return `libsecret via secret-tool (service ${SERVICE}, account ${account})`;
+        },
+    };
+}
+/** Last resort, and it says so. */
+function fileStore(path, warn = () => { }) {
+    let warned = false;
+    const warnOnce = () => {
+        if (warned)
+            return;
+        warned = true;
+        warn(`no OS keyring found — storing tokens in ${path} (mode 0600)`);
+    };
+    return {
+        read() {
+            try {
+                return parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+            }
+            catch {
+                return null;
+            }
+        },
+        write(tokens) {
+            warnOnce();
+            (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true });
+            (0, node_fs_1.writeFileSync)(path, `${JSON.stringify(tokens)}\n`, { mode: 0o600 });
+            (0, node_fs_1.chmodSync)(path, 0o600);
+        },
+        clear() {
+            (0, node_fs_1.rmSync)(path, { force: true });
+        },
+        describe() {
+            return `file ${path} (no OS keyring available)`;
+        },
+    };
+}
+function tokenStore(issuer, { fallbackPath, platform = process.platform, env = process.env, warn }) {
+    if (env.SCRIBE_TOKEN_STORE === 'file')
+        return fileStore(fallbackPath, warn);
+    if (platform === 'darwin')
+        return macKeychainStore(issuer);
+    if (platform === 'linux' && commandExists('secret-tool'))
+        return secretToolStore(issuer);
+    return fileStore(fallbackPath, warn);
+}
+//# sourceMappingURL=keychain.js.map

package/dist/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":";;AA6CA,gCAMC;AAqBD,4CA2CC;AAED,0CAiCC;AAGD,8BA4BC;AAWD,gCAQC;AAxMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,2DAAkD;AAClD,qCAAoF;AACpF,yCAAoC;AAoBpC,MAAM,OAAO,GAAG,QAAQ,CAAC;AAEzB,uEAAuE;AACvE,SAAgB,UAAU,CAAC,MAAc;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,GAAkB;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;QAC/C,OAAO,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC;QACH,IAAA,iCAAY,EAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAAC,MAAc;IAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,CAAC,IAAc,EAAE,EAAE,CAC7B,IAAA,iCAAY,EAAC,mBAAmB,EAAE,IAAI,EAAE;QACtC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACL,OAAO;QACL,IAAI;YACF,IAAI,CAAC;gBACH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM;YACV,sEAAsE;YACtE,GAAG,CAAC;gBACF,sBAAsB;gBACtB,IAAI;gBACJ,IAAI;gBACJ,OAAO;gBACP,IAAI;gBACJ,OAAO;gBACP,IAAI;gBACJ,sBAAsB;gBACtB,IAAI;gBACJ,2BAA2B;gBAC3B,IAAI;gBACJ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;QACD,KAAK;YACH,IAAI,CAAC;gBACH,GAAG,CAAC,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,2CAA2C;YAC7C,CAAC;QACH,CAAC;QACD,QAAQ;YACN,OAAO,2BAA2B,OAAO,aAAa,OAAO,GAAG,CAAC;QACnE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAAC,MAAc;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACvD,OAAO;QACL,IAAI;YACF,IAAI,CAAC;gBACH,OAAO,KAAK,CACV,IAAA,iCAAY,EAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,EAAE;oBAChD,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;iBACpC,CAAC,CAAC,IAAI,EAAE,CACV,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM;YACV,IAAA,iCAAY,EAAC,aAAa,EAAE,CAAC,OAAO,EAAE,8BAA8B,EAAE,GAAG,KAAK,CAAC,EAAE;gBAC/E,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBAC7B,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;QACD,KAAK;YACH,IAAI,CAAC;gBACH,IAAA,iCAAY,EAAC,aAAa,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxE,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;QACD,QAAQ;YACN,OAAO,sCAAsC,OAAO,aAAa,OAAO,GAAG,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mCAAmC;AACnC,SAAgB,SAAS,CAAC,IAAY,EAAE,OAAkC,GAAG,EAAE,GAAE,CAAC;IAChF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,IAAI,MAAM;YAAE,OAAO;QACnB,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,2CAA2C,IAAI,cAAc,CAAC,CAAC;IACtE,CAAC,CAAC;IACF,OAAO;QACL,IAAI;YACF,IAAI,CAAC;gBACH,OAAO,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM;YACV,QAAQ,EAAE,CAAC;YACX,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,KAAK;YACH,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,QAAQ;YACN,OAAO,QAAQ,IAAI,4BAA4B,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC;AAWD,SAAgB,UAAU,CACxB,MAAc,EACd,EAAE,YAAY,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAqB;IAEzF,IAAI,GAAG,CAAC,kBAAkB,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC5E,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,QAAQ,KAAK,OAAO,IAAI,aAAa,CAAC,aAAa,CAAC;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IACzF,OAAO,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC"}

package/dist/lock.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STALE_LOCK_MS = void 0;
+exports.withLock = withLock;
+exports.lockHolder = lockHolder;
+/**
+ * One flush at a time. Two commits in the same second each spawn a flush,
+ * and two flushes sharing a queue file would resend or lose a batch, so the
+ * loser simply skips — the queue is durable and the next commit flushes it.
+ *
+ * `wx` is the whole mechanism: an exclusive create is atomic on every
+ * filesystem the CLI runs on. A stale lock (crashed process, killed
+ * terminal) times out rather than wedging the collector forever.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+exports.STALE_LOCK_MS = 5 * 60_000;
+async function withLock(path, fn, { staleMs = exports.STALE_LOCK_MS, now = Date.now } = {}) {
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true });
+    try {
+        (0, node_fs_1.writeFileSync)(path, `${process.pid}\n`, { flag: 'wx', mode: 0o600 });
+    }
+    catch {
+        let age = Infinity;
+        try {
+            // Clamped: a filesystem timestamp a hair ahead of our clock is not a
+            // lock from the future.
+            age = Math.max(0, now() - (0, node_fs_1.statSync)(path).mtimeMs);
+        }
+        catch {
+            // Vanished between the failed create and the stat — treat as stale.
+        }
+        if (age < staleMs)
+            return { acquired: false };
+        // Stale: take it over, recording who we are for the next reader.
+        try {
+            (0, node_fs_1.writeFileSync)(path, `${process.pid}\n`, { mode: 0o600 });
+        }
+        catch {
+            return { acquired: false };
+        }
+    }
+    try {
+        return { acquired: true, value: await fn() };
+    }
+    finally {
+        (0, node_fs_1.rmSync)(path, { force: true });
+    }
+}
+/** Who holds the lock, for `scribe status`. */
+function lockHolder(path) {
+    try {
+        return (0, node_fs_1.readFileSync)(path, 'utf8').trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=lock.js.map

package/dist/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../src/lock.ts"],"names":[],"mappings":";;;AAoBA,4BA8BC;AAGD,gCAMC;AA3DD;;;;;;;;GAQG;AACH,qCAAmF;AACnF,yCAAoC;AAEvB,QAAA,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC;AAQjC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,EAAwB,EACxB,EAAE,OAAO,GAAG,qBAAa,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,KAA+C,EAAE;IAE1F,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,GAAG,QAAQ,CAAC;QACnB,IAAI,CAAC;YACH,qEAAqE;YACrE,wBAAwB;YACxB,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;QACD,IAAI,GAAG,GAAG,OAAO;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC9C,iEAAiE;QACjE,IAAI,CAAC;YACH,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,SAAgB,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,OAAO,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/login.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openInBrowser = openInBrowser;
+exports.login = login;
+/**
+ * `scribe login` — one browser sign-in, then the CLI never asks again.
+ *
+ * The loopback half of PKCE: a throwaway HTTP server on 127.0.0.1 with an
+ * OS-assigned port receives the authorization code, so the code never
+ * leaves the machine and no client secret exists to leak. The issuer's
+ * redirect allowlist permits loopback already (packages/core/src/auth/redirect.ts), so
+ * this needs no per-stage registration — unlike the Google leg, which is
+ * registered once per issuer.
+ */
+const node_http_1 = require("node:http");
+const node_child_process_1 = require("node:child_process");
+const pkce_1 = require("./pkce");
+const DONE_PAGE = (message) => `<!doctype html>
+<html><head><meta charset="utf-8"><title>Scribe</title></head>
+<body style="font:16px/1.5 -apple-system,system-ui,sans-serif;margin:4rem auto;max-width:32rem">
+<h1 style="font-size:1.25rem">Scribe</h1><p>${message}</p>
+<p style="color:#666">You can close this tab and go back to your terminal.</p>
+</body></html>`;
+function openInBrowser(url) {
+    const command = process.platform === 'darwin' ? 'open' : 'xdg-open';
+    try {
+        (0, node_child_process_1.spawn)(command, [url], { stdio: 'ignore', detached: true }).unref();
+    }
+    catch {
+        // Headless machine — the printed URL is the fallback.
+    }
+}
+/**
+ * Runs the whole flow and returns the tokens; the caller stores them.
+ * Rejects on timeout, on a state mismatch, or on an error from the issuer.
+ */
+async function login({ issuer, open = openInBrowser, log = () => { }, fetchImpl = fetch, timeoutMs = 5 * 60_000, }) {
+    const verifier = (0, pkce_1.createVerifier)();
+    const state = (0, pkce_1.createState)();
+    // Assigned once the OS has picked the port; the exchange must send the
+    // identical value, so it is captured rather than rebuilt.
+    let redirect = '';
+    const code = await new Promise((resolve, reject) => {
+        const server = (0, node_http_1.createServer)((req, res) => {
+            const result = (0, pkce_1.parseCallback)(req.url ?? '/');
+            const finish = (status, message) => {
+                res.writeHead(status, { 'content-type': 'text/html; charset=utf-8' });
+                res.end(DONE_PAGE(message));
+            };
+            if (result.error) {
+                finish(400, `Sign-in failed: ${result.error}`);
+                close();
+                reject(new Error(result.error));
+                return;
+            }
+            if (!result.code) {
+                // Favicon and friends: not the callback, not an error.
+                res.writeHead(404).end();
+                return;
+            }
+            if (result.state !== state) {
+                finish(400, 'Sign-in failed: state mismatch.');
+                close();
+                reject(new Error('state mismatch — the callback did not come from this login'));
+                return;
+            }
+            finish(200, 'Signed in. Scribe has your token.');
+            close();
+            resolve(result.code);
+        });
+        const timer = setTimeout(() => {
+            close();
+            reject(new Error(`timed out after ${Math.round(timeoutMs / 1000)}s waiting for sign-in`));
+        }, timeoutMs);
+        function close() {
+            clearTimeout(timer);
+            server.close();
+        }
+        server.on('error', (err) => {
+            close();
+            reject(err);
+        });
+        server.listen(0, '127.0.0.1', () => {
+            const { port } = server.address();
+            const redirectUri = `http://127.0.0.1:${port}/callback`;
+            const url = (0, pkce_1.authorizeUrl)({
+                issuer,
+                redirectUri,
+                challenge: (0, pkce_1.challengeFor)(verifier),
+                state,
+            });
+            redirect = redirectUri;
+            log(`Opening your browser to sign in with Google:\n  ${url}`);
+            open(url);
+        });
+    });
+    return (0, pkce_1.exchangeCode)({ issuer, code, redirectUri: redirect, verifier, fetchImpl });
+}
+//# sourceMappingURL=login.js.map

package/dist/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":";;AA2CA,sCAOC;AAMD,sBAyEC;AAjID;;;;;;;;;GASG;AACH,yCAAyC;AACzC,2DAA2C;AAG3C,iCASgB;AAEhB,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC;;;8CAGO,OAAO;;eAEtC,CAAC;AAahB,SAAgB,aAAa,CAAC,GAAW;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IACpE,IAAI,CAAC;QACH,IAAA,0BAAK,EAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,KAAK,CAAC,EAC1B,MAAM,EACN,IAAI,GAAG,aAAa,EACpB,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EACd,SAAS,GAAG,KAAK,EACjB,SAAS,GAAG,CAAC,GAAG,MAAM,GACT;IACb,MAAM,QAAQ,GAAG,IAAA,qBAAc,GAAE,CAAC;IAClC,MAAM,KAAK,GAAG,IAAA,kBAAW,GAAE,CAAC;IAC5B,uEAAuE;IACvE,0DAA0D;IAC1D,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,IAAA,wBAAY,EAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,MAAM,MAAM,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,EAAE;gBACjD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACtE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9B,CAAC,CAAC;YACF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,CAAC,GAAG,EAAE,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC/C,KAAK,EAAE,CAAC;gBACR,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,uDAAuD;gBACvD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC3B,MAAM,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;gBAC/C,KAAK,EAAE,CAAC;gBACR,MAAM,CAAC,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YACjD,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC5F,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,SAAS,KAAK;YACZ,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QAED,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;YACjD,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;YACxD,MAAM,GAAG,GAAG,IAAA,mBAAY,EAAC;gBACvB,MAAM;gBACN,WAAW;gBACX,SAAS,EAAE,IAAA,mBAAY,EAAC,QAAQ,CAAC;gBACjC,KAAK;aACN,CAAC,CAAC;YACH,QAAQ,GAAG,WAAW,CAAC;YACvB,GAAG,CAAC,mDAAmD,GAAG,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,IAAA,mBAAY,EAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;AACpF,CAAC"}

package/dist/mcp.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROTOCOL_VERSION_HEADER = void 0;
+exports.proxyError = proxyError;
+exports.protocolVersionOf = protocolVersionOf;
+exports.forward = forward;
+exports.runProxy = runProxy;
+/** The MCP protocol revision this proxy announces on every request. */
+exports.PROTOCOL_VERSION_HEADER = 'mcp-protocol-version';
+async function post(deps, line, token, protocolVersion) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    let response;
+    try {
+        response = await fetchImpl(deps.url, {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${token}`,
+                'content-type': 'application/json',
+                accept: 'application/json, text/event-stream',
+                ...(protocolVersion ? { [exports.PROTOCOL_VERSION_HEADER]: protocolVersion } : {}),
+            },
+            body: line,
+        });
+    }
+    catch (err) {
+        return { status: 0, body: null, error: err instanceof Error ? err.message : String(err) };
+    }
+    const text = await response.text();
+    return { status: response.status, body: text.trim().length > 0 ? text.trim() : null };
+}
+/** A JSON-RPC error the proxy itself has to answer, keeping the id. */
+function proxyError(line, message) {
+    let id = null;
+    try {
+        const parsed = JSON.parse(line);
+        // Notifications carry no id and expect no answer, not even an error.
+        if (parsed.id === undefined || parsed.id === null)
+            return null;
+        id = parsed.id;
+    }
+    catch {
+        return null;
+    }
+    return JSON.stringify({ jsonrpc: '2.0', id, error: { code: -32000, message } });
+}
+/** Remembers the negotiated protocol version across the session. */
+function protocolVersionOf(line) {
+    try {
+        const parsed = JSON.parse(line);
+        const version = parsed.result?.protocolVersion;
+        return typeof version === 'string' ? version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Forwards one message. A 401 buys exactly one refresh and one retry —
+ * the same contract the amend flush has, and for the same reason: the
+ * CLI's clock and the issuer's opinion of expiry can disagree.
+ */
+async function forward(deps, line, protocolVersion) {
+    let token;
+    try {
+        token = await deps.token();
+    }
+    catch (err) {
+        return {
+            status: 401,
+            body: null,
+            error: err instanceof Error ? err.message : 'not signed in — run `scribe login`',
+        };
+    }
+    let result = await post(deps, line, token, protocolVersion);
+    if (result.status === 401) {
+        const refreshed = await deps.refresh();
+        if (refreshed)
+            result = await post(deps, line, refreshed, protocolVersion);
+    }
+    return result;
+}
+/**
+ * Splits a stdio stream into newline-delimited JSON-RPC messages and
+ * pumps each one through. Resolves when stdin closes, which is how a
+ * harness tells the server to shut down.
+ */
+async function runProxy(input, deps) {
+    const log = deps.log ?? (() => { });
+    let buffer = '';
+    let protocolVersion;
+    // Messages are handled one at a time: the harness expects replies in
+    // request order, and a Lambda has no session to interleave against.
+    let chain = Promise.resolve();
+    const handle = async (line) => {
+        const trimmed = line.trim();
+        if (trimmed.length === 0)
+            return;
+        const result = await forward(deps, trimmed, protocolVersion);
+        if (result.status === 0 || result.error) {
+            log(`scribe mcp: ${result.error ?? 'no response'}`);
+            const reply = proxyError(trimmed, result.error ?? 'the Scribe MCP endpoint is unreachable');
+            if (reply)
+                deps.write(reply);
+            return;
+        }
+        if (result.status === 202 || !result.body)
+            return;
+        if (result.status >= 400) {
+            log(`scribe mcp: endpoint answered ${result.status}`);
+            // The endpoint's body is already a JSON-RPC error object when it
+            // knows the protocol; pass it through rather than paraphrasing.
+            deps.write(result.body);
+            return;
+        }
+        protocolVersion = protocolVersionOf(result.body) ?? protocolVersion;
+        deps.write(result.body);
+    };
+    return new Promise((resolve, reject) => {
+        input.setEncoding('utf8');
+        input.on('data', (chunk) => {
+            buffer += chunk;
+            let index = buffer.indexOf('\n');
+            while (index >= 0) {
+                const line = buffer.slice(0, index);
+                buffer = buffer.slice(index + 1);
+                chain = chain.then(() => handle(line));
+                index = buffer.indexOf('\n');
+            }
+        });
+        input.on('error', reject);
+        input.on('end', () => {
+            if (buffer.trim().length > 0)
+                chain = chain.then(() => handle(buffer));
+            chain.then(resolve, reject);
+        });
+    });
+}
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":";;;AA6EA,gCAWC;AAGD,8CAQC;AAOD,0BAsBC;AAOD,4BAiDC;AAhJD,uEAAuE;AAC1D,QAAA,uBAAuB,GAAG,sBAAsB,CAAC;AAS9D,KAAK,UAAU,IAAI,CACjB,IAAe,EACf,IAAY,EACZ,KAAa,EACb,eAAmC;IAEnC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;gBAC7C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,+BAAuB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E;YACD,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxF,CAAC;AAED,uEAAuE;AACvE,SAAgB,UAAU,CAAC,IAAY,EAAE,OAAe;IACtD,IAAI,EAAE,GAAY,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuC,CAAC;QACtE,qEAAqE;QACrE,IAAI,MAAM,CAAC,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/D,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,oEAAoE;AACpE,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+C,CAAC;QAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;QAC/C,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,OAAO,CAC3B,IAAe,EACf,IAAY,EACZ,eAAwB;IAExB,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC;SACjF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,SAAS;YAAE,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,QAAQ,CAAC,KAAe,EAAE,IAAe;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,eAAmC,CAAC;IACxC,qEAAqE;IACrE,oEAAoE;IACpE,IAAI,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE7C,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAE7D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACxC,GAAG,CAAC,eAAe,MAAM,CAAC,KAAK,IAAI,aAAa,EAAE,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,wCAAwC,CAAC,CAAC;YAC5F,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,OAAO;QAClD,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACzB,GAAG,CAAC,iCAAiC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACtD,iEAAiE;YACjE,gEAAgE;YAChE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC;QACpE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC;IAEF,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACjC,MAAM,IAAI,KAAK,CAAC;YAChB,IAAI,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACpC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBACjC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvC,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACnB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACvE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/paths.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvePaths = resolvePaths;
+/**
+ * Where the CLI keeps its state on the engineer's machine.
+ *
+ * Everything lives under one directory so `scribe status` can show it and
+ * `scribe uninstall` can remove it. `SCRIBE_HOME` relocates the whole lot,
+ * which is how the tests and the scratch-repo demo run without touching a
+ * real home directory — and how the installed git hook keeps pointing at
+ * the same state it was installed with.
+ */
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+/** Honours XDG_CONFIG_HOME, and SCRIBE_HOME above everything. */
+function resolvePaths(env = process.env) {
+    const home = env.SCRIBE_HOME ?? (0, node_path_1.join)(env.XDG_CONFIG_HOME ?? (0, node_path_1.join)((0, node_os_1.homedir)(), '.config'), 'scribe');
+    return {
+        home,
+        config: (0, node_path_1.join)(home, 'config.json'),
+        queue: (0, node_path_1.join)(home, 'queue.jsonl'),
+        sent: (0, node_path_1.join)(home, 'sent.jsonl'),
+        dead: (0, node_path_1.join)(home, 'rejected.jsonl'),
+        lock: (0, node_path_1.join)(home, 'flush.lock'),
+        hooks: (0, node_path_1.join)(home, 'git-hooks'),
+    };
+}
+//# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":";;AA6BA,oCAWC;AAxCD;;;;;;;;GAQG;AACH,qCAAkC;AAClC,yCAAiC;AAkBjC,iEAAiE;AACjE,SAAgB,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,IAAI,IAAA,gBAAI,EAAC,GAAG,CAAC,eAAe,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClG,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC;QACjC,KAAK,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC;QAChC,IAAI,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,YAAY,CAAC;QAC9B,IAAI,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,gBAAgB,CAAC;QAClC,IAAI,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,YAAY,CAAC;QAC9B,KAAK,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,WAAW,CAAC;KAC/B,CAAC;AACJ,CAAC"}