@true-and-useful/janee 0.8.4 → 0.9.0

package/dist/core/agent-scope.js

@@ -0,0 +1,146 @@
+"use strict";
+/**
+ * Agent-scoped credential management for Janee
+ *
+ * When an agent creates a credential via MCP, it is automatically scoped
+ * to that agent. Other agents cannot access it unless the owner (or an admin)
+ * explicitly grants access.
+ *
+ * Access policies:
+ * - "agent-only": Only the creating agent can access (default for agent-created creds)
+ * - "all-agents": Any agent can access (default for CLI-created creds)
+ * - "shared": Specific agents listed in `sharedWith` can access
+ *
+ * ## Trust Model
+ *
+ * Agent identity is resolved from the MCP transport session rather than
+ * client-asserted tool arguments, when available. The resolution order is:
+ *
+ * 1. **Transport-bound identity** (preferred): The MCP session metadata
+ *    (e.g., client certificate, OAuth token subject, or HTTP auth header)
+ *    provides a verified agentId. This cannot be spoofed.
+ *
+ * 2. **Client-asserted identity** (fallback): If the transport doesn't carry
+ *    identity, the agent can self-report via the `agentId` tool argument.
+ *    This is useful for development/testing but should NOT be trusted in
+ *    production multi-agent environments.
+ *
+ * The `resolveAgentIdentity()` function implements this resolution order.
+ * Callers should always use it instead of reading `args.agentId` directly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveAgentIdentity = resolveAgentIdentity;
+exports.cliCreatedOwnership = cliCreatedOwnership;
+exports.agentCreatedOwnership = agentCreatedOwnership;
+exports.canAgentAccess = canAgentAccess;
+exports.grantAccess = grantAccess;
+exports.revokeAccess = revokeAccess;
+/**
+ * Resolve agent identity from transport session + fallback to client assertion.
+ *
+ * In production, transport-bound identity (from session metadata) takes precedence
+ * over the client-asserted agentId argument. This prevents spoofing.
+ *
+ * @param session - MCP session object (may contain transport-bound identity)
+ * @param assertedAgentId - Client-asserted agentId from tool arguments (untrusted)
+ * @returns Resolved agent ID, or undefined if no identity available
+ */
+function resolveAgentIdentity(session, assertedAgentId) {
+    // Priority 1: Transport-bound identity from session metadata
+    // (set by authenticated MCP transports — OAuth, mTLS, signed tokens)
+    if (session?.metadata?.verifiedAgentId) {
+        return session.metadata.verifiedAgentId;
+    }
+    // Priority 2: Session-level agentId (set during session creation)
+    if (session?.agentId) {
+        return session.agentId;
+    }
+    // Priority 3 (fallback): Client-asserted identity from tool arguments.
+    // WARNING: This is spoofable. Only use in single-agent or dev environments.
+    return assertedAgentId;
+}
+/**
+ * Default ownership for credentials created via CLI (human admin)
+ */
+function cliCreatedOwnership() {
+    return {
+        accessPolicy: 'all-agents',
+        createdAt: new Date().toISOString()
+    };
+}
+/**
+ * Default ownership for credentials created by an agent via MCP
+ */
+function agentCreatedOwnership(agentId) {
+    return {
+        createdBy: agentId,
+        accessPolicy: 'agent-only',
+        createdAt: new Date().toISOString()
+    };
+}
+/**
+ * Check whether an agent is allowed to access a credential
+ *
+ * Rules:
+ * 1. If no ownership metadata exists, allow access (backward compat)
+ * 2. "all-agents" policy: always allow
+ * 3. "agent-only" policy: only the creator
+ * 4. "shared" policy: creator + listed agents
+ */
+function canAgentAccess(agentId, ownership) {
+    // No ownership metadata = legacy credential, allow all
+    if (!ownership)
+        return true;
+    // All-agents policy = unrestricted
+    if (ownership.accessPolicy === 'all-agents')
+        return true;
+    // Agent must identify themselves for restricted policies
+    if (!agentId)
+        return false;
+    // Agent-only: must be the creator
+    if (ownership.accessPolicy === 'agent-only') {
+        return ownership.createdBy === agentId;
+    }
+    // Shared: creator or in the shared list
+    if (ownership.accessPolicy === 'shared') {
+        if (ownership.createdBy === agentId)
+            return true;
+        return ownership.sharedWith?.includes(agentId) ?? false;
+    }
+    return false;
+}
+/**
+ * Grant access to another agent (changes policy to "shared" if needed)
+ */
+function grantAccess(ownership, targetAgentId) {
+    const updated = { ...ownership };
+    if (updated.accessPolicy === 'agent-only') {
+        updated.accessPolicy = 'shared';
+        updated.sharedWith = [targetAgentId];
+    }
+    else if (updated.accessPolicy === 'shared') {
+        if (!updated.sharedWith)
+            updated.sharedWith = [];
+        if (!updated.sharedWith.includes(targetAgentId)) {
+            updated.sharedWith.push(targetAgentId);
+        }
+    }
+    // "all-agents" doesn't need grants
+    return updated;
+}
+/**
+ * Revoke access from an agent
+ */
+function revokeAccess(ownership, targetAgentId) {
+    const updated = { ...ownership };
+    if (updated.accessPolicy === 'shared' && updated.sharedWith) {
+        updated.sharedWith = updated.sharedWith.filter(id => id !== targetAgentId);
+        // If no one is shared with, revert to agent-only
+        if (updated.sharedWith.length === 0) {
+            updated.accessPolicy = 'agent-only';
+            delete updated.sharedWith;
+        }
+    }
+    return updated;
+}
+//# sourceMappingURL=agent-scope.js.map

package/dist/core/agent-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-scope.js","sourceRoot":"","sources":["../../src/core/agent-scope.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;AAyBH,oDAkBC;AAKD,kDAKC;AAKD,sDAMC;AAWD,wCAyBC;AAKD,kCAkBC;AAKD,oCAgBC;AAjID;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAClC,OAA6E,EAC7E,eAAwB;IAExB,6DAA6D;IAC7D,qEAAqE;IACrE,IAAI,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,QAAQ,CAAC,eAAyB,CAAC;IACpD,CAAC;IAED,kEAAkE;IAClE,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,CAAC;IACzB,CAAC;IAED,uEAAuE;IACvE,4EAA4E;IAC5E,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB;IACjC,OAAO;QACL,YAAY,EAAE,YAAY;QAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,OAAe;IACnD,OAAO;QACL,SAAS,EAAE,OAAO;QAClB,YAAY,EAAE,YAAY;QAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,cAAc,CAC5B,OAA2B,EAC3B,SAA0C;IAE1C,uDAAuD;IACvD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,mCAAmC;IACnC,IAAI,SAAS,CAAC,YAAY,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAEzD,yDAAyD;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,kCAAkC;IAClC,IAAI,SAAS,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC;IACzC,CAAC;IAED,wCAAwC;IACxC,IAAI,SAAS,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,SAAS,CAAC,SAAS,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACjD,OAAO,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;IAC1D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CACzB,SAA8B,EAC9B,aAAqB;IAErB,MAAM,OAAO,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;IAEjC,IAAI,OAAO,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;QAC1C,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC;QAChC,OAAO,CAAC,UAAU,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,UAAU;YAAE,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,mCAAmC;IAEnC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAC1B,SAA8B,EAC9B,aAAqB;IAErB,MAAM,OAAO,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;IAEjC,IAAI,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5D,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC;QAC3E,iDAAiD;QACjD,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC;YACpC,OAAO,OAAO,CAAC,UAAU,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/core/directory.d.ts

@@ -8,7 +8,7 @@ export interface ServiceTemplate {
     description: string;
     baseUrl: string;
     auth: {
-        type: 'bearer' | 'basic' | 'hmac-mexc' | 'hmac-bybit' | 'hmac-okx' | 'headers' | 'service-account';
+        type: 'bearer' | 'basic' | 'hmac-mexc' | 'hmac-bybit' | 'hmac-okx' | 'headers' | 'service-account' | 'github-app';
         fields: string[];
     };
     docs?: string;

package/dist/core/directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"directory.d.ts","sourceRoot":"","sources":["../../src/core/directory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,iBAAiB,CAAC;QACnG,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAQD;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,eAAe,EAwN7C,CAAC;AAEF;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,EAAE,CAYhE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAEpE;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAY/D"}
+{"version":3,"file":"directory.d.ts","sourceRoot":"","sources":["../../src/core/directory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,iBAAiB,GAAG,YAAY,CAAC;QAClH,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAQD;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,eAAe,EAgO7C,CAAC;AAEF;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,EAAE,CAYhE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAEpE;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAY/D"}

package/dist/core/directory.js

@@ -36,6 +36,14 @@ exports.serviceDirectory = [
         docs: 'https://docs.github.com/en/rest',
         tags: ['developer', 'git', 'code']
     },
+    {
+        name: 'github-app',
+        description: 'GitHub App with installation tokens (for autonomous agents)',
+        baseUrl: 'https://api.github.com',
+        auth: { type: 'github-app', fields: ['appId', 'pemFile', 'installationId'] },
+        docs: 'https://docs.github.com/en/apps',
+        tags: ['developer', 'git', 'code']
+    },
     {
         name: 'linear',
         description: 'Issue tracking for software teams',

package/dist/core/directory.js.map

@@ -1 +1 @@
-{"version":3,"file":"directory.js","sourceRoot":"","sources":["../../src/core/directory.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAoPH,0CAYC;AAKD,gCAEC;AAKD,wCAYC;AA1QD,mBAAmB;AACnB,sFAAsF;AACtF,6DAA6D;AAC7D,wEAAwE;AACxE,mGAAmG;AAEnG;;GAEG;AACU,QAAA,gBAAgB,GAAsB;IACjD,UAAU;IACV;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,6BAA6B;QACnC,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;KAC7B;IAED,kBAAkB;IAClB;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,gCAAgC;QAC7C,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,iCAAiC;QACvC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC;KACnC;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,mCAAmC;QAChD,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,oCAAoC;QAC1C,IAAI,EAAE,CAAC,WAAW,EAAE,oBAAoB,EAAE,QAAQ,CAAC;KACpD;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,kCAAkC;QACxC,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,sCAAsC;QAC/C,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,uCAAuC;QAC7C,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC;KAClC;IAED,QAAQ;IACR;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,+BAA+B;QAC5C,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,gDAAgD;QACtD,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC;KAC1B;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,sBAAsB;QACnC,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;QAChD,IAAI,EAAE,mCAAmC;QACzC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC;KAC1B;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE,8BAA8B;QACvC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,2CAA2C;QACjD,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;KAC7B;IAED,mBAAmB;IACnB;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE;QAC7D,IAAI,EAAE,uCAAuC;QAC7C,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;KACxC;IACD;QACE,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE;QACzE,IAAI,EAAE,6BAA6B;QACnC,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;KACxC;IACD;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,sBAAsB;QAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE;QAC5D,IAAI,EAAE,uCAAuC;QAC7C,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;KACxC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,0BAA0B;QACnC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,oDAAoD;QAC1D,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;KACxC;IAED,gBAAgB;IAChB;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,+BAA+B;QACrC,IAAI,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,MAAM,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,+BAA+B;QAC5C,OAAO,EAAE,6BAA6B;QACtC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,qCAAqC;QAC3C,IAAI,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,WAAW,CAAC;KAClD;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,wBAAwB;QACrC,OAAO,EAAE,6BAA6B;QACtC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,yCAAyC;QAC/C,IAAI,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC;KACjC;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,mCAAmC;QAC5C,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE;QAC5D,IAAI,EAAE,uCAAuC;QAC7C,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC;KACxC;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,kBAAkB;QAC/B,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,uCAAuC;QAC7C,IAAI,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC;KACjC;IAED,mBAAmB;IACnB;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,sCAAsC;QAC/C,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,iBAAiB,EAAE,OAAO,CAAC,EAAE;QACvE,IAAI,EAAE,qEAAqE;QAC3E,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC;KACtC;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE,6BAA6B;QACtC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,8BAA8B;QACpC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;KAC5B;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,mBAAmB;QAChC,OAAO,EAAE,8BAA8B;QACvC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE;QACzD,IAAI,EAAE,0CAA0C;QAChD,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;KAC5B;IAED,qBAAqB;IACrB;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,uCAAuC;QAChD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,qCAAqC;QAC3C,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC;KACtC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,gCAAgC;QACzC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,kCAAkC;QACxC,IAAI,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;KAC5B;IAED,QAAQ;IACR;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,sBAAsB;QACnC,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,yCAAyC;QAC/C,IAAI,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC;KACxC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,6BAA6B;QACtC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,yCAAyC;QAC/C,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,cAAc,CAAC;KAClD;IACD;QACE,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,wBAAwB;QACrC,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,8CAA8C;QACpD,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;KACjC;CACF,CAAC;AAEF;;GAEG;AACH,SAAgB,eAAe,CAAC,KAAa;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAE9B,OAAO,wBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QACvC,aAAa;QACb,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,oBAAoB;QACpB,IAAI,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,aAAa;QACb,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,IAAY;IACrC,OAAO,wBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc;IAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IAExD,KAAK,MAAM,OAAO,IAAI,wBAAgB,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"directory.js","sourceRoot":"","sources":["../../src/core/directory.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AA4PH,0CAYC;AAKD,gCAEC;AAKD,wCAYC;AAlRD,mBAAmB;AACnB,sFAAsF;AACtF,6DAA6D;AAC7D,wEAAwE;AACxE,mGAAmG;AAEnG;;GAEG;AACU,QAAA,gBAAgB,GAAsB;IACjD,UAAU;IACV;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,6BAA6B;QACnC,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;KAC7B;IAED,kBAAkB;IAClB;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,gCAAgC;QAC7C,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,iCAAiC;QACvC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC;KACnC;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAC,EAAE;QAC5E,IAAI,EAAE,iCAAiC;QACvC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC;KACnC;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,mCAAmC;QAChD,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,oCAAoC;QAC1C,IAAI,EAAE,CAAC,WAAW,EAAE,oBAAoB,EAAE,QAAQ,CAAC;KACpD;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,kCAAkC;QACxC,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,sCAAsC;QAC/C,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,uCAAuC;QAC7C,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC;KAClC;IAED,QAAQ;IACR;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,+BAA+B;QAC5C,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,gDAAgD;QACtD,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC;KAC1B;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,sBAAsB;QACnC,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;QAChD,IAAI,EAAE,mCAAmC;QACzC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC;KAC1B;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE,8BAA8B;QACvC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,2CAA2C;QACjD,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;KAC7B;IAED,mBAAmB;IACnB;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE;QAC7D,IAAI,EAAE,uCAAuC;QAC7C,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;KACxC;IACD;QACE,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE;QACzE,IAAI,EAAE,6BAA6B;QACnC,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;KACxC;IACD;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,sBAAsB;QAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE;QAC5D,IAAI,EAAE,uCAAuC;QAC7C,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;KACxC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,0BAA0B;QACnC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,oDAAoD;QAC1D,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;KACxC;IAED,gBAAgB;IAChB;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,+BAA+B;QACrC,IAAI,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,MAAM,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,+BAA+B;QAC5C,OAAO,EAAE,6BAA6B;QACtC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,qCAAqC;QAC3C,IAAI,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,WAAW,CAAC;KAClD;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,wBAAwB;QACrC,OAAO,EAAE,6BAA6B;QACtC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,yCAAyC;QAC/C,IAAI,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC;KACjC;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,mCAAmC;QAC5C,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE;QAC5D,IAAI,EAAE,uCAAuC;QAC7C,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC;KACxC;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,kBAAkB;QAC/B,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,uCAAuC;QAC7C,IAAI,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC;KACjC;IAED,mBAAmB;IACnB;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,sCAAsC;QAC/C,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,iBAAiB,EAAE,OAAO,CAAC,EAAE;QACvE,IAAI,EAAE,qEAAqE;QAC3E,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC;KACtC;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE,6BAA6B;QACtC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,8BAA8B;QACpC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;KAC5B;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,mBAAmB;QAChC,OAAO,EAAE,8BAA8B;QACvC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE;QACzD,IAAI,EAAE,0CAA0C;QAChD,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;KAC5B;IAED,qBAAqB;IACrB;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,uCAAuC;QAChD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,qCAAqC;QAC3C,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC;KACtC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,gCAAgC;QACzC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,kCAAkC;QACxC,IAAI,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;KAC5B;IAED,QAAQ;IACR;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,sBAAsB;QACnC,OAAO,EAAE,2BAA2B;QACpC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,yCAAyC;QAC/C,IAAI,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC;KACxC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,6BAA6B;QACtC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,yCAAyC;QAC/C,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,cAAc,CAAC;KAClD;IACD;QACE,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,wBAAwB;QACrC,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,EAAE,8CAA8C;QACpD,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;KACjC;CACF,CAAC;AAEF;;GAEG;AACH,SAAgB,eAAe,CAAC,KAAa;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAE9B,OAAO,wBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QACvC,aAAa;QACb,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,oBAAoB;QACpB,IAAI,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,aAAa;QACb,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,IAAY;IACrC,OAAO,wBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc;IAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IAExD,KAAK,MAAM,OAAO,IAAI,wBAAgB,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/core/exec.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Secure CLI Execution for Janee (RFC 0001)
+ *
+ * Executes CLI commands with credentials injected via environment variables.
+ * The agent specifies the command to run but never sees the actual credential.
+ * Janee's core security property is preserved: agent never sees the key.
+ */
+export interface ExecCapability {
+    service: string;
+    mode: 'exec';
+    allowCommands: string[];
+    env: Record<string, string>;
+    workDir?: string;
+    ttl: string;
+    autoApprove?: boolean;
+    requiresReason?: boolean;
+    timeout?: number;
+}
+export interface ExecRequest {
+    capability: string;
+    command: string[];
+    stdin?: string;
+}
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    executionTimeMs: number;
+}
+export interface ExecAuditEvent {
+    id: string;
+    timestamp: string;
+    type: 'cli_execution';
+    service: string;
+    capability: string;
+    command: string[];
+    exitCode: number;
+    executionTimeMs: number;
+    stdout: string;
+    stderr: string;
+    denied?: boolean;
+    denyReason?: string;
+    reason?: string;
+}
+/**
+ * Validate that a command is allowed by the capability's whitelist
+ */
+export declare function validateCommand(command: string[], allowCommands: string[]): {
+    allowed: boolean;
+    reason?: string;
+};
+/**
+ * Build environment variables for command execution.
+ * Replaces {{credential}} placeholders with the actual secret.
+ * Replaces {{apiKey}} and {{apiSecret}} for HMAC-style auth.
+ */
+export declare function buildExecEnv(envTemplate: Record<string, string>, credential: string, extraCredentials?: {
+    apiKey?: string;
+    apiSecret?: string;
+    passphrase?: string;
+}): Record<string, string>;
+/**
+ * Scrub credential values from output strings.
+ * Prevents accidental credential leakage in stdout/stderr.
+ */
+export declare function scrubCredentials(output: string, credential: string, extraCredentials?: {
+    apiKey?: string;
+    apiSecret?: string;
+    passphrase?: string;
+}): string;
+/**
+ * Execute a CLI command with injected credentials.
+ * Returns stdout/stderr/exitCode without exposing the credential.
+ */
+export declare function executeCommand(command: string[], injectedEnv: Record<string, string>, options: {
+    workDir?: string;
+    timeout?: number;
+    stdin?: string;
+    credential: string;
+    extraCredentials?: {
+        apiKey?: string;
+        apiSecret?: string;
+        passphrase?: string;
+    };
+}): Promise<ExecResult>;
+//# sourceMappingURL=exec.d.ts.map

package/dist/core/exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/core/exec.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA0BvC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,UAAU,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9E,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBxB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9E,MAAM,CAmBR;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EAAE,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,OAAO,EAAE;IACP,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF,GACA,OAAO,CAAC,UAAU,CAAC,CAuErB"}

package/dist/core/exec.js

@@ -0,0 +1,149 @@
+"use strict";
+/**
+ * Secure CLI Execution for Janee (RFC 0001)
+ *
+ * Executes CLI commands with credentials injected via environment variables.
+ * The agent specifies the command to run but never sees the actual credential.
+ * Janee's core security property is preserved: agent never sees the key.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateCommand = validateCommand;
+exports.buildExecEnv = buildExecEnv;
+exports.scrubCredentials = scrubCredentials;
+exports.executeCommand = executeCommand;
+const child_process_1 = require("child_process");
+const path_1 = __importDefault(require("path"));
+/**
+ * Validate that a command is allowed by the capability's whitelist
+ */
+function validateCommand(command, allowCommands) {
+    if (!command || command.length === 0) {
+        return { allowed: false, reason: 'Empty command' };
+    }
+    const executable = path_1.default.basename(command[0]);
+    if (!allowCommands.includes(executable)) {
+        return {
+            allowed: false,
+            reason: `Command '${executable}' not allowed by capability. Allowed: ${allowCommands.join(', ')}`
+        };
+    }
+    // Check for shell injection patterns in arguments
+    const shellMetachars = /[;&|`$(){}\\<>]/;
+    for (let i = 1; i < command.length; i++) {
+        if (shellMetachars.test(command[i])) {
+            return {
+                allowed: false,
+                reason: `Argument ${i} contains shell metacharacters. Use structured arguments instead of shell syntax.`
+            };
+        }
+    }
+    return { allowed: true };
+}
+/**
+ * Build environment variables for command execution.
+ * Replaces {{credential}} placeholders with the actual secret.
+ * Replaces {{apiKey}} and {{apiSecret}} for HMAC-style auth.
+ */
+function buildExecEnv(envTemplate, credential, extraCredentials) {
+    const env = {};
+    for (const [key, value] of Object.entries(envTemplate)) {
+        let resolved = value;
+        resolved = resolved.replace(/{{credential}}/g, credential);
+        if (extraCredentials?.apiKey) {
+            resolved = resolved.replace(/{{apiKey}}/g, extraCredentials.apiKey);
+        }
+        if (extraCredentials?.apiSecret) {
+            resolved = resolved.replace(/{{apiSecret}}/g, extraCredentials.apiSecret);
+        }
+        if (extraCredentials?.passphrase) {
+            resolved = resolved.replace(/{{passphrase}}/g, extraCredentials.passphrase);
+        }
+        env[key] = resolved;
+    }
+    return env;
+}
+/**
+ * Scrub credential values from output strings.
+ * Prevents accidental credential leakage in stdout/stderr.
+ */
+function scrubCredentials(output, credential, extraCredentials) {
+    let scrubbed = output;
+    // Only scrub if credential is long enough to be meaningful
+    if (credential && credential.length >= 8) {
+        scrubbed = scrubbed.replaceAll(credential, '[REDACTED]');
+    }
+    if (extraCredentials?.apiKey && extraCredentials.apiKey.length >= 8) {
+        scrubbed = scrubbed.replaceAll(extraCredentials.apiKey, '[REDACTED]');
+    }
+    if (extraCredentials?.apiSecret && extraCredentials.apiSecret.length >= 8) {
+        scrubbed = scrubbed.replaceAll(extraCredentials.apiSecret, '[REDACTED]');
+    }
+    if (extraCredentials?.passphrase && extraCredentials.passphrase.length >= 8) {
+        scrubbed = scrubbed.replaceAll(extraCredentials.passphrase, '[REDACTED]');
+    }
+    return scrubbed;
+}
+/**
+ * Execute a CLI command with injected credentials.
+ * Returns stdout/stderr/exitCode without exposing the credential.
+ */
+async function executeCommand(command, injectedEnv, options) {
+    const timeout = options.timeout || 30000;
+    const startTime = Date.now();
+    return new Promise((resolve, reject) => {
+        const proc = (0, child_process_1.spawn)(command[0], command.slice(1), {
+            env: {
+                ...process.env, // Inherit base env
+                ...injectedEnv, // Override with injected credentials
+                // Safety: prevent credential exfil via common env vars
+                HISTFILE: '/dev/null',
+                LESSHISTFILE: '/dev/null',
+            },
+            cwd: options.workDir || '/tmp/janee-exec',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout,
+            // Don't use shell — prevents injection
+            shell: false,
+        });
+        let stdout = '';
+        let stderr = '';
+        proc.stdout.on('data', (data) => {
+            stdout += data.toString();
+        });
+        proc.stderr.on('data', (data) => {
+            stderr += data.toString();
+        });
+        if (options.stdin) {
+            proc.stdin.write(options.stdin);
+            proc.stdin.end();
+        }
+        else {
+            proc.stdin.end();
+        }
+        proc.on('close', (code) => {
+            const executionTimeMs = Date.now() - startTime;
+            // Scrub credentials from output
+            const scrubbedStdout = scrubCredentials(stdout, options.credential, options.extraCredentials);
+            const scrubbedStderr = scrubCredentials(stderr, options.credential, options.extraCredentials);
+            resolve({
+                stdout: scrubbedStdout,
+                stderr: scrubbedStderr,
+                exitCode: code ?? 1,
+                executionTimeMs,
+            });
+        });
+        proc.on('error', (error) => {
+            const executionTimeMs = Date.now() - startTime;
+            resolve({
+                stdout: '',
+                stderr: `Failed to execute command: ${error.message}`,
+                exitCode: 127,
+                executionTimeMs,
+            });
+        });
+    });
+}
+//# sourceMappingURL=exec.js.map

package/dist/core/exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/core/exec.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;AAkDH,0CA6BC;AAOD,oCAuBC;AAMD,4CAuBC;AAMD,wCAiFC;AA/ND,iDAAsC;AACtC,gDAAwB;AA4CxB;;GAEG;AACH,SAAgB,eAAe,CAC7B,OAAiB,EACjB,aAAuB;IAEvB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,UAAU,GAAG,cAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7C,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,YAAY,UAAU,yCAAyC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAClG,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,MAAM,cAAc,GAAG,iBAAiB,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,YAAY,CAAC,mFAAmF;aACzG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAC1B,WAAmC,EACnC,UAAkB,EAClB,gBAA+E;IAE/E,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,gBAAgB,EAAE,MAAM,EAAE,CAAC;YAC7B,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,gBAAgB,EAAE,SAAS,EAAE,CAAC;YAChC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,gBAAgB,EAAE,UAAU,EAAE,CAAC;YACjC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC9E,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACtB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,MAAc,EACd,UAAkB,EAClB,gBAA+E;IAE/E,IAAI,QAAQ,GAAG,MAAM,CAAC;IAEtB,2DAA2D;IAC3D,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACzC,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,gBAAgB,EAAE,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACpE,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,gBAAgB,EAAE,SAAS,IAAI,gBAAgB,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC1E,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,gBAAgB,EAAE,UAAU,IAAI,gBAAgB,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5E,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,cAAc,CAClC,OAAiB,EACjB,WAAmC,EACnC,OAMC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAC/C,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG,EAAG,mBAAmB;gBACpC,GAAG,WAAW,EAAG,qCAAqC;gBACtD,uDAAuD;gBACvD,QAAQ,EAAE,WAAW;gBACrB,YAAY,EAAE,WAAW;aAC1B;YACD,GAAG,EAAE,OAAO,CAAC,OAAO,IAAI,iBAAiB;YACzC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,OAAO;YACP,uCAAuC;YACvC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE/C,gCAAgC;YAChC,MAAM,cAAc,GAAG,gBAAgB,CACrC,MAAM,EACN,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,gBAAgB,CACzB,CAAC;YACF,MAAM,cAAc,GAAG,gBAAgB,CACrC,MAAM,EACN,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,gBAAgB,CACzB,CAAC;YAEF,OAAO,CAAC;gBACN,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,IAAI,IAAI,CAAC;gBACnB,eAAe;aAChB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACzB,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC/C,OAAO,CAAC;gBACN,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,8BAA8B,KAAK,CAAC,OAAO,EAAE;gBACrD,QAAQ,EAAE,GAAG;gBACb,eAAe;aAChB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/github-app.d.ts

@@ -0,0 +1,32 @@
+/**
+ * GitHub App Authentication
+ *
+ * Handles JWT-based authentication for GitHub Apps, minting short-lived
+ * installation tokens that are cached and auto-refreshed.
+ */
+export interface GitHubAppCredentials {
+    appId: string;
+    privateKey: string;
+    installationId: string;
+}
+export interface InstallationToken {
+    token: string;
+    expires_at: number;
+}
+export declare function validateGitHubAppCredentials(credentials: any): GitHubAppCredentials;
+export declare function createGitHubAppJWT(appId: string, privateKey: string): string;
+/**
+ * Exchange a GitHub App JWT for an installation access token.
+ */
+export declare function mintInstallationToken(appJwt: string, installationId: string): Promise<InstallationToken>;
+/**
+ * Get a cached installation token or mint a fresh one.
+ * Refreshes when <10 minutes remaining (tokens last 1 hour).
+ */
+export declare function getInstallationToken(serviceName: string, credentials: GitHubAppCredentials): Promise<string>;
+export declare function clearCachedInstallationToken(serviceName: string): void;
+/**
+ * Validate credentials by signing a JWT and listing installations.
+ */
+export declare function testGitHubAppAuth(credentials: GitHubAppCredentials): Promise<void>;
+//# sourceMappingURL=github-app.d.ts.map

package/dist/core/github-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app.d.ts","sourceRoot":"","sources":["../../src/core/github-app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,GAAG,GAAG,oBAAoB,CAkBnF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAY5E;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,iBAAiB,CAAC,CA4B5B;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,oBAAoB,GAChC,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAEtE;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,WAAW,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexF"}

package/dist/core/github-app.js

@@ -0,0 +1,105 @@
+"use strict";
+/**
+ * GitHub App Authentication
+ *
+ * Handles JWT-based authentication for GitHub Apps, minting short-lived
+ * installation tokens that are cached and auto-refreshed.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateGitHubAppCredentials = validateGitHubAppCredentials;
+exports.createGitHubAppJWT = createGitHubAppJWT;
+exports.mintInstallationToken = mintInstallationToken;
+exports.getInstallationToken = getInstallationToken;
+exports.clearCachedInstallationToken = clearCachedInstallationToken;
+exports.testGitHubAppAuth = testGitHubAppAuth;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const tokenCache = new Map();
+function validateGitHubAppCredentials(credentials) {
+    if (!credentials || typeof credentials !== 'object') {
+        throw new Error('Invalid credentials: must be an object');
+    }
+    if (!credentials.appId || typeof credentials.appId !== 'string') {
+        throw new Error('Invalid credentials: missing or invalid appId');
+    }
+    if (!credentials.privateKey || typeof credentials.privateKey !== 'string') {
+        throw new Error('Invalid credentials: missing or invalid privateKey');
+    }
+    if (!credentials.installationId || typeof credentials.installationId !== 'string') {
+        throw new Error('Invalid credentials: missing or invalid installationId');
+    }
+    return credentials;
+}
+function createGitHubAppJWT(appId, privateKey) {
+    const now = Math.floor(Date.now() / 1000);
+    return jsonwebtoken_1.default.sign({
+        iat: now - 60,
+        exp: now + 10 * 60,
+        iss: appId,
+    }, privateKey, { algorithm: 'RS256' });
+}
+/**
+ * Exchange a GitHub App JWT for an installation access token.
+ */
+async function mintInstallationToken(appJwt, installationId) {
+    const response = await fetch(`https://api.github.com/app/installations/${installationId}/access_tokens`, {
+        method: 'POST',
+        headers: {
+            'Accept': 'application/vnd.github+json',
+            'Authorization': `Bearer ${appJwt}`,
+            'User-Agent': 'janee',
+        },
+    });
+    if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`GitHub token mint failed: ${response.status} ${errorText}`);
+    }
+    const data = (await response.json());
+    if (!data.token || !data.expires_at) {
+        throw new Error('Invalid token response: missing token or expires_at');
+    }
+    return {
+        token: data.token,
+        expires_at: Math.floor(new Date(data.expires_at).getTime() / 1000),
+    };
+}
+/**
+ * Get a cached installation token or mint a fresh one.
+ * Refreshes when <10 minutes remaining (tokens last 1 hour).
+ */
+async function getInstallationToken(serviceName, credentials) {
+    const cached = tokenCache.get(serviceName);
+    if (cached) {
+        const timeRemaining = cached.expires_at - Math.floor(Date.now() / 1000);
+        if (timeRemaining > 600) {
+            return cached.token;
+        }
+    }
+    const appJwt = createGitHubAppJWT(credentials.appId, credentials.privateKey);
+    const token = await mintInstallationToken(appJwt, credentials.installationId);
+    tokenCache.set(serviceName, token);
+    return token.token;
+}
+function clearCachedInstallationToken(serviceName) {
+    tokenCache.delete(serviceName);
+}
+/**
+ * Validate credentials by signing a JWT and listing installations.
+ */
+async function testGitHubAppAuth(credentials) {
+    const appJwt = createGitHubAppJWT(credentials.appId, credentials.privateKey);
+    const response = await fetch('https://api.github.com/app', {
+        headers: {
+            'Accept': 'application/vnd.github+json',
+            'Authorization': `Bearer ${appJwt}`,
+            'User-Agent': 'janee',
+        },
+    });
+    if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`GitHub App auth test failed: ${response.status} ${errorText}`);
+    }
+}
+//# sourceMappingURL=github-app.js.map

package/dist/core/github-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app.js","sourceRoot":"","sources":["../../src/core/github-app.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;AAiBH,oEAkBC;AAED,gDAYC;AAKD,sDA+BC;AAMD,oDAgBC;AAED,oEAEC;AAKD,8CAeC;AAjID,gEAA+B;AAa/B,MAAM,UAAU,GAAmC,IAAI,GAAG,EAAE,CAAC;AAE7D,SAAgB,4BAA4B,CAAC,WAAgB;IAC3D,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,UAAU,IAAI,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,cAAc,IAAI,OAAO,WAAW,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,WAAmC,CAAC;AAC7C,CAAC;AAED,SAAgB,kBAAkB,CAAC,KAAa,EAAE,UAAkB;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,OAAO,sBAAG,CAAC,IAAI,CACb;QACE,GAAG,EAAE,GAAG,GAAG,EAAE;QACb,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE;QAClB,GAAG,EAAE,KAAK;KACX,EACD,UAAU,EACV,EAAE,SAAS,EAAE,OAAO,EAAE,CACvB,CAAC;AACJ,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,cAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,4CAA4C,cAAc,gBAAgB,EAC1E;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,QAAQ,EAAE,6BAA6B;YACvC,eAAe,EAAE,UAAU,MAAM,EAAE;YACnC,YAAY,EAAE,OAAO;SACtB;KACF,CACF,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;IAE5C,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAe;QAC3B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAoB,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,WAAiC;IAEjC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxE,IAAI,aAAa,GAAG,GAAG,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC;IAC9E,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,KAAK,CAAC;AACrB,CAAC;AAED,SAAgB,4BAA4B,CAAC,WAAmB;IAC9D,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,iBAAiB,CAAC,WAAiC;IACvE,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,4BAA4B,EAAE;QACzD,OAAO,EAAE;YACP,QAAQ,EAAE,6BAA6B;YACvC,eAAe,EAAE,UAAU,MAAM,EAAE;YACnC,YAAY,EAAE,OAAO;SACtB;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IAClF,CAAC;AACH,CAAC"}

package/dist/core/health.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Health check module for Janee services
+ * Provides connectivity and latency checks for configured API backends
+ */
+export interface HealthCheckResult {
+    service: string;
+    healthy: boolean;
+    statusCode?: number;
+    latencyMs: number;
+    error?: string;
+    checkedAt: string;
+}
+export interface HealthCheckOptions {
+    timeout?: number;
+    fetchFn?: typeof fetch;
+}
+/**
+ * Check if a service endpoint is reachable and responding
+ */
+export declare function checkServiceHealth(serviceName: string, baseUrl: string, options?: HealthCheckOptions): Promise<HealthCheckResult>;
+/**
+ * Check health of multiple services in parallel
+ */
+export declare function checkAllServicesHealth(services: Map<string, {
+    baseUrl: string;
+}>, options?: HealthCheckOptions): Promise<HealthCheckResult[]>;
+//# sourceMappingURL=health.d.ts.map

package/dist/core/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/core/health.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CA6D5B;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EAC1C,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAK9B"}