opensquid 0.5.395

package/dist/runtime/workflow_phases.d.ts

@@ -0,0 +1,50 @@
+/**
+ * AP.3 — the 7-phase workflow state machine (the gate-readable half of the
+ * severed writer the G-track dropped).
+ *
+ * `log_phase` (the MCP tool) writes TWO places: (a) the engine ledger
+ * (durable, via `task.log_phase`) and (b) this per-session state, which the
+ * workflow gate (AP.4) reads to decide whether a commit may proceed.
+ *
+ * The completeness question is "are all 7 phases logged FOR THE TASK THAT IS
+ * ACTIVE RIGHT NOW" — so completeness is NOT baked in at log time (a new task
+ * must not inherit the prior task's "complete"). We store the raw
+ * `{ task_id, phases }` ledger here and compute `isComplete(state, activeId)`
+ * at read time against the live active task. Switching to a new active task
+ * resets the ledger (a `log_phase` for a different task_id starts fresh).
+ *
+ * Phase names are the engine's canonical set (verified against the Rust
+ * `Phase::parse` validator): a mismatch would make `task.log_phase` reject the
+ * call, so this constant is the single source of truth shared by the tool.
+ *
+ * Storage: `sessionStateFile(id, 'workflow.phases_logged')` — the standard
+ * session state namespace, so the generic `read_state` primitive can read it
+ * too. Atomic tmp+rename write; null-safe read (no throw).
+ *
+ * Imports from: node:fs/promises, node:path, ./paths.js.
+ * Imported by: src/mcp/tools/log_phase.ts; src/functions/* (AP.4 gate read-side).
+ */
+/** The engine's canonical 7-phase set (matches the Rust `Phase::parse` validator). */
+export declare const REQUIRED_PHASES: readonly ["pre_research", "learn", "code", "test", "audit", "post_research", "fix"];
+export type Phase = (typeof REQUIRED_PHASES)[number];
+export interface PhaseState {
+    /** The active task these phases belong to. */
+    task_id: string;
+    /** Phases logged so far for that task (deduped, order of first log). */
+    phases: string[];
+}
+/** Read the phase ledger, or `null` if absent/unreadable/malformed (no throw). */
+export declare function readPhaseState(sessionId: string): Promise<PhaseState | null>;
+/**
+ * Append a phase for `taskId`. Starts a fresh ledger when the active task
+ * changed (the prior task's phases do not carry over). Idempotent per phase.
+ * Returns the updated state.
+ */
+export declare function appendPhase(sessionId: string, taskId: string, phase: string): Promise<PhaseState>;
+/**
+ * Complete ⟺ the ledger is for the currently-active task AND every REQUIRED
+ * phase is present. A ledger for a different task (or absent) is NOT complete —
+ * this is what prevents a new task from inheriting a prior task's completion.
+ */
+export declare function isComplete(state: PhaseState | null, activeTaskId: string): boolean;
+//# sourceMappingURL=workflow_phases.d.ts.map

package/dist/runtime/workflow_phases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow_phases.d.ts","sourceRoot":"","sources":["../../src/runtime/workflow_phases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAOH,sFAAsF;AACtF,eAAO,MAAM,eAAe,qFAQlB,CAAC;AACX,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAKrD,MAAM,WAAW,UAAU;IACzB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,kFAAkF;AAClF,wBAAsB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAqBlF;AAUD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAMrB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAGlF"}

package/dist/runtime/workflow_phases.js

@@ -0,0 +1,92 @@
+/**
+ * AP.3 — the 7-phase workflow state machine (the gate-readable half of the
+ * severed writer the G-track dropped).
+ *
+ * `log_phase` (the MCP tool) writes TWO places: (a) the engine ledger
+ * (durable, via `task.log_phase`) and (b) this per-session state, which the
+ * workflow gate (AP.4) reads to decide whether a commit may proceed.
+ *
+ * The completeness question is "are all 7 phases logged FOR THE TASK THAT IS
+ * ACTIVE RIGHT NOW" — so completeness is NOT baked in at log time (a new task
+ * must not inherit the prior task's "complete"). We store the raw
+ * `{ task_id, phases }` ledger here and compute `isComplete(state, activeId)`
+ * at read time against the live active task. Switching to a new active task
+ * resets the ledger (a `log_phase` for a different task_id starts fresh).
+ *
+ * Phase names are the engine's canonical set (verified against the Rust
+ * `Phase::parse` validator): a mismatch would make `task.log_phase` reject the
+ * call, so this constant is the single source of truth shared by the tool.
+ *
+ * Storage: `sessionStateFile(id, 'workflow.phases_logged')` — the standard
+ * session state namespace, so the generic `read_state` primitive can read it
+ * too. Atomic tmp+rename write; null-safe read (no throw).
+ *
+ * Imports from: node:fs/promises, node:path, ./paths.js.
+ * Imported by: src/mcp/tools/log_phase.ts; src/functions/* (AP.4 gate read-side).
+ */
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { sessionStateFile } from './paths.js';
+/** The engine's canonical 7-phase set (matches the Rust `Phase::parse` validator). */
+export const REQUIRED_PHASES = [
+    'pre_research',
+    'learn',
+    'code',
+    'test',
+    'audit',
+    'post_research',
+    'fix',
+];
+/** Session state key (also readable via the generic `read_state` primitive). */
+const PHASES_KEY = 'workflow.phases_logged';
+/** Read the phase ledger, or `null` if absent/unreadable/malformed (no throw). */
+export async function readPhaseState(sessionId) {
+    try {
+        const parsed = JSON.parse(await readFile(sessionStateFile(sessionId, PHASES_KEY), 'utf8'));
+        if (typeof parsed === 'object' &&
+            parsed !== null &&
+            typeof parsed.task_id === 'string' &&
+            Array.isArray(parsed.phases)) {
+            const s = parsed;
+            return {
+                task_id: s.task_id,
+                phases: s.phases.filter((p) => typeof p === 'string'),
+            };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+async function writePhaseState(sessionId, state) {
+    const path = sessionStateFile(sessionId, PHASES_KEY);
+    await mkdir(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp`;
+    await writeFile(tmp, JSON.stringify(state, null, 2), 'utf8');
+    await rename(tmp, path);
+}
+/**
+ * Append a phase for `taskId`. Starts a fresh ledger when the active task
+ * changed (the prior task's phases do not carry over). Idempotent per phase.
+ * Returns the updated state.
+ */
+export async function appendPhase(sessionId, taskId, phase) {
+    const prev = await readPhaseState(sessionId);
+    const state = prev?.task_id === taskId ? prev : { task_id: taskId, phases: [] };
+    if (!state.phases.includes(phase))
+        state.phases.push(phase);
+    await writePhaseState(sessionId, state);
+    return state;
+}
+/**
+ * Complete ⟺ the ledger is for the currently-active task AND every REQUIRED
+ * phase is present. A ledger for a different task (or absent) is NOT complete —
+ * this is what prevents a new task from inheriting a prior task's completion.
+ */
+export function isComplete(state, activeTaskId) {
+    if (state?.task_id !== activeTaskId)
+        return false;
+    return REQUIRED_PHASES.every((p) => state.phases.includes(p));
+}
+//# sourceMappingURL=workflow_phases.js.map

package/dist/runtime/workflow_phases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow_phases.js","sourceRoot":"","sources":["../../src/runtime/workflow_phases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,sFAAsF;AACtF,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,cAAc;IACd,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,eAAe;IACf,KAAK;CACG,CAAC;AAGX,gFAAgF;AAChF,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAS5C,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAiB;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,QAAQ,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CACrD,CAAC;QACb,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,OAAQ,MAA+B,CAAC,OAAO,KAAK,QAAQ;YAC5D,KAAK,CAAC,OAAO,CAAE,MAA8B,CAAC,MAAM,CAAC,EACrD,CAAC;YACD,MAAM,CAAC,GAAG,MAAgD,CAAC;YAC3D,OAAO;gBACL,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;aACnE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB,EAAE,KAAiB;IACjE,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,MAAc,EACd,KAAa;IAEb,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAe,IAAI,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC5F,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAwB,EAAE,YAAoB;IACvE,IAAI,KAAK,EAAE,OAAO,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/scope.d.ts

@@ -0,0 +1,48 @@
+import type { MemoryScope } from "./engine-client.js";
+export interface DetectedProject {
+    project: string;
+}
+/**
+ * Sync detection (v0.3.1 surface). Does NOT consult the project ID
+ * card. Use the async variant for v0.4+ behavior.
+ */
+export declare function detectProjectScope(cwd?: string): DetectedProject | null;
+/**
+ * v0.4: async detection that consults the project ID card first.
+ *
+ * Order:
+ *   1. OPENSQUID_PROJECT env → wins
+ *   2. .opensquid/project.json card (any ancestor of cwd) → stable id
+ *   3. git basename → fallback
+ *   4. null
+ */
+export declare function detectProjectScopeAsync(cwd?: string): Promise<DetectedProject | null>;
+/**
+ * Sync default-memorize-scope (v0.3.1 surface).
+ */
+export declare function defaultMemorizeScope(cwd?: string): MemoryScope;
+/**
+ * v0.4: async default-memorize-scope that consults the project ID
+ * card. Also AUTO-CREATES the card on first call in a new project
+ * (so the second call onward gets a stable id even if the user
+ * renames the directory). Pass `autoCreate: false` to skip creation.
+ */
+export declare function defaultMemorizeScopeAsync(cwd?: string, options?: {
+    autoCreate?: boolean;
+}): Promise<MemoryScope>;
+/**
+ * Sync default-recall-scope-filter (v0.3.1 surface).
+ */
+export declare function defaultRecallScopeFilter(cwd?: string): {
+    kind: "any_of";
+    scopes: MemoryScope[];
+};
+/**
+ * v0.4: async default-recall-scope-filter that consults the project
+ * ID card. Does NOT auto-create a card — recall is read-only.
+ */
+export declare function defaultRecallScopeFilterAsync(cwd?: string): Promise<{
+    kind: "any_of";
+    scopes: MemoryScope[];
+}>;
+//# sourceMappingURL=scope.d.ts.map

package/dist/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../src.legacy/scope.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAsB,GAAG,eAAe,GAAG,IAAI,CAetF;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,GAAE,MAAsB,GAC1B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAQjC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,WAAW,CAG9D;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,GAAE,MAAsB,EAC3B,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,OAAO,CAAC,WAAW,CAAC,CAiBtB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;IACtD,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB,CAKA;AAED;;;GAGG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,GAAE,MAAsB,GAC1B,OAAO,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC,CAKpD"}

package/dist/scope.js

@@ -0,0 +1,111 @@
+/**
+ * Project-scope auto-detection for memorize/recall defaults.
+ *
+ * Priority order (v0.4+ with project ID card):
+ *  1. `OPENSQUID_PROJECT` env var — explicit override, always wins.
+ *  2. **Project ID card** at `.opensquid/project.json` (walking up from
+ *     cwd) — stable across moves/renames. v0.4 addition.
+ *  3. `git rev-parse --show-toplevel` basename — fallback for projects
+ *     that don't have a card yet (auto-created on first memorize).
+ *  4. `null` — caller falls back to `MemoryScope::User`.
+ *
+ * The sync helpers below keep the v0.3 wire surface; the async
+ * variants consult the ID card and are preferred for new call sites.
+ */
+import { execSync } from "node:child_process";
+import * as path from "node:path";
+import { applyResolution, findProjectCard, resolveProject } from "./project.js";
+/**
+ * Sync detection (v0.3.1 surface). Does NOT consult the project ID
+ * card. Use the async variant for v0.4+ behavior.
+ */
+export function detectProjectScope(cwd = process.cwd()) {
+    const explicit = process.env.OPENSQUID_PROJECT?.trim();
+    if (explicit)
+        return { project: explicit };
+    try {
+        const root = execSync("git rev-parse --show-toplevel", {
+            cwd,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        if (root)
+            return { project: path.basename(root) };
+    }
+    catch {
+        // Not a git repo, or git not installed — fall through.
+    }
+    return null;
+}
+/**
+ * v0.4: async detection that consults the project ID card first.
+ *
+ * Order:
+ *   1. OPENSQUID_PROJECT env → wins
+ *   2. .opensquid/project.json card (any ancestor of cwd) → stable id
+ *   3. git basename → fallback
+ *   4. null
+ */
+export async function detectProjectScopeAsync(cwd = process.cwd()) {
+    const explicit = process.env.OPENSQUID_PROJECT?.trim();
+    if (explicit)
+        return { project: explicit };
+    const card = await findProjectCard(cwd);
+    if (card)
+        return { project: card.card.id };
+    return detectProjectScope(cwd);
+}
+/**
+ * Sync default-memorize-scope (v0.3.1 surface).
+ */
+export function defaultMemorizeScope(cwd) {
+    const detected = detectProjectScope(cwd);
+    return detected ? { project: detected.project } : "user";
+}
+/**
+ * v0.4: async default-memorize-scope that consults the project ID
+ * card. Also AUTO-CREATES the card on first call in a new project
+ * (so the second call onward gets a stable id even if the user
+ * renames the directory). Pass `autoCreate: false` to skip creation.
+ */
+export async function defaultMemorizeScopeAsync(cwd = process.cwd(), options = {}) {
+    const explicit = process.env.OPENSQUID_PROJECT?.trim();
+    if (explicit)
+        return { project: explicit };
+    const card = await findProjectCard(cwd);
+    if (card)
+        return { project: card.card.id };
+    // No card yet — auto-create if allowed, otherwise fall through to
+    // sync detection (returns git basename or "user").
+    if (options.autoCreate !== false) {
+        const resolved = await resolveProject(cwd);
+        if (resolved.kind === "new") {
+            const created = await applyResolution(cwd, resolved, { autoCreate: true });
+            if (created)
+                return { project: created.id };
+        }
+    }
+    return defaultMemorizeScope(cwd);
+}
+/**
+ * Sync default-recall-scope-filter (v0.3.1 surface).
+ */
+export function defaultRecallScopeFilter(cwd) {
+    const detected = detectProjectScope(cwd);
+    const scopes = ["user"];
+    if (detected)
+        scopes.push({ project: detected.project });
+    return { kind: "any_of", scopes };
+}
+/**
+ * v0.4: async default-recall-scope-filter that consults the project
+ * ID card. Does NOT auto-create a card — recall is read-only.
+ */
+export async function defaultRecallScopeFilterAsync(cwd = process.cwd()) {
+    const detected = await detectProjectScopeAsync(cwd);
+    const scopes = ["user"];
+    if (detected)
+        scopes.push({ project: detected.project });
+    return { kind: "any_of", scopes };
+}
+//# sourceMappingURL=scope.js.map

package/dist/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../src.legacy/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAMhF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,+BAA+B,EAAE;YACrD,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAE3C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAE3C,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,UAAoC,EAAE;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAE3C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAE3C,kEAAkE;IAClE,mDAAmD;IACnD,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,OAAO;gBAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAY;IAInD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,MAAM,GAAkB,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAkB,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC"}

package/dist/secrets/backends/dotenv.d.ts

@@ -0,0 +1,26 @@
+/**
+ * env: + .env file backend for the secrets resolver.
+ *
+ * Resolution order on first call (lazy + cached for the process lifetime):
+ *   1. Snapshot `process.env`.
+ *   2. If `opts.path` provided, parse the .env file and merge MISSING keys.
+ *      Existing process.env keys WIN — never overwritten by .env.
+ *   3. ENOENT on the .env file is silently OK (file is optional).
+ *
+ * Parse format (intentionally minimal — sufficient for Phase 1):
+ *   - Match `^([A-Z_][A-Z0-9_]*)\s*=\s*(.*)$`
+ *   - Strip a single pair of surrounding double-quotes.
+ *   - Skip blank lines, comments (`#`), and any non-matching line.
+ *   - dotenv v16 multiline `KEY="line1\nline2"` is NOT expanded here
+ *     (see Phase 1 post-research note in src/secrets/resolver.test.ts).
+ *
+ * Imports from: node:fs/promises, ../types.js.
+ * Imported by: src/secrets/index.ts.
+ */
+import type { SecretBackend } from '../types.js';
+export interface DotenvBackendOptions {
+    /** Optional absolute path to a .env file. If unset, only process.env is consulted. */
+    path?: string;
+}
+export declare function dotenvBackend(opts?: DotenvBackendOptions): SecretBackend;
+//# sourceMappingURL=dotenv.d.ts.map

package/dist/secrets/backends/dotenv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotenv.d.ts","sourceRoot":"","sources":["../../../src/secrets/backends/dotenv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,oBAAoB;IACnC,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,aAAa,CAAC,IAAI,GAAE,oBAAyB,GAAG,aAAa,CA0C5E"}

package/dist/secrets/backends/dotenv.js

@@ -0,0 +1,65 @@
+/**
+ * env: + .env file backend for the secrets resolver.
+ *
+ * Resolution order on first call (lazy + cached for the process lifetime):
+ *   1. Snapshot `process.env`.
+ *   2. If `opts.path` provided, parse the .env file and merge MISSING keys.
+ *      Existing process.env keys WIN — never overwritten by .env.
+ *   3. ENOENT on the .env file is silently OK (file is optional).
+ *
+ * Parse format (intentionally minimal — sufficient for Phase 1):
+ *   - Match `^([A-Z_][A-Z0-9_]*)\s*=\s*(.*)$`
+ *   - Strip a single pair of surrounding double-quotes.
+ *   - Skip blank lines, comments (`#`), and any non-matching line.
+ *   - dotenv v16 multiline `KEY="line1\nline2"` is NOT expanded here
+ *     (see Phase 1 post-research note in src/secrets/resolver.test.ts).
+ *
+ * Imports from: node:fs/promises, ../types.js.
+ * Imported by: src/secrets/index.ts.
+ */
+import { readFile } from 'node:fs/promises';
+export function dotenvBackend(opts = {}) {
+    let cached = null;
+    async function load() {
+        if (cached)
+            return cached;
+        // Start with a snapshot of process.env. Filter out undefined values so the
+        // record type matches Record<string, string> strictly.
+        const env = {};
+        for (const [k, v] of Object.entries(process.env)) {
+            if (typeof v === 'string')
+                env[k] = v;
+        }
+        if (opts.path) {
+            try {
+                const raw = await readFile(opts.path, 'utf8');
+                for (const line of raw.split('\n')) {
+                    const match = /^([A-Z_][A-Z0-9_]*)\s*=\s*(.*)$/.exec(line);
+                    if (!match)
+                        continue;
+                    const key = match[1];
+                    const rawValue = match[2];
+                    if (key === undefined || rawValue === undefined)
+                        continue;
+                    // process.env wins — only fill keys that aren't already set.
+                    if (env[key] !== undefined)
+                        continue;
+                    env[key] = rawValue.replace(/^"(.*)"$/, '$1');
+                }
+            }
+            catch {
+                // ENOENT or unreadable .env — file is optional.
+            }
+        }
+        cached = env;
+        return cached;
+    }
+    return {
+        scheme: 'env',
+        async resolve(name) {
+            const env = await load();
+            return env[name] ?? null;
+        },
+    };
+}
+//# sourceMappingURL=dotenv.js.map

package/dist/secrets/backends/dotenv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotenv.js","sourceRoot":"","sources":["../../../src/secrets/backends/dotenv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAQ5C,MAAM,UAAU,aAAa,CAAC,OAA6B,EAAE;IAC3D,IAAI,MAAM,GAAkC,IAAI,CAAC;IAEjD,KAAK,UAAU,IAAI;QACjB,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC9C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC3D,IAAI,CAAC,KAAK;wBAAE,SAAS;oBACrB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC1B,IAAI,GAAG,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;wBAAE,SAAS;oBAC1D,6DAA6D;oBAC7D,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;wBAAE,SAAS;oBACrC,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,CAAC;QACb,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK;QACb,KAAK,CAAC,OAAO,CAAC,IAAY;YACxB,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/secrets/backends/keychain.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Cross-platform OS keychain backend for the secrets resolver.
+ *
+ * Per-platform dispatch via `process.platform`:
+ *   - darwin → `security find-generic-password -s <svc> -a <acc> -w` (stdout = pw)
+ *   - linux  → `secret-tool lookup service <svc> account <acc>`     (stdout = pw)
+ *   - win32  → `cmdkey /list:<svc>:<acc>` (Phase 1 illustrative existence-check;
+ *              real value retrieval requires the Windows Credential Manager API
+ *              and is deferred to a later phase — see UI.7 hand-off note in
+ *              task 1.17 risk-callouts).
+ *   - other  → null (unsupported platform).
+ *
+ * The dispatch is STRICT: macOS code paths never run on Linux, and vice versa.
+ * No env-var-driven cross-platform shimming.
+ *
+ * Reference shape:
+ *   - `<account>`              → uses default service (configured via opts.service)
+ *   - `<service>/<account>`    → overrides service for this lookup
+ *
+ * Subprocess discipline (matches op.ts):
+ *   - `stdio: ['ignore', 'pipe', 'pipe']` — no stdin needed.
+ *   - SIGTERM after `timeoutMs` (default 5000) to bound interactive consent
+ *     prompts (macOS Keychain may pop a system dialog on first access).
+ *   - Spawn errors (binary missing) and non-zero exits BOTH return null at the
+ *     public API. Internally the helper still distinguishes the two so future
+ *     telemetry can surface "backend missing" vs "not found" separately.
+ *
+ * Security:
+ *   - NEVER log resolved secret values. This module logs nothing.
+ *
+ * macOS gotcha (post-research note, UI.7 hand-off): on first access to a
+ * keychain item, macOS may prompt the user to allow access. The 5s timeout
+ * catches a blocked prompt, but the setup UI should warn users.
+ *
+ * Imports from: node:child_process, ../types.js.
+ * Imported by: src/secrets/index.ts.
+ */
+import type { SecretBackend } from '../types.js';
+export interface KeychainBackendOptions {
+    /** Default service name used when a ref has no `<service>/` prefix. Default 'opensquid'. */
+    service?: string;
+    /** Subprocess timeout in ms. Default 5000. */
+    timeoutMs?: number;
+    /**
+     * Optional per-platform binary overrides. Used by tests to inject fake CLIs
+     * that mimic the real binaries' argv shape without depending on a real
+     * Keychain / libsecret / Credential Manager being present.
+     *
+     * Production code paths leave these undefined, so the real `security`,
+     * `secret-tool`, and `cmdkey` are invoked via PATH lookup.
+     */
+    binaries?: {
+        darwin?: string;
+        linux?: string;
+        win32?: string;
+    };
+}
+export declare function keychainBackend(opts?: KeychainBackendOptions): SecretBackend;
+//# sourceMappingURL=keychain.d.ts.map

package/dist/secrets/backends/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../../src/secrets/backends/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,sBAAsB;IACrC,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAQD,wBAAgB,eAAe,CAAC,IAAI,GAAE,sBAA2B,GAAG,aAAa,CAqBhF"}

package/dist/secrets/backends/keychain.js

@@ -0,0 +1,133 @@
+/**
+ * Cross-platform OS keychain backend for the secrets resolver.
+ *
+ * Per-platform dispatch via `process.platform`:
+ *   - darwin → `security find-generic-password -s <svc> -a <acc> -w` (stdout = pw)
+ *   - linux  → `secret-tool lookup service <svc> account <acc>`     (stdout = pw)
+ *   - win32  → `cmdkey /list:<svc>:<acc>` (Phase 1 illustrative existence-check;
+ *              real value retrieval requires the Windows Credential Manager API
+ *              and is deferred to a later phase — see UI.7 hand-off note in
+ *              task 1.17 risk-callouts).
+ *   - other  → null (unsupported platform).
+ *
+ * The dispatch is STRICT: macOS code paths never run on Linux, and vice versa.
+ * No env-var-driven cross-platform shimming.
+ *
+ * Reference shape:
+ *   - `<account>`              → uses default service (configured via opts.service)
+ *   - `<service>/<account>`    → overrides service for this lookup
+ *
+ * Subprocess discipline (matches op.ts):
+ *   - `stdio: ['ignore', 'pipe', 'pipe']` — no stdin needed.
+ *   - SIGTERM after `timeoutMs` (default 5000) to bound interactive consent
+ *     prompts (macOS Keychain may pop a system dialog on first access).
+ *   - Spawn errors (binary missing) and non-zero exits BOTH return null at the
+ *     public API. Internally the helper still distinguishes the two so future
+ *     telemetry can surface "backend missing" vs "not found" separately.
+ *
+ * Security:
+ *   - NEVER log resolved secret values. This module logs nothing.
+ *
+ * macOS gotcha (post-research note, UI.7 hand-off): on first access to a
+ * keychain item, macOS may prompt the user to allow access. The 5s timeout
+ * catches a blocked prompt, but the setup UI should warn users.
+ *
+ * Imports from: node:child_process, ../types.js.
+ * Imported by: src/secrets/index.ts.
+ */
+import { spawn } from 'node:child_process';
+export function keychainBackend(opts = {}) {
+    const service = opts.service ?? 'opensquid';
+    const timeout = opts.timeoutMs ?? 5000;
+    const binaries = opts.binaries ?? {};
+    return {
+        scheme: 'keychain',
+        async resolve(ref) {
+            const [svc, acc] = parseRef(ref, service);
+            switch (process.platform) {
+                case 'darwin':
+                    return macosLookup(binaries.darwin ?? 'security', svc, acc, timeout);
+                case 'linux':
+                    return linuxLookup(binaries.linux ?? 'secret-tool', svc, acc, timeout);
+                case 'win32':
+                    return windowsLookup(binaries.win32 ?? 'cmdkey', svc, acc, timeout);
+                default:
+                    return null;
+            }
+        },
+    };
+}
+/**
+ * Parse a backend-scoped reference into `[service, account]`.
+ *
+ * `acc` (no slash)          → [defaultService, acc]
+ * `svc/acc`                 → [svc, acc]
+ * `svc/with/slashes/in/acc` → [svc, 'with/slashes/in/acc']  (first `/` is the split)
+ *
+ * Empty string is treated as account = '' under default service; the platform
+ * lookup will then fail to find it and return null — no special-case here.
+ */
+function parseRef(ref, defaultService) {
+    const slash = ref.indexOf('/');
+    if (slash < 0)
+        return [defaultService, ref];
+    return [ref.slice(0, slash), ref.slice(slash + 1)];
+}
+async function macosLookup(bin, service, account, timeoutMs) {
+    const r = await runCapture(bin, ['find-generic-password', '-s', service, '-a', account, '-w'], timeoutMs);
+    return r.code === 0 ? r.stdout.trim() : null;
+}
+async function linuxLookup(bin, service, account, timeoutMs) {
+    const r = await runCapture(bin, ['lookup', 'service', service, 'account', account], timeoutMs);
+    return r.code === 0 ? r.stdout.trim() : null;
+}
+async function windowsLookup(bin, service, account, timeoutMs) {
+    // Phase 1 illustrative: `cmdkey /list:<target>` exits 0 if the credential
+    // exists, but does NOT print the password (Windows security feature). Real
+    // password retrieval requires the Credential Manager API (CredRead) via a
+    // native binding or a PowerShell helper using SecureString. Deferred to a
+    // later phase — see UI.7 hand-off and task 1.17 risk-callouts.
+    //
+    // For now, on exit-0 we return an empty string sentinel so downstream knows
+    // the credential exists. On non-zero exit (not found) or spawn-error we
+    // return null. This behavior is illustrative and will be replaced.
+    const target = `${service}:${account}`;
+    const r = await runCapture(bin, [`/list:${target}`], timeoutMs);
+    return r.code === 0 ? '' : null;
+}
+/**
+ * Spawn `bin args`, capture stdout, kill via SIGTERM after `timeoutMs`.
+ *
+ * Returns `{ code, stdout }`. `code === -1` means the spawn itself failed
+ * (e.g. binary not on PATH); `code !== 0` (and `code !== -1`) means the
+ * subprocess ran but exited non-zero (e.g. "not found"). The public
+ * `keychainBackend.resolve` collapses both into `null`, but the distinction
+ * is preserved here for future telemetry / setup-UI diagnostics.
+ *
+ * stderr is intentionally drained (so the pipe buffer doesn't fill and stall
+ * the child) but discarded — we don't log secret-tool / security stderr,
+ * because on some platforms it may echo the account name.
+ */
+function runCapture(bin, args, timeoutMs) {
+    return new Promise((resolve) => {
+        const proc = spawn(bin, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+        let stdout = '';
+        const t = setTimeout(() => proc.kill('SIGTERM'), timeoutMs);
+        proc.stdout.on('data', (d) => {
+            stdout += typeof d === 'string' ? d : d.toString('utf8');
+        });
+        // Drain stderr to prevent pipe-buffer stall; do not retain.
+        proc.stderr.on('data', (d) => {
+            void d;
+        });
+        proc.on('close', (code) => {
+            clearTimeout(t);
+            resolve({ code: code ?? -1, stdout });
+        });
+        proc.on('error', () => {
+            clearTimeout(t);
+            resolve({ code: -1, stdout: '' });
+        });
+    });
+}
+//# sourceMappingURL=keychain.js.map

package/dist/secrets/backends/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../src/secrets/backends/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA8B3C,MAAM,UAAU,eAAe,CAAC,OAA+B,EAAE;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAErC,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,KAAK,CAAC,OAAO,CAAC,GAAW;YACvB,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC1C,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACzB,KAAK,QAAQ;oBACX,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,IAAI,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBACvE,KAAK,OAAO;oBACV,OAAO,WAAW,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBACzE,KAAK,OAAO;oBACV,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBACtE;oBACE,OAAO,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,QAAQ,CAAC,GAAW,EAAE,cAAsB;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,OAAe,EACf,OAAe,EACf,SAAiB;IAEjB,MAAM,CAAC,GAAG,MAAM,UAAU,CACxB,GAAG,EACH,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAC7D,SAAS,CACV,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,OAAe,EACf,OAAe,EACf,SAAiB;IAEjB,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;IAC/F,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,OAAe,EACf,OAAe,EACf,SAAiB;IAEjB,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,+DAA+D;IAC/D,EAAE;IACF,4EAA4E;IAC5E,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,IAAc,EAAE,SAAiB;IAChE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACrE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAkB,EAAE,EAAE;YAC5C,MAAM,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,4DAA4D;QAC5D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAkB,EAAE,EAAE;YAC5C,KAAK,CAAC,CAAC;QACT,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/secrets/backends/literal.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Literal-value secret backend. URI shape `literal:<value>` returns `<value>`
+ * verbatim. Used by CLI-managed subscriptions where the secret IS the
+ * authoritative artifact (it was generated by `opensquid webhooks subscribe`
+ * and stored inline in `webhooks.yaml`). Production deployments typically
+ * prefer `env:` / `op:` / `keychain:` instead, but the CLI's rotate path
+ * needs an atomic "write new secret to webhooks.yaml BEFORE invalidating
+ * old" guarantee, which only inline storage provides.
+ *
+ * Empty literal (`literal:`) resolves to null so a malformed URI surfaces
+ * via the loader's missing-secret error path instead of silently providing
+ * an empty HMAC key.
+ *
+ * Imports from: ../types.js.
+ * Imported by: src/secrets/index.ts.
+ */
+import type { SecretBackend } from '../types.js';
+export declare function literalBackend(): SecretBackend;
+//# sourceMappingURL=literal.d.ts.map

package/dist/secrets/backends/literal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"literal.d.ts","sourceRoot":"","sources":["../../../src/secrets/backends/literal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,wBAAgB,cAAc,IAAI,aAAa,CAO9C"}