@msn-control/liftoff 0.11.2 → 0.12.0

package/dist/adapters/credentials/github-enrollment.d.ts

@@ -0,0 +1,51 @@
+import type { CommandRunner } from '../../process-runner.js';
+import type { ActivationIdentity, CredentialPolicy } from '../../domain/governance/activation/types.js';
+import { runnerPreflightSecretName } from '../../domain/governance/activation/types.js';
+import type { ProtectedCredentialChannel } from './protected-input.js';
+import { GitHubActivationClient, type GitHubActivationTransport } from '../github/activation-rest.js';
+export type GitHubCredentialConfiguration = {
+    kind: 'github-app';
+    appId: number;
+    installationId: number;
+} | {
+    kind: 'fine-grained-pat';
+    tokenId: number;
+    owner: string;
+    appUnavailableReason: string;
+};
+export declare const credentialApiPermissions: {
+    readonly metadata: 'read';
+    readonly organization_hosted_runners: 'read';
+    readonly organization_network_configurations: 'read';
+};
+export interface GitHubSecretWriter {
+    write(repository: string, name: typeof runnerPreflightSecretName, value: Uint8Array): Promise<void>;
+}
+export declare function githubCliSecretWriter(runner: CommandRunner, cwd: string): GitHubSecretWriter;
+export declare function githubRestSecretWriter(client: GitHubActivationClient, seal: (value: Uint8Array, publicKey: Uint8Array) => Promise<Uint8Array>): GitHubSecretWriter;
+export declare function parseGitHubCredentialConfiguration(value: unknown): GitHubCredentialConfiguration;
+export declare function createAppJwt(key: Uint8Array, appId: number, now: Date): Buffer;
+export interface CredentialEnrollmentResult {
+    policy: CredentialPolicy;
+    usage: {
+        repositoryId: number;
+        repository: string;
+        principal: string;
+        installationId: number | null;
+        probeEndpoints: readonly string[];
+        permissionsDigest: string;
+        secretUpdatedAt: string;
+    };
+}
+export declare function enrollGitHubCredential(input: {
+    repository: string;
+    repositoryId: number;
+    configuration: GitHubCredentialConfiguration;
+    identity: ActivationIdentity;
+    client: GitHubActivationClient;
+    channel: ProtectedCredentialChannel;
+    secretWriter: GitHubSecretWriter;
+    credentialTransport?: (value: Uint8Array) => GitHubActivationTransport;
+    now: Date;
+    assertAuthorized: () => Promise<void>;
+}): Promise<CredentialEnrollmentResult>;

package/dist/adapters/credentials/github-enrollment.js

@@ -0,0 +1,226 @@
+import { createPrivateKey, sign } from 'node:crypto';
+import { runnerPreflightSecretName } from '../../domain/governance/activation/types.js';
+import { canonicalSha256 } from '../../domain/governance/activation/canonical-json.js';
+import { buildFineGrainedPatCredentialPolicy, buildGitHubAppCredentialPolicy, canonicalCredentialRepository } from '../../governance-activation/credentials.js';
+import { GitHubActivationClient, GitHubActivationError, createAuthenticatedGitHubTransport, expectStatus, githubName, githubRepository, object, positiveId, text } from '../github/activation-rest.js';
+export const credentialApiPermissions = {
+    metadata: 'read', organization_hosted_runners: 'read', organization_network_configurations: 'read'
+};
+export function githubCliSecretWriter(runner, cwd) {
+    return {
+        async write(repository, name, value) {
+            githubRepository(repository);
+            if (name !== runnerPreflightSecretName)
+                throw new GitHubActivationError('credential-scope', 'Only the reviewed runner preflight secret may be enrolled.');
+            // gh performs GitHub's public-key sealed-box encryption. Secret bytes are stdin, never argv.
+            const result = await runner.run({
+                executable: 'gh', args: ['secret', 'set', name, '--repo', repository, '--app', 'actions']
+            }, {
+                cwd, stdin: value, redactValues: [Buffer.from(value).toString('utf8')], stream: false,
+                timeoutMs: 30_000, maxOutputBytes: 32_768, env: { GH_DEBUG: '', GH_PROMPT_DISABLED: '1', GH_PAGER: 'cat' }
+            });
+            if (result.status !== 0 || result.errorCode || result.timedOut || result.outputLimitExceeded || result.aborted) {
+                throw new GitHubActivationError('secret-write', 'GitHub did not confirm encrypted Actions secret enrollment. Check the approved repository secrets-write permission.');
+            }
+        }
+    };
+}
+export function githubRestSecretWriter(client, seal) {
+    return {
+        async write(repository, name, value) {
+            githubRepository(repository);
+            if (name !== runnerPreflightSecretName)
+                throw new GitHubActivationError('credential-scope', 'The secret name is outside the reviewed enrollment policy.');
+            const key = await client.get(`/repos/${repository}/actions/secrets/public-key`);
+            const publicKey = Buffer.from(text(key.key, 'GitHub secret public key'), 'base64');
+            if (publicKey.length !== 32)
+                throw new GitHubActivationError('invalid-key', 'GitHub secret encryption key is not a 32-byte Curve25519 key.');
+            const encrypted = await seal(value, publicKey);
+            if (encrypted.length !== value.length + 48)
+                throw new GitHubActivationError('invalid-encryption', 'Secret encryption did not produce a libsodium sealed box.');
+            await client.write('PUT', `/repos/${repository}/actions/secrets/${name}`, {
+                key_id: text(key.key_id, 'GitHub key ID'), encrypted_value: Buffer.from(encrypted).toString('base64')
+            });
+        }
+    };
+}
+export function parseGitHubCredentialConfiguration(value) {
+    const config = object(value, 'credential-ready configuration');
+    const allowed = config.kind === 'github-app' ? ['kind', 'appId', 'installationId'] :
+        ['kind', 'tokenId', 'owner', 'appUnavailableReason'];
+    if (Object.keys(config).some((key) => !allowed.includes(key))) {
+        throw new GitHubActivationError('credential-config', 'Credential configuration contains unknown fields. Values, commands, and arbitrary permission grants are forbidden.');
+    }
+    if (config.kind === 'github-app') {
+        return { kind: 'github-app', appId: positiveId(config.appId, 'Approved App ID'),
+            installationId: positiveId(config.installationId, 'Approved installation ID') };
+    }
+    if (config.kind !== 'fine-grained-pat') {
+        throw new GitHubActivationError('credential-config', 'Select an existing approved scoped GitHub App, or explicitly justify its unavailable fine-grained PAT fallback.');
+    }
+    return { kind: 'fine-grained-pat', tokenId: positiveId(config.tokenId, 'Approved PAT ID'),
+        owner: githubName(config.owner, 'Credential owner'),
+        appUnavailableReason: text(config.appUnavailableReason, 'Reason an approved scoped App is unavailable') };
+}
+function samePermissions(actual) {
+    const permissions = object(actual, 'Credential permissions');
+    return canonicalSha256(permissions) === canonicalSha256(credentialApiPermissions);
+}
+export function createAppJwt(key, appId, now) {
+    try {
+        const privateKey = createPrivateKey(Buffer.from(key));
+        if (privateKey.asymmetricKeyType !== 'rsa' || (privateKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) {
+            throw new Error('key type');
+        }
+        const issued = Math.floor(now.getTime() / 1000) - 60;
+        const unsigned = `${Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url')}.${Buffer.from(JSON.stringify({
+            iat: issued, exp: issued + 540, iss: String(positiveId(appId))
+        })).toString('base64url')}`;
+        return Buffer.from(`${unsigned}.${sign('RSA-SHA256', Buffer.from(unsigned), privateKey).toString('base64url')}`);
+    }
+    catch {
+        throw new GitHubActivationError('invalid-app-key', 'Protected input must be the approved GitHub App RSA private key (at least 2048 bits). Key bytes were withheld.');
+    }
+}
+export async function enrollGitHubCredential(input) {
+    const repository = githubRepository(input.repository);
+    const [owner, name] = repository.split('/');
+    const repoIdentity = canonicalCredentialRepository({ id: String(input.repositoryId), owner, name });
+    const makeTransport = input.credentialTransport ?? createAuthenticatedGitHubTransport;
+    const config = parseGitHubCredentialConfiguration(input.configuration);
+    await input.assertAuthorized();
+    const secret = await input.channel.read(config.kind === 'github-app' ? 'GitHub App private key' : 'fine-grained PAT');
+    let jwt;
+    let token;
+    let tokenClient;
+    let installation;
+    let pat;
+    let principal = '';
+    let tokenExpiresAt = '';
+    try {
+        if (!secret.length || secret.length > 32_768) {
+            throw new GitHubActivationError('invalid-credential', 'The protected credential is empty or exceeds the size bound.');
+        }
+        if (config.kind === 'github-app') {
+            jwt = createAppJwt(secret, config.appId, input.now);
+            const appClient = new GitHubActivationClient(makeTransport(jwt));
+            installation = await appClient.get(`/app/installations/${config.installationId}`);
+            if (installation.app_id !== config.appId || installation.id !== config.installationId ||
+                object(installation.account).login !== owner || installation.repository_selection !== 'selected' ||
+                installation.suspended_at !== null || !samePermissions(installation.permissions)) {
+                throw new GitHubActivationError('credential-scope', 'The approved App installation is suspended, over-scoped, or bound to another owner. No installation or grant will be created automatically.');
+            }
+            await input.assertAuthorized();
+            const issued = object(await appClient.write('POST', `/app/installations/${config.installationId}/access_tokens`, {
+                repository_ids: [input.repositoryId], permissions: credentialApiPermissions
+            }));
+            if (!samePermissions(issued.permissions))
+                throw new GitHubActivationError('credential-scope', 'GitHub minted a token with permissions different from the exact reviewed preflight scope.');
+            token = Buffer.from(text(issued.token, 'Installation credential'));
+            tokenExpiresAt = text(issued.expires_at, 'Installation expiry');
+            if (Date.parse(tokenExpiresAt) <= input.now.getTime() ||
+                Date.parse(tokenExpiresAt) > input.now.getTime() + 3_600_000) {
+                throw new GitHubActivationError('credential-expiry', 'Installation tokens must be current and expire within one hour.');
+            }
+            tokenClient = new GitHubActivationClient(makeTransport(token));
+            const selected = await tokenClient.list('/installation/repositories', 'repositories');
+            if (selected.length !== 1 || selected[0].id !== input.repositoryId || selected[0].full_name !== repository) {
+                throw new GitHubActivationError('credential-scope', 'The installation credential is not restricted to the exact selected repository.');
+            }
+            principal = `${text(installation.app_slug, 'App slug')}[bot]`;
+        }
+        else {
+            const raw = secret.toString('utf8').trim();
+            if (!/^github_pat_[A-Za-z0-9_]{40,250}$/u.test(raw)) {
+                throw new GitHubActivationError('credential-kind', 'The fallback must be a fine-grained PAT, never a classic PAT or an unrelated token.');
+            }
+            token = Buffer.from(raw);
+            tokenClient = new GitHubActivationClient(makeTransport(token));
+            const ownerResponse = expectStatus(await tokenClient.transport.request({ method: 'GET', path: '/user' }), [200], 'Verify enrolled PAT identity');
+            const actor = object(ownerResponse.data);
+            if (actor.login !== config.owner)
+                throw new GitHubActivationError('credential-owner', 'The enrolled PAT belongs to a different GitHub identity.');
+            principal = config.owner;
+            // The organization grant API is the authoritative scope/expiry reader, not user-entered metadata.
+            const grants = await input.client.list(`/orgs/${owner}/personal-access-tokens?owner[]=${config.owner}`);
+            const matching = grants.filter((grant) => grant.token_id === config.tokenId);
+            if (matching.length !== 1)
+                throw new GitHubActivationError('credential-metadata', 'An organization owner must make the approved fine-grained PAT grant metadata readable; its token ID is absent or ambiguous.');
+            pat = matching[0];
+            const permissions = object(pat.permissions);
+            const requiredPermissions = {
+                repository: { metadata: 'read' },
+                organization: { organization_hosted_runners: 'read', organization_network_configurations: 'read' },
+                other: {}
+            };
+            tokenExpiresAt = text(pat.token_expires_at, 'PAT expiry');
+            const headerExpiry = ownerResponse.headers['github-authentication-token-expiration'] ??
+                ownerResponse.headers['x-github-authentication-token-expiration'];
+            const createdAt = Date.parse(text(pat.created_at, 'PAT creation'));
+            if (pat.repository_selection !== 'subset' || pat.token_expired !== false || object(pat.owner).login !== config.owner ||
+                canonicalSha256(permissions) !== canonicalSha256(requiredPermissions) ||
+                pat.token_name !== `${name.toLowerCase()}-runner-preflight-read` ||
+                !headerExpiry || Date.parse(headerExpiry) !== Date.parse(tokenExpiresAt) ||
+                Date.parse(tokenExpiresAt) - createdAt !== 30 * 24 * 60 * 60 * 1000 ||
+                Date.parse(tokenExpiresAt) <= input.now.getTime() ||
+                grants.filter((grant) => object(grant.owner).login === config.owner && grant.token_expires_at === tokenExpiresAt).length !== 1) {
+                throw new GitHubActivationError('credential-scope', 'PAT grant/identity/unique provider expiry does not match the exact selected-repository, read-only, 30-day fallback policy.');
+            }
+            const selected = await input.client.list(`/orgs/${owner}/personal-access-tokens/${positiveId(pat.id, 'PAT grant ID')}/repositories`);
+            if (selected.length !== 1 || selected[0].id !== input.repositoryId || selected[0].full_name !== repository) {
+                throw new GitHubActivationError('credential-scope', 'PAT grant is not restricted to this single repository.');
+            }
+        }
+        const probeEndpoints = [
+            `/repos/${repository}`, `/orgs/${owner}/actions/hosted-runners`, `/orgs/${owner}/settings/network-configurations`
+        ];
+        const observed = await tokenClient.get(probeEndpoints[0]);
+        if (observed.id !== input.repositoryId || observed.full_name !== repository) {
+            throw new GitHubActivationError('credential-use', 'Actual credential use returned a different repository identity.');
+        }
+        await tokenClient.list(probeEndpoints[1], 'runners');
+        await tokenClient.list(probeEndpoints[2], 'network_configurations');
+        await input.assertAuthorized();
+        await input.secretWriter.write(repository, runnerPreflightSecretName, config.kind === 'github-app' ? secret : token);
+        const readback = await input.client.get(`/repos/${repository}/actions/secrets/${runnerPreflightSecretName}`);
+        const secretUpdatedAt = text(readback.updated_at, 'Secret update timestamp');
+        if (readback.name !== runnerPreflightSecretName || Date.parse(secretUpdatedAt) < input.now.getTime() - 1000) {
+            throw new GitHubActivationError('secret-readback', 'GitHub secret write has no independent current metadata readback. Enrollment remains unverified.');
+        }
+        const usage = {
+            repositoryId: input.repositoryId, repository, principal, installationId: config.kind === 'github-app' ? config.installationId : null,
+            probeEndpoints, permissionsDigest: canonicalSha256(credentialApiPermissions), secretUpdatedAt
+        };
+        const allowedWorkflows = [
+            { path: '.github/workflows/liftoff-bootstrap.yml', jobs: ['credential-use'] },
+            { path: '.github/workflows/liftoff-runner.yml', jobs: ['runner-preflight'] }
+        ];
+        const policy = config.kind === 'github-app' ? buildGitHubAppCredentialPolicy({
+            repository: repoIdentity, identity: input.identity, createdAt: input.now, allowedWorkflows,
+            installation: {
+                installationId: config.installationId, appSlug: text(installation.app_slug, 'App slug'),
+                approved: true, verified: true, selection: 'selected-repository', repositories: [repoIdentity],
+                permissions: { repository: ['metadata:read'], organization: ['hosted-runners:read', 'network-configurations:read'] },
+                permissionsVerifiedAt: input.now.toISOString(), readbackDigest: canonicalSha256(usage),
+                token: { canGenerate: true, ttlSeconds: Math.floor((Date.parse(tokenExpiresAt) - input.now.getTime()) / 1000) }
+            }
+        }) : buildFineGrainedPatCredentialPolicy({
+            repository: repoIdentity, identity: input.identity, createdAt: new Date(String(pat.created_at)), allowedWorkflows,
+            proof: { verifiedAt: input.now.toISOString(), readbackDigest: canonicalSha256(usage), readbackProvider: 'github-api', payloadFree: true }
+        });
+        return { policy, usage };
+    }
+    finally {
+        // Revoke only the ephemeral token minted here; never revoke the operator's pre-existing credential.
+        if (config.kind === 'github-app' && tokenClient) {
+            try {
+                await tokenClient.write('DELETE', '/installation/token');
+            }
+            catch { /* The token is bounded to one hour; no diagnostics may expose it. */ }
+        }
+        secret.fill(0);
+        jwt?.fill(0);
+        token?.fill(0);
+    }
+}
+//# sourceMappingURL=github-enrollment.js.map

package/dist/adapters/credentials/github-enrollment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-enrollment.js","sourceRoot":"","sources":["../../../src/adapters/credentials/github-enrollment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,MAAM,sDAAsD,CAAC;AACvF,OAAO,EACL,mCAAmC,EAAE,8BAA8B,EAAE,6BAA6B,EACnG,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,sBAAsB,EAAE,qBAAqB,EAAE,kCAAkC,EAAE,YAAY,EAC/F,UAAU,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EACvD,MAAM,8BAA8B,CAAC;AAMtC,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,mCAAmC,EAAE,MAAM;CAC1F,CAAC;AAMX,MAAM,UAAU,qBAAqB,CAAC,MAAqB,EAAE,GAAW;IACtE,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK;YACjC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,yBAAyB;gBAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,4DAA4D,CAAC,CAAC;YAC1J,6FAA6F;YAC7F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC;gBAC9B,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC;aAC1F,EAAE;gBACD,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK;gBACrF,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC3G,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC/G,MAAM,IAAI,qBAAqB,CAAC,cAAc,EAAE,qHAAqH,CAAC,CAAC;YACzK,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAA8B,EAC9B,IAAuE;IAEvE,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK;YACjC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,yBAAyB;gBAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,4DAA4D,CAAC,CAAC;YAC1J,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,UAAU,6BAA6B,CAAC,CAAC;YAChF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,EAAE,QAAQ,CAAC,CAAC;YACnF,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,qBAAqB,CAAC,aAAa,EAAE,+DAA+D,CAAC,CAAC;YAC7I,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,GAAG,EAAE;gBAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,2DAA2D,CAAC,CAAC;YAC/J,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,UAAU,oBAAoB,IAAI,EAAE,EAAE;gBACxE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACtG,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAAc;IAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAClF,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,EAAE,oHAAoH,CAAC,CAAC;IAC7K,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC;YAC7E,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACvC,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,EAAE,iHAAiH,CAAC,CAAC;IAC1K,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC;QACvF,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC;QACnD,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,8CAA8C,CAAC,EAAE,CAAC;AAC9G,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAC7D,OAAO,eAAe,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,wBAAwB,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAe,EAAE,KAAa,EAAE,GAAS;IACpE,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,UAAU,CAAC,iBAAiB,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,aAAa,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;YAC3G,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YAChI,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;SAC/D,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,EAAE,gHAAgH,CAAC,CAAC;IACvK,CAAC;AACH,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAW5C;IACC,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAChE,MAAM,YAAY,GAAG,6BAA6B,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpG,MAAM,aAAa,GAAG,KAAK,CAAC,mBAAmB,IAAI,kCAAkC,CAAC;IACtF,MAAM,MAAM,GAAG,kCAAkC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACvE,MAAM,KAAK,CAAC,gBAAgB,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IACtH,IAAI,GAAuB,CAAC;IAC5B,IAAI,KAAyB,CAAC;IAC9B,IAAI,WAA+C,CAAC;IACpD,IAAI,YAAiD,CAAC;IACtD,IAAI,GAAwC,CAAC;IAC7C,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,cAAc,GAAG,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,8DAA8D,CAAC,CAAC;QACxH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACjC,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,IAAI,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,YAAY,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;YAClF,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,IAAI,YAAY,CAAC,EAAE,KAAK,MAAM,CAAC,cAAc;gBACnF,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,YAAY,CAAC,oBAAoB,KAAK,UAAU;gBAChG,YAAY,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnF,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,6IAA6I,CAAC,CAAC;YACrM,CAAC;YACD,MAAM,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,sBAAsB,MAAM,CAAC,cAAc,gBAAgB,EAAE;gBAC/G,cAAc,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,wBAAwB;aAC5E,CAAC,CAAC,CAAC;YACJ,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC;gBAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,2FAA2F,CAAC,CAAC;YAC3L,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACnE,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;YAChE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE;gBACnD,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;gBAC/D,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,EAAE,iEAAiE,CAAC,CAAC;YAC1H,CAAC;YACD,WAAW,GAAG,IAAI,sBAAsB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,4BAA4B,EAAE,cAAc,CAAC,CAAC;YACtF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,KAAK,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC,CAAE,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;gBAC7G,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,iFAAiF,CAAC,CAAC;YACzI,CAAC;YACD,SAAS,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,EAAE,qFAAqF,CAAC,CAAC;YAC5I,CAAC;YACD,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,WAAW,GAAG,IAAI,sBAAsB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,CAAC;YACjJ,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;gBAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,0DAA0D,CAAC,CAAC;YAClJ,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;YACzB,kGAAkG;YAClG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,mCAAmC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACxG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,EAAE,6HAA6H,CAAC,CAAC;YACjN,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YACnB,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,MAAM,mBAAmB,GAAG;gBAC1B,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;gBAChC,YAAY,EAAE,EAAE,2BAA2B,EAAE,MAAM,EAAE,mCAAmC,EAAE,MAAM,EAAE;gBAClG,KAAK,EAAE,EAAE;aACV,CAAC;YACF,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;YAC1D,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,wCAAwC,CAAC;gBAClF,aAAa,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC;YACpE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;YACnE,IAAI,GAAG,CAAC,oBAAoB,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;gBAClH,eAAe,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,mBAAmB,CAAC;gBACrE,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,wBAAwB;gBAChE,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBACxE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,SAAS,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;gBACnE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE;gBACjD,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,gBAAgB,KAAK,cAAc,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjI,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,4HAA4H,CAAC,CAAC;YACpL,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,2BAA2B,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;YACrI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,KAAK,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC,CAAE,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;gBAC7G,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,wDAAwD,CAAC,CAAC;YAChH,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG;YACrB,UAAU,UAAU,EAAE,EAAE,SAAS,KAAK,yBAAyB,EAAE,SAAS,KAAK,kCAAkC;SAClH,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAE,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,YAAY,IAAI,QAAQ,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YAC5E,MAAM,IAAI,qBAAqB,CAAC,gBAAgB,EAAE,iEAAiE,CAAC,CAAC;QACvH,CAAC;QACD,MAAM,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAE,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAE,EAAE,wBAAwB,CAAC,CAAC;QACrE,MAAM,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC/B,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,yBAAyB,EAAE,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC;QACtH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,UAAU,oBAAoB,yBAAyB,EAAE,CAAC,CAAC;QAC7G,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;QAC7E,IAAI,QAAQ,CAAC,IAAI,KAAK,yBAAyB,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;YAC5G,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,EAAE,kGAAkG,CAAC,CAAC;QACzJ,CAAC;QACD,MAAM,KAAK,GAAG;YACZ,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;YACpI,cAAc,EAAE,iBAAiB,EAAE,eAAe,CAAC,wBAAwB,CAAC,EAAE,eAAe;SAC9F,CAAC;QACF,MAAM,gBAAgB,GAAG;YACvB,EAAE,IAAI,EAAE,yCAAyC,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE;YAC7E,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,kBAAkB,CAAC,EAAE;SAC7E,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,8BAA8B,CAAC;YAC3E,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,gBAAgB;YAC1F,YAAY,EAAE;gBACZ,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,YAAa,CAAC,QAAQ,EAAE,UAAU,CAAC;gBACxF,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,YAAY,EAAE,CAAC,YAAY,CAAC;gBAC9F,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC,qBAAqB,EAAE,6BAA6B,CAAC,EAAE;gBACpH,qBAAqB,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC;gBACtF,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;aAChH;SACF,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC;YACvC,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAI,CAAC,UAAU,CAAC,CAAC,EAAE,gBAAgB;YAClH,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE;SAC1I,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,oGAAoG;QACpG,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,WAAW,EAAE,CAAC;YAChD,IAAI,CAAC;gBAAC,MAAM,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;YAAC,CAAC;YACjE,MAAM,CAAC,CAAC,qEAAqE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/adapters/credentials/protected-input.d.ts

@@ -0,0 +1,7 @@
+import type { Readable } from 'node:stream';
+export interface ProtectedCredentialChannel {
+    readonly kind: 'private-tty' | 'protected-stdin';
+    read(label: 'GitHub App private key' | 'fine-grained PAT'): Promise<Buffer>;
+}
+export declare function privateTtyCredentialChannel(): ProtectedCredentialChannel;
+export declare function protectedStdinCredentialChannel(explicitSelection: boolean, input?: Readable, timeoutMs?: number): ProtectedCredentialChannel;

package/dist/adapters/credentials/protected-input.js

@@ -0,0 +1,68 @@
+import { password } from '@inquirer/prompts';
+import { GitHubActivationError } from '../github/activation-rest.js';
+export function privateTtyCredentialChannel() {
+    return {
+        kind: 'private-tty',
+        async read(label) {
+            if (!process.stdin.isTTY || !process.stdout.isTTY) {
+                throw new GitHubActivationError('private-input-required', 'Credential enrollment requires a private TTY, or explicitly selected protected stdin. Never paste credentials into chat or argv.');
+            }
+            const value = await password({ message: `Private ${label} (never copied into output):`, mask: '' });
+            const bytes = Buffer.from(value, 'utf8');
+            if (!bytes.length || bytes.length > 32_768) {
+                bytes.fill(0);
+                throw new GitHubActivationError('invalid-credential', 'Protected credential input is empty or exceeds 32 KiB.');
+            }
+            return bytes;
+        }
+    };
+}
+export function protectedStdinCredentialChannel(explicitSelection, input = process.stdin, timeoutMs = 60_000) {
+    return {
+        kind: 'protected-stdin',
+        async read() {
+            if (!explicitSelection || input.isTTY) {
+                throw new GitHubActivationError('private-input-required', 'Protected stdin must be explicitly selected and supplied by an owner-controlled non-TTY secret channel.');
+            }
+            return new Promise((resolve, reject) => {
+                const chunks = [];
+                let size = 0;
+                const clean = () => {
+                    clearTimeout(timer);
+                    input.off('data', data);
+                    input.off('end', end);
+                    input.off('error', failure);
+                    for (const bytes of chunks)
+                        bytes.fill(0);
+                    input.pause();
+                };
+                const failure = () => {
+                    clean();
+                    reject(new GitHubActivationError('protected-input-failed', 'Protected credential input was interrupted, empty, oversized, or timed out.'));
+                };
+                const data = (chunk) => {
+                    const bytes = Buffer.from(chunk);
+                    size += bytes.length;
+                    chunks.push(bytes);
+                    if (size > 32_768)
+                        failure();
+                };
+                const end = () => {
+                    if (!size) {
+                        failure();
+                        return;
+                    }
+                    const bytes = Buffer.concat(chunks);
+                    clean();
+                    resolve(bytes);
+                };
+                const timer = setTimeout(failure, timeoutMs);
+                input.on('data', data);
+                input.once('end', end);
+                input.once('error', failure);
+                input.resume();
+            });
+        }
+    };
+}
+//# sourceMappingURL=protected-input.js.map

package/dist/adapters/credentials/protected-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected-input.js","sourceRoot":"","sources":["../../../src/adapters/credentials/protected-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAOrE,MAAM,UAAU,2BAA2B;IACzC,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClD,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,EAAE,kIAAkI,CAAC,CAAC;YAChM,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,WAAW,KAAK,8BAA8B,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACpG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,wDAAwD,CAAC,CAAC;YAClH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,iBAA0B,EAC1B,KAAK,GAAa,OAAO,CAAC,KAAK,EAC/B,SAAS,GAAG,MAAM;IAElB,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK,CAAC,IAAI;YACR,IAAI,CAAC,iBAAiB,IAAK,KAA2B,CAAC,KAAK,EAAE,CAAC;gBAC7D,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,EAAE,yGAAyG,CAAC,CAAC;YACvK,CAAC;YACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrC,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;gBACb,MAAM,KAAK,GAAG,GAAG,EAAE;oBACjB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBACxB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBACtB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC5B,KAAK,MAAM,KAAK,IAAI,MAAM;wBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC1C,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,CAAC,CAAC;gBACF,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,KAAK,EAAE,CAAC;oBACR,MAAM,CAAC,IAAI,qBAAqB,CAAC,wBAAwB,EAAE,6EAA6E,CAAC,CAAC,CAAC;gBAC7I,CAAC,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,EAAE;oBACtC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACjC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;oBACrB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnB,IAAI,IAAI,GAAG,MAAM;wBAAE,OAAO,EAAE,CAAC;gBAC/B,CAAC,CAAC;gBACF,MAAM,GAAG,GAAG,GAAG,EAAE;oBACf,IAAI,CAAC,IAAI,EAAE,CAAC;wBAAC,OAAO,EAAE,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBACjC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACpC,KAAK,EAAE,CAAC;oBACR,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC,CAAC;gBACF,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC7C,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7B,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/filesystem/executables.d.ts

@@ -0,0 +1,2 @@
+import { type ExecutableObserver } from '../../domain/workstation/executables.js';
+export declare const nativeExecutableObserver: ExecutableObserver;

package/dist/adapters/filesystem/executables.js

@@ -0,0 +1,70 @@
+import { constants } from 'node:fs';
+import { access, open, realpath, stat } from 'node:fs/promises';
+import { executableCandidates, hostPath, originFromPath, unavailable } from '../../domain/workstation/executables.js';
+async function npmShim(candidate, packageId) {
+    const file = await open(candidate, 'r');
+    try {
+        const info = await file.stat();
+        if (!info.isFile() || info.size > 8_192)
+            return false;
+        const content = await file.readFile('utf8');
+        const normalized = content.replaceAll('\\', '/').toLowerCase();
+        return /^@echo off\b/i.test(content) &&
+            normalized.includes(`%dp0%/node_modules/${packageId.toLowerCase()}/`);
+    }
+    finally {
+        await file.close();
+    }
+}
+export const nativeExecutableObserver = {
+    async inspect(candidate, context) {
+        const nativePath = hostPath(context.platform);
+        const executable = nativePath.basename(candidate);
+        if (!nativePath.isAbsolute(candidate) || context.platform !== process.platform) {
+            return unavailable(executable, 'not-observable');
+        }
+        try {
+            const info = await stat(candidate);
+            if (!info.isFile())
+                return unavailable(executable, 'missing');
+            await access(candidate, context.platform === 'win32' ? constants.F_OK : constants.X_OK);
+            const target = await realpath(candidate);
+            const kind = /\.(?:cmd|bat)$/i.test(candidate) ? 'shim' : 'executable';
+            let origin = originFromPath(target, context);
+            if (origin === 'unknown' && kind === 'shim' && context.definition.packageIdentities?.npm) {
+                try {
+                    if (await npmShim(candidate, context.definition.packageIdentities.npm))
+                        origin = 'npm';
+                }
+                catch {
+                    // A readable version probe does not imply permission to inspect its launcher.
+                }
+            }
+            return {
+                executable,
+                resolution: 'resolved',
+                resolvedPath: candidate,
+                realPath: target,
+                kind,
+                origin,
+                evidence: 'documented-location'
+            };
+        }
+        catch (error) {
+            const code = error && typeof error === 'object' && 'code' in error ? error.code : undefined;
+            return unavailable(executable, code === 'ENOENT' || code === 'ENOTDIR' ? 'missing' : 'not-observable');
+        }
+    },
+    async resolve(executable, context) {
+        let unobservable = false;
+        for (const candidate of executableCandidates(executable, context)) {
+            const identity = await this.inspect(candidate, context);
+            if (identity.resolution === 'resolved')
+                return { ...identity, executable, evidence: 'path-search' };
+            if (identity.resolution === 'not-observable')
+                unobservable = true;
+        }
+        return unavailable(executable, unobservable ? 'not-observable' : 'missing');
+    }
+};
+//# sourceMappingURL=executables.js.map

package/dist/adapters/filesystem/executables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executables.js","sourceRoot":"","sources":["../../../src/adapters/filesystem/executables.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,cAAc,EACd,WAAW,EAGZ,MAAM,yCAAyC,CAAC;AAEjD,KAAK,UAAU,OAAO,CAAC,SAAiB,EAAE,SAAiB;IACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;YAAE,OAAO,KAAK,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/D,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,UAAU,CAAC,QAAQ,CAAC,sBAAsB,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAuB;IAC1D,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO;QAC9B,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC/E,OAAO,WAAW,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,OAAO,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YAC9D,MAAM,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACxF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;YACvE,IAAI,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC;gBACzF,IAAI,CAAC;oBACH,IAAI,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAAC;wBAAE,MAAM,GAAG,KAAK,CAAC;gBACzF,CAAC;gBAAC,MAAM,CAAC;oBACP,8EAA8E;gBAChF,CAAC;YACH,CAAC;YACD,OAAO;gBACL,UAAU;gBACV,UAAU,EAAE,UAAU;gBACtB,YAAY,EAAE,SAAS;gBACvB,QAAQ,EAAE,MAAM;gBAChB,IAAI;gBACJ,MAAM;gBACN,QAAQ,EAAE,qBAAqB;aAChC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5F,OAAO,WAAW,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO;QAC/B,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,KAAK,MAAM,SAAS,IAAI,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;YAClE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU;gBAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;YACpG,IAAI,QAAQ,CAAC,UAAU,KAAK,gBAAgB;gBAAE,YAAY,GAAG,IAAI,CAAC;QACpE,CAAC;QACD,OAAO,WAAW,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9E,CAAC;CACF,CAAC"}

package/dist/adapters/filesystem/update-previews.d.ts

@@ -48,3 +48,12 @@ export declare function loadUpdatePreviewReceipt(projectRoot: string, options?:
 export declare function issueUpdatePreviewReceipt(projectRoot: string, descriptors: readonly UpdatePreviewDescriptor[], options?: UpdatePreviewOptions): Promise<StoredUpdatePreview>;
 export declare function createUpdateTransactionApprovalStore(projectRoot: string, options?: UpdatePreviewOptions): UpdateTransactionApprovalStore;
 export declare function consumeUpdatePreviewReceipt(projectRoot: string, expectedReceipt: UpdatePreviewReceipt, options?: UpdatePreviewOptions): Promise<void>;
+export interface ScopedUserLocalRecord {
+    projectRoot: string;
+    path: string;
+    value: unknown;
+}
+export declare function createScopedUserLocalRecordStore(projectRoot: string, namespace: 'governance-preview' | 'governance-approval' | 'workstation-remediation', options?: UpdatePreviewOptions): {
+    read(key: string): Promise<ScopedUserLocalRecord | null>;
+    write(key: string, value: unknown): Promise<ScopedUserLocalRecord>;
+};

package/dist/adapters/filesystem/update-previews.js

@@ -4,7 +4,6 @@ import { lstat, mkdir, open, realpath, rename, unlink } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { createUpdatePreviewReceipt, normalizeUpdatePreviewProjectRoot, updatePreviewDirectoryParts, updatePreviewProjectKey, UpdatePreviewError, validateUpdatePreviewReceipt } from '../../application/update/preview.js';
-import { formatUpdateCommand } from '../../application/update/command-guidance.js';
 import { createUpdateTransactionApprovalSeal, updateTransactionApprovalKey, UpdateTransactionApprovalError, validateUpdateTransactionApprovalDigests, validateUpdateTransactionApprovalSeal } from '../../application/update/transaction-approval.js';
 import { canonicalJson } from '../../domain/governance/activation/canonical-json.js';
 import { errorCode, errorMessage } from './errors.js';
@@ -371,7 +370,7 @@ function parseReceipt(content, storage) {
 }
 function missing(storage) {
     const { location } = storage;
-    throw new UpdatePreviewError('preview-missing', `No preview receipt exists for this project at ${location.receiptPath}. Run ${formatUpdateCommand(location.projectRoot, 'check', storage.platform)}.`);
+    throw new UpdatePreviewError('preview-missing', `No saved update preview was found for project ${location.projectRoot}. Expected receipt: ${location.receiptPath}.`, { projectRoot: location.projectRoot, platform: storage.platform });
 }
 export async function loadUpdatePreviewReceipt(projectRoot, options = {}) {
     const storage = await storageFor(projectRoot, options);
@@ -610,4 +609,48 @@ export async function consumeUpdatePreviewReceipt(projectRoot, expectedReceipt,
         await io('consume receipt', storage.location.receiptPath, () => storage.fs.removeFile(storage.location.receiptPath));
     });
 }
+export function createScopedUserLocalRecordStore(projectRoot, namespace, options = {}) {
+    const location = async (key) => {
+        if (!/^[a-f0-9]{64}$/u.test(key))
+            throw storageError('A scoped metadata key must be a complete lowercase SHA-256 digest.');
+        const storage = await storageFor(projectRoot, options);
+        const filePath = storage.paths.join(storage.location.directory, `${namespace}-${storage.location.projectKey}-${key}.json`);
+        return { storage, filePath };
+    };
+    return {
+        read: async (key) => {
+            const { storage, filePath } = await location(key);
+            const snapshot = await directories(storage, false);
+            if (!snapshot)
+                return null;
+            const content = await readText(storage, filePath, snapshot);
+            if (content === undefined)
+                return null;
+            let value;
+            try {
+                value = JSON.parse(content);
+            }
+            catch (error) {
+                throw storageError(`Malformed ${namespace} record at ${filePath}.`, error);
+            }
+            return { projectRoot: storage.location.projectRoot, path: filePath, value };
+        },
+        write: async (key, value) => {
+            const { storage, filePath } = await location(key);
+            const content = canonicalJson(value);
+            const snapshot = await directories(storage, true);
+            if (!snapshot)
+                throw storageError(`Unable to create ${namespace} storage.`);
+            return withStoreLock(storage, snapshot, async () => {
+                const before = await readText(storage, filePath, snapshot);
+                if (before !== undefined && before !== content) {
+                    throw storageError(`Refusing to replace different ${namespace} metadata at ${filePath}.`);
+                }
+                if (before === undefined)
+                    await writeAtomicMetadata(storage, snapshot, filePath, content, undefined, true);
+                return { projectRoot: storage.location.projectRoot, path: filePath, value };
+            });
+        }
+    };
+}
 //# sourceMappingURL=update-previews.js.map