botanary-mcp 0.3.0 → 0.4.1

package/README.md

@@ -1,11 +1,33 @@
 # botanary-mcp
 
-Botanary's **agent connector**: a local MCP server that lets an outside coding agent - Claude Code,
-Codex, Cursor, or something you wrote yourself - hold its own signing key, prove who it is, pair with a
-Botanary account, read its balance, and spend under whatever grant its owner gave it - all without
-Botanary ever holding, seeing, or backing up that key.
-
-The tools this server exposes:
+A local MCP server that lets an outside coding agent - Claude Code, Codex, Cursor, or something you
+wrote yourself - act on a Botanary account. It has **two lanes**, backed by two independent credentials:
+
+- **The agent lane.** This machine holds its own secp256k1 signing key, proves who it is, pairs with a
+  Botanary account, reads its balance, and spends *unattended* under whatever grant its owner gave it -
+  all without Botanary ever holding, seeing, or backing up that key.
+- **The wallet lane.** The human owner logs in through their own browser (`wallet_login`) - the same
+  provider consent they already use - and this machine holds an opaque, revocable session that can read
+  and *build* on the owner's behalf, but **can never sign as the owner**. Every owner-authorized money
+  movement ends in a signature the owner makes themselves, in their own browser, against their own
+  embedded wallet.
+
+**These are independent credentials that can point at different Botanary accounts.** The agent key is
+paired to whatever account its owner paired it to; the wallet session operates on whatever account was
+picked at login. Nothing forces them to agree - `wallet_status` prints both bindings side by side and
+flags a mismatch as a first-class finding, and `wallet_send`'s own lane arbitration (below) refuses to
+let a mandate on one account authorize a spend on the other, no matter how "helpful" that would be.
+
+## Tools
+
+`botanary-mcp` advertises a **subset** of its tools at any moment - a small starter set when nothing is
+logged in yet, the wallet tools once `wallet_login` succeeds, the agent tools once this machine has a
+local identity - and pushes `notifications/tools/list_changed` when that set changes. This is a listing
+optimization, not a security boundary: every tool below is always *reachable* by name, and a hidden one
+called anyway answers honestly ("log in first") rather than pretending not to exist. See "Why the
+advertised tool list changes" further down.
+
+### Agent lane (this machine acting as a connected agent, under a grant)
 
 | Tool | What it does |
 |---|---|
@@ -25,6 +47,81 @@ The tools this server exposes:
 | `what_may_i_do` | Renders the grant in plain terms, or an honest "nothing yet" - a convenience read, never the check. |
 | `forget` | STEP 1 of 2: preview what would be destroyed and get a single-use confirmation token. Deletes nothing on its own. |
 | `confirm_forget` | STEP 2 of 2: actually delete the agent key from this machine. Requires the token from `forget`. |
+| `list_apis` | Calls `GET /apis/list` - the paid (x402) third-party API endpoints this agent may call on a chain, each with its live price and this agent's remaining budget. Reads only; calls nothing and spends nothing. |
+| `call_api` | Calls `POST /apis/calls` - call one of those endpoints and pay for it, inside the budget the OWNER committed on-chain (`X402PaymentValidator`). Signs the EIP-3009 authorization with this agent's own key; the owner never signs, and the on-chain budget - not this tool - is what bounds it. A response marked `simulated` is synthetic test data, and says so. |
+| `get_api_budget` | Calls `GET /apis/budget` - remaining authorizations, per-call maximum, expiry and epoch for this agent on a chain. Does NOT say which endpoints are enabled (`list_apis` does). |
+
+### Wallet lane (the human owner's own session, after `wallet_login`)
+
+| Tool | What it does |
+|---|---|
+| `wallet_login` | Device-style browser login: opens the owner's browser, waits for them to authorize, stores the resulting session in the OS keychain. No browser available (SSH, a container)? Prints the URL and code instead - same flow, no second code path. |
+| `wallet_logout` | Revokes the session (`DELETE /auth/session`) and clears it locally - even if the network call fails, so a dead network can never strand a live credential on disk. |
+| `wallet_status` | Prints the wallet session's account AND the agent's bound account side by side, and flags a mismatch explicitly. Safe to call regardless of which lane(s), if any, are set up. |
+| `wallet_use_account` | Switch which of the owner's accounts every subsequent `wallet_*` call uses - including which account `wallet_send`'s lane arbitration compares a paired agent's mandate against. Validates the id against `GET /accounts` first; persists to the same keychain item `wallet_login` writes. |
+| `wallet_send` | Sends tokens from the **owner's own account**. See "Lane arbitration" below - this is the tool the safety property in this README is really about. |
+| `wallet_portfolio` | Reads `GET /balance` + `GET /chains`: balances across all chains and each chain's tier (watch/basic/botanary). Raw balance and tier data - it does not itself evaluate whether a send would succeed. |
+| `wallet_activity` | Reads `GET /history`: the owner's recent sends, swaps, and yield transactions with timestamps, amounts, and final status. |
+| `wallet_markets` | Reads `GET /markets/tokens`: public market data (prices, symbols) - not account-scoped. |
+| `wallet_yield` | Reads `GET /yield/pools` + `GET /yield/shortlist` + `GET /farm/positions`: available pools, a recommended shortlist, and this account's farming positions. `shortlist` is ranked off the caller's own holdings server-side and is NOT scoped to the account `wallet_use_account` most recently switched to - the result's own `scopeCaveats` field says so explicitly. |
+| `wallet_mandates` | Reads `GET /delegations` + `GET /mandates`: what the agent lane may spend unattended - active delegations with budget info, and any outstanding mandates. |
+| `wallet_agents` | Reads `GET /agents` + `GET /agents/requests`: connected agents and any pending approval requests they've filed. |
+| `wallet_api_get` | Read ANY `GET` endpoint in Botanary's frozen OpenAPI contract, authenticated as the owner. **GET-only, deliberately** - see below. |
+
+## Lane arbitration: how `wallet_send` decides who signs
+
+`wallet_send` resolves one of exactly two lanes, in this order, every time it's called:
+
+1. **This machine holds a paired agent identity with a live mandate that covers the action, ON THE SAME
+   ACCOUNT the wallet session is presently using.** Then it signs locally with the agent's session key
+   and relays - no browser, no human click.
+2. **Otherwise** - no paired agent, no live grant, the mandate is out of bounds for this exact request
+   (wrong chain, over budget, over the per-action cap), or **the mandate is on a DIFFERENT account** -
+   it parks a typed intent (`POST /sign-requests`), opens the owner's browser to review and sign it
+   there, and polls to a terminal result.
+
+**The same-account condition is not incidental - it is the whole safety argument.** The two credentials
+are independent (see the top of this README): an agent paired to one account and a browser session open
+on another is not a bug to route around, it's the scenario this check exists to catch. Without it, "it
+signed without asking me" could mean money moved out of an account the owner was not even looking at -
+which is exactly what happened once (an agent paired to an empty account while the owner's real funds
+sat elsewhere, surfacing as a cryptic `AA21 didn't pay prefund` three Postgres queries later). Every
+`wallet_send` result names the lane it took (`lane: "agent" | "browser"`), and when a mandate existed but
+was refused for the agent lane, the result says exactly why.
+
+A local balance/chain-tier check runs before opening a browser, purely as a courtesy so a doomed request
+doesn't cost the owner a browser trip - **it is never the authorization.** The real check is the build
+the browser page itself does against the live backend, and beneath that, on-chain enforcement. A green
+result from this preflight proves nothing by itself, the same discipline `propose_payment`'s own
+client-side bounds check documents on the agent lane.
+
+## `wallet_api_get` is GET-only, deliberately - and there is no `api_post`
+
+Every path is validated against a manifest generated from the frozen OpenAPI contract
+(`openapi/botanary-v1.yaml`, via `pnpm generate:routes` - see "Development" below) before anything
+reaches the network. An undocumented path, or any method other than `GET`, is refused.
+
+**There is no write counterpart, and there must not be one.** A generic `api_post` would let a model
+reach *any* mutation - freeze the account, remove a signer, drain a grant - with no typed intent, no
+review panel, and no lane arbitration. Every write instead goes through `wallet_send` (or a future
+`wallet_swap`): a typed intent the owner reviews and signs in their own browser, or the agent lane's own
+on-chain-bound mandate. `wallet_api_get` is deliberately incapable of being that shortcut.
+
+## Why the advertised tool list changes
+
+This package ships close to twenty tools. Advertising all of them at once - most of which are unusable
+in the caller's *current* state (no wallet session yet, no paired agent yet) - is exactly the kind of
+overlapping-description clutter that degrades tool selection in a client with many MCP servers attached.
+So the advertised list is gated by state: a small starter set (`wallet_login`, `get_pairing_code`,
+`diagnose`, `wallet_status`, ...) is always visible; the wallet tools appear once `wallet_login`
+succeeds; the agent tools appear once this machine has a local identity. `wallet_login`/`wallet_logout`
+push `notifications/tools/list_changed` so a client that implements it can re-fetch immediately.
+
+**Not every client implements that notification, and a hidden tool must still work when called.** If
+your client cached the list from before you logged in and you (or the model) call `wallet_send` anyway,
+it does not 404 or pretend the tool doesn't exist - it answers honestly ("not logged in - run
+wallet_login first"). The gating is a UX optimization on top of a surface that is always fully reachable,
+never a second, hidden permission system.
 
 ## Add it to your agent
 
@@ -79,10 +176,14 @@ Claude Desktop is likewise config-file only - add this block to
 }
 ```
 
-Restart the client so it picks up the new server. Once connected, ask the agent for its Botanary
-identity or pairing code - it will call `get_identity` / `get_pairing_code` and read the key
-straight out of wherever this machine's OS keeps secrets. The first call generates the key; nothing
-before that point touches disk or asks any question.
+Restart the client so it picks up the new server. From here, two independent things you can ask for:
+
+- **"What's your Botanary identity / pairing code?"** - the AGENT lane. It calls `get_identity` /
+  `get_pairing_code` and reads the key straight out of wherever this machine's OS keeps secrets. The
+  first call generates the key; nothing before that point touches disk or asks any question.
+- **"Log me into Botanary"** - the WALLET lane. It calls `wallet_login`, opens your own browser to the
+  provider login you already use, and waits for you to authorize. Nothing is generated on this machine;
+  the session it stores is revocable from Botanary's Settings → Connected apps at any time.
 
 ## What a freshly-connected agent can and cannot do
 
@@ -175,6 +276,23 @@ Two more things worth knowing:
   metadata file (address / public key / fingerprint / when it was created / which backend holds the key)
   that's written once alongside the real key and never contains it.
 
+### The links this server opens are never handed to a shell
+
+Two flows end with this process opening a URL in the owner's own browser: `wallet_login`'s
+`verificationUrl` and `wallet_send`'s browser handoff. **Both URLs are chosen by the backend**, which
+makes the launcher a place where "a compromised backend fails to availability, never to authority"
+could quietly stop being true - a URL interpolated into a shell command string is arbitrary code
+execution on the owner's laptop, and `"..."` quoting does not prevent it (`$(...)` and backticks still
+expand inside double quotes).
+
+So `src/wallet/browser.ts` uses `execFile`, never `exec`: the opener is spawned directly with an argv
+array, so a URL is one opaque argument no matter what characters are in it, and no shell exists to
+interpret them. On Windows that means `rundll32 url.dll,FileProtocolHandler` rather than `start`, which
+is a `cmd.exe` builtin and would have needed one. On top of that, the URL must parse as an absolute
+`http`/`https` URL before anything is launched at all - which also refuses a bare `-flag` that
+`open`/`xdg-open` would otherwise read as its own argument. `test/wallet-browser.spec.ts` pins both
+halves: the argv shape, and that the real spawn primitive leaves a substitution payload literal.
+
 ### Deleting the key on its own machine
 
 ```bash
@@ -231,6 +349,10 @@ pnpm dev           # run bin/botanary-mcp.ts directly, watching for changes (no
 pnpm typecheck     # tsc --noEmit, strict (matches the backend repo's compiler settings)
 pnpm test          # vitest - no network, no real keychain (every OS call is mocked; see
                     # test/fixtures/fake-exec.ts and test/fixtures/fake-backend.ts)
+pnpm generate:routes  # regenerate src/wallet/routes.manifest.ts from the sibling botanary-be
+                       # checkout's openapi/botanary-v1.yaml - run this and commit the result whenever
+                       # the contract changes; it never runs automatically (a published install has no
+                       # sibling openapi/ directory to read it from)
 ```
 
 `BOTANARY_MCP_HOME` overrides where the non-secret metadata file (and the file-fallback secret, if it's
@@ -247,15 +369,18 @@ What stays out on purpose:
 
 - **An agent-initiated disconnect** - `DELETE /agents/{id}` is owner-only and stays that way. `forget`
   deletes a local key; it never closes the owner-side connection, and the two must not be confused.
-- **Owner-lane authority.** Nothing in this package can add or remove a signer, write or change a
-  policy, grant another agent access, or unfreeze the account - not because those endpoints are hard to
-  call, but because an agent's grant is authority to spend inside a fence, never authority to move the
-  fence. There is no tool here that could be talked into trying.
+- **AGENT-LANE authority beyond a grant.** Nothing the agent lane does can add or remove a signer, write
+  or change a policy, grant another agent access, or unfreeze the account - not because those endpoints
+  are hard to call, but because an agent's grant is authority to spend inside a fence, never authority to
+  move the fence. There is no agent-lane tool here that could be talked into trying.
 - **A cached or session-spanning bounds check as the real gate.** `propose_payment`'s pre-check (and
   `what_may_i_do`'s rendering) reads `GET /agents/me` fresh via `AgentRuntime.me()` and refuses using
   whatever the backend reports at that moment - it never assumes a bound it read earlier still holds.
   The chain is still the only real enforcement either way (see "The bound it reads is a convenience, not
-  the check" above).
+  the check" above). The wallet lane's own `wallet_send` makes the SAME promise for the mandate lane it
+  can take (see "Lane arbitration" above), and its browser-lane fallback is likewise never a shortcut:
+  `wallet_api_get` is GET-only with no write counterpart, so every wallet-lane write terminates in the
+  owner's own browser signature, not in anything this package executes on its own.
 
 `src/runtime.ts`'s `AgentRuntime` is the seam every tool in `src/tools.ts` is built on: it owns identity,
 signing (`store.sign()`/`store.signHash()`), a cached-with-retry agent session, and one method per

package/dist/src/api-client.js

@@ -5,6 +5,7 @@
 export class BotanaryApiError extends Error {
     status;
     details;
+    retryAfterSeconds;
     constructor(message, status, 
     /**
      * The backend's own `error.details` blob, carried through rather than flattened into the message.
@@ -13,10 +14,20 @@ export class BotanaryApiError extends Error {
      * Keeping the object means a handler keys off a field the backend guarantees instead of a sentence it
      * is free to reword. Null whenever the response carried none.
      */
-    details = null) {
+    details = null, 
+    /**
+     * The `Retry-After` header's value in SECONDS, when the server sent one (429/503 carry it). Null
+     * otherwise. Kept as a first-class field because a caller that wants to survive a rate limit -
+     * `wallet/login.ts`'s poll loop is the one that must - cannot see response headers otherwise, and
+     * guessing a backoff when the server told you the exact number is how a retry storm starts.
+     * Only the numeric (delta-seconds) form is parsed; the HTTP-date form yields null, and the caller
+     * falls back to its own backoff rather than mis-parsing a date as a duration.
+     */
+    retryAfterSeconds = null) {
         super(message);
         this.status = status;
         this.details = details;
+        this.retryAfterSeconds = retryAfterSeconds;
         this.name = 'BotanaryApiError';
     }
 }
@@ -37,16 +48,38 @@ export class BotanaryApiClient {
     async get(path, token) {
         return this.#request('GET', path, undefined, token);
     }
+    /** DELETE request for logout and cleanup operations. No body, authenticated with optional token. */
+    async delete(path, token) {
+        return this.#request('DELETE', path, undefined, token);
+    }
     async #request(method, path, body, token) {
         const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
             method,
             headers: { 'content-type': 'application/json', ...(token ? { authorization: `Bearer ${token}` } : {}) },
             ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
         });
-        const json = (await res.json());
-        if (!res.ok)
-            throw new BotanaryApiError(json?.error?.message ?? `${path} failed with ${res.status}`, res.status, json?.error?.details ?? null);
-        return json;
+        // Skip body parsing for 204 No Content and other empty responses. DELETE /auth/session returns
+        // 204 with no body; parsing would throw SyntaxError. Check status first, then try to parse only
+        // if there might be content.
+        let json;
+        if (res.status !== 204 && res.headers.get('content-length') !== '0') {
+            try {
+                json = (await res.json());
+            }
+            catch {
+                // If parsing fails on a non-empty response, treat as a parsing error but continue to
+                // check res.ok so we surface the right error
+                json = undefined;
+            }
+        }
+        if (!res.ok) {
+            // Numeric delta-seconds only - `Number.parseInt` on an HTTP-date ("Wed, 21 Oct 2015 07:28:00 GMT")
+            // yields NaN, which normalizes to null rather than a nonsense wait.
+            const rawRetryAfter = res.headers.get('retry-after');
+            const retryAfterSeconds = rawRetryAfter != null ? Number.parseInt(rawRetryAfter, 10) : Number.NaN;
+            throw new BotanaryApiError(json?.error?.message ?? `${path} failed with ${res.status}`, res.status, json?.error?.details ?? null, Number.isFinite(retryAfterSeconds) && retryAfterSeconds >= 0 ? retryAfterSeconds : null);
+        }
+        return (json ?? {});
     }
 }
 //# sourceMappingURL=api-client.js.map

package/dist/src/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/api-client.ts"],"names":[],"mappings":"AAAA;;;+DAG+D;AAC/D,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAG9B;IAQA;IAVX,YACE,OAAe,EACN,MAAc;IACvB;;;;;;OAMG;IACM,UAA0C,IAAI;QAEvD,KAAK,CAAC,OAAO,CAAC,CAAC;QAVN,WAAM,GAAN,MAAM,CAAQ;QAQd,YAAO,GAAP,OAAO,CAAuC;QAGvD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;yFACyF;AACzF,MAAM,OAAO,iBAAiB;IAET;IACA;IAFnB,YACmB,OAAe,EACf,YAA0B,KAAK;QAD/B,YAAO,GAAP,OAAO,CAAQ;QACf,cAAS,GAAT,SAAS,CAAsB;IAC/C,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa,EAAE,KAAc;QACvD,OAAO,IAAI,CAAC,QAAQ,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED;2EACuE;IACvE,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,KAAc;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAI,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,MAAsB,EAAE,IAAY,EAAE,IAAa,EAAE,KAAc;QACnF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACzD,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACvG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YACT,MAAM,IAAI,gBAAgB,CACxB,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,GAAG,IAAI,gBAAgB,GAAG,CAAC,MAAM,EAAE,EAC3D,GAAG,CAAC,MAAM,EACV,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,CAC7B,CAAC;QACJ,OAAO,IAAS,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/api-client.ts"],"names":[],"mappings":"AAAA;;;+DAG+D;AAC/D,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAG9B;IAQA;IASA;IAnBX,YACE,OAAe,EACN,MAAc;IACvB;;;;;;OAMG;IACM,UAA0C,IAAI;IACvD;;;;;;;OAOG;IACM,oBAAmC,IAAI;QAEhD,KAAK,CAAC,OAAO,CAAC,CAAC;QAnBN,WAAM,GAAN,MAAM,CAAQ;QAQd,YAAO,GAAP,OAAO,CAAuC;QAS9C,sBAAiB,GAAjB,iBAAiB,CAAsB;QAGhD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;yFACyF;AACzF,MAAM,OAAO,iBAAiB;IAET;IACA;IAFnB,YACmB,OAAe,EACf,YAA0B,KAAK;QAD/B,YAAO,GAAP,OAAO,CAAQ;QACf,cAAS,GAAT,SAAS,CAAsB;IAC/C,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa,EAAE,KAAc;QACvD,OAAO,IAAI,CAAC,QAAQ,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED;2EACuE;IACvE,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,KAAc;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAI,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,MAAM,CAAI,IAAY,EAAE,KAAc;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAI,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,MAAiC,EAAE,IAAY,EAAE,IAAa,EAAE,KAAc;QAC9F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACzD,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACvG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QAEH,+FAA+F;QAC/F,gGAAgG;QAChG,6BAA6B;QAC7B,IAAI,IAA4F,CAAC;QACjG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,GAAG,EAAE,CAAC;YACpE,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAEvB,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,qFAAqF;gBACrF,6CAA6C;gBAC7C,IAAI,GAAG,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,mGAAmG;YACnG,oEAAoE;YACpE,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACrD,MAAM,iBAAiB,GAAG,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAClG,MAAM,IAAI,gBAAgB,CACxB,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,GAAG,IAAI,gBAAgB,GAAG,CAAC,MAAM,EAAE,EAC3D,GAAG,CAAC,MAAM,EACV,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAC5B,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CACxF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,IAAI,EAAE,CAAM,CAAC;IAC3B,CAAC;CACF"}

package/dist/src/diagnose.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagnose.js","sourceRoot":"","sources":["../../src/diagnose.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAsCzC,MAAM,iBAAiB,GACrB,sGAAsG,CAAC;AAEzG,SAAS,MAAM,CACb,KAAoB,EACpB,OAAe,EACf,QAAmB,EACnB,QAAiC,EAAE,EACnC,YAAoC,EAAE;IAEtC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAqB;IACrD,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC,QAAQ,EAAE,0CAA0C,EAAE;YAClE;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,qDAAqD;gBAC7D,UAAU,EAAE,oFAAoF;aACjG;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAe,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,gBAAgB,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YAC5E,OAAO,MAAM,CAAC,eAAe,EAAE,iEAAiE,EAAE;gBAChG;oBACE,IAAI,EAAE,eAAe;oBACrB,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,mDAAmD,CAAC,CAAC,MAAM,IAAI;oBACvE,UAAU,EAAE,4EAA4E;iBACzF;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,qBAAqB,EAAE,gEAAgE,EAAE;YACrG;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;gBAClD,UAAU,EAAE,8DAA8D;aAC3E;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAA4B;QACrC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;QAC7F,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI,EAAE;QAC5E,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;IAEF;;;2GAGuG;IACvG,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;IAE1G,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CACX,oBAAoB,EACpB,gBAAgB,YAAY,0DAA0D,EACtF;YACE;gBACE,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,qCAAqC;gBAC7C,UAAU,EAAE,2GAA2G;aACxH;SACF,EACD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAOlB,CAAC;IAEF,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CACX,gBAAgB,EAChB,yBAAyB,KAAK,CAAC,MAAM,qCAAqC,EAC1E;YACE;gBACE,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,SAAS,KAAK,CAAC,EAAE,gBAAgB,KAAK,CAAC,MAAM,IAAI;gBACzD,UAAU,EAAE,8DAA8D;aAC3E;SACF,EACD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,wGAAwG;IACxG,wGAAwG;IACxG,sGAAsG;IACtG,kGAAkG;IAClG,oGAAoG;IACpG,sFAAsF;IACtF,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM;YAC9C,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YACtC,CAAC,CAAC,sBAAsB,CAAC;QAC3B,OAAO,MAAM,CACX,gBAAgB,EAChB,qCAAqC,KAAK,CAAC,KAAK,IAAI,SAAS,KAAK,CAAC,OAAO,EAAE,uBAAuB;YACjG,WAAW,OAAO,uEAAuE,EAC3F;YACE;gBACE,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EACJ,sBAAsB,OAAO,eAAe,IAAI,CAAC,YAAY,CAAC,OAAO,uBAAuB;oBAC5F,0FAA0F;oBAC1F,2CAA2C;gBAC7C,UAAU,EACR,yBAAyB,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO;oBACvF,qDAAqD;aACxD;SACF,EACD,KAAK,EACL,SAAS,CACV,CAAC;IACJ,CAAC;IAED,cAAc;IACd,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAmE,CAAC;QAC9G,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,MAAM,CACX,gBAAgB,EAChB,0BAA0B,KAAK,CAAC,OAAO,sCAAsC,EAC7E;gBACE;oBACE,IAAI,EAAE,kBAAkB;oBACxB,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,WAAW,KAAK,CAAC,OAAO,8BAA8B;oBAC9D,UAAU,EAAE,yDAAyD;iBACtE;aACF,EACD,KAAK,EACL,SAAS,CACV,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAC5B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QACpB,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO,MAAM,CACX,gBAAgB,EAChB,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,8DAA8D,EAC5F;gBACE;oBACE,IAAI,EAAE,kBAAkB;oBACxB,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,oCAAoC,KAAK,CAAC,OAAO,GAAG;oBAC5D,UAAU,EAAE,+DAA+D;iBAC5E;aACF,EACD,KAAK,EACL,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,SAAS,CAAC,MAAM,GAAG,gBAAgB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,6EAA6E;YACrF,UAAU,EAAE,kEAAkE;SAC/E,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,qGAAqG;IACrG,qGAAqG;IACrG,sGAAsG;IACtG,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,CAA+E,CAAC;QAC3H,SAAS,CAAC,OAAO,GAAG,iBAAiB,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YACvC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;YAChF,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,IAAI,CAAC,CAAC;QAChC,KAAK,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC3D,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YAChB,OAAO,MAAM,CACX,UAAU,EACV,gBAAgB,YAAY,oBAAoB,MAAM,IAAI,uBAAuB,OAC/E,KAAK,CAAC,KAAK,IAAI,SAAS,KAAK,CAAC,OAAO,EACvC,sCAAsC,EACtC;gBACE,GAAG,QAAQ;gBACX;oBACE,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,iBAAiB,MAAM,eAAe,KAAK,CAAC,OAAO,yBAAyB,MAAM,GAAG;oBAC7F,UAAU,EAAE,wBAAwB,KAAK,CAAC,KAAK,IAAI,SAAS,KAAK,CAAC,OAAO,EAAE,mDAAmD;iBAC/H;aACF,EACD,KAAK,EACL,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,SAAS,CAAC,OAAO,GAAG,gBAAgB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,0EAA0E;YAClF,UAAU,EAAE,iCAAiC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;IACpD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CACX,kBAAkB,EAClB,6CAA6C,EAC7C;YACE,GAAG,QAAQ;YACX;gBACE,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,iCAAiC,SAAS,GAAG;gBACrD,UAAU,EAAE,yDAAyD;aACtE;SACF,EACD,KAAK,EACL,SAAS,CACV,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CACX,UAAU,EACV,yEAAyE,EACzE,QAAQ,EACR,KAAK,EACL,SAAS,CACV,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CACX,OAAO,EACP,gBAAgB,YAAY,4BAA4B,KAAK,CAAC,KAAK,IAAI,SAAS,KAAK,CAAC,OAAO,EAAE,8BAA8B,EAC7H,EAAE,EACF,KAAK,EACL,SAAS,CACV,CAAC;AACJ,CAAC"}
+{"version":3,"file":"diagnose.js","sourceRoot":"","sources":["../../src/diagnose.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AA0CzC,MAAM,iBAAiB,GACrB,sGAAsG,CAAC;AAEzG,SAAS,MAAM,CACb,KAAoB,EACpB,OAAe,EACf,QAAmB,EACnB,QAAiC,EAAE,EACnC,YAAoC,EAAE;IAEtC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAqB;IACrD,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC,QAAQ,EAAE,0CAA0C,EAAE;YAClE;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,qDAAqD;gBAC7D,UAAU,EAAE,oFAAoF;aACjG;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAe,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,gBAAgB,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YAC5E,OAAO,MAAM,CAAC,eAAe,EAAE,iEAAiE,EAAE;gBAChG;oBACE,IAAI,EAAE,eAAe;oBACrB,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,mDAAmD,CAAC,CAAC,MAAM,IAAI;oBACvE,UAAU,EAAE,4EAA4E;iBACzF;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,qBAAqB,EAAE,gEAAgE,EAAE;YACrG;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;gBAClD,UAAU,EAAE,8DAA8D;aAC3E;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAA4B;QACrC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;QAC7F,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI,EAAE;QAC5E,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;IAEF;;;2GAGuG;IACvG,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;IAE1G,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CACX,oBAAoB,EACpB,gBAAgB,YAAY,0DAA0D,EACtF;YACE;gBACE,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,qCAAqC;gBAC7C,UAAU,EAAE,2GAA2G;aACxH;SACF,EACD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAOlB,CAAC;IAEF,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CACX,gBAAgB,EAChB,yBAAyB,KAAK,CAAC,MAAM,qCAAqC,EAC1E;YACE;gBACE,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,SAAS,KAAK,CAAC,EAAE,gBAAgB,KAAK,CAAC,MAAM,IAAI;gBACzD,UAAU,EAAE,8DAA8D;aAC3E;SACF,EACD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,wGAAwG;IACxG,wGAAwG;IACxG,sGAAsG;IACtG,kGAAkG;IAClG,oGAAoG;IACpG,sFAAsF;IACtF,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM;YAC9C,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YACtC,CAAC,CAAC,sBAAsB,CAAC;QAC3B,OAAO,MAAM,CACX,gBAAgB,EAChB,qCAAqC,KAAK,CAAC,KAAK,IAAI,SAAS,KAAK,CAAC,OAAO,EAAE,uBAAuB;YACjG,WAAW,OAAO,uEAAuE,EAC3F;YACE;gBACE,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EACJ,sBAAsB,OAAO,eAAe,IAAI,CAAC,YAAY,CAAC,OAAO,uBAAuB;oBAC5F,0FAA0F;oBAC1F,2CAA2C;gBAC7C,UAAU,EACR,yBAAyB,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO;oBACvF,qDAAqD;aACxD;SACF,EACD,KAAK,EACL,SAAS,CACV,CAAC;IACJ,CAAC;IAED,cAAc;IACd,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAmE,CAAC;QAC9G,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,MAAM,CACX,gBAAgB,EAChB,0BAA0B,KAAK,CAAC,OAAO,sCAAsC,EAC7E;gBACE;oBACE,IAAI,EAAE,kBAAkB;oBACxB,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,WAAW,KAAK,CAAC,OAAO,8BAA8B;oBAC9D,UAAU,EAAE,yDAAyD;iBACtE;aACF,EACD,KAAK,EACL,SAAS,CACV,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAC5B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QACpB,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO,MAAM,CACX,gBAAgB,EAChB,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,8DAA8D,EAC5F;gBACE;oBACE,IAAI,EAAE,kBAAkB;oBACxB,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,oCAAoC,KAAK,CAAC,OAAO,GAAG;oBAC5D,UAAU,EAAE,+DAA+D;iBAC5E;aACF,EACD,KAAK,EACL,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,SAAS,CAAC,MAAM,GAAG,gBAAgB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,6EAA6E;YACrF,UAAU,EAAE,kEAAkE;SAC/E,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,qGAAqG;IACrG,qGAAqG;IACrG,sGAAsG;IACtG,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,CAA+E,CAAC;QAC3H,SAAS,CAAC,OAAO,GAAG,iBAAiB,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YACvC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;YAChF,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,IAAI,CAAC,CAAC;QAChC,KAAK,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC3D,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YAChB,OAAO,MAAM,CACX,UAAU,EACV,gBAAgB,YAAY,oBAAoB,MAAM,IAAI,uBAAuB,OAC/E,KAAK,CAAC,KAAK,IAAI,SAAS,KAAK,CAAC,OAAO,EACvC,sCAAsC,EACtC;gBACE,GAAG,QAAQ;gBACX;oBACE,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,iBAAiB,MAAM,eAAe,KAAK,CAAC,OAAO,yBAAyB,MAAM,GAAG;oBAC7F,UAAU,EAAE,wBAAwB,KAAK,CAAC,KAAK,IAAI,SAAS,KAAK,CAAC,OAAO,EAAE,mDAAmD;iBAC/H;aACF,EACD,KAAK,EACL,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,SAAS,CAAC,OAAO,GAAG,gBAAgB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,0EAA0E;YAClF,UAAU,EAAE,iCAAiC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;IACpD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CACX,kBAAkB,EAClB,6CAA6C,EAC7C;YACE,GAAG,QAAQ;YACX;gBACE,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,iCAAiC,SAAS,GAAG;gBACrD,UAAU,EAAE,yDAAyD;aACtE;SACF,EACD,KAAK,EACL,SAAS,CACV,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CACX,UAAU,EACV,yEAAyE,EACzE,QAAQ,EACR,KAAK,EACL,SAAS,CACV,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CACX,OAAO,EACP,gBAAgB,YAAY,4BAA4B,KAAK,CAAC,KAAK,IAAI,SAAS,KAAK,CAAC,OAAO,EAAE,8BAA8B,EAC7H,EAAE,EACF,KAAK,EACL,SAAS,CACV,CAAC;AACJ,CAAC"}

package/dist/src/identity/backends/libsecret.js

@@ -9,7 +9,7 @@ import { redactSecret } from '../redact.js';
 // bare containers and plenty of real dev machines don't have one - isAvailable() below treats that as
 // "unavailable" so store.ts falls through to the file fallback, rather than failing outright.
 const NOT_FOUND_CODES = new Set([1]); // secret-tool lookup exits 1 (empty stdout) when there's no match.
-export function createLibsecretBackend(exec = nodeExec) {
+export function createLibsecretBackend(exec = nodeExec, accountName = ACCOUNT_NAME, serviceName = SERVICE_NAME) {
     return {
         id: 'libsecret',
         label: 'Linux Secret Service (libsecret)',
@@ -28,7 +28,7 @@ export function createLibsecretBackend(exec = nodeExec) {
             }
         },
         async save(secret) {
-            const r = await exec('secret-tool', ['store', '--label=Botanary agent identity', 'service', SERVICE_NAME, 'account', ACCOUNT_NAME], { input: secret });
+            const r = await exec('secret-tool', ['store', '--label=Botanary agent identity', 'service', serviceName, 'account', accountName], { input: secret });
             if (r.code !== 0) {
                 // secret-tool doesn't echo stdin back on error, but redact defensively anyway - this backend
                 // should never be the one place that skips it.
@@ -36,7 +36,7 @@ export function createLibsecretBackend(exec = nodeExec) {
             }
         },
         async load() {
-            const r = await exec('secret-tool', ['lookup', 'service', SERVICE_NAME, 'account', ACCOUNT_NAME]);
+            const r = await exec('secret-tool', ['lookup', 'service', serviceName, 'account', accountName]);
             if (r.code !== 0) {
                 if (NOT_FOUND_CODES.has(r.code) && !r.stderr.trim())
                     return null;
@@ -46,7 +46,7 @@ export function createLibsecretBackend(exec = nodeExec) {
             return value.length > 0 ? value : null;
         },
         async delete() {
-            const r = await exec('secret-tool', ['clear', 'service', SERVICE_NAME, 'account', ACCOUNT_NAME]);
+            const r = await exec('secret-tool', ['clear', 'service', serviceName, 'account', accountName]);
             // secret-tool clear exits 0 whether or not anything was there - nothing to tolerate specially.
             if (r.code !== 0) {
                 throw new KeyBackendError('libsecret', 'delete', r.stderr || `exit ${r.code}`);

package/dist/src/identity/backends/libsecret.js.map

@@ -1 +1 @@
-{"version":3,"file":"libsecret.js","sourceRoot":"","sources":["../../../../src/identity/backends/libsecret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,YAAY,EAAmB,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,gGAAgG;AAChG,4FAA4F;AAC5F,4FAA4F;AAC5F,EAAE;AACF,wGAAwG;AACxG,sGAAsG;AACtG,8FAA8F;AAC9F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,mEAAmE;AAEzG,MAAM,UAAU,sBAAsB,CAAC,OAAa,QAAQ;IAC1D,OAAO;QACL,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,kCAAkC;QAEzC,KAAK,CAAC,WAAW;YACf,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC/C,IAAI,CAAC;gBACH,2FAA2F;gBAC3F,6FAA6F;gBAC7F,4FAA4F;gBAC5F,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,qCAAqC,CAAC,CAAC,CAAC;gBAClG,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAc;YACvB,MAAM,CAAC,GAAG,MAAM,IAAI,CAClB,aAAa,EACb,CAAC,OAAO,EAAE,iCAAiC,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,EAC9F,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;YACF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjB,6FAA6F;gBAC7F,+CAA+C;gBAC/C,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjB,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;oBAAE,OAAO,IAAI,CAAC;gBACjE,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,MAAM;YACV,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;YACjG,+FAA+F;YAC/F,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"libsecret.js","sourceRoot":"","sources":["../../../../src/identity/backends/libsecret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,YAAY,EAAmB,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,gGAAgG;AAChG,4FAA4F;AAC5F,4FAA4F;AAC5F,EAAE;AACF,wGAAwG;AACxG,sGAAsG;AACtG,8FAA8F;AAC9F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,mEAAmE;AAEzG,MAAM,UAAU,sBAAsB,CAAC,OAAa,QAAQ,EAAE,cAAsB,YAAY,EAAE,cAAsB,YAAY;IAClI,OAAO;QACL,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,kCAAkC;QAEzC,KAAK,CAAC,WAAW;YACf,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC/C,IAAI,CAAC;gBACH,2FAA2F;gBAC3F,6FAA6F;gBAC7F,4FAA4F;gBAC5F,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,qCAAqC,CAAC,CAAC,CAAC;gBAClG,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAc;YACvB,MAAM,CAAC,GAAG,MAAM,IAAI,CAClB,aAAa,EACb,CAAC,OAAO,EAAE,iCAAiC,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,EAC5F,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;YACF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjB,6FAA6F;gBAC7F,+CAA+C;gBAC/C,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YAChG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjB,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;oBAAE,OAAO,IAAI,CAAC;gBACjE,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,MAAM;YACV,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YAC/F,+FAA+F;YAC/F,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/identity/backends/macos-keychain.js

@@ -13,7 +13,7 @@ import { redactSecret } from '../redact.js';
 // binding, which we deliberately don't ship. `find-generic-password`/`delete-generic-password` take no
 // secret argument, so they don't have this issue.
 const NOT_FOUND_RE = /could not be found|item.*could not be found|specified item could not be found/i;
-export function createMacosKeychainBackend(exec = nodeExec) {
+export function createMacosKeychainBackend(exec = nodeExec, accountName = ACCOUNT_NAME, serviceName = SERVICE_NAME) {
     return {
         id: 'macos-keychain',
         label: 'macOS Keychain',
@@ -34,8 +34,8 @@ export function createMacosKeychainBackend(exec = nodeExec) {
             // -U: update in place if an entry already exists, instead of erroring "already exists".
             const r = await exec('security', [
                 'add-generic-password',
-                '-a', ACCOUNT_NAME,
-                '-s', SERVICE_NAME,
+                '-a', accountName,
+                '-s', serviceName,
                 '-w', secret,
                 '-U',
             ]);
@@ -44,7 +44,7 @@ export function createMacosKeychainBackend(exec = nodeExec) {
             }
         },
         async load() {
-            const r = await exec('security', ['find-generic-password', '-a', ACCOUNT_NAME, '-s', SERVICE_NAME, '-w']);
+            const r = await exec('security', ['find-generic-password', '-a', accountName, '-s', serviceName, '-w']);
             if (r.code !== 0) {
                 if (NOT_FOUND_RE.test(r.stderr))
                     return null;
@@ -53,7 +53,7 @@ export function createMacosKeychainBackend(exec = nodeExec) {
             return r.stdout.trim();
         },
         async delete() {
-            const r = await exec('security', ['delete-generic-password', '-a', ACCOUNT_NAME, '-s', SERVICE_NAME]);
+            const r = await exec('security', ['delete-generic-password', '-a', accountName, '-s', serviceName]);
             if (r.code !== 0 && !NOT_FOUND_RE.test(r.stderr)) {
                 throw new KeyBackendError('macos-keychain', 'delete', r.stderr || `exit ${r.code}`);
             }

package/dist/src/identity/backends/macos-keychain.js.map

@@ -1 +1 @@
-{"version":3,"file":"macos-keychain.js","sourceRoot":"","sources":["../../../../src/identity/backends/macos-keychain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,YAAY,EAAmB,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,oGAAoG;AACpG,kGAAkG;AAClG,oFAAoF;AACpF,EAAE;AACF,oGAAoG;AACpG,iGAAiG;AACjG,sGAAsG;AACtG,qGAAqG;AACrG,kGAAkG;AAClG,uGAAuG;AACvG,kDAAkD;AAClD,MAAM,YAAY,GAAG,gFAAgF,CAAC;AAEtG,MAAM,UAAU,0BAA0B,CAAC,OAAa,QAAQ;IAC9D,OAAO;QACL,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,gBAAgB;QAEvB,KAAK,CAAC,WAAW;YACf,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAChD,IAAI,CAAC;gBACH,0FAA0F;gBAC1F,4EAA4E;gBAC5E,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAc;YACvB,wFAAwF;YACxF,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;gBAC/B,sBAAsB;gBACtB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,MAAM;gBACZ,IAAI;aACL,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1G,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjB,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC7C,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,MAAM;YACV,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;YACtG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"macos-keychain.js","sourceRoot":"","sources":["../../../../src/identity/backends/macos-keychain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,YAAY,EAAmB,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,oGAAoG;AACpG,kGAAkG;AAClG,oFAAoF;AACpF,EAAE;AACF,oGAAoG;AACpG,iGAAiG;AACjG,sGAAsG;AACtG,qGAAqG;AACrG,kGAAkG;AAClG,uGAAuG;AACvG,kDAAkD;AAClD,MAAM,YAAY,GAAG,gFAAgF,CAAC;AAEtG,MAAM,UAAU,0BAA0B,CAAC,OAAa,QAAQ,EAAE,cAAsB,YAAY,EAAE,cAAsB,YAAY;IACtI,OAAO;QACL,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,gBAAgB;QAEvB,KAAK,CAAC,WAAW;YACf,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAChD,IAAI,CAAC;gBACH,0FAA0F;gBAC1F,4EAA4E;gBAC5E,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAc;YACvB,wFAAwF;YACxF,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;gBAC/B,sBAAsB;gBACtB,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,MAAM;gBACZ,IAAI;aACL,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;YACxG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjB,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC7C,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,MAAM;YACV,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YACpG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/identity/backends/select.js

@@ -1,23 +1,34 @@
+import { join } from 'node:path';
 import { createFileFallbackBackend } from './file-fallback.js';
 import { createLibsecretBackend } from './libsecret.js';
 import { createMacosKeychainBackend } from './macos-keychain.js';
+import { ACCOUNT_NAME, WALLET_ACCOUNT_NAME } from './types.js';
 import { createWindowsDpapiBackend } from './windows-dpapi.js';
+import { fileFallbackSecretPath, botanaryMcpHome } from '../../paths.js';
 /**
  * Fixed, platform-derived priority order. The SAME list is used for reads and writes (store.ts): a new
  * key is written to the first available candidate, and every candidate is swept in this order when
  * looking for an existing one. `file-fallback` is always last and always available, so this list can
  * never be empty and a caller can never end up with nowhere to store a key.
+ *
+ * CRITICAL: the agent's names (SERVICE_NAME / ACCOUNT_NAME) are FROZEN for backward compatibility.
+ * Existing installs already have keys stored under these names. Wallet uses a distinct ACCOUNT_NAME
+ * to prevent collision.
  */
-export function defaultCandidates(platform = process.platform) {
+export function defaultCandidates(platform = process.platform, isWallet = false) {
+    const accountName = isWallet ? WALLET_ACCOUNT_NAME : ACCOUNT_NAME;
+    // Wallet uses distinct file paths so multiple identities never collide
+    const walletFileFallbackPath = isWallet ? join(botanaryMcpHome(), 'wallet.key') : fileFallbackSecretPath();
+    const walletWindowsDpapiPath = isWallet ? join(botanaryMcpHome(), 'wallet.dpapi') : join(botanaryMcpHome(), 'identity.dpapi');
     switch (platform) {
         case 'darwin':
-            return [createMacosKeychainBackend(), createFileFallbackBackend()];
+            return [createMacosKeychainBackend(undefined, accountName), createFileFallbackBackend(walletFileFallbackPath)];
         case 'linux':
-            return [createLibsecretBackend(), createFileFallbackBackend()];
+            return [createLibsecretBackend(undefined, accountName), createFileFallbackBackend(walletFileFallbackPath)];
         case 'win32':
-            return [createWindowsDpapiBackend(), createFileFallbackBackend()];
+            return [createWindowsDpapiBackend(undefined, walletWindowsDpapiPath), createFileFallbackBackend(walletFileFallbackPath)];
         default:
-            return [createFileFallbackBackend()];
+            return [createFileFallbackBackend(walletFileFallbackPath)];
     }
 }
 /** Pick the first available backend from `candidates`, in order. Used only to decide where a NEW key

package/dist/src/identity/backends/select.js.map

@@ -1 +1 @@
-{"version":3,"file":"select.js","sourceRoot":"","sources":["../../../../src/identity/backends/select.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAA4B,OAAO,CAAC,QAAQ;IAC5E,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,CAAC,0BAA0B,EAAE,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,KAAK,OAAO;YACV,OAAO,CAAC,sBAAsB,EAAE,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACjE,KAAK,OAAO;YACV,OAAO,CAAC,yBAAyB,EAAE,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACpE;YACE,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;oFACoF;AACpF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAwB;IAC5D,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,MAAM,OAAO,CAAC,WAAW,EAAE;YAAE,OAAO,OAAO,CAAC;IAClD,CAAC;IACD,8FAA8F;IAC9F,qGAAqG;IACrG,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"select.js","sourceRoot":"","sources":["../../../../src/identity/backends/select.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEzE;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAA4B,OAAO,CAAC,QAAQ,EAAE,WAAoB,KAAK;IACvG,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAElE,uEAAuE;IACvE,MAAM,sBAAsB,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC;IAC3G,MAAM,sBAAsB,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAE9H,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,CAAC,0BAA0B,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACjH,KAAK,OAAO;YACV,OAAO,CAAC,sBAAsB,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7G,KAAK,OAAO;YACV,OAAO,CAAC,yBAAyB,CAAC,SAAS,EAAE,sBAAsB,CAAC,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC3H;YACE,OAAO,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;oFACoF;AACpF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAwB;IAC5D,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,MAAM,OAAO,CAAC,WAAW,EAAE;YAAE,OAAO,OAAO,CAAC;IAClD,CAAC;IACD,8FAA8F;IAC9F,qGAAqG;IACrG,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;AAC/F,CAAC"}

package/dist/src/identity/backends/types.js

@@ -10,7 +10,9 @@ export class KeyBackendError extends Error {
 }
 /** Fixed, non-secret names every real backend stores the identity under. There is exactly one agent
  *  identity per machine by design (see README) - a multi-identity store is a bigger feature than this
- *  package builds. */
+ *  package builds. These defaults are FROZEN: existing installs already have agent keys stored here.
+ *  The wallet lane uses a different ACCOUNT_NAME to prevent collision. */
 export const SERVICE_NAME = 'botanary-mcp';
 export const ACCOUNT_NAME = 'agent-identity';
+export const WALLET_ACCOUNT_NAME = 'wallet-session';
 //# sourceMappingURL=types.js.map

package/dist/src/identity/backends/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/identity/backends/types.ts"],"names":[],"mappings":"AA6BA,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAEtB;IACA;IAFlB,YACkB,OAAe,EACf,SAA+C,EAC/D,OAAe;QAEf,KAAK,CAAC,IAAI,OAAO,KAAK,SAAS,YAAY,OAAO,EAAE,CAAC,CAAC;QAJtC,YAAO,GAAP,OAAO,CAAQ;QACf,cAAS,GAAT,SAAS,CAAsC;QAI/D,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;sBAEsB;AACtB,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAC3C,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/identity/backends/types.ts"],"names":[],"mappings":"AA6BA,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAEtB;IACA;IAFlB,YACkB,OAAe,EACf,SAA+C,EAC/D,OAAe;QAEf,KAAK,CAAC,IAAI,OAAO,KAAK,SAAS,YAAY,OAAO,EAAE,CAAC,CAAC;QAJtC,YAAO,GAAP,OAAO,CAAQ;QACf,cAAS,GAAT,SAAS,CAAsC;QAI/D,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;;0EAG0E;AAC1E,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAC3C,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC"}

package/dist/src/identity/backends/windows-dpapi.js

@@ -34,8 +34,8 @@ const UNPROTECT_SCRIPT = [
     '[Console]::Out.Write([System.Text.Encoding]::UTF8.GetString($unprotected))',
 ].join('\n');
 const PS_ARGS = ['-NoProfile', '-NonInteractive', '-Command'];
-function defaultFilePath() {
-    return join(botanaryMcpHome(), 'identity.dpapi');
+function defaultFilePath(filename = 'identity.dpapi') {
+    return join(botanaryMcpHome(), filename);
 }
 export function createWindowsDpapiBackend(exec = nodeExec, filePath = defaultFilePath()) {
     return {

package/dist/src/identity/backends/windows-dpapi.js.map

@@ -1 +1 @@
-{"version":3,"file":"windows-dpapi.js","sourceRoot":"","sources":["../../../../src/identity/backends/windows-dpapi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAa,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAmB,eAAe,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,sGAAsG;AACtG,uGAAuG;AACvG,+FAA+F;AAC/F,8FAA8F;AAC9F,EAAE;AACF,mFAAmF;AACnF,sGAAsG;AACtG,qGAAqG;AACrG,qGAAqG;AACrG,sGAAsG;AACtG,qGAAqG;AACrG,+FAA+F;AAC/F,qGAAqG;AACrG,sGAAsG;AACtG,uGAAuG;AACvG,MAAM,cAAc,GAAG;IACrB,wCAAwC;IACxC,mCAAmC;IACnC,uDAAuD;IACvD,oJAAoJ;IACpJ,6DAA6D;CAC9D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,gBAAgB,GAAG;IACvB,wCAAwC;IACxC,kCAAkC;IAClC,4CAA4C;IAC5C,wJAAwJ;IACxJ,4EAA4E;CAC7E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;AAE9D,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,eAAe,EAAE,EAAE,gBAAgB,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAa,QAAQ,EAAE,WAAmB,eAAe,EAAE;IACnG,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,kDAAkD;QAEzD,KAAK,CAAC,WAAW;YACf,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBACpE,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAc;YACvB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,OAAO,EAAE,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACpF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrC,iGAAiG;gBACjG,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YACzG,CAAC;YACD,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,gGAAgG;YAChG,2FAA2F;YAC3F,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,KAAK,CAAC,IAAI;YACR,IAAI,UAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAChE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,OAAO,EAAE,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"windows-dpapi.js","sourceRoot":"","sources":["../../../../src/identity/backends/windows-dpapi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAa,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAmB,eAAe,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,sGAAsG;AACtG,uGAAuG;AACvG,+FAA+F;AAC/F,8FAA8F;AAC9F,EAAE;AACF,mFAAmF;AACnF,sGAAsG;AACtG,qGAAqG;AACrG,qGAAqG;AACrG,sGAAsG;AACtG,qGAAqG;AACrG,+FAA+F;AAC/F,qGAAqG;AACrG,sGAAsG;AACtG,uGAAuG;AACvG,MAAM,cAAc,GAAG;IACrB,wCAAwC;IACxC,mCAAmC;IACnC,uDAAuD;IACvD,oJAAoJ;IACpJ,6DAA6D;CAC9D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,gBAAgB,GAAG;IACvB,wCAAwC;IACxC,kCAAkC;IAClC,4CAA4C;IAC5C,wJAAwJ;IACxJ,4EAA4E;CAC7E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;AAE9D,SAAS,eAAe,CAAC,WAAmB,gBAAgB;IAC1D,OAAO,IAAI,CAAC,eAAe,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAa,QAAQ,EAAE,WAAmB,eAAe,EAAE;IACnG,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,kDAAkD;QAEzD,KAAK,CAAC,WAAW;YACf,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBACpE,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAc;YACvB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,OAAO,EAAE,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACpF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrC,iGAAiG;gBACjG,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YACzG,CAAC;YACD,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,gGAAgG;YAChG,2FAA2F;YAC3F,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,KAAK,CAAC,IAAI;YACR,IAAI,UAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,GAAG,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAChE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,OAAO,EAAE,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/package-version.js

@@ -0,0 +1,50 @@
+/**
+ * This package's own version, read from its real `package.json` at runtime.
+ *
+ * WHY NOT a hand-maintained constant: `server.ts` used to carry `const PACKAGE_VERSION = '0.3.0'`, a
+ * literal that nothing forces to track `package.json`. Once a SECOND consumer appeared - the CLI-login
+ * handshake reports `clientVersion` to the backend, which surfaces it on the owner's consent screen -
+ * a stale literal stops being cosmetic: the owner is being shown a version claim about the very client
+ * asking for authority over their account, and it has to be the version actually running.
+ *
+ * WHY NOT `import pkg from '../package.json'`: `tsc` would then EMIT that JSON into `outDir`, producing
+ * a `dist/package.json` with no `"type": "module"` field - which Node reads as a package boundary and
+ * uses to decide that every `.js` under `dist/` is CommonJS. The published `bin` entrypoint would fail
+ * to load. Reading it with `fs` at runtime keeps `dist/` free of any nested manifest.
+ *
+ * The walk handles BOTH layouts this file runs under with one code path: `src/package-version.ts` under
+ * vitest/@swc-node (package root is one level up) and `dist/src/package-version.js` when installed from
+ * npm (two levels up).
+ */
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/** Last resort only - see `readPackageVersion`. Never the normal path. */
+const UNKNOWN_VERSION = '0.0.0-unknown';
+function readPackageVersion() {
+    let dir = dirname(fileURLToPath(import.meta.url));
+    // Bounded: five levels is far more than either real layout needs, and a bound means a malformed
+    // install can never turn this into an unbounded filesystem walk on every login.
+    for (let i = 0; i < 5; i++) {
+        try {
+            const parsed = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
+            // Name-checked so a nested manifest (a bundler artifact, a stray fixture) can never be mistaken
+            // for ours and report someone else's version to the consent screen.
+            if (parsed.name === 'botanary-mcp' && typeof parsed.version === 'string')
+                return parsed.version;
+        }
+        catch {
+            // No package.json at this level, or it is unreadable - keep walking up.
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break; // filesystem root
+        dir = parent;
+    }
+    // Never throw: a version string is metadata on a login handshake, and failing to read it must not be
+    // able to stop an owner logging in to their own wallet.
+    return UNKNOWN_VERSION;
+}
+/** Resolved once at module load - the file cannot change under a running process. */
+export const PACKAGE_VERSION = readPackageVersion();
+//# sourceMappingURL=package-version.js.map

package/dist/src/package-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-version.js","sourceRoot":"","sources":["../../src/package-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,0EAA0E;AAC1E,MAAM,eAAe,GAAG,eAAe,CAAC;AAExC,SAAS,kBAAkB;IACzB,IAAI,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,gGAAgG;IAChG,gFAAgF;IAChF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAGxE,CAAC;YACF,gGAAgG;YAChG,oEAAoE;YACpE,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC,OAAO,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM,CAAC,kBAAkB;QAC7C,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,qGAAqG;IACrG,wDAAwD;IACxD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,eAAe,GAAW,kBAAkB,EAAE,CAAC"}