@software-dlc/cli 0.157.2

package/dist/local/allow-mcp.d.ts

@@ -0,0 +1,77 @@
+/**
+ * `sdlc allow-mcp`: which repositories the SoftwareDLC plugin may run their own install in
+ * (docs/specs/local-tooling-release-readiness.md, D6). The plugin's launcher
+ * (plugins/softwaredlc/scripts/start-worktree.mjs) runs a repository's own install, and loads its
+ * .env.local, only for a repository listed in the approvals file; it speaks MCP over standard
+ * input and cannot ask, so the user approves here. This command is the file's one writer; the
+ * engine's allow_mcp.py forwards to it, and allow-mcp-cases.json pins what both sides read.
+ */
+export declare const ALLOW_MCP_USAGE: string;
+export declare const APPROVALS_SCHEMA_VERSION = 1;
+/**
+ * Set in an agent's environment by its provider (Claude Code also sets CLAUDECODE). The engine's
+ * allow_mcp.AGENT_VARIABLES is the same list, and allow-mcp-cases.json pins both.
+ */
+export declare const AGENT_VARIABLES: readonly ["SDLC_AGENT_THREAD", "CLAUDE_CODE_SESSION_ID", "CLAUDECODE", "CODEX_THREAD_ID"];
+export declare const PATH_TRUST = "The approval trusts this path: at every agent session start the plugin runs whatever this folder's own install and .env.local hold, after pulls and installs too, until you revoke it (sdlc allow-mcp --revoke).";
+export type ApprovalsDocument = {
+    schema_version: number;
+    repositories: unknown[];
+    [field: string]: unknown;
+};
+/** What the person typed after `question`, or null when there is no one to ask. */
+export type Confirm = (question: string) => Promise<string | null>;
+export type AllowMcpContext = {
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    stdout?: {
+        write(text: string): unknown;
+    };
+    stdinIsTTY?: boolean;
+    now?: () => Date;
+    /** The specs' way to answer; the command itself always asks at the controlling terminal. */
+    confirm?: Confirm;
+};
+export declare function approvalsPath(env?: NodeJS.ProcessEnv): string;
+export declare function agentSession(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * The real path that names the repository at `start`, or null when no approval can name it, read
+ * with the caller's GIT_* variables removed, as the launcher reads it. Only these layouts git itself
+ * writes have a key, and anything else fails closed (eval-20261104212736-ef4d876004b8,
+ * eval-20261104215917-9da3782ad131):
+ * - a checkout whose own .git (a directory, or a file whose gitdir: line names it) is both its git
+ *   directory and the common directory: its top level;
+ * - a linked worktree whose .git is a file naming <common>/worktrees/<id>, whose gitdir file
+ *   names that .git back: its primary checkout, the parent of a .git common directory, or, for a
+ *   bare repository (core.bare in its own config), the bare directory. A submodule's or a separate
+ *   git directory's worktrees have no key.
+ * A .git that is a symlink, a commondir or core.worktree pointing elsewhere, or a .git file naming
+ * another repository's worktree entry names nothing. The engine's allow_mcp.repository_key and the
+ * launcher hold the same rule, and allow-mcp-cases.json pins it.
+ */
+export declare function repositoryKey(start: string, env?: NodeJS.ProcessEnv): Promise<string | null>;
+/**
+ * Ask on the controlling terminal, never stdin or stdout (stdout stays one JSON object), so only
+ * the person at that terminal answers. Null when the process has none.
+ */
+export declare function askAtTerminal(question: string): Promise<string | null>;
+/** The approvals document; a missing file is empty, an unreadable one is refused. */
+export declare function readApprovals(file: string): Promise<ApprovalsDocument>;
+export declare function isApproved(doc: ApprovalsDocument, key: string): boolean;
+/**
+ * Approve (or revoke) the repository at `start`: its key and whether the file changed. A new
+ * approval first asks `confirm` for the folder's name, and is refused (Refused) unless the answer
+ * is that name. Throws outside Git or for an unreadable approvals file, which it never overwrites.
+ */
+export declare function setApproved(start: string, approve: boolean, file: string, options: {
+    confirm: Confirm;
+    env?: NodeJS.ProcessEnv;
+    now?: () => Date;
+    cwd?: string;
+}): Promise<{
+    key: string;
+    changed: boolean;
+}>;
+/** `sdlc allow-mcp ...`: the exit code, with one JSON object on stdout. */
+export declare function runAllowMcpCommand(args: string[], context?: AllowMcpContext): Promise<number>;
+//# sourceMappingURL=allow-mcp.d.ts.map

package/dist/local/allow-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-mcp.d.ts","sourceRoot":"","sources":["../../src/local/allow-mcp.ts"],"names":[],"mappings":"AAiBA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,QAGoK,CAAC;AAEjM,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,eAAe,2FAKlB,CAAC;AASX,eAAO,MAAM,UAAU,qNAC6L,CAAC;AAErN,MAAM,MAAM,iBAAiB,GAAG;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,EAAE,CAAC;IACxB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B,CAAC;AAEF,mFAAmF;AACnF,MAAM,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAEnE,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,4FAA4F;IAC5F,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAKF,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAO1E;AAED,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAE1E;AAsBD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyDxB;AAwBD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyB5E;AAsBD,qFAAqF;AACrF,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA0B5E;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAEvE;AAiDD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GACA,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAiC5C;AAoBD,2EAA2E;AAC3E,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAwDjB"}

package/dist/local/allow-mcp.js

@@ -0,0 +1,394 @@
+import { execFile } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { closeSync, openSync } from 'node:fs';
+import { lstat, mkdir, open, readFile, realpath, rename, rm } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { createInterface } from 'node:readline';
+import { ReadStream, WriteStream } from 'node:tty';
+/**
+ * `sdlc allow-mcp`: which repositories the SoftwareDLC plugin may run their own install in
+ * (docs/specs/local-tooling-release-readiness.md, D6). The plugin's launcher
+ * (plugins/softwaredlc/scripts/start-worktree.mjs) runs a repository's own install, and loads its
+ * .env.local, only for a repository listed in the approvals file; it speaks MCP over standard
+ * input and cannot ask, so the user approves here. This command is the file's one writer; the
+ * engine's allow_mcp.py forwards to it, and allow-mcp-cases.json pins what both sides read.
+ */
+export const ALLOW_MCP_USAGE = 'Usage: sdlc allow-mcp [--repo <path>] | allow-mcp --revoke [--repo <path>] | allow-mcp --list\n' +
+    "Approves the repository at <path> (default: here) for the SoftwareDLC plugin to run its own install and .env.local, takes the approval back, or lists the approved repositories. The approval is kept in the user's configuration folder ($XDG_CONFIG_HOME, else ~/.config, then softwaredlc/mcp-approvals.json), never in a repository. A repository is its primary checkout, so its linked worktrees share one approval, and a moved repository is asked again. The approval trusts the path: the plugin runs whatever that folder's install and .env.local hold at each session start, after pulls and installs too, until it is revoked. Approving is the user's consent to run the repository's code, so it asks the person to type the folder's name at the controlling terminal, and is refused inside an agent's session unless stdin is a terminal. " +
+    "Prints one JSON object on stdout. Exit 0: done; 1: refused or failed, with the reason under error; 3: approval refused in an agent session, without the person's terminal, or not confirmed.";
+export const APPROVALS_SCHEMA_VERSION = 1;
+/**
+ * Set in an agent's environment by its provider (Claude Code also sets CLAUDECODE). The engine's
+ * allow_mcp.AGENT_VARIABLES is the same list, and allow-mcp-cases.json pins both.
+ */
+export const AGENT_VARIABLES = [
+    'SDLC_AGENT_THREAD',
+    'CLAUDE_CODE_SESSION_ID',
+    'CLAUDECODE',
+    'CODEX_THREAD_ID'
+];
+const AGENT_REFUSAL = "approving a repository is the user's decision: run allow-mcp in your own terminal, not from an agent session";
+const NO_TERMINAL = 'approving a repository needs the person at its terminal: run sdlc allow-mcp in your own terminal and type the folder name when it asks';
+const NOT_CONFIRMED = 'not approved: the folder name was not typed';
+const THEN = 'Restart the agent session so the plugin starts the server again.';
+export const PATH_TRUST = "The approval trusts this path: at every agent session start the plugin runs whatever this folder's own install and .env.local hold, after pulls and installs too, until you revoke it (sdlc allow-mcp --revoke).";
+/** A refusal that is the person's to lift (exit 3), not a failure. */
+class Refused extends Error {
+}
+export function approvalsPath(env = process.env) {
+    const configured = env.XDG_CONFIG_HOME;
+    const base = configured && path.isAbsolute(configured)
+        ? configured
+        : path.join(homedir(), '.config');
+    return path.join(base, 'softwaredlc', 'mcp-approvals.json');
+}
+export function agentSession(env = process.env) {
+    return AGENT_VARIABLES.some((name) => Boolean(env[name]));
+}
+async function real(at) {
+    try {
+        return await realpath(at);
+    }
+    catch {
+        return path.resolve(at);
+    }
+}
+/** The real path a `.git` file's `gitdir:` line names, relative to the folder holding it, or null. */
+async function gitfileTarget(dotgit) {
+    let text;
+    try {
+        text = await readFile(dotgit, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const match = /^gitdir: (.+)$/m.exec(text);
+    return match ? real(path.resolve(path.dirname(dotgit), match[1].trim())) : null;
+}
+/**
+ * The real path that names the repository at `start`, or null when no approval can name it, read
+ * with the caller's GIT_* variables removed, as the launcher reads it. Only these layouts git itself
+ * writes have a key, and anything else fails closed (eval-20261104212736-ef4d876004b8,
+ * eval-20261104215917-9da3782ad131):
+ * - a checkout whose own .git (a directory, or a file whose gitdir: line names it) is both its git
+ *   directory and the common directory: its top level;
+ * - a linked worktree whose .git is a file naming <common>/worktrees/<id>, whose gitdir file
+ *   names that .git back: its primary checkout, the parent of a .git common directory, or, for a
+ *   bare repository (core.bare in its own config), the bare directory. A submodule's or a separate
+ *   git directory's worktrees have no key.
+ * A .git that is a symlink, a commondir or core.worktree pointing elsewhere, or a .git file naming
+ * another repository's worktree entry names nothing. The engine's allow_mcp.repository_key and the
+ * launcher hold the same rule, and allow-mcp-cases.json pins it.
+ */
+export async function repositoryKey(start, env = process.env) {
+    // A copy rather than Object.fromEntries keeps the ProcessEnv type the Next build augments.
+    const clean = { ...env };
+    for (const name of Object.keys(clean)) {
+        if (name.startsWith('GIT_'))
+            delete clean[name];
+    }
+    const lines = await new Promise((resolve) => {
+        execFile('git', [
+            'rev-parse',
+            '--path-format=absolute',
+            '--show-toplevel',
+            '--git-dir',
+            '--git-common-dir'
+        ], { cwd: start, env: clean, timeout: 5000 }, (error, stdout) => resolve(error ? null : String(stdout).trim().split('\n')));
+    });
+    if (lines === null || lines.length !== 3 || lines.some((line) => !line))
+        return null;
+    const [top, gitDir, common] = await Promise.all(lines.map(real));
+    // The folder's own .git, never followed through a symlink.
+    const dotgit = path.join(top, '.git');
+    let kind;
+    try {
+        const found = await lstat(dotgit);
+        if (found.isDirectory())
+            kind = 'directory';
+        else if (found.isFile())
+            kind = 'file';
+        else
+            return null;
+    }
+    catch {
+        return null;
+    }
+    const own = kind === 'directory' ? dotgit : await gitfileTarget(dotgit);
+    if (own !== gitDir)
+        return null;
+    if (gitDir === common)
+        return top;
+    if (kind !== 'file' || path.dirname(gitDir) !== path.join(common, 'worktrees'))
+        return null;
+    let repository;
+    if (path.basename(common) === '.git')
+        repository = path.dirname(common);
+    else if (await isBare(common, clean))
+        repository = common;
+    else
+        return null;
+    let named;
+    try {
+        named = (await readFile(path.join(gitDir, 'gitdir'), 'utf8')).trim();
+    }
+    catch {
+        return null;
+    }
+    if (!named)
+        return null;
+    // Its folders resolved, its final .git never followed.
+    const back = path.resolve(gitDir, named);
+    return path.join(await real(path.dirname(back)), path.basename(back)) ===
+        dotgit
+        ? repository
+        : null;
+}
+/**
+ * Whether the git directory's own config sets core.bare, so it has no primary checkout. Git never
+ * writes a .git inside a bare directory, so one holding a .git is a checkout's working tree posing
+ * as a bare repository through tracked files (eval-20261104224822-d212128ba466, F-5ABAA4D8E5A181C5).
+ */
+async function isBare(common, env) {
+    try {
+        await lstat(path.join(common, '.git'));
+        return false;
+    }
+    catch {
+        // No .git: it may be bare.
+    }
+    return new Promise((resolve) => {
+        execFile('git', ['config', '--file', path.join(common, 'config'), '--type=bool', '--get', 'core.bare'], { env, timeout: 5000 }, (error, stdout) => resolve(!error && String(stdout).trim() === 'true'));
+    });
+}
+/**
+ * Ask on the controlling terminal, never stdin or stdout (stdout stays one JSON object), so only
+ * the person at that terminal answers. Null when the process has none.
+ */
+export async function askAtTerminal(question) {
+    let input;
+    let output;
+    try {
+        input = openSync('/dev/tty', 'r');
+        output = openSync('/dev/tty', 'w');
+    }
+    catch {
+        for (const fd of [input, output])
+            if (fd !== undefined)
+                closeSync(fd);
+        return null;
+    }
+    const reader = new ReadStream(input);
+    const writer = new WriteStream(output);
+    // Not a readline terminal: the terminal's own line editing and echo stay on.
+    const lines = createInterface({ input: reader, terminal: false });
+    try {
+        return await new Promise((resolve) => {
+            lines.once('line', resolve);
+            lines.once('close', () => resolve(''));
+            writer.write(question);
+        });
+    }
+    finally {
+        lines.close();
+        reader.destroy();
+        writer.destroy();
+    }
+}
+/**
+ * A path as the terminal should show it: quoted, with control, line-separator and bidirectional
+ * characters escaped, so a folder name cannot redraw the question to show another path.
+ */
+function shown(text) {
+    return JSON.stringify(text).replace(/[\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+}
+function confirmationQuestion(key) {
+    return (`Approve the SoftwareDLC plugin to run this repository's own install and .env.local?\n` +
+        `Repository: ${shown(key)}\n` +
+        `${PATH_TRUST}\n` +
+        `Type the folder name ${shown(path.basename(key))} (without the quotes) to approve, anything else to cancel: `);
+}
+/** The approvals document; a missing file is empty, an unreadable one is refused. */
+export async function readApprovals(file) {
+    let text;
+    try {
+        text = await readFile(file, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { schema_version: APPROVALS_SCHEMA_VERSION, repositories: [] };
+        throw error;
+    }
+    let doc;
+    try {
+        doc = JSON.parse(text);
+    }
+    catch {
+        doc = null;
+    }
+    if (typeof doc !== 'object' ||
+        doc === null ||
+        Array.isArray(doc) ||
+        doc.schema_version !== APPROVALS_SCHEMA_VERSION ||
+        !Array.isArray(doc.repositories))
+        throw new Error(`${file} is not a version ${APPROVALS_SCHEMA_VERSION} approvals file`);
+    return doc;
+}
+export function isApproved(doc, key) {
+    return doc.repositories.some((entry) => entryPath(entry) === key);
+}
+function entryPath(entry) {
+    return typeof entry === 'object' && entry !== null && !Array.isArray(entry)
+        ? entry.path
+        : undefined;
+}
+/** Keys sorted at every level, as the engine wrote the file (json.dump sort_keys). */
+function sorted(value) {
+    if (Array.isArray(value))
+        return value.map(sorted);
+    if (typeof value !== 'object' || value === null)
+        return value;
+    return Object.fromEntries(Object.keys(value)
+        .sort()
+        .map((key) => [key, sorted(value[key])]));
+}
+/** Through a temporary file in the same folder, readable by the user alone, then a rename. */
+async function writeApprovals(file, doc) {
+    await mkdir(path.dirname(file), { recursive: true });
+    const temporary = path.join(path.dirname(file), `.mcp-approvals.${randomBytes(6).toString('hex')}`);
+    const handle = await open(temporary, 'wx', 0o600);
+    try {
+        // ASCII only, as json.dump wrote it, so a reader decoding with another locale reads the same paths.
+        const text = JSON.stringify(sorted(doc), null, 2).replace(/[\u007f-￿]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+        await handle.writeFile(`${text}\n`);
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        await rename(temporary, file);
+    }
+    catch (error) {
+        await rm(temporary, { force: true });
+        throw error;
+    }
+}
+function secondsTimestamp(at) {
+    return at.toISOString().replace(/\.\d{3}Z$/, 'Z');
+}
+/**
+ * Approve (or revoke) the repository at `start`: its key and whether the file changed. A new
+ * approval first asks `confirm` for the folder's name, and is refused (Refused) unless the answer
+ * is that name. Throws outside Git or for an unreadable approvals file, which it never overwrites.
+ */
+export async function setApproved(start, approve, file, options) {
+    // An empty --repo (an unset variable, say) names no repository, not the current one.
+    if (!start)
+        throw new Error(`${start} is not inside a Git repository`);
+    const key = await repositoryKey(path.resolve(options.cwd ?? process.cwd(), start), options.env);
+    if (key === null)
+        throw new Error(`${start} is not inside a Git repository, or not one an approval can name: a checkout whose own .git is its Git directory, or a linked worktree its repository's worktrees entry names back (a primary checkout's .git, or a bare repository)`);
+    let doc = await readApprovals(file);
+    let was = isApproved(doc, key);
+    if (approve && !was) {
+        const answer = await options.confirm(confirmationQuestion(key));
+        if (answer === null)
+            throw new Refused(NO_TERMINAL);
+        const name = path.basename(key);
+        if (!name || answer.trim() !== name)
+            throw new Refused(NOT_CONFIRMED);
+        // Read again: the person may take minutes, and another run may have changed the file meanwhile.
+        doc = await readApprovals(file);
+        was = isApproved(doc, key);
+    }
+    if (approve && !was) {
+        doc.repositories.push({
+            path: key,
+            approved_at: secondsTimestamp((options.now ?? (() => new Date()))())
+        });
+    }
+    else if (!approve && was)
+        doc.repositories = doc.repositories.filter((entry) => entryPath(entry) !== key);
+    if (was !== approve)
+        await writeApprovals(file, doc);
+    return { key, changed: was !== approve };
+}
+function parseArguments(args) {
+    const parsed = { repo: '.', revoke: false, list: false };
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--revoke')
+            parsed.revoke = true;
+        else if (arg === '--list')
+            parsed.list = true;
+        else if (arg === '--repo' && index + 1 < args.length)
+            parsed.repo = args[++index];
+        else if (arg.startsWith('--repo='))
+            parsed.repo = arg.slice(7);
+        else
+            return `unexpected argument ${arg}\n${ALLOW_MCP_USAGE}`;
+    }
+    if (parsed.revoke && parsed.list)
+        return `--revoke and --list cannot be combined\n${ALLOW_MCP_USAGE}`;
+    return parsed;
+}
+/** `sdlc allow-mcp ...`: the exit code, with one JSON object on stdout. */
+export async function runAllowMcpCommand(args, context = {}) {
+    const stdout = context.stdout ?? process.stdout;
+    const env = context.env ?? process.env;
+    const print = (value) => stdout.write(`${JSON.stringify(value)}\n`);
+    const parsed = parseArguments(args);
+    if (typeof parsed === 'string') {
+        print({ ok: false, error: parsed });
+        return 1;
+    }
+    const file = approvalsPath(env);
+    let doc;
+    try {
+        doc = await readApprovals(file);
+    }
+    catch (error) {
+        print({ ok: false, error: messageOf(error) });
+        return 1;
+    }
+    if (parsed.list) {
+        print({
+            ok: true,
+            file,
+            repositories: doc.repositories.map((entry) => entryPath(entry) ?? null)
+        });
+        return 0;
+    }
+    const stdinIsTTY = context.stdinIsTTY ?? Boolean(process.stdin.isTTY);
+    if (!parsed.revoke && agentSession(env) && !stdinIsTTY) {
+        print({ ok: false, error: AGENT_REFUSAL });
+        return 3;
+    }
+    try {
+        const { key, changed } = await setApproved(parsed.repo, !parsed.revoke, file, {
+            confirm: context.confirm ?? askAtTerminal,
+            env,
+            now: context.now,
+            cwd: context.cwd
+        });
+        print({
+            ok: true,
+            repository: key,
+            approved: !parsed.revoke,
+            changed,
+            file,
+            ...(parsed.revoke ? {} : { trusts: PATH_TRUST }),
+            then: THEN
+        });
+        return 0;
+    }
+    catch (error) {
+        print({ ok: false, error: messageOf(error) });
+        return error instanceof Refused ? 3 : 1;
+    }
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=allow-mcp.js.map

package/dist/local/allow-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-mcp.js","sourceRoot":"","sources":["../../src/local/allow-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EACL,KAAK,EACL,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,EAAE,EACH,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,iGAAiG;IACjG,+zBAA+zB;IAC/zB,8LAA8L,CAAC;AAEjM,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,mBAAmB;IACnB,wBAAwB;IACxB,YAAY;IACZ,iBAAiB;CACT,CAAC;AAEX,MAAM,aAAa,GACjB,8GAA8G,CAAC;AACjH,MAAM,WAAW,GACf,wIAAwI,CAAC;AAC3I,MAAM,aAAa,GAAG,6CAA6C,CAAC;AACpE,MAAM,IAAI,GACR,kEAAkE,CAAC;AACrE,MAAM,CAAC,MAAM,UAAU,GACrB,kNAAkN,CAAC;AAqBrN,sEAAsE;AACtE,MAAM,OAAQ,SAAQ,KAAK;CAAG;AAE9B,MAAM,UAAU,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,CAAC;IACvC,MAAM,IAAI,GACR,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QACvC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,oBAAoB,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,EAAU;IAC5B,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,KAAK,UAAU,aAAa,CAAC,MAAc;IACzC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,MAAyB,OAAO,CAAC,GAAG;IAEpC,2FAA2F;IAC3F,MAAM,KAAK,GAAsB,EAAE,GAAG,GAAG,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,EAAE;QAC3D,QAAQ,CACN,KAAK,EACL;YACE,WAAW;YACX,wBAAwB;YACxB,iBAAiB;YACjB,WAAW;YACX,kBAAkB;SACnB,EACD,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EACzC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAChB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAC5D,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,IAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,IAAI,GAAG,WAAW,CAAC;aACvC,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,IAAI,GAAG,MAAM,CAAC;;YAClC,OAAO,IAAI,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IAClC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,IAAI,UAAkB,CAAC;IACvB,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM;QAAE,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SACnE,IAAI,MAAM,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAAE,UAAU,GAAG,MAAM,CAAC;;QACrD,OAAO,IAAI,CAAC;IACjB,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,uDAAuD;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM;QACN,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,GAAsB;IAC1D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CACN,KAAK,EACL,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,CAAC,EACtF,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EACtB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,CACvE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,IAAI,KAAyB,CAAC;IAC9B,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAClC,MAAM,GAAG,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,IAAI,EAAE,KAAK,SAAS;gBAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,6EAA6E;IAC7E,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CACjC,8DAA8D,EAC9D,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7D,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,OAAO,CACL,uFAAuF;QACvF,eAAe,KAAK,CAAC,GAAG,CAAC,IAAI;QAC7B,GAAG,UAAU,IAAI;QACjB,wBAAwB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,6DAA6D,CAC/G,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YACpD,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QACxE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;IACD,IACE,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACjB,GAAyB,CAAC,cAAc,KAAK,wBAAwB;QACtE,CAAC,KAAK,CAAC,OAAO,CAAE,GAAyB,CAAC,YAAY,CAAC;QAEvD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,qBAAqB,wBAAwB,iBAAiB,CACtE,CAAC;IACJ,OAAO,GAAwB,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAsB,EAAE,GAAW;IAC5D,OAAO,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAA4B,CAAC,IAAI;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACf,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,GAAsB;IAChE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAClB,kBAAkB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CACnD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,oGAAoG;QACpG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CACvD,aAAa,EACb,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7D,CAAC;QACF,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACtC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAQ;IAChC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,OAAgB,EAChB,IAAY,EACZ,OAKC;IAED,qFAAqF;IACrF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,EACjD,OAAO,CAAC,GAAG,CACZ,CAAC;IACF,IAAI,GAAG,KAAK,IAAI;QACd,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,sOAAsO,CAC/O,CAAC;IACJ,IAAI,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;QACtE,gGAAgG;QAChG,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAChC,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;QACpB,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC;YACpB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,CAAC,OAAO,IAAI,GAAG;QACxB,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CACxC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,CACpC,CAAC;IACJ,IAAI,GAAG,KAAK,OAAO;QAAE,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,OAAO,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CACrB,IAAc;IAEd,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,UAAU;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;aACxC,IAAI,GAAG,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;aACzC,IAAI,GAAG,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAClD,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;aACzB,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;;YAC1D,OAAO,uBAAuB,GAAG,KAAK,eAAe,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;QAC9B,OAAO,2CAA2C,eAAe,EAAE,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAc,EACd,UAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,CAAC;YACJ,EAAE,EAAE,IAAI;YACR,IAAI;YACJ,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;SACxE,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACvD,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,WAAW,CACxC,MAAM,CAAC,IAAI,EACX,CAAC,MAAM,CAAC,MAAM,EACd,IAAI,EACJ;YACE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,aAAa;YACzC,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CACF,CAAC;QACF,KAAK,CAAC;YACJ,EAAE,EAAE,IAAI;YACR,UAAU,EAAE,GAAG;YACf,QAAQ,EAAE,CAAC,MAAM,CAAC,MAAM;YACxB,OAAO;YACP,IAAI;YACJ,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAChD,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9C,OAAO,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/local/api-client.d.ts

@@ -0,0 +1,15 @@
+import { type ApiVersionRefusal, type SdlcClientIdentity } from '@software-dlc/graph/client/api-version';
+import { ProjectDeletedError } from './project-deleted.js';
+export { ProjectDeletedError };
+export declare const SDLC_CLI_CLIENT: SdlcClientIdentity;
+export declare function sdlcCliHeaders(): Record<string, string>;
+export declare function apiVersionRefusalOf(response: Response): Promise<ApiVersionRefusal | null>;
+export declare function throwIfApiVersionRefused(response: Response, client?: SdlcClientIdentity): Promise<void>;
+export declare const PROTECTION_BYPASS_VARIABLE = "SDLC_PROTECTION_BYPASS";
+export declare const PROTECTION_BYPASS_HEADER = "x-vercel-protection-bypass";
+export declare function sdlcPlatformFetch(input?: {
+    client?: SdlcClientIdentity;
+    fetch_impl?: typeof fetch;
+    environment?: Readonly<Record<string, string | undefined>>;
+}): typeof fetch;
+//# sourceMappingURL=api-client.d.ts.map

package/dist/local/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/local/api-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAgB/B,eAAO,MAAM,eAAe,EAAE,kBAG7B,CAAC;AAEF,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEvD;AAID,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CASnC;AAED,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,QAAQ,EAClB,MAAM,GAAE,kBAAoC,GAC3C,OAAO,CAAC,IAAI,CAAC,CAGf;AAgBD,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAoBrE,wBAAgB,iBAAiB,CAC/B,KAAK,GAAE;IACL,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,UAAU,CAAC,EAAE,OAAO,KAAK,CAAC;IAC1B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACvD,GACL,OAAO,KAAK,CAad"}

package/dist/local/api-client.js

@@ -0,0 +1,87 @@
+import { createRequire } from 'node:module';
+import { ApiVersionRefusedError, readApiVersionRefusal, sdlcClientHeaders, withSdlcClientHeaders } from '@software-dlc/graph/client/api-version';
+import { ProjectDeletedError } from './project-deleted.js';
+export { ProjectDeletedError };
+// The package's own release. A bundler that copies this module away from the
+// package manifest leaves the release unknown instead of failing the import.
+function packageRelease() {
+    try {
+        const require = createRequire(import.meta.url);
+        const metadata = require('../../package.json');
+        return typeof metadata.version === 'string' ? metadata.version : 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+// The sdlc CLI as the platform sees it: every request names this release and
+// the API version it was built against.
+export const SDLC_CLI_CLIENT = {
+    kind: 'sdlc-cli',
+    release: packageRelease()
+};
+export function sdlcCliHeaders() {
+    return sdlcClientHeaders(SDLC_CLI_CLIENT);
+}
+// The platform's refusal of this client's API version, or null for any other
+// response. Reads a copy of the body, so the caller can still read it.
+export async function apiVersionRefusalOf(response) {
+    if (response.status !== 400)
+        return null;
+    const content_type = response.headers.get('content-type') ?? '';
+    if (!content_type.toLowerCase().startsWith('application/json'))
+        return null;
+    try {
+        return readApiVersionRefusal(await response.clone().json());
+    }
+    catch {
+        return null;
+    }
+}
+export async function throwIfApiVersionRefused(response, client = SDLC_CLI_CLIENT) {
+    const refusal = await apiVersionRefusalOf(response);
+    if (refusal)
+        throw new ApiVersionRefusedError(refusal, client);
+}
+async function isProjectDeleted(response) {
+    if (response.status !== 410)
+        return false;
+    const content_type = response.headers.get('content-type') ?? '';
+    if (!content_type.toLowerCase().startsWith('application/json'))
+        return false;
+    try {
+        const body = (await response.clone().json());
+        return body?.code === 'project_deleted';
+    }
+    catch {
+        return false;
+    }
+}
+// Vercel's deployment protection bypass, for a protected (staging) origin:
+// when this variable holds the secret, every platform request carries it.
+export const PROTECTION_BYPASS_VARIABLE = 'SDLC_PROTECTION_BYPASS';
+export const PROTECTION_BYPASS_HEADER = 'x-vercel-protection-bypass';
+function withProtectionBypass(request, init, bypass) {
+    // Headers given with the call replace a Request's own, so start from those.
+    const headers = new Headers(init?.headers ?? (request instanceof Request ? request.headers : undefined));
+    headers.set(PROTECTION_BYPASS_HEADER, bypass);
+    return { ...init, headers };
+}
+// The fetch for platform requests: it adds the client headers, and the
+// protection bypass when one is set, and turns a version refusal into
+// ApiVersionRefusedError, whose message names the update, and a deleted
+// project into ProjectDeletedError, whose message names sdlc reconnect, so the
+// refused request is reported once and never retried.
+export function sdlcPlatformFetch(input = {}) {
+    const client = input.client ?? SDLC_CLI_CLIENT;
+    const send = withSdlcClientHeaders(input.fetch_impl ?? fetch, client);
+    const bypass = (input.environment ?? process.env)[PROTECTION_BYPASS_VARIABLE];
+    return async (request, init) => {
+        const response = await send(request, bypass ? withProtectionBypass(request, init, bypass) : init);
+        await throwIfApiVersionRefused(response, client);
+        if (await isProjectDeleted(response))
+            throw new ProjectDeletedError();
+        return response;
+    };
+}
+//# sourceMappingURL=api-client.js.map

package/dist/local/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/local/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EAGtB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B,6EAA6E;AAC7E,6EAA6E;AAC7E,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,oBAAoB,CAA0B,CAAC;QACxE,OAAO,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,wCAAwC;AACxC,MAAM,CAAC,MAAM,eAAe,GAAuB;IACjD,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,cAAc,EAAE;CAC1B,CAAC;AAEF,MAAM,UAAU,cAAc;IAC5B,OAAO,iBAAiB,CAAC,eAAe,CAAC,CAAC;AAC5C,CAAC;AAED,6EAA6E;AAC7E,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAkB;IAElB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAChE,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,CAAC;QACH,OAAO,qBAAqB,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAkB,EAClB,SAA6B,eAAe;IAE5C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,OAAO;QAAE,MAAM,IAAI,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAkB;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAChE,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAA8B,CAAC;QAC1E,OAAO,IAAI,EAAE,IAAI,KAAK,iBAAiB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AACnE,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE,SAAS,oBAAoB,CAC3B,OAAoC,EACpC,IAAiC,EACjC,MAAc;IAEd,4EAA4E;IAC5E,MAAM,OAAO,GAAG,IAAI,OAAO,CACzB,IAAI,EAAE,OAAO,IAAI,CAAC,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAC5E,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;AACxE,+EAA+E;AAC/E,sDAAsD;AACtD,MAAM,UAAU,iBAAiB,CAC/B,QAII,EAAE;IAEN,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC;IAC/C,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,0BAA0B,CAAC,CAAC;IAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CACzB,OAAO,EACP,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAC5D,CAAC;QACF,MAAM,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,gBAAgB,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACtE,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}