@squadrules/mcp 4.8.6

package/dist/cli/commands/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../src/cli/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAIzC,SAAS,eAAe,CAAC,GAAW,EAAE,KAAa;IACjD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU,GAAG,iBAAiB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,aAAiC;IACtE,MAAM,OAAO,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAgC,EAAE,YAAY,GAAG,IAAI;IACzF,MAAM,OAAO,GAAG,YAAY,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,wBAAwB,YAAY,uBAAuB,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,OAAyB,CAAC;IACnC,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpE,IAAI,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,OAAyB,CAAC;IACnC,CAAC;IACD,OAAO,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAsB,CAAC;gBAC3E,IAAI,GAAG,CAAC,IAAI,KAAK,+BAA+B,EAAE,CAAC;oBACjD,OAAO,GAAG,CAAC;gBACb,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,aAAa,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IAC5D,OAAO,CAAC,UAAU,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,mLAAmL,CACpL;SACA,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,CAAC;SAC1D,MAAM,CAAC,oBAAoB,EAAE,yCAAyC,CAAC;SACvE,MAAM,CAAC,oBAAoB,EAAE,sEAAsE,CAAC;SACpG,MAAM,CACL,sBAAsB,EACtB,yGAAyG,CAC1G;SACA,MAAM,CACL,KAAK,EAAE,OAKN,EAAE,EAAE;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;QAC1C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,YAAY,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YACpE,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,WAAW,CAAC,2BAA2B,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAChD,IAAI,SAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YACH,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAA8B,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE;YACjE,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE;gBACjB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,SAAS,CAAC;QAEhB,IAAI,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,oBAAoB,UAAU,EAAE,EAAE,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CACX,CAAC,YAAY,KAAK;oBAChB,CAAC,CAAC,yDAAyD,CAAC,CAAC,OAAO,EAAE;oBACtE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CACd,CAAC;gBACF,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,GAAG,GAAsB;YAC7B,GAAG,OAAO,CAAC,GAAG;YACd,cAAc,EAAE,SAAS;YACzB,gBAAgB,EAAE,GAAG;YACrB,2BAA2B,EAAE,MAAM;SACpC,CAAC;QACF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE;YAC1C,GAAG,EAAE,IAAI;YACT,GAAG;YACH,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAC/E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/cli/commands/spaces.d.ts

@@ -0,0 +1,6 @@
+import { Command } from 'commander';
+/**
+ * spaces command
+ */
+export declare function spacesCommand(program: Command): void;
+//# sourceMappingURL=spaces.d.ts.map

package/dist/cli/commands/spaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spaces.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/spaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmBpD"}

package/dist/cli/commands/spaces.js

@@ -0,0 +1,25 @@
+import { handleApiError, isBrowserDisabled } from '../auth-error.js';
+import { writeJson } from '../output.js';
+import { createClientFromProgram } from '../client-factory.js';
+/**
+ * spaces command
+ */
+export function spacesCommand(program) {
+    program
+        .command('spaces')
+        .description('List available spaces and adapter counts')
+        .option('--include-adapter-titles', 'Include per-space adapter titles and layer counts')
+        .action(async (options) => {
+        try {
+            const client = createClientFromProgram(program);
+            const response = await client.spaces({
+                include_adapter_titles: Boolean(options.includeAdapterTitles)
+            });
+            writeJson(response);
+        }
+        catch (error) {
+            handleApiError(error, !isBrowserDisabled());
+        }
+    });
+}
+//# sourceMappingURL=spaces.js.map

package/dist/cli/commands/spaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spaces.js","sourceRoot":"","sources":["../../../src/cli/commands/spaces.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CACL,0BAA0B,EAC1B,mDAAmD,CACpD;SACA,MAAM,CAAC,KAAK,EAAE,OAA2C,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;gBACnC,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;aAC9D,CAAC,CAAC;YACH,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,KAAK,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/token.d.ts

@@ -0,0 +1,6 @@
+/**
+ * kairos token — print the stored bearer token to stdout (for scripting).
+ */
+import { Command } from 'commander';
+export declare function tokenCommand(program: Command): void;
+//# sourceMappingURL=token.d.ts.map

package/dist/cli/commands/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/token.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuCnD"}

package/dist/cli/commands/token.js

@@ -0,0 +1,45 @@
+/**
+ * kairos token — print the stored bearer token to stdout (for scripting).
+ */
+import { readConfig } from '../config-file.js';
+import { writeError } from '../output.js';
+import { getBaseUrl, isTokenValid, loginWithBrowser } from './login.js';
+export function tokenCommand(program) {
+    program
+        .command('token')
+        .description('Print the stored bearer token to stdout (for scripting)')
+        .option('-v, --validate', 'Validate token with GET /api/me before printing')
+        .option('-l, --login', 'Trigger browser login if no valid token exists')
+        .action(async (opts) => {
+        try {
+            const baseUrl = getBaseUrl();
+            let config = await readConfig(baseUrl);
+            let token = config.bearerToken;
+            if (!token && opts.login) {
+                const ok = await loginWithBrowser(baseUrl);
+                if (!ok) {
+                    writeError('Login failed.');
+                    process.exit(1);
+                }
+                config = await readConfig(baseUrl);
+                token = config.bearerToken;
+            }
+            if (!token) {
+                writeError('No stored token. Run `kairos login` or use `kairos token --login`.');
+                process.exit(1);
+            }
+            if (opts.validate && !(await isTokenValid(baseUrl, token))) {
+                writeError('Token invalid or expired. Run `kairos login` to re-authenticate.');
+                process.exit(1);
+            }
+            process.stdout.write(token);
+            if (process.stdout.isTTY)
+                process.stdout.write('\n');
+        }
+        catch (error) {
+            writeError(error instanceof Error ? error.message : String(error));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=token.js.map

package/dist/cli/commands/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/cli/commands/token.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,UAAU,YAAY,CAAC,OAAgB;IACzC,OAAO;SACF,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,gBAAgB,EAAE,iDAAiD,CAAC;SAC3E,MAAM,CAAC,aAAa,EAAE,gDAAgD,CAAC;SACvE,MAAM,CAAC,KAAK,EAAE,IAA6C,EAAE,EAAE;QAC5D,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;YAE/B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACvB,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;oBACN,UAAU,CAAC,eAAe,CAAC,CAAC;oBAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,CAAC;gBACD,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;gBACnC,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;YAC/B,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,UAAU,CAAC,oEAAoE,CAAC,CAAC;gBACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACzD,UAAU,CAAC,kEAAkE,CAAC,CAAC;gBAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/update.d.ts

@@ -0,0 +1,6 @@
+/**
+ * tune command
+ */
+import { Command } from 'commander';
+export declare function updateCommand(program: Command): void;
+//# sourceMappingURL=update.d.ts.map

package/dist/cli/commands/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/update.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgGpD"}

package/dist/cli/commands/update.js

@@ -0,0 +1,88 @@
+/**
+ * tune command
+ */
+import { handleApiError, isBrowserDisabled } from '../auth-error.js';
+import { writeError, writeJson } from '../output.js';
+import { readMarkdownUploadFromFile } from '../upload-guards.js';
+import { createClientFromProgram } from '../client-factory.js';
+export function updateCommand(program) {
+    program
+        .command('tune')
+        .description('Update one or more KAIROS adapter layers')
+        .argument('<uris...>', 'KAIROS adapter or layer URIs')
+        .option('--file <file>', 'Path to markdown file to apply to all specified URIs')
+        .option('--files <files...>', 'Paths to markdown files, one per URI (must match number of URIs)')
+        .option('--updates <json>', 'Updates object as JSON string (alternative to --file/--files)')
+        .option('--space <space>', 'Move all layers of each target adapter to this space (e.g. personal or a group name). Use without --file for move-only.')
+        .option('--allow-sensitive-upload', 'Allow uploads that contain token-like or private-key-like text')
+        .action(async (uris, options) => {
+        try {
+            const client = createClientFromProgram(program);
+            let markdownDoc;
+            let updates;
+            const rawSpace = typeof options.space === 'string' ? options.space.trim() : '';
+            if (rawSpace.length > 0 && !options.file && !options.files && !options.updates) {
+                const response = await client.tune(uris, { space: rawSpace });
+                writeJson(response);
+                return;
+            }
+            if (options.files) {
+                // Multiple files, one per URI
+                if (options.files.length !== uris.length) {
+                    writeError('Number of files must match number of URIs');
+                    process.exit(1);
+                    return;
+                }
+                markdownDoc = options.files.map((file) => readMarkdownUploadFromFile(file, 'tune', Boolean(options.allowSensitiveUpload)));
+            }
+            else if (options.file) {
+                // Single file for all URIs
+                const content = readMarkdownUploadFromFile(options.file, 'tune', Boolean(options.allowSensitiveUpload));
+                markdownDoc = uris.map(() => content);
+            }
+            else if (options.updates) {
+                try {
+                    updates = JSON.parse(options.updates);
+                }
+                catch (_e) {
+                    writeError('Invalid JSON in --updates option');
+                    process.exit(1);
+                    return;
+                }
+            }
+            else {
+                writeError('Must provide either --file, --updates, or --space alone for move-only');
+                process.exit(1);
+                return;
+            }
+            const tuneOpts = {};
+            if (markdownDoc)
+                tuneOpts.markdownDoc = markdownDoc;
+            if (updates)
+                tuneOpts.updates = updates;
+            if (rawSpace.length > 0)
+                tuneOpts.space = rawSpace;
+            // Auto-inject review_evidence from env (used by integration tests)
+            const envReviewEvidence = process.env['KAIROS_REVIEW_EVIDENCE'];
+            if (envReviewEvidence) {
+                try {
+                    const parsed = JSON.parse(envReviewEvidence);
+                    if (parsed && typeof parsed.verdict_file === 'string' && typeof parsed.exit_code === 'number' && typeof parsed.stdout === 'string') {
+                        tuneOpts.reviewEvidence = parsed;
+                    }
+                }
+                catch { /* ignore malformed env review_evidence */ }
+            }
+            const response = await client.tune(uris, tuneOpts);
+            writeJson(response);
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('ENOENT')) {
+                writeError('File not found');
+                process.exit(1);
+            }
+            handleApiError(error, !isBrowserDisabled());
+        }
+    });
+}
+//# sourceMappingURL=update.js.map

package/dist/cli/commands/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../src/cli/commands/update.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,0BAA0B,EAA2B,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC1C,OAAO;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,0CAA0C,CAAC;SACvD,QAAQ,CAAC,WAAW,EAAE,8BAA8B,CAAC;SACrD,MAAM,CAAC,eAAe,EAAE,sDAAsD,CAAC;SAC/E,MAAM,CAAC,oBAAoB,EAAE,kEAAkE,CAAC;SAChG,MAAM,CAAC,kBAAkB,EAAE,+DAA+D,CAAC;SAC3F,MAAM,CACH,iBAAiB,EACjB,yHAAyH,CAC5H;SACA,MAAM,CAAC,0BAA0B,EAAE,gEAAgE,CAAC;SACpG,MAAM,CAAC,KAAK,EACT,IAAc,EACd,OAMC,EACH,EAAE;QACA,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,WAA6C,CAAC;YAClD,IAAI,OAAwC,CAAC;YAC7C,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAE/E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC7E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC9D,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACpB,OAAO;YACX,CAAC;YAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,8BAA8B;gBAC9B,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;oBACvC,UAAU,CAAC,2CAA2C,CAAC,CAAC;oBACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChB,OAAO;gBACX,CAAC;gBACD,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACrC,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAClF,CAAC;YACN,CAAC;iBAAM,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACtB,2BAA2B;gBAC3B,MAAM,OAAO,GAAG,0BAA0B,CACtC,OAAO,CAAC,IAAI,EACZ,MAAM,EACN,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CACxC,CAAC;gBACF,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YAC1C,CAAC;iBAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,EAAE,EAAE,CAAC;oBACV,UAAU,CAAC,kCAAkC,CAAC,CAAC;oBAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChB,OAAO;gBACX,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,UAAU,CAAC,uEAAuE,CAAC,CAAC;gBACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACX,CAAC;YAED,MAAM,QAAQ,GAKV,EAAE,CAAC;YACP,IAAI,WAAW;gBAAE,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAC;YACpD,IAAI,OAAO;gBAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;YACxC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC;YACnD,mEAAmE;YACnE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YAChE,IAAI,iBAAiB,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBAC7C,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;wBACjI,QAAQ,CAAC,cAAc,GAAG,MAAM,CAAC;oBACrC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACnD,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7D,UAAU,CAAC,gBAAgB,CAAC,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;YACD,cAAc,CAAC,KAAK,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAChD,CAAC;IACL,CAAC,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/config-file-internals.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Shared JSON shape and path helpers for CLI config (used by config-file read and write).
+ */
+export declare const KEYCHAIN_TOKEN_PLACEHOLDER = "__KEYCHAIN__";
+export interface EnvironmentEntry {
+    bearerToken?: string;
+    refreshToken?: string;
+}
+export interface ConfigFileShape {
+    defaultUrl?: string;
+    environments?: Record<string, EnvironmentEntry>;
+    KAIROS_API_URL?: string;
+    bearerToken?: string;
+    refreshToken?: string;
+}
+export declare function isKeychainTokenPlaceholder(value: unknown): value is typeof KEYCHAIN_TOKEN_PLACEHOLDER;
+export declare function normalizeApiUrl(url: string): string;
+export declare function isSingleEnvFlatConfig(parsed: ConfigFileShape): boolean;
+export declare function parseConfigFile(path: string): ConfigFileShape | null;
+export declare function writeConfigShape(shape: ConfigFileShape): void;
+export declare function getConfigDir(): string;
+export declare function getConfigPath(): string;
+//# sourceMappingURL=config-file-internals.d.ts.map

package/dist/cli/config-file-internals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-file-internals.d.ts","sourceRoot":"","sources":["../../src/cli/config-file-internals.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,eAAO,MAAM,0BAA0B,iBAAiB,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,0BAA0B,CAErG;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAStE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAQpE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAK7D;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}

package/dist/cli/config-file-internals.js

@@ -0,0 +1,45 @@
+/**
+ * Shared JSON shape and path helpers for CLI config (used by config-file read and write).
+ */
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'fs';
+import { join } from 'path';
+import { getKairosConfigDir } from '../utils/kairos-user-dirs.js';
+const CONFIG_FILE_NAME = 'config.json';
+export const KEYCHAIN_TOKEN_PLACEHOLDER = '__KEYCHAIN__';
+export function isKeychainTokenPlaceholder(value) {
+    return value === KEYCHAIN_TOKEN_PLACEHOLDER;
+}
+export function normalizeApiUrl(url) {
+    return url.replace(/\/$/, '');
+}
+export function isSingleEnvFlatConfig(parsed) {
+    return (parsed.environments === undefined &&
+        (parsed.KAIROS_API_URL !== undefined ||
+            parsed.bearerToken !== undefined ||
+            parsed.refreshToken !== undefined));
+}
+export function parseConfigFile(path) {
+    if (!existsSync(path))
+        return null;
+    try {
+        const raw = readFileSync(path, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export function writeConfigShape(shape) {
+    const dir = getConfigDir();
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    const path = getConfigPath();
+    writeFileSync(path, JSON.stringify(shape, null, 2), { mode: 0o600 });
+}
+export function getConfigDir() {
+    return getKairosConfigDir();
+}
+export function getConfigPath() {
+    return join(getConfigDir(), CONFIG_FILE_NAME);
+}
+//# sourceMappingURL=config-file-internals.js.map

package/dist/cli/config-file-internals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-file-internals.js","sourceRoot":"","sources":["../../src/cli/config-file-internals.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,MAAM,CAAC,MAAM,0BAA0B,GAAG,cAAc,CAAC;AAezD,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACrD,OAAO,KAAK,KAAK,0BAA0B,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACvC,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IACzD,OAAO,CACH,MAAM,CAAC,YAAY,KAAK,SAAS;QACjC,CACI,MAAM,CAAC,cAAc,KAAK,SAAS;YACnC,MAAM,CAAC,WAAW,KAAK,SAAS;YAChC,MAAM,CAAC,YAAY,KAAK,SAAS,CACpC,CACJ,CAAC;AACN,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAsB;IACnD,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,YAAY;IACxB,OAAO,kBAAkB,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,aAAa;IACzB,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAC;AAClD,CAAC"}

package/dist/cli/config-file-write.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Persist CLI config / merge secrets (keyring + file). See config-file.ts for read API.
+ */
+export type WriteConfigInput = {
+    apiUrl?: string;
+    bearerToken?: string | null;
+    refreshToken?: string | null;
+};
+export declare function writeConfig(partial: WriteConfigInput): Promise<void>;
+//# sourceMappingURL=config-file-write.d.ts.map

package/dist/cli/config-file-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-file-write.d.ts","sourceRoot":"","sources":["../../src/cli/config-file-write.ts"],"names":[],"mappings":"AAAA;;GAEG;AAmCH,MAAM,MAAM,gBAAgB,GAAG;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,wBAAsB,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+H1E"}

package/dist/cli/config-file-write.js

@@ -0,0 +1,168 @@
+/**
+ * Persist CLI config / merge secrets (keyring + file). See config-file.ts for read API.
+ */
+import { deleteRefreshToken, deleteToken, getKeyringUnavailableReason, isKeyringAvailable, setRefreshToken, setToken, } from './keyring.js';
+import { writeStderr } from './output.js';
+import { getConfigPath, isSingleEnvFlatConfig, KEYCHAIN_TOKEN_PLACEHOLDER, normalizeApiUrl, parseConfigFile, writeConfigShape, } from './config-file-internals.js';
+let fallbackWarned = false;
+function warnFallbackOnce() {
+    if (fallbackWarned)
+        return;
+    fallbackWarned = true;
+    const reason = getKeyringUnavailableReason();
+    if (reason) {
+        writeStderr(`Keyring unavailable (${reason}); storing token in config file.`);
+    }
+    else {
+        writeStderr('Keyring unavailable; storing token in config file.');
+    }
+}
+export async function writeConfig(partial) {
+    const path = getConfigPath();
+    const parsed = parseConfigFile(path);
+    const useKeyring = isKeyringAvailable();
+    let defaultUrl;
+    let environments;
+    if (!parsed || isSingleEnvFlatConfig(parsed)) {
+        defaultUrl = typeof parsed?.KAIROS_API_URL === 'string' ? normalizeApiUrl(parsed.KAIROS_API_URL) : undefined;
+        environments = {};
+        if (defaultUrl) {
+            const entry = {};
+            if (typeof parsed?.bearerToken === 'string')
+                entry.bearerToken = parsed.bearerToken;
+            if (typeof parsed?.refreshToken === 'string')
+                entry.refreshToken = parsed.refreshToken;
+            if (Object.keys(entry).length > 0)
+                environments[defaultUrl] = entry;
+        }
+    }
+    else {
+        defaultUrl = typeof parsed.defaultUrl === 'string' ? normalizeApiUrl(parsed.defaultUrl) : undefined;
+        environments = { ...(parsed.environments ?? {}) };
+    }
+    const partialUrl = partial.apiUrl !== undefined ? normalizeApiUrl(partial.apiUrl) : undefined;
+    const setEnvTokenPlaceholder = (url, key) => {
+        const entry = environments[url] ?? {};
+        entry[key] = KEYCHAIN_TOKEN_PLACEHOLDER;
+        environments[url] = entry;
+    };
+    if (partialUrl !== undefined) {
+        defaultUrl = partialUrl;
+        if (!environments[partialUrl])
+            environments[partialUrl] = {};
+        if (partial.bearerToken === null) {
+            if (useKeyring)
+                await deleteToken(partialUrl);
+            if (useKeyring)
+                await deleteRefreshToken(partialUrl);
+            delete environments[partialUrl].bearerToken;
+            delete environments[partialUrl].refreshToken;
+        }
+        else if (partial.bearerToken !== undefined) {
+            if (useKeyring) {
+                const stored = await setToken(partialUrl, partial.bearerToken);
+                if (stored) {
+                    setEnvTokenPlaceholder(partialUrl, 'bearerToken');
+                }
+                else {
+                    warnFallbackOnce();
+                    environments[partialUrl].bearerToken = partial.bearerToken;
+                }
+            }
+            else {
+                warnFallbackOnce();
+                environments[partialUrl].bearerToken = partial.bearerToken;
+            }
+        }
+        if (partial.refreshToken === null) {
+            if (useKeyring)
+                await deleteRefreshToken(partialUrl);
+            delete environments[partialUrl].refreshToken;
+        }
+        else if (partial.refreshToken !== undefined) {
+            if (useKeyring) {
+                const stored = await setRefreshToken(partialUrl, partial.refreshToken);
+                if (stored) {
+                    setEnvTokenPlaceholder(partialUrl, 'refreshToken');
+                }
+                else {
+                    warnFallbackOnce();
+                    environments[partialUrl].refreshToken = partial.refreshToken;
+                }
+            }
+            else {
+                warnFallbackOnce();
+                environments[partialUrl].refreshToken = partial.refreshToken;
+            }
+        }
+        const entPartial = environments[partialUrl];
+        if (entPartial && Object.keys(entPartial).length === 0)
+            delete environments[partialUrl];
+    }
+    else if (partial.bearerToken === null && defaultUrl) {
+        if (useKeyring)
+            await deleteToken(defaultUrl);
+        if (useKeyring)
+            await deleteRefreshToken(defaultUrl);
+        const ent = environments[defaultUrl];
+        if (ent) {
+            delete ent.bearerToken;
+            delete ent.refreshToken;
+            if (Object.keys(ent).length === 0)
+                delete environments[defaultUrl];
+        }
+    }
+    else if (partial.bearerToken !== undefined && partial.bearerToken !== null && defaultUrl) {
+        if (useKeyring) {
+            const stored = await setToken(defaultUrl, partial.bearerToken);
+            if (stored) {
+                setEnvTokenPlaceholder(defaultUrl, 'bearerToken');
+            }
+            else {
+                warnFallbackOnce();
+                const ent = environments[defaultUrl] ?? {};
+                ent.bearerToken = partial.bearerToken;
+                environments[defaultUrl] = ent;
+            }
+        }
+        else {
+            warnFallbackOnce();
+            const ent = environments[defaultUrl] ?? {};
+            ent.bearerToken = partial.bearerToken;
+            environments[defaultUrl] = ent;
+        }
+    }
+    else if (partial.refreshToken === null && defaultUrl) {
+        if (useKeyring)
+            await deleteRefreshToken(defaultUrl);
+        const ent = environments[defaultUrl];
+        if (ent) {
+            delete ent.refreshToken;
+            if (Object.keys(ent).length === 0)
+                delete environments[defaultUrl];
+        }
+    }
+    else if (partial.refreshToken !== undefined && partial.refreshToken !== null && defaultUrl) {
+        if (useKeyring) {
+            const stored = await setRefreshToken(defaultUrl, partial.refreshToken);
+            if (stored) {
+                setEnvTokenPlaceholder(defaultUrl, 'refreshToken');
+            }
+            else {
+                warnFallbackOnce();
+                const ent = environments[defaultUrl] ?? {};
+                ent.refreshToken = partial.refreshToken;
+                environments[defaultUrl] = ent;
+            }
+        }
+        else {
+            warnFallbackOnce();
+            const ent = environments[defaultUrl] ?? {};
+            ent.refreshToken = partial.refreshToken;
+            environments[defaultUrl] = ent;
+        }
+    }
+    const next = defaultUrl !== undefined ? { defaultUrl, environments } : { environments };
+    writeConfigShape(next);
+}
+//# sourceMappingURL=config-file-write.js.map

package/dist/cli/config-file-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-file-write.js","sourceRoot":"","sources":["../../src/cli/config-file-write.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACH,kBAAkB,EAClB,WAAW,EACX,2BAA2B,EAC3B,kBAAkB,EAClB,eAAe,EACf,QAAQ,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAGL,aAAa,EACb,qBAAqB,EACrB,0BAA0B,EAC1B,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AAEpC,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B,SAAS,gBAAgB;IACrB,IAAI,cAAc;QAAE,OAAO;IAC3B,cAAc,GAAG,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,2BAA2B,EAAE,CAAC;IAC7C,IAAI,MAAM,EAAE,CAAC;QACT,WAAW,CAAC,wBAAwB,MAAM,kCAAkC,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACJ,WAAW,CAAC,oDAAoD,CAAC,CAAC;IACtE,CAAC;AACL,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAyB;IACzD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IAExC,IAAI,UAA8B,CAAC;IACnC,IAAI,YAA8C,CAAC;IAEnD,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,UAAU,GAAG,OAAO,MAAM,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7G,YAAY,GAAG,EAAE,CAAC;QAClB,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,GAAqB,EAAE,CAAC;YACnC,IAAI,OAAO,MAAM,EAAE,WAAW,KAAK,QAAQ;gBAAE,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YACpF,IAAI,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ;gBAAE,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;YACvF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,YAAY,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;QACtE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpG,YAAY,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,MAAM,sBAAsB,GAAG,CAAC,GAAW,EAAE,GAAmC,EAAQ,EAAE;QACxF,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,KAAK,CAAC,GAAG,CAAC,GAAG,0BAA0B,CAAC;QACxC,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC,CAAC;IAEF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,UAAU,GAAG,UAAU,CAAC;QACxB,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;YAAE,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;QAE7D,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACjC,IAAI,UAAU;gBAAE,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,UAAU;gBAAE,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;YACrD,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC;YAC5C,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC;QAC/C,CAAC;aAAM,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;gBAC/D,IAAI,MAAM,EAAE,CAAC;oBACX,sBAAsB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;gBACpD,CAAC;qBAAM,CAAC;oBACN,gBAAgB,EAAE,CAAC;oBACnB,YAAY,CAAC,UAAU,CAAC,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;gBAC7D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,gBAAgB,EAAE,CAAC;gBACnB,YAAY,CAAC,UAAU,CAAC,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,UAAU;gBAAE,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;YACrD,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC;QAC/C,CAAC;aAAM,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;gBACvE,IAAI,MAAM,EAAE,CAAC;oBACX,sBAAsB,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACN,gBAAgB,EAAE,CAAC;oBACnB,YAAY,CAAC,UAAU,CAAC,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;gBAC/D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,gBAAgB,EAAE,CAAC;gBACnB,YAAY,CAAC,UAAU,CAAC,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;IAC1F,CAAC;SAAM,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,UAAU,EAAE,CAAC;QACtD,IAAI,UAAU;YAAE,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,UAAU;YAAE,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,GAAG,CAAC,WAAW,CAAC;YACvB,OAAO,GAAG,CAAC,YAAY,CAAC;YACxB,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,UAAU,EAAE,CAAC;QAC3F,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC/D,IAAI,MAAM,EAAE,CAAC;gBACX,sBAAsB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,gBAAgB,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC3C,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;gBACtC,YAAY,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC;YACjC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,gBAAgB,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC3C,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YACtC,YAAY,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC;QACjC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,UAAU,EAAE,CAAC;QACvD,IAAI,UAAU;YAAE,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,GAAG,CAAC,YAAY,CAAC;YACxB,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,UAAU,EAAE,CAAC;QAC7F,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YACvE,IAAI,MAAM,EAAE,CAAC;gBACX,sBAAsB,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,gBAAgB,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC3C,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;gBACxC,YAAY,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC;YACjC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,gBAAgB,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC3C,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;YACxC,YAAY,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC;QACjC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAoB,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;IACzG,gBAAgB,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}

package/dist/cli/config-file.d.ts

@@ -0,0 +1,30 @@
+/**
+ * CLI config file: token and API URL storage (XDG-compliant, user-only readable).
+ * Supports multiple environments keyed by KAIROS_API_URL (normalized, no trailing slash).
+ * When keyring is available, bearer and refresh tokens are stored in the OS keyring; the config file
+ * holds only defaultUrl and environment keys. When keyring is unavailable, secrets are
+ * stored in the file (with a one-time warning).
+ *
+ * New format:
+ *   { "defaultUrl": "http://localhost:<SERVER_PORT>", "environments": { "http://localhost:<SERVER_PORT>": { "bearerToken": "..." }, ... } }
+ * Older single-env shape: { "KAIROS_API_URL": "...", "bearerToken": "..." } — migrated on first write.
+ */
+export { writeConfig } from './config-file-write.js';
+export { normalizeApiUrl, getConfigPath } from './config-file-internals.js';
+export interface CliConfig {
+    apiUrl?: string;
+    bearerToken?: string;
+    /** Present after browser PKCE login when IdP issued a refresh_token; omitted for `login --token`. */
+    refreshToken?: string;
+}
+/**
+ * Sync read of default API URL from config file (no keyring/token). Used by ApiClient constructor.
+ */
+export declare function getDefaultApiUrlFromFile(): string | undefined;
+/**
+ * Read config from disk. When baseUrl is given, returns config for that environment (token for that URL).
+ * When omitted, returns the default environment (defaultUrl). Returns empty object if file missing or invalid.
+ * Tokens are read from keyring when available; tokens in the file are migrated to keyring on first read.
+ */
+export declare function readConfig(baseUrl?: string): Promise<CliConfig>;
+//# sourceMappingURL=config-file.d.ts.map

package/dist/cli/config-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-file.d.ts","sourceRoot":"","sources":["../../src/cli/config-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAmBH,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE5E,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qGAAqG;IACrG,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA+BD;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,GAAG,SAAS,CAW7D;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAqHrE"}