@reposkein/mcp 0.4.0 → 0.6.0

package/dist/ads/supporterStore.js

@@ -0,0 +1,113 @@
+/** Where a supporter token lives on disk, and the only code that puts it
+ *  there.
+ *
+ *  ## User-level, never repo-level
+ *
+ *  Entitlement belongs to a PERSON, not to a checkout. Storing it under
+ *  `.reposkein/` would be wrong three times over: it would ride into git (or
+ *  need yet another ignore rule to stop it), it would be shared with everyone
+ *  who clones the repo — handing them a token they did not pay for — and it
+ *  would have to be re-supplied in every working copy by the one person who
+ *  did. So it lives under the user's config directory and nothing in this
+ *  package ever writes an entitlement byte inside a repository. There is a
+ *  test that asserts exactly that by byte-comparing a repo tree across a
+ *  `support` invocation.
+ *
+ *  ## Permissions
+ *
+ *  Directory 0700, file 0600, and the file mode is re-applied with an
+ *  explicit `chmodSync` after every write: `writeFileSync`'s `mode` option is
+ *  honoured only when the file is CREATED, so overwriting an existing
+ *  world-readable token would otherwise silently leave it world-readable.
+ *  The token is not a password — the worst a thief gets is no ads — but a
+ *  paid entitlement is still the holder's to keep, and 0600 costs nothing.
+ *
+ *  On Windows these modes are approximated by the runtime; `--status` reports
+ *  the mode it actually observes rather than asserting a POSIX guarantee the
+ *  platform does not offer. */
+import { chmodSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join } from "node:path";
+/** Overrides the entitlement file location. Exists for tests and for anyone
+ *  running with an unusual HOME; it is NOT a bypass — the file it points at
+ *  still has to contain a validly signed token, so redirecting it cannot
+ *  manufacture entitlement. */
+export const SUPPORTER_FILE_ENV = "REPOSKEIN_SUPPORTER_FILE";
+const DIR_NAME = "reposkein";
+const FILE_NAME = "supporter.jwt";
+/** Resolves the entitlement file path, in order:
+ *
+ *   1. `REPOSKEIN_SUPPORTER_FILE`, if absolute.
+ *   2. `$XDG_CONFIG_HOME/reposkein/supporter.jwt`, if absolute.
+ *   3. `~/.config/reposkein/supporter.jwt` — the documented location. */
+export function supporterTokenPath(env = process.env) {
+    const override = (env[SUPPORTER_FILE_ENV] ?? "").trim();
+    if (override && isAbsolute(override))
+        return override;
+    const xdg = (env.XDG_CONFIG_HOME ?? "").trim();
+    const base = xdg && isAbsolute(xdg) ? xdg : join(homedir(), ".config");
+    return join(base, DIR_NAME, FILE_NAME);
+}
+/** Cheap existence + identity probe. Returns null for "no file" and for any
+ *  error reading it — an unreadable entitlement file is indistinguishable
+ *  from an absent one as far as entitlement goes, and this runs on a tool
+ *  call's hot path, so it must never throw. */
+export function statSupporterTokenFile(env = process.env) {
+    try {
+        const st = statSync(supporterTokenPath(env));
+        if (!st.isFile())
+            return null;
+        return { mtimeMs: st.mtimeMs, size: st.size, mode: st.mode & 0o777 };
+    }
+    catch {
+        return null;
+    }
+}
+/** Reads the token text, or null if there is nothing readable there. Never
+ *  throws. Size is bounded by the caller's own token-length limit; a file
+ *  larger than that fails verification rather than being read into memory
+ *  blindly, so the read is capped here too. */
+export function readSupporterTokenFile(env = process.env, maxBytes = 64 * 1024) {
+    try {
+        const path = supporterTokenPath(env);
+        const st = statSync(path);
+        if (!st.isFile() || st.size > maxBytes)
+            return null;
+        const text = readFileSync(path, "utf8").trim();
+        return text.length === 0 ? null : text;
+    }
+    catch {
+        return null;
+    }
+}
+/** Writes the token, creating `~/.config/reposkein/` as 0700 if needed, and
+ *  returns the path written. Throws on failure — this one is called from the
+ *  CLI, where a failure must be reported, not swallowed. */
+export function writeSupporterTokenFile(token, env = process.env) {
+    const path = supporterTokenPath(env);
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(path, `${token.trim()}\n`, { mode: 0o600 });
+    // Re-assert: `mode` above applies only on creation.
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // Filesystems without POSIX modes (some Windows/network mounts). The
+        // write itself succeeded, which is what the caller asked for.
+    }
+    return path;
+}
+/** Deletes the entitlement file. Returns true if a file was removed, false if
+ *  there was nothing to remove. */
+export function removeSupporterTokenFile(env = process.env) {
+    const path = supporterTokenPath(env);
+    try {
+        statSync(path);
+    }
+    catch {
+        return false;
+    }
+    rmSync(path, { force: true });
+    return true;
+}
+//# sourceMappingURL=supporterStore.js.map

package/dist/ads/supporterStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supporterStore.js","sourceRoot":"","sources":["../../src/ads/supporterStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;+BA0B+B;AAE/B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9F,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEtD;;;+BAG+B;AAC/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAE7D,MAAM,QAAQ,GAAG,WAAW,CAAC;AAC7B,MAAM,SAAS,GAAG,eAAe,CAAC;AAElC;;;;yEAIyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AASD;;;+CAG+C;AAC/C,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;+CAG+C;AAC/C,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,EAAE,GAAG,IAAI;IAC/F,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;4DAE4D;AAC5D,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAyB,OAAO,CAAC,GAAG;IACzF,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,oDAAoD;IACpD,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,8DAA8D;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;mCACmC;AACnC,MAAM,UAAU,wBAAwB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3E,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/ads/supporterToken.d.ts

@@ -0,0 +1,133 @@
+/** The supporter-entitlement token: format, minting, and verification.
+ *
+ *  ## Why not a JWT
+ *
+ *  A JWT's header is attacker-controlled — the `alg` field in particular has
+ *  a long history of `none`/`HS256`-confusion bugs, and every JWT library
+ *  carries the machinery to be configured wrong. This token has no header at
+ *  all. The algorithm is Ed25519 because it is fixed in this file, the key is
+ *  whichever committed public key the payload's `kid` names, and there is no
+ *  wire field that can change either. That removes the entire class of
+ *  algorithm-confusion attacks and removes a dependency at the same time:
+ *  `node:crypto` speaks Ed25519 natively, so nothing new is installed.
+ *
+ *  ## Wire format
+ *
+ *      rsk1.<base64url(payload JSON)>.<base64url(signature)>
+ *
+ *  The signature covers the ASCII bytes of `rsk1.<payloadSegment>` — the
+ *  ENCODED segment, not the decoded JSON. Signing the encoding sidesteps
+ *  every JSON-canonicalization question (key order, whitespace, number
+ *  formatting): there is exactly one byte string that was signed, and it is
+ *  the one sitting in the token. The `rsk1.` prefix is inside the signed
+ *  input too, so a future `rsk2` format cannot be produced by re-labelling an
+ *  `rsk1` token.
+ *
+ *  ## Payload
+ *
+ *      { v: 1, kid: "skein-2026-08", sub: "<opaque>", tier: "skein",
+ *        iat: <unix seconds>, exp: <unix seconds> }
+ *
+ *  `sub` is an opaque hash minted by the fulfilment worker (an HMAC of the
+ *  supporter's Ko-fi email under a server-side salt), present only so a
+ *  re-issued token can be recognised as the same subscription. It is not
+ *  reversible to an email, it is never transmitted anywhere by this package,
+ *  and nothing in RepoSkein reads it except `support --status`, which prints
+ *  a prefix of it so a supporter can tell two tokens apart. There is no
+ *  account, no device id, and no counter.
+ *
+ *  ## What verification deliberately does NOT do
+ *
+ *  No revocation list, and therefore no network call. A revocation check is a
+ *  phone-home by another name, and the thing being protected is the absence
+ *  of an ad — the least valuable secret in the system. A leaked token buys a
+ *  stranger an ad-free experience they could equally have by setting
+ *  `REPOSKEIN_ADS=off`. Expiry plus re-issue is the entire enforcement model,
+ *  and that is proportionate. */
+/** Format marker and the first component of the signed input. */
+export declare const SUPPORTER_TOKEN_PREFIX = "rsk1";
+/** The only tier that entitles anyone to anything today. Compared exactly. */
+export declare const SUPPORTER_TIER = "skein";
+/** How long a token keeps working after `exp`.
+ *
+ *  Three days, and the reason is renewal timing, not generosity: Ko-fi bills
+ *  a membership on its own schedule and the fulfilment worker mints the
+ *  replacement only when that payment lands. Without a grace window a
+ *  supporter whose renewal posts a few hours late would watch a paid-for
+ *  feature switch itself off. Three days covers a weekend plus a payment
+ *  retry; it is short enough that a cancelled membership stops mattering
+ *  within the week. */
+export declare const SUPPORTER_GRACE_MS: number;
+/** Tolerance for a clock that is behind the minter's. A token whose `iat` is
+ *  further in the future than this is rejected — a legitimate minter cannot
+ *  produce one, so it means either a badly wrong clock or a forged payload,
+ *  and both should fail loudly rather than quietly grant entitlement later. */
+export declare const SUPPORTER_MAX_CLOCK_SKEW_MS: number;
+/** Longest lifetime any single token may claim (400 days). Caps the blast
+ *  radius if the signing key is ever compromised: an attacker with the key
+ *  still cannot mint a token that outlives one rotation cycle. Renewal, not
+ *  longevity, is the model. */
+export declare const SUPPORTER_MAX_LIFETIME_MS: number;
+/** Refuse to even parse anything larger. A supporter token is ~200 bytes; a
+ *  megabyte of base64 in the entitlement file is not a token. */
+export declare const SUPPORTER_MAX_TOKEN_BYTES = 4096;
+export interface SupporterClaims {
+    v: 1;
+    kid: string;
+    sub: string;
+    tier: string;
+    /** Issued-at, unix SECONDS (not milliseconds). */
+    iat: number;
+    /** Expiry, unix SECONDS. */
+    exp: number;
+}
+/** Why a token was refused. Diagnostic only — shown by `support --status`,
+ *  never transmitted. */
+export type SupporterRejection = "empty" | "too_large" | "malformed" | "unknown_key" | "bad_signature" | "bad_payload" | "wrong_tier" | "implausible_lifetime" | "not_yet_valid";
+export type SupporterVerdict = 
+/** Signature good, tier right, `exp` in the future. */
+{
+    state: "valid";
+    claims: SupporterClaims;
+}
+/** Signature good, past `exp`, still inside the grace window. */
+ | {
+    state: "grace";
+    claims: SupporterClaims;
+}
+/** Signature good, past `exp` + grace. Claims are returned so the CLI can
+ *  say *when* it lapsed rather than just "no". */
+ | {
+    state: "expired";
+    claims: SupporterClaims;
+}
+/** Never trustworthy at any time. */
+ | {
+    state: "invalid";
+    reason: SupporterRejection;
+};
+/** True when the verdict entitles the holder. The one place the
+ *  valid/grace distinction collapses. */
+export declare function isEntitled(verdict: SupporterVerdict): boolean;
+/** Mints a token. Needs the PRIVATE key, which lives only in the fulfilment
+ *  worker's secret store (see `supporterKey.ts` provenance) — nothing in the
+ *  published package or the test suite uses the real one. Exported because a
+ *  format is only trustworthy if the thing that writes it and the thing that
+ *  reads it are specified together, and because the round-trip tests need to
+ *  sign with a throwaway key. */
+export declare function signSupporterToken(claims: SupporterClaims, privateKeyPem: string): string;
+/** Full verification: shape, signature, tier, then expiry against `now`.
+ *  Pure and synchronous — no filesystem, no clock injection beyond `now`, and
+ *  nothing that can touch a socket. */
+export declare function verifySupporterToken(token: string, now?: number): SupporterVerdict;
+/** The time-dependent half, over claims whose signature is already trusted. */
+export declare function classifyClaims(claims: SupporterClaims, now?: number): SupporterVerdict;
+/** Verifies shape + signature only, deferring every time-dependent decision
+ *  to `classifyClaims`. `isSupporter()`'s cache is built on this split. */
+export declare function verifySupporterTokenClaims(token: string): {
+    ok: true;
+    claims: SupporterClaims;
+} | {
+    ok: false;
+    reason: SupporterRejection;
+};

package/dist/ads/supporterToken.js

@@ -0,0 +1,233 @@
+/** The supporter-entitlement token: format, minting, and verification.
+ *
+ *  ## Why not a JWT
+ *
+ *  A JWT's header is attacker-controlled — the `alg` field in particular has
+ *  a long history of `none`/`HS256`-confusion bugs, and every JWT library
+ *  carries the machinery to be configured wrong. This token has no header at
+ *  all. The algorithm is Ed25519 because it is fixed in this file, the key is
+ *  whichever committed public key the payload's `kid` names, and there is no
+ *  wire field that can change either. That removes the entire class of
+ *  algorithm-confusion attacks and removes a dependency at the same time:
+ *  `node:crypto` speaks Ed25519 natively, so nothing new is installed.
+ *
+ *  ## Wire format
+ *
+ *      rsk1.<base64url(payload JSON)>.<base64url(signature)>
+ *
+ *  The signature covers the ASCII bytes of `rsk1.<payloadSegment>` — the
+ *  ENCODED segment, not the decoded JSON. Signing the encoding sidesteps
+ *  every JSON-canonicalization question (key order, whitespace, number
+ *  formatting): there is exactly one byte string that was signed, and it is
+ *  the one sitting in the token. The `rsk1.` prefix is inside the signed
+ *  input too, so a future `rsk2` format cannot be produced by re-labelling an
+ *  `rsk1` token.
+ *
+ *  ## Payload
+ *
+ *      { v: 1, kid: "skein-2026-08", sub: "<opaque>", tier: "skein",
+ *        iat: <unix seconds>, exp: <unix seconds> }
+ *
+ *  `sub` is an opaque hash minted by the fulfilment worker (an HMAC of the
+ *  supporter's Ko-fi email under a server-side salt), present only so a
+ *  re-issued token can be recognised as the same subscription. It is not
+ *  reversible to an email, it is never transmitted anywhere by this package,
+ *  and nothing in RepoSkein reads it except `support --status`, which prints
+ *  a prefix of it so a supporter can tell two tokens apart. There is no
+ *  account, no device id, and no counter.
+ *
+ *  ## What verification deliberately does NOT do
+ *
+ *  No revocation list, and therefore no network call. A revocation check is a
+ *  phone-home by another name, and the thing being protected is the absence
+ *  of an ad — the least valuable secret in the system. A leaked token buys a
+ *  stranger an ad-free experience they could equally have by setting
+ *  `REPOSKEIN_ADS=off`. Expiry plus re-issue is the entire enforcement model,
+ *  and that is proportionate. */
+import { createPublicKey, createPrivateKey, sign as cryptoSign, verify as cryptoVerify } from "node:crypto";
+import { SUPPORTER_PUBLIC_KEYS } from "./supporterKey.js";
+/** Format marker and the first component of the signed input. */
+export const SUPPORTER_TOKEN_PREFIX = "rsk1";
+/** The only tier that entitles anyone to anything today. Compared exactly. */
+export const SUPPORTER_TIER = "skein";
+/** How long a token keeps working after `exp`.
+ *
+ *  Three days, and the reason is renewal timing, not generosity: Ko-fi bills
+ *  a membership on its own schedule and the fulfilment worker mints the
+ *  replacement only when that payment lands. Without a grace window a
+ *  supporter whose renewal posts a few hours late would watch a paid-for
+ *  feature switch itself off. Three days covers a weekend plus a payment
+ *  retry; it is short enough that a cancelled membership stops mattering
+ *  within the week. */
+export const SUPPORTER_GRACE_MS = 3 * 24 * 60 * 60 * 1000;
+/** Tolerance for a clock that is behind the minter's. A token whose `iat` is
+ *  further in the future than this is rejected — a legitimate minter cannot
+ *  produce one, so it means either a badly wrong clock or a forged payload,
+ *  and both should fail loudly rather than quietly grant entitlement later. */
+export const SUPPORTER_MAX_CLOCK_SKEW_MS = 24 * 60 * 60 * 1000;
+/** Longest lifetime any single token may claim (400 days). Caps the blast
+ *  radius if the signing key is ever compromised: an attacker with the key
+ *  still cannot mint a token that outlives one rotation cycle. Renewal, not
+ *  longevity, is the model. */
+export const SUPPORTER_MAX_LIFETIME_MS = 400 * 24 * 60 * 60 * 1000;
+/** Refuse to even parse anything larger. A supporter token is ~200 bytes; a
+ *  megabyte of base64 in the entitlement file is not a token. */
+export const SUPPORTER_MAX_TOKEN_BYTES = 4096;
+/** True when the verdict entitles the holder. The one place the
+ *  valid/grace distinction collapses. */
+export function isEntitled(verdict) {
+    return verdict.state === "valid" || verdict.state === "grace";
+}
+const SEGMENT_RE = /^[A-Za-z0-9_-]+$/;
+const KID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const SUB_RE = /^[A-Za-z0-9_-]{8,64}$/;
+function b64uEncode(buf) {
+    return buf.toString("base64url");
+}
+/** Decodes a segment only if it is canonical base64url: the alphabet, no
+ *  padding, no whitespace. `Buffer.from(..., "base64url")` is famously
+ *  lenient (it will happily skip garbage), so the charset gate happens first
+ *  and a token with a sloppy encoding is simply not a token. */
+function b64uDecode(seg) {
+    if (!SEGMENT_RE.test(seg))
+        return null;
+    const buf = Buffer.from(seg, "base64url");
+    if (buf.length === 0)
+        return null;
+    // Round-trip guard: re-encoding must reproduce the segment exactly, which
+    // rules out the trailing-bit slack base64 otherwise tolerates.
+    if (buf.toString("base64url") !== seg)
+        return null;
+    return buf;
+}
+/** Mints a token. Needs the PRIVATE key, which lives only in the fulfilment
+ *  worker's secret store (see `supporterKey.ts` provenance) — nothing in the
+ *  published package or the test suite uses the real one. Exported because a
+ *  format is only trustworthy if the thing that writes it and the thing that
+ *  reads it are specified together, and because the round-trip tests need to
+ *  sign with a throwaway key. */
+export function signSupporterToken(claims, privateKeyPem) {
+    const key = createPrivateKey(privateKeyPem);
+    if (key.asymmetricKeyType !== "ed25519") {
+        throw new Error(`supporter token: signing key must be ed25519, got ${key.asymmetricKeyType ?? "unknown"}`);
+    }
+    const payloadSeg = b64uEncode(Buffer.from(JSON.stringify(claims), "utf8"));
+    const signingInput = `${SUPPORTER_TOKEN_PREFIX}.${payloadSeg}`;
+    // `null` algorithm: Ed25519 hashes internally and node:crypto requires the
+    // digest argument to be null for it.
+    const sig = cryptoSign(null, Buffer.from(signingInput, "ascii"), key);
+    return `${signingInput}.${b64uEncode(sig)}`;
+}
+/** Structural + cryptographic checks, with no notion of "now". Split out so
+ *  the time-dependent part is a pure function of already-verified claims —
+ *  which is what lets `isSupporter()` cache the expensive half and re-decide
+ *  expiry on every call for free. */
+function verifyShapeAndSignature(token) {
+    const trimmed = token.trim();
+    if (trimmed.length === 0)
+        return { ok: false, reason: "empty" };
+    if (Buffer.byteLength(trimmed, "utf8") > SUPPORTER_MAX_TOKEN_BYTES)
+        return { ok: false, reason: "too_large" };
+    const parts = trimmed.split(".");
+    if (parts.length !== 3)
+        return { ok: false, reason: "malformed" };
+    const [prefix, payloadSeg, sigSeg] = parts;
+    if (prefix !== SUPPORTER_TOKEN_PREFIX)
+        return { ok: false, reason: "malformed" };
+    const sigBytes = b64uDecode(sigSeg);
+    // Ed25519 signatures are exactly 64 bytes; anything else is not one.
+    if (!sigBytes || sigBytes.length !== 64)
+        return { ok: false, reason: "malformed" };
+    const payloadBytes = b64uDecode(payloadSeg);
+    if (!payloadBytes)
+        return { ok: false, reason: "malformed" };
+    let parsed;
+    try {
+        parsed = JSON.parse(payloadBytes.toString("utf8"));
+    }
+    catch {
+        return { ok: false, reason: "bad_payload" };
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return { ok: false, reason: "bad_payload" };
+    const p = parsed;
+    if (p.v !== 1)
+        return { ok: false, reason: "bad_payload" };
+    const kid = p.kid;
+    if (typeof kid !== "string" || !KID_RE.test(kid))
+        return { ok: false, reason: "bad_payload" };
+    const sub = p.sub;
+    if (typeof sub !== "string" || !SUB_RE.test(sub))
+        return { ok: false, reason: "bad_payload" };
+    const tier = p.tier;
+    if (typeof tier !== "string")
+        return { ok: false, reason: "bad_payload" };
+    const iat = p.iat;
+    const exp = p.exp;
+    if (!Number.isSafeInteger(iat) || !Number.isSafeInteger(exp))
+        return { ok: false, reason: "bad_payload" };
+    const iatN = iat;
+    const expN = exp;
+    if (iatN <= 0 || expN <= iatN)
+        return { ok: false, reason: "bad_payload" };
+    // Key selection happens BEFORE the signature check and is driven entirely
+    // by the committed key map: an unknown `kid` can never reach verification,
+    // so the token cannot nominate its own trust root.
+    const pem = Object.prototype.hasOwnProperty.call(SUPPORTER_PUBLIC_KEYS, kid)
+        ? SUPPORTER_PUBLIC_KEYS[kid]
+        : undefined;
+    if (!pem)
+        return { ok: false, reason: "unknown_key" };
+    let signatureOk = false;
+    try {
+        const publicKey = createPublicKey(pem);
+        // Belt and braces against a future edit to the committed key map putting
+        // a non-Ed25519 key in it. `crypto.verify(null, …)` would throw for most
+        // other key types and be caught below, but an explicit refusal is
+        // clearer than relying on which algorithms happen to reject a null
+        // digest — and it is the check that keeps "the algorithm is Ed25519
+        // because this file says so" literally true.
+        if (publicKey.asymmetricKeyType !== "ed25519")
+            return { ok: false, reason: "unknown_key" };
+        signatureOk = cryptoVerify(null, Buffer.from(`${SUPPORTER_TOKEN_PREFIX}.${payloadSeg}`, "ascii"), publicKey, sigBytes);
+    }
+    catch {
+        signatureOk = false;
+    }
+    if (!signatureOk)
+        return { ok: false, reason: "bad_signature" };
+    // Tier and lifetime are checked only AFTER the signature: a rejection
+    // before that would be a statement about an unauthenticated payload.
+    if (tier !== SUPPORTER_TIER)
+        return { ok: false, reason: "wrong_tier" };
+    if ((expN - iatN) * 1000 > SUPPORTER_MAX_LIFETIME_MS)
+        return { ok: false, reason: "implausible_lifetime" };
+    return { ok: true, claims: { v: 1, kid, sub, tier, iat: iatN, exp: expN } };
+}
+/** Full verification: shape, signature, tier, then expiry against `now`.
+ *  Pure and synchronous — no filesystem, no clock injection beyond `now`, and
+ *  nothing that can touch a socket. */
+export function verifySupporterToken(token, now = Date.now()) {
+    const base = verifyShapeAndSignature(token);
+    if (!base.ok)
+        return { state: "invalid", reason: base.reason };
+    return classifyClaims(base.claims, now);
+}
+/** The time-dependent half, over claims whose signature is already trusted. */
+export function classifyClaims(claims, now = Date.now()) {
+    if (claims.iat * 1000 > now + SUPPORTER_MAX_CLOCK_SKEW_MS) {
+        return { state: "invalid", reason: "not_yet_valid" };
+    }
+    const expMs = claims.exp * 1000;
+    if (now <= expMs)
+        return { state: "valid", claims };
+    if (now <= expMs + SUPPORTER_GRACE_MS)
+        return { state: "grace", claims };
+    return { state: "expired", claims };
+}
+/** Verifies shape + signature only, deferring every time-dependent decision
+ *  to `classifyClaims`. `isSupporter()`'s cache is built on this split. */
+export function verifySupporterTokenClaims(token) {
+    return verifyShapeAndSignature(token);
+}
+//# sourceMappingURL=supporterToken.js.map

package/dist/ads/supporterToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supporterToken.js","sourceRoot":"","sources":["../../src/ads/supporterToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCA6CiC;AAEjC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,iEAAiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC;;;;;;;;uBAQuB;AACvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1D;;;+EAG+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/D;;;+BAG+B;AAC/B,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnE;iEACiE;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAqC9C;yCACyC;AACzC,MAAM,UAAU,UAAU,CAAC,OAAyB;IAClD,OAAO,OAAO,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,GAAG,kBAAkB,CAAC;AACtC,MAAM,MAAM,GAAG,2BAA2B,CAAC;AAC3C,MAAM,MAAM,GAAG,uBAAuB,CAAC;AAEvC,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED;;;gEAGgE;AAChE,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,0EAA0E;IAC1E,+DAA+D;IAC/D,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;iCAKiC;AACjC,MAAM,UAAU,kBAAkB,CAAC,MAAuB,EAAE,aAAqB;IAC/E,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,CAAC,iBAAiB,IAAI,SAAS,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3E,MAAM,YAAY,GAAG,GAAG,sBAAsB,IAAI,UAAU,EAAE,CAAC;IAC/D,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACtE,OAAO,GAAG,YAAY,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED;;;qCAGqC;AACrC,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAChE,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,yBAAyB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE9G,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAiC,CAAC;IACvE,IAAI,MAAM,KAAK,sBAAsB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAEjF,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,qEAAqE;IACrE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACnF,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE7D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAChH,MAAM,CAAC,GAAG,MAAiC,CAAC;IAE5C,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAClB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9F,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAClB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9F,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC1E,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAClB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAClB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC1G,MAAM,IAAI,GAAG,GAAa,CAAC;IAC3B,MAAM,IAAI,GAAG,GAAa,CAAC;IAC3B,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAE3E,0EAA0E;IAC1E,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,CAAC;QAC1E,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC;QAC5B,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEtD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACvC,yEAAyE;QACzE,yEAAyE;QACzE,kEAAkE;QAClE,mEAAmE;QACnE,oEAAoE;QACpE,6CAA6C;QAC7C,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC3F,WAAW,GAAG,YAAY,CACxB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,GAAG,sBAAsB,IAAI,UAAU,EAAE,EAAE,OAAO,CAAC,EAC/D,SAAS,EACT,QAAQ,CACT,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAEhE,sEAAsE;IACtE,qEAAqE;IACrE,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACxE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,yBAAyB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAE3G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED;;uCAEuC;AACvC,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC1E,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/D,OAAO,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,MAAuB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC9E,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,2BAA2B,EAAE,CAAC;QAC1D,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAChC,IAAI,GAAG,IAAI,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACpD,IAAI,GAAG,IAAI,KAAK,GAAG,kBAAkB;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACzE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC"}

package/dist/ads/types.d.ts

@@ -0,0 +1,53 @@
+/** The ONLY shape sponsored content is ever allowed to take inside this
+ *  process (see .reposkein/decisions/2026-08-21-sponsorship-placement-*.json:
+ *  "Sponsor payloads are fixed-schema and length-capped, not freeform text or
+ *  markup"). Anything a network returns is projected onto this and rejected if
+ *  it doesn't fit — never merged, never spread, never passed through.
+ *
+ *  `label` is a literal, constructed locally by `sanitizeSponsored` and never
+ *  copied from the payload: the disclosure is a property of OUR envelope, not
+ *  sponsor-supplied content, which is the same immutability rule the ADR fixes
+ *  for the viewer chip. */
+export interface SponsoredSlot {
+    readonly label: typeof SPONSORED_LABEL;
+    /** Headline, <= TITLE_MAX chars, plain text. */
+    readonly title?: string;
+    /** Body copy, <= BODY_MAX chars, plain text. */
+    readonly body?: string;
+    /** https, host in the ad network's click-domain allowlist. */
+    readonly url: string;
+}
+/** Immutable. Renaming this constant renames a disclosure, which is exactly
+ *  what the governing ADR forbids — the "label is immutable" block in
+ *  `mcp/test/adsSanitize.test.ts` asserts the literal survives every payload
+ *  that tries to rename, blank, or drop it. */
+export declare const SPONSORED_LABEL = "sponsored";
+/** Response-envelope key the slot is attached under. `_meta` (not `content`,
+ *  not a new `structuredContent`) so the slot can never displace, reorder, or
+ *  concatenate itself into the tool's own answer. */
+export declare const SPONSORED_META_KEY = "reposkein/sponsored";
+export declare const TITLE_MAX = 80;
+export declare const BODY_MAX = 200;
+export declare const URL_MAX = 512;
+/** Anything larger than this isn't a slot payload; reject before parsing fields. */
+export declare const PAYLOAD_MAX_BYTES = 4096;
+/** Everything that leaves this machine for a slot request.
+ *
+ *  Deliberately not extensible: `tool` is a tool NAME from this server's own
+ *  registry (a fixed, public string — `get_context_profile`), and `keywords`
+ *  is coarse free text the caller opted to share. No file paths, no node ids,
+ *  no code, no summaries, no repo id, no identity. See docs/SPONSORSHIP.md. */
+export interface SlotContext {
+    readonly tool: string;
+    readonly keywords?: string;
+}
+/** A source of raw (untrusted) slot payloads. One implementation talks to the
+ *  ad network (`luluAdsSource`); tests inject fakes. The return value is
+ *  `unknown` on purpose — a source is a transport, never a validator; the
+ *  ONLY validator is `sanitizeSponsored`. */
+export interface SponsoredSource {
+    requestSlot(ctx: SlotContext, opts: {
+        timeoutMs: number;
+        signal: AbortSignal;
+    }): Promise<unknown>;
+}

package/dist/ads/types.js

@@ -0,0 +1,15 @@
+/** Immutable. Renaming this constant renames a disclosure, which is exactly
+ *  what the governing ADR forbids — the "label is immutable" block in
+ *  `mcp/test/adsSanitize.test.ts` asserts the literal survives every payload
+ *  that tries to rename, blank, or drop it. */
+export const SPONSORED_LABEL = "sponsored";
+/** Response-envelope key the slot is attached under. `_meta` (not `content`,
+ *  not a new `structuredContent`) so the slot can never displace, reorder, or
+ *  concatenate itself into the tool's own answer. */
+export const SPONSORED_META_KEY = "reposkein/sponsored";
+export const TITLE_MAX = 80;
+export const BODY_MAX = 200;
+export const URL_MAX = 512;
+/** Anything larger than this isn't a slot payload; reject before parsing fields. */
+export const PAYLOAD_MAX_BYTES = 4096;
+//# sourceMappingURL=types.js.map

package/dist/ads/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/ads/types.ts"],"names":[],"mappings":"AAoBA;;;+CAG+C;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C;;qDAEqD;AACrD,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAExD,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAC5B,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC;AAC5B,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC;AAC3B,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC"}

package/dist/cli/support.d.ts

@@ -0,0 +1,46 @@
+/** `reposkein-mcp support` — install, inspect, and remove a supporter
+ *  entitlement token.
+ *
+ *  Four shapes, no subcommands:
+ *
+ *      reposkein-mcp support <token>     verify and store it
+ *      reposkein-mcp support -           read the token from stdin instead
+ *      reposkein-mcp support --status    what is installed and until when
+ *      reposkein-mcp support --remove    delete it
+ *
+ *  `-` exists because a token passed as an argument is not private: it lands
+ *  in `~/.bash_history`, and while the process runs it is visible in `ps` and
+ *  `/proc/<pid>/cmdline` to every other user on the machine. Piping it in
+ *  keeps it off both. It is not a secret worth much — the worst outcome of a
+ *  leak is somebody else getting no ads — but "it barely matters" is a poor
+ *  reason to make the private option unavailable.
+ *
+ *  The token is verified BEFORE it is written: an install that stores
+ *  unverified bytes and only complains later leaves the user with a file that
+ *  looks installed and does nothing. Nothing here contacts the network — see
+ *  `ads/supporter.ts` — so `support` works offline, which matters because the
+ *  token typically arrives by copy-paste into a terminal that may not be the
+ *  one that fetched it. */
+import { type SupporterStatus } from "../ads/supporter.js";
+import { type SupporterRejection } from "../ads/supporterToken.js";
+export interface SupportArgs {
+    mode: "install" | "status" | "remove";
+    token?: string;
+    /** `-` was given: the token comes from stdin, not from argv. */
+    stdin?: boolean;
+    json: boolean;
+    error?: string;
+}
+export declare function parseSupportArgs(argv: string[]): SupportArgs;
+/** Human-readable explanation of a rejection. Deliberately specific: "invalid
+ *  token" tells a paying supporter nothing about whether to re-copy it or ask
+ *  for a new one. */
+export declare function explainRejection(reason: SupporterRejection): string;
+export declare function renderStatus(status: SupporterStatus, now: number, color: boolean): string;
+export declare function renderStatusJson(status: SupporterStatus, now: number): string;
+/** Entry point. Returns the process exit code: 0 when the machine ends up
+ *  entitled (or a removal succeeded), 1 otherwise — so a script can branch on
+ *  `reposkein-mcp support --status` without parsing text.
+ *
+ *  `readStdin` is a test seam; production always reads fd 0. */
+export declare function runSupport(argv: string[], env?: NodeJS.ProcessEnv, now?: number, readStdin?: () => string): number;