@namzu/cli 32.0.0 → 33.1.0

package/dist/config/user-config.d.ts

@@ -20,4 +20,6 @@ export declare function userConfigPath(opts?: UserConfigWriteOptions): string;
  * when it cannot be read as YAML or written.
  */
 export declare function setUserConfigValue(path: readonly string[], value: unknown, opts?: UserConfigWriteOptions): string;
+/** Remove one user-owned setting while preserving the rest of the YAML document. */
+export declare function deleteUserConfigValue(path: readonly string[], opts?: UserConfigWriteOptions): boolean;
 //# sourceMappingURL=user-config.d.ts.map

package/dist/config/user-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-config.d.ts","sourceRoot":"","sources":["../../src/config/user-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,MAAM,WAAW,sBAAsB;IACtC,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAChC;AAED,wBAAgB,cAAc,CAAC,IAAI,GAAE,sBAA2B,GAAG,MAAM,CAKxE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,sBAA2B,GAC/B,MAAM,CA0BR"}
+{"version":3,"file":"user-config.d.ts","sourceRoot":"","sources":["../../src/config/user-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAqBH,MAAM,WAAW,sBAAsB;IACtC,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAChC;AAED,wBAAgB,cAAc,CAAC,IAAI,GAAE,sBAA2B,GAAG,MAAM,CAKxE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,sBAA2B,GAC/B,MAAM,CAsBR;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CACpC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,GAAE,sBAA2B,GAC/B,OAAO,CAwBT"}

package/dist/config/user-config.js

@@ -8,9 +8,12 @@
  * parse is refused rather than rewritten: rewriting it would drop whatever
  * the operator was in the middle of writing.
  */
-import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
+import { platform } from 'node:os';
 import { dirname, join } from 'node:path';
 import { Document, isMap, parseDocument } from 'yaml';
+import { restrictToOwner } from '../integrations/providers/credential-store.js';
 import { resolveNamzuHome } from '../integrations/state/home.js';
 export function userConfigPath(opts = {}) {
     return join(resolveNamzuHome({ ...(opts.home ? { home: opts.home } : {}), env: opts.env ?? process.env }), 'config.yaml');
@@ -38,11 +41,78 @@ export function setUserConfigValue(path, value, opts = {}) {
         }
     }
     doc.setIn(path, value);
-    mkdirSync(dirname(file), { recursive: true });
-    const temp = `${file}.${process.pid}.tmp`;
-    // The file keeps its own permissions; a new one is the owner's alone.
-    writeFileSync(temp, doc.toString(), { mode: exists ? statSync(file).mode & 0o777 : 0o600 });
-    renameSync(temp, file);
+    writePrivateUserConfig(file, doc);
     return file;
 }
+/** Remove one user-owned setting while preserving the rest of the YAML document. */
+export function deleteUserConfigValue(path, opts = {}) {
+    const file = userConfigPath(opts);
+    if (!existsSync(file))
+        return false;
+    const text = readFileSync(file, 'utf8');
+    const doc = parseDocument(text);
+    if (doc.errors.length > 0) {
+        throw new Error(`${file} is not valid YAML (${doc.errors[0]?.message ?? 'parse error'}); fix it first`);
+    }
+    if (doc.contents !== null && !isMap(doc.contents)) {
+        throw new Error(`${file} is not a mapping of settings; fix it first`);
+    }
+    for (let depth = 1; depth < path.length; depth += 1) {
+        const parent = doc.getIn(path.slice(0, depth), true);
+        if (parent === undefined || parent === null)
+            return false;
+        if (!isMap(parent)) {
+            throw new Error(`${file}: ${path.slice(0, depth).join('.')} is not a mapping; fix it first`);
+        }
+    }
+    if (!doc.hasIn(path))
+        return false;
+    doc.deleteIn(path);
+    writePrivateUserConfig(file, doc);
+    return true;
+}
+/** Replacing an old config must never carry its broad mode onto a secret-bearing copy. */
+function writePrivateUserConfig(file, doc) {
+    const parent = dirname(file);
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    if (platform() === 'win32') {
+        const entry = lstatSync(parent);
+        if (entry.isSymbolicLink() || !entry.isDirectory()) {
+            throw new Error(`User config directory must be a real directory: ${parent}`);
+        }
+        // POSIX 0600 has no ACL meaning on Windows. Secure the parent before
+        // opening a temp file and prove that file private while it is still empty.
+        restrictToOwner(parent);
+    }
+    const temp = `${file}.${process.pid}.${randomUUID()}.tmp`;
+    let fd;
+    try {
+        fd = openSync(temp, 'wx', 0o600);
+        restrictToOwner(temp);
+        writeFileSync(fd, doc.toString());
+        closeSync(fd);
+        fd = undefined;
+        restrictToOwner(temp);
+        renameSync(temp, file);
+    }
+    catch (error) {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                // The file remains private; still try to remove its name.
+            }
+        }
+        try {
+            rmSync(temp, { force: true });
+        }
+        catch (cleanupError) {
+            throw new Error(`Private user-config temporary file could not be removed: ${temp}`, {
+                cause: new AggregateError([error, cleanupError]),
+            });
+        }
+        throw error;
+    }
+}
 //# sourceMappingURL=user-config.js.map

package/dist/config/user-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-config.js","sourceRoot":"","sources":["../../src/config/user-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAClG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAQhE,MAAM,UAAU,cAAc,CAAC,OAA+B,EAAE;IAC/D,OAAO,IAAI,CACV,gBAAgB,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,EAC7F,aAAa,CACb,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CACjC,IAAuB,EACvB,KAAc,EACd,OAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC3E,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,uBAAuB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,aAAa,iBAAiB,CACtF,CAAA;IACF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAA;IACtE,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAA;QACpD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;QAC7F,CAAC;IACF,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACtB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAA;IACzC,sEAAsE;IACtE,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;IAC3F,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACtB,OAAO,IAAI,CAAA;AACZ,CAAC"}
+{"version":3,"file":"user-config.js","sourceRoot":"","sources":["../../src/config/user-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EACN,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,MAAM,EACN,aAAa,GACb,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAQhE,MAAM,UAAU,cAAc,CAAC,OAA+B,EAAE;IAC/D,OAAO,IAAI,CACV,gBAAgB,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,EAC7F,aAAa,CACb,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CACjC,IAAuB,EACvB,KAAc,EACd,OAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC3E,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,uBAAuB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,aAAa,iBAAiB,CACtF,CAAA;IACF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAA;IACtE,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAA;QACpD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;QAC7F,CAAC;IACF,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACtB,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACjC,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,qBAAqB,CACpC,IAAuB,EACvB,OAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,uBAAuB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,aAAa,iBAAiB,CACtF,CAAA;IACF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAA;IACtE,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAA;QACpD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;QACzD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;QAC7F,CAAC;IACF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAClC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAClB,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACjC,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,0FAA0F;AAC1F,SAAS,sBAAsB,CAAC,IAAY,EAAE,GAAa;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACnD,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QAC/B,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,mDAAmD,MAAM,EAAE,CAAC,CAAA;QAC7E,CAAC;QACD,qEAAqE;QACrE,2EAA2E;QAC3E,eAAe,CAAC,MAAM,CAAC,CAAA;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAA;IACzD,IAAI,EAAsB,CAAA;IAC1B,IAAI,CAAC;QACJ,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QAChC,eAAe,CAAC,IAAI,CAAC,CAAA;QACrB,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;QACjC,SAAS,CAAC,EAAE,CAAC,CAAA;QACb,EAAE,GAAG,SAAS,CAAA;QACd,eAAe,CAAC,IAAI,CAAC,CAAA;QACrB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC;gBACJ,SAAS,CAAC,EAAE,CAAC,CAAA;YACd,CAAC;YAAC,MAAM,CAAC;gBACR,0DAA0D;YAC3D,CAAC;QACF,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9B,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,4DAA4D,IAAI,EAAE,EAAE;gBACnF,KAAK,EAAE,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;aAChD,CAAC,CAAA;QACH,CAAC;QACD,MAAM,KAAK,CAAA;IACZ,CAAC;AACF,CAAC"}

package/dist/doctor/checks/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,YAAY,CAAA;AAIhE;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAsDpC,CAAA"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,YAAY,CAAA;AAIhE;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAwDpC,CAAA"}

package/dist/doctor/checks/credentials.js

@@ -53,6 +53,8 @@ export const credentialSourcesCheck = {
                     return `${d.entry.id} (Claude session · ${d.source.path})`;
                 case 'gemini-file':
                     return `${d.entry.id} (Gemini session · ${d.source.path})`;
+                case 'stored-gemini-key':
+                    return `${d.entry.id} (saved Gemini API key · ${d.source.path})`;
                 case 'codex-file':
                     return `${d.entry.id} (Codex session · ${d.source.path})`;
                 case 'stored':

package/dist/doctor/checks/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/doctor/checks/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAE5E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAgB;IAClD,EAAE,EAAE,uBAAuB;IAC3B,QAAQ,EAAE,WAAW;IACrB,GAAG,EAAE,KAAK,IAAgC,EAAE;QAC3C,IAAI,QAAuD,CAAA;QAC3D,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,iBAAiB,EAAE,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,sEAAsE;YACtE,OAAO;gBACN,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC3F,CAAA;QACF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACN,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,yBAAyB;gBAClC,WAAW,EACV,kTAAkT;aACnT,CAAA;QACF,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACvB,KAAK,KAAK;oBACT,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,CAAA;gBACnD,KAAK,QAAQ;oBACZ,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,uDAAuD,CAAA;gBAC5E,KAAK,eAAe;oBACnB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,wBAAwB,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;gBAC7D,KAAK,UAAU;oBACd,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,CAAA;gBACxD,KAAK,aAAa;oBACjB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;gBAC3D,KAAK,aAAa;oBACjB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;gBAC3D,KAAK,YAAY;oBAChB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;gBAC1D,KAAK,QAAQ;oBACZ,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;gBACtD,KAAK,OAAO;oBACX,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,GAAG,CAAA;gBAC7E,KAAK,SAAS;oBACb,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,4BAA4B,CAAA;YAClD,CAAC;QACF,CAAC,CAAC,CAAA;QACF,OAAO;YACN,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,kCAAkC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC/E,CAAA;IACF,CAAC;CACD,CAAA"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/doctor/checks/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAE5E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAgB;IAClD,EAAE,EAAE,uBAAuB;IAC3B,QAAQ,EAAE,WAAW;IACrB,GAAG,EAAE,KAAK,IAAgC,EAAE;QAC3C,IAAI,QAAuD,CAAA;QAC3D,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,iBAAiB,EAAE,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,sEAAsE;YACtE,OAAO;gBACN,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC3F,CAAA;QACF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACN,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,yBAAyB;gBAClC,WAAW,EACV,kTAAkT;aACnT,CAAA;QACF,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACvB,KAAK,KAAK;oBACT,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,CAAA;gBACnD,KAAK,QAAQ;oBACZ,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,uDAAuD,CAAA;gBAC5E,KAAK,eAAe;oBACnB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,wBAAwB,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;gBAC7D,KAAK,UAAU;oBACd,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,CAAA;gBACxD,KAAK,aAAa;oBACjB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;gBAC3D,KAAK,aAAa;oBACjB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;gBAC3D,KAAK,mBAAmB;oBACvB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,4BAA4B,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;gBACjE,KAAK,YAAY;oBAChB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;gBAC1D,KAAK,QAAQ;oBACZ,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;gBACtD,KAAK,OAAO;oBACX,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,GAAG,CAAA;gBAC7E,KAAK,SAAS;oBACb,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,4BAA4B,CAAA;YAClD,CAAC;QACF,CAAC,CAAC,CAAA;QACF,OAAO;YACN,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,kCAAkC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC/E,CAAA;IACF,CAAC;CACD,CAAA"}

package/dist/integrations/mcp/oauth-store.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Namzu-owned MCP OAuth state. Each complete resource endpoint has its own
+ * private file: a token for one path or query must never be sent to another.
+ * Discovery and PKCE state share that file so a browser round trip cannot
+ * accidentally resume against a different authorization server.
+ */
+import type { OAuthClientProvider } from '@modelcontextprotocol/client';
+export declare class McpOAuthStoreError extends Error {
+    readonly name = "McpOAuthStoreError";
+}
+export declare class McpOAuthLoginRequiredError extends Error {
+    readonly name = "McpOAuthLoginRequiredError";
+    constructor();
+}
+export interface McpOAuthProviderOptions {
+    /** The complete configured MCP URL, including its path and query. */
+    readonly endpoint: string;
+    /** Existing credential-store test seam: the OS home, not NAMZU_HOME. */
+    readonly home?: string;
+    /** The loopback callback for an interactive login. Omit in a running agent. */
+    readonly redirectUrl?: string;
+    /** Only an explicit login may open a browser. */
+    readonly onRedirect?: (authorizationUrl: URL) => void | Promise<void>;
+}
+/** Shared network policy for interactive sign-in and background token refresh. */
+export declare function isSecureMcpOAuthUrl(url: URL): boolean;
+/** A hash keeps possibly secret URL path and query values out of file names. */
+export declare function mcpOAuthPath(endpoint: string, home?: string): string;
+/** True only for a private, issuer-stamped token belonging to this exact URL. */
+export declare function hasMcpOAuthTokens(endpoint: string, home?: string): boolean;
+/** Validate and consume state before passing callback parameters to `finishAuth`. */
+export declare function consumeMcpOAuthCallbackState(endpoint: string, state: string | null, home?: string): void;
+export declare function clearMcpOAuthPending(endpoint: string, home?: string): void;
+/** Remove only this URL's credentials; another server on the same host survives. */
+export declare function clearMcpOAuthCredentials(endpoint: string, home?: string): boolean;
+/** The official MCP client consumes this provider for login and token refresh. */
+export declare function createMcpOAuthProvider(options: McpOAuthProviderOptions): OAuthClientProvider;
+/** The authorization-server identity captured before the browser opened. */
+export declare function pendingMcpOAuthIssuer(endpoint: string, home?: string): string | null;
+//# sourceMappingURL=oauth-store.d.ts.map

package/dist/integrations/mcp/oauth-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-store.d.ts","sourceRoot":"","sources":["../../../src/integrations/mcp/oauth-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmBH,OAAO,KAAK,EAGX,mBAAmB,EAInB,MAAM,8BAA8B,CAAA;AASrC,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,SAAkB,IAAI,wBAAuB;CAC7C;AAED,qBAAa,0BAA2B,SAAQ,KAAK;IACpD,SAAkB,IAAI,gCAA+B;;CAIrD;AAyBD,MAAM,WAAW,uBAAuB;IACvC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,gBAAgB,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACrE;AAkBD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAQrD;AAeD,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAIpE;AA0PD,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAG1E;AAED,qFAAqF;AACrF,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,IAAI,CAAC,EAAE,MAAM,GACX,IAAI,CAoBN;AAQD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAM1E;AAED,oFAAoF;AACpF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAmBjF;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,mBAAmB,CA6L5F;AAED,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKpF"}