@rosthq/cli 0.7.154 → 0.7.156
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +14 -7
- package/dist/commands/implementation-access.d.ts +2 -0
- package/dist/commands/implementation-access.d.ts.map +1 -1
- package/dist/commands/onboarding.d.ts +3 -2
- package/dist/commands/onboarding.d.ts.map +1 -1
- package/dist/forge-workspace.d.ts +30 -6
- package/dist/forge-workspace.d.ts.map +1 -1
- package/dist/implementation-bootstrap.d.ts +20 -3
- package/dist/implementation-bootstrap.d.ts.map +1 -1
- package/dist/implementation-credential-store.d.ts +18 -0
- package/dist/implementation-credential-store.d.ts.map +1 -1
- package/dist/implementation-run-tombstone.d.ts +31 -0
- package/dist/implementation-run-tombstone.d.ts.map +1 -0
- package/dist/index.d.ts +5 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2181 -665
- package/dist/index.js.map +4 -4
- package/dist/runner-login.d.ts +29 -0
- package/dist/runner-login.d.ts.map +1 -0
- package/dist/runner-sandbox.d.ts +6 -1
- package/dist/runner-sandbox.d.ts.map +1 -1
- package/dist/runner-serve.d.ts +15 -2
- package/dist/runner-serve.d.ts.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -96,11 +96,18 @@ rost onboard status
|
|
|
96
96
|
rost onboard resume
|
|
97
97
|
```
|
|
98
98
|
|
|
99
|
-
Every tenant-scoped `rost onboard` verb (and `rost seat create-complete`)
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
99
|
+
Every tenant-scoped `rost onboard` verb (and `rost seat create-complete`) uses
|
|
100
|
+
an existing implementation-bootstrap credential first. An absent credential
|
|
101
|
+
leaves the ordinary owner-session path available; an expired, unreadable, or
|
|
102
|
+
refused credential stops the command without retrying under another principal.
|
|
103
|
+
Human decision commands are terminal in headless runs and remain available to
|
|
104
|
+
an explicit interactive TTY owner. This includes the registry's
|
|
105
|
+
`human_required` commands, all four `credential_flow` commands
|
|
106
|
+
(`agent.configure_tools`, `credential.ingress`, `integration.connect_rest`, and
|
|
107
|
+
`tenant.anthropic_key.save`), and the none-class human decisions for
|
|
108
|
+
escalations, onboarding path selection, task proposals, Signal readings, error
|
|
109
|
+
logs, and confirmation approve/reject/remint. (`rost onboard run` prints the
|
|
110
|
+
public onboarding prompt offline and needs no credential.)
|
|
104
111
|
|
|
105
112
|
Retain each allowed local business source before constructing the setup plan.
|
|
106
113
|
The CLI reads the file and base64-encodes it client-side; the server computes
|
|
@@ -210,6 +217,6 @@ rost implementation access install-mcp --client codex
|
|
|
210
217
|
rost implementation access install-mcp --client cursor
|
|
211
218
|
```
|
|
212
219
|
|
|
213
|
-
The implementation credential is intentionally narrow and
|
|
220
|
+
The implementation credential is intentionally narrow and explicitly classified. It can run vetted reads (for example `onboarding.status`, `graph.get`, `charter.get/list`, `compass.get_current`, `goal.list`, `agent.list_fleet`, `system.health`), stage human-gated proposals (`onboarding.setup`, `onboarding.activate`, `seat.create_complete`, `agent.create_custom`, `agent.create_from_template`, `compass.set`, `compass.approve_version`, `onboarding.finish`, `agent.run_now`), execute only the receipt-bound sandbox exception `onboarding.rehearse`, and close its own run. `seat.create_complete` stages one atomic complete-Seat proposal for an owner to approve; it never makes an optional agent live. `onboarding.activate` stages the one post-rehearsal owner decision and cannot approve itself. `agent.run_now` stages one manual production run at a time, bounded to agents this same implementation run's own setup receipt created and re-checked when the approved run dispatches; it arms no schedule. The rehearsal exception grants no general agent execution authority and cannot reach unrelated agents. Everything outside the explicit class map, including other confirmation-free durable mutations and `confirmation.approve`, stays outside the bounded principal. The policy module is `packages/commands/src/implementation-bootstrap-policy.ts` and is enforced by both the runtime guard and a CI drift test.
|
|
214
221
|
|
|
215
|
-
With
|
|
222
|
+
With an implementation credential present, the CLI runs every classified command over that credential — on `rost command <id> --json '<body>'` and on the ergonomic verbs that resolve to a classified command (`rost graph show`, `rost seat list`, `rost agent list-fleet`, `rost agent templates`, `rost goal list`, `rost system health`, `rost skills list`, `rost skills catalog`, `rost charter list`, `rost charter get`, `rost compass get-current`) — even when a user session also exists. An expired, unreadable, unauthenticated, or refused implementation credential is terminal for that invocation; the CLI never silently replays the classified command as the owner. The complete human-only floor — `human_required`, `credential_flow`, and the explicit none-class decisions for escalations, onboarding path selection, task proposals, Signal readings, error logs, confirmation approve/reject/remint/dismiss/dismiss_stale/activation_set.list, `agent_grant_intervention.resume`, and `coach.draft_guide` — stops in a headless session while an explicit interactive TTY remains the deliberate owner path. A successful `implementation_access.complete` or `.abandon` clears the bearer and writes a local closed-run tombstone so headless bootstrap commands refuse owner fallthrough until a new `implementation access start`. Note that a Markdown-rendering `show` verb resolves to a `*.show_markdown` command outside the bounded surface (so `rost compass show` remains session-only; use `rost compass get-current`), and `rost agent fleet-digest` is likewise outside it (use `rost agent list-fleet`).
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { CommandClient } from "../command-client.js";
|
|
2
2
|
import { pollDeviceAuthorizationHandoff } from "../device-auth.js";
|
|
3
3
|
import { type ImplementationCredentialStore } from "../implementation-credential-store.js";
|
|
4
|
+
import { type ImplementationRunTombstoneStore } from "../implementation-run-tombstone.js";
|
|
4
5
|
export type ImplementationAccessAction = "start" | "status" | "complete" | "abandon";
|
|
5
6
|
type CliIo = {
|
|
6
7
|
stdout: Pick<NodeJS.WriteStream, "write">;
|
|
@@ -9,6 +10,7 @@ type CliIo = {
|
|
|
9
10
|
export type ImplementationAccessDeps = {
|
|
10
11
|
appUrl: string;
|
|
11
12
|
createImplementationStore(): ImplementationCredentialStore;
|
|
13
|
+
createTombstoneStore?(): ImplementationRunTombstoneStore;
|
|
12
14
|
pollDeviceAuthorizationHandoff: typeof pollDeviceAuthorizationHandoff;
|
|
13
15
|
CommandClient: typeof CommandClient;
|
|
14
16
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"implementation-access.d.ts","sourceRoot":"","sources":["../../src/commands/implementation-access.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,
|
|
1
|
+
{"version":3,"file":"implementation-access.d.ts","sourceRoot":"","sources":["../../src/commands/implementation-access.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EACL,8BAA8B,EAI/B,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAGL,KAAK,6BAA6B,EACnC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,oCAAoC,CAAC;AAe5C,MAAM,MAAM,0BAA0B,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAErF,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB,IAAI,6BAA6B,CAAC;IAC3D,oBAAoB,CAAC,IAAI,+BAA+B,CAAC;IACzD,8BAA8B,EAAE,OAAO,8BAA8B,CAAC;IACtE,aAAa,EAAE,OAAO,aAAa,CAAC;CACrC,CAAC;AAEF,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAKD,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,KAAK,EACT,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,MAAM,CAAC,CA2DjB;AA0JD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtD;AAiID,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,wBAAwB,CAOxF"}
|
|
@@ -44,8 +44,9 @@ export declare function runOnboarding(args: string[], io: CliIo, deps: Onboardin
|
|
|
44
44
|
* the user-session path (runOnboarding) and the implementation-credential path
|
|
45
45
|
* in index.ts, so both credentials get identical bodies and rendering.
|
|
46
46
|
*
|
|
47
|
-
* `onError` lets the implementation-credential caller intercept
|
|
48
|
-
*
|
|
47
|
+
* `onError` lets the implementation-credential caller intercept credential or
|
|
48
|
+
* policy errors before shared rendering; the caller handles an intercepted
|
|
49
|
+
* outcome as terminal rather than retrying under an owner session.
|
|
49
50
|
*/
|
|
50
51
|
export declare function executeOnboardingInvocation(invocation: OnboardingInvocation, io: CliIo, client: CommandClient): Promise<number>;
|
|
51
52
|
export declare function executeOnboardingInvocation(invocation: OnboardingInvocation, io: CliIo, client: CommandClient, options: {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/commands/onboarding.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAsB,MAAM,sBAAsB,CAAC;AAMzE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAI3B,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAGrC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C,CAAC;AAkDF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,MAAM,EACrB,YAAY,GAAE,MAAsC,GACnD,MAAM,CAMR;AAqBD,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EACL,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,0BAA0B,GAC1B,kBAAkB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,GAAG,OAAO,GAAG,cAAc,CAAC;IAInG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAepG;AAED
|
|
1
|
+
{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/commands/onboarding.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAsB,MAAM,sBAAsB,CAAC;AAMzE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAI3B,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAGrC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C,CAAC;AAkDF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,MAAM,EACrB,YAAY,GAAE,MAAsC,GACnD,MAAM,CAMR;AAqBD,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EACL,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,0BAA0B,GAC1B,kBAAkB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,GAAG,OAAO,GAAG,cAAc,CAAC;IAInG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAepG;AAED;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,oBAAoB,EAChC,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,MAAM,CAAC,CAAC;AACnB,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,oBAAoB,EAChC,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE;IAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,GAAG,OAAO,CAAA;CAAE,GAC5D,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;AAoCpC;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,UAAU,EAAE,oBAAoB,EAChC,YAAY,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAY,GACzD,OAAO,CAAC,IAAI,CAAC,CAqEf;AAgDD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,oBAAoB,CA+G9E;AA2FD,wBAAgB,eAAe,IAAI,MAAM,CAUxC;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EACtC,MAAM,EAAE,OAAO,GACd,MAAM,CAoBR"}
|
|
@@ -1,8 +1,29 @@
|
|
|
1
1
|
import { type StepLedger } from "./step-ledger.js";
|
|
2
2
|
export declare const MODEL_SPAWN_ENV_ALLOWLIST: readonly ["PATH", "HOME", "USER", "LANG", "LC_ALL", "TMPDIR", "SHELL", "NODE_OPTIONS"];
|
|
3
|
-
export declare function buildModelSpawnEnv(base: NodeJS.ProcessEnv, claudeConfigDir?: string, codexHomeDir?: string): NodeJS.ProcessEnv;
|
|
3
|
+
export declare function buildModelSpawnEnv(base: NodeJS.ProcessEnv, claudeConfigDir?: string, codexHomeDir?: string, claudeSecureStorageDir?: string): NodeJS.ProcessEnv;
|
|
4
4
|
export declare function resolveSourceClaudeConfigDir(base: NodeJS.ProcessEnv): string;
|
|
5
|
-
export declare function
|
|
5
|
+
export declare function resolveSourceClaudeSecureStorageDir(base: NodeJS.ProcessEnv): string;
|
|
6
|
+
export declare function provisionIsolatedClaudeConfigDir(configDir: string, seedSourceDir: string, onRepair?: (message: string) => void): Promise<string>;
|
|
7
|
+
export declare function sweepClaudeCredentialCell(cell: string, onRepair?: (message: string) => void): Promise<void>;
|
|
8
|
+
export declare function hasUsableClaudeCredentialFile(cell: string): Promise<boolean>;
|
|
9
|
+
export declare function claudeKeychainServiceNameForSecureStorageDir(secureStorageDir: string): string;
|
|
10
|
+
export type MaterializeClaudeCredentialFromKeychainResult = {
|
|
11
|
+
status: "written";
|
|
12
|
+
} | {
|
|
13
|
+
status: "already_present";
|
|
14
|
+
} | {
|
|
15
|
+
status: "unavailable";
|
|
16
|
+
reason: string;
|
|
17
|
+
};
|
|
18
|
+
/**
|
|
19
|
+
* Copy a Claude Code Keychain OAuth blob into `<cell>/.credentials.json` when the file
|
|
20
|
+
* store is empty. Used by `rost runner login` after Claude 2.1.221+ stores the cell
|
|
21
|
+
* credential in Keychain (unreachable under the turn seatbelt). Never logs secret material.
|
|
22
|
+
*/
|
|
23
|
+
export declare function materializeClaudeCredentialFileFromMacosKeychain(cell: string, options?: {
|
|
24
|
+
platform?: NodeJS.Platform;
|
|
25
|
+
readKeychainSecretImpl?: (serviceName: string) => Promise<string | null>;
|
|
26
|
+
}): Promise<MaterializeClaudeCredentialFromKeychainResult>;
|
|
6
27
|
export declare function resolveSourceCodexHomeDir(base: NodeJS.ProcessEnv): string;
|
|
7
28
|
export declare const CODEX_HOME_TMP_PREFIX = ".rost-tmp-";
|
|
8
29
|
export declare function writeFileAtomicNoFollow(dest: string, data: Buffer | string, options?: {
|
|
@@ -12,17 +33,20 @@ export declare function writeFileAtomicNoFollow(dest: string, data: Buffer | str
|
|
|
12
33
|
durable?: boolean;
|
|
13
34
|
}): Promise<void>;
|
|
14
35
|
export declare function ensureVerifiedPrivateDir(dir: string, label: string, onRepair?: (message: string) => void): Promise<void>;
|
|
15
|
-
export declare function ensureVerifiedCodexHomeDir(homeDir: string, onRepair?: (message: string) => void): Promise<string>;
|
|
16
|
-
export declare function
|
|
36
|
+
export declare function ensureVerifiedCodexHomeDir(homeDir: string, onRepair?: (message: string) => void, label?: string): Promise<string>;
|
|
37
|
+
export declare function isVerifiedExistingCodexHomeDir(homeDir: string): Promise<boolean>;
|
|
38
|
+
export declare function commitCodexHomeSeedMarker(homeDir: string, options?: {
|
|
39
|
+
required?: boolean;
|
|
40
|
+
}): Promise<void>;
|
|
17
41
|
export declare function provisionIsolatedCodexHomeDir(base: NodeJS.ProcessEnv, homeDir: string, projectRoot?: string, onRepair?: (message: string) => void): Promise<string>;
|
|
18
42
|
export type CodexHomeLock = {
|
|
19
43
|
release: () => Promise<void>;
|
|
20
44
|
};
|
|
21
|
-
export declare function
|
|
22
|
-
export declare const CODEX_HOME_BUSY_SUMMARY: string;
|
|
45
|
+
export declare function credentialCellBusySummary(waitedMs: number, runtime: "claude" | "codex"): string;
|
|
23
46
|
export declare function acquireCodexHomeLock(homeDir: string, options?: {
|
|
24
47
|
waitMs?: number;
|
|
25
48
|
staleMs?: number;
|
|
49
|
+
label?: string;
|
|
26
50
|
}): Promise<CodexHomeLock | null>;
|
|
27
51
|
export type ForgeCredential = {
|
|
28
52
|
token: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"forge-workspace.d.ts","sourceRoot":"","sources":["../src/forge-workspace.ts"],"names":[],"mappings":"AA8CA,OAAO,EAAqB,KAAK,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AASrF,eAAO,MAAM,yBAAyB,
|
|
1
|
+
{"version":3,"file":"forge-workspace.d.ts","sourceRoot":"","sources":["../src/forge-workspace.ts"],"names":[],"mappings":"AA8CA,OAAO,EAAqB,KAAK,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AASrF,eAAO,MAAM,yBAAyB,wFAiB5B,CAAC;AAEX,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,UAAU,EAOvB,eAAe,CAAC,EAAE,MAAM,EAMxB,YAAY,CAAC,EAAE,MAAM,EAOrB,sBAAsB,CAAC,EAAE,MAAM,GAC9B,MAAM,CAAC,UAAU,CAmCnB;AAkED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAQ5E;AAmBD,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAMnF;AAgBD,wBAAsB,gCAAgC,CACpD,SAAS,EAAE,MAAM,EAEjB,aAAa,EAAE,MAAM,EAGrB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GACnC,OAAO,CAAC,MAAM,CAAC,CAsDjB;AAWD,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GACnC,OAAO,CAAC,IAAI,CAAC,CAmIf;AA0DD,wBAAsB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMlF;AAOD,wBAAgB,4CAA4C,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAG7F;AAwBD,MAAM,MAAM,6CAA6C,GACrD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAC7B;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9C;;;;GAIG;AACH,wBAAsB,gDAAgD,CACpE,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IACP,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,sBAAsB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACrE,GACL,OAAO,CAAC,6CAA6C,CAAC,CA6CxD;AAoCD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAQzE;AAyBD,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAiBlD,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/F,OAAO,CAAC,IAAI,CAAC,CAsFf;AAkED,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EAIb,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GACnC,OAAO,CAAC,IAAI,CAAC,CAiDf;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,MAAM,EAKf,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,EAIpC,KAAK,SAAe,GACnB,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAOD,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBtF;AAsCD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GACnC,OAAO,CAAC,IAAI,CAAC,CAwBf;AA2BD,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,OAAO,EAAE,MAAM,EAkBf,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GACnC,OAAO,CAAC,MAAM,CAAC,CA6OjB;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;AAgB7D,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAS/F;AA2BD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EAQf,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAClE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAyM/B;AAmMD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAG3B,QAAQ,EAAE,MAAM,CAAC;IAGjB,WAAW,EAAE,MAAM,CAAC;IAGpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAKlB,OAAO,EAAE,MAAM,CAAC;IAIhB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,4BAA4B,GAAG;IAEzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,qBAAqB,CAAC;IAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAI5B,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAmLF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAOlE;AAgBD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAMvH;AAOD,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,UAAU,EAAE,eAAe,EAC3B,gBAAgB,EAAE,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC,GAAG,SAAS,EAC9D,EAAE,EAAE,CAAC,UAAU,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9C,OAAO,CAAC,CAAC,CAAC,CAWZ;AA4DD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB5E;AAqJD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CAiB1G;AASD,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAE5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CA0C1G;AAsED,wBAAsB,aAAa,CACjC,EAAE,EAAE,cAAc,EAClB,UAAU,EAAE,eAAe,EAC3B,MAAM,CAAC,EAAE,UAAU,EACnB,OAAO,CAAC,EAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAA;CAAE,GAC9D,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,eAAe,CAAA;CAAE,GAAG,IAAI,CAAC,CAgEpE;AAsBD,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiC/E;AAcD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9D,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;IAG5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAGzB,MAAM,CAAC,EAAE,UAAU,CAAC;IAIpB,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;CACnD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IAGf,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AA+GF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAM1G;AA4CD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAE1B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAIF,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,WAAW,GACX,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CA4BxF;AAsBD,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAI5D,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAajC;AAED,MAAM,MAAM,iBAAiB,GAEzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAE9C;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAQzB,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwC7B;AAID,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAgBD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BxH;AAiBD,wBAAsB,eAAe,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE"}
|
|
@@ -2,13 +2,20 @@ import { CommandClient, type CommandClientOptions } from "./command-client.js";
|
|
|
2
2
|
import type { ManifestBootstrapClass } from "./generator/manifest-types.js";
|
|
3
3
|
/**
|
|
4
4
|
* The implementation-bootstrap class for a command id, as bundled in this CLI
|
|
5
|
-
* build.
|
|
6
|
-
*
|
|
7
|
-
*
|
|
5
|
+
* build. The manifest carries the positive class projection; an id outside that
|
|
6
|
+
* projection is not available to this principal (and is returned as `deny` for
|
|
7
|
+
* the instance gate). This projection is a local emission boundary only. The
|
|
8
|
+
* server's registry policy remains the authority, so a stale projection may be
|
|
9
|
+
* narrower or broader than the server's current view, but it cannot authorize a
|
|
10
|
+
* request the server rejects.
|
|
8
11
|
*/
|
|
9
12
|
export declare function resolveImplementationBootstrapClass(commandId: string): ManifestBootstrapClass;
|
|
10
13
|
/** Every command id this CLI build will send over the implementation credential, sorted. */
|
|
11
14
|
export declare function implementationBootstrapCommandIds(): string[];
|
|
15
|
+
/** Whether the production registry marks this id as a human-decision command. */
|
|
16
|
+
export declare function isHumanDecisionCommand(commandId: string): boolean;
|
|
17
|
+
/** Treat malformed or equal-to-now expiries as unusable before any network send. */
|
|
18
|
+
export declare function isImplementationCredentialExpired(expiresAt: string, now?: Date): boolean;
|
|
12
19
|
/**
|
|
13
20
|
* Raised INSTEAD of sending a deny-class command over the implementation
|
|
14
21
|
* credential. It carries the command id and nothing else — never the token, the
|
|
@@ -18,6 +25,16 @@ export declare class ImplementationBootstrapDeniedError extends Error {
|
|
|
18
25
|
readonly commandId: string;
|
|
19
26
|
constructor(commandId: string);
|
|
20
27
|
}
|
|
28
|
+
/** A stable operator message for a credential that cannot be retried as owner. */
|
|
29
|
+
export declare function implementationCredentialExpiredMessage(hasUserSession: boolean): string;
|
|
30
|
+
/** Refuse a noninteractive human-decision command while a bounded run is active. */
|
|
31
|
+
export declare function implementationHumanDecisionMessage(commandId: string): string;
|
|
32
|
+
/**
|
|
33
|
+
* A server response means the bearer is unusable only for authentication
|
|
34
|
+
* failures. Authorization/policy refusals are not liveness signals and must not
|
|
35
|
+
* trigger a more-privileged owner retry.
|
|
36
|
+
*/
|
|
37
|
+
export declare function isImplementationCredentialUnusable(error: unknown): boolean;
|
|
21
38
|
/**
|
|
22
39
|
* Build the implementation-bootstrap `CommandClient` — the ONLY sanctioned way to
|
|
23
40
|
* construct one — with the class gate installed on the instance's `execute`.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"implementation-bootstrap.d.ts","sourceRoot":"","sources":["../src/implementation-bootstrap.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"implementation-bootstrap.d.ts","sourceRoot":"","sources":["../src/implementation-bootstrap.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,aAAa,EAAsB,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AA0D5E;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAE7F;AAED,4FAA4F;AAC5F,wBAAgB,iCAAiC,IAAI,MAAM,EAAE,CAE5D;AAED,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,oFAAoF;AACpF,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,OAAa,GAAG,OAAO,CAG9F;AAED;;;;GAIG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,SAAS,EAAE,MAAM;CAK9B;AAED,kFAAkF;AAClF,wBAAgB,sCAAsC,CAAC,cAAc,EAAE,OAAO,GAAG,MAAM,CAStF;AAED,oFAAoF;AACpF,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAM5E;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQ1E;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mCAAmC,CACjD,iBAAiB,EAAE,OAAO,aAAa,EACvC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,GACpD,aAAa,CAUf"}
|
|
@@ -15,6 +15,24 @@ export type ImplementationCredentialStore = {
|
|
|
15
15
|
clear(): Promise<void>;
|
|
16
16
|
describe(): string;
|
|
17
17
|
};
|
|
18
|
+
export type ImplementationCredentialStoreBackend = "macOS Keychain" | "owner-only file store" | "Windows Credential Manager" | "Secret Service";
|
|
19
|
+
/**
|
|
20
|
+
* No supported implementation-credential backend is configured for this
|
|
21
|
+
* platform. This is a genuine absence (there is nowhere a credential could
|
|
22
|
+
* be stored), unlike a failure after a backend has been selected.
|
|
23
|
+
*/
|
|
24
|
+
export declare class ImplementationCredentialStoreUnavailableError extends Error {
|
|
25
|
+
constructor(message?: string);
|
|
26
|
+
}
|
|
27
|
+
/**
|
|
28
|
+
* A backend was reached but could not produce a trustworthy credential result.
|
|
29
|
+
* The message intentionally carries only the backend class — never the
|
|
30
|
+
* subprocess error, stdout, stderr, credential path, or token material.
|
|
31
|
+
*/
|
|
32
|
+
export declare class ImplementationCredentialStoreReadError extends Error {
|
|
33
|
+
readonly backend: ImplementationCredentialStoreBackend;
|
|
34
|
+
constructor(backend: ImplementationCredentialStoreBackend);
|
|
35
|
+
}
|
|
18
36
|
export declare class ImplementationFileTokenStore implements ImplementationCredentialStore {
|
|
19
37
|
private readonly filePath;
|
|
20
38
|
constructor(filePath?: string);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"implementation-credential-store.d.ts","sourceRoot":"","sources":["../src/implementation-credential-store.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAUL,KAAK,QAAQ,EACd,MAAM,kBAAkB,CAAC;AAO1B,QAAA,MAAM,uCAAuC;;;;;;;kBAOlC,CAAC;AAEZ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,IAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC,CAAC;IAC1D,KAAK,CAAC,UAAU,EAAE,iCAAiC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,IAAI,MAAM,CAAC;CACpB,CAAC;
|
|
1
|
+
{"version":3,"file":"implementation-credential-store.d.ts","sourceRoot":"","sources":["../src/implementation-credential-store.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAUL,KAAK,QAAQ,EACd,MAAM,kBAAkB,CAAC;AAO1B,QAAA,MAAM,uCAAuC;;;;;;;kBAOlC,CAAC;AAEZ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,IAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC,CAAC;IAC1D,KAAK,CAAC,UAAU,EAAE,iCAAiC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,IAAI,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAC5C,gBAAgB,GAChB,uBAAuB,GACvB,4BAA4B,GAC5B,gBAAgB,CAAC;AAErB;;;;GAIG;AACH,qBAAa,6CAA8C,SAAQ,KAAK;gBAEpE,OAAO,SAAwE;CAKlF;AAED;;;;GAIG;AACH,qBAAa,sCAAuC,SAAQ,KAAK;IAC/D,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC;gBAE3C,OAAO,EAAE,oCAAoC;CAK1D;AAmVD,qBAAa,4BAA6B,YAAW,6BAA6B;IACpE,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,SAAqB;IAEpD,IAAI,IAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAezD,KAAK,CAAC,UAAU,EAAE,iCAAiC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,QAAQ,IAAI,MAAM;YAIJ,cAAc;CAI7B;AAaD,MAAM,MAAM,0CAA0C,GAAG;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEF,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,0CAA+C,GACvD,6BAA6B,CAmC/B"}
|
|
@@ -0,0 +1,31 @@
|
|
|
1
|
+
import { z } from "zod";
|
|
2
|
+
/** Durable local marker that a bounded implementation run closed and cleared its credential. */
|
|
3
|
+
export declare const implementationRunTombstoneSchema: z.ZodObject<{
|
|
4
|
+
tenant_id: z.ZodString;
|
|
5
|
+
implementation_run_id: z.ZodString;
|
|
6
|
+
status: z.ZodEnum<{
|
|
7
|
+
completed: "completed";
|
|
8
|
+
abandoned: "abandoned";
|
|
9
|
+
}>;
|
|
10
|
+
closed_at: z.ZodString;
|
|
11
|
+
}, z.core.$strict>;
|
|
12
|
+
export type ImplementationRunTombstone = z.infer<typeof implementationRunTombstoneSchema>;
|
|
13
|
+
export type ImplementationRunTombstoneStore = {
|
|
14
|
+
read(): Promise<ImplementationRunTombstone | null>;
|
|
15
|
+
write(tombstone: ImplementationRunTombstone): Promise<void>;
|
|
16
|
+
clear(): Promise<void>;
|
|
17
|
+
};
|
|
18
|
+
export declare class ImplementationRunTombstoneFileStore implements ImplementationRunTombstoneStore {
|
|
19
|
+
private readonly filePath;
|
|
20
|
+
constructor(filePath?: string);
|
|
21
|
+
read(): Promise<ImplementationRunTombstone | null>;
|
|
22
|
+
write(tombstone: ImplementationRunTombstone): Promise<void>;
|
|
23
|
+
clear(): Promise<void>;
|
|
24
|
+
}
|
|
25
|
+
export type CreateImplementationRunTombstoneStoreOptions = {
|
|
26
|
+
env?: NodeJS.ProcessEnv;
|
|
27
|
+
};
|
|
28
|
+
export declare function createImplementationRunTombstoneStore(options?: CreateImplementationRunTombstoneStoreOptions): ImplementationRunTombstoneStore;
|
|
29
|
+
export declare function implementationRunClosedMessage(tombstone: ImplementationRunTombstone, hasUserSession: boolean): string;
|
|
30
|
+
export declare function recordImplementationRunClosed(store: ImplementationRunTombstoneStore, status: ImplementationRunTombstone["status"], fields: Pick<ImplementationRunTombstone, "tenant_id" | "implementation_run_id">, closedAt?: Date): Promise<void>;
|
|
31
|
+
//# sourceMappingURL=implementation-run-tombstone.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"implementation-run-tombstone.d.ts","sourceRoot":"","sources":["../src/implementation-run-tombstone.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,gGAAgG;AAChG,eAAO,MAAM,gCAAgC;;;;;;;;kBAKlC,CAAC;AAEZ,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,IAAI,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAC;IACnD,KAAK,CAAC,SAAS,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC;AAcF,qBAAa,mCAAoC,YAAW,+BAA+B;IAC7E,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,SAAyB;IAExD,IAAI,IAAI,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAelD,KAAK,CAAC,SAAS,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B;AAED,MAAM,MAAM,4CAA4C,GAAG;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,CAAC;AAEF,wBAAgB,qCAAqC,CACnD,OAAO,GAAE,4CAAiD,GACzD,+BAA+B,CAOjC;AAED,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,0BAA0B,EACrC,cAAc,EAAE,OAAO,GACtB,MAAM,CAUR;AAED,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,+BAA+B,EACtC,MAAM,EAAE,0BAA0B,CAAC,QAAQ,CAAC,EAC5C,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE,WAAW,GAAG,uBAAuB,CAAC,EAC/E,QAAQ,OAAa,GACpB,OAAO,CAAC,IAAI,CAAC,CAOf"}
|
package/dist/index.d.ts
CHANGED
|
@@ -3,12 +3,15 @@ import { CommandClient } from "./command-client.js";
|
|
|
3
3
|
import { loginWithBrowser, refreshCliSessionIfNeeded } from "./auth.js";
|
|
4
4
|
import { loginWithDeviceCode } from "./device-auth.js";
|
|
5
5
|
import { type TokenStore } from "./token-store.js";
|
|
6
|
+
import { type ImplementationCredentialStore } from "./implementation-credential-store.js";
|
|
7
|
+
import { type ImplementationRunTombstoneStore } from "./implementation-run-tombstone.js";
|
|
6
8
|
type CliIo = {
|
|
7
9
|
stdout: Pick<NodeJS.WriteStream, "write">;
|
|
8
10
|
stderr: Pick<NodeJS.WriteStream, "write">;
|
|
9
11
|
interactive?: boolean;
|
|
10
12
|
confirm?: (question: string) => Promise<boolean>;
|
|
11
13
|
};
|
|
14
|
+
type ImplementationCredentialStoreFactory = () => ImplementationCredentialStore;
|
|
12
15
|
export declare function createConfirmPrompt(input: NodeJS.ReadableStream, output: NodeJS.WritableStream): (question: string) => Promise<boolean>;
|
|
13
16
|
type MainOptions = {
|
|
14
17
|
store?: TokenStore;
|
|
@@ -17,6 +20,8 @@ type MainOptions = {
|
|
|
17
20
|
deviceLogin?: typeof loginWithDeviceCode;
|
|
18
21
|
refreshSession?: typeof refreshCliSessionIfNeeded;
|
|
19
22
|
commandClient?: typeof CommandClient;
|
|
23
|
+
implementationCredentialStore?: ImplementationCredentialStoreFactory;
|
|
24
|
+
implementationRunTombstoneStore?: () => ImplementationRunTombstoneStore;
|
|
20
25
|
};
|
|
21
26
|
export declare function main(argv?: string[], options?: MainOptions): Promise<number>;
|
|
22
27
|
export declare function isCliEntrypoint(moduleUrl: string, argvPath: string | undefined): boolean;
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAMA,OAAO,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAMA,OAAO,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAGL,KAAK,6BAA6B,EACnC,MAAM,sCAAsC,CAAC;AAW9C,OAAO,EAKL,KAAK,+BAA+B,EACrC,MAAM,mCAAmC,CAAC;AAyC3C,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAI1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AAoBF,KAAK,oCAAoC,GAAG,MAAM,6BAA6B,CAAC;AAgOhF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,CAAC,cAAc,EAC5B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAUxC;AAuBD,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;IAGlD,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;IAGrC,6BAA6B,CAAC,EAAE,oCAAoC,CAAC;IACrE,+BAA+B,CAAC,EAAE,MAAM,+BAA+B,CAAC;CACzE,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAosBnG;AA+iBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}
|