pinecall 0.1.0

package/dist/cli/config.js

@@ -0,0 +1,94 @@
+/** `pinecall config` and `pinecall use`: the gateways this machine knows, and which one is in hand. */
+import { activate, activeName, forget, readConfig } from "./profiles.js";
+const USAGE = `usage: pinecall config              the gateways this machine knows
+       pinecall config rm <name>    forget one
+       pinecall use <profile>       the one the next verb goes to`;
+export const group = {
+    purpose: "the gateways this machine knows, and which one the next verb goes to",
+    usage: `${USAGE}
+
+  One file — ~/.pinecall/config.json — holds them, and \`pinecall login\` writes one per gateway
+  you sign in to. Nothing is exported, and there is no order of precedence to remember: the
+  profile with the ▸ is the one every verb uses until \`pinecall use\` moves it.
+
+  It prints no key. What a listing may say about one is that it is there, and its fingerprint is
+  the Keys screen's business — not a prefix, not a hint. The org and the world beside each name
+  are what \`whoami\` last said, kept as a label so this list reads without a network.
+
+  \`config rm\` takes a row out — a gateway that has moved, a key that was revoked. It forgets the
+  row here and nothing else: the key itself is stopped from the Keys screen, and a row left behind
+  is a key somebody will trust tomorrow and a refusal they will read as the gateway's fault.`,
+    run,
+};
+/** `config` with nothing after it prints them all; `use <name>` moves the mark. */
+export async function run(argv, how = {}) {
+    const out = how.out ?? process.stdout;
+    const err = how.err ?? process.stderr;
+    const [named, ...rest] = argv;
+    if (named === undefined)
+        return listed(out, how.home);
+    if (named === "rm")
+        return dropped(rest[0], out, err, how.home);
+    return chosen(named, out, err, how.home);
+}
+/** The same verb under the name a person reaches for: `pinecall use box`. */
+export async function use(argv, how = {}) {
+    const [named] = argv;
+    if (named === undefined) {
+        (how.err ?? process.stderr).write(`${USAGE}\n`);
+        return 2;
+    }
+    return await run(argv, how);
+}
+function listed(out, home) {
+    const config = readConfig(home);
+    const names = Object.keys(config.profiles).sort();
+    if (names.length === 0) {
+        out.write("no gateway yet: `pinecall login <url>`\n");
+        return 0;
+    }
+    const rows = names.map((name) => [
+        name === config.active ? `▸ ${name}` : `  ${name}`,
+        config.profiles[name].url,
+        said(config.profiles[name]),
+    ]);
+    for (const line of asColumns(rows))
+        out.write(`${line}\n`);
+    return 0;
+}
+function dropped(name, out, err, home) {
+    if (name === undefined) {
+        err.write(`${USAGE}\n`);
+        return 2;
+    }
+    if (forget(name, home)) {
+        out.write(`forgot ${name}\n`);
+        return 0;
+    }
+    return noSuchProfile(name, err, home);
+}
+function chosen(name, out, err, home) {
+    if (activate(name, home)) {
+        out.write(`▸ ${name}\n`);
+        return 0;
+    }
+    return noSuchProfile(name, err, home);
+}
+/** The one refusal both `use` and `rm` give, naming what this machine does know. */
+function noSuchProfile(name, err, home) {
+    const known = Object.keys(readConfig(home).profiles).sort();
+    const has = known.length === 0 ? "none yet: `pinecall login <url>`" : known.join(" · ");
+    err.write(`no profile called ${name}: ${has}\n`);
+    return 2;
+}
+/** Whose org and which world, as the gateway last said them. A label, never a check. */
+function said(profile) {
+    return [profile.org, profile.env].filter((word) => word !== undefined).join(" · ");
+}
+/** Every column as wide as its widest value: nothing is cut to make a table line up. */
+function asColumns(rows) {
+    const widths = rows[0].map((_, column) => Math.max(...rows.map((row) => (row[column] ?? "").length)));
+    return rows.map((row) => row.map((value, column) => (value ?? "").padEnd(widths[column])).join("  ").trimEnd());
+}
+export { activeName };
+//# sourceMappingURL=config.js.map

package/dist/cli/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAAA,uGAAuG;AAGvG,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAgB,MAAM,eAAe,CAAC;AAEvF,MAAM,KAAK,GAAG;;kEAEoD,CAAC;AAEnE,MAAM,CAAC,MAAM,KAAK,GAAU;IAC1B,OAAO,EAAE,sEAAsE;IAC/E,KAAK,EAAE,GAAG,KAAK;;;;;;;;;;;;6FAY4E;IAC3F,GAAG;CACJ,CAAC;AASF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAG,GAAY,EAAE;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IACtC,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAG,GAAY,EAAE;IACzD,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACrB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,GAA0B,EAAE,IAAwB;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE;QAClD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAE,CAAC,GAAG;QAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAE,CAAC;KAC7B,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,OAAO,CACd,IAAwB,EACxB,GAA0B,EAC1B,GAA0B,EAC1B,IAAwB;IAExB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CACb,IAAY,EACZ,GAA0B,EAC1B,GAA0B,EAC1B,IAAwB;IAExB,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,oFAAoF;AACpF,SAAS,aAAa,CAAC,IAAY,EAAE,GAA0B,EAAE,IAAwB;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxF,GAAG,CAAC,KAAK,CAAC,qBAAqB,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,wFAAwF;AACxF,SAAS,IAAI,CAAC,OAAgB;IAC5B,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrF,CAAC;AAED,wFAAwF;AACxF,SAAS,SAAS,CAAC,IAAgB;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvG,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AACnH,CAAC;AAED,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/cli/connected.d.ts

@@ -0,0 +1,30 @@
+/** The one line `pinecall run` prints when the socket is up: who registered, where, and as whom. */
+import type { RouteInput } from "../client/index.js";
+export interface Connected {
+    slug: string;
+    url: string;
+    tools: number;
+    doors: string[];
+    /** Whose org took it, and which of the two worlds. Absent when the gateway would not say. */
+    org?: string;
+    env?: string;
+    /** Which profile's key opened the door. Said because it is the thing that decides the two
+     * above, and because it used to be decided by whatever was exported in the shell. */
+    source?: string;
+}
+/**
+ * The one line `pinecall run` prints when the socket is up.
+ *
+ * It used to say the gateway and nothing else, and that cost an afternoon: a key exported in the
+ * shell wins over the one `pinecall login` just kept, so an agent could register into another org
+ * and another world with this line reading exactly the same. Where you are IS the key you hold,
+ * so the line says which key, whose org, and which world — the same four things `whoami` says.
+ *
+ * Three things a person needs and nothing this process had to invent: who registered, which
+ * gateway took it, and what the class declared. It names no page: the gateway serves none. An
+ * agent that declared no door prints no `doors` at all rather than an empty one.
+ */
+export declare function connectedLine(agent: Connected): string;
+/** Each door the class declared, as the line names it: the channel, and its number when it has one. */
+export declare function doorsOf(routes: RouteInput[] | undefined): string[];
+//# sourceMappingURL=connected.d.ts.map

package/dist/cli/connected.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected.d.ts","sourceRoot":"","sources":["../../src/cli/connected.ts"],"names":[],"mappings":"AAAA,oGAAoG;AAEpG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,6FAA6F;IAC7F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;yFACqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAStD;AAED,uGAAuG;AACvG,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAIlE"}

package/dist/cli/connected.js

@@ -0,0 +1,32 @@
+/** The one line `pinecall run` prints when the socket is up: who registered, where, and as whom. */
+/**
+ * The one line `pinecall run` prints when the socket is up.
+ *
+ * It used to say the gateway and nothing else, and that cost an afternoon: a key exported in the
+ * shell wins over the one `pinecall login` just kept, so an agent could register into another org
+ * and another world with this line reading exactly the same. Where you are IS the key you hold,
+ * so the line says which key, whose org, and which world — the same four things `whoami` says.
+ *
+ * Three things a person needs and nothing this process had to invent: who registered, which
+ * gateway took it, and what the class declared. It names no page: the gateway serves none. An
+ * agent that declared no door prints no `doors` at all rather than an empty one.
+ */
+export function connectedLine(agent) {
+    const said = [agent.slug];
+    if (agent.org !== undefined)
+        said.push(agent.org);
+    if (agent.env !== undefined)
+        said.push(agent.env);
+    said.push(`connected to ${agent.url}`);
+    if (agent.source !== undefined)
+        said.push(`key from ${agent.source}`);
+    said.push(`tools ${agent.tools}`);
+    if (agent.doors.length > 0)
+        said.push(`doors ${agent.doors.join(", ")}`);
+    return said.join(" · ");
+}
+/** Each door the class declared, as the line names it: the channel, and its number when it has one. */
+export function doorsOf(routes) {
+    return (routes ?? []).map((route) => route.number === null || route.number === undefined ? route.channel : `${route.channel} ${route.number}`);
+}
+//# sourceMappingURL=connected.js.map

package/dist/cli/connected.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected.js","sourceRoot":"","sources":["../../src/cli/connected.ts"],"names":[],"mappings":"AAAA,oGAAoG;AAiBpG;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,KAAgB;IAC5C,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,OAAO,CAAC,MAAgC;IACtD,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAClC,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,CACzG,CAAC;AACJ,CAAC"}

package/dist/cli/credentials.d.ts

@@ -0,0 +1,41 @@
+/** ~/.pinecall: the keys this machine keeps — the gateways it logged in to, and the local one. */
+/** The directory both files live in: ~/.pinecall, or the one PINECALL_HOME names instead. */
+export declare function pinecallHome(env?: NodeJS.ProcessEnv): string;
+/** One gateway this machine has logged in to: the key, the org it opened, and when it was kept. */
+export interface GatewayEntry {
+    api_key: string;
+    org: string;
+    logged_in_at: string;
+    /** The phone this person calls FROM, so a ring in the sandbox reaches their own agent rather
+     * than whoever holds the line. Said once with `pinecall line from`, and re-sent by every
+     * `pinecall run` — the gateway keeps it beside its live table, not in a row. */
+    calling?: string;
+}
+/**
+ * The credentials file as it is on disk.
+ *
+ * `api_key` is v1's own field — one key, no URL — and it is still read by the v1 CLI on this same
+ * machine. Nothing here writes over it: a login adds a row under `gateways` and leaves the rest of
+ * the file exactly as it found it.
+ */
+export interface Credentials {
+    api_key?: string;
+    gateways: Record<string, GatewayEntry>;
+}
+/** The whole file. A missing one, an unreadable one and a broken one are all an empty table. */
+export declare function readCredentials(home?: string): Credentials;
+/** One gateway's row, by the URL as `normalised` writes it. Nothing logged in is nothing here. */
+export declare function gatewayFor(url: string, home?: string): GatewayEntry | undefined;
+/** Keep one gateway's key, the rest of the file untouched, and the file readable by nobody else. */
+export declare function writeGateway(url: string, entry: Omit<GatewayEntry, "logged_in_at">, home?: string): void;
+/**
+ * Remember which phone this person calls from, on the row for this gateway.
+ *
+ * A row only, never a login: `line from` is said by somebody already logged in, and rewriting the
+ * key here would be a second place that decides what the key is. Nothing happens for a gateway
+ * with no row — you cannot say which phone is yours at a gateway you have not signed in to.
+ */
+export declare function writeCalling(url: string, calling: string | undefined, home?: string): boolean;
+/** The URL as a key in the table: lowercase scheme and host, and no trailing slash. */
+export declare function normalised(url: string): string;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/cli/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/cli/credentials.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAgBlG,6FAA6F;AAC7F,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEzE;AAED,mGAAmG;AACnG,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB;;oFAEgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACxC;AAED,gGAAgG;AAChG,wBAAgB,eAAe,CAAC,IAAI,GAAE,MAAuB,GAAG,WAAW,CAO1E;AAED,kGAAkG;AAClG,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,MAAuB,GAAG,YAAY,GAAG,SAAS,CAE/F;AAED,oGAAoG;AACpG,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EACzC,IAAI,GAAE,MAAuB,GAC5B,IAAI,CASN;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,GAAE,MAAuB,GAAG,OAAO,CAW7G;AAED,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAO9C"}

package/dist/cli/credentials.js

@@ -0,0 +1,98 @@
+/** ~/.pinecall: the keys this machine keeps — the gateways it logged in to, and the local one. */
+import { chmodSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { homedir, userInfo } from "node:os";
+import { join } from "node:path";
+// The directory is a person's, not a machine's: 0700 so another account on the same box cannot
+// list it, and 0600 on every file so it cannot read one whose name it guessed.
+const DIRECTORY_MODE = 0o700;
+const FILE_MODE = 0o600;
+// Every bit outside the owner's. A file that has one of them is readable by somebody else, and a
+// key somebody else can read is not a key we are willing to send anywhere.
+const OTHERS = 0o077;
+const CREDENTIALS = "credentials";
+/** The directory both files live in: ~/.pinecall, or the one PINECALL_HOME names instead. */
+export function pinecallHome(env = process.env) {
+    return env["PINECALL_HOME"] ?? join(homedir(), ".pinecall");
+}
+/** The whole file. A missing one, an unreadable one and a broken one are all an empty table. */
+export function readCredentials(home = pinecallHome()) {
+    const read = parsed(join(home, CREDENTIALS));
+    if (read === undefined)
+        return { gateways: {} };
+    const gateways = read["gateways"];
+    const kept = { gateways: isTable(gateways) ? gateways : {} };
+    if (typeof read["api_key"] === "string")
+        kept.api_key = read["api_key"];
+    return kept;
+}
+/** One gateway's row, by the URL as `normalised` writes it. Nothing logged in is nothing here. */
+export function gatewayFor(url, home = pinecallHome()) {
+    return readCredentials(home).gateways[normalised(url)];
+}
+/** Keep one gateway's key, the rest of the file untouched, and the file readable by nobody else. */
+export function writeGateway(url, entry, home = pinecallHome()) {
+    const kept = readCredentials(home);
+    kept.gateways[normalised(url)] = { ...entry, logged_in_at: new Date().toISOString() };
+    mkdirSync(home, { recursive: true, mode: DIRECTORY_MODE });
+    const path = join(home, CREDENTIALS);
+    writeFileSync(path, `${JSON.stringify(kept, null, 2)}\n`, { mode: FILE_MODE });
+    // writeFileSync's mode applies only when it creates the file, so a file that was already there
+    // keeps whatever mode it had — including one an editor widened.
+    chmodSync(path, FILE_MODE);
+}
+/**
+ * Remember which phone this person calls from, on the row for this gateway.
+ *
+ * A row only, never a login: `line from` is said by somebody already logged in, and rewriting the
+ * key here would be a second place that decides what the key is. Nothing happens for a gateway
+ * with no row — you cannot say which phone is yours at a gateway you have not signed in to.
+ */
+export function writeCalling(url, calling, home = pinecallHome()) {
+    const kept = readCredentials(home);
+    const row = kept.gateways[normalised(url)];
+    if (row === undefined)
+        return false;
+    kept.gateways[normalised(url)] = { ...row, ...(calling === undefined ? {} : { calling }) };
+    if (calling === undefined)
+        delete kept.gateways[normalised(url)]?.calling;
+    mkdirSync(home, { recursive: true, mode: DIRECTORY_MODE });
+    const path = join(home, CREDENTIALS);
+    writeFileSync(path, `${JSON.stringify(kept, null, 2)}\n`, { mode: FILE_MODE });
+    chmodSync(path, FILE_MODE);
+    return true;
+}
+/** The URL as a key in the table: lowercase scheme and host, and no trailing slash. */
+export function normalised(url) {
+    try {
+        const parsedUrl = new URL(url);
+        return `${parsedUrl.origin}${parsedUrl.pathname}`.replace(/\/+$/, "");
+    }
+    catch {
+        return url.replace(/\/+$/, "");
+    }
+}
+// One JSON object off disk, or nothing: a file that is not there, cannot be read or does not parse
+// are the same answer to every caller here, and none of them is worth an exception.
+function parsed(path) {
+    try {
+        const read = JSON.parse(readFileSync(path, "utf8"));
+        return isTable(read) ? read : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+// Owned by this account and readable by nobody else.
+function ours(path) {
+    try {
+        const about = statSync(path);
+        return about.uid === userInfo().uid && (about.mode & OTHERS) === 0;
+    }
+    catch {
+        return false;
+    }
+}
+function isTable(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/cli/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/cli/credentials.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAElG,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,+FAA+F;AAC/F,+EAA+E;AAC/E,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB,iGAAiG;AACjG,2EAA2E;AAC3E,MAAM,MAAM,GAAG,KAAK,CAAC;AAErB,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC/D,OAAO,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAC9D,CAAC;AAyBD,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,IAAI,GAAW,YAAY,EAAE;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,IAAI,GAAgB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,QAAyC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5G,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ;QAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,IAAI,GAAW,YAAY,EAAE;IACnE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,KAAyC,EACzC,IAAI,GAAW,YAAY,EAAE;IAE7B,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACtF,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/E,+FAA+F;IAC/F,gEAAgE;IAChE,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAA2B,EAAE,IAAI,GAAW,YAAY,EAAE;IAClG,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC3F,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC;IAC1E,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/E,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,oFAAoF;AACpF,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,SAAS,IAAI,CAAC,IAAY;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/cli/ear.d.ts

@@ -0,0 +1,3 @@
+/** The ear as its own process: one room joined, both tracks mixed, raw PCM out on fd 3, nothing else said. */
+export {};
+//# sourceMappingURL=ear.d.ts.map

package/dist/cli/ear.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ear.d.ts","sourceRoot":"","sources":["../../src/cli/ear.ts"],"names":[],"mappings":"AAAA,8GAA8G"}

package/dist/cli/ear.js

@@ -0,0 +1,59 @@
+/** The ear as its own process: one room joined, both tracks mixed, raw PCM out on fd 3, nothing else said. */
+import { writeSync } from "node:fs";
+import { AudioMixer, AudioStream, Room, RoomEvent, TrackKind } from "@livekit/rtc-node";
+// This file is a PROGRAM, started by cli/listening.ts and by nothing else. It exists because the
+// room library is a native build with a logger that writes to the file descriptor, at debug, and
+// is exported nowhere: kept in its own process, its three hundred lines of chatter go to a stdout
+// nobody reads, its threads cannot hold the CLI open after the call, and the CLI's own environment
+// is never touched to quiet it. The contract is small: the rate and the channel count on argv,
+// one JSON line on stdin — `{server_url, participant_token}` — and int16 frames on fd 3 until
+// stdin closes, which is the parent saying leave.
+const PCM = 3;
+/** One line of stdin: the seat. It stays open afterwards, because its closing is the way out. */
+function theSeat() {
+    return new Promise((answer) => {
+        let read = "";
+        const take = (chunk) => {
+            read += chunk.toString();
+            const line = read.indexOf("\n");
+            if (line === -1)
+                return;
+            process.stdin.off("data", take);
+            answer(JSON.parse(read.slice(0, line)));
+        };
+        process.stdin.on("data", take);
+    });
+}
+async function listen() {
+    const [rate, channels] = process.argv.slice(2).map(Number);
+    if (rate === undefined || channels === undefined)
+        throw new Error("usage: ear <rate> <channels>");
+    const seat = await theSeat();
+    const room = new Room();
+    const mixer = new AudioMixer(rate, channels);
+    // Both sides of the call are one stream: the caller's track and the agent's, mixed, so the
+    // speakers hear the conversation and not whichever track arrived first.
+    room.on(RoomEvent.TrackSubscribed, (track) => {
+        if (track.kind === TrackKind.KIND_AUDIO)
+            mixer.addStream(new AudioStream(track, rate, channels));
+    });
+    const leaving = new Promise((left) => {
+        process.stdin.once("end", () => left());
+        process.stdin.once("close", () => left());
+        room.on(RoomEvent.Disconnected, () => left());
+    });
+    await room.connect(seat.server_url, seat.participant_token, { autoSubscribe: true, dynacast: false });
+    void leaving.then(async () => {
+        await mixer.aclose();
+        await room.disconnect();
+        process.exit(0);
+    });
+    for await (const frame of mixer) {
+        writeSync(PCM, Buffer.from(frame.data.buffer, frame.data.byteOffset, frame.data.byteLength));
+    }
+}
+listen().catch((failed) => {
+    process.stderr.write(`${failed instanceof Error ? failed.message : String(failed)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=ear.js.map

package/dist/cli/ear.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ear.js","sourceRoot":"","sources":["../../src/cli/ear.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAE9G,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAExF,iGAAiG;AACjG,iGAAiG;AACjG,kGAAkG;AAClG,mGAAmG;AACnG,+FAA+F;AAC/F,8FAA8F;AAC9F,kDAAkD;AAClD,MAAM,GAAG,GAAG,CAAC,CAAC;AAEd,iGAAiG;AACjG,SAAS,OAAO;IACd,OAAO,IAAI,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,CAAC,KAAa,EAAQ,EAAE;YACnC,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,IAAI,KAAK,CAAC,CAAC;gBAAE,OAAO;YACxB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAsD,CAAC,CAAC;QAC/F,CAAC,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,2FAA2F;IAC3F,wEAAwE;IACxE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE;QAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,UAAU;YAAE,KAAK,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,EAAE;QACzC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACtG,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QAC3B,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAChC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,MAAe,EAAE,EAAE;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/cli/env.d.ts

@@ -0,0 +1,40 @@
+/** Where the CLI is pointed and what opens the door: the one place that decides both, for every verb. */
+/** The gateway a developer runs on their own machine, which is where `pinecall run` starts. */
+export declare const DEFAULT_URL = "http://localhost:8080";
+/** Pinecall's own cloud: where `pinecall signup` makes an org when no other gateway is named. */
+export declare const CLOUD_URL = "https://box.pinecall.io";
+/** Where the key came from, so a verb can say it and a person can check it without grepping. */
+export type Source = "profile" | "none";
+/** What the resolution found: the gateway, the key if there is one, and where the key came from. */
+export interface Found {
+    url: string;
+    apiKey: string | undefined;
+    source: Source;
+}
+/** A gateway with the key in hand: what a verb holds after `theDoor` answered. */
+export interface Open {
+    url: string;
+    apiKey: string;
+    source: Source;
+}
+/**
+ * Which gateway and which key: one profile, and there is nothing else.
+ *
+ * There used to be four files and three variables answering these two questions, in an order
+ * nobody was ever told — and the one that won was the one you had not chosen. `pinecall login`
+ * kept a key, an export from another project beat it, and a verb registered into another org in
+ * another world with every line reading exactly the same.
+ *
+ * Now: the profile `--profile` names, or the active one. `pinecall config` prints which. A
+ * machine with no browser writes one off stdin — `pinecall login --key-stdin` — so a key is never
+ * in an environment every child process and every `ps` can read. `PINECALL_HOME` says where the
+ * file is, and that is the only variable this file knows about.
+ */
+export declare function doorFrom(env?: NodeJS.ProcessEnv, home?: string, profile?: string | undefined): Found;
+/** The gateway a verb knocks at, or nothing once it has said why it cannot: every verb's first act. */
+export declare function theDoor(env?: NodeJS.ProcessEnv, err?: NodeJS.WritableStream): Open | undefined;
+/** What to say when this machine knows no gateway: the verb that fixes it, and CI's way in. */
+export declare function noKey(url: string): string;
+/** The first line a verb that connects prints: which gateway, and where its key was found. */
+export declare function doorLine(door: Open): string;
+//# sourceMappingURL=env.d.ts.map

package/dist/cli/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/cli/env.ts"],"names":[],"mappings":"AAAA,yGAAyG;AAKzG,+FAA+F;AAC/F,eAAO,MAAM,WAAW,0BAA0B,CAAC;AAEnD,iGAAiG;AACjG,eAAO,MAAM,SAAS,4BAA4B,CAAC;AAEnD,gGAAgG;AAChG,MAAM,MAAM,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;AAExC,oGAAoG;AACpG,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,IAAI;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,QAAQ,CACtB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE,MAA0B,EAChC,OAAO,GAAE,MAAM,GAAG,SAA8B,GAC/C,KAAK,CAIP;AAED,uGAAuG;AACvG,wBAAgB,OAAO,CACrB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,GAAG,GAAE,MAAM,CAAC,cAA+B,GAC1C,IAAI,GAAG,SAAS,CAOlB;AAED,+FAA+F;AAC/F,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKzC;AAED,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAE3C"}

package/dist/cli/env.js

@@ -0,0 +1,45 @@
+/** Where the CLI is pointed and what opens the door: the one place that decides both, for every verb. */
+import { pinecallHome } from "./credentials.js";
+import { profileFor, theChosenProfile } from "./profiles.js";
+/** The gateway a developer runs on their own machine, which is where `pinecall run` starts. */
+export const DEFAULT_URL = "http://localhost:8080";
+/** Pinecall's own cloud: where `pinecall signup` makes an org when no other gateway is named. */
+export const CLOUD_URL = "https://box.pinecall.io";
+/**
+ * Which gateway and which key: one profile, and there is nothing else.
+ *
+ * There used to be four files and three variables answering these two questions, in an order
+ * nobody was ever told — and the one that won was the one you had not chosen. `pinecall login`
+ * kept a key, an export from another project beat it, and a verb registered into another org in
+ * another world with every line reading exactly the same.
+ *
+ * Now: the profile `--profile` names, or the active one. `pinecall config` prints which. A
+ * machine with no browser writes one off stdin — `pinecall login --key-stdin` — so a key is never
+ * in an environment every child process and every `ps` can read. `PINECALL_HOME` says where the
+ * file is, and that is the only variable this file knows about.
+ */
+export function doorFrom(env = process.env, home = pinecallHome(env), profile = theChosenProfile()) {
+    const chosen = profileFor(profile, home);
+    if (chosen === undefined)
+        return { url: DEFAULT_URL, apiKey: undefined, source: "none" };
+    return { url: chosen.url, apiKey: chosen.key, source: "profile" };
+}
+/** The gateway a verb knocks at, or nothing once it has said why it cannot: every verb's first act. */
+export function theDoor(env = process.env, err = process.stderr) {
+    const found = doorFrom(env);
+    if (found.apiKey === undefined) {
+        err.write(`${noKey(found.url)}\n`);
+        return undefined;
+    }
+    return { url: found.url, apiKey: found.apiKey, source: found.source };
+}
+/** What to say when this machine knows no gateway: the verb that fixes it, and CI's way in. */
+export function noKey(url) {
+    return (`no gateway: \`pinecall login ${url}\`, or \`pinecall use <profile>\` for one already kept`
+        + " (`pinecall config` lists them)");
+}
+/** The first line a verb that connects prints: which gateway, and where its key was found. */
+export function doorLine(door) {
+    return `gateway ${door.url} · key from ${door.source}`;
+}
+//# sourceMappingURL=env.js.map

package/dist/cli/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/cli/env.ts"],"names":[],"mappings":"AAAA,yGAAyG;AAEzG,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE7D,+FAA+F;AAC/F,MAAM,CAAC,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAEnD,iGAAiG;AACjG,MAAM,CAAC,MAAM,SAAS,GAAG,yBAAyB,CAAC;AAmBnD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,QAAQ,CACtB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,IAAI,GAAW,YAAY,CAAC,GAAG,CAAC,EAChC,OAAO,GAAuB,gBAAgB,EAAE;IAEhD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACzF,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACpE,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,OAAO,CACrB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,GAAG,GAA0B,OAAO,CAAC,MAAM;IAE3C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AACxE,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,KAAK,CAAC,GAAW;IAC/B,OAAO,CACL,gCAAgC,GAAG,wDAAwD;UACzF,iCAAiC,CACpC,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,QAAQ,CAAC,IAAU;IACjC,OAAO,WAAW,IAAI,CAAC,GAAG,eAAe,IAAI,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC"}

package/dist/cli/eval.d.ts

@@ -0,0 +1,37 @@
+/** `pinecall eval <call-id>`: ring 3 — one real call, re-evaluated by the runtime's code checks. */
+import type { Group } from "./groups.js";
+/** One check's answer, as `POST /v1/evals/replay/{call}` writes it: three strings, no nesting. */
+export interface Verdict {
+    check: string;
+    status: string;
+    detail: string;
+}
+/** What the door answers about one call: who it was, whether it holds, and the verdicts. */
+export interface Answer {
+    call: string;
+    agent: string;
+    passed: boolean;
+    verdicts: Verdict[];
+}
+/** The words a business will not have its agent say, and the latencies it holds a call to. */
+export interface Case {
+    banned?: string[];
+    budget?: Record<string, number>;
+}
+export declare const group: Group;
+/**
+ * The judgement runs in the runtime, which is where the log, the store and the judges are. This
+ * verb builds the case and prints the answer, so a person needs no Python to read a call.
+ */
+export declare function run(argv: string[], out?: NodeJS.WritableStream): Promise<number>;
+/**
+ * The four code checks over one call, asked of the gateway. `simulate --judge` asks it again after
+ * every turn, which is why the request lives here rather than inside this verb's own argument
+ * parsing: one door, one sentence when it refuses.
+ */
+export declare function replayed(base: string, apiKey: string, call: string, said: Case): Promise<Answer>;
+/** The door this verb knocks at: the gateway's HTTP address and the call, nothing in a query. */
+export declare function replayUrl(base: string, call: string): string;
+/** The case as a person reads it: the call on top, then a line per check, aligned by name. */
+export declare function linesOf(answer: Answer): string[];
+//# sourceMappingURL=eval.d.ts.map

package/dist/cli/eval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval.d.ts","sourceRoot":"","sources":["../../src/cli/eval.ts"],"names":[],"mappings":"AAAA,oGAAoG;AAMpG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,kGAAkG;AAClG,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4FAA4F;AAC5F,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,IAAI;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,eAAO,MAAM,KAAK,EAAE,KAanB,CAAC;AAEF;;;GAGG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,GAAE,MAAM,CAAC,cAA+B,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBtG;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAStG;AAED,iGAAiG;AACjG,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,8FAA8F;AAC9F,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAQhD"}

package/dist/cli/eval.js

@@ -0,0 +1,83 @@
+/** `pinecall eval <call-id>`: ring 3 — one real call, re-evaluated by the runtime's code checks. */
+import { readFile } from "node:fs/promises";
+import { parseArgs } from "node:util";
+import { theDoor } from "./env.js";
+export const group = {
+    purpose: "ring 3: one real call, re-evaluated",
+    usage: `usage: pinecall eval <call-id> [--policy policy.json] [--json]
+
+  One finished call rebuilt from its log and answered by the runtime's four CODE checks —
+  consent, register, errors, latency. Nothing is re-run and no model is asked; the verdicts are
+  the operator's vocabulary (passed · failed · deferred · skipped), never a judge's four words.
+  Exits 1 when a check did not hold.
+
+  --policy file   {"banned": ["…"], "budget": {"llm_ttft": 1.5}} — the words this business will
+                  not have its agent say, and the latencies it holds a call to
+  --json          the answer as the door wrote it`,
+    run,
+};
+/**
+ * The judgement runs in the runtime, which is where the log, the store and the judges are. This
+ * verb builds the case and prints the answer, so a person needs no Python to read a call.
+ */
+export async function run(argv, out = process.stdout) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        allowPositionals: true,
+        options: { json: { type: "boolean", default: false }, policy: { type: "string" } },
+    });
+    const call = positionals[0];
+    if (call === undefined) {
+        process.stderr.write("usage: pinecall eval <call-id> [--policy policy.json] [--json]\n");
+        return 2;
+    }
+    const door = theDoor();
+    if (door === undefined)
+        return 2;
+    let answer;
+    try {
+        answer = await replayed(door.url, door.apiKey, call, await theCase(values.policy));
+    }
+    catch (refused) {
+        process.stderr.write(`${refused instanceof Error ? refused.message : String(refused)}\n`);
+        return 1;
+    }
+    out.write(values.json === true ? `${JSON.stringify(answer)}\n` : `${linesOf(answer).join("\n")}\n`);
+    return answer.passed ? 0 : 1;
+}
+/**
+ * The four code checks over one call, asked of the gateway. `simulate --judge` asks it again after
+ * every turn, which is why the request lives here rather than inside this verb's own argument
+ * parsing: one door, one sentence when it refuses.
+ */
+export async function replayed(base, apiKey, call, said) {
+    const answered = await fetch(replayUrl(base, call), {
+        method: "POST",
+        headers: { authorization: `Bearer ${apiKey}`, "content-type": "application/json" },
+        body: JSON.stringify(said),
+    });
+    const body = await answered.text();
+    if (!answered.ok)
+        throw new Error(`the gateway answered ${answered.status}: ${body}`);
+    return JSON.parse(body);
+}
+/** The door this verb knocks at: the gateway's HTTP address and the call, nothing in a query. */
+export function replayUrl(base, call) {
+    return `${base.replace(/\/$/, "")}/v1/evals/replay/${encodeURIComponent(call)}`;
+}
+/** The case as a person reads it: the call on top, then a line per check, aligned by name. */
+export function linesOf(answer) {
+    const width = Math.max(...answer.verdicts.map((verdict) => verdict.check.length));
+    return [
+        `${answer.call}  ${answer.agent}`,
+        ...answer.verdicts.map((verdict) => `  ${verdict.check.padEnd(width)}  ${verdict.status.padEnd(8)}  ${verdict.detail}`),
+    ];
+}
+// The words and the budget are the business's, so they come out of a file the business keeps.
+// A generated `evals/policies` would be the same JSON; nothing here cares which wrote it.
+async function theCase(policy) {
+    if (policy === undefined)
+        return {};
+    return JSON.parse(await readFile(policy, "utf8"));
+}
+//# sourceMappingURL=eval.js.map

package/dist/cli/eval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval.js","sourceRoot":"","sources":["../../src/cli/eval.ts"],"names":[],"mappings":"AAAA,oGAAoG;AAEpG,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAwBnC,MAAM,CAAC,MAAM,KAAK,GAAU;IAC1B,OAAO,EAAE,qCAAqC;IAC9C,KAAK,EAAE;;;;;;;;;kDASyC;IAChD,GAAG;CACJ,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAG,GAA0B,OAAO,CAAC,MAAM;IACnF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,EAAE,IAAI;QACV,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;KACnF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACjC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1F,OAAO,CAAC,CAAC;IACX,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAc,EAAE,IAAY,EAAE,IAAU;IACnF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAClF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;AACpC,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY;IAClD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,OAAO,CAAC,MAAc;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,OAAO;QACL,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,EAAE;QACjC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CACpB,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAChG;KACF,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,0FAA0F;AAC1F,KAAK,UAAU,OAAO,CAAC,MAA0B;IAC/C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAS,CAAC;AAC5D,CAAC"}