nomoreide 0.1.70 → 0.1.72

package/dist/core/agent-profiles/apply.d.ts

@@ -0,0 +1,36 @@
+import { type AgentName } from "../agent-env/index.js";
+import { type ProfileStoreOptions } from "./store.js";
+export type ProfileItemStatus = "add" | "identical" | "conflict";
+export interface ProfileApplyItem {
+    category: "mcp" | "skill";
+    name: string;
+    status: ProfileItemStatus;
+    warnings: string[];
+}
+export interface ProfileApplyPreview {
+    profile: string;
+    agent: AgentName;
+    items: ProfileApplyItem[];
+    /** `${credentials.*}` keys still unresolved in the profile — applied as-is. */
+    unresolvedCredentials: string[];
+}
+export interface ProfileApplyOptions extends ProfileStoreOptions {
+    cwd: string;
+    name: string;
+    agent: AgentName;
+    /** Item names (per category) to leave untouched — typically conflicts the user kept. */
+    skip?: {
+        mcps?: string[];
+        skills?: string[];
+    };
+}
+export declare function previewProfileApply(options: Omit<ProfileApplyOptions, "skip">): Promise<ProfileApplyPreview>;
+export interface ProfileApplyResult {
+    profile: string;
+    agent: AgentName;
+    mcpsApplied: string[];
+    skillsApplied: string[];
+    skipped: string[];
+    backups: string[];
+}
+export declare function applyProfile(options: ProfileApplyOptions): Promise<ProfileApplyResult>;

package/dist/core/agent-profiles/apply.js

@@ -0,0 +1,160 @@
+/**
+ * Apply a profile to an agent — the write-gated half of Agent Profiles.
+ * Mirrors the ROR-61 staged-writes gate: `previewProfileApply` classifies
+ * every item (add / identical / conflict) and surfaces warnings, then
+ * `applyProfile` snapshots the agent's config, writes through the
+ * write-guarded agent-env-writers layer, and reports every backup created.
+ */
+import { cp, mkdir, rm } from "node:fs/promises";
+import path from "node:path";
+import { addMcp, getSkillDir, snapshotAgentConfig } from "../agent-env-writers.js";
+import { readAllAgentConfigs, } from "../agent-env/index.js";
+import { findUnresolvedCredentialKeys } from "./credentials.js";
+import { getProfile, profileSkillsDir, pathExists } from "./store.js";
+export async function previewProfileApply(options) {
+    const [profile, live] = await Promise.all([
+        getProfile(options.name, options),
+        readLiveConfig(options),
+    ]);
+    const items = [];
+    for (const [key, mcp] of Object.entries(profile.mcps)) {
+        const existing = findLiveMcp(live, key);
+        const warnings = [];
+        if (options.agent === "codex" &&
+            mcp.kind === "remote" &&
+            (mcp.headers || mcp.transport === "sse")) {
+            warnings.push("Codex config only stores a URL for remote MCPs; transport and headers will be dropped.");
+        }
+        items.push({
+            category: "mcp",
+            name: key,
+            status: existing === undefined ? "add" : sameMcp(existing, mcp) ? "identical" : "conflict",
+            warnings,
+        });
+    }
+    const liveSkillNames = new Set(live.skills.filter((skill) => skill.scope === "user").map((skill) => skill.name));
+    for (const skill of profile.skills) {
+        items.push({
+            category: "skill",
+            name: skill.name,
+            // Skill contents aren't diffed — an existing dir with the same name is a conflict.
+            status: liveSkillNames.has(skill.name) ? "conflict" : "add",
+            warnings: [],
+        });
+    }
+    return {
+        profile: profile.name,
+        agent: options.agent,
+        items,
+        unresolvedCredentials: findUnresolvedCredentialKeys(profile.mcps),
+    };
+}
+export async function applyProfile(options) {
+    const profile = await getProfile(options.name, options);
+    const base = { cwd: options.cwd, homeDir: options.homeDir };
+    const skipMcps = new Set(options.skip?.mcps ?? []);
+    const skipSkills = new Set(options.skip?.skills ?? []);
+    const backups = [];
+    const skipped = [];
+    // One snapshot of the agent's config file before the batch (plus the
+    // per-write .bak.* copies the writers create anyway).
+    const snapshot = await snapshotAgentConfig({ ...base, agent: options.agent });
+    backups.push(...snapshot.backups);
+    const mcpsApplied = [];
+    for (const [key, mcp] of Object.entries(profile.mcps)) {
+        if (skipMcps.has(key)) {
+            skipped.push(`mcp "${key}"`);
+            continue;
+        }
+        const outcome = await addMcp({
+            ...base,
+            agent: options.agent,
+            key,
+            scope: "user",
+            entry: mcp.kind === "local"
+                ? { command: mcp.command, args: mcp.args, env: mcp.env }
+                : undefined,
+            remoteEntry: mcp.kind === "remote"
+                ? { transport: mcp.transport, url: mcp.url, headers: mcp.headers, env: mcp.env }
+                : undefined,
+        });
+        backups.push(...outcome.backups);
+        mcpsApplied.push(key);
+    }
+    const skillsApplied = [];
+    for (const skill of profile.skills) {
+        if (skipSkills.has(skill.name)) {
+            skipped.push(`skill "${skill.name}"`);
+            continue;
+        }
+        const sourceDir = path.join(profileSkillsDir(options.name, options), path.basename(skill.name));
+        if (!(await pathExists(sourceDir))) {
+            skipped.push(`skill "${skill.name}" (missing from profile bundle)`);
+            continue;
+        }
+        await installProfileSkill(sourceDir, skill.name, options);
+        skillsApplied.push(skill.name);
+    }
+    return {
+        profile: profile.name,
+        agent: options.agent,
+        mcpsApplied,
+        skillsApplied,
+        skipped,
+        backups,
+    };
+}
+/** Copy a bundled skill dir into the agent's user skills dir (idempotent overwrite). */
+async function installProfileSkill(sourceDir, skillName, options) {
+    const targetDir = getSkillDir({ agent: options.agent, skillName, scope: "user" }, options.cwd, options.homeDir);
+    await mkdir(path.dirname(targetDir), { recursive: true });
+    await rm(targetDir, { recursive: true, force: true });
+    await cp(sourceDir, targetDir, { recursive: true });
+}
+async function readLiveConfig(options) {
+    const configs = await readAllAgentConfigs({ cwd: options.cwd, homeDir: options.homeDir });
+    const config = configs.find((candidate) => candidate.agent === options.agent);
+    if (!config)
+        throw new Error(`Unknown agent "${options.agent}".`);
+    return config;
+}
+function findLiveMcp(config, key) {
+    const local = config.mcpServers[key];
+    if (local)
+        return { kind: "local", command: local.command, args: local.args, env: local.env };
+    const remote = config.remoteMcpServers[key];
+    if (remote) {
+        return {
+            kind: "remote",
+            transport: remote.transport,
+            url: remote.url,
+            headers: remote.headers,
+            env: remote.env,
+        };
+    }
+    return undefined;
+}
+function sameMcp(left, right) {
+    return JSON.stringify(normalizeMcp(left)) === JSON.stringify(normalizeMcp(right));
+}
+function normalizeMcp(mcp) {
+    if (mcp.kind === "local") {
+        return {
+            kind: "local",
+            command: mcp.command,
+            args: mcp.args ?? [],
+            env: sortedEntries(mcp.env),
+        };
+    }
+    return {
+        kind: "remote",
+        transport: mcp.transport,
+        url: mcp.url,
+        headers: sortedEntries(mcp.headers),
+        env: sortedEntries(mcp.env),
+    };
+}
+function sortedEntries(map) {
+    return Object.entries(map ?? {}).sort(([a], [b]) => a.localeCompare(b));
+}
+//# sourceMappingURL=apply.js.map

package/dist/core/agent-profiles/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../../src/core/agent-profiles/apply.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EACL,mBAAmB,GAGpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAA4B,MAAM,YAAY,CAAC;AA4BhG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA0C;IAE1C,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;QACjC,cAAc,CAAC,OAAO,CAAC;KACxB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAuB,EAAE,CAAC;IAErC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IACE,OAAO,CAAC,KAAK,KAAK,OAAO;YACzB,GAAG,CAAC,IAAI,KAAK,QAAQ;YACrB,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC,EACxC,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,wFAAwF,CACzF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU;YAC1F,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CACjF,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,mFAAmF;YACnF,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK;YAC3D,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK;QACL,qBAAqB,EAAE,4BAA4B,CAAC,OAAO,CAAC,IAAI,CAAC;KAClE,CAAC;AACJ,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAElC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC;YAC3B,GAAG,IAAI;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG;YACH,KAAK,EAAE,MAAM;YACb,KAAK,EACH,GAAG,CAAC,IAAI,KAAK,OAAO;gBAClB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE;gBACxD,CAAC,CAAC,SAAS;YACf,WAAW,EACT,GAAG,CAAC,IAAI,KAAK,QAAQ;gBACnB,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE;gBAChF,CAAC,CAAC,SAAS;SAChB,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACjC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAC1B,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,iCAAiC,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,MAAM,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1D,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW;QACX,aAAa;QACb,OAAO;QACP,OAAO;KACR,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,mBAAmB,CAChC,SAAiB,EACjB,SAAiB,EACjB,OAA4B;IAE5B,MAAM,SAAS,GAAG,WAAW,CAC3B,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAClD,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAI7B;IACC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,MAAuB,EAAE,GAAW;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,EAAE,MAAM,CAAC,GAAG;SAChB,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,IAAgB,EAAE,KAAiB;IAClD,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,YAAY,CAAC,GAAe;IACnC,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;YACpB,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;SAC5B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QACnC,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAuC;IAC5D,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/dist/core/agent-profiles/credentials.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Credential redaction (export) and resolution (import) for portable
+ * profiles, ported from brainctl's credential services. Exported archives
+ * must never contain raw secrets: secret-looking env/header values become
+ * `${credentials.<key>}` placeholders plus a spec describing what the
+ * importer has to supply.
+ */
+import type { CredentialSpec, ProfileMcp } from "./types.js";
+export interface RedactionResult {
+    redacted: ProfileMcp;
+    credentials: CredentialSpec[];
+    /** Original secret values, keyed by normalized credential key (kept out of archives). */
+    rawValues: Record<string, string>;
+}
+export declare function redactMcpCredentials(config: ProfileMcp): RedactionResult;
+export interface ResolutionResult {
+    resolved: ProfileMcp;
+    missing: CredentialSpec[];
+}
+export declare function resolveMcpCredentials(config: ProfileMcp, options?: {
+    credentials?: Record<string, string>;
+    credentialSpecs?: CredentialSpec[];
+    environment?: Record<string, string | undefined>;
+}): ResolutionResult;
+/** Every `${credentials.*}` key still present anywhere in the given MCPs. */
+export declare function findUnresolvedCredentialKeys(mcps: Record<string, ProfileMcp>): string[];

package/dist/core/agent-profiles/credentials.js

@@ -0,0 +1,151 @@
+export function redactMcpCredentials(config) {
+    const specs = new Map();
+    const rawValues = {};
+    const env = redactStringMap(config.env, "env", specs, rawValues);
+    const redacted = config.kind === "remote"
+        ? {
+            ...config,
+            ...(env ? { env } : {}),
+            ...((() => {
+                const headers = redactStringMap(config.headers, "header", specs, rawValues);
+                return headers ? { headers } : {};
+            })()),
+        }
+        : { ...config, ...(env ? { env } : {}) };
+    return {
+        redacted,
+        credentials: Array.from(specs.values())
+            .sort((left, right) => left.key.localeCompare(right.key))
+            .map((entry) => ({
+            key: entry.key,
+            required: true,
+            description: `${Array.from(entry.descriptions).sort().join("; ")} required for MCP access`,
+        })),
+        rawValues,
+    };
+}
+function redactStringMap(values, source, specs, rawValues) {
+    if (!values)
+        return undefined;
+    const redacted = {};
+    for (const [key, value] of Object.entries(values)) {
+        if (!shouldRedact(key)) {
+            redacted[key] = value;
+            continue;
+        }
+        const credentialKey = tokenizeCredentialKey(key).join("_");
+        const description = source === "env" ? `Environment variable ${key}` : `Header ${key}`;
+        const existing = specs.get(credentialKey);
+        if (existing)
+            existing.descriptions.add(description);
+        else
+            specs.set(credentialKey, { key: credentialKey, descriptions: new Set([description]) });
+        if (isCredentialPlaceholder(value)) {
+            redacted[key] = value; // already a placeholder — keep as-is
+        }
+        else {
+            rawValues[credentialKey] = value;
+            redacted[key] = `\${credentials.${credentialKey}}`;
+        }
+    }
+    return redacted;
+}
+function shouldRedact(key) {
+    const tokens = tokenizeCredentialKey(key);
+    if (tokens.length === 0)
+        return false;
+    const last = tokens[tokens.length - 1];
+    return (last === "authorization" ||
+        last === "password" ||
+        last === "secret" ||
+        last === "token" ||
+        (last === "key" && (tokens.includes("api") || tokens.includes("auth"))));
+}
+function tokenizeCredentialKey(key) {
+    return key
+        .trim()
+        .replace(/([A-Z]+)([A-Z][a-z0-9])/g, "$1 $2")
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .toLowerCase()
+        .split(/[^a-z0-9]+/g)
+        .filter(Boolean);
+}
+function isCredentialPlaceholder(value) {
+    return (/^\$\{credentials\.[^}]+\}$/.test(value) ||
+        /^(Bearer|Token)\s+\$\{credentials\.[^}]+\}$/i.test(value));
+}
+export function resolveMcpCredentials(config, options = {}) {
+    const specs = new Map((options.credentialSpecs ?? []).map((spec) => [spec.key, spec]));
+    const missing = new Map();
+    const env = resolveStringMap(config.env, specs, missing, options);
+    const resolved = config.kind === "remote"
+        ? {
+            ...config,
+            ...(env ? { env } : {}),
+            ...((() => {
+                const headers = resolveStringMap(config.headers, specs, missing, options);
+                return headers ? { headers } : {};
+            })()),
+        }
+        : { ...config, ...(env ? { env } : {}) };
+    return { resolved, missing: Array.from(missing.values()) };
+}
+function resolveStringMap(values, specs, missing, options) {
+    if (!values)
+        return undefined;
+    const resolved = {};
+    for (const [key, value] of Object.entries(values)) {
+        const placeholder = parseCredentialPlaceholder(value);
+        if (!placeholder) {
+            resolved[key] = value;
+            continue;
+        }
+        const supplied = options.credentials?.[placeholder.key] ?? options.environment?.[placeholder.key];
+        if (typeof supplied === "string" && supplied.length > 0) {
+            resolved[key] = placeholder.prefix ? `${placeholder.prefix} ${supplied}` : supplied;
+            continue;
+        }
+        const spec = specs.get(placeholder.key) ?? {
+            key: placeholder.key,
+            required: true,
+            description: `Credential ${placeholder.key} is required`,
+        };
+        if (spec.required)
+            missing.set(spec.key, spec);
+        resolved[key] = value; // keep the placeholder; the user can fill it later
+    }
+    return resolved;
+}
+function parseCredentialPlaceholder(value) {
+    const bare = value.match(/^\$\{credentials\.([^}]+)\}$/);
+    if (bare)
+        return { key: bare[1] };
+    const prefixed = value.match(/^(Bearer|Token)\s+\$\{credentials\.([^}]+)\}$/i);
+    if (prefixed) {
+        return {
+            key: prefixed[2],
+            prefix: prefixed[1].toLowerCase() === "bearer" ? "Bearer" : "Token",
+        };
+    }
+    return null;
+}
+const PLACEHOLDER_PATTERN = /\$\{\s*credentials\.([^}\s]+)\s*\}/g;
+/** Every `${credentials.*}` key still present anywhere in the given MCPs. */
+export function findUnresolvedCredentialKeys(mcps) {
+    const keys = new Set();
+    const visit = (value) => {
+        if (typeof value === "string") {
+            for (const match of value.matchAll(PLACEHOLDER_PATTERN))
+                keys.add(match[1]);
+        }
+        else if (Array.isArray(value)) {
+            value.forEach(visit);
+        }
+        else if (value && typeof value === "object") {
+            Object.values(value).forEach(visit);
+        }
+    };
+    visit(mcps);
+    return Array.from(keys).sort();
+}
+//# sourceMappingURL=credentials.js.map

package/dist/core/agent-profiles/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/core/agent-profiles/credentials.ts"],"names":[],"mappings":"AAgBA,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsD,CAAC;IAC5E,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAEjE,MAAM,QAAQ,GACZ,MAAM,CAAC,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC;YACE,GAAG,MAAM;YACT,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,CAAC,GAAG,EAAE;gBACR,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;gBAC5E,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,CAAC,CAAC,EAAE,CAAC;SACN;QACH,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAE7C,OAAO;QACL,QAAQ;QACR,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aACpC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B;SAC3F,CAAC,CAAC;QACL,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,MAA0C,EAC1C,MAAwB,EACxB,KAA8D,EAC9D,SAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACtB,SAAS;QACX,CAAC;QAED,MAAM,aAAa,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,QAAQ;YAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;;YAChD,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;QAE5F,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,qCAAqC;QAC9D,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC;YACjC,QAAQ,CAAC,GAAG,CAAC,GAAG,kBAAkB,aAAa,GAAG,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,CACL,IAAI,KAAK,eAAe;QACxB,IAAI,KAAK,UAAU;QACnB,IAAI,KAAK,QAAQ;QACjB,IAAI,KAAK,OAAO;QAChB,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,OAAO,GAAG;SACP,IAAI,EAAE;SACN,OAAO,CAAC,0BAA0B,EAAE,OAAO,CAAC;SAC5C,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,CACL,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC;QACxC,8CAA8C,CAAC,IAAI,CAAC,KAAK,CAAC,CAC3D,CAAC;AACJ,CAAC;AAOD,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,UAII,EAAE;IAEN,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAElE,MAAM,QAAQ,GACZ,MAAM,CAAC,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC;YACE,GAAG,MAAM;YACT,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,CAAC,GAAG,EAAE;gBACR,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC1E,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,CAAC,CAAC,EAAE,CAAC;SACN;QACH,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAE7C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,gBAAgB,CACvB,MAA0C,EAC1C,KAAkC,EAClC,OAAoC,EACpC,OAGC;IAED,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,WAAW,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACtB,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GACZ,OAAO,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,QAAQ,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YACpF,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI;YACzC,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,cAAc,WAAW,CAAC,GAAG,cAAc;SACzD,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/C,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,mDAAmD;IAC5E,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAa;IAEb,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACzD,IAAI,IAAI;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAElC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC/E,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YAChB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;SACpE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAElE,6EAA6E;AAC7E,MAAM,UAAU,4BAA4B,CAAC,IAAgC;IAC3E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,KAAc,EAAQ,EAAE;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC"}

package/dist/core/agent-profiles/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Agent Profiles (ROR-62): named MCP+skill bundles stored under
+ * `~/.config/nomoreide/agent-profiles/`, applied to agents through the
+ * write-guarded agent-env layer, shared as credential-redacted tarballs.
+ */
+export { applyProfile, previewProfileApply, type ProfileApplyItem, type ProfileApplyPreview, type ProfileApplyResult, type ProfileItemStatus, } from "./apply.js";
+export { findUnresolvedCredentialKeys, redactMcpCredentials, resolveMcpCredentials, } from "./credentials.js";
+export { assertValidProfileName, copySkillBetweenProfiles, createProfile, deleteProfile, getProfile, listProfiles, profileDir, profilesRoot, profileSkillsDir, snapshotProfileFromAgent, updateProfile, writeProfile, type ProfileStoreOptions, } from "./store.js";
+export { exportProfile, importProfile, type ExportResult, type ImportResult } from "./transfer.js";
+export { createRegistryConfigService, DEFAULT_REGISTRY_API_BASE_URL, DEFAULT_REGISTRY_FRONTEND_URL, registryConfigPath, resolveRegistryApiBaseUrl, resolveRegistryApiTarget, resolveRegistryApiToken, resolveRegistryFrontendUrl, type RegistryApiTarget, type RegistryConfigOptions, type RegistryConfigService, } from "./registry-config.js";
+export { createRegistryTokenManager, type RegistryTokenManager, type RegistryTokenManagerOptions, } from "./registry-auth.js";
+export { createRegistryClient, type RegisterGithubProfileInput, type RegistryClient, type RegistryInstallDescriptor, type RegistryProfile, } from "./registry-client.js";
+export { installProfileFromRegistry, publishProfileToRegistry, type InstallFromRegistryInput, type InstallFromRegistryResult, type PublishProfileInput, type PublishProfileResult, } from "./registry-transfer.js";
+export { PROFILE_NAME_PATTERN, profileManifestSchema, profileMcpSchema, profileSchema, slugifyProfileName, type CredentialSpec, type Profile, type ProfileManifest, type ProfileMcp, type ProfileSummary, } from "./types.js";

package/dist/core/agent-profiles/index.js

@@ -0,0 +1,15 @@
+/**
+ * Agent Profiles (ROR-62): named MCP+skill bundles stored under
+ * `~/.config/nomoreide/agent-profiles/`, applied to agents through the
+ * write-guarded agent-env layer, shared as credential-redacted tarballs.
+ */
+export { applyProfile, previewProfileApply, } from "./apply.js";
+export { findUnresolvedCredentialKeys, redactMcpCredentials, resolveMcpCredentials, } from "./credentials.js";
+export { assertValidProfileName, copySkillBetweenProfiles, createProfile, deleteProfile, getProfile, listProfiles, profileDir, profilesRoot, profileSkillsDir, snapshotProfileFromAgent, updateProfile, writeProfile, } from "./store.js";
+export { exportProfile, importProfile } from "./transfer.js";
+export { createRegistryConfigService, DEFAULT_REGISTRY_API_BASE_URL, DEFAULT_REGISTRY_FRONTEND_URL, registryConfigPath, resolveRegistryApiBaseUrl, resolveRegistryApiTarget, resolveRegistryApiToken, resolveRegistryFrontendUrl, } from "./registry-config.js";
+export { createRegistryTokenManager, } from "./registry-auth.js";
+export { createRegistryClient, } from "./registry-client.js";
+export { installProfileFromRegistry, publishProfileToRegistry, } from "./registry-transfer.js";
+export { PROFILE_NAME_PATTERN, profileManifestSchema, profileMcpSchema, profileSchema, slugifyProfileName, } from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/core/agent-profiles/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/agent-profiles/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,YAAY,EACZ,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,aAAa,EACb,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,YAAY,GAEb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAwC,MAAM,eAAe,CAAC;AACnG,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,GAI3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,0BAA0B,GAG3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,GAKrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,GAKzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,kBAAkB,GAMnB,MAAM,YAAY,CAAC"}

package/dist/core/agent-profiles/registry-auth.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Bearer-token manager for the profile registry: reads the stored access
+ * token, transparently refreshes it once on a 401, and persists rotated
+ * tokens back to the registry config file.
+ */
+import { type RegistryConfigOptions, type RegistryConfigService } from "./registry-config.js";
+export interface RegistryTokenManager {
+    /** Current access token, or null when signed out. */
+    getAccessToken(): Promise<string | null>;
+    /** Authenticated fetch that refreshes once on 401 and retries. */
+    authenticatedFetch(pathOrUrl: string, init?: RequestInit): Promise<Response>;
+    /** Persist tokens after a fresh sign-in. */
+    saveTokens(input: {
+        accessToken: string;
+        refreshToken?: string;
+    }): Promise<void>;
+    /** Sign out: drop both tokens. */
+    clear(): Promise<void>;
+}
+export interface RegistryTokenManagerOptions extends RegistryConfigOptions {
+    configService?: RegistryConfigService;
+    apiBaseUrl?: string;
+    fetch?: typeof fetch;
+}
+export declare function createRegistryTokenManager(options?: RegistryTokenManagerOptions): RegistryTokenManager;

package/dist/core/agent-profiles/registry-auth.js

@@ -0,0 +1,78 @@
+/**
+ * Bearer-token manager for the profile registry: reads the stored access
+ * token, transparently refreshes it once on a 401, and persists rotated
+ * tokens back to the registry config file.
+ */
+import { createRegistryConfigService, resolveRegistryApiBaseUrl, resolveRegistryApiToken, } from "./registry-config.js";
+export function createRegistryTokenManager(options = {}) {
+    const config = options.configService ?? createRegistryConfigService(options);
+    const fetchImpl = options.fetch ?? fetch;
+    let refreshInFlight = null;
+    async function apiBase() {
+        return (options.apiBaseUrl ??
+            (await resolveRegistryApiBaseUrl({ ...options, configService: config }))).replace(/\/$/, "");
+    }
+    async function readAccessToken() {
+        const resolved = await resolveRegistryApiToken({ ...options, configService: config });
+        return resolved?.token ?? null;
+    }
+    async function refresh() {
+        if (refreshInFlight)
+            return refreshInFlight;
+        refreshInFlight = (async () => {
+            const refreshToken = (await config.get("apiRefreshToken")) ?? null;
+            if (!refreshToken)
+                return null;
+            const res = await fetchImpl(`${await apiBase()}/auth/refresh`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ refresh_token: refreshToken }),
+            });
+            if (!res.ok) {
+                // Refresh token is dead — drop both so status reports signed-out.
+                await config.unset("apiRefreshToken");
+                await config.unset("apiToken");
+                return null;
+            }
+            const data = (await res.json());
+            await config.set("apiToken", data.access_token);
+            if (data.refresh_token)
+                await config.set("apiRefreshToken", data.refresh_token);
+            return data.access_token;
+        })().finally(() => {
+            refreshInFlight = null;
+        });
+        return refreshInFlight;
+    }
+    return {
+        getAccessToken: readAccessToken,
+        async saveTokens({ accessToken, refreshToken }) {
+            await config.set("apiToken", accessToken);
+            if (refreshToken)
+                await config.set("apiRefreshToken", refreshToken);
+        },
+        async clear() {
+            await config.unset("apiToken");
+            await config.unset("apiRefreshToken");
+        },
+        async authenticatedFetch(pathOrUrl, init = {}) {
+            const url = pathOrUrl.startsWith("http")
+                ? pathOrUrl
+                : `${await apiBase()}${pathOrUrl.startsWith("/") ? "" : "/"}${pathOrUrl}`;
+            const send = (token) => {
+                const headers = new Headers(init.headers);
+                if (token)
+                    headers.set("authorization", `Bearer ${token}`);
+                return fetchImpl(url, { ...init, headers });
+            };
+            const first = await send(await readAccessToken());
+            if (first.status !== 401)
+                return first;
+            const refreshed = await refresh();
+            if (!refreshed)
+                return first;
+            return send(refreshed);
+        },
+    };
+}
+//# sourceMappingURL=registry-auth.js.map

package/dist/core/agent-profiles/registry-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-auth.js","sourceRoot":"","sources":["../../../src/core/agent-profiles/registry-auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,GAGxB,MAAM,sBAAsB,CAAC;AAmB9B,MAAM,UAAU,0BAA0B,CACxC,UAAuC,EAAE;IAEzC,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,IAAI,eAAe,GAAkC,IAAI,CAAC;IAE1D,KAAK,UAAU,OAAO;QACpB,OAAO,CACL,OAAO,CAAC,UAAU;YAClB,CAAC,MAAM,yBAAyB,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CACzE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,UAAU,eAAe;QAC5B,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;QACtF,OAAO,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;IACjC,CAAC;IAED,KAAK,UAAU,OAAO;QACpB,IAAI,eAAe;YAAE,OAAO,eAAe,CAAC;QAC5C,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,YAAY,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,IAAI,CAAC;YACnE,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,OAAO,EAAE,eAAe,EAAE;gBAC7D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;aACtD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,kEAAkE;gBAClE,MAAM,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACtC,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqD,CAAC;YACpF,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAChD,IAAI,IAAI,CAAC,aAAa;gBAAE,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YAChF,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,OAAO;QACL,cAAc,EAAE,eAAe;QAE/B,KAAK,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE;YAC5C,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAC1C,IAAI,YAAY;gBAAE,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;QACtE,CAAC;QAED,KAAK,CAAC,KAAK;YACT,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACxC,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,GAAG,EAAE;YAC3C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;gBACtC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,GAAG,MAAM,OAAO,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,EAAE,CAAC;YAE5E,MAAM,IAAI,GAAG,CAAC,KAAoB,EAAE,EAAE;gBACpC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1C,IAAI,KAAK;oBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;gBAC3D,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9C,CAAC,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAC;YAEvC,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/agent-profiles/registry-client.d.ts

@@ -0,0 +1,65 @@
+/**
+ * HTTP client for the hosted profile registry (the brainctl platform).
+ * Thin wrapper over its REST API: profile CRUD, version + package upload,
+ * publish, install descriptors, and GitHub-repo registration. Auth is the
+ * caller's job — pass a token or an already-authenticated `fetch`.
+ */
+export interface RegistryProfile {
+    id: string;
+    slug: string;
+    title: string;
+    summary: string;
+}
+export interface RegistryProfileVersion {
+    id: string;
+    profile_id: string;
+    version: string;
+}
+export interface RegistryInstallDescriptor {
+    slug: string;
+    version: string;
+    source_kind: "brainctl" | "github" | string;
+    download_url: string;
+    checksum_sha256?: string | null;
+}
+export interface RegisterGithubProfileInput {
+    repoUrl: string;
+    slug: string;
+    title: string;
+    summary?: string;
+    refName?: string;
+    profilePath?: string;
+    manifestJson: Record<string, unknown>;
+}
+export interface RegistryClient {
+    getProfileBySlug(slug: string): Promise<RegistryProfile | null>;
+    createProfile(input: {
+        slug: string;
+        title: string;
+        summary?: string;
+        visibility?: "public" | "private";
+    }): Promise<RegistryProfile>;
+    createProfileVersion(input: {
+        profileId: string;
+        version: string;
+        changelog?: string;
+        manifestJson: Record<string, unknown>;
+    }): Promise<RegistryProfileVersion>;
+    uploadPackage(input: {
+        profileId: string;
+        versionId: string;
+        bytes: Uint8Array;
+        mimeType?: string;
+    }): Promise<unknown>;
+    publishProfileVersion(input: {
+        profileId: string;
+        versionId: string;
+    }): Promise<unknown>;
+    getInstallDescriptor(slug: string): Promise<RegistryInstallDescriptor>;
+    registerGithubProfile(input: RegisterGithubProfileInput): Promise<unknown>;
+}
+export declare function createRegistryClient(options: {
+    baseUrl: string;
+    token?: string;
+    fetch?: typeof fetch;
+}): RegistryClient;