@lyse-labs/lyse 0.1.0-alpha.2

package/dist/commands/share.js

@@ -0,0 +1,60 @@
+import { copyToClipboard, formatShareMarkdown } from "../share/clipboard.js";
+import { detectFromGit } from "../detection/from-git.js";
+import { auditDirectory } from "./audit-pipeline.js";
+import { ruleMap } from "../rules/registry.js";
+import { createSpinner } from "../util/spinner.js";
+export async function runShare(cwd, opts = {}) {
+    const isTTY = process.stderr.isTTY ?? false;
+    const isQuiet = opts.quiet === true || process.env["LYSE_QUIET"] === "1";
+    const spinner = createSpinner({ isTTY, enabled: isTTY && !isQuiet });
+    spinner.start("Discovering files…");
+    let audit;
+    try {
+        audit = await auditDirectory(cwd, { progress: spinner });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message.split("\n")[0] : String(err);
+        spinner.fail(`Share failed: ${msg}`);
+        throw err;
+    }
+    spinner.update("Copying summary to clipboard…");
+    const git = await detectFromGit(cwd);
+    const repo = git.github.value ? `${git.github.value.owner}/${git.github.value.repo}` : null;
+    const counts = new Map();
+    for (const f of audit.result.findings) {
+        const rule = ruleMap.get(f.ruleId);
+        const isFixable = !!rule?.applyCodemod;
+        const existing = counts.get(f.ruleId) ?? { count: 0, fixable: isFixable };
+        existing.count++;
+        counts.set(f.ruleId, existing);
+    }
+    const topRules = Array.from(counts.entries())
+        .map(([ruleId, v]) => ({ ruleId, ...v }))
+        .sort((a, b) => b.count - a.count);
+    const axes = {
+        tokens: null,
+        a11y: null,
+        components: null,
+        stories: null,
+    };
+    for (const axisScore of audit.result.axes) {
+        if (axisScore.axis === "tokens" && typeof axisScore.score === "number")
+            axes.tokens = axisScore.score;
+        else if (axisScore.axis === "a11y" && typeof axisScore.score === "number")
+            axes.a11y = axisScore.score;
+        else if (axisScore.axis === "components" && typeof axisScore.score === "number")
+            axes.components = axisScore.score;
+        else if (axisScore.axis === "stories" && typeof axisScore.score === "number")
+            axes.stories = axisScore.score;
+    }
+    const md = formatShareMarkdown(audit.result.finalScore, axes, topRules, repo);
+    try {
+        await copyToClipboard(md);
+        spinner.succeed(`Summary copied · score ${audit.result.finalScore}/100 · paste into Slack / Notion / email`);
+    }
+    catch {
+        spinner.fail("Clipboard unavailable — printing summary below");
+        console.log(md);
+    }
+}
+//# sourceMappingURL=share.js.map

package/dist/commands/share.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.js","sourceRoot":"","sources":["../../src/commands/share.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAMnD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,OAAqB,EAAE;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC;IACzE,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAErE,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;QACrC,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;IAEhD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAE5F,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+C,CAAC;IACtE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC1E,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAErC,MAAM,IAAI,GAAsG;QAC9G,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,IAAI;KACd,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC;aACjG,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC;aAClG,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC;aAC9G,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC;IAC/G,CAAC;IAED,MAAM,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAE9E,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC;QAC1B,OAAO,CAAC,OAAO,CAAC,0BAA0B,KAAK,CAAC,MAAM,CAAC,UAAU,0CAA0C,CAAC,CAAC;IAC/G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/telemetry.d.ts

@@ -0,0 +1,4 @@
+import { type ConsentDeps } from "../telemetry/consent.js";
+export declare function runTelemetryOn(deps?: ConsentDeps): void;
+export declare function runTelemetryOff(deps?: ConsentDeps): void;
+export declare function runTelemetryStatus(deps?: ConsentDeps): void;

package/dist/commands/telemetry.js

@@ -0,0 +1,27 @@
+import { readConsent, writeConsent, resetConsentCache } from "../telemetry/consent.js";
+function writeFinal(accepted, deps = {}) {
+    writeConsent({
+        accepted,
+        attempt: 2,
+        decided_at: new Date().toISOString(),
+        version: "1.0.0",
+    }, deps);
+    resetConsentCache();
+}
+export function runTelemetryOn(deps = {}) {
+    writeFinal(true, deps);
+    console.log("Telemetry enabled. Anonymous bench events will be sent on future audits.");
+}
+export function runTelemetryOff(deps = {}) {
+    writeFinal(false, deps);
+    console.log("Telemetry disabled. No data will be sent.");
+}
+export function runTelemetryStatus(deps = {}) {
+    const c = readConsent(deps);
+    if (!c) {
+        console.log("Telemetry status: not yet decided. You will be asked on your next `lyse audit`.");
+        return;
+    }
+    console.log(`Telemetry status: ${c.accepted ? "enabled" : "disabled"} (decided ${c.decided_at}).`);
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/commands/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../src/commands/telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAoB,MAAM,yBAAyB,CAAC;AAEzG,SAAS,UAAU,CAAC,QAAiB,EAAE,OAAoB,EAAE;IAC3D,YAAY,CAAC;QACX,QAAQ;QACR,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,OAAO,EAAE,OAAO;KACjB,EAAE,IAAI,CAAC,CAAC;IACT,iBAAiB,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAoB,EAAE;IACnD,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAoB,EAAE;IACpD,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAoB,EAAE;IACvD,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;QAC/F,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,aAAa,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;AACrG,CAAC"}

package/dist/commands/templates/lyse-workflow.yml.template

@@ -0,0 +1,30 @@
+name: Lyse audit
+on:
+  pull_request:
+  push:
+    branches: [{{ default_branch }}]
+permissions:
+  contents: read
+  security-events: write
+  pull-requests: write
+  issues: write
+  id-token: write
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - uses: lyse-labs/lyse-action@<pinned-sha>
+        id: audit
+        with:
+          fail-on-threshold: {{ threshold }}
+          post-pr-comment: {{ post_pr_comment }}
+          upload-sarif: {{ upload_sarif }}
+          publish-bench: {{ publish_bench }}
+      - uses: github/codeql-action/upload-sarif@v3
+        if: always() && {{ upload_sarif }}
+        with:
+          sarif_file: lyse-report/lyse.sarif

package/dist/config/schema.d.ts

@@ -0,0 +1,158 @@
+/**
+ * Zod schema for .lyse.yaml — addresses T2 security gap:
+ * both loadConfig sites previously cast YAML via `as` without validation.
+ *
+ * Structurally compatible with LyseConfig in ../types.ts.
+ * The schema intentionally does NOT use .strict() so future fields in
+ * .lyse.yaml don't cause hard failures — unknown keys are stripped silently.
+ */
+import { z } from "zod";
+import type { LyseConfig } from "../types.js";
+export type { LyseConfig } from "../types.js";
+export declare const LyseConfigSchema: z.ZodObject<{
+    designSystem: z.ZodEffects<z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        componentsModule: z.ZodOptional<z.ZodString>;
+        elements: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        excludePaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        componentsModule?: string | undefined;
+        elements?: Record<string, string> | undefined;
+        excludePaths?: string[] | undefined;
+    }, {
+        componentsModule?: string | undefined;
+        elements?: Record<string, string> | undefined;
+        excludePaths?: string[] | undefined;
+    }>>>, {
+        componentsModule?: string | undefined;
+        elements?: Record<string, string> | undefined;
+        excludePaths?: string[] | undefined;
+    } | undefined, {
+        componentsModule?: string | undefined;
+        elements?: Record<string, string> | undefined;
+        excludePaths?: string[] | undefined;
+    } | null | undefined>;
+    rules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodLiteral<"off">, z.ZodObject<{
+        severity: z.ZodOptional<z.ZodEnum<["error", "warning", "info", "off"]>>;
+        tolerance: z.ZodOptional<z.ZodNumber>;
+        disable: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        severity?: "error" | "warning" | "info" | "off" | undefined;
+        tolerance?: number | undefined;
+        disable?: string[] | undefined;
+    }, {
+        severity?: "error" | "warning" | "info" | "off" | undefined;
+        tolerance?: number | undefined;
+        disable?: string[] | undefined;
+    }>]>>>;
+    llm: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodOptional<z.ZodEnum<["anthropic", "openai", "openai-compatible", "mcp", "none", "auto"]>>;
+        model: z.ZodOptional<z.ZodString>;
+        endpoint: z.ZodOptional<z.ZodString>;
+        connector: z.ZodOptional<z.ZodEnum<["auto", "mcp-host", "openrouter", "direct-api-key", "ollama"]>>;
+        costCapUsd: z.ZodOptional<z.ZodNumber>;
+        cacheMaxAgeDays: z.ZodOptional<z.ZodNumber>;
+        staticOnly: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        staticOnly?: boolean | undefined;
+        provider?: "anthropic" | "openai" | "openai-compatible" | "mcp" | "none" | "auto" | undefined;
+        model?: string | undefined;
+        endpoint?: string | undefined;
+        connector?: "auto" | "mcp-host" | "openrouter" | "direct-api-key" | "ollama" | undefined;
+        costCapUsd?: number | undefined;
+        cacheMaxAgeDays?: number | undefined;
+    }, {
+        staticOnly?: boolean | undefined;
+        provider?: "anthropic" | "openai" | "openai-compatible" | "mcp" | "none" | "auto" | undefined;
+        model?: string | undefined;
+        endpoint?: string | undefined;
+        connector?: "auto" | "mcp-host" | "openrouter" | "direct-api-key" | "ollama" | undefined;
+        costCapUsd?: number | undefined;
+        cacheMaxAgeDays?: number | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    rules?: Record<string, "off" | {
+        severity?: "error" | "warning" | "info" | "off" | undefined;
+        tolerance?: number | undefined;
+        disable?: string[] | undefined;
+    }> | undefined;
+    designSystem?: {
+        componentsModule?: string | undefined;
+        elements?: Record<string, string> | undefined;
+        excludePaths?: string[] | undefined;
+    } | undefined;
+    llm?: {
+        staticOnly?: boolean | undefined;
+        provider?: "anthropic" | "openai" | "openai-compatible" | "mcp" | "none" | "auto" | undefined;
+        model?: string | undefined;
+        endpoint?: string | undefined;
+        connector?: "auto" | "mcp-host" | "openrouter" | "direct-api-key" | "ollama" | undefined;
+        costCapUsd?: number | undefined;
+        cacheMaxAgeDays?: number | undefined;
+    } | undefined;
+}, {
+    rules?: Record<string, "off" | {
+        severity?: "error" | "warning" | "info" | "off" | undefined;
+        tolerance?: number | undefined;
+        disable?: string[] | undefined;
+    }> | undefined;
+    designSystem?: {
+        componentsModule?: string | undefined;
+        elements?: Record<string, string> | undefined;
+        excludePaths?: string[] | undefined;
+    } | null | undefined;
+    llm?: {
+        staticOnly?: boolean | undefined;
+        provider?: "anthropic" | "openai" | "openai-compatible" | "mcp" | "none" | "auto" | undefined;
+        model?: string | undefined;
+        endpoint?: string | undefined;
+        connector?: "auto" | "mcp-host" | "openrouter" | "direct-api-key" | "ollama" | undefined;
+        costCapUsd?: number | undefined;
+        cacheMaxAgeDays?: number | undefined;
+    } | undefined;
+}>;
+export type LyseConfigValidated = z.infer<typeof LyseConfigSchema>;
+/**
+ * Parse and validate raw YAML output as a LyseConfig.
+ * Throws a ZodError with human-readable messages on invalid input.
+ */
+export declare function parseLyseConfig(raw: unknown): LyseConfigValidated;
+/**
+ * Validate raw YAML output as a LyseConfig without throwing.
+ * Returns { ok: true, value } on success or { ok: false, error } with a
+ * semicolon-separated list of validation issues on failure.
+ */
+export declare function safeParseLyseConfig(raw: unknown): {
+    ok: true;
+    value: LyseConfigValidated;
+} | {
+    ok: false;
+    error: string;
+};
+export interface LoadConfigOptions {
+    /**
+     * Error handling strategy:
+     * - "throw" (default): throw on invalid YAML or Zod validation failure.
+     * - "degrade": log to stderr and return empty config on any error.
+     */
+    onError?: "throw" | "degrade";
+}
+/**
+ * Load and validate .lyse.yaml for a given repository root.
+ *
+ * Respects the LYSE_CONFIG_PATH env var (set by --config flag) to override
+ * the default `.lyse.yaml` discovery path.
+ *
+ * @param repoRoot - Absolute path to the repository root.
+ * @param opts     - Options. Default: { onError: "throw" }.
+ */
+export declare function loadConfig(repoRoot: string, opts?: LoadConfigOptions): LyseConfig;
+/**
+ * Resolve where the .lyse.yaml WOULD be loaded from for this repo root, if at all.
+ * Returns the absolute path when a config file is discoverable, or `null` when
+ * no config file is present. Does NOT parse or validate the contents.
+ *
+ * Mirrors the discovery logic of `loadConfig` (LYSE_CONFIG_PATH > .lyse.yaml at root)
+ * so the value reported in `AuditResult.meta.coverage.configPath` matches the file
+ * `loadConfig` would actually read.
+ */
+export declare function resolveConfigPath(repoRoot: string): string | null;

package/dist/config/schema.js

@@ -0,0 +1,136 @@
+/**
+ * Zod schema for .lyse.yaml — addresses T2 security gap:
+ * both loadConfig sites previously cast YAML via `as` without validation.
+ *
+ * Structurally compatible with LyseConfig in ../types.ts.
+ * The schema intentionally does NOT use .strict() so future fields in
+ * .lyse.yaml don't cause hard failures — unknown keys are stripped silently.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { z } from "zod";
+export const LyseConfigSchema = z.object({
+    designSystem: z
+        .object({
+        componentsModule: z.string().optional(),
+        elements: z.record(z.string(), z.string()).optional(),
+        excludePaths: z.array(z.string()).optional(),
+    })
+        // YAML `designSystem:` with no value parses as null — treat as "not set".
+        .nullish()
+        .transform((v) => v ?? undefined),
+    rules: z
+        .record(z.string(), z.union([
+        z.literal("off"),
+        z.object({
+            severity: z.enum(["error", "warning", "info", "off"]).optional(),
+            tolerance: z.number().optional(),
+            disable: z.array(z.string()).optional(),
+        }),
+    ]))
+        .optional(),
+    llm: z
+        .object({
+        provider: z
+            .enum(["anthropic", "openai", "openai-compatible", "mcp", "none", "auto"])
+            .optional(),
+        model: z.string().optional(),
+        endpoint: z.string().optional(),
+        // ADR-0015: ConnectorResolver fields (Task 2)
+        connector: z
+            .enum(["auto", "mcp-host", "openrouter", "direct-api-key", "ollama"])
+            .optional(),
+        costCapUsd: z.number().positive().optional(),
+        cacheMaxAgeDays: z.number().positive().optional(),
+        staticOnly: z.boolean().optional(),
+    })
+        .optional(),
+});
+/**
+ * Parse and validate raw YAML output as a LyseConfig.
+ * Throws a ZodError with human-readable messages on invalid input.
+ */
+export function parseLyseConfig(raw) {
+    return LyseConfigSchema.parse(raw);
+}
+/**
+ * Validate raw YAML output as a LyseConfig without throwing.
+ * Returns { ok: true, value } on success or { ok: false, error } with a
+ * semicolon-separated list of validation issues on failure.
+ */
+export function safeParseLyseConfig(raw) {
+    const result = LyseConfigSchema.safeParse(raw);
+    if (result.success)
+        return { ok: true, value: result.data };
+    return {
+        ok: false,
+        error: result.error.issues
+            .map((i) => `${i.path.join(".") || "<root>"}: ${i.message}`)
+            .join("; "),
+    };
+}
+/**
+ * Load and validate .lyse.yaml for a given repository root.
+ *
+ * Respects the LYSE_CONFIG_PATH env var (set by --config flag) to override
+ * the default `.lyse.yaml` discovery path.
+ *
+ * @param repoRoot - Absolute path to the repository root.
+ * @param opts     - Options. Default: { onError: "throw" }.
+ */
+export function loadConfig(repoRoot, opts) {
+    const onError = opts?.onError ?? "throw";
+    // LYSE_CONFIG_PATH (set by --config flag) overrides .lyse.yaml discovery.
+    const configPath = process.env.LYSE_CONFIG_PATH ?? join(repoRoot, ".lyse.yaml");
+    try {
+        const raw = parseYaml(readFileSync(configPath, "utf8"));
+        const parsed = safeParseLyseConfig(raw);
+        if (!parsed.ok) {
+            const msg = `[lyse] Warning: Invalid .lyse.yaml: ${parsed.error}\n`;
+            if (onError === "degrade") {
+                process.stderr.write(msg);
+                return {};
+            }
+            // Hard-fail: invalid .lyse.yaml should never produce a misleading audit.
+            throw new Error(`Invalid .lyse.yaml: ${parsed.error}`);
+        }
+        const value = parsed.value;
+        // Migration: llm.provider: 'none' was removed in v0.1.
+        // Treat it as llm.staticOnly: true and warn the user.
+        if (value.llm?.provider === "none") {
+            process.stderr.write("[Lyse] DEPRECATION: llm.provider: 'none' is removed in v0.1. " +
+                "Treating as llm.staticOnly: true. Please update .lyse.yaml.\n");
+            const llmFixed = { ...value.llm, staticOnly: true };
+            delete llmFixed.provider;
+            value.llm = llmFixed;
+        }
+        return value;
+    }
+    catch (err) {
+        // Re-throw validation errors in throw mode
+        if (err instanceof Error && err.message.startsWith("Invalid .lyse.yaml")) {
+            if (onError === "degrade") {
+                process.stderr.write(`[lyse] Warning: ${err.message}\n`);
+                return {};
+            }
+            throw err;
+        }
+        // File missing / unreadable → safe default (no config) in both modes.
+        return {};
+    }
+}
+/**
+ * Resolve where the .lyse.yaml WOULD be loaded from for this repo root, if at all.
+ * Returns the absolute path when a config file is discoverable, or `null` when
+ * no config file is present. Does NOT parse or validate the contents.
+ *
+ * Mirrors the discovery logic of `loadConfig` (LYSE_CONFIG_PATH > .lyse.yaml at root)
+ * so the value reported in `AuditResult.meta.coverage.configPath` matches the file
+ * `loadConfig` would actually read.
+ */
+export function resolveConfigPath(repoRoot) {
+    const candidate = process.env.LYSE_CONFIG_PATH ?? join(repoRoot, ".lyse.yaml");
+    return existsSync(candidate) ? candidate : null;
+}
+//# sourceMappingURL=schema.js.map

package/dist/config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACrD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC7C,CAAC;QACF,0EAA0E;SACzE,OAAO,EAAE;SACT,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC;IACnC,KAAK,EAAE,CAAC;SACL,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,KAAK,CAAC;QACN,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAChB,CAAC,CAAC,MAAM,CAAC;YACP,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;YAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SACxC,CAAC;KACH,CAAC,CACH;SACA,QAAQ,EAAE;IACb,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC;aACR,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;aACzE,QAAQ,EAAE;QACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,8CAA8C;QAC9C,SAAS,EAAE,CAAC;aACT,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;aACpE,QAAQ,EAAE;QACb,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC5C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACjD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,OAAO,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAY;IAEZ,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC;KACd,CAAC;AACJ,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,IAAwB;IACnE,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,OAAO,CAAC;IACzC,0EAA0E;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAChF,IAAI,CAAC;QACH,MAAM,GAAG,GAAY,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,uCAAuC,MAAM,CAAC,KAAK,IAAI,CAAC;YACpE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,yEAAyE;YACzE,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAmB,CAAC;QACzC,uDAAuD;QACvD,sDAAsD;QACtD,IAAK,KAAK,CAAC,GAA2C,EAAE,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC5E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+DAA+D;gBAC7D,+DAA+D,CAClE,CAAC;YACF,MAAM,QAAQ,GAA4B,EAAE,GAAI,KAAK,CAAC,GAA+B,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC1G,OAAO,QAAQ,CAAC,QAAQ,CAAC;YACxB,KAAiC,CAAC,GAAG,GAAG,QAAQ,CAAC;QACpD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2CAA2C;QAC3C,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACzE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;gBACzD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,sEAAsE;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/E,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC"}

package/dist/credentials/keychain.d.ts

@@ -0,0 +1,20 @@
+import type { CredentialStore } from "./store.js";
+export interface KeytarLike {
+    getPassword(service: string, account: string): Promise<string | null>;
+    setPassword(service: string, account: string, password: string): Promise<void>;
+    deletePassword(service: string, account: string): Promise<boolean>;
+    findCredentials(service: string): Promise<Array<{
+        account: string;
+        password: string;
+    }>>;
+}
+export declare class KeychainCredentialStore implements CredentialStore {
+    private service;
+    private keytar;
+    constructor(service: string, keytar: KeytarLike);
+    static create(service: string): Promise<KeychainCredentialStore | null>;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    listKeys(): Promise<string[]>;
+}

package/dist/credentials/keychain.js

@@ -0,0 +1,35 @@
+export class KeychainCredentialStore {
+    service;
+    keytar;
+    constructor(service, keytar) {
+        this.service = service;
+        this.keytar = keytar;
+    }
+    static async create(service) {
+        try {
+            const keytar = (await import("keytar"));
+            // Smoke test: try a no-op call to verify the native module loaded properly.
+            await keytar.findCredentials(service);
+            return new KeychainCredentialStore(service, keytar);
+        }
+        catch {
+            // keytar not installed, or native module failed to load (common on Linux without libsecret).
+            // Caller falls back to PlainFileCredentialStore.
+            return null;
+        }
+    }
+    async get(key) {
+        return this.keytar.getPassword(this.service, key);
+    }
+    async set(key, value) {
+        await this.keytar.setPassword(this.service, key, value);
+    }
+    async delete(key) {
+        await this.keytar.deletePassword(this.service, key);
+    }
+    async listKeys() {
+        const creds = await this.keytar.findCredentials(this.service);
+        return creds.map((c) => c.account);
+    }
+}
+//# sourceMappingURL=keychain.js.map

package/dist/credentials/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/credentials/keychain.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,uBAAuB;IACd;IAAyB;IAA7C,YAAoB,OAAe,EAAU,MAAkB;QAA3C,YAAO,GAAP,OAAO,CAAQ;QAAU,WAAM,GAAN,MAAM,CAAY;IAAG,CAAC;IAEnE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAe;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAA0B,CAAC;YACjE,4EAA4E;YAC5E,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,6FAA6F;YAC7F,iDAAiD;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;CACF"}

package/dist/credentials/keychain.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/credentials/keychain.test.js

@@ -0,0 +1,32 @@
+import { describe, it, expect, vi } from "vitest";
+import { KeychainCredentialStore } from "./keychain.js";
+describe("KeychainCredentialStore", () => {
+    it("set + get delegates to keytar", async () => {
+        const fakeKeytar = {
+            getPassword: vi.fn().mockResolvedValueOnce("sk-ant"),
+            setPassword: vi.fn().mockResolvedValue(undefined),
+            deletePassword: vi.fn().mockResolvedValue(true),
+            findCredentials: vi.fn().mockResolvedValue([]),
+        };
+        const s = new KeychainCredentialStore("com.lyse-labs.lyse", fakeKeytar);
+        await s.set("anthropic_api_key", "sk-ant");
+        expect(fakeKeytar.setPassword).toHaveBeenCalledWith("com.lyse-labs.lyse", "anthropic_api_key", "sk-ant");
+        const v = await s.get("anthropic_api_key");
+        expect(v).toBe("sk-ant");
+    });
+    it("listKeys returns account names from findCredentials", async () => {
+        const fakeKeytar = {
+            getPassword: vi.fn(),
+            setPassword: vi.fn(),
+            deletePassword: vi.fn(),
+            findCredentials: vi.fn().mockResolvedValue([
+                { account: "anthropic_api_key", password: "..." },
+                { account: "openai_api_key", password: "..." },
+            ]),
+        };
+        const s = new KeychainCredentialStore("com.lyse-labs.lyse", fakeKeytar);
+        const keys = await s.listKeys();
+        expect(keys.sort()).toEqual(["anthropic_api_key", "openai_api_key"]);
+    });
+});
+//# sourceMappingURL=keychain.test.js.map

package/dist/credentials/keychain.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.test.js","sourceRoot":"","sources":["../../src/credentials/keychain.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAmB,MAAM,eAAe,CAAC;AAEzE,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,UAAU,GAAe;YAC7B,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC;YACpD,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;YACjD,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;YAC/C,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;SAC/C,CAAC;QACF,MAAM,CAAC,GAAG,IAAI,uBAAuB,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,GAAG,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,oBAAoB,CACjD,oBAAoB,EACpB,mBAAmB,EACnB,QAAQ,CACT,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,UAAU,GAAe;YAC7B,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;YACpB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;YACpB,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;YACvB,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;gBACzC,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE;gBACjD,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC/C,CAAC;SACH,CAAC;QACF,MAAM,CAAC,GAAG,IAAI,uBAAuB,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/credentials/paths.d.ts

@@ -0,0 +1 @@
+export declare function defaultCredentialsPath(): string;

package/dist/credentials/paths.js

@@ -0,0 +1,6 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+export function defaultCredentialsPath() {
+    return join(homedir(), ".lyse", "credentials");
+}
+//# sourceMappingURL=paths.js.map

package/dist/credentials/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/credentials/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,sBAAsB;IACpC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC"}

package/dist/credentials/store.d.ts

@@ -0,0 +1,17 @@
+export interface CredentialStore {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    listKeys(): Promise<string[]>;
+}
+export declare class PlainFileCredentialStore implements CredentialStore {
+    private path;
+    constructor(path: string);
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    listKeys(): Promise<string[]>;
+    private read;
+    private write;
+}
+export declare function createCredentialStore(): Promise<CredentialStore>;

package/dist/credentials/store.js

@@ -0,0 +1,60 @@
+import { promises as fs } from "node:fs";
+import { dirname } from "node:path";
+import { defaultCredentialsPath } from "./paths.js";
+import { KeychainCredentialStore } from "./keychain.js";
+export class PlainFileCredentialStore {
+    path;
+    constructor(path) {
+        this.path = path;
+    }
+    async get(key) {
+        const map = await this.read();
+        return map[key] ?? null;
+    }
+    async set(key, value) {
+        const map = await this.read();
+        map[key] = value;
+        await this.write(map);
+    }
+    async delete(key) {
+        const map = await this.read();
+        delete map[key];
+        await this.write(map);
+    }
+    async listKeys() {
+        const map = await this.read();
+        return Object.keys(map);
+    }
+    async read() {
+        try {
+            const raw = await fs.readFile(this.path, "utf8");
+            return JSON.parse(raw);
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return {};
+            throw err;
+        }
+    }
+    async write(map) {
+        if (Object.keys(map).length === 0) {
+            // Remove the file entirely when no keys remain — disconnect should leave no trace.
+            try {
+                await fs.unlink(this.path);
+            }
+            catch (err) {
+                if (err.code !== "ENOENT")
+                    throw err;
+            }
+            return;
+        }
+        await fs.mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
+        await fs.writeFile(this.path, JSON.stringify(map, null, 2), { mode: 0o600 });
+        await fs.chmod(this.path, 0o600);
+    }
+}
+export async function createCredentialStore() {
+    const keychain = await KeychainCredentialStore.create("com.lyse-labs.lyse");
+    return keychain ?? new PlainFileCredentialStore(defaultCredentialsPath());
+}
+//# sourceMappingURL=store.js.map

package/dist/credentials/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/credentials/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AASxD,MAAM,OAAO,wBAAwB;IACf;IAApB,YAAoB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAEpC,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACjB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAChE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAA2B;QAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,mFAAmF;YACnF,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC;YAClE,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC5E,OAAO,QAAQ,IAAI,IAAI,wBAAwB,CAAC,sBAAsB,EAAE,CAAC,CAAC;AAC5E,CAAC"}

package/dist/credentials/store.test.d.ts

@@ -0,0 +1 @@
+export {};