implto-tos-axi 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Valentyn Morenko
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,255 @@
+# implto-tos-axi
+
+Work with [Transformation OS](https://github.com/implementedtoday/Digital-Transformation-OS) from
+the repository you are changing: find the task a change belongs to, keep the deliverables tree
+honest, and reach every other tool the platform has - without carrying fifty tool schemas in
+every model request. Built to [AXI](https://github.com/kunchenguid/axi) conventions, so an agent
+can drive it as comfortably as a person can.
+
+[![npm](https://img.shields.io/npm/v/implto-tos-axi)](https://www.npmjs.com/package/implto-tos-axi)
+
+## Why this exists
+
+Transformation OS already speaks MCP, and an agent can mount the server directly. The cost is
+that all 50 tool schemas travel in the prompt of every request the agent makes, whether or not
+the task has anything to do with a ticket.
+
+This CLI is the same server reached a different way. The schemas stay on the server; a ~2 KB
+skill stub says when to reach for the tool; and the one tool a task turns out to need is fetched
+on the spot with `tools show`. An agent that never touches a ticket pays for the stub and
+nothing else.
+
+The trade is real but small: a command is two round trips instead of one, because the server is
+stateless and every invocation does its own `initialize`.
+
+## Install
+
+```sh
+npm install -g implto-tos-axi
+```
+
+Or run it without installing anything:
+
+```sh
+npx -y implto-tos-axi whoami
+```
+
+To let an agent drive it, add the skills. They are separate on purpose - a session that files a
+ticket should not also load the guidance for process maps:
+
+```sh
+npx skills add implementedtoday/implto-tos-axi --skill implto-tos-tasks -g
+npx skills add implementedtoday/implto-tos-axi --skill implto-tos-delivery -g
+npx skills add implementedtoday/implto-tos-axi --skill implto-tos-workspace -g
+```
+
+| Skill                  | Loaded when the task is about                                          |
+| ---------------------- | ---------------------------------------------------------------------- |
+| `implto-tos-tasks`     | tracking work: matching a change to a task, filing one, closing it out |
+| `implto-tos-delivery`  | what is being built: the component tree, estimates, delivery phases    |
+| `implto-tos-workspace` | everything else: process maps, people, roles, systems, client threads  |
+
+## Sign in
+
+```sh
+implto-tos-axi login                     # opens a browser
+implto-tos-axi login --profile dev
+implto-tos-axi login --scopes tasks      # ask for one area only
+implto-tos-axi login --token tos_…       # headless: paste a personal key
+```
+
+The browser flow is OAuth 2.1 against the deployment itself: the CLI registers itself, you
+approve it on a page that says what it is asking for, and the credential it gets acts as you -
+your workspaces, your name on every write. It refreshes itself for an hour at a time without
+anybody present.
+
+`--scopes` narrows the grant to some of the server's areas, and the narrowing is real: a
+credential minted for `tasks` is refused the rest, and `tools list` serves it only that area.
+
+With no terminal attached the browser path refuses (`NEEDS_HUMAN`) rather than opening a window
+nobody will see. For CI or a container, mint a key at **Settings → Personal credentials** and set `TOS_TOKEN`; it
+outranks anything on disk. Add `TOS_URL` when the deployment is not prod.
+
+## Bind a repository
+
+```sh
+implto-tos-axi init --workspace "Implemented Today" --project DT
+```
+
+Writes `.implto-tos.json`, which every command finds by walking up from the working directory.
+It is what lets the rest of the commands take names instead of ids, and what fills in
+`workspaceId` on a raw tool call. Run `init` bare to list what you can reach.
+
+## What the tool does
+
+### Matches a change to the task it belongs to
+
+```sh
+implto-tos-axi context                              # run this first
+implto-tos-axi tasks search "login redirect" --open
+implto-tos-axi tasks show TO-112
+implto-tos-axi tasks create "Fix the import guard" --assign me
+implto-tos-axi tasks update TO-112 --status "In Progress"
+implto-tos-axi tasks comment TO-112 "Shipped in #204"
+```
+
+`context` is the one call worth making at the start of a session: it answers which project this
+directory is, what the statuses are called, and which of an issue's two assignee fields you
+belong in. Everything after it takes names.
+
+`implto-tos-axi guide workflow` has the whole match-or-create procedure, including the part
+where you ask the person rather than deciding alone.
+
+### Keeps the deliverables tree honest
+
+Components are what a workspace is delivering - services, modules, APIs - in a parent-child
+tree, and tasks hang off them. A component that does not exist yet is a task with nowhere to go.
+
+```sh
+implto-tos-axi components list --tree
+implto-tos-axi components show "Billing API"
+implto-tos-axi components create "Billing API" --parent Platform --type API --estimate 40
+implto-tos-axi components update "Billing API" --parent "Payments"
+implto-tos-axi components update "Billing API" --parent none      # back to the top level
+```
+
+`--tree` is the view worth having before creating anything: a flat list with a parent column
+answers filtering questions, and the tree answers the question somebody actually has, which is
+where the new thing belongs.
+
+Omitting a link flag leaves it alone; `none` clears it. A component created inside a bound
+checkout is linked to that checkout's project unless you say `--project none`.
+
+### Reaches every other tool, without knowing about it
+
+```sh
+implto-tos-axi tools                                   # the areas, and which you hold
+implto-tos-axi tools domains organization              # what one covers, and its rules
+implto-tos-axi tools list --domain organization
+implto-tos-axi tools show create_person
+implto-tos-axi tools call create_person name="Ann Lee" email=ann@acme.com
+implto-tos-axi tools call update_process_nodes --json-file nodes.json
+```
+
+Nothing here is hard-coded: the areas, the tool names and their arguments all come from the
+server, so a tool added on a Tuesday is callable on the Tuesday with no release of this package.
+
+Arguments are `name=value`, typed against the tool's own schema - `estimateSecs=3600` arrives as
+a number, and a nullable field is cleared with `field=null`. `key=@file` reads a value from a
+file (which is how a markdown body or a mermaid diagram survives a shell), `key=@-` reads stdin,
+and `--json` passes a nested argument whole.
+
+A misspelled argument is refused here, naming the real ones. That matters more than it sounds:
+the server ignores an argument it does not know, so the call would otherwise succeed without
+doing what was asked.
+
+### Takes names, not ids
+
+Every workspace, project, status, component, parent and system is matched by name,
+case-insensitively, against what the server just returned. Two matches is an error naming both
+rather than a guess, and the error carries the full list of what was available.
+
+The one id you never type is `workspaceId`: it comes from the binding, or from
+`--workspace <name>` anywhere else, and a raw `tools call` reports which one it used.
+
+### Says what to run next
+
+Every payload ends with a `help` list, and so does every error - same field, same shape - so
+recovering from a failure reads like reading a result:
+
+```
+error: This directory is not bound to a Transformation OS project.
+code: NO_BINDING
+help[2]:
+  implto-tos-axi init --workspace <name> --project <key>
+  implto-tos-axi init   # run it bare to list what you can reach
+```
+
+## Configuration
+
+| Thing                   | Where                                                                      |
+| ----------------------- | -------------------------------------------------------------------------- |
+| Credential              | `~/.config/implto-tos-axi/credentials.json`, mode 0600 in a 0700 directory |
+|                         | `$XDG_CONFIG_HOME` is honoured; `%APPDATA%` on Windows                     |
+| Repository binding      | `.implto-tos.json`, found by walking up from the working directory         |
+| `TOS_TOKEN`             | A personal key. Outranks the file, and is never written back to it         |
+| `TOS_AXI_ALLOW_BROWSER` | Open a browser even with no TTY attached. For a wrapper that knows better  |
+
+Profiles are deployments, one origin each:
+
+| Profile | Origin                                        |
+| ------- | --------------------------------------------- |
+| `prod`  | https://implto-transformation-os.web.app      |
+| `dev`   | https://digital-transformation-os-dev.web.app |
+| `local` | http://localhost:4000                         |
+
+`--url` points at a deployment by address instead, and `--mcp-url` at the MCP endpoint directly -
+which is what a local MCP server running as its own process on port 3100 needs. Both have an
+environment variable for the headless case, and a flag always beats one.
+
+An address is named after the deployment it turns out to be, so a credential taken against dev is
+filed under `dev` whichever way you got there.
+
+The origin is not a convenience: it is the OAuth issuer and the resource a token is minted for,
+so a client that talks to one address and authorizes against another ends up with a credential
+for somebody else's server.
+
+## Command reference
+
+| Command                            | What it does                                                           |
+| ---------------------------------- | ---------------------------------------------------------------------- |
+| `login`                            | Sign in through the browser, or `--token` to paste a key               |
+| `logout`                           | Forget this machine's credential (revoking it is a button in Settings) |
+| `whoami`                           | Who this credential acts as, what it reaches, and where it came from   |
+| `init`                             | Bind this directory to a workspace and project                         |
+| `context`                          | The project, its statuses and types, and who you are                   |
+| `tasks search <words>`             | Find tasks. `--open`, `--mine`, `--status`, `--all-projects`           |
+| `tasks show <key>`                 | One task in full                                                       |
+| `tasks mine`                       | Your tasks                                                             |
+| `tasks create <title>`             | File one. `--assign me` by default                                     |
+| `tasks update <key>`               | Status, assignee, title, description, priority, due date               |
+| `tasks comment <key> <text>`       | Leave a note on it                                                     |
+| `components list`                  | The deliverables. `--tree`, `--parent`, `--project`, `--search`        |
+| `components show <name>`           | One in full, with its phase estimates                                  |
+| `components create <name>`         | Add one. `--parent`, `--type`, `--estimate`, `--system`, `--project`   |
+| `components update <name>`         | Rename, re-parent, re-link, re-estimate                                |
+| `tools`                            | The areas the server offers, and which this credential holds           |
+| `tools domains <id>`               | What one area covers, and the rules for using it                       |
+| `tools list`                       | The tools in an area. `--domain`, `--search`                           |
+| `tools show <name>`                | One tool's arguments                                                   |
+| `tools call <name> [name=value …]` | Call it                                                                |
+| `guide [topic]`                    | Topic-sized guidance. Run bare to list topics                          |
+
+`--help` on any of them is the current truth; this table is not.
+
+Guide topics: `workflow`, `components`, `tools`, `auth`, `binding`, `statuses`, `output`.
+
+## Output and exit codes
+
+Every command prints [TOON](https://github.com/toon-format/toon): compact, tabular where the
+data is tabular, and readable without a parser. The two whose content is prose rather than data -
+`guide <topic>` and `components list --tree` - print plain text, because a procedure rendered as
+one escaped string is the format fighting the content.
+
+`0` succeeded. `2` is the caller's mistake - a bad flag, a name that matches nothing or matches
+several. Everything else is `1`. Every error carries a code (`AUTH_MISSING`, `AUTH_INVALID`,
+`NO_BINDING`, `AMBIGUOUS`, `NOT_FOUND`, `FORBIDDEN`, `NEEDS_HUMAN`, `NETWORK_ERROR`,
+`VALIDATION_ERROR`) and the command that fixes it.
+
+## Development
+
+```sh
+pnpm install
+pnpm build          # tsc, and chmod the bin
+pnpm test
+pnpm typecheck
+pnpm build:skill    # regenerate the three SKILL.md stubs from src/skill.ts
+```
+
+The stubs are generated, and CI fails if the files on disk have drifted from the generator or if
+any of them grows past 2500 characters. That cap is the point of the package: a stub that grows
+into a manual gives back exactly what reaching the server this way bought.
+
+## License
+
+MIT

package/dist/bin/implto-tos-axi.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/implto-tos-axi.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { tryFastPath } from "axi-sdk-js/fast-path";
+import { VERSION } from "../src/version.js";
+// `implto-tos-axi --help | head` closes the pipe early, and an unhandled EPIPE
+// turns that into a stack trace. Piping output somewhere that stops reading is
+// ordinary shell use, not an error worth reporting.
+process.stdout.on("error", (error) => {
+    if (error.code === "EPIPE")
+        process.exit(0);
+    throw error;
+});
+if (!tryFastPath(process.argv.slice(2), { version: VERSION })) {
+    const { main } = await import("../src/cli.js");
+    await main();
+}
+//# sourceMappingURL=implto-tos-axi.js.map

package/dist/bin/implto-tos-axi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"implto-tos-axi.js","sourceRoot":"","sources":["../../bin/implto-tos-axi.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE5C,+EAA+E;AAC/E,+EAA+E;AAC/E,oDAAoD;AACpD,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;IAC1D,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,KAAK,CAAC;AACd,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC9D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/C,MAAM,IAAI,EAAE,CAAC;AACf,CAAC"}

package/dist/src/auth/loopback.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The one-shot listener that catches the authorization code.
+ *
+ * A desktop client has nowhere else to receive one, which is why RFC 8252 makes
+ * loopback the redirect for native applications and why the server matches a
+ * loopback address with the port ignored: the operating system picks the port
+ * at start-up, so it cannot be registered in advance.
+ *
+ * Bound to 127.0.0.1 only. `state` is compared in constant time, `iss` is
+ * compared against the deployment that was asked, and the server closes after
+ * the first answer - so another process on this machine that guessed the port
+ * still has to have the `state`, which only the browser was given.
+ */
+export interface LoopbackResult {
+    code: string;
+    state: string;
+}
+export interface Loopback {
+    /** The address to register and to send the browser back to. */
+    redirectUri: string;
+    state: string;
+    /** Resolves with the code, or rejects with LOGIN_TIMEOUT. */
+    wait: Promise<LoopbackResult>;
+    close(): void;
+}
+export declare function startLoopback(options: {
+    issuer: string;
+    timeoutMs: number;
+}): Promise<Loopback>;

package/dist/src/auth/loopback.js

@@ -0,0 +1,110 @@
+import { createServer } from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { TosError } from "../errors.js";
+const PAGE = (title, detail) => `<!doctype html><meta charset="utf-8"><title>${title}</title>` +
+    `<body style="font:16px/1.5 system-ui;margin:4rem auto;max-width:28rem;text-align:center">` +
+    `<h1 style="font-size:1.25rem">${title}</h1><p style="color:#555">${detail}</p></body>`;
+export async function startLoopback(options) {
+    const state = randomBytes(32).toString("base64url");
+    let settle;
+    let fail;
+    const wait = new Promise((resolve, reject) => {
+        settle = resolve;
+        fail = reject;
+    });
+    let done = false;
+    const server = createServer((req, res) => {
+        const url = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (url.pathname !== "/callback") {
+            res.writeHead(404).end();
+            return;
+        }
+        if (done) {
+            // A second arrival is not the client: the browser was answered already.
+            res.writeHead(409, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(PAGE("Already answered", "This sign-in has already completed."));
+            return;
+        }
+        const error = url.searchParams.get("error");
+        if (error) {
+            done = true;
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(PAGE("Not connected", url.searchParams.get("error_description") ?? error));
+            server.close();
+            fail(new TosError(url.searchParams.get("error_description") ?? `Authorization was refused (${error}).`, "LOGIN_REFUSED"));
+            return;
+        }
+        const returned = url.searchParams.get("state") ?? "";
+        const code = url.searchParams.get("code") ?? "";
+        const iss = url.searchParams.get("iss");
+        if (!equal(returned, state) || !code) {
+            res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(PAGE("Not connected", "This response did not match the request."));
+            return;
+        }
+        // `iss` is how a client holding authorizations from several servers knows
+        // which one answered. Ours promises it, so a mismatch is worth refusing.
+        if (iss && new URL(iss).origin !== new URL(options.issuer).origin) {
+            res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(PAGE("Not connected", "This response came from another server."));
+            return;
+        }
+        done = true;
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(PAGE("Connected", "You can close this tab and go back to the terminal."));
+        server.close();
+        settle({ code, state: returned });
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", resolve);
+    });
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        server.close();
+        throw new TosError("Could not open a local port to sign in on.", "LOGIN_FAILED");
+    }
+    const timer = setTimeout(() => {
+        if (done)
+            return;
+        done = true;
+        server.close();
+        fail(new TosError("Timed out waiting for the browser.", "LOGIN_TIMEOUT", [
+            "implto-tos-axi login --token <paste a key from Settings, Personal credentials>",
+        ]));
+    }, options.timeoutMs);
+    timer.unref?.();
+    // The promise a caller actually awaits, built once so the handler below
+    // attaches to the same object. A caller normally awaits it a moment after
+    // starting the flow, so a refusal arriving in between would surface as an
+    // unhandled rejection and, in a strict runtime, take the process down.
+    // Attaching a handler marks it handled without consuming it: it still
+    // rejects for whoever awaits it.
+    const settled = wait.finally(() => clearTimeout(timer));
+    settled.catch(() => undefined);
+    return {
+        redirectUri: `http://127.0.0.1:${address.port}/callback`,
+        state,
+        wait: settled,
+        // Settles the promise as well as closing the port. A `close` that only
+        // stopped listening left `wait` pending forever, so an abandoned sign-in
+        // hung whatever was awaiting it instead of failing.
+        close: () => {
+            clearTimeout(timer);
+            server.close();
+            if (done)
+                return;
+            done = true;
+            fail(new TosError("The sign-in was abandoned.", "LOGIN_ABANDONED"));
+        },
+    };
+}
+/** Constant time, and never throwing on a length the caller chose. */
+function equal(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    if (left.length !== right.length)
+        return false;
+    return timingSafeEqual(left, right);
+}
+//# sourceMappingURL=loopback.js.map

package/dist/src/auth/loopback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../../src/auth/loopback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AA6BxC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE,CAC7C,+CAA+C,KAAK,UAAU;IAC9D,2FAA2F;IAC3F,iCAAiC,KAAK,8BAA8B,MAAM,aAAa,CAAC;AAE1F,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAGnC;IACC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEpD,IAAI,MAAwC,CAAC;IAC7C,IAAI,IAA4B,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3D,MAAM,GAAG,OAAO,CAAC;QACjB,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACxE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,wEAAwE;YACxE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,GAAG,IAAI,CAAC;YACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;YACnF,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CACF,IAAI,QAAQ,CACV,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,8BAA8B,KAAK,IAAI,EACpF,eAAe,CAChB,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAExC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,GAAG,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YAClE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,IAAI,GAAG,IAAI,CAAC;QACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,qDAAqD,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,4CAA4C,EAAE,cAAc,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,IAAI,IAAI;YAAE,OAAO;QACjB,IAAI,GAAG,IAAI,CAAC;QACZ,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,CACF,IAAI,QAAQ,CAAC,oCAAoC,EAAE,eAAe,EAAE;YAClE,gFAAgF;SACjF,CAAC,CACH,CAAC;IACJ,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACtB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAEhB,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,sEAAsE;IACtE,iCAAiC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE/B,OAAO;QACL,WAAW,EAAE,oBAAoB,OAAO,CAAC,IAAI,WAAW;QACxD,KAAK;QACL,IAAI,EAAE,OAAO;QACb,uEAAuE;QACvE,yEAAyE;QACzE,oDAAoD;QACpD,KAAK,EAAE,GAAG,EAAE;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,CAAC,IAAI,QAAQ,CAAC,4BAA4B,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC"}

package/dist/src/auth/open-browser.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Hands a URL to whatever opens links on this machine.
+ *
+ * No dependency for three lines of `spawn`, and deliberately fire-and-forget:
+ * the URL is printed too, so a failure to open anything is survivable - the
+ * person pastes it. Detached and with stdio ignored so a browser that stays
+ * open does not hold the CLI's exit.
+ */
+export declare function openBrowser(url: string): void;

package/dist/src/auth/open-browser.js

@@ -0,0 +1,24 @@
+import { spawn } from "node:child_process";
+import { platform } from "node:os";
+/**
+ * Hands a URL to whatever opens links on this machine.
+ *
+ * No dependency for three lines of `spawn`, and deliberately fire-and-forget:
+ * the URL is printed too, so a failure to open anything is survivable - the
+ * person pastes it. Detached and with stdio ignored so a browser that stays
+ * open does not hold the CLI's exit.
+ */
+export function openBrowser(url) {
+    const [command, args] = platform() === "darwin"
+        ? ["open", [url]]
+        : platform() === "win32"
+            ? ["cmd", ["/c", "start", "", url]]
+            : ["xdg-open", [url]];
+    try {
+        spawn(command, args, { detached: true, stdio: "ignore" }).unref();
+    }
+    catch {
+        // The URL is on screen either way.
+    }
+}
+//# sourceMappingURL=open-browser.js.map

package/dist/src/auth/open-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-browser.js","sourceRoot":"","sources":["../../../src/auth/open-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GACnB,QAAQ,EAAE,KAAK,QAAQ;QACrB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC,CAAC,QAAQ,EAAE,KAAK,OAAO;YACtB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;AACH,CAAC"}

package/dist/src/auth/provider.d.ts

@@ -0,0 +1,39 @@
+import type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
+import type { Profile } from "../config/profiles.js";
+/**
+ * The SDK's OAuth client, backed by the credentials file.
+ *
+ * Everything hard is the SDK's: discovery, registration, PKCE, the exchange and
+ * the renewal on a 401. What is here is only where the pieces are kept and how
+ * the browser is opened - the parts that are this machine's business.
+ *
+ * `redirectUrl` is the loopback address the listener is already on, so the
+ * registration and the authorization request name the same port this process is
+ * holding. The server matches loopback with the port ignored, so a registration
+ * made this morning still works this afternoon on a different port.
+ */
+export declare class FileAuthProvider implements OAuthClientProvider {
+    private readonly profile;
+    private readonly redirect;
+    private readonly oauthState;
+    private readonly scope;
+    /** Called when the browser is sent somewhere, so `login` can print it. */
+    private readonly onRedirect;
+    private verifier;
+    constructor(profile: Profile, redirect: string, oauthState: string, scope: string, 
+    /** Called when the browser is sent somewhere, so `login` can print it. */
+    onRedirect: (url: URL) => void);
+    get redirectUrl(): string;
+    get clientMetadata(): OAuthClientMetadata;
+    state(): string;
+    clientInformation(): OAuthClientInformationMixed | undefined;
+    saveClientInformation(info: OAuthClientInformationMixed): void;
+    tokens(): OAuthTokens | undefined;
+    saveTokens(tokens: OAuthTokens): void;
+    redirectToAuthorization(url: URL): void;
+    saveCodeVerifier(verifier: string): void;
+    codeVerifier(): string;
+    private read;
+    private merge;
+}

package/dist/src/auth/provider.js

@@ -0,0 +1,106 @@
+import { hostname } from "node:os";
+import { readCredential, writeCredential } from "../config/credentials.js";
+import { openBrowser } from "./open-browser.js";
+/**
+ * The SDK's OAuth client, backed by the credentials file.
+ *
+ * Everything hard is the SDK's: discovery, registration, PKCE, the exchange and
+ * the renewal on a 401. What is here is only where the pieces are kept and how
+ * the browser is opened - the parts that are this machine's business.
+ *
+ * `redirectUrl` is the loopback address the listener is already on, so the
+ * registration and the authorization request name the same port this process is
+ * holding. The server matches loopback with the port ignored, so a registration
+ * made this morning still works this afternoon on a different port.
+ */
+export class FileAuthProvider {
+    profile;
+    redirect;
+    oauthState;
+    scope;
+    onRedirect;
+    verifier;
+    constructor(profile, redirect, oauthState, scope, 
+    /** Called when the browser is sent somewhere, so `login` can print it. */
+    onRedirect) {
+        this.profile = profile;
+        this.redirect = redirect;
+        this.oauthState = oauthState;
+        this.scope = scope;
+        this.onRedirect = onRedirect;
+    }
+    get redirectUrl() {
+        return this.redirect;
+    }
+    get clientMetadata() {
+        return {
+            client_name: `implto-tos-axi on ${hostname()}`,
+            redirect_uris: [this.redirect],
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            // A CLI ships to laptops and cannot keep a secret. PKCE is what binds a
+            // code to this process; a client secret would be theatre.
+            token_endpoint_auth_method: "none",
+            scope: this.scope,
+        };
+    }
+    state() {
+        return this.oauthState;
+    }
+    clientInformation() {
+        const stored = this.read().client;
+        return stored ? stored : undefined;
+    }
+    saveClientInformation(info) {
+        this.merge({ client: info });
+    }
+    tokens() {
+        const stored = this.read().tokens;
+        if (!stored?.access_token)
+            return undefined;
+        return {
+            access_token: stored.access_token,
+            token_type: "Bearer",
+            ...(stored.refresh_token ? { refresh_token: stored.refresh_token } : {}),
+            ...(stored.expires_at
+                ? { expires_in: Math.max(0, Math.round((stored.expires_at - Date.now()) / 1000)) }
+                : {}),
+        };
+    }
+    saveTokens(tokens) {
+        this.merge({
+            tokens: {
+                access_token: tokens.access_token,
+                ...(tokens.refresh_token ? { refresh_token: tokens.refresh_token } : {}),
+                ...(tokens.expires_in ? { expires_at: Date.now() + tokens.expires_in * 1000 } : {}),
+            },
+        });
+    }
+    redirectToAuthorization(url) {
+        this.onRedirect(url);
+        openBrowser(url.toString());
+    }
+    saveCodeVerifier(verifier) {
+        // In memory only, and only for this process: a verifier outlives nothing.
+        // Writing it down would put the other half of the proof on disk beside the
+        // token it protects.
+        this.verifier = verifier;
+    }
+    codeVerifier() {
+        if (!this.verifier)
+            throw new Error("No PKCE verifier for this sign-in.");
+        return this.verifier;
+    }
+    read() {
+        return readCredential(this.profile.name) ?? { origin: this.profile.origin };
+    }
+    merge(patch) {
+        writeCredential(this.profile.name, {
+            ...this.read(),
+            origin: this.profile.origin,
+            mcpUrl: this.profile.mcpUrl,
+            ...patch,
+        });
+    }
+}
+//# sourceMappingURL=provider.js.map

package/dist/src/auth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/auth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAOnC,OAAO,EAAE,cAAc,EAAE,eAAe,EAA0B,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAIR;IACA;IACA;IACA;IAEA;IARX,QAAQ,CAAqB;IAErC,YACmB,OAAgB,EAChB,QAAgB,EAChB,UAAkB,EAClB,KAAa;IAC9B,0EAA0E;IACzD,UAA8B;QAL9B,YAAO,GAAP,OAAO,CAAS;QAChB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,eAAU,GAAV,UAAU,CAAQ;QAClB,UAAK,GAAL,KAAK,CAAQ;QAEb,eAAU,GAAV,UAAU,CAAoB;IAC9C,CAAC;IAEJ,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,IAAI,cAAc;QAChB,OAAO;YACL,WAAW,EAAE,qBAAqB,QAAQ,EAAE,EAAE;YAC9C,aAAa,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC9B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,wEAAwE;YACxE,0DAA0D;YAC1D,0BAA0B,EAAE,MAAM;YAClC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,iBAAiB;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;QAClC,OAAO,MAAM,CAAC,CAAC,CAAE,MAAsC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,CAAC;IAED,qBAAqB,CAAC,IAAiC;QACrD,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAgD,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,YAAY;YAAE,OAAO,SAAS,CAAC;QAC5C,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,QAAQ;YACpB,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,UAAU;gBACnB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE;gBAClF,CAAC,CAAC,EAAE,CAAC;SACO,CAAC;IACnB,CAAC;IAED,UAAU,CAAC,MAAmB;QAC5B,IAAI,CAAC,KAAK,CAAC;YACT,MAAM,EAAE;gBACN,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpF;SACF,CAAC,CAAC;IACL,CAAC;IAED,uBAAuB,CAAC,GAAQ;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrB,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,0EAA0E;QAC1E,2EAA2E;QAC3E,qBAAqB;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,IAAI;QACV,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9E,CAAC;IAEO,KAAK,CAAC,KAAiC;QAC7C,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YACjC,GAAG,IAAI,CAAC,IAAI,EAAE;YACd,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,GAAG,KAAK;SACT,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/src/cli.d.ts

@@ -0,0 +1,2 @@
+export declare const DESCRIPTION = "Work with Transformation OS from a repository - tasks, deliverables, and the rest of the workspace";
+export declare function main(argv?: string[]): Promise<void>;