@nac3/forge-cli 0.2.0-alpha.1

package/dist/validate/index.js

@@ -0,0 +1,181 @@
+/**
+ * Yujin Forge -- project validator.
+ *
+ * Verifies that a directory looks like a Yujin Forge project. The
+ * check is static (no compile, no install). Useful day-1 as:
+ *
+ *   - a pre-commit hook
+ *   - a CI gate (yf validate --strict && yf test && yf ship)
+ *   - a sanity probe after `yf new` / `yf migrate --apply`
+ *
+ * The full NAC-3 manifest validator (label_i18n completeness for
+ * all 10 locales, verb declarations, ack contract) lands once the
+ * @yujin/nac runtime is published; this stage focuses on the
+ * structural contract that doesn't depend on the runtime.
+ */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { isValidSlug } from '../template/index.js';
+const REQUIRED_FORGE_FIELDS = [
+    'project_slug',
+    'project_name',
+    'forge_version',
+    'nac_version',
+];
+export async function validateProject(opts) {
+    const findings = [];
+    await checkForgeJson(opts.projectRoot, findings);
+    await checkPackageJson(opts.projectRoot, findings);
+    await checkSrcDir(opts.projectRoot, findings);
+    const errorCount = findings.filter((f) => f.severity === 'error').length;
+    const warnCount = findings.filter((f) => f.severity === 'warn').length;
+    const ok = errorCount === 0 && (!opts.strict || warnCount === 0);
+    return {
+        project_root: opts.projectRoot,
+        findings,
+        ok,
+    };
+}
+async function checkForgeJson(root, out) {
+    const p = path.join(root, 'yujin.forge.json');
+    let raw;
+    try {
+        raw = await fs.readFile(p, 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            out.push({
+                severity: 'error',
+                code: 'forge_json_missing',
+                message: 'yujin.forge.json not found at ' + p,
+            });
+            return;
+        }
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        out.push({
+            severity: 'error',
+            code: 'forge_json_unparseable',
+            message: 'yujin.forge.json is not valid JSON: '
+                + (err instanceof Error ? err.message : String(err)),
+        });
+        return;
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        out.push({
+            severity: 'error',
+            code: 'forge_json_not_object',
+            message: 'yujin.forge.json must be a JSON object',
+        });
+        return;
+    }
+    const obj = parsed;
+    for (const field of REQUIRED_FORGE_FIELDS) {
+        if (!(field in obj)) {
+            out.push({
+                severity: 'error',
+                code: 'forge_json_missing_field',
+                message: "yujin.forge.json missing required field '" + field + "'",
+            });
+        }
+    }
+    const slug = obj['project_slug'];
+    if (typeof slug === 'string' && !isValidSlug(slug)) {
+        out.push({
+            severity: 'error',
+            code: 'forge_json_invalid_slug',
+            message: "project_slug '" + slug + "' is not a valid slug (lowercase, dash, 3..40 chars, starts with a letter)",
+        });
+    }
+    const tel = obj['telemetry'];
+    if (tel !== undefined && (typeof tel !== 'object' || tel === null || Array.isArray(tel))) {
+        out.push({
+            severity: 'warn',
+            code: 'forge_json_telemetry_shape',
+            message: "yujin.forge.json 'telemetry' must be an object when present",
+        });
+    }
+}
+async function checkPackageJson(root, out) {
+    const p = path.join(root, 'package.json');
+    let raw;
+    try {
+        raw = await fs.readFile(p, 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            out.push({
+                severity: 'error',
+                code: 'package_json_missing',
+                message: 'package.json not found at ' + p,
+            });
+            return;
+        }
+        throw err;
+    }
+    let pkg;
+    try {
+        pkg = JSON.parse(raw);
+    }
+    catch {
+        out.push({
+            severity: 'error',
+            code: 'package_json_unparseable',
+            message: 'package.json is not valid JSON',
+        });
+        return;
+    }
+    const deps = {
+        ...(asDeps(pkg['dependencies'])),
+        ...(asDeps(pkg['devDependencies'])),
+        ...(asDeps(pkg['peerDependencies'])),
+    };
+    if (!('@yujin/nac' in deps) && !('@yujin/nac-commercial' in deps)) {
+        out.push({
+            severity: 'warn',
+            code: 'package_json_no_nac_dep',
+            message: "package.json does not depend on '@yujin/nac' or '@yujin/nac-commercial'",
+        });
+    }
+}
+function asDeps(v) {
+    if (typeof v !== 'object' || v === null || Array.isArray(v))
+        return {};
+    const out = {};
+    for (const [k, val] of Object.entries(v)) {
+        if (typeof val === 'string')
+            out[k] = val;
+    }
+    return out;
+}
+async function checkSrcDir(root, out) {
+    const p = path.join(root, 'src');
+    try {
+        const stat = await fs.stat(p);
+        if (!stat.isDirectory()) {
+            out.push({
+                severity: 'error',
+                code: 'src_not_a_directory',
+                message: 'src/ exists but is not a directory',
+            });
+        }
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            out.push({
+                severity: 'error',
+                code: 'src_missing',
+                message: 'src/ directory not found at ' + p,
+            });
+        }
+        else {
+            throw err;
+        }
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/validate/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/validate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAuBnD,MAAM,qBAAqB,GAAG;IAC5B,cAAc;IACd,cAAc;IACd,eAAe;IACf,aAAa;CACL,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAqB;IACzD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,MAAM,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,SAAS,GAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,EAAE,GAAG,UAAU,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,KAAK,CAAC,CAAC,CAAC;IAEjE,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,QAAQ;QACR,EAAE;KACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,GAAc;IACxD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC9C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,gCAAgC,GAAG,CAAC;aAC9C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,sCAAsC;kBAC3C,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SACvD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,2CAA2C,GAAG,KAAK,GAAG,GAAG;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,4EAA4E;SAChH,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,GAAc;IAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,4BAA4B,GAAG,CAAC;aAC1C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;KACrC,CAAC;IACF,IAAI,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,uBAAuB,IAAI,IAAI,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,yEAAyE;SACnF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACvE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,GAAc;IACrD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,oCAAoC;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,8BAA8B,GAAG,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/vault/catalog.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Vault slot catalog -- predefined slot names with their kind,
+ * description, and reachability test.
+ *
+ * Per SQ sec 0.11, Forge ships with a catalog of well-known
+ * credentials so the user does not have to remember the exact
+ * slot name + the kind classification. Slots that are NOT in
+ * the catalog are accepted as `kind: 'custom'`.
+ *
+ * The test function lets `yf vault test <name>` verify the
+ * credential is still valid against the external service.
+ * Network calls go out via Node's global fetch (Node 18+);
+ * timeout is enforced via AbortController so the doctor /
+ * panel does not hang on offline services.
+ *
+ * ASCII-only.
+ */
+export declare const SLOT_KINDS: readonly ["repo", "registry", "ai", "cloud", "app", "custom"];
+export type SlotKind = (typeof SLOT_KINDS)[number];
+export interface SlotCatalogEntry {
+    /** Canonical slot name. */
+    name: string;
+    /** Classification per SQ 0.11. */
+    kind: Exclude<SlotKind, 'custom'>;
+    /** Human-readable description shown in the UI. ASCII-only. */
+    description: string;
+    /** Where the user obtains this credential (URL). */
+    obtainUrl?: string;
+    /** Optional probe that hits the service and returns ok=true
+     *  when the credential is valid + 200 OK. Always returns
+     *  within `timeoutMs`. */
+    test?: (plaintext: string, opts: SlotTestOptions) => Promise<SlotTestResult>;
+}
+export interface SlotTestOptions {
+    timeoutMs: number;
+}
+export interface SlotTestResult {
+    ok: boolean;
+    /** HTTP status from the probe response (or 0 if network failure). */
+    status: number;
+    /** Service-side detail when ok=false (e.g. "bad_credentials"). */
+    detail?: string;
+    /** Latency of the probe in ms. */
+    latency_ms: number;
+}
+export declare const SLOT_CATALOG: SlotCatalogEntry[];
+/** Look up a catalog entry by exact name. Returns undefined
+ *  when the slot is custom (user-defined). */
+export declare function lookupCatalog(name: string): SlotCatalogEntry | undefined;
+/** Infer the kind for a slot name: catalog hit -> its kind,
+ *  miss -> 'custom'. */
+export declare function inferKind(name: string): SlotKind;
+/** Indexed view of the catalog by kind. */
+export declare function catalogByKind(): Record<SlotKind, SlotCatalogEntry[]>;
+//# sourceMappingURL=catalog.d.ts.map

package/dist/vault/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/vault/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,UAAU,+DAAgE,CAAC;AACxF,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClC,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;8BAE0B;IAC1B,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAC;CACpB;AA0RD,eAAO,MAAM,YAAY,EAAE,gBAAgB,EA2G1C,CAAC;AAEF;8CAC8C;AAC9C,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAExE;AAED;wBACwB;AACxB,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAGhD;AAED,2CAA2C;AAC3C,wBAAgB,aAAa,IAAI,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAMpE"}

package/dist/vault/catalog.js

@@ -0,0 +1,424 @@
+/**
+ * Vault slot catalog -- predefined slot names with their kind,
+ * description, and reachability test.
+ *
+ * Per SQ sec 0.11, Forge ships with a catalog of well-known
+ * credentials so the user does not have to remember the exact
+ * slot name + the kind classification. Slots that are NOT in
+ * the catalog are accepted as `kind: 'custom'`.
+ *
+ * The test function lets `yf vault test <name>` verify the
+ * credential is still valid against the external service.
+ * Network calls go out via Node's global fetch (Node 18+);
+ * timeout is enforced via AbortController so the doctor /
+ * panel does not hang on offline services.
+ *
+ * ASCII-only.
+ */
+export const SLOT_KINDS = ['repo', 'registry', 'ai', 'cloud', 'app', 'custom'];
+/* Helper to wrap fetch with a timeout. */
+async function probeFetch(url, init, timeoutMs) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    const t0 = Date.now();
+    try {
+        const res = await fetch(url, { ...init, signal: ctrl.signal });
+        const text = await res.text();
+        return { status: res.status, bodyText: text, latency_ms: Date.now() - t0 };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { status: 0, bodyText: '', latency_ms: Date.now() - t0, err: msg };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/* ---------- repo ---------- */
+const githubTest = async (token, opts) => {
+    const r = await probeFetch('https://api.github.com/user', {
+        headers: { authorization: 'token ' + token, accept: 'application/vnd.github+json',
+            'user-agent': 'yujin-forge' },
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    if (r.status === 200)
+        return { ok: true, status: 200, latency_ms: r.latency_ms };
+    return { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+const gitlabTest = async (token, opts) => {
+    const r = await probeFetch('https://gitlab.com/api/v4/user', {
+        headers: { 'private-token': token, 'user-agent': 'yujin-forge' },
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    return r.status === 200
+        ? { ok: true, status: 200, latency_ms: r.latency_ms }
+        : { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+const bitbucketTest = async (token, opts) => {
+    /* Bitbucket App Password requires user:pass. We expect the
+       slot value to be either `user:password` or just the
+       password (in which case test result is unreliable). */
+    const auth = token.includes(':') ? token : 'x-token-auth:' + token;
+    const r = await probeFetch('https://api.bitbucket.org/2.0/user', {
+        headers: {
+            authorization: 'Basic ' + Buffer.from(auth).toString('base64'),
+            'user-agent': 'yujin-forge',
+        },
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    return r.status === 200
+        ? { ok: true, status: 200, latency_ms: r.latency_ms }
+        : { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+/* ---------- registry ---------- */
+const npmTest = async (token, opts) => {
+    const r = await probeFetch('https://registry.npmjs.org/-/whoami', {
+        headers: { authorization: 'Bearer ' + token, accept: 'application/json',
+            'user-agent': 'yujin-forge' },
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    return r.status === 200
+        ? { ok: true, status: 200, latency_ms: r.latency_ms }
+        : { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+const pypiTest = async (token, opts) => {
+    /* PyPI does not expose a generic whoami; we probe the upload
+       endpoint with an OPTIONS request which validates auth
+       without uploading. */
+    const r = await probeFetch('https://upload.pypi.org/legacy/', {
+        method: 'OPTIONS',
+        headers: { authorization: 'Basic ' + Buffer.from('__token__:' + token).toString('base64'),
+            'user-agent': 'yujin-forge' },
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    return r.status === 200 || r.status === 204
+        ? { ok: true, status: r.status, latency_ms: r.latency_ms }
+        : { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+const dockerTest = async (token, opts) => {
+    /* DockerHub Personal Access Token -- the JWT auth endpoint
+       accepts the PAT as password for the username:PAT pair. We
+       can't do a clean whoami without the username, so we check
+       the rate-limit endpoint which only requires a valid token. */
+    const r = await probeFetch('https://hub.docker.com/v2/user/', {
+        headers: { authorization: 'Bearer ' + token, 'user-agent': 'yujin-forge' },
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    return r.status === 200
+        ? { ok: true, status: 200, latency_ms: r.latency_ms }
+        : { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+/* ---------- ai ---------- */
+const anthropicTest = async (key, opts) => {
+    /* Minimal Anthropic ping: small messages request that the
+       API can reject with auth-error without billing tokens. */
+    const r = await probeFetch('https://api.anthropic.com/v1/messages', {
+        method: 'POST',
+        headers: {
+            'x-api-key': key, 'anthropic-version': '2023-06-01',
+            'content-type': 'application/json', 'user-agent': 'yujin-forge',
+        },
+        body: JSON.stringify({
+            model: 'claude-haiku-4-5-20251001',
+            max_tokens: 1,
+            messages: [{ role: 'user', content: 'ping' }],
+        }),
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    /* 200 OK = good. 401 = bad key. 400 etc = key is good but
+       payload tweaked -- still counts as authenticated. */
+    if (r.status === 200)
+        return { ok: true, status: 200, latency_ms: r.latency_ms };
+    if (r.status === 401 || r.status === 403) {
+        return { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+    }
+    /* Anything else (400, 429, 5xx) means the key was accepted
+       by the auth layer but something else broke -- treat as
+       authenticated. */
+    return { ok: true, status: r.status, detail: 'auth ok; payload rejected', latency_ms: r.latency_ms };
+};
+const openaiTest = async (key, opts) => {
+    const r = await probeFetch('https://api.openai.com/v1/models', {
+        headers: { authorization: 'Bearer ' + key, 'user-agent': 'yujin-forge' },
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    return r.status === 200
+        ? { ok: true, status: 200, latency_ms: r.latency_ms }
+        : { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+const elevenlabsTest = async (key, opts) => {
+    const r = await probeFetch('https://api.elevenlabs.io/v1/user', {
+        headers: { 'xi-api-key': key, 'user-agent': 'yujin-forge' },
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    return r.status === 200
+        ? { ok: true, status: 200, latency_ms: r.latency_ms }
+        : { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+const googleVoiceTest = async (key, opts) => {
+    /* Google Cloud TTS lives behind a service account; the slot
+       stores the JSON SA file. We do a syntactic check (parses
+       as JSON with required fields). Network probe would need
+       token exchange which is heavier. */
+    let parsed = null;
+    try {
+        parsed = JSON.parse(key);
+    }
+    catch { /* not JSON */ }
+    if (!parsed || parsed.type !== 'service_account' || !parsed.client_email) {
+        return {
+            ok: false, status: 0,
+            detail: 'value is not a Google service-account JSON',
+            latency_ms: 0,
+        };
+    }
+    return { ok: true, status: 200, latency_ms: 0, detail: 'syntactic check (no network probe)' };
+};
+/* ---------- cloud ---------- */
+const awsTest = async (_value, _opts) => {
+    /* AWS sigv4 signing is heavy; we just emit a syntactic check
+       marker. Real auth happens when a tool uses the key. */
+    return { ok: true, status: 200, latency_ms: 0,
+        detail: 'syntactic check (no STS probe in this slice)' };
+};
+/* ---------- app ---------- */
+const slackTest = async (token, opts) => {
+    const r = await probeFetch('https://slack.com/api/auth.test', {
+        method: 'POST',
+        headers: { authorization: 'Bearer ' + token, 'user-agent': 'yujin-forge' },
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    let body = {};
+    try {
+        body = JSON.parse(r.bodyText);
+    }
+    catch { /* leave as {} */ }
+    return body.ok
+        ? { ok: true, status: r.status, latency_ms: r.latency_ms }
+        : { ok: false, status: r.status, detail: body.error || extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+const discordTest = async (token, opts) => {
+    const r = await probeFetch('https://discord.com/api/v10/users/@me', {
+        headers: { authorization: 'Bot ' + token, 'user-agent': 'yujin-forge' },
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    return r.status === 200
+        ? { ok: true, status: 200, latency_ms: r.latency_ms }
+        : { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+const stripeTest = async (key, opts) => {
+    const r = await probeFetch('https://api.stripe.com/v1/balance', {
+        headers: { authorization: 'Bearer ' + key, 'user-agent': 'yujin-forge' },
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    return r.status === 200
+        ? { ok: true, status: 200, latency_ms: r.latency_ms }
+        : { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+const sendgridTest = async (key, opts) => {
+    const r = await probeFetch('https://api.sendgrid.com/v3/scopes', {
+        headers: { authorization: 'Bearer ' + key, 'user-agent': 'yujin-forge' },
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    return r.status === 200
+        ? { ok: true, status: 200, latency_ms: r.latency_ms }
+        : { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+const linearTest = async (token, opts) => {
+    const r = await probeFetch('https://api.linear.app/graphql', {
+        method: 'POST',
+        headers: { authorization: token, 'content-type': 'application/json',
+            'user-agent': 'yujin-forge' },
+        body: JSON.stringify({ query: '{ viewer { id } }' }),
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    return r.status === 200
+        ? { ok: true, status: 200, latency_ms: r.latency_ms }
+        : { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+const notionTest = async (token, opts) => {
+    const r = await probeFetch('https://api.notion.com/v1/users/me', {
+        headers: { authorization: 'Bearer ' + token, 'notion-version': '2022-06-28',
+            'user-agent': 'yujin-forge' },
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    return r.status === 200
+        ? { ok: true, status: 200, latency_ms: r.latency_ms }
+        : { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+const figmaTest = async (token, opts) => {
+    const r = await probeFetch('https://api.figma.com/v1/me', {
+        headers: { 'x-figma-token': token, 'user-agent': 'yujin-forge' },
+    }, opts.timeoutMs);
+    if (r.err)
+        return { ok: false, status: 0, detail: r.err, latency_ms: r.latency_ms };
+    return r.status === 200
+        ? { ok: true, status: 200, latency_ms: r.latency_ms }
+        : { ok: false, status: r.status, detail: extractError(r.bodyText), latency_ms: r.latency_ms };
+};
+const twilioTest = async (_token, _opts) => {
+    /* Twilio requires SID + auth_token as basic; we cannot probe
+       just one. Emit a syntactic check that the value looks like
+       an auth token (32 hex chars). */
+    const ok = /^[a-f0-9]{32,}$/.test(_token);
+    return { ok, status: ok ? 200 : 0,
+        detail: ok ? 'syntactic check (needs paired twilio_account_sid for real probe)'
+            : 'value does not look like a 32-hex auth token',
+        latency_ms: 0 };
+};
+function extractError(bodyText) {
+    if (!bodyText)
+        return '';
+    try {
+        const parsed = JSON.parse(bodyText);
+        if (parsed.message)
+            return String(parsed.message).slice(0, 120);
+        if (parsed.error)
+            return String(parsed.error).slice(0, 120);
+        if (parsed.detail)
+            return String(parsed.detail).slice(0, 120);
+    }
+    catch { /* fall through */ }
+    return bodyText.slice(0, 120);
+}
+/* The catalog itself. Order is preserved for UI listing. */
+export const SLOT_CATALOG = [
+    /* repo */
+    { name: 'github_token', kind: 'repo',
+        description: 'GitHub Personal Access Token (ghp_* / github_pat_*)',
+        obtainUrl: 'https://github.com/settings/tokens',
+        test: githubTest },
+    { name: 'gitlab_token', kind: 'repo',
+        description: 'GitLab Personal Access Token (glpat-*)',
+        obtainUrl: 'https://gitlab.com/-/user_settings/personal_access_tokens',
+        test: gitlabTest },
+    { name: 'bitbucket_token', kind: 'repo',
+        description: 'Bitbucket App Password (paired user:pwd or pwd only)',
+        obtainUrl: 'https://bitbucket.org/account/settings/app-passwords/',
+        test: bitbucketTest },
+    { name: 'ssh_key', kind: 'repo',
+        description: 'SSH private key for repo push (paste full PEM body)' },
+    /* registry */
+    { name: 'npm_token', kind: 'registry',
+        description: 'npmjs.com automation token (Publish + Read)',
+        obtainUrl: 'https://www.npmjs.com/settings/~/tokens',
+        test: npmTest },
+    { name: 'pypi_token', kind: 'registry',
+        description: 'PyPI API token (starts with pypi-*)',
+        obtainUrl: 'https://pypi.org/manage/account/token/',
+        test: pypiTest },
+    { name: 'maven_token', kind: 'registry',
+        description: 'Sonatype OSSRH token (user:password)' },
+    { name: 'docker_token', kind: 'registry',
+        description: 'DockerHub Personal Access Token',
+        obtainUrl: 'https://hub.docker.com/settings/security',
+        test: dockerTest },
+    { name: 'homebrew_token', kind: 'registry',
+        description: 'GitHub token with repo scope for brew tap publishing' },
+    /* ai */
+    { name: 'anthropic', kind: 'ai',
+        description: 'Anthropic API key (sk-ant-*)',
+        obtainUrl: 'https://console.anthropic.com/settings/keys',
+        test: anthropicTest },
+    { name: 'openai', kind: 'ai',
+        description: 'OpenAI API key (sk-* or sk-proj-*)',
+        obtainUrl: 'https://platform.openai.com/api-keys',
+        test: openaiTest },
+    { name: 'elevenlabs', kind: 'ai',
+        description: 'ElevenLabs API key',
+        obtainUrl: 'https://elevenlabs.io/app/settings/api-keys',
+        test: elevenlabsTest },
+    { name: 'google_voice', kind: 'ai',
+        description: 'Google Cloud Service Account JSON for Speech-to-Text + Text-to-Speech',
+        obtainUrl: 'https://console.cloud.google.com/iam-admin/serviceaccounts',
+        test: googleVoiceTest },
+    /* cloud */
+    { name: 'aws_access_key_id', kind: 'cloud',
+        description: 'AWS Access Key ID (AKIA*)',
+        obtainUrl: 'https://console.aws.amazon.com/iam/home#/security_credentials',
+        test: awsTest },
+    { name: 'aws_secret_access_key', kind: 'cloud',
+        description: 'AWS Secret Access Key (paired with aws_access_key_id)',
+        test: awsTest },
+    { name: 'gcp_service_account', kind: 'cloud',
+        description: 'GCP Service Account JSON',
+        obtainUrl: 'https://console.cloud.google.com/iam-admin/serviceaccounts',
+        test: googleVoiceTest /* same JSON syntactic check */ },
+    { name: 'azure_service_principal', kind: 'cloud',
+        description: 'Azure SP credentials (JSON with clientId, clientSecret, tenantId)' },
+    /* app */
+    { name: 'slack_bot_token', kind: 'app',
+        description: 'Slack bot token (xoxb-*)',
+        obtainUrl: 'https://api.slack.com/apps',
+        test: slackTest },
+    { name: 'discord_bot_token', kind: 'app',
+        description: 'Discord bot token (from a Discord application)',
+        obtainUrl: 'https://discord.com/developers/applications',
+        test: discordTest },
+    { name: 'twilio_account_sid', kind: 'app',
+        description: 'Twilio Account SID (AC*)',
+        obtainUrl: 'https://console.twilio.com/' },
+    { name: 'twilio_auth_token', kind: 'app',
+        description: 'Twilio Auth Token (32 hex chars)',
+        obtainUrl: 'https://console.twilio.com/',
+        test: twilioTest },
+    { name: 'stripe_secret_key', kind: 'app',
+        description: 'Stripe Secret Key (sk_live_* or sk_test_*)',
+        obtainUrl: 'https://dashboard.stripe.com/apikeys',
+        test: stripeTest },
+    { name: 'sendgrid_api_key', kind: 'app',
+        description: 'SendGrid API Key (SG.*)',
+        obtainUrl: 'https://app.sendgrid.com/settings/api_keys',
+        test: sendgridTest },
+    { name: 'mailgun_api_key', kind: 'app',
+        description: 'Mailgun API Key',
+        obtainUrl: 'https://app.mailgun.com/app/account/security/api_keys' },
+    { name: 'linear_token', kind: 'app',
+        description: 'Linear API key',
+        obtainUrl: 'https://linear.app/settings/api',
+        test: linearTest },
+    { name: 'notion_token', kind: 'app',
+        description: 'Notion integration token (secret_*)',
+        obtainUrl: 'https://www.notion.so/profile/integrations',
+        test: notionTest },
+    { name: 'figma_token', kind: 'app',
+        description: 'Figma Personal Access Token',
+        obtainUrl: 'https://www.figma.com/settings',
+        test: figmaTest },
+];
+/** Look up a catalog entry by exact name. Returns undefined
+ *  when the slot is custom (user-defined). */
+export function lookupCatalog(name) {
+    return SLOT_CATALOG.find((e) => e.name === name);
+}
+/** Infer the kind for a slot name: catalog hit -> its kind,
+ *  miss -> 'custom'. */
+export function inferKind(name) {
+    const entry = lookupCatalog(name);
+    return entry ? entry.kind : 'custom';
+}
+/** Indexed view of the catalog by kind. */
+export function catalogByKind() {
+    const out = {
+        repo: [], registry: [], ai: [], cloud: [], app: [], custom: [],
+    };
+    for (const e of SLOT_CATALOG)
+        out[e.kind].push(e);
+    return out;
+}
+//# sourceMappingURL=catalog.js.map