crosscheck-cli 0.0.63 → 0.0.64

package/dist/activate.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Activation. Two paths:
+ *
+ *   1. Device-authorization grant (RFC 8628) — new default. Run with no
+ *      argument:  `crosscheck activate`
+ *      Prints a URL + short user-code; polls /api/crosscheck/cli/token
+ *      until the user authorizes in their browser; stores the resulting
+ *      JWT + signing keys in the OS keychain. This is what `gh auth
+ *      login` / `vercel login` do; eliminates the "paste a 256-char
+ *      base64 token into your terminal" friction wall.
+ *
+ *   2. Legacy single-use token paste — kept alive for backwards
+ *      compatibility with the old install flow:
+ *      `crosscheck activate <TOKEN>`
+ *      Will be removed in a future release.
+ *
+ * Both paths end with the same artifacts in the keychain:
+ *   - jwt              (Ed25519-signed activation JWT)
+ *   - jwtJti           (revocation handle)
+ *   - jwtPublicKey     (key used to verify the JWT — comes from server)
+ *   - hmacSigningKey   (per-seat key for signing telemetry events)
+ */
+/** Public entry point. With no token, runs the device flow. */
+export declare function activate(token?: string): Promise<void>;
+/**
+ * Device-flow activation. Prints a URL + user-code, polls until the user
+ * authorizes in their browser, then stores artifacts in the keychain.
+ *
+ * Polling resilience (per Matt's panel review): network errors retry with
+ * backoff and don't terminate the flow. Only `expired`, `denied`, and
+ * `already_consumed` are terminal.
+ */
+export declare function activateDeviceFlow(opts?: {
+    /** Extra query params appended to the /cli/start verification URL — used by
+     *  `install` to pass a loopback callback + state + provider list so the same
+     *  browser session also collects provider keys (one visit, not two). */
+    extraVerifyParams?: Record<string, string>;
+    /** crosscheck-enterprise only: point the browser step at
+     *  /enterprise/sso/start instead of the server-provided /cli/start. The
+     *  device-code/poll/JWT mechanics underneath are completely unchanged —
+     *  only which page confirms the code differs. */
+    verificationUrlOverride?: string;
+    /** Called once the device code exists, instead of printing to the console.
+     *  A GUI host (Crosscheck Desktop) renders the code and URL in its own
+     *  window; a terminal is not the only place this flow can happen. When
+     *  omitted, the console output below is unchanged. */
+    onPrompt?: (info: {
+        verifyUrl: string;
+        userCode: string;
+        expiresIn: number;
+    }) => void;
+    /** Set false to suppress the automatic browser launch — a GUI host may want
+     *  to show the code first and let the user press a button. */
+    autoOpenBrowser?: boolean;
+}): Promise<void>;

package/dist/activate.js

@@ -93,8 +93,14 @@ export async function activateDeviceFlow(opts) {
         parts.push(`${encodeURIComponent(k)}=${encodeURIComponent(v)}`);
     }
     const verifyUrl = `${opts?.verificationUrlOverride ?? start.verificationUrl}?${parts.join("&")}`;
-    printActivationPrompt(verifyUrl, start.userCode, start.expiresIn);
-    openBrowser(verifyUrl);
+    if (opts?.onPrompt) {
+        opts.onPrompt({ verifyUrl, userCode: start.userCode, expiresIn: start.expiresIn });
+    }
+    else {
+        printActivationPrompt(verifyUrl, start.userCode, start.expiresIn);
+    }
+    if (opts?.autoOpenBrowser !== false)
+        openBrowser(verifyUrl);
     // Compute the machine fingerprint once and send it on every poll so the
     // device-flow activation carries the same identity as the legacy flow
     // (enables revocation + the server's seat-in-use guard).

package/dist/activate.js.map

@@ -1 +1 @@
-{"version":3,"file":"activate.js","sourceRoot":"","sources":["../src/activate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAgC1B,2DAA2D;AAC3D,KAAK,UAAU,iBAAiB,CAAC,CAAkB;IACjD,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QACnB,MAAM,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAc;IAC3C,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAChC,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,cAAc,CAAC,KAAa;IACzC,MAAM,eAAe,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACvD,MAAM,WAAW,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IAEpC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,UAAU,0BAA0B,EAAE;QACjE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,eAAe,EAAE,KAAK;YACtB,eAAe;YACf,WAAW;YACX,UAAU;SACX,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAmB,CAAC;IACvD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1D,MAAM,KAAK,GACT,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE;YACtB,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1D,CAAC,CAAC,QAAQ,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAUxC;IACC,iDAAiD;IACjD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,UAAU,iCAAiC,EAAE;QAC7E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;KACzB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAwB,CAAC;IAClE,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACjE,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,0EAA0E;IAC1E,MAAM,KAAK,GAAG,CAAC,QAAQ,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,IAAI,EAAE,uBAAuB,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACjG,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAClE,WAAW,CAAC,SAAS,CAAC,CAAC;IAEvB,wEAAwE;IACxE,sEAAsE;IACtE,yDAAyD;IACzD,MAAM,eAAe,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACvD,MAAM,WAAW,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IAEpC,yBAAyB;IACzB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACvD,IAAI,UAAU,GAAG,SAAS,CAAC;IAC3B,sEAAsE;IACtE,wCAAwC;IACxC,IAAI,SAAS,GAAG,UAAU,CAAC;IAE3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACvB,SAAS,GAAG,UAAU,CAAC,CAAC,gDAAgD;QAExE,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,UAAU,2BAA2B,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,eAAe;oBACf,WAAW;oBACX,UAAU;iBACX,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kCAAkC;YAClC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,eAAe,CACpF,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAkB,CAAC;QACtD,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC9B,sCAAsC;YACtC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACrD,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,oEAAoE;gBACpE,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;oBACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC1B,UAAU,GAAG,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,6DAA6D;oBAC3D,GAAG,UAAU,kEAAkE;oBAC/E,wEAAwE;oBACxE,4EAA4E;oBAC5E,iBAAiB,CACpB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,eAAe,EAAE,CAAC;gBAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,kBAAkB,EAAE,CAAC;gBAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,gDAAgD,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,CAAC,KAAK,cAAc,EAAE,CAAC;gBACzB,2CAA2C;gBAC3C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,2DAA2D;YAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,SAAiB,EACjB,QAAgB,EAChB,SAAiB;IAEjB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAC3C,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC;IAChC,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;IAC/B,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,mCAAmC,CAAC,CAAC;IAC7E,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"activate.js","sourceRoot":"","sources":["../src/activate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAgC1B,2DAA2D;AAC3D,KAAK,UAAU,iBAAiB,CAAC,CAAkB;IACjD,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QACnB,MAAM,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAc;IAC3C,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAChC,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,cAAc,CAAC,KAAa;IACzC,MAAM,eAAe,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACvD,MAAM,WAAW,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IAEpC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,UAAU,0BAA0B,EAAE;QACjE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,eAAe,EAAE,KAAK;YACtB,eAAe;YACf,WAAW;YACX,UAAU;SACX,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAmB,CAAC;IACvD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1D,MAAM,KAAK,GACT,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE;YACtB,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1D,CAAC,CAAC,QAAQ,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAkBxC;IACC,iDAAiD;IACjD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,UAAU,iCAAiC,EAAE;QAC7E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;KACzB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAwB,CAAC;IAClE,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACjE,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,0EAA0E;IAC1E,MAAM,KAAK,GAAG,CAAC,QAAQ,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,IAAI,EAAE,uBAAuB,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACjG,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACrF,CAAC;SAAM,CAAC;QACN,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,IAAI,EAAE,eAAe,KAAK,KAAK;QAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IAE5D,wEAAwE;IACxE,sEAAsE;IACtE,yDAAyD;IACzD,MAAM,eAAe,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACvD,MAAM,WAAW,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IAEpC,yBAAyB;IACzB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACvD,IAAI,UAAU,GAAG,SAAS,CAAC;IAC3B,sEAAsE;IACtE,wCAAwC;IACxC,IAAI,SAAS,GAAG,UAAU,CAAC;IAE3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACvB,SAAS,GAAG,UAAU,CAAC,CAAC,gDAAgD;QAExE,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,UAAU,2BAA2B,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,eAAe;oBACf,WAAW;oBACX,UAAU;iBACX,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kCAAkC;YAClC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,eAAe,CACpF,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAkB,CAAC;QACtD,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC9B,sCAAsC;YACtC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACrD,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,oEAAoE;gBACpE,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;oBACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC1B,UAAU,GAAG,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,6DAA6D;oBAC3D,GAAG,UAAU,kEAAkE;oBAC/E,wEAAwE;oBACxE,4EAA4E;oBAC5E,iBAAiB,CACpB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,eAAe,EAAE,CAAC;gBAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,kBAAkB,EAAE,CAAC;gBAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,gDAAgD,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,CAAC,KAAK,cAAc,EAAE,CAAC;gBACzB,2CAA2C;gBAC3C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,2DAA2D;YAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,SAAiB,EACjB,QAAgB,EAChB,SAAiB;IAEjB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAC3C,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC;IAChC,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;IAC/B,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,mCAAmC,CAAC,CAAC;IAC7E,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/cli-enterprise.d.ts

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+/**
+ * crosscheck-enterprise CLI entry point. Deliberately a much smaller command
+ * surface than the standard crosscheck-cli's cli.ts — no `keys store`
+ * (file/keychain), no `keys add|remove` free-for-all, no `--backend`
+ * choice, no Google-OAuth activate/login. Every one of those omissions is
+ * the point, not an oversight: this bin only ever signs in via the org's
+ * SSO and only ever stores keys in 1Password, restricted to whatever the
+ * org admin has currently allowed (see /account/enterprise).
+ */
+export {};

package/dist/cli.d.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+/**
+ * Crosscheck (XC) CLI entry point. Minimal argument parser — subcommand and
+ * positional/named args. We don't pull in a heavyweight CLI library in the
+ * skeleton; if richer help text or interactive flows are needed later,
+ * commander or yargs slots in here.
+ */
+export {};

package/dist/config.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Compile-time constants. Override the server base URL via the
+ * CROSSCHECK_SERVER environment variable for local development against a
+ * preview deployment. The Ed25519 public key is embedded at build time so
+ * the CLI can verify JWTs offline.
+ */
+export declare const SERVER_URL: string;
+/** npm package name of this CLI — used when self-registering the MCP server. */
+export declare const CLI_PACKAGE = "crosscheck-cli";
+/** This CLI's own version, read from package.json at runtime. Used by the
+ *  serve-time update check to compare against the npm `latest` dist-tag. */
+export declare const CLI_VERSION: string;
+/**
+ * npm package name of the TypeScript MCP engine the CLI runs. The CLI is the
+ * license/onboarding wrapper; crosscheck-mcp is the engine (formerly a bundled
+ * Python server — now pure TypeScript, shipped as a normal npm dependency).
+ */
+export declare const ENGINE_PACKAGE = "crosscheck-mcp";
+/**
+ * Engine version the npx fallback pins to. We never float the fallback to
+ * `@latest`: that drifts past the version this CLI was built/tested against
+ * and triggers a fresh native rebuild in a throwaway npx cache (the failure
+ * mode behind "MCP error -32000: Connection closed" on some machines). Keep
+ * this in lockstep with the `crosscheck-mcp` dependency in package.json.
+ */
+export declare const ENGINE_FALLBACK_VERSION = "0.2.25";
+/**
+ * Ed25519 public key (PEM, SPKI) used to verify activation JWTs. This is
+ * replaced at build time by the publish pipeline with the public half of
+ * the keypair produced by scripts/generate-cb-secrets.ts on the server.
+ *
+ * For local dev: set CROSSCHECK_JWT_PUBLIC_KEY in the environment.
+ */
+export declare const EMBEDDED_PUBLIC_KEY_PEM: string;
+/**
+ * OS keychain service identifier. Stored entries:
+ *   - "jwt"                            → the activation JWT (rotates ~weekly)
+ *   - "hmacSigningKey"                 → per-seat HMAC key from /activate
+ *   - "key:anthropic" / "key:openai" / "key:gemini" / "key:grok"
+ *                                      → user-supplied upstream LLM keys
+ *   - "installUuid"                    → stable UUID generated at first run
+ */
+export declare const KEYCHAIN_SERVICE = "crosscheck";
+/**
+ * Heartbeat cadence. Matches the server's 24h refreshAt / 7d exp / 72h
+ * fail-open grace. Configurable for tests.
+ */
+export declare const HEARTBEAT_INTERVAL_MS: number;
+export declare const HEARTBEAT_FAIL_OPEN_MS: number;
+/**
+ * Telemetry batch flush. Events accumulate in memory and POST in batches
+ * up to 100 events or 30 seconds, whichever comes first.
+ */
+export declare const TELEMETRY_BATCH_SIZE = 50;
+export declare const TELEMETRY_FLUSH_MS = 30000;

package/dist/config.js

@@ -31,7 +31,7 @@ export const ENGINE_PACKAGE = "crosscheck-mcp";
  * mode behind "MCP error -32000: Connection closed" on some machines). Keep
  * this in lockstep with the `crosscheck-mcp` dependency in package.json.
  */
-export const ENGINE_FALLBACK_VERSION = "0.2.15";
+export const ENGINE_FALLBACK_VERSION = "0.2.25";
 /**
  * Ed25519 public key (PEM, SPKI) used to verify activation JWTs. This is
  * replaced at build time by the publish pipeline with the public half of

package/dist/doctor.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `crosscheck doctor` — diagnose a broken install without guessing.
+ *
+ * Prints a checklist and exits non-zero if a CRITICAL check fails, so users
+ * (and support) get an actionable cause instead of Claude Code's bare
+ * "-32000: Connection closed". Each check is independent and never throws —
+ * a thrown check is reported as a failure, not a crash.
+ */
+export type Level = "ok" | "warn" | "fail";
+export declare function line(level: Level, msg: string): void;
+export declare function runDoctor(): Promise<{
+    critical: number;
+}>;

package/dist/engine-version.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Resolve the crosscheck-mcp engine version this process is actually RUNNING
+ * — for diagnostics (heartbeat reporting) only, never for launch decisions
+ * (mcp.ts's resolveEngineLauncher is the source of truth there).
+ *
+ * MEMOIZED, AND THAT IS THE POINT. `serve` is a long-lived process that
+ * loaded the engine once at startup, but the file it loaded from is an npx
+ * cache directory that a later `npx crosscheck-cli@latest` overwrites in
+ * place. Re-reading package.json on every heartbeat therefore reported the
+ * version on DISK while the process kept executing the code it had already
+ * loaded — so a server running a five-day-old engine cheerfully reported
+ * itself as current.
+ *
+ * That is not a cosmetic reporting bug. It is why a GPT-6 Astra failure went
+ * unexplained for days: the dashboard said the engine was new enough to have
+ * the fix, the process was not, and nothing anywhere could see the gap.
+ * Reading once, at startup, means the reported version is the version whose
+ * code is running.
+ *
+ * Can't `require.resolve(`${ENGINE_PACKAGE}/package.json`)` directly — the
+ * engine's "exports" map only exposes ".", so that subpath throws on Node
+ * ≥18 (see mcp.ts). Instead resolve the main entry (dist/<entry>.cjs) and
+ * walk up two directories to the package root.
+ */
+export declare function resolveEngineVersion(): string;
+/** Test seam only — lets a test observe that the value is pinned. */
+export declare function __resetEngineVersionCache(): void;

package/dist/enterprise/compliance.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Shared compliance check: is this machine actually doing what its org's
+ * enterprise policy requires? Used by both `doctor` (human-readable report)
+ * and the heartbeat self-report (the one signal that can trigger a
+ * server-side revocation — see crosscheck-site's decidePolicyCompliance).
+ *
+ * Compliant means BOTH:
+ *   1. The secret backend is 1password-only (no local file/keychain keys).
+ *   2. Every locally-configured provider key is on the org's current
+ *      allowlist (no leftover key for a provider the admin has since
+ *      disabled).
+ */
+import { type ProviderPolicy } from "./policy.js";
+export type ComplianceReport = {
+    compliant: boolean;
+    policy: ProviderPolicy | null;
+    backendOk: boolean;
+    outOfPolicyProviders: string[];
+};
+export declare function checkCompliance(jwt: string): Promise<ComplianceReport>;

package/dist/enterprise/doctor.d.ts

@@ -0,0 +1,17 @@
+/**
+ * crosscheck-enterprise-only doctor checks, run in addition to the shared
+ * runDoctor() checks (Node version, secret store, activation, etc.). Two
+ * things the standard CLI has no concept of, both computed by the shared
+ * checkCompliance() helper (also used by the heartbeat self-report):
+ *
+ *   1. Is the 1Password-only backend actually active? (Not just configured
+ *      — actually the CURRENT backend. A user who somehow ran the legacy
+ *      `--backend 1password` flow is caught here, not silently accepted.)
+ *   2. Are locally-configured provider keys a subset of the org's current
+ *      allowlist? A key left over from before an admin disabled a provider
+ *      would otherwise sit there unnoticed until the next `serve` filters
+ *      it out anyway — this surfaces it explicitly.
+ */
+export declare function runEnterpriseDoctorChecks(): Promise<{
+    critical: number;
+}>;

package/dist/enterprise/install.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `crosscheck-enterprise install` — the enterprise analog of install.ts's
+ * runInstall(): activate/sign-in, set up keys, register the MCP server.
+ * Idempotent, same as the standard install (safe to re-run).
+ *
+ * Differences from the standard flow, by design (see the org bootstrap
+ * model in schema.ts): sign-in is always SSO (enterpriseLogin, never
+ * Google), and keys setup is always the restricted 1Password-only wizard
+ * scoped to the org's current provider allowlist — there is no "skip keys,
+ * add later" shortcut here the way the standard flow has, because without
+ * at least one allowed provider mapped there's nothing this bin can do.
+ */
+export declare function runEnterpriseInstall(): Promise<void>;

package/dist/enterprise/keys-setup.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `crosscheck-enterprise keys setup` — 1Password-only, restricted to the
+ * org's currently-allowed providers. Unlike the standard CLI's `keys setup`,
+ * there is no file/keychain option to fall back to, and no `--backend`
+ * choice: this bin only ever wires 1Password, and only ever offers
+ * providers the org admin has enabled (see /account/enterprise).
+ */
+export declare function runEnterpriseOnePasswordKeysSetup(): Promise<void>;

package/dist/enterprise/login.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `crosscheck-enterprise login` — same device-code/poll/JWT mechanics as
+ * the standard CLI's activate flow (activateDeviceFlow), just pointed at
+ * /enterprise/sso/start instead of the server-provided /cli/start. That
+ * page collects the work email and routes to the org's own Okta/Entra —
+ * there is no Google OAuth path in this bin at all.
+ */
+export declare function enterpriseLogin(): Promise<void>;

package/dist/enterprise/policy.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Provider-policy fetch + cache for crosscheck-enterprise. Deliberately
+ * fails RESTRICTIVE (last-known-good cached policy, or an empty allowlist
+ * if there's no cache at all) rather than fail-open — the opposite
+ * fail-direction from heartbeat's entitlement grace window, on purpose:
+ * staying open is safe for "are you still a paying customer," staying
+ * restricted is safe for "which providers is this org allowed to use."
+ */
+import type { ModelPolicy } from "../model-policy.js";
+export type ProviderPolicy = {
+    version: number;
+    allowedProviders: readonly string[];
+    /** Per-provider model allow/deny, additive on top of allowedProviders.
+     *  Absent (undefined) or missing a given provider means no model-level
+     *  restriction for that provider — only the provider-level allowlist
+     *  above applies. Optional so an older cached policy.json (pre-model-
+     *  policy) still parses. */
+    modelPolicy?: ModelPolicy;
+};
+/**
+ * Fetch the current policy from the server, falling back to the cached
+ * last-known-good policy on any failure (network, non-200, malformed body).
+ * Returns null only when there's neither a live fetch NOR a cache — the
+ * caller should treat that as "no providers allowed" (see mcp.ts).
+ */
+export declare function fetchProviderPolicy(jwt: string): Promise<ProviderPolicy | null>;

package/dist/explain.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `crosscheck explain` — verify a cost figure on your own machine.
+ *
+ * The server stores opaque fingerprints; the laptop stores the mapping from
+ * fingerprint to branch name. This command is where the two meet, and it is
+ * the whole answer to "how do I know that number is real?" — a developer can
+ * check every dollar attributed to them without the server ever having learned
+ * what they were building.
+ *
+ * It prints only what it can actually stand behind: buckets the server has
+ * numbers for, joined to local labels where the local map has them, and an
+ * explicit note where it doesn't. No estimating, no filling in gaps.
+ */
+type LocalEntry = {
+    label: string;
+    lastSeen: string;
+};
+type LocalMap = Record<string, LocalEntry>;
+export type ServerBucket = {
+    fingerprint: string;
+    kind: "feature" | "maintenance";
+    label: string | null;
+    panelRuns: number;
+    panelCostUsd: number;
+    hostTokens: number;
+    hostCostUsd: number;
+    totalCostUsd: number;
+    sharedCostUsd?: number;
+};
+export declare function localFeatureMap(dir?: string): LocalMap;
+/**
+ * Render the joined view. Pure, so the formatting is testable without a
+ * network or a home directory.
+ */
+export declare function renderExplain(buckets: ServerBucket[], local: LocalMap): string;
+/** Fetch buckets for this seat and print the joined view. */
+export declare function explain(): Promise<number>;
+export {};

package/dist/fingerprint.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Privacy-preserving machine fingerprint. Hashed with scrypt (Node built-in):
+ *
+ *   fingerprint = scrypt(machine-id || install-uuid || os-platform, fixedSalt)
+ *
+ * The same inputs always produce the same hash (fixed salt). The hash is not
+ * reversible to PII — it's only useful as a stable identifier for
+ * re-activation flows. NEVER raw MAC address, serial number, or hardware UUID
+ * — those are PII and unstable across OS updates.
+ *
+ * Uses Node's built-in crypto (no native dependency) — the fingerprint is a
+ * stable, non-secret identifier the server simply stores, so a slow password
+ * KDF (argon2) was unnecessary and added a node-gyp build step.
+ *
+ * The `installUuid` is generated once at first run and stored in the OS
+ * keychain so subsequent invocations on the same install yield the same
+ * fingerprint even if the machine-id rotates.
+ */
+export type OsPlatform = "darwin" | "linux" | "win32" | "other";
+export declare function detectPlatform(): OsPlatform;
+export declare function getOrCreateInstallUuid(): Promise<string>;
+/**
+ * Best-effort machine identifier. Falls back to a stable hash of OS +
+ * hostname if a true machine-id is unavailable.
+ */
+export declare function getMachineId(): string;
+/**
+ * Compute the fingerprint hash. scrypt with the fixed salt so the result is
+ * deterministic for the same machine and the server can just store the string.
+ */
+export declare function computeFingerprintHash(): Promise<string>;

package/dist/heartbeat.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Heartbeat scheduler. Runs every 24h from a long-lived `crosscheck serve`
+ * process; tolerates up to 72h of network failure before locking the CLI
+ * out (matches the server's grace window).
+ *
+ * On `status: "revoked"` the CLI must refuse to make further calls and
+ * surface the reason ("your subscription was canceled", "this machine was
+ * deactivated from the dashboard", etc.) — heartbeat is the only way the
+ * server gets to revoke a seat that's already activated.
+ */
+type HeartbeatResponse = {
+    status: "ok" | "revoked" | "past_due";
+    reason?: string;
+    refreshJwt?: string;
+    refreshAt?: string;
+    expiresAt?: string;
+};
+export type HeartbeatState = {
+    lastOkAt: number | null;
+    status: "ok" | "revoked" | "past_due";
+    message: string | null;
+};
+export declare function currentState(): HeartbeatState;
+export declare function isAllowedToRun(now?: number): boolean;
+export declare function runHeartbeat(opts?: {
+    checkPolicyCompliance?: boolean;
+}): Promise<HeartbeatResponse>;
+/** Long-running scheduler. Returns a stop fn. */
+export declare function startScheduler(opts?: {
+    checkPolicyCompliance?: boolean;
+}): () => void;
+export {};

package/dist/http.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Minimal HTTP helper built on Node's global `fetch` (stable in Node 18+).
+ *
+ * Why not undici: undici@7 hard-requires Node >= 20.18.1 and crashes on import
+ * on slightly older Node 20.x — and its `request()` does NOT follow 3xx
+ * redirects on POST, so an apex→www 308 made every activation call read a
+ * "Redirecting…" HTML body and fail to parse as JSON. Global `fetch` is built
+ * in (no dependency, works on Node 18+) and follows redirects by default.
+ *
+ * The returned shape intentionally mirrors the slice of undici's `request`
+ * response this CLI used (`statusCode`, `body.json()`, `body.text()`) so call
+ * sites didn't have to change.
+ */
+type RequestOpts = {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+    /**
+     * Abort after this many ms. Opt-in, because most calls here are user-
+     * initiated and would rather wait than fail. Startup-path calls are the
+     * exception: on that path a hanging server must not hold up an MCP
+     * connection, so those pass a bound.
+     */
+    timeoutMs?: number;
+};
+export declare function request(url: string, opts?: RequestOpts): Promise<{
+    statusCode: number;
+    body: {
+        json: () => Promise<unknown>;
+        text: () => Promise<string>;
+    };
+}>;
+export {};

package/dist/install.d.ts

@@ -0,0 +1,19 @@
+/**
+ * One-command install orchestrator — the path documented for Claude Code in
+ * VS Code. Run as `npx -y crosscheck-cli@latest install` (Claude Code will
+ * run this for you when you ask it to "Install Crosscheck").
+ *
+ * Steps:
+ *   1. Node version sanity check.
+ *   2. Activate + add provider keys. For a first-time install this is ONE
+ *      browser session: the keys loopback is started, device-auth opens
+ *      /cli/start with the loopback params, and after authorization the same
+ *      page collects all provider keys. Env-present keys are imported first;
+ *      already-activated machines just top up missing keys.
+ *   3. Register the MCP server with Claude Code (user scope), then next steps.
+ *
+ * Fully non-interactive (never reads stdin) and idempotent — re-running
+ * `crosscheck install` is safe, and a skipped/timed-out keys step still leaves
+ * activation intact (run `crosscheck keys setup` later).
+ */
+export declare function runInstall(): Promise<void>;

package/dist/jwt.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Local Ed25519 JWT verification. The activation flow stores the JWT in the
+ * keychain along with the public key that signed it; every subsequent CLI
+ * invocation parses + verifies it locally with the keychain-stored public
+ * key before making any privileged decision (e.g., whether to keep running,
+ * whether to refresh on heartbeat).
+ *
+ * No network round-trip on the hot path — heartbeats are scheduled, not
+ * per-call. This is the offline-tolerance the design depends on.
+ *
+ * Public-key source precedence:
+ *   1. Keychain entry "jwtPublicKey" (set by activate.ts on first activation)
+ *   2. CROSSCHECK_JWT_PUBLIC_KEY env var (dev override)
+ *   3. Fall back to bundled config.ts constant (empty by default; deprecated)
+ *
+ * verifyJwt is async because it reads from the OS keychain. Callers must
+ * await it. The first call caches the resolved KeyObject in memory.
+ */
+export type CodybuildJwtPayload = {
+    sub: string;
+    seatId: string;
+    orgId: string;
+    fp: string;
+    iat: number;
+    exp: number;
+    refreshAt: number;
+    jti: string;
+};
+export declare function verifyJwt(jwt: string): Promise<{
+    ok: true;
+    payload: CodybuildJwtPayload;
+} | {
+    ok: false;
+    reason: string;
+}>;

package/dist/key-format.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Provider key-format helpers — used to (a) catch obvious paste mistakes
+ * (someone pasting an org id, an email, a truncated key, or the wrong
+ * provider's key) before we store a dud, and (b) map intuitive provider
+ * aliases (e.g. `xai`) to the canonical internal id (`grok`).
+ *
+ * Patterns are deliberately loose (prefix + min length) so a provider tweaking
+ * the tail of their key format doesn't lock users out — they're a sanity check,
+ * not a cryptographic gate. Keep in lockstep with the site's provider-fields.ts.
+ */
+/** Canonical internal provider ids (what the keychain + engine use). */
+export declare const CANONICAL_PROVIDERS: readonly ["anthropic", "openai", "gemini", "grok", "groq", "deepseek", "mistral", "kimi", "qwen"];
+/** Resolve an alias (or canonical id) to the canonical provider id, or null
+ *  if it's neither. */
+export declare function resolveProvider(input: string): string | null;
+/** Per-provider key shape: a loose validation regex + a human hint. */
+export declare const KEY_FORMATS: Record<string, {
+    pattern: RegExp;
+    hint: string;
+}>;
+/** Generic "is this even an API key?" check: no whitespace, not an email,
+ *  not a URL, reasonable length. Catches the most common paste mistakes
+ *  regardless of provider. */
+export declare function looksLikeApiKey(value: string): boolean;
+/**
+ * HARD validation. Only rejects things that clearly aren't an API key at all
+ * (whitespace, email, URL, far too short). Returns a message, or null when the
+ * value is plausibly a key. Deliberately does NOT enforce a provider-specific
+ * prefix — providers change their key formats over time, and we must never
+ * hard-block a key the user says is correct. Prefix/shape mismatches are
+ * surfaced as a non-blocking warning via `formatWarning` instead.
+ */
+export declare function validateKey(provider: string, value: string): string | null;
+/**
+ * SOFT check: the value passes hard validation but doesn't match the provider's
+ * usual key shape (e.g. an xAI key that doesn't start with `xai-`). Returns a
+ * non-blocking warning string, or null. Callers should print it and proceed —
+ * never block on it.
+ */
+export declare function formatWarning(provider: string, value: string): string | null;

package/dist/key-status-signing.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Canonical signing form for key status reports.
+ *
+ * MUST stay byte-identical to src/lib/crosscheck/key-status-crypto.ts in
+ * crosscheck-site. Drift fails verification server-side, and a rejected
+ * report is indistinguishable in the UI from "this machine has no keys" —
+ * the most misleading failure this feature could have.
+ *
+ * Providers are sorted before joining: a report is a set, not a sequence, and
+ * signing it as a sequence would make verification depend on the order the
+ * key store happened to enumerate in.
+ */
+export type SignableKeyStatusItem = {
+    provider: string;
+    present: boolean;
+    suffix?: string;
+    lastResult?: string;
+    lastCheckedAt?: string;
+};
+export declare function canonicalKeyStatusBody(r: {
+    seatId: string;
+    orgId: string;
+    reportedAt: string;
+    providers: readonly SignableKeyStatusItem[];
+}): string;