@shravansunder/agent-vm 0.0.1

package/dist/cli/format-zod-error.js

@@ -0,0 +1,18 @@
+function formatIssuePath(pathSegments) {
+    if (pathSegments.length === 0) {
+        return '(root)';
+    }
+    return pathSegments.reduce((currentPath, pathSegment) => {
+        if (typeof pathSegment === 'number') {
+            return `${currentPath}[${pathSegment}]`;
+        }
+        return currentPath.length > 0 ? `${currentPath}.${String(pathSegment)}` : String(pathSegment);
+    }, '');
+}
+function formatIssue(issue) {
+    return `  ${formatIssuePath(issue.path)}: ${issue.message}`;
+}
+export function formatZodError(title, error) {
+    return [title, ...error.issues.map(formatIssue)].join('\n');
+}
+//# sourceMappingURL=format-zod-error.js.map

package/dist/cli/format-zod-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-zod-error.js","sourceRoot":"","sources":["../../src/cli/format-zod-error.ts"],"names":[],"mappings":"AAEA,SAAS,eAAe,CAAC,YAAoC;IAC5D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,WAAmB,EAAE,WAAW,EAAE,EAAE;QAC/D,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,GAAG,WAAW,IAAI,WAAW,GAAG,CAAC;QACzC,CAAC;QAED,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/F,CAAC,EAAE,EAAE,CAAC,CAAC;AACR,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IACnC,OAAO,KAAK,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,KAAe;IAC5D,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC"}

package/dist/cli/init-command.d.ts

@@ -0,0 +1,29 @@
+import readline from 'node:readline/promises';
+export interface ScaffoldAgentVmProjectOptions {
+    readonly gatewayType: GatewayType;
+    readonly targetDir: string;
+    readonly zoneId: string;
+}
+export interface ScaffoldAgentVmProjectResult {
+    readonly created: readonly string[];
+    readonly keychainStored: boolean;
+    readonly skipped: readonly string[];
+}
+interface ScaffoldAgentVmProjectDependencies {
+    readonly copyBundledOpenClawPlugin?: (targetDir: string) => Promise<'created' | 'skipped'>;
+    readonly generateAgeIdentityKey?: () => string | undefined;
+}
+export interface PromptAndStoreTokenDependencies {
+    readonly hasKeychainToken?: () => boolean;
+    readonly storeKeychainToken?: (token: string) => void;
+    readonly createReadlineInterface?: () => readline.Interface;
+}
+export type GatewayType = 'coding' | 'openclaw';
+export declare function scaffoldAgentVmProject(options: ScaffoldAgentVmProjectOptions, dependencies?: ScaffoldAgentVmProjectDependencies): Promise<ScaffoldAgentVmProjectResult>;
+/**
+ * Interactively prompt for the 1Password service account token and store it
+ * in macOS Keychain. Skips if stdin is not a TTY or if a token already exists.
+ */
+export declare function promptAndStoreServiceAccountToken(dependencies?: PromptAndStoreTokenDependencies): Promise<boolean>;
+export {};
+//# sourceMappingURL=init-command.d.ts.map

package/dist/cli/init-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-command.d.ts","sourceRoot":"","sources":["../../src/cli/init-command.ts"],"names":[],"mappings":"AAGA,OAAO,QAAQ,MAAM,wBAAwB,CAAC;AAY9C,MAAM,WAAW,6BAA6B;IAC7C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,UAAU,kCAAkC;IAC3C,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAC3F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CAC3D;AAED,MAAM,WAAW,+BAA+B;IAC/C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACtD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,QAAQ,CAAC,SAAS,CAAC;CAC5D;AAED,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;AAoUhD,wBAAgB,sBAAsB,CACrC,OAAO,EAAE,6BAA6B,EACtC,YAAY,GAAE,kCAAuC,GACnD,OAAO,CAAC,4BAA4B,CAAC,CAEvC;AAiHD;;;GAGG;AACH,wBAAsB,iCAAiC,CACtD,YAAY,GAAE,+BAAoC,GAChD,OAAO,CAAC,OAAO,CAAC,CA0ClB"}

package/dist/cli/init-command.js

@@ -0,0 +1,407 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import readline from 'node:readline/promises';
+import { getKeychainTokenSource, hasServiceAccountToken, storeServiceAccountToken, } from './keychain-credential.js';
+import { openClawPluginVendorDirectory, syncBundledOpenClawPluginBundle, } from './openclaw-plugin-bundle.js';
+const defaultGatewayIngressPort = 18791;
+const defaultOpenClawExtensionsPath = '/home/openclaw/.openclaw/extensions';
+function resolveGatewayConfigFileName(gatewayType) {
+    return gatewayType === 'coding' ? 'coding.json' : 'openclaw.json';
+}
+const defaultSystemConfig = (zoneId, gatewayType) => ({
+    host: {
+        controllerPort: 18800,
+        secretsProvider: {
+            type: '1password',
+            tokenSource: getKeychainTokenSource(),
+        },
+    },
+    cacheDir: './cache',
+    images: {
+        gateway: {
+            buildConfig: './images/gateway/build-config.json',
+            dockerfile: './images/gateway/Dockerfile',
+        },
+        tool: {
+            buildConfig: './images/tool/build-config.json',
+            dockerfile: './images/tool/Dockerfile',
+        },
+    },
+    zones: [
+        {
+            id: zoneId,
+            gateway: {
+                type: gatewayType,
+                memory: '2G',
+                cpus: 2,
+                port: defaultGatewayIngressPort,
+                gatewayConfig: `./config/${zoneId}/${resolveGatewayConfigFileName(gatewayType)}`,
+                stateDir: `./state/${zoneId}`,
+                workspaceDir: `./workspaces/${zoneId}`,
+            },
+            secrets: defaultSecretsForGatewayType(zoneId, gatewayType),
+            allowedHosts: defaultAllowedHostsForGatewayType(gatewayType),
+            websocketBypass: defaultWebsocketBypassForGatewayType(gatewayType),
+            toolProfile: 'standard',
+        },
+    ],
+    toolProfiles: {
+        standard: {
+            memory: '1G',
+            cpus: 1,
+            workspaceRoot: './workspaces/tools',
+        },
+    },
+    tcpPool: {
+        basePort: 19000,
+        size: 5,
+    },
+});
+function defaultSecretsForGatewayType(zoneId, gatewayType) {
+    if (gatewayType === 'coding') {
+        return {
+            ANTHROPIC_API_KEY: {
+                ref: `op://agent-vm/${zoneId}-anthropic/credential`,
+                source: '1password',
+                hosts: ['api.anthropic.com'],
+                injection: 'http-mediation',
+            },
+            OPENAI_API_KEY: {
+                ref: `op://agent-vm/${zoneId}-openai/credential`,
+                source: '1password',
+                hosts: ['api.openai.com'],
+                injection: 'http-mediation',
+            },
+        };
+    }
+    return {
+        DISCORD_BOT_TOKEN: {
+            ref: `op://agent-vm/${zoneId}-discord/bot-token`,
+            source: '1password',
+            injection: 'env',
+        },
+        PERPLEXITY_API_KEY: {
+            ref: `op://agent-vm/${zoneId}-perplexity/credential`,
+            source: '1password',
+            hosts: ['api.perplexity.ai'],
+            injection: 'http-mediation',
+        },
+        OPENCLAW_GATEWAY_TOKEN: {
+            ref: `op://agent-vm/${zoneId}-gateway-auth/password`,
+            source: '1password',
+            injection: 'env',
+        },
+    };
+}
+function defaultAllowedHostsForGatewayType(gatewayType) {
+    if (gatewayType === 'coding') {
+        return [
+            'api.anthropic.com',
+            'api.openai.com',
+            'auth.openai.com',
+            'api.github.com',
+            'registry.npmjs.org',
+        ];
+    }
+    return [
+        'api.openai.com',
+        'auth.openai.com',
+        'api.perplexity.ai',
+        'discord.com',
+        'cdn.discordapp.com',
+        'api.github.com',
+        'registry.npmjs.org',
+    ];
+}
+function defaultWebsocketBypassForGatewayType(gatewayType) {
+    if (gatewayType === 'coding') {
+        return [];
+    }
+    return [
+        'gateway.discord.gg:443',
+        'web.whatsapp.com:443',
+        'g.whatsapp.net:443',
+        'mmg.whatsapp.net:443',
+    ];
+}
+function defaultEnvTemplateForGatewayType(_gatewayType) {
+    return `# agent-vm environment configuration
+# 1Password token is stored in macOS Keychain by agent-vm init.
+# Only set this for CI or non-macOS environments:
+# OP_SERVICE_ACCOUNT_TOKEN=
+`;
+}
+const defaultGatewayDockerfile = `FROM node:24-slim
+
+ENV PNPM_HOME=/pnpm
+ENV PATH=\${PNPM_HOME}:\${PATH}
+
+RUN apt-get update && \\
+    apt-get install -y --no-install-recommends \\
+      openssh-server \\
+      ca-certificates \\
+      git \\
+      curl \\
+      python3 && \\
+    rm -rf /var/lib/apt/lists/* && \\
+    update-ca-certificates && \\
+    corepack enable && \\
+    pnpm add -g openclaw@2026.4.2 && \\
+    OPENCLAW_PACKAGE_ROOT="$(pnpm root -g)/openclaw" && \\
+    (cd "$OPENCLAW_PACKAGE_ROOT" && node scripts/postinstall-bundled-plugins.mjs) && \\
+    mkdir -p /opt/openclaw-sdk && \\
+    ln -sf "$OPENCLAW_PACKAGE_ROOT/dist/plugin-sdk/sandbox.js" /opt/openclaw-sdk/sandbox.js && \\
+    printf '#!/bin/sh\\nexec /pnpm/openclaw "$@"\\n' > /usr/local/bin/openclaw && \\
+    chmod 755 /usr/local/bin/openclaw && \\
+    useradd -m -s /bin/bash openclaw && \\
+    mkdir -p ${defaultOpenClawExtensionsPath} /home/openclaw/workspace /run/sshd /root && \\
+    chown -R openclaw:openclaw /home/openclaw && \\
+    ln -sf /proc/self/fd /dev/fd 2>/dev/null || true
+
+COPY vendor/gondolin ${defaultOpenClawExtensionsPath}/gondolin
+`;
+const defaultCodingGatewayDockerfile = `FROM node:24-slim
+
+ENV PNPM_HOME=/pnpm
+ENV PATH=\${PNPM_HOME}:\${PATH}
+
+RUN apt-get update && \\
+    apt-get install -y --no-install-recommends \\
+      openssh-server \\
+      ca-certificates \\
+      git \\
+      curl \\
+      python3 && \\
+    rm -rf /var/lib/apt/lists/* && \\
+    update-ca-certificates && \\
+    corepack enable && \\
+    pnpm add -g @openai/codex-cli && \\
+    printf '#!/bin/sh\\nexec /pnpm/codex "$@"\\n' > /usr/local/bin/codex && \\
+    chmod 755 /usr/local/bin/codex && \\
+    useradd -m -s /bin/bash coder && \\
+    mkdir -p /workspace /run/sshd /state && \\
+    chown -R coder:coder /workspace /state && \\
+    ln -sf /proc/self/fd /dev/fd 2>/dev/null || true
+`;
+const defaultToolDockerfile = `FROM node:24-slim
+
+RUN apt-get update && \\
+    apt-get install -y --no-install-recommends \\
+      openssh-server \\
+      ca-certificates \\
+      git \\
+      curl \\
+      python3 && \\
+    rm -rf /var/lib/apt/lists/* && \\
+    update-ca-certificates && \\
+    useradd -m -s /bin/bash sandbox && \\
+    mkdir -p /workspace /run/sshd && \\
+    chown sandbox:sandbox /workspace && \\
+    ln -sf /proc/self/fd /dev/fd 2>/dev/null || true
+`;
+const defaultGatewayBuildConfig = () => ({
+    arch: 'aarch64',
+    distro: 'alpine',
+    alpine: {
+        version: '3.23.0',
+        kernelPackage: 'linux-virt',
+        kernelImage: 'vmlinuz-virt',
+        rootfsPackages: [],
+        initramfsPackages: [],
+    },
+    oci: {
+        image: 'agent-vm-gateway:latest',
+        pullPolicy: 'never',
+    },
+    rootfs: {
+        label: 'gondolin-root',
+        sizeMb: 4096,
+    },
+});
+const defaultToolBuildConfig = () => ({
+    arch: 'aarch64',
+    distro: 'alpine',
+    alpine: {
+        version: '3.23.0',
+        kernelPackage: 'linux-virt',
+        kernelImage: 'vmlinuz-virt',
+        rootfsPackages: [],
+        initramfsPackages: [],
+    },
+    oci: {
+        image: 'agent-vm-tool:latest',
+        pullPolicy: 'never',
+    },
+    rootfs: {
+        label: 'tool-root',
+        sizeMb: 2048,
+    },
+});
+const defaultOpenClawConfig = (zoneId, gatewayIngressPort) => ({
+    gateway: {
+        auth: { mode: 'token' },
+        bind: 'loopback',
+        controlUi: {
+            allowedOrigins: [
+                `http://127.0.0.1:${gatewayIngressPort}`,
+                `http://localhost:${gatewayIngressPort}`,
+            ],
+        },
+        mode: 'local',
+        port: 18789,
+    },
+    agents: {
+        defaults: {
+            model: { primary: 'openai-codex/gpt-5.4' },
+            sandbox: { backend: 'gondolin', mode: 'all', scope: 'session' },
+            workspace: '/home/openclaw/workspace',
+        },
+    },
+    tools: { elevated: { enabled: false } },
+    plugins: {
+        load: {
+            paths: [defaultOpenClawExtensionsPath],
+        },
+        entries: {
+            gondolin: {
+                enabled: true,
+                config: {
+                    controllerUrl: 'http://controller.vm.host:18800',
+                    zoneId,
+                },
+            },
+        },
+    },
+    channels: {},
+});
+const defaultCodingGatewayConfig = () => ({
+    agentTimeoutMs: 600_000,
+    branchPrefix: 'agent/',
+    commitCoAuthor: 'agent-vm-coding <noreply@agent-vm>',
+    idleTimeoutMs: 1_800_000,
+    lintCommand: 'pnpm lint',
+    maxRetries: 3,
+    model: 'gpt-5.4-mini',
+    stateDir: '/state',
+    testCommand: 'pnpm test',
+    verificationTimeoutMs: 300_000,
+});
+async function writeFileIfMissing(filePath, content) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    try {
+        await fs.writeFile(filePath, content, {
+            encoding: 'utf8',
+            flag: 'wx',
+        });
+        return 'created';
+    }
+    catch (error) {
+        if (typeof error === 'object' && error !== null && 'code' in error && error.code === 'EEXIST') {
+            return 'skipped';
+        }
+        throw error;
+    }
+}
+export function scaffoldAgentVmProject(options, dependencies = {}) {
+    return scaffoldAgentVmProjectInternal(options, dependencies);
+}
+async function scaffoldAgentVmProjectInternal(options, dependencies = {}) {
+    const created = [];
+    const skipped = [];
+    const gatewayType = options.gatewayType;
+    const systemConfigPath = path.join(options.targetDir, 'system.json');
+    const systemConfigStatus = await writeFileIfMissing(systemConfigPath, `${JSON.stringify(defaultSystemConfig(options.zoneId, gatewayType), null, '\t')}\n`);
+    (systemConfigStatus === 'created' ? created : skipped).push('system.json');
+    const envFilePath = path.join(options.targetDir, '.env.local');
+    const envFileStatus = await writeFileIfMissing(envFilePath, defaultEnvTemplateForGatewayType(gatewayType));
+    (envFileStatus === 'created' ? created : skipped).push('.env.local');
+    if (envFileStatus === 'created') {
+        const generateAgeIdentityKey = dependencies.generateAgeIdentityKey ??
+            (() => {
+                try {
+                    const keygenOutput = execFileSync('age-keygen', [], { encoding: 'utf8' });
+                    return keygenOutput
+                        .split('\n')
+                        .find((line) => line.startsWith('AGE-SECRET-KEY-'))
+                        ?.trim();
+                }
+                catch {
+                    return undefined;
+                }
+            });
+        const ageIdentityKey = generateAgeIdentityKey();
+        if (ageIdentityKey) {
+            await fs.appendFile(envFilePath, `AGE_IDENTITY_KEY=${ageIdentityKey}\n`, 'utf8');
+        }
+    }
+    const gatewayConfigFileName = resolveGatewayConfigFileName(gatewayType);
+    const gatewayConfigPath = path.join(options.targetDir, 'config', options.zoneId, gatewayConfigFileName);
+    const gatewayConfigStatus = await writeFileIfMissing(gatewayConfigPath, `${JSON.stringify(gatewayType === 'openclaw'
+        ? defaultOpenClawConfig(options.zoneId, defaultGatewayIngressPort)
+        : defaultCodingGatewayConfig(), null, '\t')}\n`);
+    (gatewayConfigStatus === 'created' ? created : skipped).push(`config/${options.zoneId}/${gatewayConfigFileName}`);
+    const gatewayDockerfilePath = path.join(options.targetDir, 'images', 'gateway', 'Dockerfile');
+    const gatewayDockerfileStatus = await writeFileIfMissing(gatewayDockerfilePath, gatewayType === 'openclaw' ? defaultGatewayDockerfile : defaultCodingGatewayDockerfile);
+    (gatewayDockerfileStatus === 'created' ? created : skipped).push('images/gateway/Dockerfile');
+    const gatewayBuildConfigPath = path.join(options.targetDir, 'images', 'gateway', 'build-config.json');
+    const gatewayBuildConfigStatus = await writeFileIfMissing(gatewayBuildConfigPath, `${JSON.stringify(defaultGatewayBuildConfig(), null, '\t')}\n`);
+    (gatewayBuildConfigStatus === 'created' ? created : skipped).push('images/gateway/build-config.json');
+    if (gatewayType === 'openclaw') {
+        const pluginCopyStatus = await (dependencies.copyBundledOpenClawPlugin ?? syncBundledOpenClawPluginBundle)(options.targetDir);
+        (pluginCopyStatus === 'created' ? created : skipped).push(openClawPluginVendorDirectory);
+    }
+    const toolDockerfilePath = path.join(options.targetDir, 'images', 'tool', 'Dockerfile');
+    const toolDockerfileStatus = await writeFileIfMissing(toolDockerfilePath, defaultToolDockerfile);
+    (toolDockerfileStatus === 'created' ? created : skipped).push('images/tool/Dockerfile');
+    const toolBuildConfigPath = path.join(options.targetDir, 'images', 'tool', 'build-config.json');
+    const toolBuildConfigStatus = await writeFileIfMissing(toolBuildConfigPath, `${JSON.stringify(defaultToolBuildConfig(), null, '\t')}\n`);
+    (toolBuildConfigStatus === 'created' ? created : skipped).push('images/tool/build-config.json');
+    for (const directoryPath of [
+        path.join(options.targetDir, 'state', options.zoneId),
+        path.join(options.targetDir, 'workspaces', options.zoneId),
+        path.join(options.targetDir, 'workspaces', 'tools'),
+    ]) {
+        await fs.mkdir(directoryPath, { recursive: true });
+    }
+    return { created, keychainStored: false, skipped };
+}
+/**
+ * Interactively prompt for the 1Password service account token and store it
+ * in macOS Keychain. Skips if stdin is not a TTY or if a token already exists.
+ */
+export async function promptAndStoreServiceAccountToken(dependencies = {}) {
+    const hasToken = dependencies.hasKeychainToken ?? hasServiceAccountToken;
+    const storeToken = dependencies.storeKeychainToken ?? storeServiceAccountToken;
+    if (hasToken()) {
+        return false;
+    }
+    if (!process.stdin.isTTY) {
+        return false;
+    }
+    // Use a muted output stream so readline doesn't echo the token
+    const { Writable } = await import('node:stream');
+    const mutedOutput = new Writable({
+        write(_chunk, _encoding, callback) {
+            callback();
+        },
+    });
+    const rl = dependencies.createReadlineInterface?.() ??
+        readline.createInterface({ input: process.stdin, output: mutedOutput, terminal: true });
+    try {
+        process.stderr.write('Paste your 1Password service account token (from https://my.1password.com/developer-tools/service-accounts):\n> ');
+        const token = await rl.question('');
+        process.stderr.write('\n');
+        const trimmedToken = token.trim();
+        if (!trimmedToken) {
+            return false;
+        }
+        storeToken(trimmedToken);
+        process.stderr.write('✓ Stored in macOS Keychain\n');
+        return true;
+    }
+    finally {
+        rl.close();
+    }
+}
+//# sourceMappingURL=init-command.js.map

package/dist/cli/init-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-command.js","sourceRoot":"","sources":["../../src/cli/init-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,QAAQ,MAAM,wBAAwB,CAAC;AAE9C,OAAO,EACN,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,GACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,6BAA6B,EAC7B,+BAA+B,GAC/B,MAAM,6BAA6B,CAAC;AA2BrC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AACxC,MAAM,6BAA6B,GAAG,qCAAqC,CAAC;AAC5E,SAAS,4BAA4B,CAAC,WAAwB;IAC7D,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC;AACnE,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,WAAwB,EAAU,EAAE,CAAC,CAAC;IAClF,IAAI,EAAE;QACL,cAAc,EAAE,KAAK;QACrB,eAAe,EAAE;YAChB,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,sBAAsB,EAAE;SACrC;KACD;IACD,QAAQ,EAAE,SAAS;IACnB,MAAM,EAAE;QACP,OAAO,EAAE;YACR,WAAW,EAAE,oCAAoC;YACjD,UAAU,EAAE,6BAA6B;SACzC;QACD,IAAI,EAAE;YACL,WAAW,EAAE,iCAAiC;YAC9C,UAAU,EAAE,0BAA0B;SACtC;KACD;IACD,KAAK,EAAE;QACN;YACC,EAAE,EAAE,MAAM;YACV,OAAO,EAAE;gBACR,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,yBAAyB;gBAC/B,aAAa,EAAE,YAAY,MAAM,IAAI,4BAA4B,CAAC,WAAW,CAAC,EAAE;gBAChF,QAAQ,EAAE,WAAW,MAAM,EAAE;gBAC7B,YAAY,EAAE,gBAAgB,MAAM,EAAE;aACtC;YACD,OAAO,EAAE,4BAA4B,CAAC,MAAM,EAAE,WAAW,CAAC;YAC1D,YAAY,EAAE,iCAAiC,CAAC,WAAW,CAAC;YAC5D,eAAe,EAAE,oCAAoC,CAAC,WAAW,CAAC;YAClE,WAAW,EAAE,UAAU;SACvB;KACD;IACD,YAAY,EAAE;QACb,QAAQ,EAAE;YACT,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,CAAC;YACP,aAAa,EAAE,oBAAoB;SACnC;KACD;IACD,OAAO,EAAE;QACR,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,CAAC;KACP;CACD,CAAC,CAAC;AAEH,SAAS,4BAA4B,CACpC,MAAc,EACd,WAAwB;IAExB,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO;YACN,iBAAiB,EAAE;gBAClB,GAAG,EAAE,iBAAiB,MAAM,uBAAuB;gBACnD,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,CAAC,mBAAmB,CAAC;gBAC5B,SAAS,EAAE,gBAAgB;aAC3B;YACD,cAAc,EAAE;gBACf,GAAG,EAAE,iBAAiB,MAAM,oBAAoB;gBAChD,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,CAAC,gBAAgB,CAAC;gBACzB,SAAS,EAAE,gBAAgB;aAC3B;SACD,CAAC;IACH,CAAC;IAED,OAAO;QACN,iBAAiB,EAAE;YAClB,GAAG,EAAE,iBAAiB,MAAM,oBAAoB;YAChD,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,KAAK;SAChB;QACD,kBAAkB,EAAE;YACnB,GAAG,EAAE,iBAAiB,MAAM,wBAAwB;YACpD,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,CAAC,mBAAmB,CAAC;YAC5B,SAAS,EAAE,gBAAgB;SAC3B;QACD,sBAAsB,EAAE;YACvB,GAAG,EAAE,iBAAiB,MAAM,wBAAwB;YACpD,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,KAAK;SAChB;KACD,CAAC;AACH,CAAC;AAED,SAAS,iCAAiC,CAAC,WAAwB;IAClE,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO;YACN,mBAAmB;YACnB,gBAAgB;YAChB,iBAAiB;YACjB,gBAAgB;YAChB,oBAAoB;SACpB,CAAC;IACH,CAAC;IAED,OAAO;QACN,gBAAgB;QAChB,iBAAiB;QACjB,mBAAmB;QACnB,aAAa;QACb,oBAAoB;QACpB,gBAAgB;QAChB,oBAAoB;KACpB,CAAC;AACH,CAAC;AAED,SAAS,oCAAoC,CAAC,WAAwB;IACrE,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACX,CAAC;IAED,OAAO;QACN,wBAAwB;QACxB,sBAAsB;QACtB,oBAAoB;QACpB,sBAAsB;KACtB,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,YAAyB;IAClE,OAAO;;;;CAIP,CAAC;AACF,CAAC;AAED,MAAM,wBAAwB,GAAG;;;;;;;;;;;;;;;;;;;;;;;eAuBlB,6BAA6B;;;;uBAIrB,6BAA6B;CACnD,CAAC;AAEF,MAAM,8BAA8B,GAAG;;;;;;;;;;;;;;;;;;;;;;CAsBtC,CAAC;AAEF,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;CAe7B,CAAC;AAEF,MAAM,yBAAyB,GAAG,GAAW,EAAE,CAAC,CAAC;IAChD,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE;QACP,OAAO,EAAE,QAAQ;QACjB,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,cAAc;QAC3B,cAAc,EAAE,EAAE;QAClB,iBAAiB,EAAE,EAAE;KACrB;IACD,GAAG,EAAE;QACJ,KAAK,EAAE,yBAAyB;QAChC,UAAU,EAAE,OAAO;KACnB;IACD,MAAM,EAAE;QACP,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,IAAI;KACZ;CACD,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,GAAW,EAAE,CAAC,CAAC;IAC7C,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE;QACP,OAAO,EAAE,QAAQ;QACjB,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,cAAc;QAC3B,cAAc,EAAE,EAAE;QAClB,iBAAiB,EAAE,EAAE;KACrB;IACD,GAAG,EAAE;QACJ,KAAK,EAAE,sBAAsB;QAC7B,UAAU,EAAE,OAAO;KACnB;IACD,MAAM,EAAE;QACP,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,IAAI;KACZ;CACD,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAE,kBAA0B,EAAU,EAAE,CAAC,CAAC;IACtF,OAAO,EAAE;QACR,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QACvB,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE;YACV,cAAc,EAAE;gBACf,oBAAoB,kBAAkB,EAAE;gBACxC,oBAAoB,kBAAkB,EAAE;aACxC;SACD;QACD,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,KAAK;KACX;IACD,MAAM,EAAE;QACP,QAAQ,EAAE;YACT,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE;YAC1C,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE;YAC/D,SAAS,EAAE,0BAA0B;SACrC;KACD;IACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;IACvC,OAAO,EAAE;QACR,IAAI,EAAE;YACL,KAAK,EAAE,CAAC,6BAA6B,CAAC;SACtC;QACD,OAAO,EAAE;YACR,QAAQ,EAAE;gBACT,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE;oBACP,aAAa,EAAE,iCAAiC;oBAChD,MAAM;iBACN;aACD;SACD;KACD;IACD,QAAQ,EAAE,EAAE;CACZ,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,GAAW,EAAE,CAAC,CAAC;IACjD,cAAc,EAAE,OAAO;IACvB,YAAY,EAAE,QAAQ;IACtB,cAAc,EAAE,oCAAoC;IACpD,aAAa,EAAE,SAAS;IACxB,WAAW,EAAE,WAAW;IACxB,UAAU,EAAE,CAAC;IACb,KAAK,EAAE,cAAc;IACrB,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,WAAW;IACxB,qBAAqB,EAAE,OAAO;CAC9B,CAAC,CAAC;AAEH,KAAK,UAAU,kBAAkB,CAChC,QAAgB,EAChB,OAAe;IAEf,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC;QACJ,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE;YACrC,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,IAAI;SACV,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/F,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,MAAM,UAAU,sBAAsB,CACrC,OAAsC,EACtC,eAAmD,EAAE;IAErD,OAAO,8BAA8B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC5C,OAAsC,EACtC,eAAmD,EAAE;IAErD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAExC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACrE,MAAM,kBAAkB,GAAG,MAAM,kBAAkB,CAClD,gBAAgB,EAChB,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CACnF,CAAC;IACF,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE3E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAC7C,WAAW,EACX,gCAAgC,CAAC,WAAW,CAAC,CAC7C,CAAC;IACF,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,sBAAsB,GAC3B,YAAY,CAAC,sBAAsB;YACnC,CAAC,GAAuB,EAAE;gBACzB,IAAI,CAAC;oBACJ,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC1E,OAAO,YAAY;yBACjB,KAAK,CAAC,IAAI,CAAC;yBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;wBACnD,EAAE,IAAI,EAAE,CAAC;gBACX,CAAC;gBAAC,MAAM,CAAC;oBACR,OAAO,SAAS,CAAC;gBAClB,CAAC;YACF,CAAC,CAAC,CAAC;QACJ,MAAM,cAAc,GAAG,sBAAsB,EAAE,CAAC;QAChD,IAAI,cAAc,EAAE,CAAC;YACpB,MAAM,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,oBAAoB,cAAc,IAAI,EAAE,MAAM,CAAC,CAAC;QAClF,CAAC;IACF,CAAC;IAED,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAClC,OAAO,CAAC,SAAS,EACjB,QAAQ,EACR,OAAO,CAAC,MAAM,EACd,qBAAqB,CACrB,CAAC;IACF,MAAM,mBAAmB,GAAG,MAAM,kBAAkB,CACnD,iBAAiB,EACjB,GAAG,IAAI,CAAC,SAAS,CAChB,WAAW,KAAK,UAAU;QACzB,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,yBAAyB,CAAC;QAClE,CAAC,CAAC,0BAA0B,EAAE,EAC/B,IAAI,EACJ,IAAI,CACJ,IAAI,CACL,CAAC;IACF,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAC3D,UAAU,OAAO,CAAC,MAAM,IAAI,qBAAqB,EAAE,CACnD,CAAC;IAEF,MAAM,qBAAqB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC9F,MAAM,uBAAuB,GAAG,MAAM,kBAAkB,CACvD,qBAAqB,EACrB,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,8BAA8B,CACtF,CAAC;IACF,CAAC,uBAAuB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAE9F,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CACvC,OAAO,CAAC,SAAS,EACjB,QAAQ,EACR,SAAS,EACT,mBAAmB,CACnB,CAAC;IACF,MAAM,wBAAwB,GAAG,MAAM,kBAAkB,CACxD,sBAAsB,EACtB,GAAG,IAAI,CAAC,SAAS,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAC9D,CAAC;IACF,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAChE,kCAAkC,CAClC,CAAC;IACF,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,gBAAgB,GAAG,MAAM,CAC9B,YAAY,CAAC,yBAAyB,IAAI,+BAA+B,CACzE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrB,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IACxF,MAAM,oBAAoB,GAAG,MAAM,kBAAkB,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;IACjG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAExF,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAChG,MAAM,qBAAqB,GAAG,MAAM,kBAAkB,CACrD,mBAAmB,EACnB,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAC3D,CAAC;IACF,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAEhG,KAAK,MAAM,aAAa,IAAI;QAC3B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC;KACnD,EAAE,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACtD,eAAgD,EAAE;IAElD,MAAM,QAAQ,GAAG,YAAY,CAAC,gBAAgB,IAAI,sBAAsB,CAAC;IACzE,MAAM,UAAU,GAAG,YAAY,CAAC,kBAAkB,IAAI,wBAAwB,CAAC;IAE/E,IAAI,QAAQ,EAAE,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACd,CAAC;IAED,+DAA+D;IAC/D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC;QAChC,KAAK,CAAC,MAAc,EAAE,SAAyB,EAAE,QAAoB;YACpE,QAAQ,EAAE,CAAC;QACZ,CAAC;KACD,CAAC,CAAC;IAEH,MAAM,EAAE,GACP,YAAY,CAAC,uBAAuB,EAAE,EAAE;QACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzF,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,kHAAkH,CAClH,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE3B,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC;QACd,CAAC;QAED,UAAU,CAAC,YAAY,CAAC,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACb,CAAC;YAAS,CAAC;QACV,EAAE,CAAC,KAAK,EAAE,CAAC;IACZ,CAAC;AACF,CAAC"}

package/dist/cli/keychain-credential.d.ts

@@ -0,0 +1,19 @@
+export interface KeychainCredentialDependencies {
+    readonly execFileSync?: (command: string, args: readonly string[]) => string;
+}
+/**
+ * Store the 1Password service account token in macOS Keychain.
+ * Uses `security add-generic-password -U` which creates or updates.
+ * No password prompt when logged in — Keychain is unlocked.
+ */
+export declare function storeServiceAccountToken(token: string, dependencies?: KeychainCredentialDependencies): void;
+/**
+ * Check whether a service account token exists in macOS Keychain.
+ */
+export declare function hasServiceAccountToken(dependencies?: KeychainCredentialDependencies): boolean;
+export declare function getKeychainTokenSource(): {
+    readonly type: 'keychain';
+    readonly service: string;
+    readonly account: string;
+};
+//# sourceMappingURL=keychain-credential.d.ts.map

package/dist/cli/keychain-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-credential.d.ts","sourceRoot":"","sources":["../../src/cli/keychain-credential.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,CAAC;CAC7E;AAMD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACvC,KAAK,EAAE,MAAM,EACb,YAAY,GAAE,8BAAmC,GAC/C,IAAI,CAYN;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,GAAE,8BAAmC,GAAG,OAAO,CAejG;AAED,wBAAgB,sBAAsB,IAAI;IACzC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB,CAMA"}

package/dist/cli/keychain-credential.js

@@ -0,0 +1,52 @@
+import { execFileSync } from 'node:child_process';
+const KEYCHAIN_SERVICE = 'agent-vm';
+const KEYCHAIN_ACCOUNT = '1p-service-account';
+function defaultExecFileSync(command, args) {
+    return execFileSync(command, [...args], { encoding: 'utf8' });
+}
+/**
+ * Store the 1Password service account token in macOS Keychain.
+ * Uses `security add-generic-password -U` which creates or updates.
+ * No password prompt when logged in — Keychain is unlocked.
+ */
+export function storeServiceAccountToken(token, dependencies = {}) {
+    const exec = dependencies.execFileSync ?? defaultExecFileSync;
+    exec('security', [
+        'add-generic-password',
+        '-s',
+        KEYCHAIN_SERVICE,
+        '-a',
+        KEYCHAIN_ACCOUNT,
+        '-w',
+        token,
+        '-U',
+    ]);
+}
+/**
+ * Check whether a service account token exists in macOS Keychain.
+ */
+export function hasServiceAccountToken(dependencies = {}) {
+    const exec = dependencies.execFileSync ?? defaultExecFileSync;
+    try {
+        exec('security', [
+            'find-generic-password',
+            '-s',
+            KEYCHAIN_SERVICE,
+            '-a',
+            KEYCHAIN_ACCOUNT,
+            '-w',
+        ]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function getKeychainTokenSource() {
+    return {
+        type: 'keychain',
+        service: KEYCHAIN_SERVICE,
+        account: KEYCHAIN_ACCOUNT,
+    };
+}
+//# sourceMappingURL=keychain-credential.js.map

package/dist/cli/keychain-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-credential.js","sourceRoot":"","sources":["../../src/cli/keychain-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,gBAAgB,GAAG,UAAU,CAAC;AACpC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAM9C,SAAS,mBAAmB,CAAC,OAAe,EAAE,IAAuB;IACpE,OAAO,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACvC,KAAa,EACb,eAA+C,EAAE;IAEjD,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAC9D,IAAI,CAAC,UAAU,EAAE;QAChB,sBAAsB;QACtB,IAAI;QACJ,gBAAgB;QAChB,IAAI;QACJ,gBAAgB;QAChB,IAAI;QACJ,KAAK;QACL,IAAI;KACJ,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,eAA+C,EAAE;IACvF,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAC9D,IAAI,CAAC;QACJ,IAAI,CAAC,UAAU,EAAE;YAChB,uBAAuB;YACvB,IAAI;YACJ,gBAAgB;YAChB,IAAI;YACJ,gBAAgB;YAChB,IAAI;SACJ,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,MAAM,UAAU,sBAAsB;IAKrC,OAAO;QACN,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,gBAAgB;QACzB,OAAO,EAAE,gBAAgB;KACzB,CAAC;AACH,CAAC"}

package/dist/cli/lease-commands.d.ts

@@ -0,0 +1,11 @@
+import type { SystemConfig } from '../config/system-config.js';
+import { type CliDependencies, type CliIo } from './agent-vm-cli-support.js';
+interface RunLeaseCommandOptions {
+    readonly dependencies: CliDependencies;
+    readonly io: CliIo;
+    readonly restArguments: readonly string[];
+    readonly systemConfig: SystemConfig;
+}
+export declare function runLeaseCommand(options: RunLeaseCommandOptions): Promise<void>;
+export {};
+//# sourceMappingURL=lease-commands.d.ts.map

package/dist/cli/lease-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease-commands.d.ts","sourceRoot":"","sources":["../../src/cli/lease-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,KAAK,EAGV,MAAM,2BAA2B,CAAC;AAEnC,UAAU,sBAAsB;IAC/B,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;CACpC;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBpF"}

package/dist/cli/lease-commands.js

@@ -0,0 +1,22 @@
+import { resolveControllerBaseUrl, writeJson, } from './agent-vm-cli-support.js';
+export async function runLeaseCommand(options) {
+    const controllerClient = options.dependencies.createControllerClient({
+        baseUrl: resolveControllerBaseUrl(options.systemConfig),
+    });
+    const leaseSubcommand = options.restArguments[0];
+    if (leaseSubcommand === 'list') {
+        writeJson(options.io, await controllerClient.listLeases());
+        return;
+    }
+    if (leaseSubcommand === 'release') {
+        const leaseId = options.restArguments[1];
+        if (!leaseId) {
+            throw new Error('Usage: agent-vm controller lease release <leaseId>');
+        }
+        await controllerClient.releaseLease(leaseId);
+        writeJson(options.io, { ok: true, released: leaseId });
+        return;
+    }
+    throw new Error(`Unknown lease subcommand '${leaseSubcommand ?? 'undefined'}'.`);
+}
+//# sourceMappingURL=lease-commands.js.map

package/dist/cli/lease-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease-commands.js","sourceRoot":"","sources":["../../src/cli/lease-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAGN,wBAAwB,EACxB,SAAS,GACT,MAAM,2BAA2B,CAAC;AASnC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA+B;IACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,sBAAsB,CAAC;QACpE,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC,YAAY,CAAC;KACvD,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAEjD,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QAChC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3D,OAAO;IACR,CAAC;IAED,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,OAAO;IACR,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,6BAA6B,eAAe,IAAI,WAAW,IAAI,CAAC,CAAC;AAClF,CAAC"}

package/dist/cli/openclaw-plugin-bundle.d.ts

@@ -0,0 +1,3 @@
+export declare const openClawPluginVendorDirectory = "images/gateway/vendor/gondolin";
+export declare function syncBundledOpenClawPluginBundle(targetDir: string): Promise<'created' | 'skipped'>;
+//# sourceMappingURL=openclaw-plugin-bundle.d.ts.map

package/dist/cli/openclaw-plugin-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openclaw-plugin-bundle.d.ts","sourceRoot":"","sources":["../../src/cli/openclaw-plugin-bundle.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,6BAA6B,mCAAmC,CAAC;AAkB9E,wBAAsB,+BAA+B,CACpD,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAahC"}

package/dist/cli/openclaw-plugin-bundle.js

@@ -0,0 +1,30 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+export const openClawPluginVendorDirectory = 'images/gateway/vendor/gondolin';
+async function resolveBundledOpenClawPluginDistDirectory() {
+    const pluginEntrypointPath = fileURLToPath(import.meta.resolve('@shravansunder/openclaw-agent-vm-plugin'));
+    const pluginDistDirectory = path.dirname(pluginEntrypointPath);
+    try {
+        await fs.access(path.join(pluginDistDirectory, 'openclaw.plugin.json'));
+    }
+    catch (error) {
+        throw new Error(`Bundled gondolin plugin dist is missing at '${pluginDistDirectory}'. Run \`pnpm build\` before using the OpenClaw gateway scaffold/build path.`, { cause: error });
+    }
+    return pluginDistDirectory;
+}
+export async function syncBundledOpenClawPluginBundle(targetDir) {
+    const pluginTargetDirectory = path.join(targetDir, openClawPluginVendorDirectory);
+    try {
+        await fs.access(path.join(pluginTargetDirectory, 'openclaw.plugin.json'));
+        await fs.rm(pluginTargetDirectory, { force: true, recursive: true });
+    }
+    catch {
+        // continue
+    }
+    const pluginDistDirectory = await resolveBundledOpenClawPluginDistDirectory();
+    await fs.mkdir(path.dirname(pluginTargetDirectory), { recursive: true });
+    await fs.cp(pluginDistDirectory, pluginTargetDirectory, { recursive: true });
+    return 'created';
+}
+//# sourceMappingURL=openclaw-plugin-bundle.js.map

package/dist/cli/openclaw-plugin-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openclaw-plugin-bundle.js","sourceRoot":"","sources":["../../src/cli/openclaw-plugin-bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,CAAC,MAAM,6BAA6B,GAAG,gCAAgC,CAAC;AAE9E,KAAK,UAAU,yCAAyC;IACvD,MAAM,oBAAoB,GAAG,aAAa,CACzC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAC9D,CAAC;IACF,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,CAAC;QACJ,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACd,+CAA+C,mBAAmB,8EAA8E,EAChJ,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACpD,SAAiB;IAEjB,MAAM,qBAAqB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;IAClF,IAAI,CAAC;QACJ,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC1E,MAAM,EAAE,CAAC,EAAE,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACR,WAAW;IACZ,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,yCAAyC,EAAE,CAAC;IAC9E,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,MAAM,EAAE,CAAC,EAAE,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,OAAO,SAAS,CAAC;AAClB,CAAC"}