@squadrules/mcp 4.8.6

package/dist/cli/config-file.js

@@ -0,0 +1,200 @@
+/**
+ * CLI config file: token and API URL storage (XDG-compliant, user-only readable).
+ * Supports multiple environments keyed by KAIROS_API_URL (normalized, no trailing slash).
+ * When keyring is available, bearer and refresh tokens are stored in the OS keyring; the config file
+ * holds only defaultUrl and environment keys. When keyring is unavailable, secrets are
+ * stored in the file (with a one-time warning).
+ *
+ * New format:
+ *   { "defaultUrl": "http://localhost:<SERVER_PORT>", "environments": { "http://localhost:<SERVER_PORT>": { "bearerToken": "..." }, ... } }
+ * Older single-env shape: { "KAIROS_API_URL": "...", "bearerToken": "..." } — migrated on first write.
+ */
+import { getRefreshToken, getToken, isKeyringAvailable, setRefreshToken, setToken, } from './keyring.js';
+import { writeStderr } from './output.js';
+import { getConfigPath, isKeychainTokenPlaceholder, isSingleEnvFlatConfig, KEYCHAIN_TOKEN_PLACEHOLDER, normalizeApiUrl, parseConfigFile, writeConfigShape, } from './config-file-internals.js';
+export { writeConfig } from './config-file-write.js';
+export { normalizeApiUrl, getConfigPath } from './config-file-internals.js';
+function extractInlineSecret(value) {
+    if (isKeychainTokenPlaceholder(value))
+        return { inlineValue: undefined, hadPlaceholder: true };
+    return { inlineValue: value, hadPlaceholder: false };
+}
+let keychainUnreachableWarned = false;
+/**
+ * One-time warning for the placeholder dead-end: the file marks a token as keychain-stored
+ * (__KEYCHAIN__) but the keyring can no longer return it (binding gone or timed out). Without this
+ * the CLI silently drops the session; here we tell the user how to recover.
+ */
+function warnKeychainUnreachableOnce() {
+    if (keychainUnreachableWarned)
+        return;
+    keychainUnreachableWarned = true;
+    writeStderr('Token was saved to the OS keychain but the keyring is now unavailable — run `kairos login` to re-authenticate.');
+}
+function persistEnvironmentSentinel(path, url, opts) {
+    const parsed = parseConfigFile(path);
+    if (!parsed || isSingleEnvFlatConfig(parsed))
+        return;
+    const envs = { ...(parsed.environments ?? {}) };
+    const entry = { ...(envs[url] ?? {}) };
+    if (opts.bearer)
+        entry.bearerToken = KEYCHAIN_TOKEN_PLACEHOLDER;
+    if (opts.refresh)
+        entry.refreshToken = KEYCHAIN_TOKEN_PLACEHOLDER;
+    envs[url] = entry;
+    if (typeof parsed.defaultUrl === 'string')
+        writeConfigShape({ defaultUrl: parsed.defaultUrl, environments: envs });
+    else
+        writeConfigShape({ environments: envs });
+}
+/**
+ * Sync read of default API URL from config file (no keyring/token). Used by ApiClient constructor.
+ */
+export function getDefaultApiUrlFromFile() {
+    const path = getConfigPath();
+    const parsed = parseConfigFile(path);
+    if (!parsed)
+        return undefined;
+    if (isSingleEnvFlatConfig(parsed) && typeof parsed.KAIROS_API_URL === 'string') {
+        return normalizeApiUrl(parsed.KAIROS_API_URL);
+    }
+    if (typeof parsed.defaultUrl === 'string')
+        return normalizeApiUrl(parsed.defaultUrl);
+    const envs = parsed.environments ?? {};
+    const first = Object.keys(envs)[0];
+    return first ? normalizeApiUrl(first) : undefined;
+}
+/**
+ * Read config from disk. When baseUrl is given, returns config for that environment (token for that URL).
+ * When omitted, returns the default environment (defaultUrl). Returns empty object if file missing or invalid.
+ * Tokens are read from keyring when available; tokens in the file are migrated to keyring on first read.
+ */
+export async function readConfig(baseUrl) {
+    const path = getConfigPath();
+    const parsed = parseConfigFile(path);
+    if (!parsed)
+        return {};
+    const useKeyring = isKeyringAvailable();
+    let effectiveUrl;
+    let tokenFromFile;
+    let refreshFromFile;
+    let hadTokenPlaceholder = false;
+    let hadRefreshPlaceholder = false;
+    let apiUrlOut;
+    if (isSingleEnvFlatConfig(parsed)) {
+        const storedSingleUrlRaw = typeof parsed.KAIROS_API_URL === 'string' ? parsed.KAIROS_API_URL : undefined;
+        const normalizedStoredSingleUrl = storedSingleUrlRaw ? normalizeApiUrl(storedSingleUrlRaw) : undefined;
+        const normalizedBase = baseUrl ? normalizeApiUrl(baseUrl) : undefined;
+        const isMatchingStoredSingle = !!(normalizedStoredSingleUrl &&
+            ((!normalizedBase && normalizedStoredSingleUrl) || normalizedBase === normalizedStoredSingleUrl));
+        if (!normalizedStoredSingleUrl && normalizedBase) {
+            effectiveUrl = normalizedBase;
+            apiUrlOut = normalizedBase;
+        }
+        else if (normalizedStoredSingleUrl && (normalizedBase === undefined || normalizedBase === normalizedStoredSingleUrl)) {
+            effectiveUrl = normalizedStoredSingleUrl;
+            apiUrlOut = normalizedStoredSingleUrl;
+            tokenFromFile = typeof parsed.bearerToken === 'string' ? parsed.bearerToken : undefined;
+            refreshFromFile = typeof parsed.refreshToken === 'string' ? parsed.refreshToken : undefined;
+            const tokenInfo = extractInlineSecret(tokenFromFile);
+            const refreshInfo = extractInlineSecret(refreshFromFile);
+            hadTokenPlaceholder = tokenInfo.hadPlaceholder;
+            hadRefreshPlaceholder = refreshInfo.hadPlaceholder;
+            const tokenInline = tokenInfo.inlineValue;
+            const refreshInline = refreshInfo.inlineValue;
+            if (useKeyring && isMatchingStoredSingle) {
+                let tokenStored = false;
+                let refreshStored = false;
+                if (tokenInline)
+                    tokenStored = await setToken(normalizedStoredSingleUrl, tokenInline);
+                if (refreshInline)
+                    refreshStored = await setRefreshToken(normalizedStoredSingleUrl, refreshInline);
+                const nextEntry = {};
+                if (tokenFromFile !== undefined) {
+                    if (tokenStored || hadTokenPlaceholder)
+                        nextEntry.bearerToken = KEYCHAIN_TOKEN_PLACEHOLDER;
+                    else if (tokenInline)
+                        nextEntry.bearerToken = tokenInline;
+                }
+                if (refreshFromFile !== undefined) {
+                    if (refreshStored || hadRefreshPlaceholder)
+                        nextEntry.refreshToken = KEYCHAIN_TOKEN_PLACEHOLDER;
+                    else if (refreshInline)
+                        nextEntry.refreshToken = refreshInline;
+                }
+                writeConfigShape({
+                    defaultUrl: normalizedStoredSingleUrl,
+                    environments: Object.keys(nextEntry).length > 0 ? { [normalizedStoredSingleUrl]: nextEntry } : {},
+                });
+            }
+        }
+        else {
+            effectiveUrl = normalizedBase;
+            apiUrlOut = normalizedBase;
+        }
+    }
+    else {
+        const environments = parsed.environments ?? {};
+        const defaultUrl = typeof parsed.defaultUrl === 'string' ? normalizeApiUrl(parsed.defaultUrl) : undefined;
+        effectiveUrl = baseUrl ? normalizeApiUrl(baseUrl) : defaultUrl ?? Object.keys(environments)[0];
+        if (!effectiveUrl)
+            return {};
+        apiUrlOut = effectiveUrl;
+        const entry = environments[effectiveUrl];
+        tokenFromFile = entry && typeof entry.bearerToken === 'string' ? entry.bearerToken : undefined;
+        refreshFromFile = entry && typeof entry.refreshToken === 'string' ? entry.refreshToken : undefined;
+        const tokenInfo = extractInlineSecret(tokenFromFile);
+        const refreshInfo = extractInlineSecret(refreshFromFile);
+        tokenFromFile = tokenInfo.inlineValue;
+        refreshFromFile = refreshInfo.inlineValue;
+        hadTokenPlaceholder = tokenInfo.hadPlaceholder;
+        hadRefreshPlaceholder = refreshInfo.hadPlaceholder;
+    }
+    if (!effectiveUrl)
+        return {};
+    const fromKeyring = await getToken(effectiveUrl);
+    let token = fromKeyring ?? null;
+    if (!token && tokenFromFile) {
+        if (useKeyring) {
+            const stored = await setToken(effectiveUrl, tokenFromFile);
+            token = tokenFromFile;
+            if (stored)
+                persistEnvironmentSentinel(path, effectiveUrl, { bearer: true });
+        }
+        else {
+            token = tokenFromFile;
+        }
+    }
+    if (hadTokenPlaceholder && !fromKeyring) {
+        if (!isKeyringAvailable())
+            warnKeychainUnreachableOnce();
+        token = null;
+    }
+    const fromKeyringRefresh = await getRefreshToken(effectiveUrl);
+    let refreshToken = fromKeyringRefresh ?? null;
+    if (!refreshToken && refreshFromFile) {
+        if (useKeyring) {
+            const stored = await setRefreshToken(effectiveUrl, refreshFromFile);
+            refreshToken = refreshFromFile;
+            if (stored)
+                persistEnvironmentSentinel(path, effectiveUrl, { refresh: true });
+        }
+        else {
+            refreshToken = refreshFromFile;
+        }
+    }
+    if (hadRefreshPlaceholder && !fromKeyringRefresh) {
+        if (!isKeyringAvailable())
+            warnKeychainUnreachableOnce();
+        refreshToken = null;
+    }
+    const out = {};
+    if (apiUrlOut)
+        out.apiUrl = apiUrlOut;
+    if (token)
+        out.bearerToken = token;
+    if (refreshToken)
+        out.refreshToken = refreshToken;
+    return out;
+}
+//# sourceMappingURL=config-file.js.map

package/dist/cli/config-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-file.js","sourceRoot":"","sources":["../../src/cli/config-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,eAAe,EACf,QAAQ,EACR,kBAAkB,EAClB,eAAe,EACf,QAAQ,GACT,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,aAAa,EACb,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAS5E,SAAS,mBAAmB,CAAC,KAAyB;IACpD,IAAI,0BAA0B,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC/F,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACvD,CAAC;AAED,IAAI,yBAAyB,GAAG,KAAK,CAAC;AACtC;;;;GAIG;AACH,SAAS,2BAA2B;IAClC,IAAI,yBAAyB;QAAE,OAAO;IACtC,yBAAyB,GAAG,IAAI,CAAC;IACjC,WAAW,CAAC,gHAAgH,CAAC,CAAC;AAChI,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY,EAAE,GAAW,EAAE,IAA6C;IAC1G,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO;IACrD,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,WAAW,GAAG,0BAA0B,CAAC;IAChE,IAAI,IAAI,CAAC,OAAO;QAAE,KAAK,CAAC,YAAY,GAAG,0BAA0B,CAAC;IAClE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClB,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QAAE,gBAAgB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;;QAC9G,gBAAgB,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB;IACpC,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,qBAAqB,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC7E,OAAO,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAgB;IAC/C,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IAExC,IAAI,YAAgC,CAAC;IACrC,IAAI,aAAiC,CAAC;IACtC,IAAI,eAAmC,CAAC;IACxC,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAClC,IAAI,SAA6B,CAAC;IAElC,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,kBAAkB,GAAG,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QACzG,MAAM,yBAAyB,GAAG,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,sBAAsB,GAAG,CAAC,CAAC,CAC/B,yBAAyB;YACzB,CAAC,CAAC,CAAC,cAAc,IAAI,yBAAyB,CAAC,IAAI,cAAc,KAAK,yBAAyB,CAAC,CACjG,CAAC;QAEF,IAAI,CAAC,yBAAyB,IAAI,cAAc,EAAE,CAAC;YACjD,YAAY,GAAG,cAAc,CAAC;YAC9B,SAAS,GAAG,cAAc,CAAC;QAC7B,CAAC;aAAM,IAAI,yBAAyB,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,yBAAyB,CAAC,EAAE,CAAC;YACvH,YAAY,GAAG,yBAAyB,CAAC;YACzC,SAAS,GAAG,yBAAyB,CAAC;YACtC,aAAa,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,eAAe,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5F,MAAM,SAAS,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;YACzD,mBAAmB,GAAG,SAAS,CAAC,cAAc,CAAC;YAC/C,qBAAqB,GAAG,WAAW,CAAC,cAAc,CAAC;YACnD,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;YAC1C,MAAM,aAAa,GAAG,WAAW,CAAC,WAAW,CAAC;YAE9C,IAAI,UAAU,IAAI,sBAAsB,EAAE,CAAC;gBACzC,IAAI,WAAW,GAAG,KAAK,CAAC;gBACxB,IAAI,aAAa,GAAG,KAAK,CAAC;gBAC1B,IAAI,WAAW;oBAAE,WAAW,GAAG,MAAM,QAAQ,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC;gBACtF,IAAI,aAAa;oBAAE,aAAa,GAAG,MAAM,eAAe,CAAC,yBAAyB,EAAE,aAAa,CAAC,CAAC;gBAEnG,MAAM,SAAS,GAAoD,EAAE,CAAC;gBACtE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAChC,IAAI,WAAW,IAAI,mBAAmB;wBAAE,SAAS,CAAC,WAAW,GAAG,0BAA0B,CAAC;yBACtF,IAAI,WAAW;wBAAE,SAAS,CAAC,WAAW,GAAG,WAAW,CAAC;gBAC5D,CAAC;gBACD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;oBAClC,IAAI,aAAa,IAAI,qBAAqB;wBAAE,SAAS,CAAC,YAAY,GAAG,0BAA0B,CAAC;yBAC3F,IAAI,aAAa;wBAAE,SAAS,CAAC,YAAY,GAAG,aAAa,CAAC;gBACjE,CAAC;gBACD,gBAAgB,CAAC;oBACf,UAAU,EAAE,yBAAyB;oBACrC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,yBAAyB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE;iBAClG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,cAAc,CAAC;YAC9B,SAAS,GAAG,cAAc,CAAC;QAC7B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1G,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,CAAC;QAC7B,SAAS,GAAG,YAAY,CAAC;QACzB,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACzC,aAAa,GAAG,KAAK,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,eAAe,GAAG,KAAK,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACnG,MAAM,SAAS,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACzD,aAAa,GAAG,SAAS,CAAC,WAAW,CAAC;QACtC,eAAe,GAAG,WAAW,CAAC,WAAW,CAAC;QAC1C,mBAAmB,GAAG,SAAS,CAAC,cAAc,CAAC;QAC/C,qBAAqB,GAAG,WAAW,CAAC,cAAc,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAE7B,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,KAAK,GAAG,WAAW,IAAI,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,aAAa,EAAE,CAAC;QAC5B,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;YAC3D,KAAK,GAAG,aAAa,CAAC;YACtB,IAAI,MAAM;gBAAE,0BAA0B,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,aAAa,CAAC;QACxB,CAAC;IACH,CAAC;IACD,IAAI,mBAAmB,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,kBAAkB,EAAE;YAAE,2BAA2B,EAAE,CAAC;QACzD,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,YAAY,GAAG,kBAAkB,IAAI,IAAI,CAAC;IAC9C,IAAI,CAAC,YAAY,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;YACpE,YAAY,GAAG,eAAe,CAAC;YAC/B,IAAI,MAAM;gBAAE,0BAA0B,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,eAAe,CAAC;QACjC,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACjD,IAAI,CAAC,kBAAkB,EAAE;YAAE,2BAA2B,EAAE,CAAC;QACzD,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,IAAI,SAAS;QAAE,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;IACtC,IAAI,KAAK;QAAE,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC;IACnC,IAAI,YAAY;QAAE,GAAG,CAAC,YAAY,GAAG,YAAY,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cli/config.d.ts

@@ -0,0 +1,13 @@
+/**
+ * CLI Configuration
+ */
+/**
+ * Default API base for Commander --url and fallbacks: KAIROS_API_URL, then saved config defaultUrl, then localhost:3000.
+ * Matches docs/CLI.md resolution order (without an explicit --url flag).
+ */
+export declare function getCliApiUrlDefault(): string;
+/**
+ * Get the KAIROS API base URL (same as getCliApiUrlDefault).
+ */
+export declare function getApiUrl(): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/cli/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAED;;GAEG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAElC"}

package/dist/cli/config.js

@@ -0,0 +1,24 @@
+/**
+ * CLI Configuration
+ */
+import { getDefaultApiUrlFromFile } from './config-file.js';
+/**
+ * Default API base for Commander --url and fallbacks: KAIROS_API_URL, then saved config defaultUrl, then localhost:3000.
+ * Matches docs/CLI.md resolution order (without an explicit --url flag).
+ */
+export function getCliApiUrlDefault() {
+    const env = (process.env['KAIROS_API_URL'] || '').trim();
+    if (env)
+        return env;
+    const fromFile = getDefaultApiUrlFromFile();
+    if (fromFile)
+        return fromFile;
+    return 'http://localhost:3000';
+}
+/**
+ * Get the KAIROS API base URL (same as getCliApiUrlDefault).
+ */
+export function getApiUrl() {
+    return getCliApiUrlDefault();
+}
+//# sourceMappingURL=config.js.map

package/dist/cli/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IAC/B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,uBAAuB,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS;IACrB,OAAO,mBAAmB,EAAE,CAAC;AACjC,CAAC"}

package/dist/cli/download-export-ref.d.ts

@@ -0,0 +1,7 @@
+export interface DownloadedExportRef {
+    data: Buffer;
+    filename?: string;
+    contentType?: string;
+}
+export declare function downloadExportRef(baseUrl: string, urlOrPath: string): Promise<DownloadedExportRef>;
+//# sourceMappingURL=download-export-ref.d.ts.map

package/dist/cli/download-export-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"download-export-ref.d.ts","sourceRoot":"","sources":["../../src/cli/download-export-ref.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiBxG"}

package/dist/cli/download-export-ref.js

@@ -0,0 +1,19 @@
+export async function downloadExportRef(baseUrl, urlOrPath) {
+    const url = urlOrPath.startsWith('http://') || urlOrPath.startsWith('https://')
+        ? urlOrPath
+        : `${baseUrl}${urlOrPath.startsWith('/') ? '' : '/'}${urlOrPath}`;
+    const response = await fetch(url);
+    if (!response.ok) {
+        const body = await response.text().catch(() => '');
+        throw new Error(`Download failed (${response.status}): ${body || response.statusText}`);
+    }
+    const contentDisposition = response.headers.get('content-disposition') ?? '';
+    const filenameMatch = /filename="([^"]+)"/i.exec(contentDisposition);
+    const arrayBuffer = await response.arrayBuffer();
+    return {
+        data: Buffer.from(arrayBuffer),
+        ...(filenameMatch?.[1] ? { filename: filenameMatch[1] } : {}),
+        ...(response.headers.get('content-type') ? { contentType: response.headers.get('content-type') } : {})
+    };
+}
+//# sourceMappingURL=download-export-ref.js.map

package/dist/cli/download-export-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"download-export-ref.js","sourceRoot":"","sources":["../../src/cli/download-export-ref.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,SAAiB;IACxE,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;QAC7E,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,GAAG,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;IAC7E,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;QAC9B,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxG,CAAC;AACJ,CAAC"}

package/dist/cli/fetch-error.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Helpers for turning opaque undici network failures into actionable messages.
+ *
+ * undici reports network problems as `TypeError: fetch failed` and stores the real reason on
+ * `err.cause` (e.g. ECONNREFUSED / ENOTFOUND / certificate). Surfacing that cause is the whole
+ * point — a bare "fetch failed" gives the user nothing to act on.
+ */
+/**
+ * Append undici's underlying `cause` to an opaque "fetch failed" message so the user sees the real
+ * reason instead of a bare "fetch failed". Message-only — never alters control flow.
+ */
+export declare function describeFetchError(err: unknown): string;
+/**
+ * Build a network Error whose message carries the underlying cause plus a reachability hint, and
+ * whose `cause` preserves the original error for programmatic access.
+ */
+export declare function networkErrorWithHint(prefix: string, err: unknown): Error;
+//# sourceMappingURL=fetch-error.d.ts.map

package/dist/cli/fetch-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-error.d.ts","sourceRoot":"","sources":["../../src/cli/fetch-error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAYvD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,KAAK,CAOxE"}

package/dist/cli/fetch-error.js

@@ -0,0 +1,38 @@
+/**
+ * Helpers for turning opaque undici network failures into actionable messages.
+ *
+ * undici reports network problems as `TypeError: fetch failed` and stores the real reason on
+ * `err.cause` (e.g. ECONNREFUSED / ENOTFOUND / certificate). Surfacing that cause is the whole
+ * point — a bare "fetch failed" gives the user nothing to act on.
+ */
+/**
+ * Append undici's underlying `cause` to an opaque "fetch failed" message so the user sees the real
+ * reason instead of a bare "fetch failed". Message-only — never alters control flow.
+ */
+export function describeFetchError(err) {
+    if (!(err instanceof Error))
+        return 'network error';
+    let detail = err.message || 'network error';
+    const cause = err.cause;
+    if (cause instanceof Error) {
+        const code = cause.code;
+        const causeText = code ? `${code} ${cause.message}` : cause.message;
+        if (causeText && !detail.includes(causeText))
+            detail = `${detail} (${causeText})`;
+    }
+    else if (typeof cause === 'string' && cause && !detail.includes(cause)) {
+        detail = `${detail} (${cause})`;
+    }
+    return detail;
+}
+/**
+ * Build a network Error whose message carries the underlying cause plus a reachability hint, and
+ * whose `cause` preserves the original error for programmatic access.
+ */
+export function networkErrorWithHint(prefix, err) {
+    const detailed = new Error(`${prefix}: ${describeFetchError(err)}. ` +
+        `Verify the server is reachable and the URL/port is correct (--url / KAIROS_API_URL).`);
+    detailed.cause = err;
+    return detailed;
+}
+//# sourceMappingURL=fetch-error.js.map

package/dist/cli/fetch-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-error.js","sourceRoot":"","sources":["../../src/cli/fetch-error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC3C,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC;IACpD,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,eAAe,CAAC;IAC5C,MAAM,KAAK,GAAI,GAA2B,CAAC,KAAK,CAAC;IACjD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QACpE,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,GAAG,CAAC;IACtF,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,KAAK,KAAK,GAAG,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,GAAY;IAC7D,MAAM,QAAQ,GAAG,IAAI,KAAK,CACtB,GAAG,MAAM,KAAK,kBAAkB,CAAC,GAAG,CAAC,IAAI;QACzC,sFAAsF,CACzF,CAAC;IACD,QAAgC,CAAC,KAAK,GAAG,GAAG,CAAC;IAC9C,OAAO,QAAQ,CAAC;AACpB,CAAC"}

package/dist/cli/format-next-call.d.ts

@@ -0,0 +1,2 @@
+export declare function formatNextCallBlock(response: unknown): string | null;
+//# sourceMappingURL=format-next-call.d.ts.map

package/dist/cli/format-next-call.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-next-call.d.ts","sourceRoot":"","sources":["../../src/cli/format-next-call.ts"],"names":[],"mappings":"AA2BA,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAyCpE"}

package/dist/cli/format-next-call.js

@@ -0,0 +1,63 @@
+function toJson(value) {
+    return JSON.stringify(value, null, 2);
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null;
+}
+function buildForwardSnippet(nextCall) {
+    const kind = nextCall['kind'];
+    const args = nextCall['args'];
+    if (!isObject(args) || typeof args['uri'] !== 'string')
+        return null;
+    if (kind === 'forward') {
+        const payload = {
+            uri: args['uri'],
+            solution: isObject(args['solution_template']) ? args['solution_template'] : {}
+        };
+        return `kairos forward '${payload.uri}' --solution '${JSON.stringify(payload.solution)}'`;
+    }
+    if (kind === 'reward') {
+        return `kairos reward '${args['uri']}' success 'completed'`;
+    }
+    return null;
+}
+export function formatNextCallBlock(response) {
+    if (!isObject(response))
+        return null;
+    if (isObject(response['next_call'])) {
+        const nextCall = response['next_call'];
+        const snippet = buildForwardSnippet(nextCall);
+        const lines = ['next_call:', toJson(nextCall)];
+        if (snippet) {
+            lines.push('shell_snippet:', snippet);
+        }
+        return lines.join('\n');
+    }
+    if (Array.isArray(response['choices'])) {
+        const candidates = response['choices']
+            .map((choice) => (isObject(choice) ? choice : null))
+            .filter((choice) => choice !== null)
+            .map((choice) => ({
+            role: choice['role'],
+            label: choice['label'],
+            forward_first_call: choice['forward_first_call']
+        }))
+            .filter((choice) => isObject(choice.forward_first_call));
+        if (candidates.length === 0)
+            return null;
+        const first = candidates[0];
+        const uri = isObject(first.forward_first_call) && typeof first.forward_first_call['uri'] === 'string'
+            ? first.forward_first_call['uri']
+            : null;
+        const lines = ['next_call_candidates:', toJson(candidates)];
+        if (uri) {
+            lines.push('shell_snippet:', `kairos forward '${uri}'`);
+        }
+        return lines.join('\n');
+    }
+    if ('next_call' in response && response['next_call'] === null) {
+        return 'next_call: null';
+    }
+    return null;
+}
+//# sourceMappingURL=format-next-call.js.map

package/dist/cli/format-next-call.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-next-call.js","sourceRoot":"","sources":["../../src/cli/format-next-call.ts"],"names":[],"mappings":"AAEA,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAoB;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG;YACd,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC;YAChB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE;SAC/E,CAAC;QACF,OAAO,mBAAmB,OAAO,CAAC,GAAG,iBAAiB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC5F,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,kBAAkB,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAe,CAAC;QACrD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,UAAU,GAAI,QAAQ,CAAC,SAAS,CAAe;aAClD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACnD,MAAM,CAAC,CAAC,MAAM,EAAwB,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC;aACzD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;YACtB,kBAAkB,EAAE,MAAM,CAAC,oBAAoB,CAAC;SACjD,CAAC,CAAC;aACF,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC3D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QAC7B,MAAM,GAAG,GACP,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,OAAO,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,QAAQ;YACvF,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,KAAK,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5D,IAAI,GAAG,EAAE,CAAC;YACR,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,GAAG,GAAG,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,WAAW,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+/**
+ * KAIROS CLI - Command-line interface for interacting with KAIROS REST API
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;GAEG"}

package/dist/cli/index.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+/**
+ * KAIROS CLI - Command-line interface for interacting with KAIROS REST API
+ */
+import { createProgram } from './program.js';
+// Parse arguments (async for commands that perform I/O before spawn, e.g. `serve`)
+await createProgram().parseAsync(process.argv);
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,mFAAmF;AACnF,MAAM,aAAa,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/cli/keyring.d.ts

@@ -0,0 +1,73 @@
+/**
+ * CLI keyring: OS-native credential storage for bearer tokens.
+ * Uses @napi-rs/keyring (keytar-compatible API). When keyring is unavailable or
+ * fails at runtime, the CLI falls back to the config file at XDG_CONFIG_HOME/squadrules
+ * (or ~/.config/squadrules on Unix, %APPDATA%\\squadrules on Windows) for all users.
+ *
+ * Migration: credentials stored under the prior service name (`kairos-cli`) are
+ * transparently copied to the new service name (`squadrules-cli`) on first read.
+ * Prior entries are never deleted during reads — only on explicit logout/delete.
+ */
+/** Primary keyring service name (post-rebrand). */
+export declare const KEYRING_SERVICE = "squadrules-cli";
+/** Prior keyring service name (pre-rebrand). Retained for fallback reads and cleanup on delete. */
+export declare const KEYRING_SERVICE_PRIOR = "kairos-cli";
+type KeytarModule = {
+    getPassword: (service: string, account: string) => Promise<string | null>;
+    setPassword: (service: string, account: string, password: string) => Promise<void>;
+    deletePassword: (service: string, account: string) => Promise<boolean>;
+};
+/**
+ * Race a keyring promise against a timeout. Returns the fallback on timeout instead of hanging.
+ * The timer is cleared once the race settles and is unref'd so it never keeps the CLI process
+ * alive on its own — otherwise a resolved keyring op would still block exit until the timer fires.
+ *
+ * Exported for unit testing of the no-leak contract; not part of the public keyring API.
+ */
+export declare function withKeyringTimeout<T>(promise: Promise<T>, fallback: T): Promise<T>;
+/**
+ * Whether the keyring backend is usable: the native module loaded AND it has not degraded (a prior
+ * operation did not time out). Returns false once degraded so callers fall back to the config file
+ * instead of stalling on every op.
+ */
+export declare function isKeyringAvailable(): boolean;
+/** The error captured when the native keyring binding failed to load, or null if it loaded. */
+export declare function getKeyringLoadError(): Error | null;
+/**
+ * Human-readable reason the keyring is unavailable, or null when it is usable. Distinguishes a
+ * missing/broken native binding from a keychain that loaded but stopped responding (timed out).
+ */
+export declare function getKeyringUnavailableReason(): string | null;
+/** Test-only: inject a fake keyring module (or null) and reset the degradation latch. */
+export declare function __setKeyringForTest(mod: KeytarModule | null, loadError?: Error | null): void;
+/**
+ * Get the stored bearer token for the given account (normalized API URL).
+ * Tries new service first, then the prior service with transparent copy-forward.
+ * Returns null if not found or keyring unavailable.
+ */
+export declare function getToken(account: string): Promise<string | null>;
+/**
+ * Store the bearer token for the given account in the new service.
+ * Returns true if stored in keyring, false if keyring unavailable or setPassword threw
+ * (config-file will fall back to file).
+ */
+export declare function setToken(account: string, token: string): Promise<boolean>;
+/**
+ * Delete the stored bearer token for the given account from BOTH the new and prior services.
+ * Returns true if deleted from new service (or not present), false if keyring unavailable.
+ */
+export declare function deleteToken(account: string): Promise<boolean>;
+/**
+ * Get the stored refresh token. Tries new service first, then the prior service with transparent copy-forward.
+ */
+export declare function getRefreshToken(account: string): Promise<string | null>;
+/**
+ * Store the refresh token in the new service.
+ */
+export declare function setRefreshToken(account: string, token: string): Promise<boolean>;
+/**
+ * Delete the refresh token from BOTH the new and prior services.
+ */
+export declare function deleteRefreshToken(account: string): Promise<boolean>;
+export {};
+//# sourceMappingURL=keyring.d.ts.map

package/dist/cli/keyring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring.d.ts","sourceRoot":"","sources":["../../src/cli/keyring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,mDAAmD;AACnD,eAAO,MAAM,eAAe,mBAAmB,CAAC;AAChD,mGAAmG;AACnG,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAoElD,KAAK,YAAY,GAAG;IAChB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1E,CAAC;AAKF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CASlF;AAwCD;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,IAAI,KAAK,GAAG,IAAI,CAGlD;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,IAAI,CAS3D;AAED,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,EAAE,SAAS,GAAE,KAAK,GAAG,IAAW,GAAG,IAAI,CAIlG;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQtE;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/E;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQnE;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ7E;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAStF;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ1E"}