@vibe-commit/capture 0.1.0

package/dist/copy/strings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strings.js","sourceRoot":"","sources":["../../src/copy/strings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC,qFAAqF;AACrF,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,KAAK,EAAE,gCAAgC;IACvC,OAAO,EAAE,gEAAgE;IACzE,QAAQ,EAAE;QACR,OAAO,EAAE,oDAAoD;QAC7D,MAAM,EAAE,sEAAsE;QAC9E,GAAG,EAAE,+BAA+B;QACpC,4EAA4E;QAC5E,GAAG,EAAE,sFAAsF;QAC3F,MAAM,EAAE,gDAAgD;KACzD;IACD,OAAO,EAAE,2CAA2C;CAC5C,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,UAAU,EAAE,QAAQ;IACpB,aAAa,EAAE,WAAW;IAC1B,SAAS,EAAE,OAAO;IAClB,iFAAiF;IACjF,cAAc,EAAE,CAAC,IAAY,EAAU,EAAE,CAAC,oBAAoB,IAAI,EAAE;CAC5D,CAAC;AAEX,oCAAoC;AACpC,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,SAAS,EAAE,oCAAoC;IAC/C,UAAU,EAAE,qCAAqC;IACjD,SAAS,EAAE,mCAAmC;IAC9C;;;;;OAKG;IACH,SAAS,EAAE,MAAM;IACjB,gBAAgB,EAAE,WAAW;IAC7B,cAAc,EAAE,WAAW;IAC3B,yDAAyD;IACzD,YAAY,EAAE,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE,CAAC,GAAG,IAAI,kBAAkB,IAAI,GAAG;IACtF,kFAAkF;IAClF,gBAAgB,EAAE,CAAC,GAAW,EAAE,GAAW,EAAU,EAAE,CAAC,GAAG,GAAG,UAAU,GAAG,EAAE;IAC7E,eAAe,EAAE,mBAAmB;IACpC,iEAAiE;IACjE,YAAY,EAAE,gCAAgC;IAC9C,WAAW,EAAE,kCAAkC;CACvC,CAAC;AAEX;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,wEAAwE;IACxE;;;;;OAKG;IACH,cAAc,EAAE,gEAAgE;IAChF;;;;;;;;OAQG;IACH,aAAa,EACX,gOAAgO;IAClO;;;;;;;;;;;;;OAaG;IACH,eAAe,EACb,0NAA0N;IAC5N;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyDG;IACH,cAAc,EACZ,0VAA0V;IAC5V,8EAA8E;IAC9E,gBAAgB,EAAE,qBAAqB;IACvC;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,+BAA+B;IACnD,aAAa,EAAE,WAAW;IAC1B,QAAQ,EAAE,sCAAsC;IAChD,SAAS,EAAE,yBAAyB;IACpC,WAAW,EAAE,YAAY;IACzB,YAAY,EAAE,mBAAmB;IAEjC,mCAAmC;IACnC,4EAA4E;IAC5E,cAAc,EAAE,OAAO;IACvB,0DAA0D;IAC1D,kBAAkB,EAAE,wCAAwC;IAC5D,iBAAiB,EACf,wHAAwH;IAC1H,iBAAiB,EAAE,yBAAyB;IAC5C,gBAAgB,EAAE,4CAA4C;IAC9D;;;;OAIG;IACH,oBAAoB,EAAE,wCAAwC;IAC9D,mBAAmB,EACjB,6GAA6G;IAC/G,mBAAmB,EAAE,kCAAkC;IACvD,uBAAuB,EAAE,2BAA2B;IAEpD,qEAAqE;IACrE,sDAAsD;IACtD,WAAW,EAAE,CAAC,IAAY,EAAU,EAAE,CAAC,qBAAqB,IAAI,uBAAuB;IACvF,SAAS,EAAE,SAAS;IACpB;;;;OAIG;IACH,gBAAgB,EAAE,uDAAuD;IACzE,eAAe,EACb,mKAAmK;IACrK,eAAe,EAAE,8CAA8C;IAE/D,yEAAyE;IACzE;;;;;;;;;;OAUG;IACH,WAAW,EAAE,0CAA0C;IACvD;;;;;;;;OAQG;IACH,UAAU,EAAE,CAAC,IAAY,EAAU,EAAE,CACnC,GAAG,IAAI,sEAAsE;IAC/E;;;;;;;;;OASG;IACH,eAAe,EAAE,2BAA2B;IAC5C;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE,CAAC,MAAc,EAAU,EAAE,CAC1C,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,mBAAmB,MAAM,UAAU;IAC/E,wFAAwF;IACxF,eAAe,EACb,iHAAiH;IACnH,iBAAiB,EAAE,WAAW;IAC9B,gFAAgF;IAChF,YAAY,EAAE,CAAC,IAAY,EAAU,EAAE,CAAC,wBAAwB,IAAI,GAAG;CAC/D,CAAC;AAEX;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,SAAS,EAAE,CAAC,IAAY,EAAU,EAAE,CAClC,wCAAwC,IAAI,wGAAwG;IACtJ,OAAO,EAAE,CAAC,IAAY,EAAU,EAAE,CAChC,wCAAwC,IAAI,mGAAmG;IACjJ,OAAO,EAAE,+CAA+C;IACxD,QAAQ,EAAE,kHAAkH;IAC5H,aAAa,EAAE,uDAAuD;IACtE,YAAY,EAAE,CAAC,UAAkB,EAAU,EAAE,CAC3C,8CAA8C,UAAU,oJAAoJ;IAC9M,iBAAiB,EAAE,kBAAkB;IACrC,iBAAiB,EAAE,mCAAmC;IACtD,kBAAkB,EAAE,mEAAmE;IACvF,UAAU,EAAE,uDAAuD;IACnE,SAAS,EAAE,CAAC,GAAW,EAAU,EAAE,CACjC,4CAA4C,GAAG,iEAAiE;CAC1G,CAAC;AAEX,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,WAAW,EAAE,gDAAgD;IAC7D,UAAU,EAAE,CAAC,QAAgB,EAAU,EAAE,CACvC,2CAA2C,QAAQ,8NAA8N;IACnR,UAAU,EAAE,+CAA+C;IAC3D,SAAS,EACP,uIAAuI;IACzI,QAAQ,EAAE,kBAAkB;IAC5B;;;;OAIG;IACH,UAAU,EAAE,8DAA8D;IAC1E,iEAAiE;IACjE,UAAU,EAAE,+BAA+B;IAC3C,cAAc,EAAE,0BAA0B;IAC1C;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,wDAAwD;CAC3D,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,8EAA8E;IAC9E,OAAO,EAAE,kCAAkC;IAC3C;;;OAGG;IACH,WAAW,EAAE,qCAAqC;IAClD,OAAO,EAAE,0BAA0B;IACnC,IAAI,EAAE,YAAY;IAElB,qEAAqE;IACrE,WAAW,EAAE,gEAAgE;IAC7E,cAAc,EAAE,kEAAkE;IAElF,iEAAiE;IACjE,YAAY,EAAE,gDAAgD;IAC9D,gFAAgF;IAChF,sBAAsB,EACpB,4HAA4H;IAC9H,gFAAgF;IAChF,oBAAoB,EAClB,mGAAmG;IACrG;;;OAGG;IACH,kBAAkB,EAChB,kIAAkI;IACpI,WAAW,EAAE,8BAA8B;IAE3C,UAAU,EAAE,uBAAuB;IACnC,SAAS,EAAE,2FAA2F;IACtG,SAAS,EAAE,oBAAoB;IAE/B,WAAW,EAAE,iCAAiC;IAC9C,UAAU,EACR,yFAAyF;IAC3F,UAAU,EAAE,oBAAoB;IAEhC,YAAY,EAAE,0CAA0C;IACxD;;;;;OAKG;IACH,WAAW,EAAE,2DAA2D;IACxE,WAAW,EAAE,wCAAwC;IAErD,eAAe,EAAE,iDAAiD;IAClE,cAAc,EAAE,oEAAoE;IACpF,cAAc,EAAE,iCAAiC;IAEjD,aAAa,EAAE,oDAAoD;IACnE,YAAY,EAAE,+EAA+E;IAC7F,YAAY,EAAE,wCAAwC;IAEtD,uDAAuD;IACvD,eAAe,EAAE,oCAAoC;IAErD,sEAAsE;IACtE;;;;;;;;;;;;OAYG;IACH,WAAW,EAAE,mCAAmC;IAChD,UAAU,EACR,6HAA6H;IAC/H,UAAU,EAAE,4CAA4C;IACxD;;;;;;OAMG;IACH,QAAQ,EAAE,gEAAgE;IAC1E,OAAO,EACL,8IAA8I;IAChJ,OAAO,EAAE,2BAA2B;CAC5B,CAAC;AAEX,wBAAwB;AACxB,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,IAAI,EAAE,qCAAqC;IAC3C,UAAU,EAAE,8CAA8C;IAC1D,IAAI,EAAE,2CAA2C;CACzC,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,qEAAqE;IACrE;;;;;;;;;;OAUG;IACH,UAAU,EAAE,CAAC,IAAY,EAAU,EAAE,CAAC,sBAAsB,IAAI,kBAAkB;IAElF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,mBAAmB,EACjB,+KAA+K;IAEjL;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,EACd,4KAA4K;IAE9K,uDAAuD;IACvD,SAAS,EAAE,MAAM;IACjB,gFAAgF;IAChF,aAAa,EAAE,GAAG;IAElB,wDAAwD;IACxD,8EAA8E;IAC9E,cAAc,EAAE,CAAC,OAAe,EAAU,EAAE,CAAC,eAAe,OAAO,EAAE;IACrE;;;;;;;;;OASG;IACH,mBAAmB,EAAE,CAAC,KAAa,EAAU,EAAE,CAC7C,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,cAAc,KAAK,oBAAoB;IACzF;;;;;OAKG;IACH,qBAAqB,EAAE,sBAAsB;IAE7C;;;;;;;;OAQG;IACH,eAAe,EAAE,wDAAwD;IACzE;;;;;OAKG;IACH,cAAc,EACZ,gJAAgJ;IAClJ;;;;;OAKG;IACH,sBAAsB,EACpB,oFAAoF;IACtF,cAAc,EAAE,kFAAkF;IAElG,uEAAuE;IACvE;;;;;;;;;OASG;IACH,UAAU,EAAE,CAAC,IAAY,EAAE,EAAU,EAAE,KAAa,EAAU,EAAE,CAC9D,iBAAiB,IAAI,IAAI,EAAE,OAAO,KAAK,wDAAwD;IACjG,0FAA0F;IAC1F,gBAAgB,EAAE,CAAC,KAAa,EAAU,EAAE,CAC1C,GAAG,KAAK,iDAAiD;IAC3D,iFAAiF;IACjF,eAAe,EAAE,gDAAgD;IAEjE,gEAAgE;IAChE,SAAS,EAAE,8CAA8C;IACzD,QAAQ,EACN,kGAAkG;IACpG,QAAQ,EAAE,6BAA6B;IAEvC;;;;;;;;;;;;;;OAcG;IAEH;;;;;;;;;OASG;IACH,WAAW,EAAE,iEAAiE;IAC9E,UAAU,EACR,yLAAyL;IAC3L,UAAU,EAAE,8CAA8C;IAC1D,iBAAiB,EAAE,uBAAuB;IAE1C,8EAA8E;IAC9E,SAAS,EAAE,4CAA4C;IACvD,QAAQ,EACN,0IAA0I;IAC5I,QAAQ,EAAE,mDAAmD;IAE7D,mFAAmF;IACnF;;;;;;;OAOG;IACH,eAAe,EAAE,gDAAgD;IACjE,cAAc,EACZ,wHAAwH;IAC1H,eAAe,EAAE,2CAA2C;IAC5D,cAAc,EACZ,qHAAqH;IACvH,aAAa,EAAE,iEAAiE;IAChF,YAAY,EACV,4HAA4H;IAC9H,OAAO,EAAE,2CAA2C;IAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,QAAQ,EAAE,oEAAoE;IAC9E,OAAO,EACL,0MAA0M;IAC5M,OAAO,EAAE,qFAAqF;IAE9F,yEAAyE;IACzE,aAAa,EAAE,8CAA8C;IAC7D,YAAY,EACV,2FAA2F;IAC7F,YAAY,EAAE,sCAAsC;CAC5C,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,aAAa,EAAE,iCAAiC;IAChD,aAAa,EAAE,UAAU;IAEzB,2EAA2E;IAC3E;;;;;;;;;;OAUG;IACH,UAAU,EAAE,CAAC,GAAW,EAAU,EAAE,CAClC,qGAAqG,GAAG,GAAG;IAC7G,IAAI,EAAE,CAAC,SAAiB,EAAE,IAAY,EAAE,GAAW,EAAE,OAAe,EAAU,EAAE,CAC9E,GAAG,SAAS,OAAO,IAAI,6DAA6D,GAAG,KAAK,OAAO,KAAK;IAC1G,4DAA4D;IAC5D,aAAa,EAAE,WAAW;IAE1B;;;;;;;;;;;;;;;OAeG;IACH,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,+BAA+B;IAC/B,iBAAiB,EAAE,4BAA4B;IAC/C,kBAAkB,EAAE,gCAAgC;IACpD,kBAAkB,EAAE,uBAAuB;IAC3C,6EAA6E;IAC7E,UAAU,EAAE,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE;IAEzE;;;;;;;;;;;;OAYG;IACH,QAAQ,EAAE,CAAC,KAAa,EAAU,EAAE,CAClC,GAAG,KAAK,uEAAuE;IACjF,WAAW,EAAE,wEAAwE;IAErF,2EAA2E;IAC3E;;;;;;;;OAQG;IACH,WAAW,EAAE,+DAA+D;IAC5E,UAAU,EACR,yKAAyK;IAE3K;;;;;OAKG;IACH,uBAAuB,EAAE,2DAA2D;IACpF,sBAAsB,EACpB,0KAA0K;IAC5K,sBAAsB,EAAE,8CAA8C;IAEtE,OAAO,EAAE,uCAAuC;IAChD,MAAM,EACJ,4IAA4I;IAC9I,MAAM,EAAE,eAAe;IAEvB;;;;;;;OAOG;IACH,MAAM,EAAE,CAAC,KAAa,EAAU,EAAE,CAAC,oBAAoB,KAAK,EAAE;IAE9D,SAAS,EAAE,kCAAkC;IAC7C,QAAQ,EACN,+HAA+H;IACjI,QAAQ,EAAE,kCAAkC;IAE5C,SAAS,EAAE,oCAAoC;IAC/C,QAAQ,EACN,oHAAoH;IACtH,QAAQ,EAAE,+BAA+B;CACjC,CAAC;AA4HX,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,SAAS,EAAE;QACT,IAAI,EAAE,uDAAuD;QAC7D,GAAG,EAAE,uHAAuH;QAC5H,GAAG,EAAE,8CAA8C;QACnD,IAAI,EAAE,IAAI,CAAC,KAAK;KACjB;IAED;;;;;;;;OAQG;IACH,MAAM,EAAE;QACN,IAAI,EAAE,+CAA+C;QACrD,GAAG,EAAE,2JAA2J;QAChK,GAAG,EAAE,sEAAsE;QAC3E,IAAI,EAAE,IAAI,CAAC,KAAK;KACjB;IAED;;;;;;;;OAQG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,CAAC,GAAW,EAAE,MAAc,EAAU,EAAE,CAAC,iBAAiB,GAAG,OAAO,MAAM,GAAG;QACnF,GAAG,EAAE,CAAC,GAAW,EAAU,EAAE,CAC3B,4EAA4E,GAAG,6CAA6C;QAC9H,GAAG,EAAE,gEAAgE;QACrE,IAAI,EAAE,IAAI,CAAC,KAAK;KACjB;IAED;;;;;;;OAOG;IACH,gBAAgB,EAAE;QAChB,IAAI,EAAE,CAAC,KAAa,EAAE,MAAc,EAAU,EAAE,CAC9C,gCAAgC,KAAK,eAAe,MAAM,GAAG;QAC/D,GAAG,EAAE,gIAAgI;QACrI,GAAG,EAAE,sFAAsF;QAC3F,IAAI,EAAE,IAAI,CAAC,KAAK;KACjB;IAED;;;;;;;;OAQG;IACH,cAAc,EAAE;QACd,IAAI,EAAE,CAAC,MAAc,EAAE,QAAgB,EAAU,EAAE,CACjD,8BAA8B,MAAM,8CAA8C,QAAQ,GAAG;QAC/F,GAAG,EAAE,CAAC,MAAc,EAAU,EAAE,CAC9B,uDAAuD,MAAM,sHAAsH,MAAM,GAAG;QAC9L,GAAG,EAAE,wEAAwE;QAC7E,IAAI,EAAE,IAAI,CAAC,KAAK;KACjB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,cAAc,EAAE;QACd,IAAI,EAAE,sFAAsF;QAC5F,GAAG,EAAE,mPAAmP;QACxP,GAAG,EAAE,iKAAiK;QACtK,IAAI,EAAE,IAAI,CAAC,KAAK;KACjB;CACkE,CAAC;AAEtE,iFAAiF;AACjF,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,yCAAyC;AAEzC,yEAAyE;AACzE,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,YAAY,EAAE,6DAA6D;IAC3E,YAAY,EAAE,6EAA6E;IAC3F,SAAS,EAAE,2EAA2E;IACtF,YAAY,EAAE,4DAA4D;IAC1E,WAAW,EAAE,uBAAuB;CAC5B,CAAC;AAEX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,cAAc,EAAE,4CAA4C;IAC5D,aAAa,EAAE,6BAA6B;IAC5C,aAAa,EAAE,2CAA2C;IAC1D,sBAAsB,EAAE,yCAAyC;CACzD,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,cAAc,EAAE,kEAAkE;IAClF,gBAAgB,EACd,yGAAyG;IAC3G,iBAAiB,EACf,yFAAyF;IAC3F,aAAa,EAAE,mBAAmB;IAElC,gBAAgB,EAAE,oEAAoE;IACtF,oBAAoB,EAAE,MAAM;IAC5B,qBAAqB,EAAE,MAAM;IAC7B,eAAe,EAAE,wEAAwE;IACzF,eAAe,EAAE,mCAAmC;IAEpD,cAAc,EAAE,wCAAwC;IACxD,aAAa,EAAE,mEAAmE;IAClF,aAAa,EAAE,6BAA6B;CACpC,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,SAAS,EAAE,gCAAgC;IAC3C,cAAc,EAAE,4BAA4B;IAC5C,cAAc,EAAE,iCAAiC;IACjD,QAAQ,EAAE,yBAAyB;CAC3B,CAAC;AAEX;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,YAAY,EACV,yFAAyF;IAC3F,iBAAiB,EACf,8FAA8F;IAChG,8DAA8D;IAC9D,kBAAkB,EAAE,CAAC,KAAa,EAAE,OAAe,EAAU,EAAE,CAC7D,yBAAyB,KAAK,wCAAwC,OAAO,8BAA8B;IAC7G;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,YAAoB,EAAU,EAAE,CACjD,qCAAqC,YAAY,EAAE;CAC7C,CAAC;AAEX;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,6EAA6E;IAC7E,IAAI,EAAE,CAAC,KAAa,EAAU,EAAE,CAAC,iBAAiB,KAAK,iBAAiB;IACxE,8DAA8D;IAC9D,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;IACT,gDAAgD;IAChD,KAAK,EAAE,eAAe;CACd,CAAC;AAEX,iFAAiF;AACjF,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,OAAO,EAAE,oBAAoB;IAC7B,4FAA4F;IAC5F,MAAM,EAAE,8BAA8B;IACtC,MAAM,EAAE,mBAAmB;IAC3B;;;OAGG;IACH,MAAM,EAAE,sCAAsC;IAC9C,mDAAmD;IACnD,SAAS,EAAE,iDAAiD;IAC5D,GAAG,EAAE,gBAAgB;IACrB;;;;;;;OAOG;IACH,GAAG,EAAE,uCAAuC;IAC5C,gBAAgB,EAAE,0CAA0C;IAC5D;;;;;;;;;;;;;;;OAeG;IACH,aAAa,EAAE,+CAA+C;CACtD,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,SAAS,EAAE,2BAA2B;IACtC,QAAQ,EAAE,oCAAoC;IAC9C;;;;;;;;;;OAUG;IACH,OAAO,EAAE,mCAAmC;IAC5C;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,mDAAmD;IAClE;;;;;;;;;;;;;OAaG;IACH,YAAY,EAAE,8CAA8C;CACpD,CAAC"}

package/dist/copy/time.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Relative ages, for the one row that has one — `CR-021`, style guide §10.3.
+ *
+ * In `copy/` and not in a command body because it produces USER-FACING TEXT,
+ * which is the whole rule this directory exists for (`strings.ts`'s header): a
+ * quoted string inside a verb is the CR-090 precondition-1 violation. It is a
+ * function rather than a constant for the same reason `unsupportedRuntime` is —
+ * the sentence is templated on a value.
+ *
+ * No `Intl.RelativeTimeFormat`. Its output is locale-dependent, and §13.4's rule
+ * that identical commands emit identical bytes is what makes screenshots, issue
+ * pastes and golden-file tests comparable. A fixed English phrase is the same
+ * choice `renderHelp` already makes by never reflowing to `stdout.columns`.
+ */
+/**
+ * How long ago `thenMs` was, as one phrase.
+ *
+ * Deliberately coarse: the caller is a human asking "is capture working?", and a
+ * second-precision answer invites a precision the record does not have — the
+ * stamp is written when the client's POST returned, not when the server sealed
+ * the turn.
+ *
+ * A future timestamp (a clock that moved backwards, a state file copied between
+ * machines) reads as `just now` rather than as a negative age. It is the one
+ * answer that is never wrong in a way that misleads.
+ */
+export declare function relativeAge(thenMs: number, nowMs: number): string;

package/dist/copy/time.js

@@ -0,0 +1,43 @@
+/**
+ * Relative ages, for the one row that has one — `CR-021`, style guide §10.3.
+ *
+ * In `copy/` and not in a command body because it produces USER-FACING TEXT,
+ * which is the whole rule this directory exists for (`strings.ts`'s header): a
+ * quoted string inside a verb is the CR-090 precondition-1 violation. It is a
+ * function rather than a constant for the same reason `unsupportedRuntime` is —
+ * the sentence is templated on a value.
+ *
+ * No `Intl.RelativeTimeFormat`. Its output is locale-dependent, and §13.4's rule
+ * that identical commands emit identical bytes is what makes screenshots, issue
+ * pastes and golden-file tests comparable. A fixed English phrase is the same
+ * choice `renderHelp` already makes by never reflowing to `stdout.columns`.
+ */
+const MINUTE_MS = 60_000;
+const HOUR_MS = 60 * MINUTE_MS;
+const DAY_MS = 24 * HOUR_MS;
+/**
+ * How long ago `thenMs` was, as one phrase.
+ *
+ * Deliberately coarse: the caller is a human asking "is capture working?", and a
+ * second-precision answer invites a precision the record does not have — the
+ * stamp is written when the client's POST returned, not when the server sealed
+ * the turn.
+ *
+ * A future timestamp (a clock that moved backwards, a state file copied between
+ * machines) reads as `just now` rather than as a negative age. It is the one
+ * answer that is never wrong in a way that misleads.
+ */
+export function relativeAge(thenMs, nowMs) {
+    const elapsed = nowMs - thenMs;
+    if (elapsed < MINUTE_MS)
+        return "just now";
+    if (elapsed < HOUR_MS)
+        return plural(Math.floor(elapsed / MINUTE_MS), "minute");
+    if (elapsed < DAY_MS)
+        return plural(Math.floor(elapsed / HOUR_MS), "hour");
+    return plural(Math.floor(elapsed / DAY_MS), "day");
+}
+function plural(count, unit) {
+    return `${count} ${unit}${count === 1 ? "" : "s"} ago`;
+}
+//# sourceMappingURL=time.js.map

package/dist/copy/time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.js","sourceRoot":"","sources":["../../src/copy/time.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,MAAM,OAAO,GAAG,EAAE,GAAG,SAAS,CAAC;AAC/B,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC;AAE5B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,KAAa;IACvD,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;IAC/B,IAAI,OAAO,GAAG,SAAS;QAAE,OAAO,UAAU,CAAC;IAC3C,IAAI,OAAO,GAAG,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;IAChF,IAAI,OAAO,GAAG,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,IAAY;IACzC,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AACzD,CAAC"}

package/dist/credential.d.ts

@@ -0,0 +1,211 @@
+/**
+ * The ingest credential — load, carry, redact.
+ *
+ * THE INVARIANT, and the whole reason `/cso` is mandatory on this file: the
+ * credential is an **opaque secret**. Never parse it. Never log it.
+ *
+ * It is NOT a JWT and must never be treated as one. W2 (`CR-009`/`CR-010`/
+ * `CR-011`) found that a `vcik_` token already fails at `/mcp` for an entirely
+ * incidental reason — base64url has no dots, so the JWT verifier rejects it
+ * before any audience check runs. Any client that "validates" the credential by
+ * decomposing it inherits that trap: it would appear to work while checking
+ * something else entirely.
+ *
+ * ## How the plaintext is kept out of logs
+ *
+ * A bare `string` leaks through every ordinary path: template interpolation,
+ * `JSON.stringify`, `console.error(obj)`, an unhandled rejection whose message
+ * embedded it. So the plaintext never travels as a bare string — it travels
+ * inside `IngestCredential`, whose `toString`, `toJSON` and Node inspect hook
+ * all render `vcik_…redacted`. Reaching the plaintext requires calling
+ * `expose()`, which is deliberately ugly and greppable.
+ *
+ * That is a real control, not a ceremony: `test/credential.test.ts` proves it can
+ * go red by asserting each redaction path against the raw secret.
+ *
+ * ## Precedence
+ *
+ * `VIBECOMMIT_TOKEN` is read **BEFORE** `~/.vibecommit/credentials.json`, for
+ * headless and CI use (D56 plan, founder call).
+ *
+ * Wire contract retyped from `vibecommit-mcp/src/oauth/ingest_credential.ts`
+ * (prefix, opacity, no rotation). Nothing is imported from that package and
+ * nothing may be: it is closed source and this package is MIT (D60 §D1a).
+ *
+ * @provenance vibecommit-mcp src/oauth/ingest_credential.ts — wire contract, retyped
+ */
+/**
+ * Retyped from `INGEST_CREDENTIAL_TOKEN_PREFIX` in the closed-source server.
+ * Its job there is to make a leaked credential greppable and to keep a plaintext
+ * from ever being mistaken for a hex digest. Its job HERE is narrower: refuse to
+ * put a credential of the wrong class on the ingest lane.
+ */
+export declare const INGEST_TOKEN_PREFIX = "vcik_";
+/** What a redacted credential renders as. Contains no bytes of the secret. */
+export declare const REDACTED = "vcik_\u2026redacted";
+/**
+ * An opaque ingest credential.
+ *
+ * Every ordinary way of turning a value into text renders `REDACTED`. The
+ * plaintext leaves only through `expose()`.
+ */
+export declare class IngestCredential {
+    #private;
+    /** Where it came from. Safe to log — names a source, not a value. */
+    readonly source: CredentialSource;
+    constructor(secret: string, source: CredentialSource);
+    /** The plaintext. The ONLY exit. Call this at the request boundary, nowhere else. */
+    expose(): string;
+    toString(): string;
+    toJSON(): string;
+    get [Symbol.toStringTag](): string;
+}
+export type CredentialSource = "env" | "file";
+export type CredentialLoad = {
+    readonly kind: "ok";
+    readonly credential: IngestCredential;
+} | {
+    readonly kind: "absent";
+}
+/**
+ * Present but not an ingest credential. Refused CLIENT-side and never sent:
+ * a control-plane token put on the data plane would be a privilege class
+ * crossing a lane boundary, and the fact that the server's audience wall
+ * (`CR-010`) would also reject it is defence in depth, not a reason to try.
+ */
+ | {
+    readonly kind: "wrong-class";
+    readonly source: CredentialSource;
+}
+/** File exists but is readable by group or other. Refused rather than used. */
+ | {
+    readonly kind: "insecure-file";
+    readonly path: string;
+    readonly mode: string;
+} | {
+    readonly kind: "unreadable";
+    readonly path: string;
+};
+export interface CredentialEnvironment {
+    readonly env: NodeJS.ProcessEnv;
+    readonly home: string;
+}
+/** What `readSecretFile` returns. The two not-ok cases are `CredentialLoad`'s. */
+export type SecretFileRead = {
+    readonly kind: "ok";
+    readonly raw: string;
+} | {
+    readonly kind: "absent";
+} | {
+    readonly kind: "insecure-file";
+    readonly path: string;
+    readonly mode: string;
+};
+/**
+ * Read a file under `~/.vibecommit/` that holds a secret, refusing an insecure
+ * one — **the two checks the human lane INHERITS rather than copies**.
+ *
+ * It was inline in `loadCredential` while the ingest credential was the only
+ * secret on disk. `CR-084d` adds a second (the refresh token), and a second copy
+ * of a security check is a second thing to forget when the first one changes —
+ * so it is one function with two callers instead.
+ *
+ * `/cso` finding 3 (2026-08-09), MEDIUM, is the DIRECTORY half. The FILE's mode
+ * was checked and the directory's was not, and the directory is the one that
+ * matters for the interesting attack: a second local account cannot read a 0600
+ * credentials.json, but with a writable `~/.vibecommit` it can unlink it and
+ * drop in its own 0600 file. The victim's next hook then uploads their whole
+ * transcript stream into the attacker's org. `grantProject` chmods the directory
+ * to 0700 on first write, so a clean install is fine — this covers the directory
+ * that already existed.
+ */
+export declare function readSecretFile(home: string, path: string): SecretFileRead;
+/**
+ * Load the ingest credential. `VIBECOMMIT_TOKEN` first, then the credentials
+ * file.
+ *
+ * Returns a discriminated union rather than throwing: the hook path must not
+ * take an exception for a missing credential, and the interactive path wants to
+ * distinguish the four not-ok outcomes to print four different fixes.
+ */
+export declare function loadCredential(ctx: CredentialEnvironment): CredentialLoad;
+/**
+ * Belt and braces for the `inspect` path specifically.
+ *
+ * `util.inspect` honours the custom symbol on the instance, but a credential
+ * nested inside a plain object that someone stringifies with `%o` should also
+ * come out redacted. Exposed so tests can assert it rather than assume it.
+ */
+export declare function describeCredential(value: unknown): string;
+/** What a redacted refresh token renders as. Contains no bytes of the secret. */
+export declare const REDACTED_REFRESH = "refresh\u2026redacted";
+/** What a redacted access token renders as. Contains no bytes of the secret. */
+export declare const REDACTED_ACCESS = "access\u2026redacted";
+/**
+ * The base of both user-principal token types.
+ *
+ * A shared base rather than two copies: every redaction path is defined once, so
+ * a fifth rendering path discovered later is closed for both at once. The marker
+ * is per-subclass because a redacted string that could not say WHICH token it
+ * stood for would make a log line ambiguous exactly when someone is debugging an
+ * auth failure.
+ */
+declare abstract class OpaqueToken {
+    #private;
+    protected constructor(secret: string);
+    protected abstract marker(): string;
+    /** The plaintext. The ONLY exit. Call this at the request boundary, nowhere else. */
+    expose(): string;
+    toString(): string;
+    toJSON(): string;
+    get [Symbol.toStringTag](): string;
+}
+/**
+ * The long-lived half of the human lane: rotated on every use, 90-day family cap.
+ *
+ * ⚠ Presenting one twice is a REPLAY to the server and revokes the whole family
+ * (`refresh.ts`'s `reuse_detected`). That is why `oauth/lock.ts` exists — see
+ * its module note, which is the single most consequential comment in this task.
+ */
+export declare class RefreshToken extends OpaqueToken {
+    constructor(secret: string);
+    protected marker(): string;
+}
+/**
+ * The short-lived half: an RS256 JWT, `aud` = the `/mcp` audience, ~900 seconds.
+ *
+ * Held as an opaque token DESPITE being a JWT, and the distinction is worth
+ * stating: a JWT's payload is readable by anyone holding it, so "opaque" here is
+ * about not LOGGING it, not about not parsing it. Nothing in this client parses
+ * it — the expiry travels beside it as data from the token response, because
+ * trusting a claim inside a token to decide whether to refresh that token is
+ * asking the thing being validated to validate itself.
+ */
+export declare class AccessToken extends OpaqueToken {
+    constructor(secret: string);
+    protected marker(): string;
+}
+/**
+ * Is this string a refresh token rather than something else in the wrong slot?
+ *
+ * The server mints it as 32 random bytes, base64url-encoded and unpadded
+ * (`refresh.ts`'s `mintRefreshToken`). It therefore has NO dots — so a JWT is
+ * refused — and it does not carry the ingest prefix, so a `vcik_` is refused.
+ *
+ * ⚠ This is a CLASS check, not a validity check. It answers "is this the right
+ * KIND of secret for this slot", which is a question the client can answer
+ * locally; whether the token is live is the server's answer and is never guessed
+ * here. Same discipline as the ingest credential: never parse the secret.
+ */
+export declare function isRefreshTokenShape(value: string): boolean;
+/**
+ * Is this string an access token rather than something else in the wrong slot?
+ *
+ * Three non-empty dot-separated base64url segments — the JWS Compact
+ * Serialization shape (RFC 7515 §3.1). This is the mirror of the trap recorded
+ * at the top of this file: a `vcik_` is base64url with NO dots, so it fails here
+ * for the same structural reason it fails the server's JWT verifier, and it
+ * cannot be smuggled into the bearer position of a read.
+ */
+export declare function isAccessTokenShape(value: string): boolean;
+export {};

package/dist/credential.js

@@ -0,0 +1,298 @@
+/**
+ * The ingest credential — load, carry, redact.
+ *
+ * THE INVARIANT, and the whole reason `/cso` is mandatory on this file: the
+ * credential is an **opaque secret**. Never parse it. Never log it.
+ *
+ * It is NOT a JWT and must never be treated as one. W2 (`CR-009`/`CR-010`/
+ * `CR-011`) found that a `vcik_` token already fails at `/mcp` for an entirely
+ * incidental reason — base64url has no dots, so the JWT verifier rejects it
+ * before any audience check runs. Any client that "validates" the credential by
+ * decomposing it inherits that trap: it would appear to work while checking
+ * something else entirely.
+ *
+ * ## How the plaintext is kept out of logs
+ *
+ * A bare `string` leaks through every ordinary path: template interpolation,
+ * `JSON.stringify`, `console.error(obj)`, an unhandled rejection whose message
+ * embedded it. So the plaintext never travels as a bare string — it travels
+ * inside `IngestCredential`, whose `toString`, `toJSON` and Node inspect hook
+ * all render `vcik_…redacted`. Reaching the plaintext requires calling
+ * `expose()`, which is deliberately ugly and greppable.
+ *
+ * That is a real control, not a ceremony: `test/credential.test.ts` proves it can
+ * go red by asserting each redaction path against the raw secret.
+ *
+ * ## Precedence
+ *
+ * `VIBECOMMIT_TOKEN` is read **BEFORE** `~/.vibecommit/credentials.json`, for
+ * headless and CI use (D56 plan, founder call).
+ *
+ * Wire contract retyped from `vibecommit-mcp/src/oauth/ingest_credential.ts`
+ * (prefix, opacity, no rotation). Nothing is imported from that package and
+ * nothing may be: it is closed source and this package is MIT (D60 §D1a).
+ *
+ * @provenance vibecommit-mcp src/oauth/ingest_credential.ts — wire contract, retyped
+ */
+import { lstatSync, readFileSync, statSync } from "node:fs";
+import { inspect } from "node:util";
+import { credentialsPath, rootDir } from "./paths.js";
+/**
+ * Retyped from `INGEST_CREDENTIAL_TOKEN_PREFIX` in the closed-source server.
+ * Its job there is to make a leaked credential greppable and to keep a plaintext
+ * from ever being mistaken for a hex digest. Its job HERE is narrower: refuse to
+ * put a credential of the wrong class on the ingest lane.
+ */
+export const INGEST_TOKEN_PREFIX = "vcik_";
+/** What a redacted credential renders as. Contains no bytes of the secret. */
+export const REDACTED = `${INGEST_TOKEN_PREFIX}…redacted`;
+/**
+ * An opaque ingest credential.
+ *
+ * Every ordinary way of turning a value into text renders `REDACTED`. The
+ * plaintext leaves only through `expose()`.
+ */
+export class IngestCredential {
+    #secret;
+    /** Where it came from. Safe to log — names a source, not a value. */
+    source;
+    constructor(secret, source) {
+        this.#secret = secret;
+        this.source = source;
+    }
+    /** The plaintext. The ONLY exit. Call this at the request boundary, nowhere else. */
+    expose() {
+        return this.#secret;
+    }
+    toString() {
+        return REDACTED;
+    }
+    toJSON() {
+        return REDACTED;
+    }
+    [Symbol.for("nodejs.util.inspect.custom")]() {
+        return REDACTED;
+    }
+    get [Symbol.toStringTag]() {
+        return REDACTED;
+    }
+}
+/**
+ * Read a file under `~/.vibecommit/` that holds a secret, refusing an insecure
+ * one — **the two checks the human lane INHERITS rather than copies**.
+ *
+ * It was inline in `loadCredential` while the ingest credential was the only
+ * secret on disk. `CR-084d` adds a second (the refresh token), and a second copy
+ * of a security check is a second thing to forget when the first one changes —
+ * so it is one function with two callers instead.
+ *
+ * `/cso` finding 3 (2026-08-09), MEDIUM, is the DIRECTORY half. The FILE's mode
+ * was checked and the directory's was not, and the directory is the one that
+ * matters for the interesting attack: a second local account cannot read a 0600
+ * credentials.json, but with a writable `~/.vibecommit` it can unlink it and
+ * drop in its own 0600 file. The victim's next hook then uploads their whole
+ * transcript stream into the attacker's org. `grantProject` chmods the directory
+ * to 0700 on first write, so a clean install is fine — this covers the directory
+ * that already existed.
+ */
+export function readSecretFile(home, path) {
+    try {
+        const dir = rootDir(home);
+        const dirMode = statSync(dir).mode & 0o777;
+        if ((dirMode & 0o077) !== 0) {
+            return { kind: "insecure-file", path: dir, mode: dirMode.toString(8).padStart(3, "0") };
+        }
+        // `lstat`, not `stat`: `stat` follows a symlink and would report the
+        // TARGET's mode, so a link to an attacker-owned 0600 file would pass a
+        // check that exists to establish who can read this one.
+        const mode = lstatSync(path).mode & 0o777;
+        if ((mode & 0o077) !== 0) {
+            return { kind: "insecure-file", path, mode: mode.toString(8).padStart(3, "0") };
+        }
+        return { kind: "ok", raw: readFileSync(path, "utf8") };
+    }
+    catch {
+        // ENOENT is the overwhelmingly common case — not connected yet.
+        return { kind: "absent" };
+    }
+}
+/**
+ * Load the ingest credential. `VIBECOMMIT_TOKEN` first, then the credentials
+ * file.
+ *
+ * Returns a discriminated union rather than throwing: the hook path must not
+ * take an exception for a missing credential, and the interactive path wants to
+ * distinguish the four not-ok outcomes to print four different fixes.
+ */
+export function loadCredential(ctx) {
+    const fromEnv = ctx.env.VIBECOMMIT_TOKEN;
+    if (fromEnv !== undefined && fromEnv.trim() !== "") {
+        const secret = fromEnv.trim();
+        if (!secret.startsWith(INGEST_TOKEN_PREFIX)) {
+            return { kind: "wrong-class", source: "env" };
+        }
+        return { kind: "ok", credential: new IngestCredential(secret, "env") };
+    }
+    const path = credentialsPath(ctx.home);
+    const read = readSecretFile(ctx.home, path);
+    if (read.kind !== "ok")
+        return read;
+    const raw = read.raw;
+    let token;
+    try {
+        // Parsing the FILE is not parsing the CREDENTIAL. The file is our own JSON
+        // envelope; the credential is the opaque string inside it and stays opaque.
+        token = JSON.parse(raw).token;
+    }
+    catch {
+        return { kind: "unreadable", path };
+    }
+    if (typeof token !== "string" || token.trim() === "") {
+        return { kind: "unreadable", path };
+    }
+    const secret = token.trim();
+    if (!secret.startsWith(INGEST_TOKEN_PREFIX)) {
+        return { kind: "wrong-class", source: "file" };
+    }
+    return { kind: "ok", credential: new IngestCredential(secret, "file") };
+}
+/**
+ * Belt and braces for the `inspect` path specifically.
+ *
+ * `util.inspect` honours the custom symbol on the instance, but a credential
+ * nested inside a plain object that someone stringifies with `%o` should also
+ * come out redacted. Exposed so tests can assert it rather than assume it.
+ */
+export function describeCredential(value) {
+    return inspect(value, { depth: 3 });
+}
+// ---------------------------------------------------------------------------
+// CR-084d — THE SECOND SLOT: the human lane's user-principal tokens.
+//
+// One sign-in, two token classes, and they are kept apart on purpose:
+//
+//   * the OPAQUE ingest credential above (`vcik_`), long-lived, no rotation,
+//     machine-scoped, for the hook lane;
+//   * a REFRESH TOKEN and a short-lived ACCESS TOKEN below, user-scoped, for the
+//     read lane's `tools/call` against `/mcp`.
+//
+// ⚠ `loadCredential`'s `wrong-class` refusal above is NOT widened, and widening
+// it is the obvious wrong move a later reader will make. `credential.ts:96-102`
+// says why: a control-plane token on the data plane is a privilege class
+// crossing a lane, and the server's audience wall rejecting it too is defence in
+// depth rather than a reason to try. The refusal is now mirrored in BOTH
+// directions — a `vcik_` put in the refresh slot is refused just as a JWT put in
+// the ingest slot is — so neither lane can be fed the other's secret by a
+// copy-paste into the wrong file.
+//
+// ⚠ AND THE REDACTION DISCIPLINE IS NOT CEREMONY HERE EITHER — it matters MORE.
+// The module note at the top of this file lists the four leak paths a bare
+// `string` has (template interpolation, `JSON.stringify`, `console.error(obj)`,
+// an unhandled rejection whose message embedded it). A user-principal token has
+// MORE authority than an ingest credential: it reads a user's history rather
+// than appending to one org's. Shipping it as a bare string would reopen that
+// whole leak class on the more dangerous secret, so both classes below carry the
+// same four renderers and the same deliberately-ugly `expose()`.
+//
+// @provenance vibecommit-mcp src/oauth/refresh.ts — 32-byte base64url opaque refresh token, retyped
+// @provenance vibecommit-mcp src/oauth/token.ts — RFC 6749 §5.1 token response shape, retyped
+// ---------------------------------------------------------------------------
+/** What a redacted refresh token renders as. Contains no bytes of the secret. */
+export const REDACTED_REFRESH = "refresh…redacted";
+/** What a redacted access token renders as. Contains no bytes of the secret. */
+export const REDACTED_ACCESS = "access…redacted";
+/**
+ * The base of both user-principal token types.
+ *
+ * A shared base rather than two copies: every redaction path is defined once, so
+ * a fifth rendering path discovered later is closed for both at once. The marker
+ * is per-subclass because a redacted string that could not say WHICH token it
+ * stood for would make a log line ambiguous exactly when someone is debugging an
+ * auth failure.
+ */
+class OpaqueToken {
+    #secret;
+    constructor(secret) {
+        this.#secret = secret;
+    }
+    /** The plaintext. The ONLY exit. Call this at the request boundary, nowhere else. */
+    expose() {
+        return this.#secret;
+    }
+    toString() {
+        return this.marker();
+    }
+    toJSON() {
+        return this.marker();
+    }
+    [Symbol.for("nodejs.util.inspect.custom")]() {
+        return this.marker();
+    }
+    get [Symbol.toStringTag]() {
+        return this.marker();
+    }
+}
+/**
+ * The long-lived half of the human lane: rotated on every use, 90-day family cap.
+ *
+ * ⚠ Presenting one twice is a REPLAY to the server and revokes the whole family
+ * (`refresh.ts`'s `reuse_detected`). That is why `oauth/lock.ts` exists — see
+ * its module note, which is the single most consequential comment in this task.
+ */
+export class RefreshToken extends OpaqueToken {
+    constructor(secret) {
+        super(secret);
+    }
+    marker() {
+        return REDACTED_REFRESH;
+    }
+}
+/**
+ * The short-lived half: an RS256 JWT, `aud` = the `/mcp` audience, ~900 seconds.
+ *
+ * Held as an opaque token DESPITE being a JWT, and the distinction is worth
+ * stating: a JWT's payload is readable by anyone holding it, so "opaque" here is
+ * about not LOGGING it, not about not parsing it. Nothing in this client parses
+ * it — the expiry travels beside it as data from the token response, because
+ * trusting a claim inside a token to decide whether to refresh that token is
+ * asking the thing being validated to validate itself.
+ */
+export class AccessToken extends OpaqueToken {
+    constructor(secret) {
+        super(secret);
+    }
+    marker() {
+        return REDACTED_ACCESS;
+    }
+}
+/**
+ * Is this string a refresh token rather than something else in the wrong slot?
+ *
+ * The server mints it as 32 random bytes, base64url-encoded and unpadded
+ * (`refresh.ts`'s `mintRefreshToken`). It therefore has NO dots — so a JWT is
+ * refused — and it does not carry the ingest prefix, so a `vcik_` is refused.
+ *
+ * ⚠ This is a CLASS check, not a validity check. It answers "is this the right
+ * KIND of secret for this slot", which is a question the client can answer
+ * locally; whether the token is live is the server's answer and is never guessed
+ * here. Same discipline as the ingest credential: never parse the secret.
+ */
+export function isRefreshTokenShape(value) {
+    if (value === "" || value.startsWith(INGEST_TOKEN_PREFIX))
+        return false;
+    return /^[A-Za-z0-9_-]+$/.test(value);
+}
+/**
+ * Is this string an access token rather than something else in the wrong slot?
+ *
+ * Three non-empty dot-separated base64url segments — the JWS Compact
+ * Serialization shape (RFC 7515 §3.1). This is the mirror of the trap recorded
+ * at the top of this file: a `vcik_` is base64url with NO dots, so it fails here
+ * for the same structural reason it fails the server's JWT verifier, and it
+ * cannot be smuggled into the bearer position of a read.
+ */
+export function isAccessTokenShape(value) {
+    const parts = value.split(".");
+    return parts.length === 3 && parts.every((p) => /^[A-Za-z0-9_-]+$/.test(p));
+}
+//# sourceMappingURL=credential.js.map

package/dist/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../src/credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,mBAAmB,WAAW,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IAClB,OAAO,CAAS;IACzB,qEAAqE;IAC5D,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB;QAClD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,qFAAqF;IACrF,MAAM;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,QAAQ;QACN,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM;QACJ,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AA6BD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAC1F,CAAC;QACD,qEAAqE;QACrE,uEAAuE;QACvE,wDAAwD;QACxD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAA0B;IACvD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAErB,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,2EAA2E;QAC3E,4EAA4E;QAC5E,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC,KAAK,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AACrE,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,6EAA6E;AAC7E,yCAAyC;AACzC,iFAAiF;AACjF,+CAA+C;AAC/C,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,yEAAyE;AACzE,iFAAiF;AACjF,yEAAyE;AACzE,iFAAiF;AACjF,0EAA0E;AAC1E,kCAAkC;AAClC,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,iFAAiF;AACjF,iEAAiE;AACjE,EAAE;AACF,oGAAoG;AACpG,8FAA8F;AAC9F,8EAA8E;AAE9E,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAe,WAAW;IACf,OAAO,CAAS;IAEzB,YAAsB,MAAc;QAClC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAID,qFAAqF;IACrF,MAAM;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACtB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,YAAa,SAAQ,WAAW;IAC3C,YAAY,MAAc;QACxB,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAES,MAAM;QACd,OAAO,gBAAgB,CAAC;IAC1B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,WAAY,SAAQ,WAAW;IAC1C,YAAY,MAAc;QACxB,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAES,MAAM;QACd,OAAO,eAAe,CAAC;IACzB,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC"}