opensquid 0.5.395

package/dist/setup/cli/webhooks_actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks_actions.d.ts","sourceRoot":"","sources":["../../../src/setup/cli/webhooks_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAIH,OAAO,EAOL,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAM7B,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,gFAAgF;AAChF,MAAM,MAAM,YAAY,GAAG,CACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAE9D,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,aAAa,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,OAAO,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AA0BD,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAYzF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAO7D;AAMD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAUjE;AASD,wBAAsB,YAAY,CAChC,IAAI,EAAE,UAAU,EAChB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CA4Ef;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,UAAU,EAChB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IAAE,GAAG,EAAE,OAAO,CAAA;CAAE,GACrB,OAAO,CAAC,IAAI,CAAC,CAuBf;AAMD,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAkDzF;AAgCD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,UAAU,EAChB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IAAE,GAAG,EAAE,OAAO,CAAA;CAAE,GACrB,OAAO,CAAC,IAAI,CAAC,CAiDf"}

package/dist/setup/cli/webhooks_actions.js

@@ -0,0 +1,301 @@
+/**
+ * Action implementations for CLI.3 — `opensquid webhooks …`.
+ *
+ * Split out of `webhooks.ts` (file-size budget). Each exported function is a
+ * single verb's body; `webhooks.ts` wires commander to these via thin
+ * `.action(opts => action(...))` bridges. Functions take all I/O via
+ * explicit deps (`paths`, `out`, `err`, `isTty`, `now`, optional `fetch`)
+ * so they're testable independently.
+ *
+ * Verb semantics (locked):
+ *
+ *   list        — `subscriptions:` from `~/.opensquid/webhooks.yaml`; the
+ *                 secret column is ALWAYS rendered as `[REDACTED]`. Never
+ *                 prints raw secrets at any log level. Subscribe is the
+ *                 ONLY verb that emits the freshly-generated secret on
+ *                 stdout (by design — the user needs it to configure the
+ *                 upstream sender).
+ *   subscribe   — generate HMAC, compose record, atomic write, print URL +
+ *                 secret. Requires `--skill <name>` XOR `--deliver-only`;
+ *                 errors with explicit message on neither / both.
+ *   unsubscribe — confirm (`--yes` to bypass), filter list, atomic write.
+ *                 Non-TTY context without `--yes` exits 1.
+ *   test        — simulate POST against the running daemon at the canonical
+ *                 URL. Signs body with the subscription's secret + emits the
+ *                 HTTP status. `--payload <json>` overrides the default `{}`.
+ *   rotate      — atomicity-critical. Generates new secret, writes the new
+ *                 record set to `webhooks.yaml` FIRST (rename = atomic on
+ *                 POSIX). Only AFTER the rename succeeds do we print the
+ *                 new secret to stdout. If the process dies between
+ *                 generate-secret and rename, NO state changed. If it dies
+ *                 between rename and stdout-print, the new secret is on
+ *                 disk and the user can `list` to see the rotation
+ *                 happened (re-print is not possible by design — the user
+ *                 must rotate again to see a fresh secret).
+ *
+ * Imports from: node:crypto, node:http, node:readline/promises,
+ *   ./webhooks_state.
+ * Imported by: src/setup/cli/webhooks.ts.
+ */
+import { createHmac } from 'node:crypto';
+import { genSecret, literalSecretUri, readWebhooksFile, unwrapLiteralSecret, webhookUrl, writeWebhooksFile, } from './webhooks_state.js';
+/** Severity literals from SCHED.1's `SeveritySpec`. */
+const SEVERITIES = ['critical', 'error', 'warning', 'info'];
+async function confirm(question, isTty) {
+    if (!isTty())
+        return false;
+    const rl = (await import('node:readline/promises')).createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    try {
+        const answer = (await rl.question(question)).trim().toLowerCase();
+        return answer === 'y' || answer === 'yes';
+    }
+    finally {
+        rl.close();
+    }
+}
+// ---------------------------------------------------------------------------
+// list — kubectl-style table. Secret column is ALWAYS [REDACTED].
+// ---------------------------------------------------------------------------
+const LIST_COLS = ['ID', 'PACK', 'MODE', 'TARGET', 'URL', 'SECRET'];
+function padCell(s, n) {
+    return s + ' '.repeat(Math.max(0, n - s.length));
+}
+export function renderListTable(rows, port) {
+    const cells = rows.map((r) => {
+        const mode = r.deliver_only === true ? 'deliver-only' : 'skill';
+        const target = r.deliver_only === true ? (r.deliver_to ?? '?') : (r.skill ?? '?');
+        return [r.id, r.pack, mode, target, webhookUrl(r.id, port), '[REDACTED]'];
+    });
+    const widths = LIST_COLS.map((h, i) => Math.max(h.length, ...cells.map((row) => (row[i] ?? '').length)));
+    const header = LIST_COLS.map((h, i) => padCell(h, widths[i] ?? 0)).join('  ');
+    const body = cells.map((row) => row.map((cell, i) => padCell(cell, widths[i] ?? 0)).join('  '));
+    return [header, ...body].join('\n');
+}
+export async function actList(deps) {
+    const subs = await readWebhooksFile(deps.paths.webhooksPath);
+    if (subs.length === 0) {
+        deps.out('(no webhook subscriptions)\n');
+        return;
+    }
+    deps.out(renderListTable(subs, deps.paths.port) + '\n');
+}
+/** Mode-mutex evidence: returns the error message if invalid; null otherwise. */
+export function checkModeMutex(opts) {
+    const hasSkill = opts.skill !== undefined && opts.skill.length > 0;
+    const hasDeliverOnly = opts.deliverOnly === true;
+    if (!hasSkill && !hasDeliverOnly) {
+        return 'must pick exactly one mode: pass either --skill <name> (LLM-route mode) or --deliver-only (zero-LLM template mode)';
+    }
+    if (hasSkill && hasDeliverOnly) {
+        return '--skill and --deliver-only are mutually exclusive: skill-mode routes through the evaluator; deliver-only renders a template without invoking the LLM';
+    }
+    return null;
+}
+function parseRateLimit(spec) {
+    const m = /^(\d+)\/(minute|hour|day)$/.exec(spec.trim());
+    if (!m)
+        throw new Error(`--rate-limit "${spec}" must be "<n>/<minute|hour|day>" (e.g. "60/minute")`);
+    return { max: Number.parseInt(m[1] ?? '0', 10), per: m[2] };
+}
+export async function actSubscribe(deps, id, opts) {
+    const existing = await readWebhooksFile(deps.paths.webhooksPath);
+    if (existing.some((s) => s.id === id)) {
+        deps.err(`opensquid webhooks subscribe: subscription "${id}" already exists (use \`opensquid webhooks rotate ${id}\` to rotate the secret, or \`opensquid webhooks unsubscribe ${id}\` first)\n`);
+        process.exitCode = 1;
+        return;
+    }
+    const mutexErr = checkModeMutex(opts);
+    if (mutexErr !== null) {
+        deps.err(`opensquid webhooks subscribe: ${mutexErr}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    if (opts.deliverOnly === true) {
+        for (const field of ['deliver', 'template', 'severity']) {
+            if (opts[field] === undefined) {
+                deps.err(`opensquid webhooks subscribe: --${field} is required when --deliver-only is set (SCHED.2 deliver-only mode needs template + deliver + severity together)\n`);
+                process.exitCode = 1;
+                return;
+            }
+        }
+        if (!SEVERITIES.includes(opts.severity)) {
+            deps.err(`opensquid webhooks subscribe: --severity "${opts.severity ?? ''}" must be one of ${SEVERITIES.join('|')}\n`);
+            process.exitCode = 1;
+            return;
+        }
+    }
+    const hex = genSecret();
+    const record = {
+        id,
+        pack: opts.pack,
+        secret: literalSecretUri(hex),
+        created_at: deps.now().toISOString(),
+    };
+    if (opts.skill !== undefined)
+        record.skill = opts.skill;
+    if (opts.deliverOnly === true) {
+        // Required-field checks above guarantee these are defined.
+        record.deliver_only = true;
+        if (opts.template !== undefined)
+            record.template = opts.template;
+        if (opts.deliver !== undefined)
+            record.deliver_to = opts.deliver;
+        record.severity = opts.severity;
+    }
+    if (opts.rateLimit !== undefined) {
+        try {
+            record.rate_limit = parseRateLimit(opts.rateLimit);
+        }
+        catch (e) {
+            deps.err(`opensquid webhooks subscribe: ${e instanceof Error ? e.message : String(e)}\n`);
+            process.exitCode = 1;
+            return;
+        }
+    }
+    await writeWebhooksFile(deps.paths.webhooksPath, [...existing, record]);
+    deps.out(`${JSON.stringify({
+        id,
+        pack: opts.pack,
+        mode: opts.deliverOnly === true ? 'deliver-only' : 'skill',
+        url: webhookUrl(id, deps.paths.port),
+        secret: hex,
+        ...(record.skill !== undefined ? { skill: record.skill } : {}),
+        ...(record.deliver_to !== undefined ? { deliver_to: record.deliver_to } : {}),
+        ...(record.severity !== undefined ? { severity: record.severity } : {}),
+    }, null, 2)}\n`);
+}
+// ---------------------------------------------------------------------------
+// unsubscribe — confirm + atomic rewrite.
+// ---------------------------------------------------------------------------
+export async function actUnsubscribe(deps, id, opts) {
+    const existing = await readWebhooksFile(deps.paths.webhooksPath);
+    if (!existing.some((s) => s.id === id)) {
+        deps.err(`opensquid webhooks unsubscribe: no subscription with id "${id}"\n`);
+        process.exitCode = 1;
+        return;
+    }
+    if (!opts.yes && !deps.isTty()) {
+        deps.err(`opensquid webhooks unsubscribe: refusing to remove "${id}" without --yes in non-interactive context\n`);
+        process.exitCode = 1;
+        return;
+    }
+    if (!opts.yes && !(await confirm(`Unsubscribe webhook "${id}"? [y/N] `, deps.isTty))) {
+        deps.out('aborted\n');
+        return;
+    }
+    await writeWebhooksFile(deps.paths.webhooksPath, existing.filter((s) => s.id !== id));
+    deps.out(`unsubscribed ${id}\n`);
+}
+export async function actTest(deps, id, opts) {
+    const existing = await readWebhooksFile(deps.paths.webhooksPath);
+    const sub = existing.find((s) => s.id === id);
+    if (!sub) {
+        deps.err(`opensquid webhooks test: no subscription with id "${id}"\n`);
+        process.exitCode = 1;
+        return;
+    }
+    const unwrapped = unwrapLiteralSecret(sub.secret);
+    if (!unwrapped.literal) {
+        deps.err(`opensquid webhooks test: subscription "${id}" stores a non-literal secret URI ("${sub.secret.split(':')[0] ?? '?'}:...") — \`test\` requires inline-literal secrets so the CLI can sign without configuring a resolver. Rotate the subscription to migrate.\n`);
+        process.exitCode = 1;
+        return;
+    }
+    const body = opts.payload ?? '{}';
+    const sig = `sha256=${createHmac('sha256', unwrapped.value).update(body, 'utf8').digest('hex')}`;
+    const url = webhookUrl(id, deps.paths.port);
+    const doFetch = deps.fetch ??
+        (async (u, init) => {
+            const r = await globalThis.fetch(u, init);
+            return { status: r.status, text: () => r.text() };
+        });
+    let status;
+    let responseText;
+    try {
+        const r = await doFetch(url, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                'x-opensquid-signature': sig,
+            },
+            body,
+        });
+        status = r.status;
+        responseText = await r.text();
+    }
+    catch (e) {
+        deps.err(`opensquid webhooks test: POST to ${url} failed (${e instanceof Error ? e.message : String(e)}) — is the daemon running on port ${String(deps.paths.port)}?\n`);
+        process.exitCode = 1;
+        return;
+    }
+    deps.out(`${JSON.stringify({ id, url, status, response: safeJsonOrText(responseText) }, null, 2)}\n`);
+}
+function safeJsonOrText(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+// ---------------------------------------------------------------------------
+// rotate — atomic secret swap.
+//
+// Ordering (locked):
+//   1. Read full subscription set.
+//   2. Generate the new secret (in-memory only — not yet on disk).
+//   3. Build NEW subscription set with the rotated record (old set untouched
+//      in memory). Stamp `rotated_at`.
+//   4. `writeWebhooksFile` → tmp file → `rename` (POSIX-atomic). After this
+//      line, webhooks.yaml is the authoritative new state.
+//   5. ONLY NOW print the new secret on stdout.
+//
+// Failure modes:
+//   - Crash before step 4: nothing changed on disk.
+//   - Crash during step 4: rename is atomic, so it either succeeded or
+//     didn't — the file is never half-written.
+//   - Crash after step 4 / before step 5: secret is rotated on disk; the
+//     user re-runs `rotate` to surface a fresh secret (re-printing the
+//     existing one is not possible by design — we never read it back into
+//     the user's terminal scrollback).
+// ---------------------------------------------------------------------------
+export async function actRotate(deps, id, opts) {
+    const existing = await readWebhooksFile(deps.paths.webhooksPath);
+    const sub = existing.find((s) => s.id === id);
+    if (!sub) {
+        deps.err(`opensquid webhooks rotate: no subscription with id "${id}"\n`);
+        process.exitCode = 1;
+        return;
+    }
+    if (!opts.yes && !deps.isTty()) {
+        deps.err(`opensquid webhooks rotate: refusing to rotate "${id}" without --yes in non-interactive context\n`);
+        process.exitCode = 1;
+        return;
+    }
+    if (!opts.yes &&
+        !(await confirm(`Rotate HMAC secret for "${id}"? Old secret stops working. [y/N] `, deps.isTty))) {
+        deps.out('aborted\n');
+        return;
+    }
+    // Step 2-3: build new state in memory (no disk writes yet).
+    const hex = genSecret();
+    const rotated = {
+        ...sub,
+        secret: literalSecretUri(hex),
+        rotated_at: deps.now().toISOString(),
+    };
+    const next = existing.map((s) => (s.id === id ? rotated : s));
+    // Step 4: atomic disk swap. After this returns successfully, the NEW
+    // secret is the only secret on disk — old is invalidated.
+    await writeWebhooksFile(deps.paths.webhooksPath, next);
+    // Step 5: only now is it safe to print.
+    deps.out(`${JSON.stringify({
+        id,
+        url: webhookUrl(id, deps.paths.port),
+        secret: hex,
+        rotated_at: rotated.rotated_at,
+    }, null, 2)}\n`);
+}
+//# sourceMappingURL=webhooks_actions.js.map

package/dist/setup/cli/webhooks_actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks_actions.js","sourceRoot":"","sources":["../../../src/setup/cli/webhooks_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,iBAAiB,GAElB,MAAM,qBAAqB,CAAC;AAE7B,uDAAuD;AACvD,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAU,CAAC;AAuBrE,KAAK,UAAU,OAAO,CAAC,QAAgB,EAAE,KAAoB;IAC3D,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,eAAe,CAAC;QAClE,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClE,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,CAAC;IAC5C,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAC;AAE7E,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAmC,EAAE,IAAY;IAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;QAChE,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;QAClF,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACpC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CACjE,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAgB;IAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AAC1D,CAAC;AAgBD,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC;IACjD,IAAI,CAAC,QAAQ,IAAI,CAAC,cAAc,EAAE,CAAC;QACjC,OAAO,oHAAoH,CAAC;IAC9H,CAAC;IACD,IAAI,QAAQ,IAAI,cAAc,EAAE,CAAC;QAC/B,OAAO,sJAAsJ,CAAC;IAChK,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,CAAC,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC;QACJ,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,sDAAsD,CAAC,CAAC;IAC/F,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAA8B,EAAE,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAgB,EAChB,EAAU,EACV,IAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,CACN,+CAA+C,EAAE,qDAAqD,EAAE,gEAAgE,EAAE,aAAa,CACxL,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,iCAAiC,QAAQ,IAAI,CAAC,CAAC;QACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAU,EAAE,CAAC;YACjE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,GAAG,CACN,mCAAmC,KAAK,oHAAoH,CAC7J,CAAC;gBACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAoB,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,GAAG,CACN,6CAA6C,IAAI,CAAC,QAAQ,IAAI,EAAE,oBAAoB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAC7G,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,MAAM,GAAuB;QACjC,EAAE;QACF,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC;QAC7B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACxD,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC9B,2DAA2D;QAC3D,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC;QACjE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAoB,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,CAAC,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,iCAAiC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,CACN,GAAG,IAAI,CAAC,SAAS,CACf;QACE,EAAE;QACF,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;QAC1D,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACpC,MAAM,EAAE,GAAG;QACX,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CACN,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAgB,EAChB,EAAU,EACV,IAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,4DAA4D,EAAE,KAAK,CAAC,CAAC;QAC9E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CACN,uDAAuD,EAAE,8CAA8C,CACxG,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,wBAAwB,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtB,OAAO;IACT,CAAC;IACD,MAAM,iBAAiB,CACrB,IAAI,CAAC,KAAK,CAAC,YAAY,EACvB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CACpC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,EAAU,EAAE,IAAc;IACxE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,GAAG,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CACN,0CAA0C,EAAE,uCAAuC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,6IAA6I,CAChQ,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IAClC,MAAM,GAAG,GAAG,UAAU,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACjG,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GACX,IAAI,CAAC,KAAK;QACV,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACjB,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC1C,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,IAAI,MAAc,CAAC;IACnB,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,uBAAuB,EAAE,GAAG;aAC7B;YACD,IAAI;SACL,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAClB,YAAY,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,GAAG,CACN,oCAAoC,GAAG,YACrC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC3C,qCAAqC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAClE,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG,CACN,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,EAAE;AACF,qBAAqB;AACrB,mCAAmC;AACnC,mEAAmE;AACnE,6EAA6E;AAC7E,uCAAuC;AACvC,4EAA4E;AAC5E,2DAA2D;AAC3D,gDAAgD;AAChD,EAAE;AACF,iBAAiB;AACjB,oDAAoD;AACpD,uEAAuE;AACvE,+CAA+C;AAC/C,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,uCAAuC;AACvC,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAgB,EAChB,EAAU,EACV,IAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,GAAG,CAAC,uDAAuD,EAAE,KAAK,CAAC,CAAC;QACzE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CACN,kDAAkD,EAAE,8CAA8C,CACnG,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IACE,CAAC,IAAI,CAAC,GAAG;QACT,CAAC,CAAC,MAAM,OAAO,CAAC,2BAA2B,EAAE,qCAAqC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAChG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtB,OAAO;IACT,CAAC;IAED,4DAA4D;IAC5D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,OAAO,GAAuB;QAClC,GAAG,GAAG;QACN,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC;QAC7B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IACF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,qEAAqE;IACrE,0DAA0D;IAC1D,MAAM,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAEvD,wCAAwC;IACxC,IAAI,CAAC,GAAG,CACN,GAAG,IAAI,CAAC,SAAS,CACf;QACE,EAAE;QACF,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACpC,MAAM,EAAE,GAAG;QACX,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CACN,CAAC;AACJ,CAAC"}

package/dist/setup/cli/webhooks_state.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Webhook subscription persistence helpers for CLI.3.
+ *
+ * Split out of `webhooks.ts` (file-size budget). Three concerns:
+ *
+ *   1. `readWebhooksFile` / `writeWebhooksFile` — load + atomically rewrite
+ *      `~/.opensquid/webhooks.yaml`. Schema mirrors the SCHED.1 runtime
+ *      loader (`src/runtime/webhook_subscriptions.ts`) so anything the CLI
+ *      writes is consumable by the daemon without a second migration step.
+ *      Atomic write via `tmp + rename` (now delegated to `state_io.ts`).
+ *   2. `genSecret` — `crypto.randomBytes(32).toString('hex')` returning the
+ *      64-char lowercase hex string used for HMAC-SHA256 signing keys. The
+ *      caller embeds it via a `literal:<hex>` URI so the runtime's secret
+ *      resolver (post-`literalBackend()` registration) reads it back.
+ *   3. `defaultWebhooksPath` / `defaultWebhookPort` — `~/.opensquid/
+ *      webhooks.yaml` + `8765` matching `DEFAULT_WEBHOOK_PORT` in
+ *      `src/runtime/daemon.ts`.
+ *
+ * Secret-handling discipline (audit-critical):
+ *
+ *   We DO NOT use the runtime `SecretResolver` here. The CLI is the
+ *   authoritative writer of inline-literal subscriptions; introducing
+ *   resolver indirection in the CLI write path would couple the CLI to
+ *   the resolver's env-var / 1Password backends and break the locked
+ *   "write new secret to webhooks.yaml BEFORE invalidating old" atomic
+ *   rotation contract. The `secret:` field is stored as the URI
+ *   `literal:<64-hex>` directly — readers (CLI + daemon) get the hex by
+ *   either stripping the `literal:` prefix (CLI) or routing through the
+ *   resolver with `literalBackend()` registered (daemon, configured at
+ *   setup time outside this task's scope).
+ *
+ * Imports from: node:crypto, ../../runtime/paths, ./state_io.
+ * Imported by: src/setup/cli/webhooks.ts + src/setup/cli/webhooks_actions.ts.
+ */
+/** CLI-managed shape mirrors the SCHED.1 `SubscriptionYaml` exactly. */
+export interface SubscriptionRecord {
+    id: string;
+    pack: string;
+    /** Required unless deliver_only is true. */
+    skill?: string;
+    /** URI for the SecretResolver. CLI writes `literal:<64-hex>`. */
+    secret: string;
+    /** SCHED.2 zero-LLM mode flag. Default false on disk; we never write
+     *  `deliver_only: false` explicitly to keep skill-mode YAML clean. */
+    deliver_only?: boolean;
+    template?: string;
+    deliver_to?: string;
+    severity?: 'critical' | 'error' | 'warning' | 'info';
+    rate_limit?: {
+        max: number;
+        per: 'minute' | 'hour' | 'day';
+    };
+    /** ISO-8601 timestamps the CLI stamps for audit. Daemon ignores. */
+    created_at?: string;
+    rotated_at?: string;
+}
+export declare const defaultWebhooksPath: () => string;
+/** Mirrors `DEFAULT_WEBHOOK_PORT` in `src/runtime/daemon.ts`. */
+export declare const defaultWebhookPort: () => number;
+/** Generate a 64-char lowercase hex HMAC-SHA256 signing key (32 bytes). */
+export declare function genSecret(): string;
+/** Compose the `literal:` URI the CLI persists into `secret:`. */
+export declare function literalSecretUri(hex: string): string;
+/** Strip a `literal:` prefix; returns the URI unchanged if not literal. */
+export declare function unwrapLiteralSecret(uri: string): {
+    literal: boolean;
+    value: string;
+};
+/** Canonical `http://localhost:<port>/webhook/<id>` URL — daemon route. */
+export declare function webhookUrl(id: string, port: number): string;
+export declare function readWebhooksFile(path: string): Promise<SubscriptionRecord[]>;
+/**
+ * Atomic write — delegates to `writeKeyedYamlList` (T-SIC L9 byte-preserves
+ * the `subscriptions: []\n` empty form). Callers MUST pass the FULL
+ * desired subscription set; we never merge here because partial writes
+ * risk dropping unrelated subscriptions on concurrent CLI invocations.
+ */
+export declare function writeWebhooksFile(path: string, subscriptions: readonly SubscriptionRecord[]): Promise<void>;
+//# sourceMappingURL=webhooks_state.d.ts.map

package/dist/setup/cli/webhooks_state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks_state.d.ts","sourceRoot":"","sources":["../../../src/setup/cli/webhooks_state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AASH,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf;0EACsE;IACtE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACrD,UAAU,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAA;KAAE,CAAC;IAC7D,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,mBAAmB,QAAO,MAAiD,CAAC;AAEzF,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,QAAO,MAAc,CAAC;AAErD,2EAA2E;AAC3E,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAGpF;AAED,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3D;AAKD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAOlF;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,SAAS,kBAAkB,EAAE,GAC3C,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/setup/cli/webhooks_state.js

@@ -0,0 +1,73 @@
+/**
+ * Webhook subscription persistence helpers for CLI.3.
+ *
+ * Split out of `webhooks.ts` (file-size budget). Three concerns:
+ *
+ *   1. `readWebhooksFile` / `writeWebhooksFile` — load + atomically rewrite
+ *      `~/.opensquid/webhooks.yaml`. Schema mirrors the SCHED.1 runtime
+ *      loader (`src/runtime/webhook_subscriptions.ts`) so anything the CLI
+ *      writes is consumable by the daemon without a second migration step.
+ *      Atomic write via `tmp + rename` (now delegated to `state_io.ts`).
+ *   2. `genSecret` — `crypto.randomBytes(32).toString('hex')` returning the
+ *      64-char lowercase hex string used for HMAC-SHA256 signing keys. The
+ *      caller embeds it via a `literal:<hex>` URI so the runtime's secret
+ *      resolver (post-`literalBackend()` registration) reads it back.
+ *   3. `defaultWebhooksPath` / `defaultWebhookPort` — `~/.opensquid/
+ *      webhooks.yaml` + `8765` matching `DEFAULT_WEBHOOK_PORT` in
+ *      `src/runtime/daemon.ts`.
+ *
+ * Secret-handling discipline (audit-critical):
+ *
+ *   We DO NOT use the runtime `SecretResolver` here. The CLI is the
+ *   authoritative writer of inline-literal subscriptions; introducing
+ *   resolver indirection in the CLI write path would couple the CLI to
+ *   the resolver's env-var / 1Password backends and break the locked
+ *   "write new secret to webhooks.yaml BEFORE invalidating old" atomic
+ *   rotation contract. The `secret:` field is stored as the URI
+ *   `literal:<64-hex>` directly — readers (CLI + daemon) get the hex by
+ *   either stripping the `literal:` prefix (CLI) or routing through the
+ *   resolver with `literalBackend()` registered (daemon, configured at
+ *   setup time outside this task's scope).
+ *
+ * Imports from: node:crypto, ../../runtime/paths, ./state_io.
+ * Imported by: src/setup/cli/webhooks.ts + src/setup/cli/webhooks_actions.ts.
+ */
+import { randomBytes } from 'node:crypto';
+import { join } from 'node:path';
+import { OPENSQUID_HOME } from '../../runtime/paths.js';
+import { readKeyedYamlList, writeKeyedYamlList } from './state_io.js';
+export const defaultWebhooksPath = () => join(OPENSQUID_HOME(), 'webhooks.yaml');
+/** Mirrors `DEFAULT_WEBHOOK_PORT` in `src/runtime/daemon.ts`. */
+export const defaultWebhookPort = () => 8765;
+/** Generate a 64-char lowercase hex HMAC-SHA256 signing key (32 bytes). */
+export function genSecret() {
+    return randomBytes(32).toString('hex');
+}
+/** Compose the `literal:` URI the CLI persists into `secret:`. */
+export function literalSecretUri(hex) {
+    return `literal:${hex}`;
+}
+/** Strip a `literal:` prefix; returns the URI unchanged if not literal. */
+export function unwrapLiteralSecret(uri) {
+    if (uri.startsWith('literal:'))
+        return { literal: true, value: uri.slice('literal:'.length) };
+    return { literal: false, value: uri };
+}
+/** Canonical `http://localhost:<port>/webhook/<id>` URL — daemon route. */
+export function webhookUrl(id, port) {
+    return `http://localhost:${String(port)}/webhook/${id}`;
+}
+const isSubscriptionRecord = (v) => typeof v === 'object' && v !== null;
+export async function readWebhooksFile(path) {
+    return readKeyedYamlList(path, 'subscriptions', 'webhooks.yaml', isSubscriptionRecord);
+}
+/**
+ * Atomic write — delegates to `writeKeyedYamlList` (T-SIC L9 byte-preserves
+ * the `subscriptions: []\n` empty form). Callers MUST pass the FULL
+ * desired subscription set; we never merge here because partial writes
+ * risk dropping unrelated subscriptions on concurrent CLI invocations.
+ */
+export async function writeWebhooksFile(path, subscriptions) {
+    return writeKeyedYamlList(path, 'subscriptions', subscriptions);
+}
+//# sourceMappingURL=webhooks_state.js.map

package/dist/setup/cli/webhooks_state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks_state.js","sourceRoot":"","sources":["../../../src/setup/cli/webhooks_state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAsBtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,eAAe,CAAC,CAAC;AAEzF,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC;AAErD,2EAA2E;AAC3E,MAAM,UAAU,SAAS;IACvB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,WAAW,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,EAAU,EAAE,IAAY;IACjD,OAAO,oBAAoB,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAU,EAA2B,EAAE,CACnE,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,OAAO,iBAAiB,CACtB,IAAI,EACJ,eAAe,EACf,eAAe,EACf,oBAAoB,CACrB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,aAA4C;IAE5C,OAAO,kBAAkB,CAAC,IAAI,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;AAClE,CAAC"}

package/dist/setup/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Setup: first-run wizard, pack inspector, validation report, and the
+ * channel/model/secrets configuration UI surface.
+ *
+ * Imports from: anything in src/ (top of the dependency tree alongside mcp/).
+ * Imported by: nothing in src/.
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/setup/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/setup/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC"}

package/dist/setup/index.js

@@ -0,0 +1,9 @@
+/**
+ * Setup: first-run wizard, pack inspector, validation report, and the
+ * channel/model/secrets configuration UI surface.
+ *
+ * Imports from: anything in src/ (top of the dependency tree alongside mcp/).
+ * Imported by: nothing in src/.
+ */
+export {};
+//# sourceMappingURL=index.js.map

package/dist/setup/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/setup/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC"}

package/dist/setup/migrate/auto_memory_importer.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Orchestrates the auto-memory → opensquid sync (G.6 + MAU.1).
+ *
+ * Reads every `*.md` (minus `MEMORY.md`, the index) in a source directory,
+ * parses each via the reader, and reconciles it against the libSQL MemoryStore
+ * (retire-Rust RES-5b — engine-free):
+ *   - name not present              → `store.create`  (imported)
+ *   - name present, content changed → `store.update`  (refreshed)
+ *   - name present, content same    → no-op           (skipped)
+ *
+ * Identity: the auto-memory file's frontmatter `name` field. Engine
+ * `MemoryListRow` has no `name` column, so the slug round-trips through
+ * `origin.host` via the `IMPORT_HOST_PREFIX` marker. `fetchExistingImportIndex`
+ * pages `memory.list` once and returns a `name → { id }` map; the caller passes
+ * it in via `opts.existingIndex` so iteration is purely local.
+ *
+ * Refresh detection (MAU.1): `MemoryListRow` carries no `content`, and
+ * `memoryUpdate` cannot write `origin` — so a content hash stashed in
+ * `origin.host` would go stale after an update and re-trigger forever. Instead,
+ * for an existing entry we `memoryGet({ id })` (returns the FULL body) and
+ * compare against the file body; equal → skip, differ → update. After an update
+ * the stored content matches the file, so the next run no-ops (self-terminating).
+ * `dryRun` performs NO engine reads or writes — it reports existing entries as
+ * `skipped` (a coarse preview; refresh detection needs a live read).
+ *
+ * Scope mapping (Phase-2 lock): feedback / user / reference → user-scope;
+ * project → project-scope. All imports tagged `authored_by: 'user'`
+ * (auto-memory is by definition user-authored → eviction-immune).
+ *
+ * `fileWhitelist` is the G.7 hook hand-off: when set, only basenames in the
+ * list are candidates. Undefined → all `.md` files except `MEMORY.md`.
+ *
+ * Imports from: node:fs, node:path, ./memory_store_handle.js, ./auto_memory_reader.js.
+ * Imported by: setup/cli/memory.ts, auto_memory_snapshot.ts, auto_memory_importer.test.ts.
+ */
+import { type MemoryStore } from './memory_store_handle.js';
+/** Marker that lets us re-derive the auto-memory `name` slug from the engine row. */
+export declare const IMPORT_HOST_PREFIX = "opensquid-import:auto-memory:";
+/** An engine memory previously imported from auto-memory, keyed by name slug. */
+export interface ImportIndexEntry {
+    id: string;
+}
+export interface ImportResult {
+    imported: number;
+    refreshed: number;
+    skipped: number;
+    errors: {
+        path: string;
+        reason: string;
+    }[];
+}
+export interface ImportOpts {
+    dryRun: boolean;
+    /** Pre-fetched `name → { id }` map of auto-memory entries already in the engine. */
+    existingIndex: Map<string, ImportIndexEntry>;
+    /** G.7 snapshot hook hand-off; undefined → all .md files except MEMORY.md. */
+    fileWhitelist?: string[];
+    /**
+     * Resolved umbrella namespace for `project`-scoped imports (T-memory-scope-isolation). The CALLER
+     * resolves it from the project cwd the auto-memory dir was derived from (NOT the importer's process
+     * cwd — every file in this `dir` belongs to that one project, so one namespace is correct). Undefined
+     * ⇒ project-scoped imports get a null namespace (recallable only with no project context).
+     */
+    namespace?: string | null;
+}
+export declare function importAutoMemoryDir(dir: string, store: MemoryStore, opts: ImportOpts): Promise<ImportResult>;
+/**
+ * Returns a `name → { id }` map of auto-memory entries already in the store, via
+ * `store.listImportIndex()` (which pages the libSQL memory rows + extracts the slug from the
+ * `origin:import:` marker tag). Non-import rows (no marker) are ignored.
+ *
+ * The caller passes the map to `importAutoMemoryDir` (so iteration is local) and to
+ * `pruneOrphanedImports` (MAU.2). The `{ id }` lets the importer `store.get` / `store.update` the
+ * right row on refresh.
+ */
+export declare function fetchExistingImportIndex(store: MemoryStore): Promise<Map<string, ImportIndexEntry>>;
+/**
+ * Deletion propagation (MAU.2): remove engine memories whose auto-memory source
+ * file no longer exists, so the derived recall index reflects the source.
+ *
+ * Marker-guarded: only entries in `existingIndex` (i.e. carrying the
+ * `IMPORT_HOST_PREFIX` marker) are deletion candidates — engine-native and
+ * user-`memorize`d entries are never in that map, so they are structurally
+ * unreachable here. `force: true` because import entries are tagged
+ * `authored_by: 'user'` (eviction-immune); the marker + an absent source is the
+ * authority, and pruning a derived copy does not evict a hand-authored lesson.
+ *
+ * Safety net for the on-disk set: an entry is kept if its name matches EITHER a
+ * file's frontmatter `name` (authoritative; handles name != basename) OR a
+ * file's basename. The basename fallback means a transiently-malformed file
+ * (which `readAutoMemory` would throw on) still protects its engine copy from
+ * being orphaned by a parse error.
+ *
+ * `dryRun` counts candidates without deleting.
+ */
+export declare function pruneOrphanedImports(dir: string, store: MemoryStore, existingIndex: Map<string, ImportIndexEntry>, opts: {
+    dryRun: boolean;
+}): Promise<{
+    pruned: number;
+}>;
+//# sourceMappingURL=auto_memory_importer.d.ts.map

package/dist/setup/migrate/auto_memory_importer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto_memory_importer.d.ts","sourceRoot":"","sources":["../../../src/setup/migrate/auto_memory_importer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAKH,OAAO,EAAU,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAUpE,qFAAqF;AACrF,eAAO,MAAM,kBAAkB,kCAAkC,CAAC;AAElE,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,oFAAoF;IACpF,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,YAAY,CAAC,CA0DvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAGxC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,WAAW,EAClB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5C,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACxB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB7B"}