@springbrand/cli 0.1.0

package/dist/lib/agent-launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-launcher.js","sourceRoot":"","sources":["../../src/lib/agent-launcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAatC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAEvC,iCAAiC;IACjC,MAAM,cAAc,GAAgC;QAClD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;QACpE,QAAQ,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC;QAChC,UAAU,EAAE,CAAC,UAAU,EAAE,GAAG,IAAI,GAAG,CAAC;QACpC,OAAO,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC;KAC9B,CAAC;IAEF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,sCAAsC;QACtC,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,4BAA4B;QAC5B,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgB;IAC/C,MAAM,QAAQ,GAA8B;QAC1C,aAAa,EAAE,QAAQ;QACvB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,UAAU;QACtB,OAAO,EAAE,MAAM;KAChB,CAAC;IAEF,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE;YAC3C,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA8B;IAC3D,aAAa,EAAE,4DAA4D;IAC3E,QAAQ,EAAE,sCAAsC;IAChD,UAAU,EAAE,iCAAiC;IAC7C,OAAO,EAAE,oCAAoC;CAC9C,CAAC"}

package/dist/lib/auth.d.ts

@@ -0,0 +1,90 @@
+/** 复刻自 tiny-fish CLI 编译产物：auth.d.ts + auth.impl.js */
+/**
+ * The wire format the platform mints and the Gateway parses:
+ * `sbk_v1_<environment>_<16-byte id>_<32-byte secret>`. Authoritative definition lives in
+ * `@springbrand/auth/mcp-api-key`; it is restated here because the CLI ships as its own npm
+ * package and cannot depend on the Gateway's vendored tarball.
+ */
+export declare const MCP_KEY_PREFIX = "sbk_v1_";
+export declare const KEY_FORMAT_HINT = "Expected a SpringBrand MCP key: sbk_v1_<dev|production>_<id>_<secret>.";
+export { DASHBOARD_URL, getDashboardUrl } from './constants.js';
+export declare function configDir(): string;
+export declare function configFile(): string;
+/** Install channel baked onto connect context; the connect flow is always CLI-driven. */
+export declare const CONNECT_SOURCE = "springbrand_cli";
+export declare const CONNECT_ATTEMPT_ENV = "SPRINGBRAND_CONNECT_ATTEMPT_ID";
+export declare function loadConfig(): SpringbrandConfig;
+export declare function isAttemptId(value: string): boolean;
+/**
+ * Park a page-minted attempt id for the connect that follows in a later process:
+ * `auth login` and the connect it leads to are separate copied commands.
+ */
+export declare function savePendingConnectAttempt(attemptId: string): void;
+/** Read-and-clear: one parked id seeds one install attempt, expired or not. */
+export declare function takePendingConnectAttempt(): string | undefined;
+/** Throwing variant for callers with their own cleanup (connect's telemetry flush). */
+export declare function writeConfig(apiKey: string): void;
+export declare function saveConfig(apiKey: string): void;
+/** `authMode` omitted rewrites the entry without one: a reconnect that degraded must not keep a stale key claim. */
+export declare function saveConnectContext(client: string, attemptId: string, authMode?: RecordedAuthMode): void;
+/** Distinguishes a missing entry from an unreadable config file. */
+export declare function connectContextState(client: string): 'present' | 'absent' | 'unreadable';
+/** Kept marker after uninstall makes doctor offer to reinstall the harness. */
+export declare function clearConnectContext(client: string): void;
+export declare function persistApiKeyToEnvironment(apiKey: string, options?: EnvironmentOptions): void;
+export declare function clearConfig(): boolean;
+/**
+ * The environment and the safe security identifier, never the secret. The environment decides
+ * which endpoint a key belongs to (see `environmentOf`), and `keyId` is the platform's own
+ * non-bearer identifier for the key.
+ */
+export declare function parseKeyIdentity(key: string): KeyIdentity | undefined;
+export declare function validateKeyFormat(key: string): boolean;
+export declare function maskKey(key: string): string;
+/** Key for optional paths (telemetry, auth probes) — absent is a valid answer, so never exits. */
+export declare function resolvedApiKey(explicitApiKey?: string): string | undefined;
+/** Answers "is this the CLI's own key" without the value leaving the caller; see sdk/cli/CLAUDE.md. */
+export declare function matchesCliKey(value: string | undefined): boolean;
+/** resolvedApiKey for keys that reach a config file or the wire — loadConfig() is unvalidated on read. */
+export declare function validatedApiKey(explicitApiKey?: string): string | undefined;
+/**
+ * The diagnosis, not the key: doctor must report a bad credential and say where it came from
+ * rather than exit like getApiKey does.
+ */
+export declare function apiKeyStatus(explicitApiKey?: string): ResolvedKey | UnresolvedKey;
+export declare function getApiKey(): string;
+export type RecordedAuthMode = 'api-key' | 'oauth' | 'deferred';
+export type KeyEnvironment = 'dev' | 'production';
+export interface KeyIdentity {
+    environment: KeyEnvironment;
+    id: string;
+    /** The platform's `sbkid_v1_…` security identifier; not a bearer value. */
+    keyId: string;
+}
+interface ConnectEntry {
+    attempt_id: string;
+    auth_mode?: RecordedAuthMode;
+}
+interface PendingConnectAttempt {
+    id: string;
+    ts: number;
+}
+interface SpringbrandConfig {
+    api_key?: string;
+    connect?: Record<string, ConnectEntry>;
+    pending_connect_attempt?: PendingConnectAttempt;
+}
+interface EnvironmentOptions {
+    platform?: typeof process.platform;
+    shell?: string;
+}
+export type KeySource = 'explicit' | 'env' | 'config' | 'none';
+export interface ResolvedKey {
+    key: string;
+    source: Exclude<KeySource, 'none'>;
+}
+export interface UnresolvedKey {
+    error: string;
+    source: KeySource;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/lib/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,sDAAsD;AAQtD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC,eAAO,MAAM,eAAe,2EAA2E,CAAC;AACxG,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAChE,wBAAgB,SAAS,IAAI,MAAM,CAGlC;AACD,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AACD,yFAAyF;AACzF,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAGhD,eAAO,MAAM,mBAAmB,mCAAmC,CAAC;AAEpE,wBAAgB,UAAU,IAAI,iBAAiB,CAoB9C;AAwBD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAElD;AAYD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAYjE;AAGD,+EAA+E;AAC/E,wBAAgB,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAa9D;AACD,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAEhD;AACD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAQ/C;AACD,oHAAoH;AACpH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAevG;AACD,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,CAgBvF;AACD,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAiBxD;AAeD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,IAAI,CA2B7F;AACD,wBAAgB,WAAW,IAAI,OAAO,CAarC;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAOrE;AACD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEtD;AACD,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAS3C;AAYD,kGAAkG;AAClG,wBAAgB,cAAc,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE1E;AACD,uGAAuG;AACvG,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEhE;AACD,0GAA0G;AAC1G,wBAAgB,eAAe,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG3E;AACD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,aAAa,CAWjF;AACD,wBAAgB,SAAS,IAAI,MAAM,CAMlC;AAGD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AAEhE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,YAAY,CAAC;AAElD,MAAM,WAAW,WAAW;IACxB,WAAW,EAAE,cAAc,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,YAAY;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAChC;AAED,UAAU,qBAAqB;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;CACd;AAED,UAAU,iBAAiB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACvC,uBAAuB,CAAC,EAAE,qBAAqB,CAAC;CACnD;AAED,UAAU,kBAAkB;IACxB,QAAQ,CAAC,EAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE/D,MAAM,WAAW,WAAW;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,aAAa;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,CAAC;CACrB"}

package/dist/lib/auth.js

@@ -0,0 +1,327 @@
+/** 复刻自 tiny-fish CLI 编译产物：auth.d.ts + auth.impl.js */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import spawn from 'cross-spawn';
+import { err, errLine } from './output.js';
+import { SPRINGBRAND_API_KEY_VAR } from './constants.js';
+/**
+ * The wire format the platform mints and the Gateway parses:
+ * `sbk_v1_<environment>_<16-byte id>_<32-byte secret>`. Authoritative definition lives in
+ * `@springbrand/auth/mcp-api-key`; it is restated here because the CLI ships as its own npm
+ * package and cannot depend on the Gateway's vendored tarball.
+ */
+export const MCP_KEY_PREFIX = 'sbk_v1_';
+const KEY_PATTERN = /^sbk_v1_(dev|production)_([0-9a-f]{32})_[0-9a-f]{64}$/;
+export const KEY_FORMAT_HINT = 'Expected a SpringBrand MCP key: sbk_v1_<dev|production>_<id>_<secret>.';
+export { DASHBOARD_URL, getDashboardUrl } from './constants.js';
+export function configDir() {
+    // os.homedir() is cross-platform; process.env.HOME is undefined on Windows
+    return path.join(os.homedir(), '.springbrand');
+}
+export function configFile() {
+    return path.join(configDir(), 'config.json');
+}
+/** Install channel baked onto connect context; the connect flow is always CLI-driven. */
+export const CONNECT_SOURCE = 'springbrand_cli';
+// An env var, not a flag: released CLIs ignore an unknown one, and the installer's PATH
+// prepend means a copied command can still run a CLI far older than the page that wrote it.
+export const CONNECT_ATTEMPT_ENV = 'SPRINGBRAND_CONNECT_ATTEMPT_ID';
+const RECORDED_AUTH_MODES = ['api-key', 'oauth', 'deferred'];
+export function loadConfig() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(configFile(), 'utf8'));
+        if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+            return {};
+        const obj = raw;
+        const config = {};
+        if (typeof obj['api_key'] === 'string')
+            config.api_key = obj['api_key'];
+        const connect = parseConnectMap(obj['connect']);
+        if (connect)
+            config.connect = connect;
+        const pending = parsePendingAttempt(obj['pending_connect_attempt']);
+        if (pending)
+            config.pending_connect_attempt = pending;
+        return config;
+    }
+    catch {
+        return {};
+    }
+}
+function parseConnectMap(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const out = {};
+    for (const [client, entry] of Object.entries(value)) {
+        const record = entry;
+        const attemptId = record?.attempt_id;
+        if (typeof attemptId !== 'string')
+            continue;
+        const authMode = record?.auth_mode;
+        out[client] =
+            typeof authMode === 'string' && RECORDED_AUTH_MODES.includes(authMode)
+                ? { attempt_id: attemptId, auth_mode: authMode }
+                : { attempt_id: attemptId };
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+function parsePendingAttempt(value) {
+    const entry = value;
+    if (typeof entry?.id !== 'string' || typeof entry.ts !== 'number')
+        return undefined;
+    return isAttemptId(entry.id) ? { id: entry.id, ts: entry.ts } : undefined;
+}
+export function isAttemptId(value) {
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+/**
+ * The one read-modify-write of the config file. Every caller goes through it so the
+ * loadConfig whitelist stays the single definition of what survives a write. Throws;
+ * callers own their failure policy, which differs per command.
+ */
+function updateConfig(change) {
+    // 0o700: only owner can read/write/execute the directory
+    fs.mkdirSync(configDir(), { recursive: true, mode: 0o700 });
+    // 0o600: only owner can read/write the config file (key is sensitive)
+    fs.writeFileSync(configFile(), JSON.stringify(change(loadConfig())), { mode: 0o600 });
+}
+/**
+ * Park a page-minted attempt id for the connect that follows in a later process:
+ * `auth login` and the connect it leads to are separate copied commands.
+ */
+export function savePendingConnectAttempt(attemptId) {
+    if (!isAttemptId(attemptId))
+        return;
+    try {
+        updateConfig((config) => ({
+            ...config,
+            pending_connect_attempt: { id: attemptId, ts: Date.now() },
+        }));
+    }
+    catch {
+        // Attribution is never worth failing a sign-in for.
+    }
+}
+// Older than this and the id belongs to some abandoned setup, not the connect running now.
+const PENDING_ATTEMPT_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+/** Read-and-clear: one parked id seeds one install attempt, expired or not. */
+export function takePendingConnectAttempt() {
+    const pending = loadConfig().pending_connect_attempt;
+    if (!pending)
+        return undefined;
+    try {
+        updateConfig(({ pending_connect_attempt: _cleared, ...rest }) => rest);
+    }
+    catch {
+        // An id still on disk would be claimed twice, and a double-counted install is worse
+        // than a missed join.
+        return undefined;
+    }
+    return Date.now() - pending.ts <= PENDING_ATTEMPT_MAX_AGE_MS ? pending.id : undefined;
+}
+/** Throwing variant for callers with their own cleanup (connect's telemetry flush). */
+export function writeConfig(apiKey) {
+    updateConfig((config) => ({ ...config, api_key: apiKey }));
+}
+export function saveConfig(apiKey) {
+    try {
+        writeConfig(apiKey);
+    }
+    catch (e) {
+        err({ error: `Could not write config: ${e instanceof Error ? e.message : String(e)}` });
+        process.exit(1);
+    }
+}
+/** `authMode` omitted rewrites the entry without one: a reconnect that degraded must not keep a stale key claim. */
+export function saveConnectContext(client, attemptId, authMode) {
+    const entry = authMode
+        ? { attempt_id: attemptId, auth_mode: authMode }
+        : { attempt_id: attemptId };
+    try {
+        updateConfig((config) => ({
+            ...config,
+            connect: { ...config.connect, [client]: entry },
+        }));
+    }
+    catch (e) {
+        // Best-effort attribution marker: a write failure must not fail a connect that has
+        // already succeeded (MCP registered, skill installed, authenticated). Warn and continue.
+        errLine(`Warning: could not persist connect context: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+/** Distinguishes a missing entry from an unreadable config file. */
+export function connectContextState(client) {
+    let raw;
+    try {
+        raw = fs.readFileSync(configFile(), 'utf8');
+    }
+    catch (e) {
+        return e.code === 'ENOENT' ? 'absent' : 'unreadable';
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        const entry = parsed && typeof parsed === 'object' ? parsed.connect?.[client] : undefined;
+        return entry ? 'present' : 'absent';
+    }
+    catch {
+        return 'unreadable';
+    }
+}
+/** Kept marker after uninstall makes doctor offer to reinstall the harness. */
+export function clearConnectContext(client) {
+    // Read-first: writing through an unreadable config would rewrite it as {}.
+    if (connectContextState(client) !== 'present')
+        return;
+    try {
+        updateConfig((config) => {
+            if (!config.connect?.[client])
+                return config;
+            const remaining = Object.fromEntries(Object.entries(config.connect).filter(([key]) => key !== client));
+            const { connect, ...rest } = config;
+            void connect;
+            return Object.keys(remaining).length > 0 ? { ...rest, connect: remaining } : rest;
+        });
+    }
+    catch (e) {
+        errLine(`Warning: could not clear connect context: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+function resolveProfilePath(shell, platform) {
+    const home = os.homedir();
+    const macBashProfile = ['.bash_profile', '.bash_login', '.profile']
+        .map((name) => path.join(home, name)) // nosemgrep: path-join-resolve-traversal -- fixed filenames under os.homedir()
+        .find((candidate) => fs.existsSync(candidate)) ?? path.join(home, '.bash_profile');
+    if (shell === 'zsh')
+        return path.join(home, '.zshrc');
+    if (shell === 'bash') {
+        return platform === 'darwin' ? macBashProfile : path.join(home, '.bashrc');
+    }
+    if (shell === 'fish')
+        return path.join(home, '.config', 'fish', 'config.fish');
+    return path.join(home, '.profile');
+}
+export function persistApiKeyToEnvironment(apiKey, options) {
+    const platform = options?.platform ?? process.platform;
+    if (platform === 'win32') {
+        const result = spawn.sync('setx', [SPRINGBRAND_API_KEY_VAR, apiKey], { stdio: 'ignore' });
+        if (result.error || result.status !== 0) {
+            throw new Error('Could not set SPRINGBRAND_API_KEY in the Windows user environment', {
+                cause: result.error,
+            });
+        }
+        return;
+    }
+    const shell = path.basename(options?.shell ?? process.env['SHELL'] ?? '');
+    const fish = shell === 'fish';
+    const profile = resolveProfilePath(shell, platform);
+    const quotedKey = `'${apiKey.replaceAll("'", "'\\''")}'`;
+    const prefix = fish ? `set -gx ${SPRINGBRAND_API_KEY_VAR} ` : `export ${SPRINGBRAND_API_KEY_VAR}=`;
+    const assignment = `${prefix}${quotedKey}`;
+    const existing = fs.existsSync(profile) ? fs.readFileSync(profile, 'utf8') : '';
+    // Drops prior assignments, so repeated logins do not stack stale keys.
+    const cleaned = existing
+        .split('\n')
+        .filter((line) => !line.startsWith(prefix))
+        .join('\n');
+    const updated = `${cleaned}${cleaned && !cleaned.endsWith('\n') ? '\n' : ''}${assignment}\n`;
+    fs.mkdirSync(path.dirname(profile), { recursive: true });
+    fs.writeFileSync(profile, updated, { mode: 0o600 });
+    fs.chmodSync(profile, 0o600);
+}
+export function clearConfig() {
+    if (!loadConfig().api_key)
+        return false;
+    try {
+        // The parked id goes too: the next person to sign in on this machine is not the one
+        // whose copy minted it.
+        updateConfig(({ api_key: _key, pending_connect_attempt: _attempt, ...rest }) => rest);
+        return true;
+    }
+    catch {
+        // Write failed — key was not actually removed
+        return false;
+    }
+}
+/** The one rule that is ours to enforce: the key becomes an HTTP header, so CR/LF cannot pass. */
+function isHeaderSafe(key) {
+    for (let i = 0; i < key.length; i += 1) {
+        if (key.charCodeAt(i) < 0x20)
+            return false;
+    }
+    return true;
+}
+/**
+ * The environment and the safe security identifier, never the secret. The environment decides
+ * which endpoint a key belongs to (see `environmentOf`), and `keyId` is the platform's own
+ * non-bearer identifier for the key.
+ */
+export function parseKeyIdentity(key) {
+    const match = KEY_PATTERN.exec(key);
+    if (!match)
+        return undefined;
+    const environment = match[1];
+    const id = match[2];
+    return { environment, id, keyId: `sbkid_v1_${environment}_${id}` };
+}
+export function validateKeyFormat(key) {
+    return isHeaderSafe(key) && KEY_PATTERN.test(key);
+}
+export function maskKey(key) {
+    if (key.length <= 8)
+        return '***';
+    const identity = parseKeyIdentity(key);
+    // `sbk_v1_<environment>_` is shared by every key of that environment, so a preview has to
+    // reach into the id to tell two of them apart.
+    return identity
+        ? `${MCP_KEY_PREFIX}${identity.environment}_${identity.id.slice(0, 6)}...${key.slice(-4)}`
+        : key.slice(0, 12) + '...' + key.slice(-4);
+}
+// The one flag/env/config precedence chain; `source` says which place a caller must name.
+function lookupApiKey(explicitApiKey) {
+    if (explicitApiKey)
+        return { value: explicitApiKey, source: 'explicit' };
+    const envKey = process.env[SPRINGBRAND_API_KEY_VAR];
+    if (envKey)
+        return { value: envKey, source: 'env' };
+    // No try/catch: loadConfig swallows its own errors and returns {}.
+    const stored = loadConfig().api_key;
+    return stored ? { value: stored, source: 'config' } : { source: 'none' };
+}
+/** Key for optional paths (telemetry, auth probes) — absent is a valid answer, so never exits. */
+export function resolvedApiKey(explicitApiKey) {
+    return lookupApiKey(explicitApiKey).value;
+}
+/** Answers "is this the CLI's own key" without the value leaving the caller; see sdk/cli/CLAUDE.md. */
+export function matchesCliKey(value) {
+    return value !== undefined && value === resolvedApiKey();
+}
+/** resolvedApiKey for keys that reach a config file or the wire — loadConfig() is unvalidated on read. */
+export function validatedApiKey(explicitApiKey) {
+    const key = resolvedApiKey(explicitApiKey);
+    return key && validateKeyFormat(key) ? key : undefined;
+}
+/**
+ * The diagnosis, not the key: doctor must report a bad credential and say where it came from
+ * rather than exit like getApiKey does.
+ */
+export function apiKeyStatus(explicitApiKey) {
+    const { value, source } = lookupApiKey(explicitApiKey);
+    if (!value || source === 'none') {
+        return { error: 'No API key found. Run: sp auth login', source: 'none' };
+    }
+    // Shape is the server's call. A local prefix rule turns a key format we have not shipped
+    // support for yet into a hard failure the user cannot work around, and the 401 says more.
+    if (!isHeaderSafe(value)) {
+        return { error: 'The API key contains control characters and cannot be sent', source };
+    }
+    return { key: value, source };
+}
+export function getApiKey() {
+    const resolved = apiKeyStatus();
+    if ('key' in resolved)
+        return resolved.key;
+    err({ error: resolved.error });
+    process.exit(1);
+}
+//# sourceMappingURL=auth.js.map

package/dist/lib/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,sDAAsD;AAEtD,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,aAAa,CAAC;AAChC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC;AACxC,MAAM,WAAW,GAAG,uDAAuD,CAAC;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,wEAAwE,CAAC;AACxG,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAChE,MAAM,UAAU,SAAS;IACrB,2EAA2E;IAC3E,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACnD,CAAC;AACD,MAAM,UAAU,UAAU;IACtB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AACD,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAChD,wFAAwF;AACxF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;AACpE,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AAC7D,MAAM,UAAU,UAAU;IACtB,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAC7D,OAAO,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,GAA8B,CAAC;QAC3C,MAAM,MAAM,GAAsB,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ;YAClC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QAChD,IAAI,OAAO;YACP,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;QAC7B,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACpE,IAAI,OAAO;YACP,MAAM,CAAC,uBAAuB,GAAG,OAAO,CAAC;QAC7C,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,CAAC;QACH,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC;AACD,SAAS,eAAe,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,OAAO,SAAS,CAAC;IACrB,MAAM,GAAG,GAAiC,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,KAAsD,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,EAAE,UAAU,CAAC;QACrC,IAAI,OAAO,SAAS,KAAK,QAAQ;YAC7B,SAAS;QACb,MAAM,QAAQ,GAAG,MAAM,EAAE,SAAS,CAAC;QACnC,GAAG,CAAC,MAAM,CAAC;YACP,OAAO,QAAQ,KAAK,QAAQ,IAAI,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAClE,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAA4B,EAAE;gBACpE,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AACD,SAAS,mBAAmB,CAAC,KAAc;IACvC,MAAM,KAAK,GAAG,KAA0D,CAAC;IACzE,IAAI,OAAO,KAAK,EAAE,EAAE,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC7D,OAAO,SAAS,CAAC;IACrB,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,KAAa;IACrC,OAAO,4EAA4E,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpG,CAAC;AACD;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAAwD;IAC1E,yDAAyD;IACzD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,sEAAsE;IACtE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1F,CAAC;AACD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACvD,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;QACvB,OAAO;IACX,IAAI,CAAC;QACD,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACtB,GAAG,MAAM;YACT,uBAAuB,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;SAC7D,CAAC,CAAC,CAAC;IACR,CAAC;IACD,MAAM,CAAC;QACH,oDAAoD;IACxD,CAAC;AACL,CAAC;AACD,2FAA2F;AAC3F,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvD,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB;IACrC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC,uBAAuB,CAAC;IACrD,IAAI,CAAC,OAAO;QACR,OAAO,SAAS,CAAC;IACrB,IAAI,CAAC;QACD,YAAY,CAAC,CAAC,EAAE,uBAAuB,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,CAAC;QACH,oFAAoF;QACpF,sBAAsB;QACtB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC;AACD,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,MAAc;IACtC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,MAAc;IACrC,IAAI,CAAC;QACD,WAAW,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,EAAE,KAAK,EAAE,2BAA2B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC;AACD,oHAAoH;AACpH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,SAAiB,EAAE,QAA2B;IAC7F,MAAM,KAAK,GAAG,QAAQ;QAClB,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE;QAChD,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAChC,IAAI,CAAC;QACD,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACtB,GAAG,MAAM;YACT,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE;SAClD,CAAC,CAAC,CAAC;IACR,CAAC;IACD,OAAO,CAAC,EAAE,CAAC;QACP,mFAAmF;QACnF,yFAAyF;QACzF,OAAO,CAAC,+CAA+C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;AACL,CAAC;AACD,oEAAoE;AACpE,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAC9C,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACD,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,EAAE,CAAC;QACP,OAAQ,CAAwB,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;IACjF,CAAC;IACD,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,OAAO,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxC,CAAC;IACD,MAAM,CAAC;QACH,OAAO,YAAY,CAAC;IACxB,CAAC;AACL,CAAC;AACD,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAC9C,2EAA2E;IAC3E,IAAI,mBAAmB,CAAC,MAAM,CAAC,KAAK,SAAS;QACzC,OAAO;IACX,IAAI,CAAC;QACD,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;YACpB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC;gBACzB,OAAO,MAAM,CAAC;YAClB,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC;YACvG,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;YACpC,KAAK,OAAO,CAAC;YACb,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,CAAC,EAAE,CAAC;QACP,OAAO,CAAC,6CAA6C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;AACL,CAAC;AACD,SAAS,kBAAkB,CAAC,KAAa,EAAE,QAAyB;IAChE,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,cAAc,GAAG,CAAC,eAAe,EAAE,aAAa,EAAE,UAAU,CAAC;SAC9D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,+EAA+E;SACpH,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACvF,IAAI,KAAK,KAAK,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACnB,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,KAAK,KAAK,MAAM;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACvC,CAAC;AACD,MAAM,UAAU,0BAA0B,CAAC,MAAc,EAAE,OAA4B;IACnF,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACvD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,uBAAuB,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,mEAAmE,EAAE;gBACjF,KAAK,EAAE,MAAM,CAAC,KAAK;aACtB,CAAC,CAAC;QACP,CAAC;QACD,OAAO;IACX,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,KAAK,KAAK,MAAM,CAAC;IAC9B,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,uBAAuB,GAAG,CAAC,CAAC,CAAC,UAAU,uBAAuB,GAAG,CAAC;IACnG,MAAM,UAAU,GAAG,GAAG,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,uEAAuE;IACvE,MAAM,OAAO,GAAG,QAAQ;SACnB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SAC1C,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,MAAM,OAAO,GAAG,GAAG,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,IAAI,CAAC;IAC7F,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AACD,MAAM,UAAU,WAAW;IACvB,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO;QACrB,OAAO,KAAK,CAAC;IACjB,IAAI,CAAC;QACD,oFAAoF;QACpF,wBAAwB;QACxB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACzG,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,CAAC;QACH,8CAA8C;QAC9C,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AACD,kGAAkG;AAClG,SAAS,YAAY,CAAC,GAAW;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI;YACxB,OAAO,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AACD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IACxC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QACN,OAAO,SAAS,CAAC;IACrB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAmB,CAAC;IAC/C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACrB,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,WAAW,IAAI,EAAE,EAAE,EAAE,CAAC;AACvE,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,GAAW;IACzC,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AACD,MAAM,UAAU,OAAO,CAAC,GAAW;IAC/B,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;QACf,OAAO,KAAK,CAAC;IACjB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,0FAA0F;IAC1F,+CAA+C;IAC/C,OAAO,QAAQ;QACX,CAAC,CAAC,GAAG,cAAc,GAAG,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QAC1F,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AACD,0FAA0F;AAC1F,SAAS,YAAY,CAAC,cAAuB;IACzC,IAAI,cAAc;QACd,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACpD,IAAI,MAAM;QACN,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5C,mEAAmE;IACnE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC;IACpC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC7E,CAAC;AACD,kGAAkG;AAClG,MAAM,UAAU,cAAc,CAAC,cAAuB;IAClD,OAAO,YAAY,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC;AAC9C,CAAC;AACD,uGAAuG;AACvG,MAAM,UAAU,aAAa,CAAC,KAAyB;IACnD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;AAC7D,CAAC;AACD,0GAA0G;AAC1G,MAAM,UAAU,eAAe,CAAC,cAAuB;IACnD,MAAM,GAAG,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;IAC3C,OAAO,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AACD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,cAAuB;IAChD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,sCAAsC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC7E,CAAC;IACD,yFAAyF;IACzF,0FAA0F;IAC1F,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,4DAA4D,EAAE,MAAM,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AACD,MAAM,UAAU,SAAS;IACrB,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,IAAI,KAAK,IAAI,QAAQ;QACjB,OAAO,QAAQ,CAAC,GAAG,CAAC;IACxB,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/lib/bundled-skill.d.ts

@@ -0,0 +1,5 @@
+/** 复刻自 tiny-fish CLI 编译产物：bundled-skill.d.ts + bundled-skill.impl.js */
+/** Two levels up from dist/lib/ is the package root; tsc mirrors src/. */
+export declare function bundledSkillDir(name?: string): string;
+export declare function bundledSkillNames(): readonly string[];
+//# sourceMappingURL=bundled-skill.d.ts.map

package/dist/lib/bundled-skill.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled-skill.d.ts","sourceRoot":"","sources":["../../src/lib/bundled-skill.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAKxE,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,IAAI,GAAE,MAAuB,GAAG,MAAM,CAGrE;AAED,wBAAgB,iBAAiB,IAAI,SAAS,MAAM,EAAE,CAErD"}

package/dist/lib/bundled-skill.js

@@ -0,0 +1,13 @@
+/** 复刻自 tiny-fish CLI 编译产物：bundled-skill.d.ts + bundled-skill.impl.js */
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { BUNDLED_SKILL_NAMES, WEB_SKILL_NAME } from './constants.js';
+/** Two levels up from dist/lib/ is the package root; tsc mirrors src/. */
+export function bundledSkillDir(name = WEB_SKILL_NAME) {
+    const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+    return path.join(packageRoot, 'skill', name);
+}
+export function bundledSkillNames() {
+    return BUNDLED_SKILL_NAMES;
+}
+//# sourceMappingURL=bundled-skill.js.map

package/dist/lib/bundled-skill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled-skill.js","sourceRoot":"","sources":["../../src/lib/bundled-skill.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrE,0EAA0E;AAC1E,MAAM,UAAU,eAAe,CAAC,OAAe,cAAc;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC7B,OAAO,mBAAmB,CAAC;AAC/B,CAAC"}

package/dist/lib/claude-config.d.ts

@@ -0,0 +1,19 @@
+/** 复刻自 tiny-fish CLI 编译产物：claude-config.d.ts + claude-config.impl.js */
+export declare function claudeSettingsPath(): string;
+export declare function claudeMdPath(): string;
+export declare const SPRINGBRAND_PERMISSION = "Bash(springbrand:*)";
+export declare const CLAUDE_MD_MARKER = "<!-- springbrand-configure-claude -->";
+export declare function readSettingsJson(): Record<string, unknown>;
+export declare function writeSettingsJson(settings: Record<string, unknown>): void;
+export declare function mergeSettings(existing: Record<string, unknown>): Record<string, unknown>;
+export declare function removeFromSettings(existing: Record<string, unknown>): Record<string, unknown>;
+export declare function readClaudeMd(): string;
+export declare function writeClaudeMd(content: string): void;
+export declare function mergeClaudeMd(existing: string): {
+    content: string;
+    replaced: boolean;
+};
+export declare function removeFromClaudeMd(existing: string): string;
+export declare function isSpringbrandConfiguredInSettings(settings: Record<string, unknown>): boolean;
+export declare function isSpringbrandConfiguredInClaudeMd(content: string): boolean;
+//# sourceMappingURL=claude-config.d.ts.map

package/dist/lib/claude-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-config.d.ts","sourceRoot":"","sources":["../../src/lib/claude-config.ts"],"names":[],"mappings":"AAAA,wEAAwE;AASxE,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AACD,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AA2B5D,eAAO,MAAM,gBAAgB,0CAA0C,CAAC;AAgCxE,wBAAgB,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe1D;AACD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAGzE;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBxF;AACD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0B7F;AAED,wBAAgB,YAAY,IAAI,MAAM,CAUrC;AACD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAGnD;AAaD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;CACrB,CAaA;AACD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAO3D;AAED,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAM5F;AACD,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1E"}