@lotagate/cli 0.1.20 → 0.1.22

package/dist/infrastructure/clipboard/clipboard-adapter-factory.js

@@ -0,0 +1,98 @@
+import { CliError } from '../../domain/errors/cli-error.js';
+import { CLI_ERROR_CODES } from '../../domain/errors/error-codes.js';
+import { WindowsClipboardAdapter } from './windows-clipboard-adapter.js';
+import { detectHostPlatform } from '../platform/host-platform.js';
+import { spawnPlatformProcess } from '../platform/host-process.js';
+import { CLIPBOARD_POLICY, clipboardUnavailableError, isClipboardUnavailableError } from './clipboard-policy.js';
+export function createClipboardAdapter(platform = detectHostPlatform()) {
+    if (platform.id === 'windows')
+        return new WindowsClipboardAdapter(platform);
+    if (platform.id === 'macos')
+        return new FallbackClipboardAdapter([
+            new ProcessClipboardAdapter('pbpaste', ['-Prefer', 'png'], 'image/png', platform),
+        ]);
+    if (platform.id === 'linux' || platform.id === 'bsd')
+        return new FallbackClipboardAdapter([
+            new ProcessClipboardAdapter('wl-paste', ['--no-newline', '--type', 'image/png'], 'image/png', platform),
+            new ProcessClipboardAdapter('xclip', ['-selection', 'clipboard', '-target', 'image/png', '-out'], 'image/png', platform),
+        ]);
+    return new UnsupportedClipboardAdapter();
+}
+export class ProcessClipboardAdapter {
+    command;
+    args;
+    mimeType;
+    platform;
+    constructor(command, args, mimeType, platform = detectHostPlatform()) {
+        this.command = command;
+        this.args = args;
+        this.mimeType = mimeType;
+        this.platform = platform;
+    }
+    async readImage() {
+        return new Promise((resolve, reject) => {
+            const child = spawnPlatformProcess(this.command, this.args, this.platform, { stdio: ['ignore', 'pipe', 'pipe'] });
+            const chunks = [];
+            let size = 0;
+            let settled = false;
+            const finish = (callback) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                callback();
+            };
+            const timer = setTimeout(() => {
+                child.kill();
+                finish(() => reject(clipboardUnavailableError(`Clipboard image read timed out after ${CLIPBOARD_POLICY.timeoutMs}ms.`)));
+            }, CLIPBOARD_POLICY.timeoutMs);
+            child.stdout?.on('data', (chunk) => {
+                if (settled)
+                    return;
+                size += chunk.byteLength;
+                if (size > CLIPBOARD_POLICY.maxImageBytes) {
+                    child.kill();
+                    finish(() => reject(new CliError(CLI_ERROR_CODES.ATTACHMENT_TOO_LARGE, 'Clipboard image is too large.', { category: 'attachment', userMessage: 'Clipboard image exceeds the maximum allowed size.' })));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            child.once('error', () => finish(() => resolve(undefined)));
+            child.once('close', (code) => {
+                finish(() => {
+                    if (code !== 0 || chunks.length === 0)
+                        resolve(undefined);
+                    else
+                        resolve({ bytes: Buffer.concat(chunks), mimeType: this.mimeType });
+                });
+            });
+        });
+    }
+}
+class FallbackClipboardAdapter {
+    adapters;
+    constructor(adapters) {
+        this.adapters = adapters;
+    }
+    async readImage() {
+        let unavailable;
+        for (const adapter of this.adapters) {
+            try {
+                const image = await adapter.readImage();
+                if (image !== undefined)
+                    return image;
+            }
+            catch (error) {
+                if (!isClipboardUnavailableError(error))
+                    throw error;
+                unavailable = error;
+            }
+        }
+        throw unavailable ?? clipboardUnavailableError('No supported clipboard image provider was found.');
+    }
+}
+class UnsupportedClipboardAdapter {
+    async readImage() {
+        throw clipboardUnavailableError('Clipboard image support is unavailable on this platform.');
+    }
+}

package/dist/infrastructure/clipboard/clipboard-policy.d.ts

@@ -0,0 +1,8 @@
+import { CliError } from '../../domain/errors/cli-error.js';
+export declare const CLIPBOARD_POLICY: {
+    readonly maxImageBytes: number;
+    readonly maxTextBytes: number;
+    readonly timeoutMs: 15000;
+};
+export declare function clipboardUnavailableError(message: string, cause?: unknown): CliError;
+export declare function isClipboardUnavailableError(error: unknown): error is CliError;

package/dist/infrastructure/clipboard/clipboard-policy.js

@@ -0,0 +1,19 @@
+import { CliError } from '../../domain/errors/cli-error.js';
+import { CLI_ERROR_CODES } from '../../domain/errors/error-codes.js';
+import { RESOURCE_LIMITS } from '../../domain/runtime/resource-limits.js';
+export const CLIPBOARD_POLICY = {
+    maxImageBytes: RESOURCE_LIMITS.maxAttachmentBytes,
+    maxTextBytes: RESOURCE_LIMITS.clipboardTextBytes,
+    timeoutMs: RESOURCE_LIMITS.clipboardTimeoutMs,
+};
+export function clipboardUnavailableError(message, cause) {
+    return new CliError(CLI_ERROR_CODES.ATTACHMENT_CLIPBOARD_UNAVAILABLE, message, {
+        category: 'attachment',
+        userMessage: 'Unable to read from the clipboard. Copy the content again and retry.',
+        retryable: true,
+        ...(cause === undefined ? {} : { cause }),
+    });
+}
+export function isClipboardUnavailableError(error) {
+    return error instanceof CliError && error.code === CLI_ERROR_CODES.ATTACHMENT_CLIPBOARD_UNAVAILABLE;
+}

package/dist/infrastructure/clipboard/clipboard-text-adapter-factory.d.ts

@@ -0,0 +1,10 @@
+import type { ClipboardTextAdapter } from '../../ports/clipboard-text-adapter.js';
+import { type HostPlatformContext } from '../platform/host-platform.js';
+export declare function createClipboardTextAdapter(platform?: HostPlatformContext): ClipboardTextAdapter;
+export declare class ProcessClipboardTextAdapter implements ClipboardTextAdapter {
+    private readonly command;
+    private readonly args;
+    private readonly platform;
+    constructor(command: string, args: readonly string[], platform?: HostPlatformContext);
+    readText(): Promise<string | undefined>;
+}

package/dist/infrastructure/clipboard/clipboard-text-adapter-factory.js

@@ -0,0 +1,94 @@
+import { CliError } from '../../domain/errors/cli-error.js';
+import { CLI_ERROR_CODES } from '../../domain/errors/error-codes.js';
+import { WindowsClipboardTextAdapter } from './windows-clipboard-text-adapter.js';
+import { detectHostPlatform } from '../platform/host-platform.js';
+import { spawnPlatformProcess } from '../platform/host-process.js';
+import { CLIPBOARD_POLICY, clipboardUnavailableError, isClipboardUnavailableError } from './clipboard-policy.js';
+export function createClipboardTextAdapter(platform = detectHostPlatform()) {
+    if (platform.id === 'windows')
+        return new WindowsClipboardTextAdapter(platform);
+    if (platform.id === 'macos')
+        return new ProcessClipboardTextAdapter('pbpaste', [], platform);
+    if (platform.id === 'linux' || platform.id === 'bsd')
+        return new FallbackClipboardTextAdapter([
+            new ProcessClipboardTextAdapter('wl-paste', ['--no-newline'], platform),
+            new ProcessClipboardTextAdapter('xclip', ['-selection', 'clipboard', '-out'], platform),
+        ]);
+    return new UnsupportedClipboardTextAdapter();
+}
+export class ProcessClipboardTextAdapter {
+    command;
+    args;
+    platform;
+    constructor(command, args, platform = detectHostPlatform()) {
+        this.command = command;
+        this.args = args;
+        this.platform = platform;
+    }
+    async readText() {
+        return new Promise((resolve, reject) => {
+            const child = spawnPlatformProcess(this.command, this.args, this.platform, { stdio: ['ignore', 'pipe', 'pipe'] });
+            const chunks = [];
+            let size = 0;
+            let settled = false;
+            const finish = (callback) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                callback();
+            };
+            const timer = setTimeout(() => {
+                child.kill();
+                finish(() => reject(clipboardUnavailableError(`Clipboard text read timed out after ${CLIPBOARD_POLICY.timeoutMs}ms.`)));
+            }, CLIPBOARD_POLICY.timeoutMs);
+            child.stdout?.on('data', (chunk) => {
+                if (settled)
+                    return;
+                size += chunk.byteLength;
+                if (size > CLIPBOARD_POLICY.maxTextBytes) {
+                    child.kill();
+                    finish(() => reject(new CliError(CLI_ERROR_CODES.ATTACHMENT_TOO_LARGE, 'Clipboard text is too large.', {
+                        category: 'attachment', userMessage: 'Clipboard text exceeds the maximum allowed size.',
+                    })));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            child.once('error', () => finish(() => resolve(undefined)));
+            child.once('close', (code) => finish(() => {
+                if (code !== 0 || chunks.length === 0)
+                    resolve(undefined);
+                else
+                    resolve(Buffer.concat(chunks).toString('utf8'));
+            }));
+        });
+    }
+}
+class FallbackClipboardTextAdapter {
+    adapters;
+    constructor(adapters) {
+        this.adapters = adapters;
+    }
+    async readText() {
+        let unavailable;
+        for (const adapter of this.adapters) {
+            try {
+                const text = await adapter.readText();
+                if (text !== undefined)
+                    return text;
+            }
+            catch (error) {
+                if (!isClipboardUnavailableError(error))
+                    throw error;
+                unavailable = error;
+            }
+        }
+        throw unavailable ?? clipboardUnavailableError('No supported clipboard text provider was found.');
+    }
+}
+class UnsupportedClipboardTextAdapter {
+    async readText() {
+        throw clipboardUnavailableError('Clipboard text support is unavailable on this platform.');
+    }
+}

package/dist/infrastructure/clipboard/image-normalizer.d.ts

@@ -0,0 +1,12 @@
+import type { Attachment, AttachmentPayload, AttachmentSource } from '../../domain/session/attachment.js';
+import type { TextFileContentPart, TextImageContentPart, TextMessage } from '@lotagate/sdk';
+export declare const DEFAULT_MAX_IMAGE_BYTES: number;
+export interface NormalizedImage {
+    bytes: Buffer;
+    mimeType: string;
+}
+export declare function normalizeImage(bytes: Uint8Array, declaredMimeType?: string, maxBytes?: number): NormalizedImage;
+export declare function createImageAttachment(image: NormalizedImage, source: AttachmentSource, id: string, storagePath?: string): Attachment;
+export declare function toImageContentPart(payload: AttachmentPayload): TextImageContentPart;
+export declare function toAttachmentContentPart(payload: AttachmentPayload): TextImageContentPart | TextFileContentPart;
+export declare function buildUserMessage(prompt: string, attachments?: readonly AttachmentPayload[]): TextMessage;

package/dist/infrastructure/clipboard/image-normalizer.js

@@ -0,0 +1,78 @@
+import { CliError } from '../../domain/errors/cli-error.js';
+import { CLI_ERROR_CODES } from '../../domain/errors/error-codes.js';
+import { RESOURCE_LIMITS } from '../../domain/runtime/resource-limits.js';
+export const DEFAULT_MAX_IMAGE_BYTES = RESOURCE_LIMITS.maxAttachmentBytes;
+const IMAGE_MIME_TYPES = new Map([
+    ['89504e470d0a1a0a', 'image/png'],
+    ['ffd8ff', 'image/jpeg'],
+    ['47494638', 'image/gif'],
+    ['424d', 'image/bmp'],
+]);
+export function normalizeImage(bytes, declaredMimeType, maxBytes = DEFAULT_MAX_IMAGE_BYTES) {
+    if (bytes.byteLength === 0 || bytes.byteLength > maxBytes) {
+        throw new CliError(CLI_ERROR_CODES.ATTACHMENT_TOO_LARGE, 'Image size is outside the allowed range.', {
+            category: 'attachment', userMessage: `Image size must be between 1 byte and ${maxBytes} bytes.`,
+        });
+    }
+    const detected = detectMimeType(bytes);
+    const mimeType = detected ?? declaredMimeType;
+    if (mimeType === undefined || !mimeType.startsWith('image/')) {
+        throw new CliError(CLI_ERROR_CODES.ATTACHMENT_FORMAT_UNSUPPORTED, 'Clipboard content is not a supported image.', {
+            category: 'attachment', userMessage: 'The clipboard does not contain a supported image format.',
+        });
+    }
+    if (detected !== undefined && declaredMimeType !== undefined && declaredMimeType !== detected) {
+        throw new CliError(CLI_ERROR_CODES.ATTACHMENT_INVALID_IMAGE, 'Declared image type does not match its bytes.', {
+            category: 'attachment', userMessage: 'The image format does not match its actual content.',
+        });
+    }
+    return { bytes: Buffer.from(bytes), mimeType };
+}
+export function createImageAttachment(image, source, id, storagePath) {
+    const name = id.trim();
+    if (name.length === 0)
+        throw new CliError(CLI_ERROR_CODES.ATTACHMENT_INVALID_IMAGE, 'Attachment id is required.', { category: 'attachment' });
+    return {
+        id: name,
+        name,
+        mimeType: image.mimeType,
+        sizeBytes: image.bytes.byteLength,
+        source,
+        ...(storagePath === undefined ? {} : { storagePath }),
+    };
+}
+export function toImageContentPart(payload) {
+    const base64 = Buffer.from(payload.bytes).toString('base64');
+    return { type: 'image_url', image_url: { url: `data:${payload.attachment.mimeType};base64,${base64}`, detail: 'auto' } };
+}
+export function toAttachmentContentPart(payload) {
+    if (payload.attachment.mimeType.startsWith('image/'))
+        return toImageContentPart(payload);
+    const base64 = Buffer.from(payload.bytes).toString('base64');
+    return {
+        type: 'input_file',
+        file_data: `data:${payload.attachment.mimeType};base64,${base64}`,
+        filename: payload.attachment.name,
+        media_type: payload.attachment.mimeType,
+    };
+}
+export function buildUserMessage(prompt, attachments = []) {
+    if (attachments.length === 0)
+        return { role: 'user', content: prompt };
+    return {
+        role: 'user',
+        content: [
+            { type: 'text', text: prompt },
+            ...attachments.map(toAttachmentContentPart),
+        ],
+    };
+}
+function detectMimeType(bytes) {
+    const hex = [...bytes.slice(0, 8)].map((byte) => byte.toString(16).padStart(2, '0')).join('');
+    for (const [signature, mimeType] of IMAGE_MIME_TYPES)
+        if (hex.startsWith(signature))
+            return mimeType;
+    if (bytes.length >= 12 && Buffer.from(bytes.slice(0, 12)).toString('ascii', 0, 4) === 'RIFF' && Buffer.from(bytes.slice(8, 12)).toString('ascii') === 'WEBP')
+        return 'image/webp';
+    return undefined;
+}

package/dist/infrastructure/clipboard/windows-clipboard-adapter.d.ts

@@ -0,0 +1,7 @@
+import type { ClipboardAdapter, ClipboardImage } from '../../ports/clipboard-adapter.js';
+import { type HostPlatformContext } from '../platform/host-platform.js';
+export declare class WindowsClipboardAdapter implements ClipboardAdapter {
+    private readonly platform;
+    constructor(platform?: HostPlatformContext);
+    readImage(): Promise<ClipboardImage | undefined>;
+}

package/dist/infrastructure/clipboard/windows-clipboard-adapter.js

@@ -0,0 +1,66 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { CliError } from '../../domain/errors/cli-error.js';
+import { CLI_ERROR_CODES } from '../../domain/errors/error-codes.js';
+import { DEFAULT_MAX_IMAGE_BYTES } from './image-normalizer.js';
+import { readFileBounded } from '../filesystem/bounded-file-reader.js';
+import { detectHostPlatform } from '../platform/host-platform.js';
+import { spawnPlatformProcess } from '../platform/host-process.js';
+import { CLIPBOARD_POLICY, clipboardUnavailableError } from './clipboard-policy.js';
+export class WindowsClipboardAdapter {
+    platform;
+    constructor(platform = detectHostPlatform()) {
+        this.platform = platform;
+    }
+    async readImage() {
+        if (!this.platform.isWindows) {
+            throw clipboardUnavailableError('Windows clipboard image adapter cannot run on this platform.');
+        }
+        const outputPath = path.join(os.tmpdir(), `lotagate-clipboard-${process.pid}-${crypto.randomUUID()}.png`);
+        try {
+            await runPowerShell(outputPath, this.platform);
+            const image = await readFileBounded(outputPath, DEFAULT_MAX_IMAGE_BYTES);
+            if (image.truncated) {
+                throw new CliError(CLI_ERROR_CODES.ATTACHMENT_TOO_LARGE, 'Clipboard image exceeds the configured size limit.', {
+                    category: 'attachment', userMessage: 'The clipboard image is too large to attach.',
+                });
+            }
+            return { bytes: image.bytes, mimeType: 'image/png' };
+        }
+        catch (error) {
+            if (error instanceof CliError)
+                throw error;
+            throw clipboardUnavailableError('Unable to read an image from the clipboard.', error);
+        }
+        finally {
+            await fs.rm(outputPath, { force: true });
+        }
+    }
+}
+function runPowerShell(outputPath, platform) {
+    const script = "$ErrorActionPreference='Stop'; $image=Get-Clipboard -Format Image; if ($null -eq $image) { exit 3 }; $image.Save($env:LOTAGATE_CLIPBOARD_OUTPUT, [System.Drawing.Imaging.ImageFormat]::Png)";
+    return new Promise((resolve, reject) => {
+        const child = spawnPlatformProcess('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], platform, {
+            env: { ...process.env, LOTAGATE_CLIPBOARD_OUTPUT: outputPath },
+            stdio: ['ignore', 'ignore', 'pipe'],
+        });
+        const stderr = [];
+        let settled = false;
+        const finish = (callback) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            callback();
+        };
+        const timer = setTimeout(() => {
+            child.kill();
+            finish(() => reject(clipboardUnavailableError(`Clipboard image read timed out after ${CLIPBOARD_POLICY.timeoutMs}ms.`)));
+        }, CLIPBOARD_POLICY.timeoutMs);
+        child.stderr?.on('data', (chunk) => stderr.push(chunk));
+        child.once('error', (error) => finish(() => reject(error)));
+        child.once('close', (code) => finish(() => code === 0 ? resolve() : reject(new Error(Buffer.concat(stderr).toString('utf8').trim() || `PowerShell exited with code ${String(code)}.`))));
+    });
+}

package/dist/infrastructure/clipboard/windows-clipboard-text-adapter.d.ts

@@ -0,0 +1,7 @@
+import type { ClipboardTextAdapter } from '../../ports/clipboard-text-adapter.js';
+import { type HostPlatformContext } from '../platform/host-platform.js';
+export declare class WindowsClipboardTextAdapter implements ClipboardTextAdapter {
+    private readonly platform;
+    constructor(platform?: HostPlatformContext);
+    readText(): Promise<string | undefined>;
+}

package/dist/infrastructure/clipboard/windows-clipboard-text-adapter.js

@@ -0,0 +1,70 @@
+import { CliError } from '../../domain/errors/cli-error.js';
+import { CLI_ERROR_CODES } from '../../domain/errors/error-codes.js';
+import { detectHostPlatform } from '../platform/host-platform.js';
+import { spawnPlatformProcess } from '../platform/host-process.js';
+import { CLIPBOARD_POLICY, clipboardUnavailableError } from './clipboard-policy.js';
+export class WindowsClipboardTextAdapter {
+    platform;
+    constructor(platform = detectHostPlatform()) {
+        this.platform = platform;
+    }
+    async readText() {
+        if (!this.platform.isWindows) {
+            throw clipboardUnavailableError('Windows clipboard text adapter cannot run on this platform.');
+        }
+        try {
+            return await runPowerShellText(this.platform);
+        }
+        catch (error) {
+            if (error instanceof CliError)
+                throw error;
+            throw clipboardUnavailableError('Unable to read text from the clipboard.', error);
+        }
+    }
+}
+function runPowerShellText(platform) {
+    const script = "$ErrorActionPreference='Stop'; [Console]::OutputEncoding = [System.Text.Encoding]::UTF8; $text=Get-Clipboard -Raw; if ($null -eq $text) { exit 3 }; [Console]::Out.Write($text)";
+    return new Promise((resolve, reject) => {
+        const child = spawnPlatformProcess('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], platform, {
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        const chunks = [];
+        let size = 0;
+        let settled = false;
+        const finish = (callback) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            callback();
+        };
+        const timer = setTimeout(() => {
+            child.kill();
+            finish(() => reject(clipboardUnavailableError(`Clipboard text read timed out after ${CLIPBOARD_POLICY.timeoutMs}ms.`)));
+        }, CLIPBOARD_POLICY.timeoutMs);
+        child.stdout?.on('data', (chunk) => {
+            if (settled)
+                return;
+            size += chunk.byteLength;
+            if (size > CLIPBOARD_POLICY.maxTextBytes) {
+                child.kill();
+                finish(() => reject(new CliError(CLI_ERROR_CODES.ATTACHMENT_TOO_LARGE, 'Clipboard text is too large.', {
+                    category: 'attachment', userMessage: 'Clipboard text exceeds the maximum allowed size.',
+                })));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        const stderr = [];
+        child.stderr?.on('data', (chunk) => stderr.push(chunk));
+        child.once('error', (error) => finish(() => reject(error)));
+        child.once('close', (code) => finish(() => {
+            if (code === 3)
+                resolve(undefined);
+            else if (code !== 0)
+                reject(new Error(Buffer.concat(stderr).toString('utf8').trim() || `PowerShell exited with code ${String(code)}.`));
+            else
+                resolve(Buffer.concat(chunks).toString('utf8'));
+        }));
+    });
+}

package/dist/infrastructure/config/config-loader.d.ts

@@ -0,0 +1,19 @@
+import { type CliConfig, type ConfigurableKey } from '../../domain/config/config-schema.js';
+import type { Logger } from '../../ports/logger.js';
+import { type PlatformPaths } from '../platform/platform-paths.js';
+export interface ConfigLoadResult {
+    config: CliConfig;
+    sources: readonly string[];
+}
+export declare class ConfigLoader {
+    private readonly logger;
+    private readonly paths;
+    constructor(logger: Logger, paths?: PlatformPaths);
+    get platformPaths(): PlatformPaths;
+    load(cwd: string, options?: {
+        includeProject?: boolean;
+    }): Promise<ConfigLoadResult>;
+    setGlobal(key: ConfigurableKey, value: unknown): Promise<void>;
+    private readOptional;
+    private readDocumentOptional;
+}

package/dist/infrastructure/config/config-loader.js

@@ -0,0 +1,76 @@
+import { CliError } from '../../domain/errors/cli-error.js';
+import { CLI_ERROR_CODES } from '../../domain/errors/error-codes.js';
+import { DEFAULT_CONFIG, mergeConfig } from '../../domain/config/config-schema.js';
+import { resolvePlatformPaths, resolveProjectConfigPaths } from '../platform/platform-paths.js';
+import { atomicWriteFile, withFileLock } from '../filesystem/atomic-file-store.js';
+import { isFileNotFound } from '../filesystem/fs-errors.js';
+import { readJsonFileBounded } from '../filesystem/bounded-json-reader.js';
+import { RESOURCE_LIMITS } from '../../domain/runtime/resource-limits.js';
+import { validateSettingsDocument } from '../../domain/settings/settings-document.js';
+export class ConfigLoader {
+    logger;
+    paths;
+    constructor(logger, paths = resolvePlatformPaths()) {
+        this.logger = logger;
+        this.paths = paths;
+    }
+    get platformPaths() {
+        return this.paths;
+    }
+    async load(cwd, options = {}) {
+        const layers = [];
+        const sources = [];
+        const candidates = options.includeProject === false
+            ? [this.paths.globalConfigFile]
+            : [this.paths.globalConfigFile, resolveProjectConfigPaths(cwd).settings, resolveProjectConfigPaths(cwd).localSettings];
+        for (const file of candidates) {
+            const layer = await this.readOptional(file);
+            if (layer !== undefined) {
+                layers.push(layer);
+                sources.push(file);
+            }
+        }
+        return { config: mergeConfig(DEFAULT_CONFIG, ...layers), sources };
+    }
+    async setGlobal(key, value) {
+        await withFileLock(this.paths.globalConfigFile, async () => {
+            const existing = await this.readDocumentOptional(this.paths.globalConfigFile);
+            const candidate = {
+                ...(existing?.config ?? {}),
+                ...(existing?.permissions === undefined ? {} : { permissions: existing.permissions }),
+                [key]: value,
+                schemaVersion: 1,
+            };
+            validateSettingsDocument(candidate);
+            await atomicWriteFile(this.paths.globalConfigFile, `${JSON.stringify(candidate, null, 2)}\n`);
+        });
+        this.logger.info('Global configuration updated.', { key });
+    }
+    async readOptional(file) {
+        const document = await this.readDocumentOptional(file);
+        return document?.config;
+    }
+    async readDocumentOptional(file) {
+        try {
+            try {
+                return validateSettingsDocument(await readJsonFileBounded(file, RESOURCE_LIMITS.configFileBytes));
+            }
+            catch (error) {
+                if (isFileNotFound(error))
+                    return undefined;
+                if (error instanceof CliError)
+                    throw error;
+                throw new CliError(CLI_ERROR_CODES.CONFIG_INVALID_JSON, `Invalid JSON in ${file}.`, {
+                    category: 'config', userMessage: `Unable to parse JSON in ${file}.`, cause: error,
+                });
+            }
+        }
+        catch (error) {
+            if (error instanceof CliError)
+                throw error;
+            throw new CliError(CLI_ERROR_CODES.CONFIG_NOT_FOUND, `Unable to read config ${file}.`, {
+                category: 'config', userMessage: `Unable to read configuration file ${file}.`, cause: error,
+            });
+        }
+    }
+}

package/dist/infrastructure/config/environment-values.d.ts

@@ -0,0 +1,2 @@
+/** Reads an integer environment value without allowing invalid settings to disable a safe default. */
+export declare function readBoundedEnvironmentInteger(value: string | undefined, fallback: number, minimum: number, maximum: number): number;

package/dist/infrastructure/config/environment-values.js

@@ -0,0 +1,7 @@
+/** Reads an integer environment value without allowing invalid settings to disable a safe default. */
+export function readBoundedEnvironmentInteger(value, fallback, minimum, maximum) {
+    if (value === undefined)
+        return fallback;
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) && parsed >= minimum && parsed <= maximum ? parsed : fallback;
+}

package/dist/infrastructure/credentials/composite-credential-store.d.ts

@@ -0,0 +1,11 @@
+import type { AuthProfile, StoredCredential } from '../../domain/auth/auth-profile.js';
+import type { CredentialStore } from '../../ports/credential-store.js';
+export declare class CompositeCredentialStore implements CredentialStore {
+    private readonly stores;
+    private readonly writableStore;
+    constructor(stores: readonly CredentialStore[], writableStore: CredentialStore);
+    list(): Promise<readonly AuthProfile[]>;
+    get(profileName: string): Promise<StoredCredential | undefined>;
+    set(credential: StoredCredential): Promise<void>;
+    delete(profileName: string): Promise<boolean>;
+}

package/dist/infrastructure/credentials/composite-credential-store.js

@@ -0,0 +1,32 @@
+export class CompositeCredentialStore {
+    stores;
+    writableStore;
+    constructor(stores, writableStore) {
+        this.stores = stores;
+        this.writableStore = writableStore;
+    }
+    async list() {
+        const profiles = new Map();
+        for (const store of this.stores)
+            for (const profile of await store.list())
+                profiles.set(profile.name, profile);
+        return [...profiles.values()].sort((left, right) => left.name.localeCompare(right.name));
+    }
+    async get(profileName) {
+        for (const store of this.stores) {
+            const credential = await store.get(profileName);
+            if (credential !== undefined)
+                return credential;
+        }
+        return undefined;
+    }
+    async set(credential) {
+        await this.writableStore.set(credential);
+    }
+    async delete(profileName) {
+        let deleted = false;
+        for (const store of this.stores)
+            deleted = (await store.delete(profileName)) || deleted;
+        return deleted;
+    }
+}

package/dist/infrastructure/credentials/encrypted-file-credential-store.d.ts

@@ -0,0 +1,17 @@
+import { type AuthProfile, type StoredCredential } from '../../domain/auth/auth-profile.js';
+import type { CredentialStore } from '../../ports/credential-store.js';
+import type { PlatformPaths } from '../platform/platform-paths.js';
+export declare class EncryptedFileCredentialStore implements CredentialStore {
+    private readonly paths;
+    private readonly secret;
+    constructor(paths: PlatformPaths, secret?: string | undefined);
+    list(): Promise<readonly AuthProfile[]>;
+    get(profileName: string): Promise<StoredCredential | undefined>;
+    set(credential: StoredCredential): Promise<void>;
+    delete(profileName: string): Promise<boolean>;
+    private readPayload;
+    private writePayload;
+    private readFile;
+    private deriveKey;
+    private resolveSecret;
+}