@squadrules/mcp 4.8.6

package/dist/cli/keyring.js

@@ -0,0 +1,257 @@
+/**
+ * CLI keyring: OS-native credential storage for bearer tokens.
+ * Uses @napi-rs/keyring (keytar-compatible API). When keyring is unavailable or
+ * fails at runtime, the CLI falls back to the config file at XDG_CONFIG_HOME/squadrules
+ * (or ~/.config/squadrules on Unix, %APPDATA%\\squadrules on Windows) for all users.
+ *
+ * Migration: credentials stored under the prior service name (`kairos-cli`) are
+ * transparently copied to the new service name (`squadrules-cli`) on first read.
+ * Prior entries are never deleted during reads — only on explicit logout/delete.
+ */
+import { createRequire } from 'module';
+const requireMod = createRequire(import.meta.url);
+/** Primary keyring service name (post-rebrand). */
+export const KEYRING_SERVICE = 'squadrules-cli';
+/** Prior keyring service name (pre-rebrand). Retained for fallback reads and cleanup on delete. */
+export const KEYRING_SERVICE_PRIOR = 'kairos-cli';
+/** Distinct keyring account suffix for refresh tokens (normalized API URL + suffix). */
+const REFRESH_ACCOUNT_SUFFIX = '::refresh';
+function refreshAccount(account) {
+    return `${account}${REFRESH_ACCOUNT_SUFFIX}`;
+}
+/**
+ * Read from the new service; if absent, fall back to the prior service and copy forward.
+ * Returns the credential value or null. Never throws.
+ *
+ * The copy is best-effort: if writing to the new service fails (e.g. keyring
+ * locked), the value from the prior service is still returned so the user is not disrupted.
+ */
+async function readWithPriorFallback(mod, account) {
+    // 1. Try new service
+    const primary = await runKeyringOp(mod.getPassword(KEYRING_SERVICE, account));
+    if (primary !== KEYRING_TIMED_OUT && primary !== null)
+        return primary;
+    if (primary === KEYRING_TIMED_OUT)
+        return null;
+    // 2. Fallback to the prior service
+    const prior = await runKeyringOp(mod.getPassword(KEYRING_SERVICE_PRIOR, account));
+    if (prior === KEYRING_TIMED_OUT || prior === null)
+        return null;
+    // 3. Copy to new service (best-effort; never delete the prior entry here)
+    try {
+        await runKeyringOp(mod.setPassword(KEYRING_SERVICE, account, prior));
+        // Verify the write succeeded by reading back
+        const verify = await runKeyringOp(mod.getPassword(KEYRING_SERVICE, account));
+        if (verify === KEYRING_TIMED_OUT || verify !== prior) {
+            // Verification failed — still return the prior value, don't break the user
+        }
+    }
+    catch {
+        // Copy failed — still return the prior value
+    }
+    return prior;
+}
+/**
+ * Delete from both the new and prior services. Used on logout/cleanup.
+ * Returns true if the new-service deletion succeeded (or was absent).
+ */
+async function deleteFromBothServices(mod, account) {
+    let primaryOk = false;
+    try {
+        const r = await runKeyringOp(mod.deletePassword(KEYRING_SERVICE, account));
+        primaryOk = r !== KEYRING_TIMED_OUT;
+    }
+    catch {
+        primaryOk = false;
+    }
+    // Best-effort prior-service cleanup
+    try {
+        await runKeyringOp(mod.deletePassword(KEYRING_SERVICE_PRIOR, account));
+    }
+    catch {
+        // Prior-service deletion failure is non-fatal
+    }
+    return primaryOk;
+}
+/** Timeout for keyring operations. macOS Keychain can hang indefinitely if locked or unresponsive. */
+const KEYRING_TIMEOUT_MS = 10_000;
+/**
+ * Race a keyring promise against a timeout. Returns the fallback on timeout instead of hanging.
+ * The timer is cleared once the race settles and is unref'd so it never keeps the CLI process
+ * alive on its own — otherwise a resolved keyring op would still block exit until the timer fires.
+ *
+ * Exported for unit testing of the no-leak contract; not part of the public keyring API.
+ */
+export function withKeyringTimeout(promise, fallback) {
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(fallback), KEYRING_TIMEOUT_MS);
+        timer.unref?.();
+    });
+    return Promise.race([promise, timeout]).finally(() => {
+        if (timer)
+            clearTimeout(timer);
+    });
+}
+let keytar = undefined;
+/** Captured error from the last failed require of the native keyring binding (null if load succeeded). */
+let keyringLoadError = null;
+/**
+ * Degradation latch: set once any keyring operation times out. macOS Keychain can hang
+ * indefinitely with no answerable authorization prompt; without this latch every subsequent op
+ * would re-incur the full KEYRING_TIMEOUT_MS stall (readConfig runs several ops, and
+ * ApiClient.request calls readConfig multiple times — tens of seconds of hang). Once latched, ops
+ * short-circuit to the config-file fallback immediately.
+ */
+let keyringDegraded = false;
+/** Sentinel distinguishing a timed-out keyring op from a legitimate null/absent value. */
+const KEYRING_TIMED_OUT = Symbol('keyring-timed-out');
+function loadKeyring() {
+    if (keytar !== undefined)
+        return keytar;
+    try {
+        const mod = requireMod('@napi-rs/keyring/keytar');
+        keytar = mod;
+        return mod;
+    }
+    catch (err) {
+        keytar = null;
+        keyringLoadError = err instanceof Error ? err : new Error(String(err));
+        return null;
+    }
+}
+/**
+ * Run a keyring operation under the shared timeout. On timeout, latch degradation and return the
+ * sentinel so callers can distinguish "timed out" from a real result.
+ */
+async function runKeyringOp(op) {
+    const result = await withKeyringTimeout(op, KEYRING_TIMED_OUT);
+    if (result === KEYRING_TIMED_OUT)
+        keyringDegraded = true;
+    return result;
+}
+/**
+ * Whether the keyring backend is usable: the native module loaded AND it has not degraded (a prior
+ * operation did not time out). Returns false once degraded so callers fall back to the config file
+ * instead of stalling on every op.
+ */
+export function isKeyringAvailable() {
+    return loadKeyring() !== null && !keyringDegraded;
+}
+/** The error captured when the native keyring binding failed to load, or null if it loaded. */
+export function getKeyringLoadError() {
+    loadKeyring();
+    return keyringLoadError;
+}
+/**
+ * Human-readable reason the keyring is unavailable, or null when it is usable. Distinguishes a
+ * missing/broken native binding from a keychain that loaded but stopped responding (timed out).
+ */
+export function getKeyringUnavailableReason() {
+    if (loadKeyring() === null) {
+        const detail = keyringLoadError?.message ?? 'unknown error';
+        return `native keyring binding unavailable (${detail})`;
+    }
+    if (keyringDegraded) {
+        return `keychain did not respond (timed out after ${KEYRING_TIMEOUT_MS / 1000}s)`;
+    }
+    return null;
+}
+/** Test-only: inject a fake keyring module (or null) and reset the degradation latch. */
+export function __setKeyringForTest(mod, loadError = null) {
+    keytar = mod;
+    keyringLoadError = loadError;
+    keyringDegraded = false;
+}
+/**
+ * Get the stored bearer token for the given account (normalized API URL).
+ * Tries new service first, then the prior service with transparent copy-forward.
+ * Returns null if not found or keyring unavailable.
+ */
+export async function getToken(account) {
+    const mod = loadKeyring();
+    if (!mod || keyringDegraded)
+        return null;
+    try {
+        return await readWithPriorFallback(mod, account);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Store the bearer token for the given account in the new service.
+ * Returns true if stored in keyring, false if keyring unavailable or setPassword threw
+ * (config-file will fall back to file).
+ */
+export async function setToken(account, token) {
+    const mod = loadKeyring();
+    if (!mod || keyringDegraded)
+        return false;
+    try {
+        const result = await runKeyringOp(mod.setPassword(KEYRING_SERVICE, account, token));
+        return result !== KEYRING_TIMED_OUT;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Delete the stored bearer token for the given account from BOTH the new and prior services.
+ * Returns true if deleted from new service (or not present), false if keyring unavailable.
+ */
+export async function deleteToken(account) {
+    const mod = loadKeyring();
+    if (!mod || keyringDegraded)
+        return false;
+    try {
+        return await deleteFromBothServices(mod, account);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Get the stored refresh token. Tries new service first, then the prior service with transparent copy-forward.
+ */
+export async function getRefreshToken(account) {
+    const mod = loadKeyring();
+    if (!mod || keyringDegraded)
+        return null;
+    try {
+        return await readWithPriorFallback(mod, refreshAccount(account));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Store the refresh token in the new service.
+ */
+export async function setRefreshToken(account, token) {
+    const mod = loadKeyring();
+    if (!mod || keyringDegraded)
+        return false;
+    try {
+        const result = await runKeyringOp(mod.setPassword(KEYRING_SERVICE, refreshAccount(account), token));
+        return result !== KEYRING_TIMED_OUT;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Delete the refresh token from BOTH the new and prior services.
+ */
+export async function deleteRefreshToken(account) {
+    const mod = loadKeyring();
+    if (!mod || keyringDegraded)
+        return false;
+    try {
+        return await deleteFromBothServices(mod, refreshAccount(account));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=keyring.js.map

package/dist/cli/keyring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring.js","sourceRoot":"","sources":["../../src/cli/keyring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEvC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAElD,mDAAmD;AACnD,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAChD,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAElD,wFAAwF;AACxF,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAE3C,SAAS,cAAc,CAAC,OAAe;IACnC,OAAO,GAAG,OAAO,GAAG,sBAAsB,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,qBAAqB,CAChC,GAAiB,EACjB,OAAe;IAEf,qBAAqB;IACrB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,IAAI,OAAO,KAAK,iBAAiB,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACtE,IAAI,OAAO,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAE/C,mCAAmC;IACnC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/D,0EAA0E;IAC1E,IAAI,CAAC;QACD,MAAM,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,eAAe,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACrE,6CAA6C;QAC7C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,IAAI,MAAM,KAAK,iBAAiB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACnD,2EAA2E;QAC/E,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,6CAA6C;IACjD,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACjC,GAAiB,EACjB,OAAe;IAEf,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,SAAS,GAAG,CAAC,KAAK,iBAAiB,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACL,SAAS,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,oCAAoC;IACpC,IAAI,CAAC;QACD,MAAM,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACL,8CAA8C;IAClD,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAQD,sGAAsG;AACtG,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAI,OAAmB,EAAE,QAAW;IAClE,IAAI,KAAgD,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,EAAE;QACvC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAChE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACjD,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,IAAI,MAAM,GAAoC,SAAS,CAAC;AACxD,0GAA0G;AAC1G,IAAI,gBAAgB,GAAiB,IAAI,CAAC;AAC1C;;;;;;GAMG;AACH,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,0FAA0F;AAC1F,MAAM,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;AAEtD,SAAS,WAAW;IAChB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,UAAU,CAAC,yBAAyB,CAAiB,CAAC;QAClE,MAAM,GAAG,GAAG,CAAC;QACb,OAAO,GAAG,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,GAAG,IAAI,CAAC;QACd,gBAAgB,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAI,EAAc;IACzC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAA+B,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAC7F,IAAI,MAAM,KAAK,iBAAiB;QAAE,eAAe,GAAG,IAAI,CAAC;IACzD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAC9B,OAAO,WAAW,EAAE,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC;AACtD,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB;IAC/B,WAAW,EAAE,CAAC;IACd,OAAO,gBAAgB,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B;IACvC,IAAI,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,gBAAgB,EAAE,OAAO,IAAI,eAAe,CAAC;QAC5D,OAAO,uCAAuC,MAAM,GAAG,CAAC;IAC5D,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QAClB,OAAO,6CAA6C,kBAAkB,GAAG,IAAI,IAAI,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,mBAAmB,CAAC,GAAwB,EAAE,YAA0B,IAAI;IACxF,MAAM,GAAG,GAAG,CAAC;IACb,gBAAgB,GAAG,SAAS,CAAC;IAC7B,eAAe,GAAG,KAAK,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe;IAC1C,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACD,OAAO,MAAM,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,KAAa;IACzD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,eAAe;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,eAAe,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACpF,OAAO,MAAM,KAAK,iBAAiB,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe;IAC7C,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,eAAe;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACD,OAAO,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe;IACjD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACD,OAAO,MAAM,qBAAqB,CAAC,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,KAAa;IAChE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,eAAe;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,eAAe,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACpG,OAAO,MAAM,KAAK,iBAAiB,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe;IACpD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,eAAe;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACD,OAAO,MAAM,sBAAsB,CAAC,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC"}

package/dist/cli/oauth-refresh.d.ts

@@ -0,0 +1,32 @@
+/**
+ * OAuth refresh_token grant for CLI: discover token endpoint from
+ * /.well-known/oauth-protected-resource, then POST refresh_token + client_id.
+ */
+/** Hardcoded OIDC client_id for CLI (same as login command). */
+export declare const KAIROS_CLI_CLIENT_ID = "kairos-cli";
+export interface OAuthProtectedResourceMeta {
+    authorization_servers?: string[];
+    authorization_endpoint?: string;
+    token_endpoint?: string;
+}
+export interface OAuthEndpoints {
+    authEndpoint: string;
+    tokenEndpoint: string;
+}
+/**
+ * Fetch auth and token endpoints from the KAIROS well-known metadata.
+ * Shared by browser PKCE login and refresh_token grant.
+ */
+export declare function fetchOAuthProtectedResourceMetadata(baseUrl: string, fetchImpl?: typeof fetch): Promise<OAuthEndpoints | null>;
+export interface RefreshTokenResult {
+    access_token: string;
+    /** Present when the IdP rotates the refresh token. */
+    refresh_token?: string | undefined;
+}
+/**
+ * Exchange refresh_token for new tokens. Returns null on network/HTTP/body failure.
+ */
+export declare function refreshAccessToken(baseUrl: string, refreshToken: string, fetchImpl?: typeof fetch): Promise<RefreshTokenResult | null>;
+/** Seconds until JWT exp claim, or null if missing/unparseable. */
+export declare function jwtExpiresInSeconds(accessToken: string): number | null;
+//# sourceMappingURL=oauth-refresh.d.ts.map

package/dist/cli/oauth-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-refresh.d.ts","sourceRoot":"","sources":["../../src/cli/oauth-refresh.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,MAAM,WAAW,0BAA0B;IACvC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAsB,mCAAmC,CACrD,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,OAAO,KAAa,GAChC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAsBhC;AAED,MAAM,WAAW,kBAAkB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,SAAS,GAAE,OAAO,KAAa,GAChC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA8BpC;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWtE"}

package/dist/cli/oauth-refresh.js

@@ -0,0 +1,91 @@
+/**
+ * OAuth refresh_token grant for CLI: discover token endpoint from
+ * /.well-known/oauth-protected-resource, then POST refresh_token + client_id.
+ */
+import { tryNormalizeHttpUrlForFetch } from './safe-http-url.js';
+/** Hardcoded OIDC client_id for CLI (same as login command). */
+export const KAIROS_CLI_CLIENT_ID = 'kairos-cli';
+/**
+ * Fetch auth and token endpoints from the KAIROS well-known metadata.
+ * Shared by browser PKCE login and refresh_token grant.
+ */
+export async function fetchOAuthProtectedResourceMetadata(baseUrl, fetchImpl = fetch) {
+    const root = tryNormalizeHttpUrlForFetch(baseUrl);
+    if (!root)
+        return null;
+    const wellKnownUrl = `${root}/.well-known/oauth-protected-resource`;
+    // codeql[js/file-access-to-http]: outbound URL is derived from tryNormalizeHttpUrlForFetch(baseUrl), not raw config text.
+    const wkRes = await fetchImpl(wellKnownUrl);
+    if (!wkRes.ok)
+        return null;
+    const meta = (await wkRes.json());
+    const fromDirectAuth = tryNormalizeHttpUrlForFetch(meta.authorization_endpoint?.trim());
+    const fromDirectToken = tryNormalizeHttpUrlForFetch(meta.token_endpoint?.trim());
+    const server0 = meta.authorization_servers?.[0]?.trim();
+    const serverRoot = server0 ? tryNormalizeHttpUrlForFetch(server0.replace(/\/$/, '')) : null;
+    const authEndpoint = fromDirectAuth ||
+        (serverRoot ? `${serverRoot}/protocol/openid-connect/auth` : '');
+    const tokenEndpoint = fromDirectToken ||
+        (serverRoot ? `${serverRoot}/protocol/openid-connect/token` : '');
+    const authNorm = tryNormalizeHttpUrlForFetch(authEndpoint);
+    const tokenNorm = tryNormalizeHttpUrlForFetch(tokenEndpoint);
+    if (!authNorm || !tokenNorm)
+        return null;
+    return { authEndpoint: authNorm, tokenEndpoint: tokenNorm };
+}
+/**
+ * Exchange refresh_token for new tokens. Returns null on network/HTTP/body failure.
+ */
+export async function refreshAccessToken(baseUrl, refreshToken, fetchImpl = fetch) {
+    const endpoints = await fetchOAuthProtectedResourceMetadata(baseUrl, fetchImpl);
+    if (!endpoints)
+        return null;
+    const ac = new AbortController();
+    const timeout = setTimeout(() => ac.abort(), 30_000);
+    let tokenRes;
+    try {
+        tokenRes = await fetchImpl(endpoints.tokenEndpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'refresh_token',
+                refresh_token: refreshToken,
+                client_id: KAIROS_CLI_CLIENT_ID,
+            }),
+            signal: ac.signal,
+        });
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+    if (!tokenRes.ok)
+        return null;
+    const body = (await tokenRes.json());
+    if (!body.access_token)
+        return null;
+    const out = { access_token: body.access_token };
+    if (typeof body.refresh_token === 'string' && body.refresh_token.length > 0) {
+        out.refresh_token = body.refresh_token;
+    }
+    return out;
+}
+/** Seconds until JWT exp claim, or null if missing/unparseable. */
+export function jwtExpiresInSeconds(accessToken) {
+    try {
+        const parts = accessToken.split('.');
+        const payloadB64 = parts[1];
+        if (parts.length < 2 || payloadB64 === undefined)
+            return null;
+        const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf-8'));
+        if (typeof payload.exp !== 'number')
+            return null;
+        return payload.exp - Math.floor(Date.now() / 1000);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=oauth-refresh.js.map

package/dist/cli/oauth-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-refresh.js","sourceRoot":"","sources":["../../src/cli/oauth-refresh.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,gEAAgE;AAChE,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAajD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACrD,OAAe,EACf,YAA0B,KAAK;IAE/B,MAAM,IAAI,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,YAAY,GAAG,GAAG,IAAI,uCAAuC,CAAC;IACpE,0HAA0H;IAC1H,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAA+B,CAAC;IAChE,MAAM,cAAc,GAAG,2BAA2B,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,MAAM,eAAe,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,MAAM,YAAY,GACd,cAAc;QACd,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,+BAA+B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrE,MAAM,aAAa,GACf,eAAe;QACf,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,gCAAgC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AAChE,CAAC;AAQD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,OAAe,EACf,YAAoB,EACpB,YAA0B,KAAK;IAE/B,MAAM,SAAS,GAAG,MAAM,mCAAmC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAChF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACD,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,aAAa,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACtB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,oBAAoB;aAClC,CAAC;YACF,MAAM,EAAE,EAAE,CAAC,MAAM;SACpB,CAAC,CAAC;IACP,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;YAAS,CAAC;QACP,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsD,CAAC;IAC1F,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAuB,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACpE,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACnD,IAAI,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB,CAAC;QACvG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjD,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC"}

package/dist/cli/output.d.ts

@@ -0,0 +1,10 @@
+/**
+ * CLI Output Utility
+ * Uses process.stdout/stderr directly to avoid console.* linting restrictions
+ */
+export declare function writeStdout(message: string): void;
+export declare function writeStderr(message: string): void;
+export declare function writeError(message: string): void;
+export declare function writeJson(data: any): void;
+export declare function writeMarkdown(content: string): void;
+//# sourceMappingURL=output.d.ts.map

package/dist/cli/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/cli/output.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAKjD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEjD;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEhD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,CAEzC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEnD"}

package/dist/cli/output.js

@@ -0,0 +1,23 @@
+/**
+ * CLI Output Utility
+ * Uses process.stdout/stderr directly to avoid console.* linting restrictions
+ */
+export function writeStdout(message) {
+    const line = message + '\n';
+    if (!process.stdout.write(line)) {
+        process.stdout.once('drain', () => { });
+    }
+}
+export function writeStderr(message) {
+    process.stderr.write(message + '\n');
+}
+export function writeError(message) {
+    writeStderr(`Error: ${message}`);
+}
+export function writeJson(data) {
+    writeStdout(JSON.stringify(data, null, 2));
+}
+export function writeMarkdown(content) {
+    writeStdout(content);
+}
+//# sourceMappingURL=output.js.map

package/dist/cli/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/cli/output.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,UAAU,WAAW,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,OAAO,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3C,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe;IACtC,WAAW,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAS;IAC/B,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IACzC,WAAW,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC"}

package/dist/cli/program.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function createProgram(): Command;
+//# sourceMappingURL=program.d.ts.map

package/dist/cli/program.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../../src/cli/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6BpC,wBAAgB,aAAa,IAAI,OAAO,CA0CvC"}

package/dist/cli/program.js

@@ -0,0 +1,64 @@
+import { Command } from 'commander';
+import { createRequire } from 'module';
+import { activateCommand } from './commands/search.js';
+import { forwardCommand } from './commands/begin.js';
+import { trainCliCommand } from './commands/cli-train.js';
+import { spacesCommand } from './commands/spaces.js';
+import { updateCommand } from './commands/update.js';
+import { deleteCommand } from './commands/delete.js';
+import { rewardCommand } from './commands/attest.js';
+import { exportCommand } from './commands/export.js';
+import { loginCommand } from './commands/login.js';
+import { logoutCommand } from './commands/logout.js';
+import { tokenCommand } from './commands/token.js';
+import { serveCommand } from './commands/serve.js';
+import { getCliApiUrlDefault } from './config.js';
+const loadPackageJson = createRequire(import.meta.url);
+const { version } = loadPackageJson('../../package.json');
+function enableHelpAfterError(command) {
+    command.showHelpAfterError();
+    command.showSuggestionAfterError();
+    for (const subcommand of command.commands) {
+        enableHelpAfterError(subcommand);
+    }
+}
+export function createProgram() {
+    const program = new Command();
+    program
+        .name('squadrules')
+        .description('CLI tool for interacting with SquadRules REST API')
+        .version(version)
+        .option('-u, --url <url>', 'SquadRules API base URL', getCliApiUrlDefault())
+        .option('--timeout <seconds>', 'request timeout in seconds (env: KAIROS_TIMEOUT_MS, default: 15)')
+        .option('--retries <n>', 'max retries on network errors (env: KAIROS_RETRIES, default: 2)')
+        .option('--no-browser', 'do not open browser when auth is required (e.g. in tests or scripts)')
+        .hook('preAction', (_thisCommand, actionCommand) => {
+        // optsWithGlobals merges root --url / --no-browser for nested commands (e.g. squadrules --url … train …).
+        if (actionCommand.name() === 'serve') {
+            return;
+        }
+        const opts = actionCommand.optsWithGlobals();
+        if (opts.url) {
+            process.env['KAIROS_API_URL'] = opts.url;
+        }
+        if (opts.browser === false) {
+            process.env['KAIROS_NO_BROWSER'] = '1';
+        }
+    });
+    // Register commands for the current MCP tool surface.
+    activateCommand(program); // activate
+    forwardCommand(program); // forward
+    trainCliCommand(program);
+    spacesCommand(program);
+    updateCommand(program); // tune
+    deleteCommand(program); // delete
+    rewardCommand(program); // reward
+    exportCommand(program); // export
+    serveCommand(program);
+    loginCommand(program);
+    logoutCommand(program);
+    tokenCommand(program);
+    enableHelpAfterError(program);
+    return program;
+}
+//# sourceMappingURL=program.js.map

package/dist/cli/program.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"program.js","sourceRoot":"","sources":["../../src/cli/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGlD,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvD,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,oBAAoB,CAAwB,CAAC;AAEjF,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAC7B,OAAO,CAAC,wBAAwB,EAAE,CAAC;IAEnC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1C,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,YAAY,CAAC;SAClB,WAAW,CAAC,mDAAmD,CAAC;SAChE,OAAO,CAAC,OAAO,CAAC;SAChB,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,CAAC;SAC3E,MAAM,CAAC,qBAAqB,EAAE,kEAAkE,CAAC;SACjG,MAAM,CAAC,eAAe,EAAE,iEAAiE,CAAC;SAC1F,MAAM,CAAC,cAAc,EAAE,sEAAsE,CAAC;SAC9F,IAAI,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,aAAa,EAAE,EAAE;QACjD,0GAA0G;QAC1G,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,eAAe,EAAyC,CAAC;QACpF,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;QAC3C,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,GAAG,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,sDAAsD;IACtD,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;IACrC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;IACnC,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;IAC/B,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;IACjC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;IACjC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;IACjC,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,YAAY,CAAC,OAAO,CAAC,CAAC;IAEtB,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE9B,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cli/resolve-api-base.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Resolve the effective KAIROS API base URL from the root program after Commander parse.
+ * Global --url is merged into optsWithGlobals for subcommands.
+ */
+import type { Command } from 'commander';
+export declare function getResolvedApiBaseFromProgram(program: Command): string;
+//# sourceMappingURL=resolve-api-base.d.ts.map

package/dist/cli/resolve-api-base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-api-base.d.ts","sourceRoot":"","sources":["../../src/cli/resolve-api-base.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAOtE"}

package/dist/cli/resolve-api-base.js

@@ -0,0 +1,14 @@
+/**
+ * Resolve the effective KAIROS API base URL from the root program after Commander parse.
+ * Global --url is merged into optsWithGlobals for subcommands.
+ */
+import { normalizeAndValidateApiBaseUrl } from './upload-guards.js';
+export function getResolvedApiBaseFromProgram(program) {
+    const g = program.optsWithGlobals?.() ?? program.opts();
+    const raw = typeof g['url'] === 'string' ? g['url'].trim() : '';
+    if (!raw) {
+        throw new Error('KAIROS API base URL is missing');
+    }
+    return normalizeAndValidateApiBaseUrl(raw);
+}
+//# sourceMappingURL=resolve-api-base.js.map

package/dist/cli/resolve-api-base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-api-base.js","sourceRoot":"","sources":["../../src/cli/resolve-api-base.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEpE,MAAM,UAAU,6BAA6B,CAAC,OAAgB;IAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,eAAe,EAAE,EAAE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,8BAA8B,CAAC,GAAG,CAAC,CAAC;AAC/C,CAAC"}

package/dist/cli/rewrite-login-url.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Rewrites OIDC login URLs from the API so redirect_uri matches the CLI's API base (--url).
+ * The server builds redirect_uri from AUTH_CALLBACK_BASE_URL; when that differs from the host
+ * the CLI targets, the browser flow would land on the wrong origin after Keycloak redirects.
+ */
+export declare function rewriteLoginUrlRedirectToApiBase(loginUrl: string, apiBaseUrl: string): string;
+//# sourceMappingURL=rewrite-login-url.d.ts.map

package/dist/cli/rewrite-login-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewrite-login-url.d.ts","sourceRoot":"","sources":["../../src/cli/rewrite-login-url.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAyB7F"}

package/dist/cli/rewrite-login-url.js

@@ -0,0 +1,34 @@
+/**
+ * Rewrites OIDC login URLs from the API so redirect_uri matches the CLI's API base (--url).
+ * The server builds redirect_uri from AUTH_CALLBACK_BASE_URL; when that differs from the host
+ * the CLI targets, the browser flow would land on the wrong origin after Keycloak redirects.
+ */
+export function rewriteLoginUrlRedirectToApiBase(loginUrl, apiBaseUrl) {
+    let parsed;
+    try {
+        parsed = new URL(loginUrl);
+    }
+    catch {
+        return loginUrl;
+    }
+    const redirect = parsed.searchParams.get('redirect_uri');
+    if (!redirect) {
+        return loginUrl;
+    }
+    let redirectParsed;
+    try {
+        redirectParsed = new URL(redirect);
+    }
+    catch {
+        return loginUrl;
+    }
+    const path = redirectParsed.pathname.replace(/\/$/, '') || '/';
+    if (!path.endsWith('/auth/callback')) {
+        return loginUrl;
+    }
+    const base = apiBaseUrl.replace(/\/$/, '');
+    const next = new URL(loginUrl);
+    next.searchParams.set('redirect_uri', `${base}/auth/callback`);
+    return next.toString();
+}
+//# sourceMappingURL=rewrite-login-url.js.map

package/dist/cli/rewrite-login-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewrite-login-url.js","sourceRoot":"","sources":["../../src/cli/rewrite-login-url.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,UAAU,gCAAgC,CAAC,QAAgB,EAAE,UAAkB;IACjF,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,IAAI,cAAmB,CAAC;IACxB,IAAI,CAAC;QACD,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,IAAI,gBAAgB,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC"}

package/dist/cli/safe-http-url.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Restrict outbound CLI URLs to http(s) without embedded credentials, query, or fragment.
+ * Used before fetch() for API base and IdP endpoints from metadata.
+ * (Unlike normalizeAndValidateApiBaseUrl in upload-guards.ts, this does not apply TRUSTED_API_HOSTS.)
+ */
+/** @returns Normalized absolute URL string (no trailing slash), or null if invalid. */
+export declare function tryNormalizeHttpUrlForFetch(raw: string | undefined | null): string | null;
+//# sourceMappingURL=safe-http-url.d.ts.map

package/dist/cli/safe-http-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-http-url.d.ts","sourceRoot":"","sources":["../../src/cli/safe-http-url.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,uFAAuF;AACvF,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAczF"}