@wayai/cli 0.3.39 → 0.3.41

package/dist/lib/token-store.js

@@ -1,354 +0,0 @@
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import * as os from 'node:os';
-export function identifyTokenType(token) {
-    if (token.startsWith('way_'))
-        return 'way_token';
-    if (token.startsWith('eyJ'))
-        return 'jwt';
-    return 'unknown';
-}
-const KEYRING_SERVICE = 'wayai';
-const KEY_WAY_TOKEN = 'way_token';
-const KEY_OAUTH_ACCESS = 'oauth_access_token';
-const KEY_OAUTH_REFRESH = 'oauth_refresh_token';
-// Resolved per-call (not at module load) so tests can redirect via $HOME and
-// production code picks up any runtime HOME changes (e.g., su -).
-function configDir() { return path.join(os.homedir(), '.wayai'); }
-function configPath() { return path.join(configDir(), 'config.json'); }
-let keyringCache;
-// Cross-platform manual cleanup hint. @napi-rs/keyring targets macOS Keychain,
-// libsecret on Linux, and Windows Credential Manager — the shell command to
-// evict a stuck entry differs per OS, so we tailor the message rather than
-// printing a macOS-only `security` invocation to Linux/Windows users.
-function manualCleanupCommand(account) {
-    if (process.platform === 'darwin') {
-        return `security delete-generic-password -s ${KEYRING_SERVICE} -a ${account}`;
-    }
-    if (process.platform === 'win32') {
-        return `cmdkey /delete:${KEYRING_SERVICE}/${account}`;
-    }
-    if (process.platform === 'linux') {
-        return `secret-tool clear service ${KEYRING_SERVICE} account ${account}`;
-    }
-    return `(remove the entry with service="${KEYRING_SERVICE}" account="${account}" from your OS credential store)`;
-}
-/**
- * A keyring slot was deleted but a subsequent getPassword still returned a
- * value — the underlying secret store accepted the delete call without
- * actually removing the entry. Typically a macOS Keychain ACL surviving
- * from a prior login. Until the slot is cleared, writes to other slots
- * cannot reliably override what reads pick up first.
- */
-export class StaleKeyringSlotError extends Error {
-    account;
-    constructor(account) {
-        super(`Stale credential remains in OS keyring slot "${account}" after delete. ` +
-            `This usually means a prior login left an ACL the current process can't override. ` +
-            `Clean it up manually and retry:\n` +
-            `  ${manualCleanupCommand(account)}`);
-        this.account = account;
-        this.name = 'StaleKeyringSlotError';
-    }
-}
-async function clearSlot(keyring, account) {
-    await keyring.deletePassword(KEYRING_SERVICE, account);
-    // A throw from getPassword (locked keychain, libsecret hiccup) means we
-    // cannot confirm the slot is empty — treat the same as "stale entry
-    // survived" so callers throw StaleKeyringSlotError rather than degrading
-    // to file fallback (which would write OAuth alongside a possibly-stuck
-    // way_, reproducing the masked-credential bug this helper exists to stop).
-    try {
-        return (await keyring.getPassword(KEYRING_SERVICE, account)) === null;
-    }
-    catch {
-        return false;
-    }
-}
-async function getKeyring() {
-    if (keyringCache !== undefined)
-        return keyringCache;
-    try {
-        const mod = await import('@napi-rs/keyring');
-        const Entry = mod.Entry;
-        keyringCache = {
-            async getPassword(service, account) {
-                try {
-                    return new Entry(service, account).getPassword();
-                }
-                catch {
-                    return null;
-                }
-            },
-            async setPassword(service, account, password) {
-                new Entry(service, account).setPassword(password);
-            },
-            async deletePassword(service, account) {
-                try {
-                    return new Entry(service, account).deletePassword();
-                }
-                catch {
-                    return false;
-                }
-            },
-        };
-    }
-    catch {
-        keyringCache = null;
-    }
-    return keyringCache;
-}
-function readLegacyConfigFile() {
-    if (!fs.existsSync(configPath()))
-        return null;
-    try {
-        return JSON.parse(fs.readFileSync(configPath(), 'utf-8'));
-    }
-    catch {
-        return null;
-    }
-}
-function stripTokensFromFile() {
-    const legacy = readLegacyConfigFile();
-    if (!legacy)
-        return;
-    // token_expires_at is a timestamp, not a secret — keep it as metadata so the
-    // refresh path can decide when to refresh without reading the keyring.
-    const cleaned = {};
-    for (const [k, v] of Object.entries(legacy)) {
-        if (k === 'token' || k === 'access_token' || k === 'refresh_token')
-            continue;
-        cleaned[k] = v;
-    }
-    fs.writeFileSync(configPath(), JSON.stringify(cleaned, null, 2) + '\n', { mode: 0o600 });
-}
-export async function migrateLegacyTokens() {
-    const legacy = readLegacyConfigFile();
-    if (!legacy)
-        return null;
-    if (!legacy.token && !legacy.access_token)
-        return null;
-    const keyring = await getKeyring();
-    if (legacy.token) {
-        if (keyring) {
-            try {
-                await keyring.setPassword(KEYRING_SERVICE, KEY_WAY_TOKEN, legacy.token);
-                // Strip failure leaves plaintext on disk until the next CLI invocation
-                // re-attempts — keyring write was successful, so functionally OK.
-                try {
-                    stripTokensFromFile();
-                }
-                catch (err) {
-                    console.warn(`wayai: failed to strip legacy token from ~/.wayai/config.json (${err.message}); will retry next run.`);
-                }
-            }
-            catch (err) {
-                // Keyring write failed (locked keychain, etc.); leave the legacy file
-                // intact so the file-fallback read keeps working and the next CLI run
-                // can retry the migration.
-                console.warn(`wayai: keyring migration failed (${err.message}); continuing with file-backed token.`);
-            }
-        }
-        return { kind: 'way', token: legacy.token };
-    }
-    if (legacy.access_token) {
-        if (keyring) {
-            try {
-                await keyring.setPassword(KEYRING_SERVICE, KEY_OAUTH_ACCESS, legacy.access_token);
-                if (legacy.refresh_token) {
-                    await keyring.setPassword(KEYRING_SERVICE, KEY_OAUTH_REFRESH, legacy.refresh_token);
-                }
-                try {
-                    stripTokensFromFile();
-                }
-                catch (err) {
-                    console.warn(`wayai: failed to strip legacy tokens from ~/.wayai/config.json (${err.message}); will retry next run.`);
-                }
-            }
-            catch (err) {
-                console.warn(`wayai: keyring migration failed (${err.message}); continuing with file-backed tokens.`);
-            }
-        }
-        return {
-            kind: 'oauth',
-            access_token: legacy.access_token,
-            refresh_token: legacy.refresh_token,
-            expires_at: legacy.token_expires_at,
-        };
-    }
-    return null;
-}
-export async function getToken() {
-    // Env override has highest precedence — supports CI, container, op-run injection.
-    const envToken = process.env.WAYAI_TOKEN;
-    if (envToken) {
-        if (identifyTokenType(envToken) === 'way_token') {
-            return { kind: 'way', token: envToken };
-        }
-        return { kind: 'oauth', access_token: envToken };
-    }
-    const keyring = await getKeyring();
-    if (keyring) {
-        const wayToken = await keyring.getPassword(KEYRING_SERVICE, KEY_WAY_TOKEN);
-        if (wayToken)
-            return { kind: 'way', token: wayToken };
-        const accessToken = await keyring.getPassword(KEYRING_SERVICE, KEY_OAUTH_ACCESS);
-        if (accessToken) {
-            const refreshToken = await keyring.getPassword(KEYRING_SERVICE, KEY_OAUTH_REFRESH);
-            const expiresAt = readMetadataExpiresAt();
-            return {
-                kind: 'oauth',
-                access_token: accessToken,
-                refresh_token: refreshToken ?? undefined,
-                expires_at: expiresAt ?? undefined,
-            };
-        }
-    }
-    const legacy = readLegacyConfigFile();
-    if (!legacy)
-        return null;
-    if (legacy.token)
-        return { kind: 'way', token: legacy.token };
-    if (legacy.access_token) {
-        return {
-            kind: 'oauth',
-            access_token: legacy.access_token,
-            refresh_token: legacy.refresh_token,
-            expires_at: legacy.token_expires_at,
-        };
-    }
-    return null;
-}
-export async function setWayToken(token) {
-    const keyring = await getKeyring();
-    if (keyring) {
-        try {
-            await keyring.setPassword(KEYRING_SERVICE, KEY_WAY_TOKEN, token);
-            clearMetadataExpiresAt();
-            // Read precedence favors way_ over OAuth, so a leftover OAuth credential
-            // won't shadow this token — but `wayai logout` then misses it. Warn so
-            // the user can sweep it manually. Slots are independent — parallelize.
-            const [accessCleared, refreshCleared] = await Promise.all([
-                clearSlot(keyring, KEY_OAUTH_ACCESS),
-                clearSlot(keyring, KEY_OAUTH_REFRESH),
-            ]);
-            const stuck = [
-                accessCleared ? null : KEY_OAUTH_ACCESS,
-                refreshCleared ? null : KEY_OAUTH_REFRESH,
-            ].filter((a) => a !== null);
-            if (stuck.length > 0) {
-                console.warn([
-                    `wayai: stale OAuth credential persists in OS keyring after delete. Commands work, but \`wayai logout\` won't fully clear. Manually:`,
-                    ...stuck.map((a) => `  ${manualCleanupCommand(a)}`),
-                ].join('\n'));
-            }
-            return;
-        }
-        catch (err) {
-            // Runtime keyring failure (locked keychain, broken libsecret session, etc.) —
-            // degrade to file storage. Visible warning so users notice the downgrade.
-            console.warn(`wayai: keyring write failed (${err.message}); falling back to file storage.`);
-        }
-    }
-    writeFileFallback({ token });
-}
-export async function setOAuthTokens(access_token, refresh_token, expires_at) {
-    const keyring = await getKeyring();
-    if (keyring) {
-        try {
-            // way_ wins the read race, so a leftover way_ would silently mask the
-            // OAuth tokens we're about to write — every subsequent API call would
-            // send the dead way_ and the backend would reject it. Verify the slot
-            // is actually empty after deletePassword and fail loudly otherwise.
-            if (!(await clearSlot(keyring, KEY_WAY_TOKEN))) {
-                throw new StaleKeyringSlotError(KEY_WAY_TOKEN);
-            }
-            await keyring.setPassword(KEYRING_SERVICE, KEY_OAUTH_ACCESS, access_token);
-            if (refresh_token) {
-                await keyring.setPassword(KEYRING_SERVICE, KEY_OAUTH_REFRESH, refresh_token);
-            }
-            writeMetadataExpiresAt(expires_at);
-            return;
-        }
-        catch (err) {
-            // StaleKeyringSlotError propagates — file fallback can't help because
-            // the next read still hits the stuck keyring slot first.
-            if (err instanceof StaleKeyringSlotError)
-                throw err;
-            console.warn(`wayai: keyring write failed (${err.message}); falling back to file storage.`);
-        }
-    }
-    writeFileFallback({ access_token, refresh_token, token_expires_at: expires_at });
-}
-export async function clearTokens() {
-    const keyring = await getKeyring();
-    if (keyring) {
-        // Slots are independent — run all three in parallel (3 keyring RPCs vs 6).
-        const slots = [KEY_WAY_TOKEN, KEY_OAUTH_ACCESS, KEY_OAUTH_REFRESH];
-        const cleared = await Promise.all(slots.map((account) => clearSlot(keyring, account)));
-        for (const [i, ok] of cleared.entries()) {
-            if (!ok) {
-                const account = slots[i];
-                console.warn(`wayai: could not clear keyring slot "${account}". Subsequent commands may still pick the stale token. Manually:\n` +
-                    `  ${manualCleanupCommand(account)}`);
-            }
-        }
-    }
-    if (fs.existsSync(configPath())) {
-        fs.unlinkSync(configPath());
-    }
-}
-function readMetadataExpiresAt() {
-    const legacy = readLegacyConfigFile();
-    return legacy?.token_expires_at ?? null;
-}
-function writeMetadataExpiresAt(expires_at) {
-    const existing = readLegacyConfigFile() ?? {};
-    delete existing.token;
-    delete existing.access_token;
-    delete existing.refresh_token;
-    existing.token_expires_at = expires_at;
-    ensureConfigDir();
-    fs.writeFileSync(configPath(), JSON.stringify(existing, null, 2) + '\n', { mode: 0o600 });
-}
-function clearMetadataExpiresAt() {
-    const existing = readLegacyConfigFile();
-    if (!existing)
-        return;
-    // Strip any orphan token fields from prior file-fallback sessions while we're
-    // here — keeps the metadata file token-free once keyring is in use.
-    delete existing.token;
-    delete existing.access_token;
-    delete existing.refresh_token;
-    delete existing.token_expires_at;
-    ensureConfigDir();
-    fs.writeFileSync(configPath(), JSON.stringify(existing, null, 2) + '\n', { mode: 0o600 });
-}
-function ensureConfigDir() {
-    if (!fs.existsSync(configDir())) {
-        fs.mkdirSync(configDir(), { recursive: true });
-    }
-}
-function writeFileFallback(tokens) {
-    const existing = readLegacyConfigFile() ?? {};
-    // Strip ALL token fields before merging — without this, a mode switch in the
-    // no-keyring path (way → OAuth or vice versa) would leave the old mode's
-    // fields on disk and `getToken` would return the stale value because the
-    // file-fallback read checks `token` before `access_token`.
-    delete existing.token;
-    delete existing.access_token;
-    delete existing.refresh_token;
-    delete existing.token_expires_at;
-    Object.assign(existing, tokens);
-    ensureConfigDir();
-    fs.writeFileSync(configPath(), JSON.stringify(existing, null, 2) + '\n', { mode: 0o600 });
-}
-/** Test hook — production code must not call this. */
-export function __setKeyringForTesting(binding) {
-    keyringCache = binding;
-}
-/** Test hook — production code must not call this. */
-export function __resetKeyringForTesting() {
-    keyringCache = undefined;
-}
-//# sourceMappingURL=token-store.js.map

package/dist/lib/token-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/lib/token-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAO9B,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC;IACjD,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,eAAe,GAAG,OAAO,CAAC;AAChC,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAC9C,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAEhD,6EAA6E;AAC7E,kEAAkE;AAClE,SAAS,SAAS,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC1E,SAAS,UAAU,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;AAM/E,IAAI,YAA+C,CAAC;AAOpD,+EAA+E;AAC/E,4EAA4E;AAC5E,2EAA2E;AAC3E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,OAAe;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,uCAAuC,eAAe,OAAO,OAAO,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,kBAAkB,eAAe,IAAI,OAAO,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,6BAA6B,eAAe,YAAY,OAAO,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,mCAAmC,eAAe,cAAc,OAAO,kCAAkC,CAAC;AACnH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAClB;IAA5B,YAA4B,OAAe;QACzC,KAAK,CACH,gDAAgD,OAAO,kBAAkB;YACzE,mFAAmF;YACnF,mCAAmC;YACnC,KAAK,oBAAoB,CAAC,OAAO,CAAC,EAAE,CACrC,CAAC;QANwB,YAAO,GAAP,OAAO,CAAQ;QAOzC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,KAAK,UAAU,SAAS,CAAC,OAAuB,EAAE,OAAe;IAC/D,MAAM,OAAO,CAAC,cAAc,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACvD,wEAAwE;IACxE,oEAAoE;IACpE,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACxB,YAAY,GAAG;YACb,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO;gBAChC,IAAI,CAAC;oBAAC,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,IAAI,CAAC;gBAAC,CAAC;YAClF,CAAC;YACD,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ;gBAC1C,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YACpD,CAAC;YACD,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO;gBACnC,IAAI,CAAC;oBAAC,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,KAAK,CAAC;gBAAC,CAAC;YACtF,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAUD,SAAS,oBAAoB;IAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAA2B,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,eAAe;YAAE,SAAS;QAC7E,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IAEnC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxE,uEAAuE;gBACvE,kEAAkE;gBAClE,IAAI,CAAC;oBAAC,mBAAmB,EAAE,CAAC;gBAAC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBAC1C,OAAO,CAAC,IAAI,CAAC,kEAAmE,GAAa,CAAC,OAAO,yBAAyB,CAAC,CAAC;gBAClI,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sEAAsE;gBACtE,sEAAsE;gBACtE,2BAA2B;gBAC3B,OAAO,CAAC,IAAI,CAAC,oCAAqC,GAAa,CAAC,OAAO,uCAAuC,CAAC,CAAC;YAClH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,gBAAgB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;gBAClF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;oBACzB,MAAM,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,iBAAiB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;gBACtF,CAAC;gBACD,IAAI,CAAC;oBAAC,mBAAmB,EAAE,CAAC;gBAAC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBAC1C,OAAO,CAAC,IAAI,CAAC,mEAAoE,GAAa,CAAC,OAAO,yBAAyB,CAAC,CAAC;gBACnI,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,oCAAqC,GAAa,CAAC,OAAO,wCAAwC,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,UAAU,EAAE,MAAM,CAAC,gBAAgB;SACpC,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,kFAAkF;IAClF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,WAAW,EAAE,CAAC;YAChD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IAEnC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;QAC3E,IAAI,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAEtD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;QACjF,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACnF,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;YAC1C,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,YAAY,EAAE,WAAW;gBACzB,aAAa,EAAE,YAAY,IAAI,SAAS;gBACxC,UAAU,EAAE,SAAS,IAAI,SAAS;aACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC9D,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,UAAU,EAAE,MAAM,CAAC,gBAAgB;SACpC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa;IAC7C,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACnC,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;YACjE,sBAAsB,EAAE,CAAC;YACzB,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACxD,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;gBACpC,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,KAAK,GAAG;gBACZ,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB;gBACvC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB;aAC1C,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CACV;oBACE,qIAAqI;oBACrI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8EAA8E;YAC9E,0EAA0E;YAC1E,OAAO,CAAC,IAAI,CAAC,gCAAiC,GAAa,CAAC,OAAO,kCAAkC,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IACD,iBAAiB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,YAAoB,EACpB,aAAiC,EACjC,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACnC,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,qBAAqB,CAAC,aAAa,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;YAC3E,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;YAC/E,CAAC;YACD,sBAAsB,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,yDAAyD;YACzD,IAAI,GAAG,YAAY,qBAAqB;gBAAE,MAAM,GAAG,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,gCAAiC,GAAa,CAAC,OAAO,kCAAkC,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IACD,iBAAiB,CAAC,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACnC,IAAI,OAAO,EAAE,CAAC;QACZ,2EAA2E;QAC3E,MAAM,KAAK,GAAG,CAAC,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,CAAU,CAAC;QAC5E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACvF,KAAK,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CACV,wCAAwC,OAAO,oEAAoE;oBACnH,KAAK,oBAAoB,CAAC,OAAO,CAAC,EAAE,CACrC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;QAChC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,OAAO,MAAM,EAAE,gBAAgB,IAAI,IAAI,CAAC;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAAC,UAAkB;IAChD,MAAM,QAAQ,GAAG,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAC9C,OAAO,QAAQ,CAAC,KAAK,CAAC;IACtB,OAAO,QAAQ,CAAC,YAAY,CAAC;IAC7B,OAAO,QAAQ,CAAC,aAAa,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,GAAG,UAAU,CAAC;IACvC,eAAe,EAAE,CAAC;IAClB,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IACxC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,8EAA8E;IAC9E,oEAAoE;IACpE,OAAO,QAAQ,CAAC,KAAK,CAAC;IACtB,OAAO,QAAQ,CAAC,YAAY,CAAC;IAC7B,OAAO,QAAQ,CAAC,aAAa,CAAC;IAC9B,OAAO,QAAQ,CAAC,gBAAgB,CAAC;IACjC,eAAe,EAAE,CAAC;IAClB,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;QAChC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAuC;IAChE,MAAM,QAAQ,GAAG,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAC9C,6EAA6E;IAC7E,yEAAyE;IACzE,yEAAyE;IACzE,2DAA2D;IAC3D,OAAO,QAAQ,CAAC,KAAK,CAAC;IACtB,OAAO,QAAQ,CAAC,YAAY,CAAC;IAC7B,OAAO,QAAQ,CAAC,aAAa,CAAC;IAC9B,OAAO,QAAQ,CAAC,gBAAgB,CAAC;IACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,CAAC;IAClB,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,sBAAsB,CAAC,OAA8B;IACnE,YAAY,GAAG,OAAO,CAAC;AACzB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,wBAAwB;IACtC,YAAY,GAAG,SAAS,CAAC;AAC3B,CAAC"}

package/dist/lib/types.d.ts

@@ -1,18 +0,0 @@
-/**
- * Shared types for the CLI — imported from @wayai/shared/contracts
- */
-export type { HubAsCodeKanbanFollowup, HubAsCodeKanbanStatus, HubAsCodePayload, HubAsCodeAgent, HubAsCodeCustomTool, HubAsCodeState, HubAsCodeTeam, HubAsCodeResource, HubAsCodeResourceFile, HubAsCodeAgentResource, HubAsCodeOutboundContact, HubAsCodeOutboundList, HubAsCodeOutboundSchedule, HubAsCodeEval, CiDiffResponse, CiLookupResponse, CiOrganizationsResponse, CiCreateOrganizationResponse, CiHubListItem, CiHubListResponse, CiSyncResponse, CiSyncMcpResponse, OrgResourcesPayload, OrgAsCodeResource, OrgAsCodeResourceFolder, CiOrgResourcesPushResponse, } from '@wayai/shared/contracts/ci';
-/** Mirrors SyncSkillsResultItem from @wayai/shared/contracts/setup/resources */
-export interface SyncSkillsResultItem {
-    connection_id: string;
-    connection_name: string;
-    uploaded: number;
-    failed: number;
-    errors: string[];
-}
-/** Mirrors SyncSkillsResponse from @wayai/shared/contracts/setup/resources */
-export interface SyncSkillsResponse {
-    success: true;
-    message: string;
-    results: SyncSkillsResultItem[];
-}

package/dist/lib/types.js

@@ -1,5 +0,0 @@
-/**
- * Shared types for the CLI — imported from @wayai/shared/contracts
- */
-export {};
-//# sourceMappingURL=types.js.map

package/dist/lib/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/lib/utils.d.ts

@@ -1,97 +0,0 @@
-/**
- * Shared utility functions
- */
-export declare const UUID_RE: RegExp;
-/**
- * Prompt the user for free-text input.
- */
-export declare function prompt(question: string): Promise<string>;
-/**
- * Prompt the user for yes/no confirmation. Returns true if they answer 'y'.
- */
-export declare function confirm(question: string): Promise<boolean>;
-/** Prompt for a secret, masking typed characters with `*`. */
-export declare function promptSecret(question: string): Promise<string>;
-/** Read all of stdin as a single trimmed string (for piped input). */
-export declare function readStdin(): Promise<string>;
-/**
- * Kebab-case slug for hub folders and skill names.
- *
- * MIRROR of the canonical `@wayai/shared` `slugifyKebab(input, 64)`. The CLI
- * can't import the shared runtime (it's never published — see the drift-guard
- * test no-shared-runtime-import.test.ts), so this is duplicated and pinned by
- * that test against `slugifySkillName`. Uses NFKD (not NFD) so ligatures and
- * full-width chars fold toward ASCII identically to the platform — keep these
- * exact steps in lockstep with slugifyKebab or pushed slugs diverge from the UI.
- */
-export declare function slugify(input: string): string;
-/**
- * Resolve the hub YAML path in a folder: tries hub.yaml first, falls back to wayai.yaml.
- * Returns the full path if found, null otherwise.
- */
-export declare function resolveHubYamlPath(hubFolder: string): string | null;
-/**
- * Try to detect hub_id from hub.yaml (or wayai.yaml) in the current working directory.
- * Returns null if no config file exists or it lacks hub_id.
- */
-export declare function detectHubFromCwd(): Promise<{
-    hubId: string;
-    hubFolder: string;
-} | null>;
-/**
- * Parse a shorthand period string (e.g. "7d", "4w", "3m", "1y") into
- * { start, end, periodicity } for analytics queries.
- */
-export declare function parsePeriod(period: string): {
-    start: string;
-    end: string;
-    periodicity: string;
-};
-/**
- * Parse --from/--to date strings into ISO format.
- * Accepts YYYY-MM-DD or full ISO datetime. Appends time suffix if needed.
- */
-export declare function parseDateArg(date: string, position: 'from' | 'to'): string;
-/**
- * Resolve organization_id from: --org flag → .wayai.yaml → single-org auto-select.
- * Returns { organizationId, organizationName } or exits with an error.
- */
-export declare function resolveOrganizationId(client: {
-    organizations(): Promise<{
-        organizations: Array<{
-            id: string;
-            name: string;
-        }>;
-    }>;
-}, orgIdFlag?: string): Promise<{
-    organizationId: string;
-    organizationName?: string;
-}>;
-export declare function parsePositiveIntFlag(name: string, raw: string | undefined): number;
-/**
- * Low-level predicate: true when `--help`/`-h` appears anywhere in args.
- *
- * The match is deliberately broad (and so fail-safe — printing help is
- * non-destructive). The one realistic command that takes a free-text value that
- * could *equal* `--help` is `report` (`report create --description "--help"`),
- * and that command owns its help handling so it's excluded from interception by
- * `shouldInterceptHelp` — its own parser sees the value verbatim. Used both to
- * gate that interception and to skip the update check on any help invocation.
- */
-export declare function wantsHelp(args: string[]): boolean;
-/**
- * Whether the top-level entry should short-circuit to the GLOBAL help BEFORE
- * dispatching `command`. This stops side-effecting subcommands (e.g.
- * `run-eval`, which would otherwise create + run a billable eval session) from
- * executing on a `--help`/`-h` request.
- *
- * Returns false — i.e. falls through to the command's own handler — for:
- * - the top-level `help` slot (handled by the dispatch switch itself),
- * - an absent command, and
- * - commands in `ownHelpCommands` (e.g. `eval`, `admin`, `report`), which
- *   render their own richer command-specific help; intercepting them here would
- *   downgrade that to the global help.
- */
-export declare function shouldInterceptHelp(command: string | undefined, args: string[], ownHelpCommands: ReadonlySet<string>): boolean;
-/** Returns true if `latest` is a newer semver than `current` */
-export declare function isNewerVersion(latest: string, current: string): boolean;