@vibe-commit/capture 0.10.0 → 0.11.0

package/dist/identity.d.ts

@@ -0,0 +1,32 @@
+/**
+ * THE IDENTITY DIGEST — U5a of the detached uploader (plan §3.13).
+ *
+ * One machine-wide worker serves every session's firing log, and a session can be started under a different credential than the one the
+ * worker would find on its own: `VIBECOMMIT_TOKEN=<org B>` in one shell, the saved `org A` credential everywhere else. Without a check, the
+ * worker would upload B's session under A's credential. So each firing carries a digest of "who this upload is for", the worker computes
+ * its own, and **a worker serves only firings of its own identity**, in the idle drain as well.
+ *
+ * The digest is a sha256 of, in order:
+ *  - the ingest URL (a different server is a different account),
+ *  - the credential SOURCE: the constant `file` for the saved credential, and for `VIBECOMMIT_TOKEN` a hash of the token itself,
+ *  - `CLAUDE_CONFIG_DIR` and `CODEX_HOME` (a different agent profile is a different set of transcripts).
+ *
+ * ⛔ The saved credential is a CONSTANT on purpose. A fingerprint there would strand every queued firing the moment `vibecommit auth`
+ * rotates it: the worker re-reads the file every round, so rotation takes effect at once and the identity must not change with it.
+ *
+ * ⛔ A LEAF: it imports `node:crypto` and nothing of this package, so the hook can compute it without loading the worker. It reads a token
+ * only to hash it and never returns, stores or logs it; the digest is not reversible and carries no secret.
+ */
+/** The part of the environment the digest is a function of. Anything else cannot change who an upload is for. */
+export interface IdentityInput {
+    /** The validated ingest URL (`ingestUrl(env)`), never the raw override. */
+    readonly url: string;
+    readonly env: NodeJS.ProcessEnv;
+}
+/** `file`, or `env:<sha256 of the token>`. A blank `VIBECOMMIT_TOKEN` is not set (`loadCredential` agrees). */
+export declare function credentialSourceOf(env: NodeJS.ProcessEnv): string;
+/**
+ * The digest. Each field is length-prefixed, so ("ab","c") and ("a","bc") cannot collide, and an absent variable differs from an empty one
+ * only if nobody can tell them apart (they behave identically), which is why both read as "".
+ */
+export declare function identityDigest(input: IdentityInput): string;

package/dist/identity.js

@@ -0,0 +1,38 @@
+/**
+ * THE IDENTITY DIGEST — U5a of the detached uploader (plan §3.13).
+ *
+ * One machine-wide worker serves every session's firing log, and a session can be started under a different credential than the one the
+ * worker would find on its own: `VIBECOMMIT_TOKEN=<org B>` in one shell, the saved `org A` credential everywhere else. Without a check, the
+ * worker would upload B's session under A's credential. So each firing carries a digest of "who this upload is for", the worker computes
+ * its own, and **a worker serves only firings of its own identity**, in the idle drain as well.
+ *
+ * The digest is a sha256 of, in order:
+ *  - the ingest URL (a different server is a different account),
+ *  - the credential SOURCE: the constant `file` for the saved credential, and for `VIBECOMMIT_TOKEN` a hash of the token itself,
+ *  - `CLAUDE_CONFIG_DIR` and `CODEX_HOME` (a different agent profile is a different set of transcripts).
+ *
+ * ⛔ The saved credential is a CONSTANT on purpose. A fingerprint there would strand every queued firing the moment `vibecommit auth`
+ * rotates it: the worker re-reads the file every round, so rotation takes effect at once and the identity must not change with it.
+ *
+ * ⛔ A LEAF: it imports `node:crypto` and nothing of this package, so the hook can compute it without loading the worker. It reads a token
+ * only to hash it and never returns, stores or logs it; the digest is not reversible and carries no secret.
+ */
+import { createHash } from "node:crypto";
+/** `file`, or `env:<sha256 of the token>`. A blank `VIBECOMMIT_TOKEN` is not set (`loadCredential` agrees). */
+export function credentialSourceOf(env) {
+    const token = env.VIBECOMMIT_TOKEN?.trim() ?? "";
+    return token === "" ? "file" : `env:${createHash("sha256").update(token).digest("hex")}`;
+}
+/**
+ * The digest. Each field is length-prefixed, so ("ab","c") and ("a","bc") cannot collide, and an absent variable differs from an empty one
+ * only if nobody can tell them apart (they behave identically), which is why both read as "".
+ */
+export function identityDigest(input) {
+    const hash = createHash("sha256");
+    for (const part of [input.url, credentialSourceOf(input.env), input.env.CLAUDE_CONFIG_DIR ?? "", input.env.CODEX_HOME ?? ""]) {
+        hash.update(`${Buffer.byteLength(part)}:`);
+        hash.update(part);
+    }
+    return hash.digest("hex");
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzC,+GAA+G;AAC/G,MAAM,UAAU,kBAAkB,CAAC,GAAsB;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjD,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7H,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { type InvocationMode } from "./exit.js";
-declare const VERBS: readonly ["auth", "connect", "scan", "backfill", "status", "off", "why", "report", "finalize"];
-export type Verb = (typeof VERBS)[number];
-export declare function isVerb(value: string): value is Verb;
+import { isVerb, type Verb } from "./verbs.js";
+export { isVerb };
+export type { Verb };
 /**
  * Hook invocations are distinguished by ARGV FIRST, then by env.
  *
@@ -18,17 +18,3 @@ export declare function isVerb(value: string): value is Verb;
  * established it and a wrapper may already set it.
  */
 export declare function invocationMode(env: NodeJS.ProcessEnv, argv: readonly string[]): InvocationMode;
-/**
- * `--help`, wrapped hard at 80 columns per DESIGN.md §13.4.
- *
- * Never reflows to `process.stdout.columns`: identical commands must emit
- * identical bytes, or issue-paste, screenshots and every golden-file test of the
- * copy break. `test/help-golden.test.ts` is that golden file.
- *
- * No SGR here at all. Colour would have to be resolved before help could be
- * rendered, and help is the one surface where structure alone is enough —
- * indentation and the label gutter carry it, which is §13.1's point about
- * `NO_COLOR` being a lossless degradation rather than a downgrade.
- */
-export declare function renderHelp(): string;
-export {};