@omniaseo/cli 0.1.0

package/dist/commands/m2.js

@@ -0,0 +1,83 @@
+import { CliError, EXIT } from '../errors.js';
+export async function whoami(client) {
+    return client.invoke('omnia_workspace_get_context', { includeModules: true });
+}
+export async function capabilities(client) {
+    const [actions, context] = await Promise.all([
+        client.list(),
+        client.invoke('omnia_workspace_get_context', { includeModules: true }),
+    ]);
+    return {
+        context,
+        actions: actions.map((action) => ({
+            slug: action.slug,
+            version: action.version,
+            requiredScopes: action.requiredScopes,
+            effects: action.effects,
+            riskLevel: action.riskLevel,
+            approvalPolicy: action.approvalPolicyDefault,
+            retryMode: action.retryMode,
+            enabled: action.enabled,
+        })),
+    };
+}
+export async function effectiveScopes(client) {
+    const context = await client.invoke('omnia_workspace_get_context', { includeModules: false });
+    const connection = context.connection;
+    if (!connection || typeof connection !== 'object' || !Array.isArray(connection.scopes)) {
+        throw new CliError('Workspace context did not contain effective connection scopes', 'SCOPES_UNAVAILABLE', EXIT.VALIDATION);
+    }
+    return { scopes: connection.scopes };
+}
+export async function approvalList(client, options) {
+    return client.invoke('omnia_approval_list', {
+        ...(options.cursor ? { cursor: options.cursor } : {}),
+        ...(options.limit === undefined ? {} : { limit: options.limit }),
+        ...(options.state ? { state: options.state } : {}),
+        ...(options.actionSlug ? { actionSlug: options.actionSlug } : {}),
+    });
+}
+export async function approvalOpen(client, approvalId) {
+    return client.invoke('omnia_approval_get', { approvalId });
+}
+export async function approvalWait(client, approvalId, timeoutMs) {
+    return client.invoke('omnia_approval_wait', { approvalId, ...(timeoutMs === undefined ? {} : { timeoutMs }) });
+}
+export async function auditTail(client, options) {
+    return client.invoke('omnia_activity_recent', {
+        ...(options.cursor ? { cursor: options.cursor } : {}),
+        ...(options.limit === undefined ? {} : { limit: options.limit }),
+        ...(options.since ? { since: options.since } : {}),
+        ...(options.outcome ? { outcome: options.outcome } : {}),
+    });
+}
+export async function auditExport(client, options) {
+    return client.invoke('omnia_activity_export', {
+        idempotencyKey: options.idempotencyKey,
+        ...(options.since ? { since: options.since } : {}),
+        ...(options.until ? { until: options.until } : {}),
+        ...(options.actionSlug ? { actionSlug: options.actionSlug } : {}),
+        ...(options.resourceType ? { resourceType: options.resourceType } : {}),
+        ...(options.effect ? { effect: options.effect } : {}),
+        ...(options.outcome ? { outcome: options.outcome } : {}),
+        ...(options.maxRows === undefined ? {} : { maxRows: options.maxRows }),
+    });
+}
+export async function connectionList(client) { return client.list(); }
+export async function connectionInspect(client, id) { return client.inspect(id); }
+export async function connectionUpdate(client, id, name, expectedUpdatedAt) {
+    if (!name.trim() || name.length > 200)
+        throw new CliError('Connection name must contain 1-200 characters', 'CONNECTION_UPDATE_INVALID', EXIT.USAGE);
+    if (!Number.isFinite(Date.parse(expectedUpdatedAt)))
+        throw new CliError('Expected updatedAt must be an ISO date', 'CONNECTION_UPDATE_INVALID', EXIT.USAGE);
+    return client.update(id, { name: name.trim(), expectedUpdatedAt });
+}
+export async function connectionRevoke(client, id, approved) {
+    if (!approved)
+        throw new CliError('Connection revocation requires --yes', 'CONFIRMATION_REQUIRED', EXIT.USAGE);
+    return client.revoke(id);
+}
+export function backendBlocked(capability) {
+    throw new CliError(`${capability} commands require a real backend capability that is not available`, `${capability.toUpperCase()}_BACKEND_UNAVAILABLE`, EXIT.UNSUPPORTED_HOST, { status: capability === 'schedule' ? 'UNSUPPORTED' : 'BLOCKED', capability, reason: 'BACKEND_NOT_IMPLEMENTED' });
+}
+//# sourceMappingURL=m2.js.map

package/dist/commands/m2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"m2.js","sourceRoot":"","sources":["../../src/commands/m2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAI9C,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAA0B;IACrD,OAAO,MAAM,CAAC,MAAM,CAAC,6BAA6B,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAA0B;IAC3D,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,MAAM,CAAC,IAAI,EAAE;QACb,MAAM,CAAC,MAAM,CAA0B,6BAA6B,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;KAChG,CAAC,CAAC;IACH,OAAO;QACL,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,MAAM,CAAC,qBAAqB;YAC5C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAA0B;IAC9D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAA0B,6BAA6B,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IACvH,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAE,UAAsC,CAAC,MAAM,CAAC,EAAE,CAAC;QACpH,MAAM,IAAI,QAAQ,CAAC,+DAA+D,EAAE,oBAAoB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7H,CAAC;IACD,OAAO,EAAE,MAAM,EAAG,UAAoC,CAAC,MAAM,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA0B,EAC1B,OAAiF;IAEjF,OAAO,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE;QAC1C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAA0B,EAAE,UAAkB;IAC/E,OAAO,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAA0B,EAAE,UAAkB,EAAE,SAAkB;IACnG,OAAO,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AACjH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAA0B,EAC1B,OAA8E;IAE9E,OAAO,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE;QAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAA0B,EAC1B,OAAoK;IAEpK,OAAO,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE;QAC5C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;KACvE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAwB,IAAsB,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1G,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAwB,EAAE,EAAU,IAAsB,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9H,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAwB,EAAE,EAAU,EAAE,IAAY,EAAE,iBAAyB;IAClH,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,QAAQ,CAAC,+CAA+C,EAAE,2BAA2B,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpJ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,wCAAwC,EAAE,2BAA2B,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3J,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;AACrE,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAwB,EAAE,EAAU,EAAE,QAAiB;IAC5F,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,sCAAsC,EAAE,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/G,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAA+C;IAC5E,MAAM,IAAI,QAAQ,CAChB,GAAG,UAAU,mEAAmE,EAChF,GAAG,UAAU,CAAC,WAAW,EAAE,sBAAsB,EACjD,IAAI,CAAC,gBAAgB,EACrB,EAAE,MAAM,EAAE,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,yBAAyB,EAAE,CACjH,CAAC;AACJ,CAAC"}

package/dist/config/cli.d.ts

@@ -0,0 +1,11 @@
+export type CliConfig = {
+    apiOrigin: string;
+    oauthIssuer: string;
+    oauthClientId: string;
+    oauthResource: string;
+    oauthRedirectUri: string;
+    oauthScopes: readonly string[];
+    managementUrl?: string;
+};
+export declare function loadCliConfig(env?: NodeJS.ProcessEnv): CliConfig;
+//# sourceMappingURL=cli.d.ts.map

package/dist/config/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/config/cli.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GAAG;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAgCF,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CA+C7E"}

package/dist/config/cli.js

@@ -0,0 +1,62 @@
+import { CliError, EXIT } from '../errors.js';
+const required = (env, name) => {
+    const value = env[name]?.trim();
+    if (!value) {
+        throw new CliError(`External CLI OAuth is not configured: ${name} is required`, 'CLI_OAUTH_NOT_CONFIGURED', EXIT.AUTH_BLOCKED, { status: 'BLOCKED', missing: name });
+    }
+    return value;
+};
+function secureUrl(value, name, loopback = false) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new CliError(`${name} must be an absolute URL`, 'CLI_CONFIG_INVALID', EXIT.CONFIG_CONFLICT);
+    }
+    const loopbackHttp = loopback && url.protocol === 'http:' && (url.hostname === '127.0.0.1' || url.hostname === '[::1]');
+    if (url.protocol !== 'https:' && !loopbackHttp) {
+        throw new CliError(`${name} must use HTTPS`, 'CLI_CONFIG_INVALID', EXIT.CONFIG_CONFLICT);
+    }
+    if (url.username || url.password || url.hash || url.search) {
+        throw new CliError(`${name} must not contain credentials, query parameters or a fragment`, 'CLI_CONFIG_INVALID', EXIT.CONFIG_CONFLICT);
+    }
+    return url.toString();
+}
+export function loadCliConfig(env = process.env) {
+    const redirect = secureUrl(required(env, 'OMNIA_CLI_OAUTH_REDIRECT_URI'), 'OMNIA_CLI_OAUTH_REDIRECT_URI', true);
+    const redirectUrl = new URL(redirect);
+    if (redirectUrl.protocol !== 'http:' || !['127.0.0.1', '[::1]'].includes(redirectUrl.hostname) || !redirectUrl.port || redirectUrl.search) {
+        throw new CliError('OMNIA_CLI_OAUTH_REDIRECT_URI must be an exact fixed-port loopback URL without query parameters', 'CLI_CONFIG_INVALID', EXIT.CONFIG_CONFLICT);
+    }
+    const scopes = required(env, 'OMNIA_CLI_OAUTH_SCOPES').split(/[ ,]+/u).map((scope) => scope.trim()).filter(Boolean);
+    if (scopes.length === 0 || scopes.some((scope) => scope.length > 120)) {
+        throw new CliError('OMNIA_CLI_OAUTH_SCOPES is invalid', 'CLI_CONFIG_INVALID', EXIT.CONFIG_CONFLICT);
+    }
+    const management = env.OMNIA_CLI_MANAGEMENT_URL?.trim();
+    const apiOrigin = secureUrl(required(env, 'OMNIA_CLI_API_ORIGIN'), 'OMNIA_CLI_API_ORIGIN');
+    const oauthResource = secureUrl(required(env, 'OMNIA_CLI_OAUTH_RESOURCE'), 'OMNIA_CLI_OAUTH_RESOURCE');
+    const apiUrl = new URL(apiOrigin);
+    const resourceUrl = new URL(oauthResource);
+    if (apiUrl.pathname !== '/' || resourceUrl.pathname !== '/' || apiUrl.toString() !== resourceUrl.toString()) {
+        throw new CliError('OMNIA_CLI_API_ORIGIN and OMNIA_CLI_OAUTH_RESOURCE must identify the same origin-level protected resource', 'CLI_CONFIG_INVALID', EXIT.CONFIG_CONFLICT);
+    }
+    const oauthClientId = required(env, 'OMNIA_CLI_OAUTH_CLIENT_ID');
+    if (oauthClientId.length > 200 || /[\u0000-\u001f\u007f]/u.test(oauthClientId)) {
+        throw new CliError('OMNIA_CLI_OAUTH_CLIENT_ID is invalid', 'CLI_CONFIG_INVALID', EXIT.CONFIG_CONFLICT);
+    }
+    const managementUrl = management ? secureUrl(management, 'OMNIA_CLI_MANAGEMENT_URL') : undefined;
+    if (managementUrl && new URL(managementUrl).origin !== new URL(apiOrigin).origin) {
+        throw new CliError('OMNIA_CLI_MANAGEMENT_URL must share the protected API origin', 'CLI_CONFIG_INVALID', EXIT.CONFIG_CONFLICT);
+    }
+    return {
+        apiOrigin,
+        oauthIssuer: secureUrl(required(env, 'OMNIA_CLI_OAUTH_ISSUER'), 'OMNIA_CLI_OAUTH_ISSUER'),
+        oauthClientId,
+        oauthResource,
+        oauthRedirectUri: redirect,
+        oauthScopes: [...new Set([...scopes, 'offline_access'])],
+        ...(managementUrl ? { managementUrl } : {}),
+    };
+}
+//# sourceMappingURL=cli.js.map

package/dist/config/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/config/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAY9C,MAAM,QAAQ,GAAG,CAAC,GAAsB,EAAE,IAAY,EAAU,EAAE;IAChE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAChB,yCAAyC,IAAI,cAAc,EAC3D,0BAA0B,EAC1B,IAAI,CAAC,YAAY,EACjB,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,KAAa,EAAE,IAAY,EAAE,QAAQ,GAAG,KAAK;IAC9D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,GAAG,IAAI,0BAA0B,EAAE,oBAAoB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IACxH,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/C,MAAM,IAAI,QAAQ,CAAC,GAAG,IAAI,iBAAiB,EAAE,oBAAoB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC3D,MAAM,IAAI,QAAQ,CAAC,GAAG,IAAI,+DAA+D,EAAE,oBAAoB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzI,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,8BAA8B,CAAC,EAAE,8BAA8B,EAAE,IAAI,CAAC,CAAC;IAChH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,WAAW,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QAC1I,MAAM,IAAI,QAAQ,CAChB,gGAAgG,EAChG,oBAAoB,EACpB,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,QAAQ,CAAC,mCAAmC,EAAE,oBAAoB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC3F,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACvG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,WAAW,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC5G,MAAM,IAAI,QAAQ,CAChB,0GAA0G,EAC1G,oBAAoB,EACpB,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACjE,IAAI,aAAa,CAAC,MAAM,GAAG,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,QAAQ,CAAC,sCAAsC,EAAE,oBAAoB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,IAAI,aAAa,IAAI,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;QACjF,MAAM,IAAI,QAAQ,CAChB,8DAA8D,EAC9D,oBAAoB,EACpB,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;QACzF,aAAa;QACb,aAAa;QACb,gBAAgB,EAAE,QAAQ;QAC1B,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/config/secrets.d.ts

@@ -0,0 +1,2 @@
+export declare function hasSecretLikeKey(value: unknown): boolean;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/config/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/config/secrets.ts"],"names":[],"mappings":"AAEA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGxD"}

package/dist/config/secrets.js

@@ -0,0 +1,7 @@
+const SECRET_LIKE_KEY = /(?:access[_-]?token|refresh[_-]?token|password|secret|cookie|api[_-]?key|private[_-]?key)/i;
+export function hasSecretLikeKey(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    return Object.entries(value).some(([key, child]) => SECRET_LIKE_KEY.test(key) || hasSecretLikeKey(child));
+}
+//# sourceMappingURL=secrets.js.map

package/dist/config/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/config/secrets.ts"],"names":[],"mappings":"AAAA,MAAM,eAAe,GAAG,4FAA4F,CAAC;AAErH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5G,CAAC"}

package/dist/contracts.d.ts

@@ -0,0 +1,2 @@
+export declare const WORKSPACE_CONTEXT_ACTION: import("@omnia/omnia-connect-contracts").ActionDefinition;
+//# sourceMappingURL=contracts.d.ts.map

package/dist/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,wBAAwB,2DAAmB,CAAC"}

package/dist/contracts.js

@@ -0,0 +1,7 @@
+import { getActionDefinition } from '@omnia/omnia-connect-contracts';
+const workspaceContext = getActionDefinition('omnia_workspace_get_context');
+if (!workspaceContext?.enabled || workspaceContext.mcpAnnotations.readOnlyHint !== true) {
+    throw new Error('Canonical read-only workspace context action is unavailable');
+}
+export const WORKSPACE_CONTEXT_ACTION = workspaceContext;
+//# sourceMappingURL=contracts.js.map

package/dist/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,6BAA6B,CAAC,CAAC;AAC5E,IAAI,CAAC,gBAAgB,EAAE,OAAO,IAAI,gBAAgB,CAAC,cAAc,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;IACxF,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,18 @@
+export declare const EXIT: {
+    readonly OK: 0;
+    readonly USAGE: 2;
+    readonly CONFIG_CONFLICT: 3;
+    readonly DEPENDENCY_MISSING: 4;
+    readonly AUTH_BLOCKED: 5;
+    readonly NETWORK: 6;
+    readonly VALIDATION: 7;
+    readonly UNSUPPORTED_HOST: 8;
+    readonly INTERNAL: 9;
+};
+export declare class CliError extends Error {
+    readonly code: string;
+    readonly exitCode: number;
+    readonly details?: unknown;
+    constructor(message: string, code: string, exitCode: number, details?: unknown);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,IAAI;;;;;;;;;;CAUP,CAAC;AAEX,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAO/E"}

package/dist/errors.js

@@ -0,0 +1,24 @@
+export const EXIT = {
+    OK: 0,
+    USAGE: 2,
+    CONFIG_CONFLICT: 3,
+    DEPENDENCY_MISSING: 4,
+    AUTH_BLOCKED: 5,
+    NETWORK: 6,
+    VALIDATION: 7,
+    UNSUPPORTED_HOST: 8,
+    INTERNAL: 9,
+};
+export class CliError extends Error {
+    code;
+    exitCode;
+    details;
+    constructor(message, code, exitCode, details) {
+        super(message);
+        this.name = 'CliError';
+        this.code = code;
+        this.exitCode = exitCode;
+        this.details = details;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,EAAE,EAAE,CAAC;IACL,KAAK,EAAE,CAAC;IACR,eAAe,EAAE,CAAC;IAClB,kBAAkB,EAAE,CAAC;IACrB,YAAY,EAAE,CAAC;IACf,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,CAAC;IACb,gBAAgB,EAAE,CAAC;IACnB,QAAQ,EAAE,CAAC;CACH,CAAC;AAEX,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAS;IACb,QAAQ,CAAS;IACjB,OAAO,CAAW;IAE3B,YAAY,OAAe,EAAE,IAAY,EAAE,QAAgB,EAAE,OAAiB;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF"}

package/dist/http/bounded.d.ts

@@ -0,0 +1,3 @@
+export declare function readBoundedText(response: Response, maxBytes: number): Promise<string>;
+export declare function readBoundedJson(response: Response, maxBytes: number): Promise<unknown>;
+//# sourceMappingURL=bounded.d.ts.map

package/dist/http/bounded.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded.d.ts","sourceRoot":"","sources":["../../src/http/bounded.ts"],"names":[],"mappings":"AAEA,wBAAsB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB3F;AAED,wBAAsB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO5F"}

package/dist/http/bounded.js

@@ -0,0 +1,36 @@
+import { CliError, EXIT } from '../errors.js';
+export async function readBoundedText(response, maxBytes) {
+    if (!response.body)
+        return '';
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let size = 0;
+    let text = '';
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            size += chunk.value.byteLength;
+            if (size > maxBytes) {
+                await reader.cancel();
+                throw new CliError('HTTP response exceeded the configured byte limit', 'RESPONSE_TOO_LARGE', EXIT.NETWORK);
+            }
+            text += decoder.decode(chunk.value, { stream: true });
+        }
+        return text + decoder.decode();
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+export async function readBoundedJson(response, maxBytes) {
+    const text = await readBoundedText(response, maxBytes);
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new CliError('Remote endpoint returned invalid JSON', 'REMOTE_INVALID_JSON', EXIT.NETWORK, { status: response.status });
+    }
+}
+//# sourceMappingURL=bounded.js.map

package/dist/http/bounded.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded.js","sourceRoot":"","sources":["../../src/http/bounded.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,QAAgB;IACxE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM;YACtB,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/B,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,QAAQ,CAAC,kDAAkD,EAAE,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7G,CAAC;YACD,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,QAAgB;IACxE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,uCAAuC,EAAE,qBAAqB,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAChI,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export declare function main(argv?: readonly string[]): Promise<number>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAsEA,wBAAsB,IAAI,CAAC,IAAI,GAAE,SAAS,MAAM,EAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6RlF"}