pray-cli 1.6.0

package/CHANGELOG.md

@@ -0,0 +1,50 @@
+# CHANGELOG
+
+## Unreleased
+
+## 1.6.0 (2026-07-29)
+
+- Add `login` with passkey and ssh-agent modes; persist sessions in `.pray/session.json`.
+- Add `upgrade` via `npm install -g pray-cli@latest`.
+- Honor `update --major|--latest|--dry-run|--json`, `plan --remote`, and `outdated --remote`.
+- Implement `trust import-repo` and `trust import-registry` for local and http(s) sources.
+
+## 1.5.2 (2026-07-29)
+
+- Put the Prayfile positioning line into the npm package description for registry search.
+
+## 1.5.1 (2026-07-29)
+
+- Sync `PACKAGE_VERSION` with the package version and add `prepublishOnly` build for npm publish.
+- Rework package description and README opener to match Prayfile positioning.
+
+## 1.5.0 (2026-07-27)
+
+- Accept Gemfile-like Ruby surface sugar for Prayfile statements: `{…}` blocks, top-level `;`, and optional call parentheses.
+- Add parser coverage for symbol maps and surface forms alongside substitute tests.
+- Exercise the shared `testdata/shared` Prayfile corpus alongside Rust and Ruby.
+
+## 1.3.0 (2026-07-26)
+
+- Add destination DSL parsing: `compose`, `tree`, and `file:` blocks in `Prayfile` for scoped rendering and exact file bindings, matching `pray-core`.
+- Add role-based export selection (`fragment`, `folder`, `file`) so packages without an explicit `export:` resolve unambiguous exports automatically.
+- Add `format`/`fmt` command to rewrite a legacy `Prayfile` into the recommended destination DSL and normalize marker comments in rendered lockfile outputs.
+- Emit `pray` as the canonical package declaration keyword when formatting or editing manifests, while still accepting `use`, `include`, `agent`, and `package` on read for backward compatibility.
+
+## 1.1.0 (2026-07-14)
+
+- Add environment-aware rendering with `group` blocks and `--env` or `PRAY_ENV`.
+- Add global `--path` and `--file-path` flags with `PRAY_PATH`, `PRAY_FILE_PATH`, and project `.env` support.
+- Record the selected environment in `Prayfile.lock`.
+- Improve CLI help with grouped commands, per-command help, and suggestions for unknown commands.
+- Add `--no-input` to skip interactive prompts.
+- Honor `PRAY_NO_COLOR` and `NO_COLOR` for plain terminal output.
+- Refresh git distribution caches on install when a locked revision is missing locally.
+
+## 1.0.0 (2026-07-13)
+
+- Initial npm release of `pray-cli`.
+- Resolve local path packages and git distribution sources.
+- Publish to local distribution roots and serve over HTTP.
+- Install, update, render, verify, and drift workflows with `Prayfile.lock`.
+- Git distribution integration tests for install, locked revision, and update.

package/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 pray contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,69 @@
+# pray-cli
+
+TypeScript `pray` CLI and library for [Prayfile](https://pray.kisko.dev): a package manager for the language placed before inference.
+
+Resolve, lock, render, verify, publish, and serve shared instructions, policies, templates, and related input as versioned packages. The installed executable is `pray`.
+
+**Website:** [pray.kisko.dev](https://pray.kisko.dev)
+
+**Maintainer:** Andrei Makarov ([contact@kiskolabs.com](mailto:contact@kiskolabs.com))
+
+**Repository:** [kiskolabs/pray](https://github.com/kiskolabs/pray)
+
+**Community docs:** [CHANGELOG.md](CHANGELOG.md) · [LICENSE.md](LICENSE.md) · [SECURITY.md](SECURITY.md)
+
+## Install
+
+```sh
+npm install -g pray-cli
+```
+
+Or run without installing:
+
+```sh
+npx pray-cli install
+```
+
+## Usage
+
+From a project with a `Prayfile`:
+
+```sh
+pray manifest
+pray install
+pray verify --strict
+pray drift
+pray publish --root ./prayers
+pray serve --root ./prayers --port 7429
+```
+
+## Commands
+
+- `manifest`, `init`, `prayer init`, `repo init`
+- `add`, `remove`, `update`, `unlock`
+- `install`, `apply`, `plan`, `render`, `verify`, `drift`, `format`
+- `package`, `publish`, `serve`, `sync`, `vendor`, `clean`, `tree`
+- `list`, `outdated`, `explain`
+- `trust`, `confess`, `login`, `upgrade`
+
+## Development
+
+```sh
+cd npmjs/pray-cli
+npm install
+npm test
+npm run build
+node bin/pray.js version
+```
+
+## Requirements
+
+- Node.js 20+
+- `git` for git sources
+- `zstd` and `tar` for `.praypkg` archives
+
+## Status
+
+Registry HTTP(S), git sources, local publish/serve/sync, vendor/tree, login (passkey and ssh-agent), upgrade, update/plan/outdated remote flags, and trust import paths are implemented. SSH registry (`pray+ssh://`) and `serve --stdio` remain planned.
+
+See `SPEC.md` in the repository root for the normative specification.

package/SECURITY.md

@@ -0,0 +1,28 @@
+# SECURITY
+
+## Reporting a Vulnerability
+
+Do NOT open a public GitHub issue for security vulnerabilities.
+
+Email security details to: security@kiskolabs.com
+
+Include: description, steps to reproduce, potential impact, and suggested fix (if available).
+
+### Response Timeline
+
+- We will acknowledge receipt of your report
+- We will provide an initial assessment
+- We will keep you informed of our progress and resolution timeline
+
+### Disclosure Policy
+
+- We will work with you to understand and resolve the issue
+- We will credit you for the discovery (unless you prefer to remain anonymous)
+- We will publish a security advisory after the vulnerability is patched
+- We will coordinate public disclosure with you
+
+## Automation Security
+
+* Context Isolation: It is strictly forbidden to include production credentials, API keys, or Personally Identifiable Information (PII) in prompts sent to third-party LLMs or automation services.
+
+* Supply Chain: All automated dependencies must be verified.

package/bin/pray.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { runCli } from "../dist/cli/main.js";
+
+const exitCode = await runCli(process.argv.slice(2));
+process.exit(exitCode);

package/dist/archive/praypkg.d.ts

@@ -0,0 +1,6 @@
+import type { ResolvedPackage } from "../resolve/types.js";
+export declare function buildPackageArchiveBytes(packageEntry: ResolvedPackage): Buffer;
+export declare function unpackPraypkg(artifactBytes: Buffer, outputDirectory: string): void;
+export declare function packageArchivePath(packageName: string, version: string): string;
+export declare function writePackageArchive(packageEntry: ResolvedPackage, outputPath: string): void;
+//# sourceMappingURL=praypkg.d.ts.map

package/dist/archive/praypkg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"praypkg.d.ts","sourceRoot":"","sources":["../../src/archive/praypkg.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,eAAe,GAC5B,MAAM,CAuBR;AAED,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,GACtB,IAAI,CASN;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,MAAM,CAGR;AAED,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,eAAe,EAC7B,UAAU,EAAE,MAAM,GACjB,IAAI,CAIN"}

package/dist/archive/praypkg.js

@@ -0,0 +1,67 @@
+import { spawnSync } from "node:child_process";
+import { copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { PrayError } from "../errors.js";
+import { findPrayspecFile } from "../package-spec/index.js";
+export function buildPackageArchiveBytes(packageEntry) {
+    const prayspecPath = findPrayspecFile(packageEntry.root);
+    const staging = mkdtempSync(join(tmpdir(), "pray-package-"));
+    try {
+        writeFileSync(join(staging, "metadata.json"), packageMetadataJson(packageEntry), "utf8");
+        writeFileSync(join(staging, basename(prayspecPath)), readFileSync(prayspecPath));
+        for (const file of packageEntry.spec.files) {
+            const destination = join(staging, file);
+            mkdirSync(dirname(destination), { recursive: true });
+            copyFileSync(join(packageEntry.root, file), destination);
+        }
+        const tarBytes = runCommand("tar", ["-cf", "-", "-C", staging, "."]);
+        return runCommand("zstd", ["-q", "-c"], tarBytes);
+    }
+    finally {
+        rmSync(staging, { recursive: true, force: true });
+    }
+}
+export function unpackPraypkg(artifactBytes, outputDirectory) {
+    mkdirSync(outputDirectory, { recursive: true });
+    const tarBytes = runCommand("zstd", ["-d", "-q", "-c"], artifactBytes);
+    const result = spawnSync("tar", ["-xf", "-", "-C", outputDirectory], {
+        input: tarBytes,
+    });
+    if (result.status !== 0) {
+        throw PrayError.integrity("failed to unpack package archive");
+    }
+}
+export function packageArchivePath(packageName, version) {
+    const slug = packageName.replaceAll("/", "-");
+    return join(".pray", "packages", `${slug}-${version}.praypkg`);
+}
+export function writePackageArchive(packageEntry, outputPath) {
+    const bytes = buildPackageArchiveBytes(packageEntry);
+    mkdirSync(dirname(resolve(outputPath)), { recursive: true });
+    writeFileSync(outputPath, bytes);
+}
+function packageMetadataJson(packageEntry) {
+    return JSON.stringify({
+        name: packageEntry.spec.name,
+        version: packageEntry.spec.version,
+        tree_hash: packageEntry.treeHash,
+        exports: packageEntry.selectedExports,
+    });
+}
+function runCommand(program, argumentsList, input) {
+    const result = spawnSync(program, argumentsList, {
+        input,
+        encoding: "buffer",
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    if (result.error?.code === "ENOENT") {
+        throw PrayError.unsupported(`${program} is required to build or unpack package archives`);
+    }
+    if (result.status !== 0) {
+        const message = result.stderr?.toString("utf8").trim();
+        throw PrayError.integrity(message.length > 0 ? message : `${program} failed`);
+    }
+    return result.stdout;
+}
+//# sourceMappingURL=praypkg.js.map

package/dist/archive/praypkg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"praypkg.js","sourceRoot":"","sources":["../../src/archive/praypkg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACL,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG5D,MAAM,UAAU,wBAAwB,CACtC,YAA6B;IAE7B,MAAM,YAAY,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,aAAa,CACX,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAC9B,mBAAmB,CAAC,YAAY,CAAC,EACjC,MAAM,CACP,CAAC;QACF,aAAa,CACX,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,EACrC,YAAY,CAAC,YAAY,CAAC,CAC3B,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACrE,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,aAAqB,EACrB,eAAuB;IAEvB,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE;QACnE,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,SAAS,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,OAAe;IAEf,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,OAAO,UAAU,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,YAA6B,EAC7B,UAAkB;IAElB,MAAM,KAAK,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;IACrD,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB,CAAC,YAA6B;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI;QAC5B,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO;QAClC,SAAS,EAAE,YAAY,CAAC,QAAQ;QAChC,OAAO,EAAE,YAAY,CAAC,eAAe;KACtC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,OAAe,EACf,aAAuB,EACvB,KAAc;IAEd,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE;QAC/C,KAAK;QACL,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,IAAK,MAAM,CAAC,KAA2C,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3E,MAAM,SAAS,CAAC,WAAW,CACzB,GAAG,OAAO,kDAAkD,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,SAAS,CAAC,SAAS,CACvB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,SAAS,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAgB,CAAC;AACjC,CAAC"}

package/dist/auth/login.d.ts

@@ -0,0 +1,11 @@
+export interface LoginOptions {
+    servers: string[];
+    email: string;
+    credentialId?: string;
+    passkeyKey?: string;
+    publicKey?: string;
+    sshAgent: boolean;
+}
+export declare function parseLoginArguments(argumentsList: string[]): LoginOptions;
+export declare function runLoginCommand(argumentsList: string[], sessionRoot: string): Promise<void>;
+//# sourceMappingURL=login.d.ts.map

package/dist/auth/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,YAAY,CAwEzE;AAED,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EAAE,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/auth/login.js

@@ -0,0 +1,84 @@
+import { PrayError } from "../errors.js";
+import { loginWithPasskey } from "./passkey.js";
+import { loginWithSshAgent } from "./ssh-agent.js";
+export function parseLoginArguments(argumentsList) {
+    const servers = [];
+    let email;
+    let credentialId;
+    let passkeyKey;
+    let publicKey;
+    let sshAgent = false;
+    for (let index = 0; index < argumentsList.length; index += 1) {
+        const argument = argumentsList[index];
+        const next = () => {
+            const value = argumentsList[index + 1];
+            if (!value) {
+                throw PrayError.unsupported(`login requires a value after ${argument}`);
+            }
+            index += 1;
+            return value;
+        };
+        switch (argument) {
+            case "--server":
+                servers.push(next());
+                break;
+            case "--email":
+                email = next();
+                break;
+            case "--credential-id":
+                credentialId = next();
+                break;
+            case "--passkey-key":
+                passkeyKey = next();
+                break;
+            case "--public-key":
+                publicKey = next();
+                break;
+            case "--ssh-agent":
+                sshAgent = true;
+                break;
+            default:
+                if (argument.startsWith("--")) {
+                    throw PrayError.unsupported(`unknown login flag: ${argument}`);
+                }
+                throw PrayError.unsupported(`unexpected login argument: ${argument}`);
+        }
+    }
+    if (servers.length === 0) {
+        throw PrayError.unsupported("login requires at least one --server URL");
+    }
+    if (!email) {
+        throw PrayError.unsupported("login requires --email ADDRESS");
+    }
+    const passkeyMode = passkeyKey !== undefined;
+    if (passkeyMode === sshAgent || (!passkeyMode && !publicKey && !sshAgent)) {
+        throw PrayError.unsupported("login requires exactly one authentication mode");
+    }
+    if (passkeyMode && !credentialId) {
+        throw PrayError.unsupported("passkey login requires --credential-id");
+    }
+    if (sshAgent && !publicKey) {
+        throw PrayError.unsupported("ssh-agent login requires --public-key");
+    }
+    return {
+        servers,
+        email,
+        credentialId,
+        passkeyKey,
+        publicKey,
+        sshAgent,
+    };
+}
+export async function runLoginCommand(argumentsList, sessionRoot) {
+    const options = parseLoginArguments(argumentsList);
+    for (const server of options.servers) {
+        const session = options.passkeyKey
+            ? await loginWithPasskey(server, options.credentialId, options.passkeyKey, sessionRoot)
+            : await loginWithSshAgent(server, options.publicKey, sessionRoot);
+        if (session.email !== options.email) {
+            throw PrayError.resolution(`login completed for ${session.email} but ${options.email} was requested`);
+        }
+        process.stdout.write(`logged in as ${session.email} via ${session.kind} on ${server}\n`);
+    }
+}
+//# sourceMappingURL=login.js.map

package/dist/auth/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAWnD,MAAM,UAAU,mBAAmB,CAAC,aAAuB;IACzD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAyB,CAAC;IAC9B,IAAI,YAAgC,CAAC;IACrC,IAAI,UAA8B,CAAC;IACnC,IAAI,SAA6B,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAE,CAAC;QACvC,MAAM,IAAI,GAAG,GAAW,EAAE;YACxB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CAAC,WAAW,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,UAAU;gBACb,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrB,MAAM;YACR,KAAK,SAAS;gBACZ,KAAK,GAAG,IAAI,EAAE,CAAC;gBACf,MAAM;YACR,KAAK,iBAAiB;gBACpB,YAAY,GAAG,IAAI,EAAE,CAAC;gBACtB,MAAM;YACR,KAAK,eAAe;gBAClB,UAAU,GAAG,IAAI,EAAE,CAAC;gBACpB,MAAM;YACR,KAAK,cAAc;gBACjB,SAAS,GAAG,IAAI,EAAE,CAAC;gBACnB,MAAM;YACR,KAAK,aAAa;gBAChB,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM;YACR;gBACE,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,MAAM,SAAS,CAAC,WAAW,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,SAAS,CAAC,WAAW,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,SAAS,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,SAAS,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,WAAW,GAAG,UAAU,KAAK,SAAS,CAAC;IAC7C,IAAI,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1E,MAAM,SAAS,CAAC,WAAW,CACzB,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,SAAS,CAAC,WAAW,CAAC,wCAAwC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3B,MAAM,SAAS,CAAC,WAAW,CAAC,uCAAuC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACL,OAAO;QACP,KAAK;QACL,YAAY;QACZ,UAAU;QACV,SAAS;QACT,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAuB,EACvB,WAAmB;IAEnB,MAAM,OAAO,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU;YAChC,CAAC,CAAC,MAAM,gBAAgB,CACpB,MAAM,EACN,OAAO,CAAC,YAAa,EACrB,OAAO,CAAC,UAAU,EAClB,WAAW,CACZ;YACH,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAU,EAAE,WAAW,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YACpC,MAAM,SAAS,CAAC,UAAU,CACxB,uBAAuB,OAAO,CAAC,KAAK,QAAQ,OAAO,CAAC,KAAK,gBAAgB,CAC1E,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gBAAgB,OAAO,CAAC,KAAK,QAAQ,OAAO,CAAC,IAAI,OAAO,MAAM,IAAI,CACnE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/auth/passkey.d.ts

@@ -0,0 +1,3 @@
+import { type SessionFile } from "./session.js";
+export declare function loginWithPasskey(serverUrl: string, credentialId: string, privateKeyPath: string, sessionRoot: string): Promise<SessionFile>;
+//# sourceMappingURL=passkey.d.ts.map

package/dist/auth/passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../src/auth/passkey.ts"],"names":[],"mappings":"AAIA,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAYhE,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,CAAC,CA8BtB"}

package/dist/auth/passkey.js

@@ -0,0 +1,48 @@
+import { createPrivateKey, sign } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { PrayError } from "../errors.js";
+import { httpPostJson, joinUrl } from "../http/client.js";
+import { persistSession } from "./session.js";
+export async function loginWithPasskey(serverUrl, credentialId, privateKeyPath, sessionRoot) {
+    const base = trimTrailingSlash(serverUrl);
+    const challenge = await postJson(joinUrl(base, "v1/auth/passkeys/challenge"), { credential_id: credentialId });
+    const privateKeyBytes = readFileSync(privateKeyPath);
+    if (privateKeyBytes.length !== 32) {
+        throw PrayError.unsupported("passkey private key must be 32 raw bytes");
+    }
+    const privateKey = ed25519PrivateKeyFromSeed(privateKeyBytes);
+    const signature = sign(null, Buffer.from(challenge.challenge, "utf8"), privateKey).toString("base64");
+    const response = await postJson(joinUrl(base, "v1/auth/passkeys/login"), {
+        credential_id: credentialId,
+        challenge_id: challenge.challenge_id,
+        signature,
+    });
+    return persistSession(sessionRoot, {
+        server_url: serverUrl,
+        email: response.email,
+        token: response.token,
+        kind: "passkey",
+    });
+}
+function ed25519PrivateKeyFromSeed(seed) {
+    const prefix = Buffer.from("302e020100300506032b657004220420", "hex");
+    return createPrivateKey({
+        key: Buffer.concat([prefix, seed]),
+        format: "der",
+        type: "pkcs8",
+    });
+}
+async function postJson(url, body) {
+    const responseBody = await httpPostJson(url, "application/json", JSON.stringify(body));
+    try {
+        return JSON.parse(responseBody.toString("utf8"));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw PrayError.parse("auth response", message);
+    }
+}
+function trimTrailingSlash(value) {
+    return value.replace(/\/+$/, "");
+}
+//# sourceMappingURL=passkey.js.map

package/dist/auth/passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../src/auth/passkey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAoB,MAAM,cAAc,CAAC;AAYhE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB,EACjB,YAAoB,EACpB,cAAsB,EACtB,WAAmB;IAEnB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAC9B,OAAO,CAAC,IAAI,EAAE,4BAA4B,CAAC,EAC3C,EAAE,aAAa,EAAE,YAAY,EAAE,CAChC,CAAC;IACF,MAAM,eAAe,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IACrD,IAAI,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAClC,MAAM,SAAS,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,UAAU,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CACpB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,EACxC,UAAU,CACX,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,OAAO,CAAC,IAAI,EAAE,wBAAwB,CAAC,EACvC;QACE,aAAa,EAAE,YAAY;QAC3B,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,SAAS;KACV,CACF,CAAC;IACF,OAAO,cAAc,CAAC,WAAW,EAAE;QACjC,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,SAAS;KAChB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;IACtE,OAAO,gBAAgB,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,GAAW,EAAE,IAAa;IACnD,MAAM,YAAY,GAAG,MAAM,YAAY,CACrC,GAAG,EACH,kBAAkB,EAClB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CACrB,CAAC;IACF,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/dist/auth/session.d.ts

@@ -0,0 +1,11 @@
+export interface SessionFile {
+    server_url: string;
+    email: string;
+    token: string;
+    kind: string;
+    signer_fingerprint?: string;
+}
+export declare function sessionFilePath(root: string): string;
+export declare function persistSession(root: string, session: SessionFile): SessionFile;
+export declare function loadSessions(path: string): SessionFile[] | undefined;
+//# sourceMappingURL=session.d.ts.map

package/dist/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAQD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,GACnB,WAAW,CAgBb;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,GAAG,SAAS,CAcpE"}

package/dist/auth/session.js

@@ -0,0 +1,38 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { PrayError } from "../errors.js";
+export function sessionFilePath(root) {
+    return join(root, ".pray", "session.json");
+}
+export function persistSession(root, session) {
+    const path = sessionFilePath(root);
+    mkdirSync(join(path, ".."), { recursive: true });
+    const sessions = loadSessions(path) ?? [];
+    const existingIndex = sessions.findIndex((entry) => entry.server_url === session.server_url);
+    if (existingIndex >= 0) {
+        sessions[existingIndex] = session;
+    }
+    else {
+        sessions.push(session);
+    }
+    const document = sessions.length === 1 ? sessions[0] : { sessions };
+    writeFileSync(path, `${JSON.stringify(document, null, 2)}\n`, "utf8");
+    return session;
+}
+export function loadSessions(path) {
+    if (!existsSync(path)) {
+        return undefined;
+    }
+    try {
+        const document = JSON.parse(readFileSync(path, "utf8"));
+        if ("sessions" in document && Array.isArray(document.sessions)) {
+            return document.sessions;
+        }
+        return [document];
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw PrayError.parse("session file", message);
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAgBzC,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,OAAoB;IAEpB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CACtC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,CACnD,CAAC;IACF,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GACZ,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtD,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAoB,CAAC;QAC3E,IAAI,UAAU,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,OAAO,QAAQ,CAAC,QAAQ,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,QAAuB,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/auth/ssh-agent.d.ts

@@ -0,0 +1,3 @@
+import { type SessionFile } from "./session.js";
+export declare function loginWithSshAgent(serverUrl: string, publicKeyPath: string, sessionRoot: string): Promise<SessionFile>;
+//# sourceMappingURL=ssh-agent.d.ts.map

package/dist/auth/ssh-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-agent.d.ts","sourceRoot":"","sources":["../../src/auth/ssh-agent.ts"],"names":[],"mappings":"AAIA,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAahE,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,CAAC,CA0BtB"}

package/dist/auth/ssh-agent.js

@@ -0,0 +1,135 @@
+import { readFileSync } from "node:fs";
+import { connect } from "node:net";
+import { PrayError } from "../errors.js";
+import { httpPostJson, joinUrl } from "../http/client.js";
+import { persistSession } from "./session.js";
+export async function loginWithSshAgent(serverUrl, publicKeyPath, sessionRoot) {
+    const publicKey = readFileSync(publicKeyPath, "utf8").trim();
+    const base = trimTrailingSlash(serverUrl);
+    const challenge = await postJson(joinUrl(base, "v1/auth/ssh-keys/challenge"), { public_key: publicKey });
+    const signature = await sshAgentSign(publicKey, Buffer.from(challenge.challenge, "utf8"));
+    const response = await postJson(joinUrl(base, "v1/auth/ssh-keys/login"), {
+        public_key: publicKey,
+        challenge_id: challenge.challenge_id,
+        signature,
+    });
+    return persistSession(sessionRoot, {
+        server_url: serverUrl,
+        email: response.email,
+        token: response.token,
+        kind: "ssh_key",
+        signer_fingerprint: challenge.fingerprint,
+    });
+}
+async function sshAgentSign(publicKey, message) {
+    const agentSocket = process.env.SSH_AUTH_SOCK;
+    if (!agentSocket) {
+        throw PrayError.unsupported("SSH_AUTH_SOCK is not set");
+    }
+    const rawKeyBytes = parseSshEd25519PublicKey(publicKey);
+    const publicKeyBlob = Buffer.concat([
+        sshString(Buffer.from("ssh-ed25519")),
+        sshString(rawKeyBytes),
+    ]);
+    const payload = Buffer.concat([
+        sshString(publicKeyBlob),
+        sshString(message),
+        Buffer.from([0, 0, 0, 0]),
+    ]);
+    const response = await agentRequest(agentSocket, 13, payload);
+    if (response.messageType !== 14) {
+        throw PrayError.resolution(`ssh agent returned unexpected message type: ${response.messageType}`);
+    }
+    const signatureBlob = readSshString(response.payload, 0).value;
+    return parseSshSignatureBlob(signatureBlob);
+}
+function parseSshEd25519PublicKey(publicKey) {
+    const fields = publicKey.split(/\s+/);
+    const algorithm = fields[0];
+    const keyValue = fields[1];
+    if (!algorithm || !keyValue) {
+        throw PrayError.unsupported("public key must include an algorithm and key");
+    }
+    if (algorithm !== "ssh-ed25519") {
+        throw PrayError.unsupported(`unsupported public key algorithm: ${algorithm}`);
+    }
+    const blob = Buffer.from(keyValue, "base64");
+    const algorithmField = readSshString(blob, 0);
+    if (algorithmField.value.toString("utf8") !== "ssh-ed25519") {
+        throw PrayError.parse("public key", "ed25519 public key blob must start with ssh-ed25519");
+    }
+    const keyBytes = readSshString(blob, algorithmField.nextOffset).value;
+    if (keyBytes.length !== 32) {
+        throw PrayError.parse("public key", "ed25519 public key must be 32 bytes");
+    }
+    return keyBytes;
+}
+function parseSshSignatureBlob(signatureBlob) {
+    const algorithm = readSshString(signatureBlob, 0);
+    if (algorithm.value.toString("utf8") !== "ssh-ed25519") {
+        throw PrayError.unsupported(`unsupported ssh signature algorithm: ${algorithm.value.toString("utf8")}`);
+    }
+    const signature = readSshString(signatureBlob, algorithm.nextOffset).value;
+    return signature.toString("base64");
+}
+function agentRequest(socketPath, messageType, payload) {
+    return new Promise((resolve, reject) => {
+        const socket = connect(socketPath);
+        const chunks = [];
+        socket.on("error", (error) => reject(error));
+        socket.on("data", (chunk) => chunks.push(chunk));
+        socket.on("end", () => {
+            try {
+                resolve(parseAgentResponse(Buffer.concat(chunks)));
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+        const body = Buffer.concat([Buffer.from([messageType]), payload]);
+        const frame = Buffer.alloc(4 + body.length);
+        frame.writeUInt32BE(body.length, 0);
+        body.copy(frame, 4);
+        socket.end(frame);
+    });
+}
+function parseAgentResponse(buffer) {
+    if (buffer.length < 5) {
+        throw PrayError.resolution("empty ssh agent response");
+    }
+    const length = buffer.readUInt32BE(0);
+    const body = buffer.subarray(4, 4 + length);
+    return { messageType: body[0], payload: body.subarray(1) };
+}
+function sshString(bytes) {
+    const buffer = Buffer.alloc(4 + bytes.length);
+    buffer.writeUInt32BE(bytes.length, 0);
+    bytes.copy(buffer, 4);
+    return buffer;
+}
+function readSshString(buffer, offset) {
+    if (buffer.length < offset + 4) {
+        throw PrayError.resolution("truncated ssh field");
+    }
+    const length = buffer.readUInt32BE(offset);
+    const start = offset + 4;
+    const end = start + length;
+    if (buffer.length < end) {
+        throw PrayError.resolution("truncated ssh agent response");
+    }
+    return { value: buffer.subarray(start, end), nextOffset: end };
+}
+async function postJson(url, body) {
+    const responseBody = await httpPostJson(url, "application/json", JSON.stringify(body));
+    try {
+        return JSON.parse(responseBody.toString("utf8"));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw PrayError.parse("auth response", message);
+    }
+}
+function trimTrailingSlash(value) {
+    return value.replace(/\/+$/, "");
+}
+//# sourceMappingURL=ssh-agent.js.map