@polardbx/pxbaas 0.0.0-stage → 0.1.0-beta.1

package/dist/instance/provision.js

@@ -0,0 +1,139 @@
+/**
+ * Provisioning core logic — claim a Zero PXBaas instance and bind it to a baas
+ * profile. Kept separate from the commander wiring and driven by narrow
+ * interfaces so it is unit-testable with fakes (no keytar / no network).
+ *
+ * Security model: Zero returns plaintext keys over TLS; this module ingests them
+ * into the credential sink (keyring) and NEVER returns plaintext — only
+ * fingerprints. Agents can run this without a human TTY login.
+ */
+import { computeFingerprint } from '../credentials/masker.js';
+import { ZeroDriver } from '@polardbx/pxbaas-client';
+function profileNameFor(id, explicit) {
+    if (explicit)
+        return explicit;
+    const suffix = id.replace(/[^a-zA-Z0-9]/g, '').slice(-6) || id.slice(-6);
+    return `zero-${suffix}`;
+}
+/** Claim (or reuse) a Zero instance and bind it to a profile + credentials. */
+export async function provisionInstance(deps, options = {}) {
+    const switchProfile = options.switchProfile !== false;
+    // Reuse path: bind the most recent active local instance instead of claiming.
+    if (options.reuse) {
+        const active = await deps.store.listActive();
+        const recent = active[active.length - 1];
+        if (recent) {
+            const existing = await deps.creds.getCredentials(recent.profileName);
+            if (existing) {
+                const switchedFrom = switchProfile ? (await deps.profiles.getCurrentProfile())?.name ?? null : null;
+                if (switchProfile)
+                    await deps.profiles.useProfile(recent.profileName);
+                return {
+                    reused: true,
+                    profileName: recent.profileName,
+                    switchedFrom,
+                    instance: {
+                        id: recent.id,
+                        endpoint: recent.endpoint,
+                        appEndpoint: recent.appEndpoint,
+                        dashboardUrl: recent.dashboardUrl,
+                        whitelistIp: recent.whitelistIp,
+                        expiresAt: recent.expiresAt,
+                        mode: 'single-tenant',
+                    },
+                    keys: {
+                        anon: { fingerprint: computeFingerprint(existing.anonKey), role: 'anon' },
+                        serviceRole: { fingerprint: computeFingerprint(existing.serviceRoleKey), role: 'service_role' },
+                    },
+                    dashboard: { username: 'supabase', passwordRevealed: false },
+                };
+            }
+        }
+        // no reusable instance → fall through to claim
+    }
+    const claimed = await deps.zero.claim(options.whitelistIp);
+    const inst = claimed.instance;
+    const endpoint = ZeroDriver.toEndpoint(inst);
+    const name = profileNameFor(inst.id, options.name);
+    // Fail-closed on name collision unless forced.
+    const existingProfile = await deps.profiles.getProfile(name);
+    if (existingProfile && !options.force) {
+        throw new Error(`Profile '${name}' already exists. Choose another with --name, or pass --force to overwrite.`);
+    }
+    const switchedFrom = switchProfile ? (await deps.profiles.getCurrentProfile())?.name ?? null : null;
+    const now = new Date().toISOString();
+    const profile = {
+        name,
+        endpoint,
+        appEndpoint: inst.appEndpoint,
+        mode: 'single-tenant',
+        source: 'zero',
+        zeroInstanceId: inst.id,
+        expiresAt: inst.expiresAt,
+        createdAt: existingProfile?.createdAt ?? now,
+        updatedAt: now,
+    };
+    await deps.profiles.setProfile(profile);
+    await deps.creds.setCredentials(name, {
+        anonKey: inst.apiKey,
+        serviceRoleKey: inst.serviceRoleKey,
+        storedAt: now,
+    });
+    const record = {
+        id: inst.id,
+        endpoint,
+        appEndpoint: inst.appEndpoint,
+        profileName: name,
+        token: claimed.token,
+        expiresAt: inst.expiresAt,
+        dashboardUrl: inst.dashboardUrl,
+        whitelistIp: inst.whitelistIp,
+        dashboardPassword: inst.dashboardPassword,
+        dbPassword: inst.dbPassword,
+        claimedAt: now,
+    };
+    await deps.store.addInstance(record);
+    if (switchProfile)
+        await deps.profiles.useProfile(name);
+    return {
+        reused: false,
+        profileName: name,
+        switchedFrom,
+        instance: {
+            id: inst.id,
+            endpoint,
+            dashboardUrl: inst.dashboardUrl,
+            region: inst.region,
+            whitelistIp: inst.whitelistIp,
+            expiresAt: inst.expiresAt,
+            mode: 'single-tenant',
+        },
+        keys: {
+            anon: { fingerprint: computeFingerprint(inst.apiKey), role: 'anon' },
+            serviceRole: { fingerprint: computeFingerprint(inst.serviceRoleKey), role: 'service_role' },
+        },
+        dashboard: { username: 'supabase', passwordRevealed: false },
+    };
+}
+/** Release a Zero instance and unbind/remove its local profile. */
+export async function releaseInstance(deps, id, opts = {}) {
+    const removeProfile = opts.removeProfile !== false;
+    const rec = await deps.store.getInstance(id);
+    const token = rec?.token ?? (await deps.store.getToken());
+    if (!token) {
+        throw new Error('No Zero ownership token found locally; cannot release. Did you provision from this machine?');
+    }
+    await deps.zero.release(id, token);
+    await deps.store.removeInstance(id);
+    let profileRemoved = null;
+    let wasCurrent = false;
+    if (rec && removeProfile) {
+        const current = await deps.profiles.getCurrentProfile();
+        wasCurrent = current?.name === rec.profileName;
+        await deps.creds.deleteCredentials(rec.profileName);
+        await deps.profiles.removeProfile(rec.profileName);
+        profileRemoved = rec.profileName;
+    }
+    return { id, released: true, profileRemoved, wasCurrent };
+}
+//# sourceMappingURL=provision.js.map

package/dist/instance/provision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision.js","sourceRoot":"","sources":["../../src/instance/provision.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAG9D,OAAO,EAAE,UAAU,EAA6C,MAAM,yBAAyB,CAAC;AA6DhG,SAAS,cAAc,CAAC,EAAU,EAAE,QAAiB;IACnD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,QAAQ,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAmB,EACnB,UAA4B,EAAE;IAE9B,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC;IAEtD,8EAA8E;IAC9E,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACrE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBACpG,IAAI,aAAa;oBAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACtE,OAAO;oBACL,MAAM,EAAE,IAAI;oBACZ,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,YAAY;oBACZ,QAAQ,EAAE;wBACR,EAAE,EAAE,MAAM,CAAC,EAAE;wBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,IAAI,EAAE,eAAe;qBACtB;oBACD,IAAI,EAAE;wBACJ,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;wBACzE,WAAW,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE;qBAChG;oBACD,SAAS,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE;iBAC7D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,+CAA+C;IACjD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD,+CAA+C;IAC/C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,eAAe,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,6EAA6E,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,MAAM,OAAO,GAAgB;QAC3B,IAAI;QACJ,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,MAAM;QACd,cAAc,EAAE,IAAI,CAAC,EAAE;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,eAAe,EAAE,SAAS,IAAI,GAAG;QAC5C,SAAS,EAAE,GAAG;KACf,CAAC;IACF,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAExC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE;QACpC,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;IAEH,MAAM,MAAM,GAAuB;QACjC,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI;QACjB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,GAAG;KACf,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAErC,IAAI,aAAa;QAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAExD,OAAO;QACL,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,IAAI;QACjB,YAAY;QACZ,QAAQ,EAAE;YACR,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ;YACR,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,eAAe;SACtB;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;YACpE,WAAW,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE;SAC5F;QACD,SAAS,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE;KAC7D,CAAC;AACJ,CAAC;AASD,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAmB,EACnB,EAAU,EACV,OAAoC,EAAE;IAEtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IACjH,CAAC;IAED,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAEpC,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACxD,UAAU,GAAG,OAAO,EAAE,IAAI,KAAK,GAAG,CAAC,WAAW,CAAC;QAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACnD,cAAc,GAAG,GAAG,CAAC,WAAW,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AAC5D,CAAC"}

package/dist/instance/zero-store.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Zero store — persists PolarDB-X Zero ownership token and claimed-instance
+ * bindings under `~/.baas/zero.json` (mode 0600).
+ *
+ * Because PXBaas has NO credentials re-read endpoint (unlike PXFuse), the keys
+ * returned at claim time must be durably stored here (and in the keyring via
+ * CredentialStore). `instance list` cannot fetch keys back from Zero.
+ */
+export interface ZeroInstanceRecord {
+    id: string;
+    endpoint: string;
+    appEndpoint?: string;
+    profileName: string;
+    token: string;
+    expiresAt?: string;
+    dashboardUrl?: string;
+    whitelistIp?: string;
+    /** Sensitive; stored 0600, never printed except via `instance credentials --reveal`. */
+    dashboardPassword?: string;
+    dbPassword?: string;
+    claimedAt: string;
+}
+interface ZeroStoreFile {
+    version: 1;
+    token: string;
+    instances: ZeroInstanceRecord[];
+}
+export declare class ZeroStore {
+    private homeDir;
+    private cache;
+    constructor(homeDir?: string);
+    private filePath;
+    load(): Promise<ZeroStoreFile>;
+    private save;
+    /** Latest ownership token (empty string when never provisioned). */
+    getToken(): Promise<string>;
+    /** Upsert an instance record by id and refresh the top-level token. */
+    addInstance(record: ZeroInstanceRecord): Promise<void>;
+    getInstance(id: string): Promise<ZeroInstanceRecord | null>;
+    findInstanceByProfile(profileName: string): Promise<ZeroInstanceRecord | null>;
+    listInstances(): Promise<ZeroInstanceRecord[]>;
+    /** Instances whose expiresAt is in the future (or unknown). */
+    listActive(now?: Date): Promise<ZeroInstanceRecord[]>;
+    removeInstance(id: string): Promise<boolean>;
+}
+export {};
+//# sourceMappingURL=zero-store.d.ts.map

package/dist/instance/zero-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zero-store.d.ts","sourceRoot":"","sources":["../../src/instance/zero-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,aAAa;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAA8B;gBAE/B,OAAO,CAAC,EAAE,MAAM;IAI5B,OAAO,CAAC,QAAQ;IAIV,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC;YAiBtB,IAAI;IAQlB,oEAAoE;IAC9D,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAKjC,uEAAuE;IACjE,WAAW,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAStD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAK3D,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAK9E,aAAa,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKpD,+DAA+D;IACzD,UAAU,CAAC,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKjE,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAQnD"}

package/dist/instance/zero-store.js

@@ -0,0 +1,91 @@
+/**
+ * Zero store — persists PolarDB-X Zero ownership token and claimed-instance
+ * bindings under `~/.baas/zero.json` (mode 0600).
+ *
+ * Because PXBaas has NO credentials re-read endpoint (unlike PXFuse), the keys
+ * returned at claim time must be durably stored here (and in the keyring via
+ * CredentialStore). `instance list` cannot fetch keys back from Zero.
+ */
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+export class ZeroStore {
+    homeDir;
+    cache = null;
+    constructor(homeDir) {
+        this.homeDir = homeDir ?? join(homedir(), '.baas');
+    }
+    filePath() {
+        return join(this.homeDir, 'zero.json');
+    }
+    async load() {
+        if (this.cache)
+            return this.cache;
+        const p = this.filePath();
+        if (!existsSync(p)) {
+            this.cache = { version: 1, token: '', instances: [] };
+            return this.cache;
+        }
+        try {
+            const data = JSON.parse(await readFile(p, 'utf-8'));
+            if (data.version !== 1)
+                throw new Error(`Unsupported zero.json version: ${data.version}`);
+            this.cache = { version: 1, token: data.token ?? '', instances: data.instances ?? [] };
+            return this.cache;
+        }
+        catch (err) {
+            throw new Error(`Failed to read zero.json: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    async save(state) {
+        if (!existsSync(this.homeDir)) {
+            await mkdir(this.homeDir, { mode: 0o700, recursive: true });
+        }
+        await writeFile(this.filePath(), JSON.stringify(state, null, 2) + '\n', { mode: 0o600 });
+        this.cache = state;
+    }
+    /** Latest ownership token (empty string when never provisioned). */
+    async getToken() {
+        const s = await this.load();
+        return s.token;
+    }
+    /** Upsert an instance record by id and refresh the top-level token. */
+    async addInstance(record) {
+        const s = await this.load();
+        const idx = s.instances.findIndex((i) => i.id === record.id);
+        if (idx >= 0)
+            s.instances[idx] = record;
+        else
+            s.instances.push(record);
+        s.token = record.token || s.token;
+        await this.save(s);
+    }
+    async getInstance(id) {
+        const s = await this.load();
+        return s.instances.find((i) => i.id === id) ?? null;
+    }
+    async findInstanceByProfile(profileName) {
+        const s = await this.load();
+        return s.instances.find((i) => i.profileName === profileName) ?? null;
+    }
+    async listInstances() {
+        const s = await this.load();
+        return [...s.instances];
+    }
+    /** Instances whose expiresAt is in the future (or unknown). */
+    async listActive(now = new Date()) {
+        const s = await this.load();
+        return s.instances.filter((i) => !i.expiresAt || new Date(i.expiresAt).getTime() > now.getTime());
+    }
+    async removeInstance(id) {
+        const s = await this.load();
+        const before = s.instances.length;
+        s.instances = s.instances.filter((i) => i.id !== id);
+        if (s.instances.length === before)
+            return false;
+        await this.save(s);
+        return true;
+    }
+}
+//# sourceMappingURL=zero-store.js.map

package/dist/instance/zero-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zero-store.js","sourceRoot":"","sources":["../../src/instance/zero-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAuBjC,MAAM,OAAO,SAAS;IACZ,OAAO,CAAS;IAChB,KAAK,GAAyB,IAAI,CAAC;IAE3C,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAEO,QAAQ;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAkB,CAAC;YACrE,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YACtF,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,KAAoB;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,QAAQ;QACZ,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,WAAW,CAAC,MAA0B;QAC1C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,GAAG,IAAI,CAAC;YAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;;YACnC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;QAClC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,WAAmB;QAC7C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,IAAI,IAAI,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,UAAU,CAAC,MAAY,IAAI,IAAI,EAAE;QACrC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":""}

package/dist/main.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+import { program } from 'commander';
+import { registerCommands } from './cli/root.js';
+import { ProfileManager, setCliProfileOverrideGlobal } from './credentials/profile.js';
+// Global options
+program
+    .name('pxbaas')
+    .description('PolarDB-X BaaS CLI')
+    .version('0.0.0-dev')
+    .option('--json', 'Output in JSON format')
+    .option('--profile <name>', 'Use specific profile')
+    .option('--debug', 'Enable debug output');
+// Register all commands
+registerCommands(program);
+// `--profile` is a program-level option, so commander only parses it when given
+// BEFORE the subcommand (`pxbaas --profile x app list`). Every command resolves
+// credentials through ProfileManager.getCurrentProfile(), which used to make a
+// trailing `--profile` a silent no-op — the command then ran against whatever
+// profile happened to be current, i.e. a cross-instance write hazard.
+// Declare it on every (sub)command as well so both positions work.
+const declareProfileOption = (cmd) => {
+    if (!cmd.options.some((o) => o.long === '--profile')) {
+        cmd.option('--profile <name>', 'Use specific profile');
+    }
+    cmd.commands.forEach(declareProfileOption);
+};
+declareProfileOption(program);
+// Resolve --profile once, before any command runs: validate it exists (fail loudly
+// instead of silently falling back to the current profile) and publish it as a
+// process-wide override. Never persisted — `profile ls` current marker is untouched.
+program.hook('preAction', async (_thisCommand, actionCommand) => {
+    const requested = (actionCommand.opts().profile ?? program.opts().profile);
+    if (!requested)
+        return;
+    const manager = new ProfileManager();
+    const known = await manager.listProfiles();
+    if (!known.some((p) => p.name === requested)) {
+        const names = known.map((p) => p.name).join(', ') || '(none)';
+        console.error(`✗ Unknown profile: '${requested}'. Available profiles: ${names}`);
+        process.exit(1);
+    }
+    setCliProfileOverrideGlobal(requested);
+});
+// Parse arguments
+program.parse();
+//# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAW,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAEvF,iBAAiB;AACjB,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,oBAAoB,CAAC;KACjC,OAAO,CAAC,WAAW,CAAC;KACpB,MAAM,CAAC,QAAQ,EAAE,uBAAuB,CAAC;KACzC,MAAM,CAAC,kBAAkB,EAAE,sBAAsB,CAAC;KAClD,MAAM,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;AAE5C,wBAAwB;AACxB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAE1B,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,sEAAsE;AACtE,mEAAmE;AACnE,MAAM,oBAAoB,GAAG,CAAC,GAAY,EAAQ,EAAE;IAClD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IACzD,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAC7C,CAAC,CAAC;AACF,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,mFAAmF;AACnF,+EAA+E;AAC/E,qFAAqF;AACrF,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE;IAC9D,MAAM,SAAS,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAE5D,CAAC;IACd,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,MAAM,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QAC9D,OAAO,CAAC,KAAK,CACX,uBAAuB,SAAS,0BAA0B,KAAK,EAAE,CAClE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,2BAA2B,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,kBAAkB;AAClB,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/skill/assets.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Locate the bundled Agent Skills at runtime.
+ *
+ * Distribution route A (ctxdb0-style): skills ship as package files under
+ * `apps/baas/skills/<skill>/` and `package.json#files` includes `skills`.
+ * We resolve the package root by walking up from this module until we find a
+ * `skills/` directory containing at least one `<skill>/SKILL.md`. This works for
+ * the compiled layout (`dist/skill/assets.js`) and for direct source execution.
+ *
+ * There can be MULTIPLE bundled skills (e.g. `pxbaas-cli`, `pxbaas-app-spec`);
+ * `pxbaas skill install` installs all of them by default.
+ *
+ * NOTE: the standalone single-file binary (`bun build --compile`) does not carry
+ * these files on disk; resolution then fails and callers surface a clear
+ * "requires the npm/source install" error.
+ */
+/** Thrown when the bundled skills cannot be located (e.g. single-binary mode). */
+export declare class SkillAssetsNotFoundError extends Error {
+    constructor(message: string);
+}
+/** Walk up from the current module to find the app package root (holds `skills/`). */
+export declare function resolvePackageRoot(startDir?: string): string | null;
+/** Absolute path to the bundled `skills/` directory. */
+export declare function resolveSkillsRoot(startDir?: string): string;
+/** Names of all bundled skills under a given `skills/` root (subdirs with a SKILL.md). */
+export declare function listBundledSkillsIn(skillsRoot: string): Promise<string[]>;
+/** Names of all bundled skills (subdirs of the resolved `skills/` that contain a SKILL.md). */
+export declare function listBundledSkills(startDir?: string): Promise<string[]>;
+/** Absolute path to one bundled skill directory. */
+export declare function resolveSkillAssetDir(skillName: string, startDir?: string): string;
+/** Read the CLI version from the resolved package.json (best-effort). */
+export declare function readCliVersion(startDir?: string): Promise<string>;
+/**
+ * Recursively list a skill's files as POSIX-style relative paths (e.g. `SKILL.md`,
+ * `references/db-and-meta.md`). Skips hidden files/dirs and `node_modules`.
+ */
+export declare function listSkillFiles(assetDir: string): Promise<string[]>;
+//# sourceMappingURL=assets.d.ts.map

package/dist/skill/assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/skill/assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,kFAAkF;AAClF,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAUD,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,QAAQ,GAAE,MAAoB,GAAG,MAAM,GAAG,IAAI,CAShF;AAED,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,QAAQ,GAAE,MAAoB,GAAG,MAAM,CAQxE;AAED,0FAA0F;AAC1F,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ/E;AAED,+FAA+F;AAC/F,wBAAsB,iBAAiB,CAAC,QAAQ,GAAE,MAAoB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEzF;AAED,oDAAoD;AACpD,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAoB,GAAG,MAAM,CAE9F;AAED,yEAAyE;AACzE,wBAAsB,cAAc,CAAC,QAAQ,GAAE,MAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CASpF;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkBxE"}

package/dist/skill/assets.js

@@ -0,0 +1,111 @@
+/**
+ * Locate the bundled Agent Skills at runtime.
+ *
+ * Distribution route A (ctxdb0-style): skills ship as package files under
+ * `apps/baas/skills/<skill>/` and `package.json#files` includes `skills`.
+ * We resolve the package root by walking up from this module until we find a
+ * `skills/` directory containing at least one `<skill>/SKILL.md`. This works for
+ * the compiled layout (`dist/skill/assets.js`) and for direct source execution.
+ *
+ * There can be MULTIPLE bundled skills (e.g. `pxbaas-cli`, `pxbaas-app-spec`);
+ * `pxbaas skill install` installs all of them by default.
+ *
+ * NOTE: the standalone single-file binary (`bun build --compile`) does not carry
+ * these files on disk; resolution then fails and callers surface a clear
+ * "requires the npm/source install" error.
+ */
+import { existsSync } from 'node:fs';
+import { readFile, readdir } from 'node:fs/promises';
+import { dirname, join, relative, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/** Thrown when the bundled skills cannot be located (e.g. single-binary mode). */
+export class SkillAssetsNotFoundError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'SkillAssetsNotFoundError';
+    }
+}
+function moduleDir() {
+    return dirname(fileURLToPath(import.meta.url));
+}
+function isSkillsRoot(dir) {
+    return existsSync(join(dir, 'skills')) && existsSync(join(dir, 'package.json'));
+}
+/** Walk up from the current module to find the app package root (holds `skills/`). */
+export function resolvePackageRoot(startDir = moduleDir()) {
+    let dir = startDir;
+    for (let i = 0; i < 8; i++) {
+        if (isSkillsRoot(dir))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+/** Absolute path to the bundled `skills/` directory. */
+export function resolveSkillsRoot(startDir = moduleDir()) {
+    const root = resolvePackageRoot(startDir);
+    if (!root) {
+        throw new SkillAssetsNotFoundError('Bundled skills not found. `pxbaas skill install` requires the npm or source install (the standalone single-file binary does not bundle skill assets).');
+    }
+    return join(root, 'skills');
+}
+/** Names of all bundled skills under a given `skills/` root (subdirs with a SKILL.md). */
+export async function listBundledSkillsIn(skillsRoot) {
+    const entries = await readdir(skillsRoot, { withFileTypes: true });
+    const names = [];
+    for (const e of entries) {
+        if (!e.isDirectory() || e.name.startsWith('.'))
+            continue;
+        if (existsSync(join(skillsRoot, e.name, 'SKILL.md')))
+            names.push(e.name);
+    }
+    return names.sort();
+}
+/** Names of all bundled skills (subdirs of the resolved `skills/` that contain a SKILL.md). */
+export async function listBundledSkills(startDir = moduleDir()) {
+    return listBundledSkillsIn(resolveSkillsRoot(startDir));
+}
+/** Absolute path to one bundled skill directory. */
+export function resolveSkillAssetDir(skillName, startDir = moduleDir()) {
+    return join(resolveSkillsRoot(startDir), skillName);
+}
+/** Read the CLI version from the resolved package.json (best-effort). */
+export async function readCliVersion(startDir = moduleDir()) {
+    const root = resolvePackageRoot(startDir);
+    if (!root)
+        return 'unknown';
+    try {
+        const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
+        return pkg.version ?? 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/**
+ * Recursively list a skill's files as POSIX-style relative paths (e.g. `SKILL.md`,
+ * `references/db-and-meta.md`). Skips hidden files/dirs and `node_modules`.
+ */
+export async function listSkillFiles(assetDir) {
+    const out = [];
+    async function walk(dir) {
+        const entries = await readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (entry.name.startsWith('.') || entry.name === 'node_modules')
+                continue;
+            const full = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                await walk(full);
+            }
+            else if (entry.isFile()) {
+                out.push(relative(assetDir, full).split(sep).join('/'));
+            }
+        }
+    }
+    await walk(assetDir);
+    return out.sort();
+}
+//# sourceMappingURL=assets.js.map

package/dist/skill/assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../src/skill/assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,kFAAkF;AAClF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAAC,WAAmB,SAAS,EAAE;IAC/D,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,iBAAiB,CAAC,WAAmB,SAAS,EAAE;IAC9D,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,wBAAwB,CAChC,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IAC1D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACzD,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,WAAmB,SAAS,EAAE;IACpE,OAAO,mBAAmB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,WAAmB,SAAS,EAAE;IACpF,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,WAAmB,SAAS,EAAE;IACjE,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAyB,CAAC;QACnG,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,KAAK,UAAU,IAAI,CAAC,GAAW;QAC7B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;gBAAE,SAAS;YAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC"}

package/dist/skill/hint.d.ts

@@ -0,0 +1,39 @@
+/**
+ * First-run skill hint (option A).
+ *
+ * Nudges the user once — on any `pxbaas` command — that a bundled Agent Skill can
+ * be installed into a detected Agent host, so they discover `pxbaas skill install`
+ * without us silently writing into their agent config on npm install.
+ *
+ * Deliberately non-intrusive:
+ * - prints to **stderr** (never pollutes `--json` stdout that agents parse)
+ * - skipped when `--json`, when running any `skill` subcommand, when no host is
+ *   detected, when the skill is already installed in a detected host, when the
+ *   hint was shown before (state under ~/.baas), or when BAAS_NO_SKILL_HINT is set
+ * - never throws: a hint failure must not break the actual command
+ */
+export interface SkillHintOptions {
+    /** Global --json flag; when true the hint is suppressed. */
+    json?: boolean;
+    /** $HOME override (defaults to os.homedir()). Injectable for tests. */
+    homeDir?: string;
+    /** Invoked command path, e.g. "db query" or "skill install". */
+    commandPath?: string;
+    /** Environment override (defaults to process.env). Injectable for tests. */
+    env?: NodeJS.ProcessEnv;
+    /** stderr writer override. Injectable for tests. */
+    stderr?: (line: string) => void;
+}
+/**
+ * Print the one-time skill hint when appropriate. Safe to call before any
+ * command action; resolves without side effects when suppressed.
+ */
+export declare function maybePrintSkillHint(options?: SkillHintOptions): Promise<void>;
+/**
+ * First-run hint shown when NO profile is configured yet: point the user to
+ * `pxbaas provision` (free 15-day Zero instance) or `pxbaas login` (own instance).
+ * Non-intrusive: stderr, once, skipped under --json / on onboarding commands /
+ * when a profile already exists / when BAAS_NO_PROVISION_HINT is set.
+ */
+export declare function maybePrintProvisionHint(options?: SkillHintOptions): Promise<void>;
+//# sourceMappingURL=hint.d.ts.map

package/dist/skill/hint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hint.d.ts","sourceRoot":"","sources":["../../src/skill/hint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAWH,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,oDAAoD;IACpD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAQD;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCvF;AAKD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC3F"}