@vectle/cli 1.0.0 → 1.1.1

package/dist/integrations.d.ts

@@ -0,0 +1,126 @@
+import { type ClientFamily } from './store.js';
+import type { VectleConfig } from './store.js';
+type IntegrationCapability = 'full_lifecycle' | 'policy_and_mcp' | 'mcp_only' | 'authorized_only' | 'disconnected' | 'conflict';
+type AdapterOption = {
+    client_family: ClientFamily;
+    profile_label: string;
+    adapter_entry_id: string | null;
+};
+type ClientSelection = {
+    schema_version: 'client-selection-v1';
+    status: 'not_required' | 'selected' | 'choice_required' | 'none_detected';
+    reason: 'all_requested' | 'managed_invocation' | 'explicit_family' | 'single_detected' | 'multiple_detected' | 'same_family_multiple_profiles' | 'no_supported_client';
+    options: AdapterOption[];
+};
+export type SupportedClientFamily = Exclude<ClientFamily, 'terminal' | 'unknown'>;
+export declare const SUPPORTED_CLIENTS: readonly SupportedClientFamily[];
+export type DetectionResult = {
+    client: SupportedClientFamily;
+    state: 'active_invocation' | 'managed_existing' | 'configured_unmanaged' | 'installed_only' | 'absent';
+    confidence: 'authoritative' | 'high' | 'weak' | 'none';
+    profileKey: string | null;
+    profileLabel: string;
+    adapterEntryId: string | null;
+    evidence: Array<{
+        source: 'explicit_flag' | 'managed_manifest' | 'immediate_parent' | 'documented_host_marker' | 'exact_config_entry' | 'executable';
+        safeCode: string;
+    }>;
+};
+export type IntegrationManifestEntry = {
+    adapter_entry_id: string;
+    client_family: SupportedClientFamily;
+    profile_label: string;
+    integration_capability: IntegrationCapability;
+    policy_checksum: `sha256:${string}`;
+    integration_binding_digest: `sha256:${string}`;
+    managed: true;
+    config_digest: `sha256:${string}` | null;
+    hook_digest: `sha256:${string}` | null;
+    installed_at: string;
+    updated_at: string;
+};
+export type IntegrationManifest = {
+    schema_version: 'integrations-v1';
+    entries: IntegrationManifestEntry[];
+};
+export declare function emptyIntegrationManifest(): IntegrationManifest;
+export declare function validateAdapterEntryId(value: unknown): value is string;
+export declare function loadIntegrationManifest(root?: string): IntegrationManifest;
+export declare function saveIntegrationManifest(manifest: IntegrationManifest, root?: string): void;
+export declare function removeIntegrationEntries(families?: readonly SupportedClientFamily[], root?: string): number;
+export type DetectionOptions = {
+    explicit?: ClientFamily | 'auto' | 'all';
+    trustedInvocation?: SupportedClientFamily;
+    home?: string;
+    manifest?: IntegrationManifest;
+    configEvidence?: Partial<Record<SupportedClientFamily, string[]>>;
+};
+export declare function detectClients(options?: DetectionOptions): DetectionResult[];
+export declare function chooseClient(options?: DetectionOptions): {
+    selection: ClientSelection;
+    selected: DetectionResult | null;
+    candidates: DetectionResult[];
+};
+export declare function newIntegrationEntry(client: SupportedClientFamily, profileLabel: string, policyChecksum: `sha256:${string}`, integrationBindingDigest: `sha256:${string}`, capability?: IntegrationCapability): IntegrationManifestEntry;
+export type IntegrationBindingDetails = {
+    clientFamily: SupportedClientFamily;
+    profileKey: string;
+    stateRoot: string;
+    nodePath: string;
+    nodeSha256: `sha256:${string}`;
+    cliEntry: string;
+    cliSha256: `sha256:${string}`;
+    policyBaseVersion: string;
+    policyVariant: string;
+    policyChecksum: `sha256:${string}`;
+    ownedTargetIdentifiers: string[];
+    managedCommandArgumentVectors: string[][];
+};
+export declare function canonicalIntegrationBinding(value: Record<string, unknown>): string;
+export declare function integrationBindingProjection(config: Pick<VectleConfig, 'endpoint' | 'installation'>, adapterEntryId: string, details?: IntegrationBindingDetails): {
+    schema_version: string;
+    adapter_entry_id: string;
+    client_family: string;
+    profile_key: string;
+    state_root: string;
+    approved_api_origin: string;
+    cli_version: string;
+    runtime: {
+        node_path: string;
+        node_sha256: string;
+        cli_entry: string;
+        cli_sha256: string;
+    };
+    policy: {
+        base_version: string;
+        variant: string;
+        checksum: string;
+    };
+    owned_target_identifiers: never[];
+    managed_command_argument_vectors: never[];
+} | {
+    schema_version: string;
+    adapter_entry_id: string;
+    client_family: SupportedClientFamily;
+    profile_key: string;
+    state_root: string;
+    approved_api_origin: string;
+    cli_version: string;
+    runtime: {
+        node_path: string;
+        node_sha256: `sha256:${string}`;
+        cli_entry: string;
+        cli_sha256: `sha256:${string}`;
+    };
+    policy: {
+        base_version: string;
+        variant: string;
+        checksum: `sha256:${string}`;
+    };
+    owned_target_identifiers: string[];
+    managed_command_argument_vectors: string[][];
+};
+export declare function integrationBindingDigest(config: Pick<VectleConfig, 'endpoint' | 'installation'>, adapterEntryId: string, details?: IntegrationBindingDetails): `sha256:${string}`;
+export declare function managedMcpArguments(client: SupportedClientFamily, adapterEntryId: string, stateRoot: string, bindingDigest: string): string[];
+export declare function integrationPathForTests(root?: string): string;
+export {};

package/dist/integrations.js

@@ -0,0 +1,173 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+import { CLI_VERSION } from './constants.js';
+import { atomicWriteJson, digestLocal, issueLocalId } from './state.js';
+import { configDirectory } from './store.js';
+export const SUPPORTED_CLIENTS = ['codex', 'claude_code', 'cursor', 'vscode'];
+const integrationPath = (root = configDirectory()) => join(root, 'integrations.json');
+const clientRoots = {
+    codex: '.codex',
+    claude_code: '.claude',
+    cursor: '.cursor',
+    vscode: '.copilot',
+};
+const clientMarkers = {
+    codex: ['config.toml', 'hooks.json', 'AGENTS.md', 'AGENTS.override.md'],
+    claude_code: ['settings.json', 'CLAUDE.md'],
+    cursor: ['mcp.json', 'hooks.json'],
+    vscode: ['mcp-config.json', 'instructions', 'hooks'],
+};
+function safeProfile(value) {
+    return /^[A-Za-z0-9][A-Za-z0-9 _.-]{0,79}$/u.test(value) ? value : 'default';
+}
+function validEntry(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const item = value;
+    return Object.keys(item).length === 11
+        && typeof item.adapter_entry_id === 'string' && /^vai_[A-Za-z0-9_-]{22}$/u.test(item.adapter_entry_id)
+        && typeof item.client_family === 'string' && SUPPORTED_CLIENTS.includes(item.client_family)
+        && typeof item.profile_label === 'string' && safeProfile(item.profile_label) === item.profile_label
+        && ['full_lifecycle', 'policy_and_mcp', 'mcp_only', 'authorized_only', 'disconnected', 'conflict'].includes(String(item.integration_capability))
+        && typeof item.policy_checksum === 'string' && /^sha256:[0-9a-f]{64}$/u.test(item.policy_checksum)
+        && typeof item.integration_binding_digest === 'string' && /^sha256:[0-9a-f]{64}$/u.test(item.integration_binding_digest)
+        && item.managed === true
+        && (item.config_digest === null || typeof item.config_digest === 'string' && /^sha256:[0-9a-f]{64}$/u.test(item.config_digest))
+        && (item.hook_digest === null || typeof item.hook_digest === 'string' && /^sha256:[0-9a-f]{64}$/u.test(item.hook_digest))
+        && typeof item.installed_at === 'string' && Number.isFinite(Date.parse(item.installed_at))
+        && typeof item.updated_at === 'string' && Number.isFinite(Date.parse(item.updated_at));
+}
+export function emptyIntegrationManifest() { return { schema_version: 'integrations-v1', entries: [] }; }
+export function validateAdapterEntryId(value) {
+    if (typeof value !== 'string' || !/^vai_[A-Za-z0-9_-]{22}$/u.test(value))
+        return false;
+    const encoded = value.slice(4);
+    try {
+        return Buffer.from(encoded, 'base64url').byteLength === 16 && Buffer.from(encoded, 'base64url').toString('base64url') === encoded;
+    }
+    catch {
+        return false;
+    }
+}
+export function loadIntegrationManifest(root) {
+    try {
+        const value = JSON.parse(readFileSync(integrationPath(root), 'utf8'));
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            return emptyIntegrationManifest();
+        const record = value;
+        if (Object.keys(record).length !== 2 || record.schema_version !== 'integrations-v1' || !Array.isArray(record.entries) || record.entries.length > 8 || record.entries.some(entry => !validEntry(entry)))
+            return emptyIntegrationManifest();
+        return { schema_version: 'integrations-v1', entries: record.entries };
+    }
+    catch {
+        return emptyIntegrationManifest();
+    }
+}
+export function saveIntegrationManifest(manifest, root) {
+    if (manifest.entries.length > 8 || manifest.entries.some(entry => !validEntry(entry)))
+        throw new Error('invalid_integration_manifest');
+    atomicWriteJson(integrationPath(root), manifest);
+}
+export function removeIntegrationEntries(families, root) {
+    const current = loadIntegrationManifest(root);
+    const keep = families ? current.entries.filter(entry => !families.includes(entry.client_family)) : [];
+    saveIntegrationManifest({ schema_version: 'integrations-v1', entries: keep }, root);
+    return current.entries.length - keep.length;
+}
+function exactConfigEvidence(family, home = homedir()) {
+    const root = join(home, clientRoots[family]);
+    const present = clientMarkers[family].filter(marker => existsSync(join(root, marker)));
+    return present.length ? present : null;
+}
+export function detectClients(options = {}) {
+    const manifest = options.manifest ?? loadIntegrationManifest();
+    if (options.explicit && options.explicit !== 'auto' && options.explicit !== 'all' && options.explicit !== 'terminal' && options.explicit !== 'unknown') {
+        const existing = manifest.entries.find(entry => entry.client_family === options.explicit);
+        return [{ client: options.explicit, state: existing ? 'managed_existing' : 'active_invocation', confidence: 'authoritative', profileKey: existing?.profile_label ?? null, profileLabel: existing?.profile_label ?? 'default', adapterEntryId: existing?.adapter_entry_id ?? null, evidence: [{ source: 'explicit_flag', safeCode: 'client_explicit' }] }];
+    }
+    if (options.trustedInvocation) {
+        const existing = manifest.entries.find(entry => entry.client_family === options.trustedInvocation);
+        return [{ client: options.trustedInvocation, state: 'active_invocation', confidence: 'authoritative', profileKey: existing?.profile_label ?? null, profileLabel: existing?.profile_label ?? 'default', adapterEntryId: existing?.adapter_entry_id ?? null, evidence: [{ source: 'documented_host_marker', safeCode: 'trusted_invocation' }] }];
+    }
+    const results = [];
+    for (const client of SUPPORTED_CLIENTS) {
+        const existing = manifest.entries.filter(entry => entry.client_family === client);
+        const evidence = options.configEvidence?.[client] ?? exactConfigEvidence(client, options.home);
+        if (existing.length) {
+            for (const entry of existing)
+                results.push({ client, state: 'managed_existing', confidence: 'high', profileKey: entry.profile_label, profileLabel: entry.profile_label, adapterEntryId: entry.adapter_entry_id, evidence: [{ source: 'managed_manifest', safeCode: 'managed_entry' }] });
+        }
+        else if (evidence?.length) {
+            results.push({ client, state: 'configured_unmanaged', confidence: 'weak', profileKey: null, profileLabel: 'default', adapterEntryId: null, evidence: evidence.slice(0, 4).map(safeCode => ({ source: 'exact_config_entry', safeCode: `marker_${safeCode.replace(/[^A-Za-z0-9_-]/gu, '_')}` })) });
+        }
+    }
+    return results;
+}
+export function chooseClient(options = {}) {
+    if (options.explicit === 'all') {
+        const candidates = detectClients({ ...options, explicit: 'auto' });
+        const optionsList = candidates.map(candidateOption).slice(0, 8);
+        return { selection: { schema_version: 'client-selection-v1', status: 'not_required', reason: 'all_requested', options: optionsList }, selected: null, candidates };
+    }
+    const candidates = detectClients(options);
+    if (options.explicit && options.explicit !== 'auto' && options.explicit !== 'terminal' && options.explicit !== 'unknown') {
+        const selected = candidates[0] ?? null;
+        return { selection: { schema_version: 'client-selection-v1', status: 'selected', reason: 'explicit_family', options: selected ? [candidateOption(selected)] : [] }, selected, candidates };
+    }
+    const strong = candidates.filter(candidate => candidate.confidence === 'authoritative' || candidate.confidence === 'high');
+    if (strong.length === 1)
+        return { selection: { schema_version: 'client-selection-v1', status: 'selected', reason: strong[0].state === 'managed_existing' ? 'managed_invocation' : 'single_detected', options: [candidateOption(strong[0])] }, selected: strong[0], candidates };
+    if (strong.length > 1)
+        return { selection: { schema_version: 'client-selection-v1', status: 'choice_required', reason: new Set(strong.map(item => item.client)).size === 1 ? 'same_family_multiple_profiles' : 'multiple_detected', options: strong.map(candidateOption).slice(0, 8) }, selected: null, candidates };
+    return { selection: { schema_version: 'client-selection-v1', status: 'none_detected', reason: 'no_supported_client', options: [] }, selected: null, candidates };
+}
+function candidateOption(value) {
+    return { client_family: value.client, profile_label: safeProfile(value.profileLabel), adapter_entry_id: value.adapterEntryId };
+}
+export function newIntegrationEntry(client, profileLabel, policyChecksum, integrationBindingDigest, capability = 'mcp_only') {
+    const now = new Date().toISOString();
+    return { adapter_entry_id: issueLocalId('vai'), client_family: client, profile_label: safeProfile(profileLabel), integration_capability: capability, policy_checksum: policyChecksum, integration_binding_digest: integrationBindingDigest, managed: true, config_digest: null, hook_digest: null, installed_at: now, updated_at: now };
+}
+function canonicalBindingValue(value) {
+    if (typeof value === 'string')
+        return value.normalize('NFC');
+    if (Array.isArray(value))
+        return value.map(canonicalBindingValue);
+    if (value && typeof value === 'object')
+        return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, child]) => [key.normalize('NFC'), canonicalBindingValue(child)]));
+    return value;
+}
+export function canonicalIntegrationBinding(value) {
+    return JSON.stringify(canonicalBindingValue(value));
+}
+export function integrationBindingProjection(config, adapterEntryId, details) {
+    if (!validateAdapterEntryId(adapterEntryId))
+        throw new Error('invalid_adapter_entry_id');
+    const endpoint = config.endpoint.replace(/\/$/u, '');
+    if (!details)
+        return {
+            schema_version: 'integration-binding-v1', adapter_entry_id: adapterEntryId, client_family: 'unknown', profile_key: 'default', state_root: '', approved_api_origin: endpoint, cli_version: CLI_VERSION,
+            runtime: { node_path: '', node_sha256: `sha256:${'0'.repeat(64)}`, cli_entry: '', cli_sha256: `sha256:${'0'.repeat(64)}` },
+            policy: { base_version: 'agent-policy-v1', variant: 'lookup_on_demand__sharing_explicit', checksum: `sha256:${'0'.repeat(64)}` },
+            owned_target_identifiers: [], managed_command_argument_vectors: [],
+        };
+    if (details.stateRoot && !isAbsolute(details.stateRoot) || !isAbsolute(details.nodePath) || !isAbsolute(details.cliEntry))
+        throw new Error('invalid_integration_binding');
+    return {
+        schema_version: 'integration-binding-v1', adapter_entry_id: adapterEntryId, client_family: details.clientFamily, profile_key: details.profileKey, state_root: details.stateRoot, approved_api_origin: endpoint, cli_version: CLI_VERSION,
+        runtime: { node_path: details.nodePath, node_sha256: details.nodeSha256, cli_entry: details.cliEntry, cli_sha256: details.cliSha256 },
+        policy: { base_version: details.policyBaseVersion, variant: details.policyVariant, checksum: details.policyChecksum },
+        owned_target_identifiers: [...details.ownedTargetIdentifiers], managed_command_argument_vectors: details.managedCommandArgumentVectors.map(vector => [...vector]),
+    };
+}
+export function integrationBindingDigest(config, adapterEntryId, details) {
+    return digestLocal(canonicalIntegrationBinding(integrationBindingProjection(config, adapterEntryId, details)));
+}
+export function managedMcpArguments(client, adapterEntryId, stateRoot, bindingDigest) {
+    if (!validateAdapterEntryId(adapterEntryId) || !/^sha256:[0-9a-f]{64}$/u.test(bindingDigest) || !isAbsolute(stateRoot))
+        throw new Error('invalid_integration_binding');
+    return ['mcp', '--client', client, '--adapter-entry-id', adapterEntryId, '--state-root', stateRoot, '--integration-manifest-digest', bindingDigest];
+}
+export function integrationPathForTests(root) { return integrationPath(root); }
+//# sourceMappingURL=integrations.js.map

package/dist/integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.js","sourceRoot":"","sources":["../src/integrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAC;AAQhE,MAAM,CAAC,MAAM,iBAAiB,GAAqC,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AA4BhH,MAAM,eAAe,GAAG,CAAC,IAAI,GAAG,eAAe,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;AACtF,MAAM,WAAW,GAA0C;IACzD,KAAK,EAAE,QAAQ;IACf,WAAW,EAAE,SAAS;IACtB,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,UAAU;CACnB,CAAC;AACF,MAAM,aAAa,GAA4C;IAC7D,KAAK,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,CAAC;IACvE,WAAW,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;IAC3C,MAAM,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;IAClC,MAAM,EAAE,CAAC,iBAAiB,EAAE,cAAc,EAAE,OAAO,CAAC;CACrD,CAAC;AAEF,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;WACjC,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;WACnG,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAsC,CAAC;WACjH,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,aAAa;WAChG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;WAC7I,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;WAC/F,OAAO,IAAI,CAAC,0BAA0B,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC;WACrH,IAAI,CAAC,OAAO,KAAK,IAAI;WACrB,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;WAC5H,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;WACtH,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;WACvF,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,wBAAwB,KAA0B,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAE9H,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC;QAAC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,UAAU,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACpK,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAa;IACnD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;QACjF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,wBAAwB,EAAE,CAAC;QACnG,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,iBAAiB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,wBAAwB,EAAE,CAAC;QAC1O,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAqC,EAAE,CAAC;IACtG,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,wBAAwB,EAAE,CAAC;IAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAA6B,EAAE,IAAa;IAClF,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACvI,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAA2C,EAAE,IAAa;IACjG,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,uBAAuB,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IACpF,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;AAC9C,CAAC;AAED,SAAS,mBAAmB,CAAC,MAA6B,EAAE,IAAI,GAAG,OAAO,EAAE;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACvF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAUD,MAAM,UAAU,aAAa,CAAC,UAA4B,EAAE;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,uBAAuB,EAAE,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvJ,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,IAAI,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,IAAI,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,gBAAgB,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5V,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnG,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,IAAI,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,IAAI,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,gBAAgB,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;IACjV,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/F,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,MAAM,KAAK,IAAI,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,cAAc,EAAE,KAAK,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3R,CAAC;aAAM,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,oBAA6B,EAAE,QAAQ,EAAE,UAAU,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7S,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,UAA4B,EAAE;IACzD,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,aAAa,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,OAAO,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACrK,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzH,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QACvC,OAAO,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAC7L,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,eAAe,IAAI,SAAS,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC;IAC3H,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,kBAAkB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;IAChR,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,mBAAmB,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACrT,OAAO,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACnK,CAAC;AAED,SAAS,eAAe,CAAC,KAAsB;IAC7C,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;AACjI,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA6B,EAAE,YAAoB,EAAE,cAAkC,EAAE,wBAA4C,EAAE,aAAoC,UAAU;IACvN,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,EAAE,gBAAgB,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,YAAY,CAAC,EAAE,sBAAsB,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAC1U,CAAC;AAiBD,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrP,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAA8B;IACxE,OAAO,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAuD,EAAE,cAAsB,EAAE,OAAmC;IAC/J,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO;QAAE,OAAO;YACnB,cAAc,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW;YACrM,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE;YAC1H,MAAM,EAAE,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,oCAAoC,EAAE,QAAQ,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE;YAChI,wBAAwB,EAAE,EAAE,EAAE,gCAAgC,EAAE,EAAE;SACnE,CAAC;IACF,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1K,OAAO;QACL,cAAc,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW;QACxO,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE;QACrI,MAAM,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE;QACrH,wBAAwB,EAAE,CAAC,GAAG,OAAO,CAAC,sBAAsB,CAAC,EAAE,gCAAgC,EAAE,OAAO,CAAC,6BAA6B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;KAClK,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAuD,EAAE,cAAsB,EAAE,OAAmC;IAC3J,OAAO,WAAW,CAAC,2BAA2B,CAAC,4BAA4B,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AACjH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA6B,EAAE,cAAsB,EAAE,SAAiB,EAAE,aAAqB;IACjI,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACvK,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,EAAE,+BAA+B,EAAE,aAAa,CAAC,CAAC;AACtJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAa,IAAI,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC"}

package/dist/legacy-compat.d.ts

@@ -0,0 +1,45 @@
+import { type CredentialBackend, type VectleConfig } from './store.js';
+export type LegacyCredentialSource = 'macos_keychain' | 'linux_secret_service' | 'windows_credential_manager' | 'file' | 'environment';
+export type LegacyOriginBinding = {
+    credential_handle: `sha256:${string}`;
+    credential_source: LegacyCredentialSource;
+    selected_root_digest: `sha256:${string}`;
+    origin: string;
+    pinned_by: 'compiled_official_endpoint';
+    state: 'active' | 'superseded';
+    created_at: string;
+};
+export type LegacyOriginBindings = {
+    schema_version: 'legacy-origin-bindings-v1';
+    entries: LegacyOriginBinding[];
+};
+export type LegacyCompatibility = {
+    schema_version: 'legacy-compatibility-v1';
+    source_config_digest: `sha256:${string}`;
+    state: 'legacy_v1' | 'upgraded_v2';
+    contributor_id: string | null;
+    display_name: string | null;
+    identity_scope: 'project' | 'global' | null;
+    client_family: VectleConfig['clientFamily'];
+    credential_backend: CredentialBackend | null;
+    authorization_mode: 'standing' | 'per_write' | null;
+    authorization_expires_at: string | null;
+    last_update_notice_version: string | null;
+    last_update_notice_at: string | null;
+};
+export declare function legacyOriginBindingsPath(root?: string): string;
+export declare function legacyCompatibilityPath(root?: string): string;
+export declare function legacyRootDigest(root: string): `sha256:${string}`;
+export declare function legacyCredentialHandle(source: LegacyCredentialSource, token: string): `sha256:${string}`;
+export declare function legacySource(backend: CredentialBackend | undefined, platform?: NodeJS.Platform, environment?: NodeJS.ProcessEnv): LegacyCredentialSource;
+export declare function compiledOfficialOrigin(value: string): string;
+/** Pin a legacy credential before any authenticated request is allowed. */
+export declare function ensureLegacyOriginBinding(input: {
+    root?: string;
+    token: string;
+    source: LegacyCredentialSource;
+    endpoint: string;
+    now?: string;
+}): LegacyOriginBinding;
+export declare function readLegacyCompatibility(root?: string): LegacyCompatibility | null;
+export declare function writeLegacyCompatibility(config: VectleConfig, state: 'legacy_v1' | 'upgraded_v2', root?: string): LegacyCompatibility;

package/dist/legacy-compat.js

@@ -0,0 +1,149 @@
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { DEFAULT_ENDPOINT } from './constants.js';
+import { atomicWriteJson, digestLocal } from './state.js';
+import { configDirectory, configPath } from './store.js';
+const safeId = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+const safeDisplay = /^[^\r\n]{1,80}$/u;
+const semver = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
+const digestPattern = /^sha256:[0-9a-f]{64}$/u;
+export function legacyOriginBindingsPath(root = configDirectory()) { return join(root, 'legacy-origin-bindings.json'); }
+export function legacyCompatibilityPath(root = configDirectory()) { return join(root, 'legacy-compatibility.json'); }
+function sha(value) { return `sha256:${createHash('sha256').update(value).digest('hex')}`; }
+export function legacyRootDigest(root) { return sha(root.normalize('NFC')); }
+export function legacyCredentialHandle(source, token) {
+    if (!/^vctk_[A-Za-z0-9_-]{43}$/u.test(token))
+        throw new Error('invalid_legacy_credential');
+    return sha(`${source}\0${token}`);
+}
+export function legacySource(backend, platform = process.platform, environment = process.env) {
+    if (typeof environment.VECTLE_TOKEN === 'string' && environment.VECTLE_TOKEN.trim())
+        return 'environment';
+    if (backend === 'file')
+        return 'file';
+    if (platform === 'darwin')
+        return 'macos_keychain';
+    if (platform === 'linux')
+        return 'linux_secret_service';
+    if (platform === 'win32')
+        return 'windows_credential_manager';
+    return 'file';
+}
+export function compiledOfficialOrigin(value) {
+    let origin;
+    try {
+        const parsed = new URL(value);
+        if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.pathname !== '/' || parsed.search || parsed.hash)
+            throw new Error('invalid_origin');
+        origin = parsed.origin;
+    }
+    catch {
+        throw new Error('endpoint_mismatch');
+    }
+    const official = new URL(DEFAULT_ENDPOINT).origin;
+    if (origin !== official)
+        throw new Error('endpoint_mismatch');
+    return official;
+}
+function validBinding(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const item = value;
+    return Object.keys(item).length === 8
+        && digestPattern.test(String(item.credential_handle))
+        && ['macos_keychain', 'linux_secret_service', 'windows_credential_manager', 'file', 'environment'].includes(String(item.credential_source))
+        && digestPattern.test(String(item.selected_root_digest))
+        && item.origin === new URL(DEFAULT_ENDPOINT).origin
+        && item.pinned_by === 'compiled_official_endpoint'
+        && (item.state === 'active' || item.state === 'superseded')
+        && typeof item.created_at === 'string' && Number.isFinite(Date.parse(item.created_at));
+}
+function readBindings(root) {
+    try {
+        const value = JSON.parse(readFileSync(legacyOriginBindingsPath(root), 'utf8'));
+        if (Object.keys(value).length !== 2 || value.schema_version !== 'legacy-origin-bindings-v1' || !Array.isArray(value.entries) || value.entries.length > 8 || value.entries.some(item => !validBinding(item)))
+            throw new Error('legacy_origin_binding_invalid');
+        return { schema_version: 'legacy-origin-bindings-v1', entries: value.entries };
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === 'legacy_origin_binding_invalid')
+            throw error;
+        return { schema_version: 'legacy-origin-bindings-v1', entries: [] };
+    }
+}
+/** Pin a legacy credential before any authenticated request is allowed. */
+export function ensureLegacyOriginBinding(input) {
+    const root = input.root ?? configDirectory();
+    const origin = compiledOfficialOrigin(input.endpoint);
+    const createdAt = input.now ?? new Date().toISOString();
+    if (!Number.isFinite(Date.parse(createdAt)))
+        throw new Error('invalid_timestamp');
+    const entry = { credential_handle: legacyCredentialHandle(input.source, input.token), credential_source: input.source, selected_root_digest: legacyRootDigest(root), origin, pinned_by: 'compiled_official_endpoint', state: 'active', created_at: createdAt };
+    const bindings = readBindings(root);
+    const matching = bindings.entries.find(item => item.credential_handle === entry.credential_handle);
+    if (matching && (matching.origin !== origin || matching.selected_root_digest !== entry.selected_root_digest || matching.credential_source !== entry.credential_source || matching.state !== 'active'))
+        throw new Error('legacy_origin_binding_mismatch');
+    if (!matching)
+        bindings.entries = [...bindings.entries.filter(item => item.credential_source !== 'environment' || input.source === 'environment'), entry].slice(-8);
+    atomicWriteJson(legacyOriginBindingsPath(root), bindings);
+    return entry;
+}
+function sourceDigest() {
+    try {
+        return sha(readFileSync(configPath()));
+    }
+    catch {
+        return digestLocal('missing-legacy-config');
+    }
+}
+function validCompatibility(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const item = value;
+    return Object.keys(item).length === 12
+        && item.schema_version === 'legacy-compatibility-v1'
+        && digestPattern.test(String(item.source_config_digest))
+        && (item.state === 'legacy_v1' || item.state === 'upgraded_v2')
+        && (item.contributor_id === null || typeof item.contributor_id === 'string' && safeId.test(item.contributor_id))
+        && (item.display_name === null || typeof item.display_name === 'string' && safeDisplay.test(item.display_name))
+        && (item.identity_scope === null || item.identity_scope === 'project' || item.identity_scope === 'global')
+        && ['codex', 'claude_code', 'cursor', 'vscode', 'terminal', 'unknown'].includes(String(item.client_family))
+        && (item.credential_backend === null || ['keychain', 'file', 'environment'].includes(String(item.credential_backend)))
+        && (item.authorization_mode === null || item.authorization_mode === 'standing' || item.authorization_mode === 'per_write')
+        && (item.authorization_expires_at === null || typeof item.authorization_expires_at === 'string' && Number.isFinite(Date.parse(item.authorization_expires_at)))
+        && (item.last_update_notice_version === null || typeof item.last_update_notice_version === 'string' && semver.test(item.last_update_notice_version))
+        && (item.last_update_notice_at === null || typeof item.last_update_notice_at === 'string' && Number.isFinite(Date.parse(item.last_update_notice_at)));
+}
+function optionalId(value) { return typeof value === 'string' && safeId.test(value) ? value : null; }
+function optionalDisplay(value) { return typeof value === 'string' && safeDisplay.test(value) ? value : null; }
+function optionalDate(value) { return typeof value === 'string' && Number.isFinite(Date.parse(value)) ? value : null; }
+function optionalSemver(value) { return typeof value === 'string' && semver.test(value) ? value : null; }
+export function readLegacyCompatibility(root = configDirectory()) {
+    try {
+        const value = JSON.parse(readFileSync(legacyCompatibilityPath(root), 'utf8'));
+        return validCompatibility(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeLegacyCompatibility(config, state, root = configDirectory()) {
+    const value = {
+        schema_version: 'legacy-compatibility-v1',
+        source_config_digest: sourceDigest(),
+        state,
+        contributor_id: optionalId(config.contributorId),
+        display_name: optionalDisplay(config.displayName),
+        identity_scope: config.identityScope === 'project' || config.identityScope === 'global' ? config.identityScope : null,
+        client_family: config.clientFamily,
+        credential_backend: config.credentialBackend === 'keychain' || config.credentialBackend === 'file' || config.credentialBackend === 'environment' ? config.credentialBackend : null,
+        authorization_mode: config.authorizationMode === 'standing' || config.authorizationMode === 'per_write' ? config.authorizationMode : null,
+        authorization_expires_at: optionalDate(config.authorizationExpiresAt),
+        last_update_notice_version: optionalSemver(config.lastUpdateNoticeVersion),
+        last_update_notice_at: optionalDate(config.lastUpdateNoticeAt),
+    };
+    atomicWriteJson(legacyCompatibilityPath(root), value);
+    return value;
+}
+//# sourceMappingURL=legacy-compat.js.map

package/dist/legacy-compat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-compat.js","sourceRoot":"","sources":["../src/legacy-compat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,UAAU,EAA6C,MAAM,YAAY,CAAC;AA6BpG,MAAM,MAAM,GAAG,sCAAsC,CAAC;AACtD,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,MAAM,GAAG,2DAA2D,CAAC;AAC3E,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAE/C,MAAM,UAAU,wBAAwB,CAAC,IAAI,GAAG,eAAe,EAAE,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC,CAAC,CAAC;AACxH,MAAM,UAAU,uBAAuB,CAAC,IAAI,GAAG,eAAe,EAAE,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC,CAAC,CAAC;AAErH,SAAS,GAAG,CAAC,KAA0B,IAAI,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAwB,CAAC,CAAC,CAAC;AAEvI,MAAM,UAAU,gBAAgB,CAAC,IAAY,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAErF,MAAM,UAAU,sBAAsB,CAAC,MAA8B,EAAE,KAAa;IAClF,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC3F,OAAO,GAAG,CAAC,GAAG,MAAM,KAAK,KAAK,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAsC,EAAE,WAA4B,OAAO,CAAC,QAAQ,EAAE,cAAiC,OAAO,CAAC,GAAG;IAC7J,IAAI,OAAO,WAAW,CAAC,YAAY,KAAK,QAAQ,IAAI,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE;QAAE,OAAO,aAAa,CAAC;IAC1G,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IACnD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,sBAAsB,CAAC;IACxD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,4BAA4B,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACrK,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;WAChC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;WAClD,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;WACxI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;WACrD,IAAI,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM;WAChD,IAAI,CAAC,SAAS,KAAK,4BAA4B;WAC/C,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC;WACxD,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;QAC1G,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,cAAc,KAAK,2BAA2B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC9P,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,OAAO,EAAE,KAAK,CAAC,OAAgC,EAAE,CAAC;IAC1G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,+BAA+B;YAAE,MAAM,KAAK,CAAC;QAC7F,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACtE,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,yBAAyB,CAAC,KAAuG;IAC/I,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAClF,MAAM,KAAK,GAAwB,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,4BAA4B,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACpR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACnG,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,oBAAoB,KAAK,KAAK,CAAC,oBAAoB,IAAI,QAAQ,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACzP,IAAI,CAAC,QAAQ;QAAE,QAAQ,CAAC,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,KAAK,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpK,eAAe,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC;QAAC,OAAO,GAAG,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,WAAW,CAAC,uBAAuB,CAAC,CAAC;IAAC,CAAC;AACxG,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;WACjC,IAAI,CAAC,cAAc,KAAK,yBAAyB;WACjD,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;WACrD,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa,CAAC;WAC5D,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;WAC7G,CAAC,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;WAC5G,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC;WACvG,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;WACxG,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;WACnH,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,UAAU,IAAI,IAAI,CAAC,kBAAkB,KAAK,WAAW,CAAC;WACvH,CAAC,IAAI,CAAC,wBAAwB,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,wBAAwB,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;WAC3J,CAAC,IAAI,CAAC,0BAA0B,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,0BAA0B,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;WACjJ,CAAC,IAAI,CAAC,qBAAqB,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,qBAAqB,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;AAC1J,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,IAAI,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9G,SAAS,eAAe,CAAC,KAAc,IAAI,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACxH,SAAS,YAAY,CAAC,KAAc,IAAI,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAChI,SAAS,cAAc,CAAC,KAAc,IAAI,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAElH,MAAM,UAAU,uBAAuB,CAAC,IAAI,GAAG,eAAe,EAAE;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;QACzF,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAoB,EAAE,KAAkC,EAAE,IAAI,GAAG,eAAe,EAAE;IACzH,MAAM,KAAK,GAAwB;QACjC,cAAc,EAAE,yBAAyB;QACzC,oBAAoB,EAAE,YAAY,EAAE;QACpC,KAAK;QACL,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC;QAChD,YAAY,EAAE,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC;QACjD,cAAc,EAAE,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;QACrH,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,kBAAkB,EAAE,MAAM,CAAC,iBAAiB,KAAK,UAAU,IAAI,MAAM,CAAC,iBAAiB,KAAK,MAAM,IAAI,MAAM,CAAC,iBAAiB,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI;QAClL,kBAAkB,EAAE,MAAM,CAAC,iBAAiB,KAAK,UAAU,IAAI,MAAM,CAAC,iBAAiB,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI;QACzI,wBAAwB,EAAE,YAAY,CAAC,MAAM,CAAC,sBAAsB,CAAC;QACrE,0BAA0B,EAAE,cAAc,CAAC,MAAM,CAAC,uBAAuB,CAAC;QAC1E,qBAAqB,EAAE,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC;KAC/D,CAAC;IACF,eAAe,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lifecycle.d.ts

@@ -0,0 +1,50 @@
+import { renderAgentPolicy } from './agent-policy.js';
+import { type IntegrationManifestEntry, type SupportedClientFamily } from './integrations.js';
+import { type VectleConfig } from './store.js';
+export type LifecycleOptions = {
+    client: SupportedClientFamily;
+    stateRoot: string;
+    adapterEntryId: string;
+    integrationManifestDigest: `sha256:${string}`;
+    policyChecksum?: `sha256:${string}`;
+    config?: VectleConfig;
+    now?: () => number;
+};
+export type HookState = {
+    schema_version: 'hook-state-v1';
+    client_family: SupportedClientFamily;
+    adapter_entry_id: string;
+    policy_version: 'agent-policy-v1';
+    policy_variant: ReturnType<typeof renderAgentPolicy>['variant'];
+    policy_checksum: `sha256:${string}`;
+    integration_manifest_digest: `sha256:${string}`;
+    executed_at: string;
+};
+export declare function readHookState(root: string, adapterEntryId: string): HookState | null;
+export declare function runLifecycle(options: LifecycleOptions): Promise<{
+    schema_version: "lifecycle-gate-v1";
+    status: "blocked";
+    client_family: SupportedClientFamily;
+    adapter_entry_id: null;
+    policy_variant: import("./agent-policy.js").PolicyVariant;
+    policy_checksum: `sha256:${string}`;
+    hook_state: null;
+    reason_code: string;
+    instructions: string;
+} | {
+    schema_version: "lifecycle-gate-v1";
+    status: "invoked";
+    client_family: SupportedClientFamily;
+    adapter_entry_id: string;
+    policy_variant: import("./agent-policy.js").PolicyVariant;
+    policy_checksum: `sha256:${string}`;
+    hook_state: HookState;
+    instructions: string;
+}>;
+export declare function validateManagedMcpBinding(options: {
+    client: SupportedClientFamily;
+    stateRoot: string;
+    adapterEntryId: string;
+    integrationManifestDigest: string;
+    config: VectleConfig;
+}): IntegrationManifestEntry;