spidersan 0.20.1 → 0.20.2

package/dist/lib/crypto.js

@@ -0,0 +1,176 @@
+/**
+ * Spider Mail Crypto Module
+ *
+ * E2E encryption for agent messaging using TweetNaCl.
+ * Uses X25519 for key exchange and XSalsa20-Poly1305 for encryption.
+ */
+import nacl from 'tweetnacl';
+import util from 'tweetnacl-util';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { validateAgentId } from './security.js';
+// Key storage location
+const KEYS_DIR = join(homedir(), '.spidersan', 'keys');
+/**
+ * Ensure keys directory exists
+ */
+function ensureKeysDir() {
+    if (!existsSync(KEYS_DIR)) {
+        mkdirSync(KEYS_DIR, { recursive: true });
+    }
+}
+/**
+ * Get path to agent's keypair file
+ */
+function getKeyPath(agentId) {
+    const safeAgentId = validateAgentId(agentId);
+    return join(KEYS_DIR, `${safeAgentId}.key.json`);
+}
+/**
+ * Get path to known public keys registry
+ */
+function getPublicKeysPath() {
+    return join(KEYS_DIR, 'known_keys.json');
+}
+/**
+ * Generate a new keypair for an agent
+ */
+export function generateKeyPair() {
+    return nacl.box.keyPair();
+}
+/**
+ * Save keypair to local storage
+ */
+export function saveKeyPair(agentId, keyPair) {
+    ensureKeysDir();
+    const serialized = {
+        publicKey: util.encodeBase64(keyPair.publicKey),
+        secretKey: util.encodeBase64(keyPair.secretKey),
+    };
+    writeFileSync(getKeyPath(agentId), JSON.stringify(serialized, null, 2), { mode: 0o600 });
+}
+/**
+ * Load keypair from local storage
+ */
+export function loadKeyPair(agentId) {
+    const path = getKeyPath(agentId);
+    if (!existsSync(path))
+        return null;
+    try {
+        const data = JSON.parse(readFileSync(path, 'utf-8'));
+        return {
+            publicKey: util.decodeBase64(data.publicKey),
+            secretKey: util.decodeBase64(data.secretKey),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Check if agent has a keypair
+ */
+export function hasKeyPair(agentId) {
+    return existsSync(getKeyPath(agentId));
+}
+/**
+ * Get public key as base64 string (for sharing)
+ */
+export function getPublicKeyBase64(agentId) {
+    const keyPair = loadKeyPair(agentId);
+    if (!keyPair)
+        return null;
+    return util.encodeBase64(keyPair.publicKey);
+}
+/**
+ * Load known public keys registry
+ */
+export function loadKnownKeys() {
+    const path = getPublicKeysPath();
+    if (!existsSync(path))
+        return {};
+    try {
+        return JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Save a public key for another agent
+ */
+export function saveKnownKey(agentId, publicKeyBase64) {
+    ensureKeysDir();
+    const safeAgentId = validateAgentId(agentId);
+    const keys = loadKnownKeys();
+    keys[safeAgentId] = publicKeyBase64;
+    writeFileSync(getPublicKeysPath(), JSON.stringify(keys, null, 2), { mode: 0o600 });
+}
+/**
+ * Get public key for an agent (from known keys)
+ */
+export function getKnownKey(agentId) {
+    const safeAgentId = validateAgentId(agentId);
+    const keys = loadKnownKeys();
+    const keyBase64 = keys[safeAgentId];
+    if (!keyBase64)
+        return null;
+    return util.decodeBase64(keyBase64);
+}
+/**
+ * Encrypt a message for a recipient
+ */
+export function encryptMessage(message, recipientPublicKey, senderKeyPair) {
+    const messageBytes = util.decodeUTF8(message);
+    const nonce = nacl.randomBytes(nacl.box.nonceLength);
+    const ciphertext = nacl.box(messageBytes, nonce, recipientPublicKey, senderKeyPair.secretKey);
+    return {
+        ciphertext: util.encodeBase64(ciphertext),
+        nonce: util.encodeBase64(nonce),
+        senderPublicKey: util.encodeBase64(senderKeyPair.publicKey),
+    };
+}
+/**
+ * Decrypt a message from a sender
+ */
+export function decryptMessage(encrypted, recipientKeyPair) {
+    try {
+        const ciphertext = util.decodeBase64(encrypted.ciphertext);
+        const nonce = util.decodeBase64(encrypted.nonce);
+        const senderPublicKey = util.decodeBase64(encrypted.senderPublicKey);
+        const decrypted = nacl.box.open(ciphertext, nonce, senderPublicKey, recipientKeyPair.secretKey);
+        if (!decrypted)
+            return null;
+        return util.encodeUTF8(decrypted);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Encrypt multiple fields for a message
+ */
+export function encryptFields(fields, recipientPublicKey, senderKeyPair) {
+    const serialized = JSON.stringify(fields);
+    const encrypted = encryptMessage(serialized, recipientPublicKey, senderKeyPair);
+    return {
+        encrypted,
+        fieldNames: Object.keys(fields),
+    };
+}
+/**
+ * Decrypt fields from a message
+ */
+export function decryptFields(encrypted, recipientKeyPair) {
+    const decrypted = decryptMessage(encrypted, recipientKeyPair);
+    if (!decrypted)
+        return null;
+    try {
+        return JSON.parse(decrypted);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=crypto.js.map

package/dist/lib/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,gBAAgB,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,uBAAuB;AACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;AAkBvD;;GAEG;AACH,SAAS,aAAa;IAClB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,OAAe;IAC/B,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,QAAQ,EAAE,GAAG,WAAW,WAAW,CAAC,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB;IACtB,OAAO,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,OAAgB;IACzD,aAAa,EAAE,CAAC;IAChB,MAAM,UAAU,GAAsB;QAClC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;QAC/C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;KAClD,CAAC;IACF,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAsB,CAAC;QAC1E,OAAO;YACH,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;YAC5C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;SAC/C,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe;IACtC,OAAO,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAC9C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IACzB,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,eAAuB;IACjE,aAAa,EAAE,CAAC;IAChB,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,WAAW,CAAC,GAAG,eAAe,CAAC;IACpC,aAAa,CAAC,iBAAiB,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACvF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACvC,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC1B,OAAe,EACf,kBAA8B,EAC9B,aAAsB;IAEtB,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CACvB,YAAY,EACZ,KAAK,EACL,kBAAkB,EAClB,aAAa,CAAC,SAAS,CAC1B,CAAC;IAEF,OAAO;QACH,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;QACzC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAC/B,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC;KAC9D,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC1B,SAA2B,EAC3B,gBAAyB;IAEzB,IAAI,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAErE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAC3B,UAAU,EACV,KAAK,EACL,eAAe,EACf,gBAAgB,CAAC,SAAS,CAC7B,CAAC;QAEF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CACzB,MAA+B,EAC/B,kBAA8B,EAC9B,aAAsB;IAEtB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,EAAE,kBAAkB,EAAE,aAAa,CAAC,CAAC;IAChF,OAAO;QACH,SAAS;QACT,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;KAClC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CACzB,SAA2B,EAC3B,gBAAyB;IAEzB,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC"}

package/dist/lib/ecosystem-env.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Ecosystem environment resolution.
+ *
+ * The repo list scanned by `spidersan conflicts --ecosystem`. It comes from
+ * `--repos`, then `SPIDERSAN_ECOSYSTEM` when that holds a path list
+ * (colon-separated), then `conflicts.ecosystemRepos` in a config file.
+ * There is no built-in default: unconfigured means no repos.
+ *
+ * A boolean-looking SPIDERSAN_ECOSYSTEM value was the switch for the
+ * `spidersan-ecosystem` plugin, removed in 0.20.0. It is still never read as a
+ * path list, so `SPIDERSAN_ECOSYSTEM=0` does not scan a repo named "0".
+ */
+import type { SpidersanConfig } from './config.js';
+type Env = Record<string, string | undefined>;
+export declare function isOffToken(value?: string): boolean;
+export declare function isOnToken(value?: string): boolean;
+export type EcosystemRepoSource = 'flag' | 'env' | 'config' | 'none';
+export interface EcosystemRepoResolution {
+    repos: string[];
+    source: EcosystemRepoSource;
+}
+export declare const ECOSYSTEM_UNCONFIGURED_HINT: string;
+/**
+ * Resolve the repo list for `conflicts --ecosystem`.
+ * Precedence: --repos flag > SPIDERSAN_ECOSYSTEM path list > config > none.
+ */
+export declare function resolveEcosystemRepos(config: Pick<SpidersanConfig, 'conflicts'>, options?: {
+    reposFlag?: string;
+    env?: Env;
+    home?: string;
+}): EcosystemRepoResolution;
+export {};
+//# sourceMappingURL=ecosystem-env.d.ts.map

package/dist/lib/ecosystem-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecosystem-env.d.ts","sourceRoot":"","sources":["../../src/lib/ecosystem-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAS9C,wBAAgB,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,wBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAEjD;AAQD,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAErE,MAAM,WAAW,uBAAuB;IACpC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,mBAAmB,CAAC;CAC/B;AAED,eAAO,MAAM,2BAA2B,QAEgE,CAAC;AAEzG;;;GAGG;AACH,wBAAgB,qBAAqB,CACjC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,EAC1C,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/D,uBAAuB,CAwBzB"}

package/dist/lib/ecosystem-env.js

@@ -0,0 +1,62 @@
+/**
+ * Ecosystem environment resolution.
+ *
+ * The repo list scanned by `spidersan conflicts --ecosystem`. It comes from
+ * `--repos`, then `SPIDERSAN_ECOSYSTEM` when that holds a path list
+ * (colon-separated), then `conflicts.ecosystemRepos` in a config file.
+ * There is no built-in default: unconfigured means no repos.
+ *
+ * A boolean-looking SPIDERSAN_ECOSYSTEM value was the switch for the
+ * `spidersan-ecosystem` plugin, removed in 0.20.0. It is still never read as a
+ * path list, so `SPIDERSAN_ECOSYSTEM=0` does not scan a repo named "0".
+ */
+import { homedir } from 'os';
+import { join } from 'path';
+const OFF_TOKENS = ['0', 'false', 'no', 'off'];
+const ON_TOKENS = ['1', 'true', 'yes', 'on'];
+function norm(value) {
+    return (value ?? '').trim().toLowerCase();
+}
+export function isOffToken(value) {
+    return OFF_TOKENS.includes(norm(value));
+}
+export function isOnToken(value) {
+    return ON_TOKENS.includes(norm(value));
+}
+function expandHome(p, home) {
+    if (p === '~')
+        return home;
+    if (p.startsWith('~/'))
+        return join(home, p.slice(2));
+    return p;
+}
+export const ECOSYSTEM_UNCONFIGURED_HINT = 'No ecosystem repos configured. Set SPIDERSAN_ECOSYSTEM=/path/to/repo-a:/path/to/repo-b, ' +
+    'add "conflicts": { "ecosystemRepos": ["/path/to/repo-a"] } to ~/.spidersanrc, or pass --repos a,b.';
+/**
+ * Resolve the repo list for `conflicts --ecosystem`.
+ * Precedence: --repos flag > SPIDERSAN_ECOSYSTEM path list > config > none.
+ */
+export function resolveEcosystemRepos(config, options = {}) {
+    const env = options.env ?? process.env;
+    const home = options.home ?? env.HOME ?? homedir();
+    const clean = (list) => [...new Set(list.map((r) => r.trim()).filter(Boolean).map((r) => expandHome(r, home)))];
+    if (options.reposFlag) {
+        const repos = clean(options.reposFlag.split(','));
+        if (repos.length > 0)
+            return { repos, source: 'flag' };
+    }
+    const envValue = env.SPIDERSAN_ECOSYSTEM;
+    if (envValue && !isOffToken(envValue) && !isOnToken(envValue)) {
+        const repos = clean(envValue.split(':'));
+        if (repos.length > 0)
+            return { repos, source: 'env' };
+    }
+    const fromConfig = config.conflicts?.ecosystemRepos;
+    if (Array.isArray(fromConfig)) {
+        const repos = clean(fromConfig.filter((r) => typeof r === 'string'));
+        if (repos.length > 0)
+            return { repos, source: 'config' };
+    }
+    return { repos: [], source: 'none' };
+}
+//# sourceMappingURL=ecosystem-env.js.map

package/dist/lib/ecosystem-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecosystem-env.js","sourceRoot":"","sources":["../../src/lib/ecosystem-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAC/C,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAE7C,SAAS,IAAI,CAAC,KAAc;IACxB,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAc;IACpC,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,IAAY;IACvC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC;AACb,CAAC;AASD,MAAM,CAAC,MAAM,2BAA2B,GACpC,0FAA0F;IAC1F,oGAAoG,CAAC;AAEzG;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACjC,MAA0C,EAC1C,UAA4D,EAAE;IAE9D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,CAAC,IAAc,EAAY,EAAE,CACvC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5F,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACzC,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC"}

package/dist/lib/errors.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Spidersan Error Classes
+ *
+ * Structured error types for consistent error handling.
+ */
+export declare class SpidersanError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+export declare class StorageError extends SpidersanError {
+    readonly operation: string;
+    constructor(message: string, operation: string);
+}
+export declare class ConfigError extends SpidersanError {
+    constructor(message: string);
+}
+export declare class GitError extends SpidersanError {
+    constructor(message: string);
+}
+export declare class LicenseError extends SpidersanError {
+    constructor(message: string);
+}
+export declare class SupabaseError extends SpidersanError {
+    readonly hint?: string | undefined;
+    constructor(message: string, hint?: string | undefined);
+}
+/**
+ * Format error for CLI output
+ */
+export declare function formatError(error: unknown): string;
+/**
+ * Handle CLI errors consistently
+ */
+export declare function handleError(error: unknown, exitCode?: number): never;
+//# sourceMappingURL=errors.d.ts.map

package/dist/lib/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,qBAAa,cAAe,SAAQ,KAAK;aACQ,IAAI,EAAE,MAAM;gBAA7C,OAAO,EAAE,MAAM,EAAkB,IAAI,EAAE,MAAM;CAI5D;AAED,qBAAa,YAAa,SAAQ,cAAc;aACC,SAAS,EAAE,MAAM;gBAAlD,OAAO,EAAE,MAAM,EAAkB,SAAS,EAAE,MAAM;CAIjE;AAED,qBAAa,WAAY,SAAQ,cAAc;gBAC/B,OAAO,EAAE,MAAM;CAI9B;AAED,qBAAa,QAAS,SAAQ,cAAc;gBAC5B,OAAO,EAAE,MAAM;CAI9B;AAED,qBAAa,YAAa,SAAQ,cAAc;gBAChC,OAAO,EAAE,MAAM;CAI9B;AAED,qBAAa,aAAc,SAAQ,cAAc;aACA,IAAI,CAAC,EAAE,MAAM;gBAA9C,OAAO,EAAE,MAAM,EAAkB,IAAI,CAAC,EAAE,MAAM,YAAA;CAI7D;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYlD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAI,GAAG,KAAK,CAG/D"}

package/dist/lib/errors.js

@@ -0,0 +1,71 @@
+/**
+ * Spidersan Error Classes
+ *
+ * Structured error types for consistent error handling.
+ */
+export class SpidersanError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'SpidersanError';
+    }
+}
+export class StorageError extends SpidersanError {
+    operation;
+    constructor(message, operation) {
+        super(message, 'STORAGE_ERROR');
+        this.operation = operation;
+        this.name = 'StorageError';
+    }
+}
+export class ConfigError extends SpidersanError {
+    constructor(message) {
+        super(message, 'CONFIG_ERROR');
+        this.name = 'ConfigError';
+    }
+}
+export class GitError extends SpidersanError {
+    constructor(message) {
+        super(message, 'GIT_ERROR');
+        this.name = 'GitError';
+    }
+}
+export class LicenseError extends SpidersanError {
+    constructor(message) {
+        super(message, 'LICENSE_ERROR');
+        this.name = 'LicenseError';
+    }
+}
+export class SupabaseError extends SpidersanError {
+    hint;
+    constructor(message, hint) {
+        super(message, 'SUPABASE_ERROR');
+        this.hint = hint;
+        this.name = 'SupabaseError';
+    }
+}
+/**
+ * Format error for CLI output
+ */
+export function formatError(error) {
+    if (error instanceof SpidersanError) {
+        let msg = `❌ ${error.message}`;
+        if (error instanceof SupabaseError && error.hint) {
+            msg += `\n   Hint: ${error.hint}`;
+        }
+        return msg;
+    }
+    if (error instanceof Error) {
+        return `❌ ${error.message}`;
+    }
+    return `❌ Unknown error: ${String(error)}`;
+}
+/**
+ * Handle CLI errors consistently
+ */
+export function handleError(error, exitCode = 1) {
+    console.error(formatError(error));
+    process.exit(exitCode);
+}
+//# sourceMappingURL=errors.js.map

package/dist/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACQ;IAA7C,YAAY,OAAe,EAAkB,IAAY;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QAD0B,SAAI,GAAJ,IAAI,CAAQ;QAErD,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IACjC,CAAC;CACJ;AAED,MAAM,OAAO,YAAa,SAAQ,cAAc;IACC;IAA7C,YAAY,OAAe,EAAkB,SAAiB;QAC1D,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QADS,cAAS,GAAT,SAAS,CAAQ;QAE1D,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC/B,CAAC;CACJ;AAED,MAAM,OAAO,WAAY,SAAQ,cAAc;IAC3C,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC9B,CAAC;CACJ;AAED,MAAM,OAAO,QAAS,SAAQ,cAAc;IACxC,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IAC3B,CAAC;CACJ;AAED,MAAM,OAAO,YAAa,SAAQ,cAAc;IAC5C,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC/B,CAAC;CACJ;AAED,MAAM,OAAO,aAAc,SAAQ,cAAc;IACA;IAA7C,YAAY,OAAe,EAAkB,IAAa;QACtD,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QADQ,SAAI,GAAJ,IAAI,CAAS;QAEtD,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAChC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACtC,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;QAClC,IAAI,GAAG,GAAG,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,KAAK,YAAY,aAAa,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC/C,GAAG,IAAI,cAAc,KAAK,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QACzB,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,oBAAoB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,QAAQ,GAAG,CAAC;IACpD,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC"}

package/dist/lib/git-events-subscriber.d.ts

@@ -0,0 +1,86 @@
+/**
+ * git-events-subscriber
+ *
+ * Subscribes to spidersan_git_events via Supabase Realtime for low-latency
+ * git-change notifications, with a catch-up poll on startup/reconnect so no
+ * events are missed while a machine was offline.
+ *
+ * Delivery model:
+ *   Realtime INSERT  — instant fan-out (< 1s when connected)
+ *   Catch-up query   — WHERE seq > last_seen_seq on startup/reconnect
+ *
+ * Actions per event type (P1 — notify, not auto-execute):
+ *   push          → warn agent, log to activity + pending files
+ *   pull_request  → log only
+ *   create        → log only
+ *   delete        → mark registry branch abandoned, archive entry
+ *
+ * AI layer (P2): pending events will be routed through spidersan-smol/gemma4
+ * for ecosystem-aware severity decisions. The pending log is the handoff point.
+ */
+/**
+ * The compare-API credential, preferring the vault-injected name.
+ *
+ * It cannot be stored as `GITHUB_TOKEN`: envoak's protected-namespace filter
+ * (`SENSITIVE_PREFIXES` in Envoak vault.ts) refuses to inject any name starting
+ * `GITHUB_`, so a vault secret called GITHUB_TOKEN would be granted, decrypted,
+ * and then dropped — leaving the daemon silently unauthenticated at 60 req/h.
+ * Hence the app-prefixed `spidersan/SPIDERSAN_GITHUB_TOKEN`.
+ *
+ * `GITHUB_TOKEN` stays as a fallback so a plain shell (or CI) that already
+ * exports it keeps working.
+ */
+export declare function resolveGithubToken(env?: NodeJS.ProcessEnv): string | undefined;
+export interface GitEvent {
+    id: string;
+    seq: number;
+    delivery_id: string;
+    repo: string;
+    event_type: string;
+    action: string | null;
+    ref: string | null;
+    ref_type: string | null;
+    branch: string | null;
+    before_sha: string | null;
+    after_sha: string | null;
+    sender_login: string | null;
+    received_at: string;
+}
+export interface GitWatchOptions {
+    pollIntervalMs?: number;
+    repoPaths?: string[];
+    onEvent?: (event: GitEvent) => void;
+    logger?: (msg: string) => void;
+    quiet?: boolean;
+    disableRealtime?: boolean;
+}
+export interface GitWatchHandle {
+    stop: () => void;
+}
+/**
+ * Build a map from "owner/repo" to local clone path(s).
+ * Scans provided repoPaths first; if empty, scans all registered repos
+ * by reading their .spidersan/registry.json locations from ~/.spidersan.
+ */
+export declare function normalizeRemoteUrl(url: string): string;
+export declare function isTreebirdRepo(repo: string): boolean;
+/**
+ * Detect the stale-revert signature in one repo: many tracked files DELETED in
+ * the working tree (HEAD/index intact). This is recoverable and non-destructive
+ * — `git restore` brings the files back — so we only warn, loudly, with the fix.
+ * Returns true if an alarm fired.
+ */
+export declare function checkWorkingTreeIntegrity(repoPath: string, log: (m: string) => void): boolean;
+/**
+ * Start the git-events daemon in hybrid mode:
+ *  - Supabase Realtime WebSocket for < 1s delivery (when available)
+ *  - 5-min safety-sweep poll to catch events missed during disconnects
+ * Returns a handle with a stop() method.
+ */
+export declare function startGitWatch(opts?: GitWatchOptions): Promise<GitWatchHandle>;
+/**
+ * One-shot catch-up: fetch any missed events since last cursor, then exit.
+ * Useful for cron/CI environments that don't run persistent daemons.
+ */
+export declare function catchUpOnce(opts?: GitWatchOptions): Promise<void>;
+//# sourceMappingURL=git-events-subscriber.d.ts.map

package/dist/lib/git-events-subscriber.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-events-subscriber.d.ts","sourceRoot":"","sources":["../../src/lib/git-events-subscriber.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAuBH;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACrC,MAAM,GAAG,SAAS,CAEpB;AAID,MAAM,WAAW,QAAQ;IACrB,EAAE,EAAY,MAAM,CAAC;IACrB,GAAG,EAAW,MAAM,CAAC;IACrB,WAAW,EAAG,MAAM,CAAC;IACrB,IAAI,EAAU,MAAM,CAAC;IACrB,UAAU,EAAI,MAAM,CAAC;IACrB,MAAM,EAAQ,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,EAAW,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAM,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAQ,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAI,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAK,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAG,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC3B,IAAI,EAAE,MAAM,IAAI,CAAC;CACpB;AA4CD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAWtD;AAMD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AA4CD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAuB7F;AAirBD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAgDvF;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3E"}