@sapiom/harness 0.0.0 → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Sapiom
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,45 +1,46 @@
 # @sapiom/harness
 
-## ⚠️ IMPORTANT NOTICE ⚠️
-
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
-
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
-
-## Purpose
-
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@sapiom/harness`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
-
-## What is OIDC Trusted Publishing?
-
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
-
-## Setup Instructions
-
-To properly configure OIDC trusted publishing for this package:
-
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
-
-## DO NOT USE THIS PACKAGE
-
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
-
-## More Information
-
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
-
----
-
-**Maintained for OIDC setup purposes only**
+A local web app for building on Sapiom with your own coding agent.
+
+```bash
+npx @sapiom/harness [dir]
+```
+
+One command: checks your environment, signs you in, and opens a browser app
+with your coding agent (Claude Code today, Codex next) running in an embedded
+terminal — pre-wired with the Sapiom MCP servers and a workflow-authoring
+system prompt, in whatever project directory you choose.
+
+## What you get
+
+- **Terminal sessions** — your agent, your subscription, your machine; the
+  harness only configures it. Multiple sessions, resumable chat history.
+- **Workflows rail** — orchestration projects (`sapiom.json`) discovered and
+  tracked, with one-click local test run, deploy, production run, and
+  open-in-Sapiom actions.
+- **Canvas** — a live pane that renders static HTML your agent writes to
+  `.sapiom/canvas/` (visualize your workflow, your docs, anything), plus a
+  preview mode for dev servers the agent starts.
+- **Zero config mutation** — everything is injected per-session via flags;
+  your global agent settings are never touched.
+
+Uninstall: `rm -rf ~/.sapiom/harness` (all harness-owned state lives there).
+
+## Telemetry
+
+With explicit opt-in, the harness collects usage events (prompts, tool calls,
+session lifecycle) to improve Sapiom. Opt out any time; `--no-telemetry`
+disables collection entirely. Events are also written locally to
+`~/.sapiom/harness/events.ndjson` for your own inspection.
+
+## Development
+
+```bash
+pnpm --filter @sapiom/harness dev        # server (tsx) on :4100
+pnpm --filter @sapiom/harness dev:web    # Vite dev server, proxies to :4100
+pnpm --filter @sapiom/harness build      # server (tsc) + SPA (vite) → dist/
+```
+
+Architecture: a single Node process (Express + ws + node-pty) serves the built
+SPA, a small REST API, terminal WebSocket streams, and the local telemetry
+ingest endpoint. The interface contract lives in `src/shared/types.ts`.

package/dist/cli/auth.d.ts

@@ -0,0 +1,26 @@
+export interface HarnessIdentity {
+    userId: string;
+    tenantId: string;
+    organizationName: string;
+    apiKey: string;
+    /** "cached" when resolved from ~/.sapiom/credentials.json with no login
+     *  prompt this run; "fresh" right after a browser login just completed.
+     *  Lets the CLI make a silent cached-credential sign-in visible. */
+    source: "cached" | "fresh";
+}
+export interface EnsureAuthenticatedOptions {
+    /** Prompt a browser login when no cached credential exists. */
+    interactive: boolean;
+    /** Skip auth entirely (the `--no-auth` flag) — no fs/network access. */
+    noAuth?: boolean;
+    /** Overrides SAPIOM_ENVIRONMENT for this call. */
+    environment?: string;
+}
+/**
+ * Reuses `@sapiom/mcp`'s browser OAuth flow and `~/.sapiom/credentials.json`
+ * cache so the harness and the sapiom-dev MCP share one identity. Returns
+ * `null` when `noAuth` is set, or when not interactive and no credential is
+ * cached yet.
+ */
+export declare function ensureAuthenticated(options: EnsureAuthenticatedOptions): Promise<HarnessIdentity | null>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/cli/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/cli/auth.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf;;wEAEoE;IACpE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,+DAA+D;IAC/D,WAAW,EAAE,OAAO,CAAC;IACrB,wEAAwE;IACxE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAiCjC"}

package/dist/cli/auth.js

@@ -0,0 +1,39 @@
+import { resolveEnvironment, readCredentials, writeCredentials, performBrowserAuth, } from "@sapiom/mcp/auth";
+/**
+ * Reuses `@sapiom/mcp`'s browser OAuth flow and `~/.sapiom/credentials.json`
+ * cache so the harness and the sapiom-dev MCP share one identity. Returns
+ * `null` when `noAuth` is set, or when not interactive and no credential is
+ * cached yet.
+ */
+export async function ensureAuthenticated(options) {
+    if (options.noAuth)
+        return null;
+    const env = await resolveEnvironment(options.environment ?? process.env.SAPIOM_ENVIRONMENT);
+    const existing = await readCredentials(env.name);
+    if (existing) {
+        return {
+            userId: existing.tenantId,
+            tenantId: existing.tenantId,
+            organizationName: existing.organizationName,
+            apiKey: existing.apiKey,
+            source: "cached",
+        };
+    }
+    if (!options.interactive)
+        return null;
+    const result = await performBrowserAuth(env.appURL, env.apiURL);
+    await writeCredentials(env.name, env.appURL, env.apiURL, {
+        apiKey: result.apiKey,
+        tenantId: result.tenantId,
+        organizationName: result.organizationName,
+        apiKeyId: result.apiKeyId,
+    });
+    return {
+        userId: result.tenantId,
+        tenantId: result.tenantId,
+        organizationName: result.organizationName,
+        apiKey: result.apiKey,
+        source: "fresh",
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/cli/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/cli/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAsB1B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAmC;IAEnC,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAE5F,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,QAAQ;YACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;QACvD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,QAAQ;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,OAAO;KAChB,CAAC;AACJ,CAAC"}

package/dist/cli/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/dist/cli/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../../src/cli/bin.ts"],"names":[],"mappings":""}

package/dist/cli/bin.js

@@ -0,0 +1,163 @@
+#!/usr/bin/env node
+/**
+ * sapiom-harness CLI entry (workstream W4).
+ *
+ * Flow: doctor → auth (reuse @sapiom/mcp browser OAuth) → consent (first run)
+ * → generate boot token → startServer → open browser → print a startup banner.
+ *
+ * Flags: [dir] (default cwd), --port, --no-auth, --no-telemetry, --no-open,
+ * --no-session, --dev.
+ */
+import * as path from "node:path";
+import * as crypto from "node:crypto";
+import open from "open";
+import { DEFAULT_PORT } from "../shared/types.js";
+import { runDoctor, printDoctorReport, pickDefaultHarness, CLAUDE_INSTALL_COMMAND, CODEX_INSTALL_COMMAND, } from "./doctor.js";
+import { ensureAuthenticated } from "./auth.js";
+import { ensureConsent } from "./consent.js";
+import { loadSettings, recordRecentDir } from "./settings.js";
+import { getOrCreateMachineId } from "./machine-id.js";
+import { startServer } from "../server/index.js";
+function parseArgs(argv) {
+    let dir;
+    let port = DEFAULT_PORT;
+    let noAuth = false;
+    let noTelemetry = false;
+    let noOpen = false;
+    let noSession = false;
+    let dev = false;
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        switch (arg) {
+            case "--port": {
+                const value = argv[++i];
+                if (!value || Number.isNaN(Number(value))) {
+                    throw new Error("--port requires a numeric value");
+                }
+                port = Number(value);
+                break;
+            }
+            case "--no-auth":
+                noAuth = true;
+                break;
+            case "--no-telemetry":
+                noTelemetry = true;
+                break;
+            case "--no-open":
+                noOpen = true;
+                break;
+            case "--no-session":
+                noSession = true;
+                break;
+            case "--dev":
+                dev = true;
+                break;
+            default:
+                if (arg.startsWith("--")) {
+                    throw new Error(`Unknown flag: ${arg}`);
+                }
+                if (dir !== undefined) {
+                    throw new Error(`Unexpected extra argument: ${arg}`);
+                }
+                dir = arg;
+        }
+    }
+    return {
+        dir: path.resolve(dir ?? process.cwd()),
+        port,
+        noAuth,
+        noTelemetry,
+        noOpen,
+        noSession,
+        dev,
+    };
+}
+function printBanner(opts) {
+    const authLine = opts.identity
+        ? `${opts.identity.organizationName} (${opts.identity.userId})${opts.identity.source === "cached" ? " — cached" : ""}`
+        : "not authenticated";
+    console.log("");
+    console.log("  Sapiom Harness");
+    console.log("  --------------");
+    console.log(`  directory   ${opts.dir}`);
+    console.log(`  auth        ${authLine}`);
+    console.log(`  telemetry   ${opts.telemetryOptIn ? "on" : "off"}`);
+    // Always the full tokened URL — with --no-open (or a browser that failed
+    // to launch) this is the only way to reach the app; a bare host:port
+    // 401s on every /api call and can't open the WS connections.
+    console.log(`  url         ${opts.serverStarted ? `http://localhost:${opts.port}/?token=${opts.bootToken}` : "(server not started)"}`);
+    console.log("");
+}
+const main = async () => {
+    const options = parseArgs(process.argv.slice(2));
+    const doctorReport = await runDoctor();
+    printDoctorReport(doctorReport);
+    if (!doctorReport.ok) {
+        console.error("\nsapiom-harness requires Node >= 20 and at least one coding agent on PATH:\n" +
+            `  Claude Code:  ${CLAUDE_INSTALL_COMMAND}\n` +
+            `  Codex:        ${CODEX_INSTALL_COMMAND}\n` +
+            "Fix the checks above and try again.");
+        process.exit(1);
+    }
+    const defaultHarnessKind = pickDefaultHarness(doctorReport);
+    if (!doctorReport.availableHarnesses.includes("claude-code")) {
+        console.log(`\n⚠ Claude Code not found — install with: ${CLAUDE_INSTALL_COMMAND}\n` +
+            "  Continuing with the Codex harness.");
+    }
+    const machineId = await getOrCreateMachineId();
+    const identity = await ensureAuthenticated({ interactive: true, noAuth: options.noAuth });
+    // A cached credential signs you in with no visible prompt at all — call it
+    // out explicitly so "auth silently worked" doesn't read as "nothing
+    // happened" (a fresh login is its own visible browser flow already).
+    if (identity?.source === "cached") {
+        console.log(`\nSigned in as ${identity.organizationName} (cached credential).`);
+    }
+    const telemetryOptIn = await ensureConsent({ noTelemetry: options.noTelemetry });
+    // First run = no recent directories recorded before this boot. Must be read
+    // BEFORE recordRecentDir below stamps the launch dir in — after that the
+    // signal is gone for good. Drives the SPA's welcome panel (AppState.firstRun)
+    // and suppresses the auto-created boot session, so a brand-new user lands on
+    // the welcome panel rather than a bare terminal in whatever directory they
+    // happened to launch from.
+    const firstRun = (await loadSettings()).recentDirs.length === 0;
+    await recordRecentDir(options.dir);
+    const bootToken = crypto.randomBytes(32).toString("hex");
+    let server = null;
+    try {
+        server = await startServer({
+            port: options.port,
+            bootToken,
+            telemetryOptIn,
+            identity,
+            machineId,
+            launchDir: options.dir,
+            autoCreateSession: !options.noSession && !firstRun,
+            defaultHarnessKind,
+            availableHarnesses: doctorReport.availableHarnesses,
+            firstRun,
+        });
+    }
+    catch (err) {
+        if (!options.dev)
+            throw err;
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`\n⚠ Harness server is not wired up yet: ${message}`);
+        console.error("--dev flow verified (doctor → auth → consent) without a live server.\n");
+    }
+    printBanner({
+        dir: options.dir,
+        port: server?.port ?? options.port,
+        bootToken,
+        identity,
+        telemetryOptIn,
+        serverStarted: server !== null,
+    });
+    if (server && !options.noOpen) {
+        await open(`http://localhost:${server.port}/?token=${bootToken}`);
+    }
+};
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});
+//# sourceMappingURL=bin.js.map

package/dist/cli/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../../src/cli/bin.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAwB,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAsB,MAAM,oBAAoB,CAAC;AAYrE,SAAS,SAAS,CAAC,IAAc;IAC/B,IAAI,GAAuB,CAAC;IAC5B,IAAI,IAAI,GAAG,YAAY,CAAC;IACxB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,GAAG,GAAG,KAAK,CAAC;IAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACxB,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;gBACD,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrB,MAAM;YACR,CAAC;YACD,KAAK,WAAW;gBACd,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM;YACR,KAAK,gBAAgB;gBACnB,WAAW,GAAG,IAAI,CAAC;gBACnB,MAAM;YACR,KAAK,WAAW;gBACd,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM;YACR,KAAK,cAAc;gBACjB,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,KAAK,OAAO;gBACV,GAAG,GAAG,IAAI,CAAC;gBACX,MAAM;YACR;gBACE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;gBAC1C,CAAC;gBACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;gBACvD,CAAC;gBACD,GAAG,GAAG,GAAG,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACvC,IAAI;QACJ,MAAM;QACN,WAAW;QACX,MAAM;QACN,SAAS;QACT,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAOpB;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ;QAC5B,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,IACxD,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EACpD,EAAE;QACJ,CAAC,CAAC,mBAAmB,CAAC;IAExB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACnE,yEAAyE;IACzE,qEAAqE;IACrE,6DAA6D;IAC7D,OAAO,CAAC,GAAG,CACT,iBACE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,sBAClF,EAAE,CACH,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;IACrC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjD,MAAM,YAAY,GAAG,MAAM,SAAS,EAAE,CAAC;IACvC,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAChC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CACX,+EAA+E;YAC7E,mBAAmB,sBAAsB,IAAI;YAC7C,mBAAmB,qBAAqB,IAAI;YAC5C,qCAAqC,CACxC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CACT,6CAA6C,sBAAsB,IAAI;YACrE,sCAAsC,CACzC,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAE/C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,2EAA2E;IAC3E,oEAAoE;IACpE,qEAAqE;IACrE,IAAI,QAAQ,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,CAAC,gBAAgB,uBAAuB,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACjF,4EAA4E;IAC5E,yEAAyE;IACzE,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;IAChE,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEzD,IAAI,MAAM,GAAyB,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,WAAW,CAAC;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS;YACT,cAAc;YACd,QAAQ;YACR,SAAS;YACT,SAAS,EAAE,OAAO,CAAC,GAAG;YACtB,iBAAiB,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,QAAQ;YAClD,kBAAkB;YAClB,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;YACnD,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,MAAM,GAAG,CAAC;QAC5B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,2CAA2C,OAAO,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,KAAK,CACX,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,WAAW,CAAC;QACV,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI;QAClC,SAAS;QACT,QAAQ;QACR,cAAc;QACd,aAAa,EAAE,MAAM,KAAK,IAAI;KAC/B,CAAC,CAAC;IAEH,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,CAAC,oBAAoB,MAAM,CAAC,IAAI,WAAW,SAAS,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC,CAAC;AAEF,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/cli/consent.d.ts

@@ -0,0 +1,15 @@
+export interface EnsureConsentOptions {
+    /** The `--no-telemetry` flag — forces telemetry off without prompting. */
+    noTelemetry: boolean;
+}
+/**
+ * Resolves the telemetry opt-in state. Prompts once on first run and persists
+ * the answer; subsequent runs reuse the stored value silently. `--no-telemetry`
+ * always wins and never prompts. `SAPIOM_TELEMETRY_DISABLED`/`DO_NOT_TRACK`
+ * force telemetry off for this run — overriding a persisted opt-in and
+ * skipping the prompt entirely — without touching what's actually stored, so
+ * a later run without the env var set sees whatever the user answered (or
+ * will still be asked, if this env-vetoed run was their first).
+ */
+export declare function ensureConsent(options: EnsureConsentOptions): Promise<boolean>;
+//# sourceMappingURL=consent.d.ts.map

package/dist/cli/consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../../src/cli/consent.ts"],"names":[],"mappings":"AAqCA,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,WAAW,EAAE,OAAO,CAAC;CACtB;AAuBD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBnF"}

package/dist/cli/consent.js

@@ -0,0 +1,81 @@
+import * as readline from "node:readline/promises";
+import { hasStoredSettings, loadSettings, saveSettings } from "./settings.js";
+// Internal/friendlies phase: default to opted in (matches the on-by-default
+// prompt below and the non-TTY fallback) — flip this the other way for a
+// wider release.
+const DEFAULT_TELEMETRY_OPT_IN = true;
+const CONSENT_COPY = `
+Sapiom Harness collects local usage analytics to improve the product:
+  - the prompts you send and the tool calls your agent makes
+  - session start/stop lifecycle events
+This is always written locally to ~/.sapiom/harness/events.ndjson for your
+own inspection.
+
+Telemetry is ON to help us improve (opt out anytime in the app's settings
+gear, or run with --no-telemetry).
+`.trim();
+async function promptConsent() {
+    console.log(`\n${CONSENT_COPY}\n`);
+    if (!process.stdin.isTTY) {
+        console.log(`Non-interactive session — defaulting telemetry to ${DEFAULT_TELEMETRY_OPT_IN ? "on" : "off"}.\n`);
+        return DEFAULT_TELEMETRY_OPT_IN;
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = (await rl.question("Keep it on? [Y/n] ")).trim().toLowerCase();
+        if (answer === "")
+            return DEFAULT_TELEMETRY_OPT_IN;
+        return answer === "y" || answer === "yes";
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * Environment opt-out, same precedence and value-parsing as
+ * `@sapiom/analytics-core`'s `resolveConsent()`: `SAPIOM_TELEMETRY_DISABLED`
+ * (Sapiom-specific) before `DO_NOT_TRACK` (the ecosystem-wide convention),
+ * both accepting `1`/`true` case-insensitively. Checked ahead of any stored
+ * settings — an operator setting either at the OS/shell level always wins
+ * for that run, regardless of a previously persisted opt-in.
+ */
+function isEnvFlagSet(value) {
+    if (typeof value !== "string")
+        return false;
+    const normalized = value.trim().toLowerCase();
+    return normalized === "1" || normalized === "true";
+}
+/** Which env var (if any) forces telemetry off this run, for the printed reason. */
+function envDisableReason() {
+    if (isEnvFlagSet(process.env.SAPIOM_TELEMETRY_DISABLED))
+        return "SAPIOM_TELEMETRY_DISABLED";
+    if (isEnvFlagSet(process.env.DO_NOT_TRACK))
+        return "DO_NOT_TRACK";
+    return null;
+}
+/**
+ * Resolves the telemetry opt-in state. Prompts once on first run and persists
+ * the answer; subsequent runs reuse the stored value silently. `--no-telemetry`
+ * always wins and never prompts. `SAPIOM_TELEMETRY_DISABLED`/`DO_NOT_TRACK`
+ * force telemetry off for this run — overriding a persisted opt-in and
+ * skipping the prompt entirely — without touching what's actually stored, so
+ * a later run without the env var set sees whatever the user answered (or
+ * will still be asked, if this env-vetoed run was their first).
+ */
+export async function ensureConsent(options) {
+    if (options.noTelemetry)
+        return false;
+    const envReason = envDisableReason();
+    if (envReason) {
+        console.log(`Telemetry disabled via ${envReason} — skipping the consent prompt.\n`);
+        return false;
+    }
+    const isFirstRun = !(await hasStoredSettings());
+    const settings = await loadSettings();
+    if (!isFirstRun)
+        return settings.telemetryOptIn;
+    const telemetryOptIn = await promptConsent();
+    await saveSettings({ ...settings, telemetryOptIn });
+    return telemetryOptIn;
+}
+//# sourceMappingURL=consent.js.map

package/dist/cli/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/cli/consent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE9E,4EAA4E;AAC5E,yEAAyE;AACzE,iBAAiB;AACjB,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,MAAM,YAAY,GAAG;;;;;;;;;CASpB,CAAC,IAAI,EAAE,CAAC;AAET,KAAK,UAAU,aAAa;IAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC;IAEnC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,qDAAqD,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;QAC/G,OAAO,wBAAwB,CAAC;IAClC,CAAC;IAED,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9E,IAAI,MAAM,KAAK,EAAE;YAAE,OAAO,wBAAwB,CAAC;QACnD,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,CAAC;IAC5C,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAOD;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,KAAyB;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,MAAM,CAAC;AACrD,CAAC;AAED,oFAAoF;AACpF,SAAS,gBAAgB;IACvB,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QAAE,OAAO,2BAA2B,CAAC;IAC5F,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,cAAc,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA6B;IAC/D,IAAI,OAAO,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAEtC,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,0BAA0B,SAAS,mCAAmC,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IAEtC,IAAI,CAAC,UAAU;QAAE,OAAO,QAAQ,CAAC,cAAc,CAAC;IAEhD,MAAM,cAAc,GAAG,MAAM,aAAa,EAAE,CAAC;IAC7C,MAAM,YAAY,CAAC,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IACpD,OAAO,cAAc,CAAC;AACxB,CAAC"}

package/dist/cli/doctor.d.ts

@@ -0,0 +1,27 @@
+import type { DoctorCheck, HarnessKind } from "../shared/types.js";
+/** Exact remedies surfaced in doctor output and the fatal-exit message —
+ *  kept as named constants so bin.ts's messaging can't drift from what
+ *  doctor.ts itself tells the user to run. */
+export declare const CLAUDE_INSTALL_COMMAND = "npm i -g @anthropic-ai/claude-code";
+export declare const CODEX_INSTALL_COMMAND = "npm i -g @openai/codex";
+/**
+ * Node is a hard requirement. Neither coding agent is individually required —
+ * the harness runs with whichever of claude/codex is on PATH — but at least
+ * one of them must be, or there's nothing to launch.
+ */
+export interface DoctorReport {
+    checks: DoctorCheck[];
+    ok: boolean;
+    /** Harness kinds with a working binary on PATH, in default-preference order
+     *  (claude-code first). Empty only when `ok` is false. */
+    availableHarnesses: HarnessKind[];
+}
+export declare function runDoctor(): Promise<DoctorReport>;
+/** First available harness in preference order, for callers that need a
+ *  single default (e.g. the auto-created boot session). Only falls back to
+ *  "claude-code" when the report itself is empty — main() already refuses to
+ *  proceed past a report with no available harnesses, so real callers never
+ *  hit that fallback. */
+export declare function pickDefaultHarness(report: DoctorReport): HarnessKind;
+export declare function printDoctorReport(report: DoctorReport): void;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/cli/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA8CnE;;8CAE8C;AAC9C,eAAO,MAAM,sBAAsB,uCAAuC,CAAC;AAC3E,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,EAAE,EAAE,OAAO,CAAC;IACZ;8DAC0D;IAC1D,kBAAkB,EAAE,WAAW,EAAE,CAAC;CACnC;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC,CAoBvD;AAED;;;;yBAIyB;AACzB,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,WAAW,CAEpE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAM5D"}

package/dist/cli/doctor.js

@@ -0,0 +1,74 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+async function which(bin) {
+    try {
+        const { stdout } = await execFileAsync(process.platform === "win32" ? "where" : "which", [
+            bin,
+        ]);
+        return stdout.trim().split("\n")[0] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+async function version(bin, args = ["--version"]) {
+    try {
+        const { stdout } = await execFileAsync(bin, args);
+        return stdout.trim().split("\n")[0] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function nodeCheck() {
+    const major = Number(process.versions.node.split(".")[0]);
+    const ok = major >= 20;
+    return {
+        name: "node",
+        ok,
+        detail: ok ? `v${process.versions.node}` : `v${process.versions.node} (need >= 20)`,
+    };
+}
+async function binaryCheck(name, bin, versionArgs, notFoundDetail) {
+    const found = await which(bin);
+    if (!found)
+        return { name, ok: false, detail: notFoundDetail };
+    const v = await version(bin, versionArgs);
+    return { name, ok: true, detail: v ?? found };
+}
+/** Exact remedies surfaced in doctor output and the fatal-exit message —
+ *  kept as named constants so bin.ts's messaging can't drift from what
+ *  doctor.ts itself tells the user to run. */
+export const CLAUDE_INSTALL_COMMAND = "npm i -g @anthropic-ai/claude-code";
+export const CODEX_INSTALL_COMMAND = "npm i -g @openai/codex";
+export async function runDoctor() {
+    const node = nodeCheck();
+    const [claude, codex, git] = await Promise.all([
+        binaryCheck("claude", "claude", ["--version"], `not found on PATH — install: ${CLAUDE_INSTALL_COMMAND}`),
+        binaryCheck("codex", "codex", ["--version"], `not found on PATH — install: ${CODEX_INSTALL_COMMAND}`),
+        binaryCheck("git", "git", ["--version"], "not found on PATH"),
+    ]);
+    const availableHarnesses = [
+        ...(claude.ok ? ["claude-code"] : []),
+        ...(codex.ok ? ["codex"] : []),
+    ];
+    const checks = [node, claude, codex, git];
+    return { checks, ok: node.ok && availableHarnesses.length > 0, availableHarnesses };
+}
+/** First available harness in preference order, for callers that need a
+ *  single default (e.g. the auto-created boot session). Only falls back to
+ *  "claude-code" when the report itself is empty — main() already refuses to
+ *  proceed past a report with no available harnesses, so real callers never
+ *  hit that fallback. */
+export function pickDefaultHarness(report) {
+    return report.availableHarnesses[0] ?? "claude-code";
+}
+export function printDoctorReport(report) {
+    console.log("Doctor:");
+    for (const check of report.checks) {
+        const mark = check.ok ? "✓" : "✗";
+        console.log(`  ${mark} ${check.name.padEnd(8)} ${check.detail}`);
+    }
+}
+//# sourceMappingURL=doctor.js.map

package/dist/cli/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,KAAK,UAAU,KAAK,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE;YACvF,GAAG;SACJ,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,OAAiB,CAAC,WAAW,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC;IACvB,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,EAAE;QACF,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,eAAe;KACpF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAY,EACZ,GAAW,EACX,WAAqB,EACrB,cAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/D,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;AAChD,CAAC;AAED;;8CAE8C;AAC9C,MAAM,CAAC,MAAM,sBAAsB,GAAG,oCAAoC,CAAC;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAe9D,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,WAAW,CACT,QAAQ,EACR,QAAQ,EACR,CAAC,WAAW,CAAC,EACb,gCAAgC,sBAAsB,EAAE,CACzD;QACD,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,gCAAgC,qBAAqB,EAAE,CAAC;QACrG,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;KAC9D,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAkB;QACxC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,aAAa,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,OAAO,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,kBAAkB,EAAE,CAAC;AACtF,CAAC;AAED;;;;yBAIyB;AACzB,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAoB;IACpD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/cli/machine-id.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Stable anonymous install id, used to tag every analytics event
+ * (`AnalyticsEvent.machineId`) regardless of which Sapiom user is signed in.
+ * Created once on first run and reused forever after.
+ *
+ * Hardened per `@sapiom/analytics-core`'s `identity.ts` pattern: private
+ * file permissions (mode 0600, on both create and a pre-existing file),
+ * silent regeneration when the stored content is missing/corrupt, and
+ * graceful degradation — an unreadable/unwritable HOME must never crash
+ * server boot over an analytics nicety. Kept as our own plain-text
+ * `~/.sapiom/harness/machine-id` file for now; converging onto her
+ * `~/.sapiom/analytics.json` identity is a separate, later conversation.
+ *
+ * @param filePath Where the id file lives. Defaults to the real
+ *   `HARNESS_PATHS.machineId`; tests and scripted checks pass a path under
+ *   their scratch state root so a boot never writes to the real home dir.
+ */
+export declare function getOrCreateMachineId(filePath?: string): Promise<string>;
+//# sourceMappingURL=machine-id.d.ts.map

package/dist/cli/machine-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-id.d.ts","sourceRoot":"","sources":["../../src/cli/machine-id.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,GAAE,MAA4C,GACrD,OAAO,CAAC,MAAM,CAAC,CAsBjB"}