@aligndottech/cli 0.49.0 → 0.51.0

package/dist/lib/login-flow.d.ts

@@ -1,5 +1,20 @@
+import { type VerifiedIdentity } from './join-flow.js';
 import type { createConfigStore, EnvironmentConfig, EnvName } from './config.js';
 type ConfigStore = ReturnType<typeof createConfigStore>;
+/**
+ * The address /auth/cli-init hands back is opened in a browser, so it is checked first: http(s) only, and for a team destination its
+ * origin must be the saved gateway's or web app's (a joined gateway is whatever was joined, so its word is not enough). A string
+ * starting with '!' is the reason it was refused.
+ */
+export declare function checkLoginUrl(raw: unknown, env: EnvironmentConfig): string;
+/**
+ * `align login --env <team> --token X`: the no-browser renewal. A person at a terminal only, never inside an agent, and the token is
+ * kept only once the destination's gateway says whose it is; the tenant saved is THAT one, never the previous token's.
+ */
+export declare function saveTeamToken(env: EnvironmentConfig, envName: EnvName, token: string, config: ConfigStore, ctx: {
+    wrapped: boolean;
+    tty: boolean;
+}): Promise<VerifiedIdentity | string>;
 export declare function loginInteractive(env: EnvironmentConfig, envName: EnvName, config: ConfigStore): Promise<boolean>;
 export {};
 //# sourceMappingURL=login-flow.d.ts.map

package/dist/lib/login-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-flow.d.ts","sourceRoot":"","sources":["../../src/lib/login-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEjF,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAMxD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,iBAAiB,EACtB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,OAAO,CAAC,CAoElB"}
+{"version":3,"file":"login-flow.d.ts","sourceRoot":"","sources":["../../src/lib/login-flow.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,gBAAgB,EAAe,MAAM,gBAAgB,CAAC;AAKpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEjF,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAMxD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAY1E;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,GACpH,OAAO,CAAC,gBAAgB,GAAG,MAAM,CAAC,CAQpC;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,iBAAiB,EACtB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,OAAO,CAAC,CA+FlB"}

package/dist/lib/login-flow.js

@@ -1,32 +1,92 @@
 import * as p from '@clack/prompts';
 import chalk from 'chalk';
+import { assertTransport } from './destination-trust.js';
+import { verifyToken } from './join-flow.js';
 import { tryOpenUrl } from './open-url.js';
+import { visible } from './share/visible.js';
 import { createGatewayClient, GatewayError } from './gateway-client.js';
 import { CLI_CALLBACK_PORTS, waitForCallback } from './cli-oauth.js';
 // Browser-based CLI login. Starts a local callback server, opens the branded
 // login page, exchanges the returned token, verifies it, and persists the
 // token + tenant id. Returns true on success. Shared by `align login` and the
 // inline login on the cloud `align setup` path.
+/**
+ * The address /auth/cli-init hands back is opened in a browser, so it is checked first: http(s) only, and for a team destination its
+ * origin must be the saved gateway's or web app's (a joined gateway is whatever was joined, so its word is not enough). A string
+ * starting with '!' is the reason it was refused.
+ */
+export function checkLoginUrl(raw, env) {
+    if (typeof raw !== 'string' || raw === '')
+        return '!the gateway sent no login address';
+    let u;
+    try {
+        u = new URL(raw);
+    }
+    catch {
+        return '!the gateway sent something that is not a web address';
+    }
+    if (u.protocol !== 'https:' && u.protocol !== 'http:')
+        return `!it is not a web address (${visible(u.protocol)})`;
+    if (env.kind === 'team') {
+        let origin;
+        try {
+            origin = assertTransport(u.origin);
+        }
+        catch (e) {
+            return `!${visible(e.message)}`;
+        }
+        const own = [env.gatewayUrl, env.appUrl].filter((x) => typeof x === 'string').map((x) => x.replace(/\/+$/, ''));
+        if (!own.includes(origin))
+            return `!${visible(u.host)} is not this destination's gateway or web app`;
+    }
+    return raw;
+}
+/**
+ * `align login --env <team> --token X`: the no-browser renewal. A person at a terminal only, never inside an agent, and the token is
+ * kept only once the destination's gateway says whose it is; the tenant saved is THAT one, never the previous token's.
+ */
+export async function saveTeamToken(env, envName, token, config, ctx) {
+    if (ctx.wrapped)
+        return 'A token for a team destination has to be saved by you, in your own terminal, not from inside an agent. Nothing was saved.';
+    if (!ctx.tty)
+        return 'Saving a token for a team destination needs a terminal. Nothing was saved.';
+    const who = await verifyToken(env.gatewayUrl, token);
+    if (typeof who === 'string')
+        return `${new URL(env.gatewayUrl).host} ${who}`;
+    config.setAuthToken(envName, token);
+    config.setTenantId(envName, who.tenantId);
+    return who;
+}
 export async function loginInteractive(env, envName, config) {
     const spinner = p.spinner();
     spinner.start('Opening browser for login...');
     let loginUrl = '';
+    const stop = new AbortController();
+    let refused = '';
     const callbackPromise = waitForCallback({
         ports: CLI_CALLBACK_PORTS,
         timeoutMs: 120_000,
+        signal: stop.signal,
         onBound: async (port, nonce) => {
             try {
                 const res = await fetch(`${env.gatewayUrl}/auth/cli-init?port=${port}&nonce=${nonce}`);
                 if (!res.ok)
                     throw new Error(`Gateway returned ${res.status}`);
                 const body = await res.json();
-                loginUrl = body.url;
+                const checked = checkLoginUrl(body.url, env);
+                if (typeof checked !== 'string' || checked.startsWith('!')) {
+                    refused = typeof checked === 'string' ? checked.slice(1) : 'the gateway sent no login address';
+                    spinner.stop(`Not opening that address: ${refused}`);
+                    stop.abort();
+                    return;
+                }
+                loginUrl = checked;
                 const opened = await tryOpenUrl(loginUrl);
                 // The message follows the boolean: claiming "Browser opened" over a detected
                 // failure is the same lie the paste path told in 0.28.0.
                 spinner.stop(opened
-                    ? `Browser opened. If nothing happened, visit:\n  ${chalk.bold(loginUrl)}`
-                    : `Could not open a browser here. Log in at:\n  ${chalk.bold(loginUrl)}`);
+                    ? `Browser opened. If nothing happened, visit:\n  ${chalk.bold(visible(loginUrl))}`
+                    : `Could not open a browser here. Log in at:\n  ${chalk.bold(visible(loginUrl))}`);
                 p.log.info('Waiting for you to log in (2 min timeout)...');
             }
             catch (e) {
@@ -39,7 +99,7 @@ export async function loginInteractive(env, envName, config) {
         result = await callbackPromise;
     }
     catch (e) {
-        p.log.error(`Login failed: ${e.message}`);
+        p.log.error(refused ? `Login stopped: ${refused}. Nothing was saved.` : `Login failed: ${e.message}`);
         return false;
     }
     const token = result.data['token'];
@@ -47,6 +107,22 @@ export async function loginInteractive(env, envName, config) {
         p.log.error('No token received. Try again or use: align login --token <token>');
         return false;
     }
+    // A team destination is renewed the way it was joined: the token is only kept once the gateway has answered who it belongs to,
+    // in the shape an Align gateway uses. "Unreachable" is not "verified" here, unlike the builtins below (join review F10).
+    if (env.kind === 'team') {
+        const spin = p.spinner();
+        spin.start('Verifying token...');
+        const who = await verifyToken(env.gatewayUrl, token);
+        if (typeof who === 'string') {
+            spin.stop('Login failed: the new token could not be verified.');
+            p.log.error(`${new URL(env.gatewayUrl).host} ${who}`);
+            return false;
+        }
+        config.setAuthToken(envName, token);
+        config.setTenantId(envName, who.tenantId);
+        spin.stop(`Logged in as ${visible(who.email)} (${visible(who.tenantName)}) [${envName}]`);
+        return true;
+    }
     const verifySpinner = p.spinner();
     verifySpinner.start('Verifying token...');
     try {

package/dist/lib/login-flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-flow.js","sourceRoot":"","sources":["../../src/lib/login-flow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKrE,6EAA6E;AAC7E,0EAA0E;AAC1E,8EAA8E;AAC9E,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAsB,EACtB,OAAgB,EAChB,MAAmB;IAEnB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAE9C,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,MAAM,eAAe,GAAG,eAAe,CAAC;QACtC,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE,OAAO;QAClB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,UAAU,uBAAuB,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC;gBACvF,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAqB,CAAC;gBACjD,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC;gBACpB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC1C,6EAA6E;gBAC7E,yDAAyD;gBACzD,OAAO,CAAC,IAAI,CACV,MAAM;oBACJ,CAAC,CAAC,kDAAkD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAC1E,CAAC,CAAC,gDAAgD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAC3E,CAAC;gBACF,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,2BAA4B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,MAAuD,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,eAAe,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAkB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAuB,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAClC,aAAa,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7D,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iFAAiF;QACjF,8EAA8E;QAC9E,iFAAiF;QACjF,mDAAmD;QACnD,MAAM,MAAM,GAAG,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACrC,aAAa,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YACrE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACzE,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"login-flow.js","sourceRoot":"","sources":["../../src/lib/login-flow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAyB,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKrE,6EAA6E;AAC7E,0EAA0E;AAC1E,8EAA8E;AAC9E,gDAAgD;AAChD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,GAAsB;IAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,oCAAoC,CAAC;IACvF,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QAAC,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,uDAAuD,CAAC;IAAC,CAAC;IACnG,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,6BAA6B,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;IAClH,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,OAAO,IAAI,OAAO,CAAE,CAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAAC,CAAC;QACrG,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7H,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,+CAA+C,CAAC;IACvG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAsB,EAAE,OAAgB,EAAE,KAAa,EAAE,MAAmB,EAAE,GAAuC;IAErH,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,2HAA2H,CAAC;IACpJ,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO,4EAA4E,CAAC;IAClG,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;IAC7E,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAsB,EACtB,OAAgB,EAChB,MAAmB;IAEnB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAE9C,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAM,eAAe,GAAG,eAAe,CAAC;QACtC,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,UAAU,uBAAuB,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC;gBACvF,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAsB,CAAC;gBAClD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3D,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC;oBAC/F,OAAO,CAAC,IAAI,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;oBACrD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,QAAQ,GAAG,OAAO,CAAC;gBACnB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC1C,6EAA6E;gBAC7E,yDAAyD;gBACzD,OAAO,CAAC,IAAI,CACV,MAAM;oBACJ,CAAC,CAAC,kDAAkD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE;oBACnF,CAAC,CAAC,gDAAgD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CACpF,CAAC;gBACF,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,2BAA4B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,MAAuD,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,eAAe,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,OAAO,sBAAsB,CAAC,CAAC,CAAC,iBAAkB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACjH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAuB,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+HAA+H;IAC/H,yHAAyH;IACzH,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YAChE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAClC,aAAa,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7D,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iFAAiF;QACjF,8EAA8E;QAC9E,iFAAiF;QACjF,mDAAmD;QACnD,MAAM,MAAM,GAAG,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACrC,aAAa,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YACrE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACzE,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/mcp/mark-tool.d.ts

@@ -0,0 +1,27 @@
+import type { Judge } from '../curation/judgements-db.js';
+import type { EnvironmentConfig } from '../config.js';
+export declare const MARK_TOOL = "align_mark";
+/** What an agent may record. Hiding a decision, declaring one replaced and ratifying are the person's. */
+export declare const MARK_KINDS: readonly ["verdict", "note"];
+export declare const MARK_TOOL_SCHEMA: {
+    readonly name: "align_mark";
+    readonly annotations: {
+        readonly readOnlyHint: false;
+        readonly destructiveHint: true;
+    };
+    readonly description: string;
+    readonly inputSchema: Record<string, unknown>;
+};
+export interface MarkToolResult {
+    text: string;
+    [k: string]: unknown;
+}
+export interface MarkToolContext {
+    /** The MCP `initialize` clientInfo, as the SDK holds it. */
+    clientInfo?: {
+        name?: unknown;
+    };
+    judge?: () => Promise<Judge>;
+}
+export declare function runMarkTool(args: Record<string, unknown> | undefined, env: EnvironmentConfig, ctx?: MarkToolContext): Promise<MarkToolResult>;
+//# sourceMappingURL=mark-tool.d.ts.map

package/dist/lib/mcp/mark-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mark-tool.d.ts","sourceRoot":"","sources":["../../../src/lib/mcp/mark-tool.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAC;AAE1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtD,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,0GAA0G;AAC1G,eAAO,MAAM,UAAU,8BAA+B,CAAC;AAoBvD,eAAO,MAAM,gBAAgB;;;;;;;;CAWnB,CAAC;AAEX,MAAM,WAAW,cAAc;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE;AACtE,MAAM,WAAW,eAAe;IAC9B,4DAA4D;IAC5D,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;CAC9B;AA+BD,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuBvJ"}

package/dist/lib/mcp/mark-tool.js

@@ -0,0 +1,103 @@
+/**
+ * LM: the MCP tool `align_mark` - the USER's judgement, recorded locally, relayed by their agent.
+ *
+ * What an agent may and may not do here:
+ * - It may record a verdict, a replacement, a "not a decision" and a note the user asked it to
+ *   record. Each row carries `via = 'mcp'` and the agent's registry id (or 'unknown'), so the
+ *   person sees later which answers came through an agent, and a share lists them separately.
+ * - It may NOT ratify. Ratifying is a person standing behind a decision; `align ratify` refuses
+ *   anything that is not a terminal. `kind: "ratify"` gets the command for the user instead.
+ * - It may NOT pass a token or key: the schema is closed.
+ * - Nothing is sent anywhere and no model is asked. The tool reads and writes the local file.
+ */
+import { applyJudgement, MarkError, MAX_CHECK_FILES, MAX_NOTE_CHARS } from '../curation/mark.js';
+import { defaultJudge } from '../curation/judge.js';
+import { agentIdFrom, cliCommandFor, jsonSchemaOf, strictInput } from './tool-rules.js';
+export const MARK_TOOL = 'align_mark';
+/** What an agent may record. Hiding a decision, declaring one replaced and ratifying are the person's. */
+export const MARK_KINDS = ['verdict', 'note'];
+const PERSON_ONLY = {
+    not_a_decision: (id) => `align mark ${id} not-a-decision`,
+    supersede: (id, other) => `align mark ${id} replaces ${other}`,
+    ratify: (id) => cliCommandFor('ratify', id),
+};
+const SPEC = {
+    tool: MARK_TOOL,
+    required: ['decision_id'],
+    properties: {
+        decision_id: { type: 'string', description: 'The decision the user is judging (its id from the check or from align_get_conflicts)', maxLength: 200 },
+        kind: { type: 'string', description: 'verdict (default) or note', enum: MARK_KINDS },
+        verdict: { type: 'string', description: 'With a verdict: real, or false (a false alarm), as the USER answered', enum: ['real', 'false'] },
+        counterpart_id: { type: 'string', description: 'A stored conflict: the other decision of the pair. ', maxLength: 200 },
+        check_files: { type: 'array', description: 'A check hit: the files the check covered, exactly as the check result listed them', maxItems: MAX_CHECK_FILES, itemMaxLength: 1024 },
+        text: { type: 'string', description: 'With note: the note', maxLength: MAX_NOTE_CHARS },
+    },
+};
+export const MARK_TOOL_SCHEMA = {
+    name: MARK_TOOL,
+    annotations: { readOnlyHint: false, destructiveHint: true },
+    description: 'Record the USER\'s judgement in the local graph on this machine. After a conflict from align_check_alignment or align_get_conflicts, ASK the user "Was that a real conflict?" and pass their answer; never decide for them. ' +
+        'For a check hit: decision_id + verdict (real or false) + check_files (the files the check covered, as the check result lists them); a false verdict hides that decision only for a later check of the same files. ' +
+        'For a stored conflict: decision_id + counterpart_id + verdict. ' +
+        'Also kind note (text: one line of plain text, 500 characters at most). ' +
+        'Each is recorded as passed on by you, under your agent name; the user sees it labelled that way, a hit you hide is shown as hidden by you, and every check says so. Nothing is shared or sent; sharing is a separate step the user confirms. ' +
+        'You cannot hide a decision (not_a_decision), mark one replaced (supersede) or ratify: those are the user\'s own acts, and asking for one returns the exact `align mark` or `align ratify` command to give them. You cannot replace a mark the user made themselves. It never takes a token or key. The user can list or undo marks with `align mark --list` and `--undo`.',
+    inputSchema: jsonSchemaOf(SPEC),
+};
+function actionFrom(input) {
+    const id = input['decision_id'];
+    const kind = input['kind'] ?? 'verdict';
+    const counterpart = input['counterpart_id'];
+    const files = input['check_files'];
+    const verdict = input['verdict'];
+    const stray = (names) => names.find((n) => input[n] !== undefined);
+    switch (kind) {
+        case 'verdict': {
+            if (verdict === undefined)
+                throw new MarkError('usage', `${MARK_TOOL} needs "verdict" (real or false) for a verdict.`);
+            if (input['text'] !== undefined)
+                throw new MarkError('usage', `${MARK_TOOL} takes "text" only with kind "note".`);
+            const hasFiles = files !== undefined && files.length > 0;
+            if ((counterpart !== undefined) === hasFiles) {
+                throw new MarkError('usage', `${MARK_TOOL} verdict takes one of two shapes: a check hit (decision_id + verdict + check_files), or a stored conflict (decision_id + counterpart_id + verdict).`);
+            }
+            return counterpart !== undefined
+                ? { action: 'conflict', a: id, b: counterpart, verdict }
+                : { action: 'check', id, verdict, files: files ?? [] };
+        }
+        default: {
+            const text = input['text'];
+            if (typeof text !== 'string' || text.trim() === '')
+                throw new MarkError('usage', `${MARK_TOOL} kind note needs "text".`);
+            const other = stray(['verdict', 'check_files', 'counterpart_id']);
+            if (other)
+                throw new MarkError('usage', `${MARK_TOOL} kind note does not take "${other}".`);
+            return { action: 'note', id, text };
+        }
+    }
+}
+export async function runMarkTool(args, env, ctx = {}) {
+    // A friendly refusal ahead of the closed enum: these are the person's acts, not typos.
+    const kind = args?.['kind'];
+    if (typeof kind === 'string' && Object.prototype.hasOwnProperty.call(PERSON_ONLY, kind)) {
+        const clip = (v) => (typeof v === 'string' && /^[\w.:-]{1,80}$/.test(v) ? v : '<id>');
+        throw new Error(`${MARK_TOOL} cannot do ${kind}: only the person can, not an agent. Ask the user to run: ${PERSON_ONLY[kind](clip(args?.['decision_id']), clip(args?.['counterpart_id']))}`);
+    }
+    const input = strictInput(SPEC, args);
+    if (env.mode !== 'local-embedded' || !env.localDbPath) {
+        throw new Error(`${MARK_TOOL} records judgements in the local graph on this machine, and this server reads a hosted Align graph. ` +
+            'Use the local Align server (align mcp --env local).');
+    }
+    const action = actionFrom(input);
+    const judge = await (ctx.judge ?? defaultJudge)();
+    try {
+        const out = applyJudgement({ dbPath: env.localDbPath, judge, origin: { via: 'mcp', agentId: agentIdFrom(ctx.clientInfo) } }, action);
+        return { recorded: true, kind: out.kind, replaced: out.replaced, text: out.text };
+    }
+    catch (e) {
+        if (e instanceof MarkError)
+            throw new Error(e.message);
+        throw e;
+    }
+}
+//# sourceMappingURL=mark-tool.js.map

package/dist/lib/mcp/mark-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mark-tool.js","sourceRoot":"","sources":["../../../src/lib/mcp/mark-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,cAAc,EAAmB,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAElH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAmB,MAAM,iBAAiB,CAAC;AAEzG,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC;AACtC,0GAA0G;AAC1G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,MAAM,CAAU,CAAC;AACvD,MAAM,WAAW,GAAoE;IACnF,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,EAAE,iBAAiB;IACzD,SAAS,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,EAAE,aAAa,KAAK,EAAE;IAC9D,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC;CAC5C,CAAC;AAEF,MAAM,IAAI,GAAe;IACvB,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,CAAC,aAAa,CAAC;IACzB,UAAU,EAAE;QACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sFAAsF,EAAE,SAAS,EAAE,GAAG,EAAE;QACpJ,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,UAAU,EAAE;QACpF,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sEAAsE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;QACzI,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qDAAqD,EAAE,SAAS,EAAE,GAAG,EAAE;QACtH,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mFAAmF,EAAE,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,IAAI,EAAE;QAChL,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE,SAAS,EAAE,cAAc,EAAE;KACxF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;IAC3D,WAAW,EACT,8NAA8N;QAC9N,oNAAoN;QACpN,iEAAiE;QACjE,yEAAyE;QACzE,+OAA+O;QAC/O,2WAA2W;IAC7W,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC;CACvB,CAAC;AASX,SAAS,UAAU,CAAC,KAA8B;IAChD,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,CAAW,CAAC;IAC1C,MAAM,IAAI,GAAI,KAAK,CAAC,MAAM,CAAwB,IAAI,SAAS,CAAC;IAChE,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,CAAuB,CAAC;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAyB,CAAC;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAiC,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,KAAe,EAAsB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACjG,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,SAAS,iDAAiD,CAAC,CAAC;YACvH,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,SAAS,sCAAsC,CAAC,CAAC;YAClH,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACzD,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,SAAS,qJAAqJ,CAAC,CAAC;YAClM,CAAC;YACD,OAAO,WAAW,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE;gBACxD,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,SAAS,0BAA0B,CAAC,CAAC;YACzH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAClE,IAAI,KAAK;gBAAE,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,SAAS,6BAA6B,KAAK,IAAI,CAAC,CAAC;YAC5F,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAyC,EAAE,GAAsB,EAAE,MAAuB,EAAE;IAC5H,uFAAuF;IACvF,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvG,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,cAAc,IAAI,6DAA6D,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/L,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,GAAG,SAAS,sGAAsG;YAClH,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,YAAY,CAAC,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACrI,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IACpF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC"}

package/dist/lib/mcp/share-status-tool.d.ts

@@ -0,0 +1,13 @@
+import type { EnvironmentConfig } from '../config.js';
+import { type ShareToolContext, type ShareToolResult } from './share-tool.js';
+export declare const SHARE_STATUS_TOOL_SCHEMA: {
+    readonly name: "align_share_status";
+    readonly annotations: {
+        readonly readOnlyHint: false;
+        readonly destructiveHint: false;
+    };
+    readonly description: string;
+    readonly inputSchema: Record<string, unknown>;
+};
+export declare function runShareStatusTool(args: Record<string, unknown> | undefined, env: EnvironmentConfig, ctx?: ShareToolContext): Promise<ShareToolResult>;
+//# sourceMappingURL=share-status-tool.d.ts.map

package/dist/lib/mcp/share-status-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-status-tool.d.ts","sourceRoot":"","sources":["../../../src/lib/mcp/share-status-tool.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAQtD,OAAO,EAA6D,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AASzI,eAAO,MAAM,wBAAwB;;;;;;;;CAU3B,CAAC;AAIX,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,GAAE,gBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CA+DhK"}

package/dist/lib/mcp/share-status-tool.js

@@ -0,0 +1,116 @@
+/**
+ * ALI-1540: the MCP tool `align_share_status` - the second half of an approved share.
+ *
+ * `align_share` stages a request and hands the person a link. This tool reads where that request stands and, ONLY
+ * when the gateway says the person approved it, sends the exact bytes that were approved (the completion call).
+ * Everything else it does is read-only: waiting, declined, expired and cancelled change nothing on the team graph.
+ *
+ * It completes at most once: the pending file is taken by an atomic rename, so a second call finds nothing to
+ * complete. Before it completes it rebuilds the share from the local graph and refuses (and cancels the request)
+ * if what would be shared changed since the person was shown it, the same rule `--confirm` applies to a code.
+ *
+ * Input: one string, the request id. No token or key can be passed.
+ */
+import { createHash } from 'node:crypto';
+import { defaultJudge } from '../curation/judge.js';
+import { defaultGatewayUrlFor } from '../config.js';
+import { completeRequest, CompletionError } from '../share/approval.js';
+import { buildPlaintext } from '../share/envelope.js';
+import { getPromotion } from '../share/ledger.js';
+import { claimRequest, combinedHash, deleteRequest, loadRequest, sweepPending } from '../share/pending.js';
+import { REQUEST_ID_RE } from '../share/requests-client.js';
+import { prepare, renderResults, send, ShareError } from '../share/run.js';
+import { visible } from '../share/visible.js';
+import { hasLogin, NO_LOGIN, resolveShareTarget, SHARE_STATUS_TOOL } from './share-tool.js';
+import { jsonSchemaOf, strictInput } from './tool-rules.js';
+const SPEC = {
+    tool: SHARE_STATUS_TOOL,
+    required: ['request_id'],
+    properties: { request_id: { type: 'string', description: 'The request_id align_share returned', maxLength: 64 } },
+};
+export const SHARE_STATUS_TOOL_SCHEMA = {
+    name: SHARE_STATUS_TOOL,
+    // It writes: once the user has approved, it completes the share, which creates or updates decisions on the team graph. It deletes nothing there.
+    annotations: { readOnlyHint: false, destructiveHint: false },
+    description: 'Check a share the user was asked to approve in their browser (from align_share), and finish it once they have. ' +
+        'It reports waiting, declined, expired or cancelled, and changes nothing in those cases. When the user HAS approved, the first call sends exactly what they approved and returns the result; a second call sends nothing. ' +
+        'A completed share stays with the team as its record, even if the user later leaves. It does not approve anything: approving is the user\'s act, in their browser, and you must not attempt it. Call it after the user says they approved, or to see whether they have. ' +
+        'It never takes a token or key.',
+    inputSchema: jsonSchemaOf(SPEC),
+};
+const minutes = (iso, now = Date.now()) => Math.max(0, Math.round((Date.parse(iso) - now) / 60000));
+export async function runShareStatusTool(args, env, ctx = {}) {
+    const input = strictInput(SPEC, args);
+    const id = input['request_id'];
+    const t = resolveShareTarget(env, ctx, SHARE_STATUS_TOOL);
+    sweepPending();
+    if (!hasLogin(t.cloudEnv))
+        return { text: NO_LOGIN(), shared: false };
+    if (!REQUEST_ID_RE.test(id))
+        return { text: 'That is not a share request id. Use the request_id align_share returned.', shared: false };
+    const rec = loadRequest(id);
+    if (rec === null)
+        return { text: 'No share is waiting under that id on this machine. It may already be finished, cancelled or expired. Call align_share again to start a new one.', shared: false, state: 'unknown' };
+    try {
+        const { state } = await t.client.getShareRequest(id);
+        const ended = (text, st) => { deleteRequest(id); return { text, shared: false, state: st }; };
+        switch (state) {
+            case 'pending': return { text: `Still waiting for the user to approve it in their browser. Code ${visible(rec.userCode)}; it expires in about ${minutes(rec.expiresAt)} minutes. Nothing has been sent. Ask the user to open the link align_share gave them.`, shared: false, state, request_id: id };
+            case 'declined': return ended('The user declined it in their browser. Nothing was sent.', state);
+            case 'expired': return ended('The request expired before it was approved. Nothing was sent. Call align_share again to start a new one.', state);
+            case 'cancelled': return ended('The request was cancelled. Nothing was sent.', state);
+            case 'failed': return ended('The gateway marked the request as failed. Nothing was sent. Call align_share again to start a new one.', state);
+            case 'completed': {
+                // Completed by this process (the answer was lost) or by another. If this machine has no ledger row for what it staged,
+                // say so: a later retract cannot find an unrecorded share, and "already completed" alone would read as fully done.
+                const unrecorded = rec.localIds.filter((l) => getPromotion(env.localDbPath, l, rec.envName, rec.tenantId) === null);
+                return ended(unrecorded.length === 0
+                    ? 'That share was already completed, and this machine has the record of it.'
+                    : 'The gateway says that share was completed (by this machine, whose answer was lost, or by another process). This machine has NO record of the result, so it is not in the local ledger and `align share --retract` cannot find it. Check the team graph. Sharing the same decision again is safe (it will not make a second copy) and records it here.', state);
+            }
+            case 'completing': return { text: 'The gateway is finishing that share now. Check again in a moment.', shared: false, state, request_id: id };
+            case 'approved': break;
+        }
+        // Approved: take the request (atomically), so two calls cannot both complete it.
+        const claim = claimRequest(id);
+        if (claim === null)
+            return { text: 'That share is already being completed or has been. Nothing more was sent by this call.', shared: false, state: 'completing', request_id: id };
+        try {
+            const shareCtx = { dbPath: env.localDbPath, envName: t.envName, client: t.client, judge: await (ctx.judge ?? defaultJudge)(), salt: t.salt, gatewayUrl: t.cloudEnv.gatewayUrl, defaultGatewayUrl: defaultGatewayUrlFor(t.envName) };
+            const prep = await prepare(shareCtx, claim.request.localIds);
+            // Rebuild what would be sent NOW and require it to be byte-for-byte what was approved, with the hash and the decisions this record names.
+            // A pending file edited to point at other decisions (or a stale copy) can never record one decision's share under another's id.
+            const rebuilt = prep.payloads.length === 0 ? null : buildPlaintext({ kind: 'share', tenantId: prep.tenantId, gatewayUrl: prep.gatewayUrl, payloads: prep.payloads });
+            const unchanged = rebuilt !== null
+                && rebuilt.equals(Buffer.from(claim.request.bytesB64, 'base64'))
+                && createHash('sha256').update(rebuilt).digest('hex') === claim.request.sha256
+                && prep.payloads.map((p) => p.localId).join('\n') === claim.request.localIds.join('\n');
+            if (prep.secrets.length || !unchanged || combinedHash(prep.payloads, prep) !== claim.request.hash || claim.request.envName !== t.envName) {
+                // What the user approved is no longer what this machine would send: do not send it.
+                await t.client.cancelShareRequest(id).catch(() => undefined);
+                claim.finish();
+                return { text: 'What would be shared, or where it would go, changed since the user was shown it, so nothing was sent and the request was cancelled. Call align_share to start again.', shared: false, state: 'changed' };
+            }
+            const response = await completeRequest(t.client, id, claim.request.bytesB64);
+            const rows = await send(shareCtx, prep, { post: async (_b, phase) => (phase === 'share' ? response : null) });
+            claim.finish();
+            const waiting = rows.some((r) => r.judgementFailures.some((f) => f.error === 'needs_confirmation'));
+            const more = waiting ? `\n\nSome of the user's judgements wait for the team's existing text to be confirmed. Tell the user to run align share ${visible(claim.request.localIds[0] ?? '<id>')} in their own terminal: they approve that second step in the browser too.` : '';
+            return { text: `Approved by the user, and sent:\n${renderResults(rows)}${more}`, shared: !rows.every((r) => r.outcome.kind === 'refused' || r.outcome.kind === 'unknown'), state: 'completed' };
+        }
+        catch (e) {
+            // No verdict from the gateway means the same bytes may be sent again; any other failure is final for this request.
+            if (e instanceof CompletionError && e.retryable)
+                claim.release();
+            else
+                claim.finish();
+            throw e;
+        }
+    }
+    catch (e) {
+        if (e instanceof ShareError)
+            throw new Error(e.message);
+        throw new Error(visible(e.message));
+    }
+}
+//# sourceMappingURL=share-status-tool.js.map

package/dist/lib/mcp/share-status-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-status-tool.js","sourceRoot":"","sources":["../../../src/lib/mcp/share-status-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC3G,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,EAAE,iBAAiB,EAA+C,MAAM,iBAAiB,CAAC;AACzI,OAAO,EAAE,YAAY,EAAE,WAAW,EAAmB,MAAM,iBAAiB,CAAC;AAE7E,MAAM,IAAI,GAAe;IACvB,IAAI,EAAE,iBAAiB;IACvB,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,UAAU,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE;CAClH,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,IAAI,EAAE,iBAAiB;IACvB,iJAAiJ;IACjJ,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;IAC5D,WAAW,EACT,iHAAiH;QACjH,2NAA2N;QAC3N,yQAAyQ;QACzQ,gCAAgC;IAClC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC;CACvB,CAAC;AAEX,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AAEpH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAyC,EAAE,GAAsB,EAAE,MAAwB,EAAE;IACpI,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,KAAK,CAAC,YAAY,CAAW,CAAC;IACzC,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC1D,YAAY,EAAE,CAAC;IACf,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,0EAA0E,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACxI,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,iJAAiJ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACtN,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAU,EAAmB,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/H,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,mEAAmE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,yBAAyB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,uFAAuF,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YACtS,KAAK,UAAU,CAAC,CAAC,OAAO,KAAK,CAAC,0DAA0D,EAAE,KAAK,CAAC,CAAC;YACjG,KAAK,SAAS,CAAC,CAAC,OAAO,KAAK,CAAC,0GAA0G,EAAE,KAAK,CAAC,CAAC;YAChJ,KAAK,WAAW,CAAC,CAAC,OAAO,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAC;YACtF,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,wGAAwG,EAAE,KAAK,CAAC,CAAC;YAC7I,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,uHAAuH;gBACvH,mHAAmH;gBACnH,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,WAAY,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;gBACrH,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;oBAClC,CAAC,CAAC,0EAA0E;oBAC5E,CAAC,CAAC,uVAAuV,EAAE,KAAK,CAAC,CAAC;YACtW,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,mEAAmE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAC9I,KAAK,UAAU,CAAC,CAAC,MAAM;QACzB,CAAC;QACD,iFAAiF;QACjF,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,wFAAwF,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAClL,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,WAAY,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACrO,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC7D,0IAA0I;YAC1I,gIAAgI;YAChI,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrK,MAAM,SAAS,GAAG,OAAO,KAAK,IAAI;mBAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;mBAC7D,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;mBAC3E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1F,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;gBACzI,oFAAoF;gBACpF,MAAM,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC7D,KAAK,CAAC,MAAM,EAAE,CAAC;gBACf,OAAO,EAAE,IAAI,EAAE,sKAAsK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAC3N,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC7E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9G,KAAK,CAAC,MAAM,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,oBAAoB,CAAC,CAAC,CAAC;YACpG,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,yHAAyH,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,2EAA2E,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7Q,OAAO,EAAE,IAAI,EAAE,oCAAoC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAClM,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,mHAAmH;YACnH,IAAI,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,SAAS;gBAAE,KAAK,CAAC,OAAO,EAAE,CAAC;;gBAAM,KAAK,CAAC,MAAM,EAAE,CAAC;YACtF,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/lib/mcp/share-tool.d.ts

@@ -0,0 +1,50 @@
+import type { EnvironmentConfig } from '../config.js';
+import type { Judge } from '../curation/judgements-db.js';
+import { type ShareClient } from '../share/run.js';
+export declare const SHARE_TOOL = "align_share";
+export declare const SHARE_STATUS_TOOL = "align_share_status";
+export declare const SHARE_TOOL_SCHEMA: {
+    readonly name: "align_share";
+    readonly annotations: {
+        readonly readOnlyHint: false;
+        readonly destructiveHint: false;
+    };
+    readonly description: string;
+    readonly inputSchema: Record<string, unknown>;
+};
+export interface ShareToolContext {
+    clientInfo?: {
+        name?: unknown;
+    };
+    judge?: () => Promise<Judge>;
+    /** Test seam: the destination and the client. Production resolves the user's default cloud env. */
+    share?: {
+        cloudEnv: EnvironmentConfig;
+        envName: string;
+        client: ShareClient;
+        salt?: string;
+        appUrl?: string;
+        label?: string;
+        teamAppUrl?: string;
+    };
+}
+export interface ShareToolResult {
+    text: string;
+    code?: string;
+    [k: string]: unknown;
+}
+export interface ShareTarget {
+    cloudEnv: EnvironmentConfig;
+    envName: string;
+    client: ShareClient;
+    salt: string;
+    appUrl: string;
+    label: string; /** Set for a team destination: the web app saved at join time. */
+    teamAppUrl?: string;
+}
+/** The local graph this server reads, and the cloud environment a share goes to. Shared with align_share_status. */
+export declare function resolveShareTarget(env: EnvironmentConfig, ctx: ShareToolContext, tool: string): ShareTarget;
+export declare const NO_LOGIN: () => string;
+export declare const hasLogin: (e: EnvironmentConfig) => boolean;
+export declare function runShareTool(args: Record<string, unknown> | undefined, env: EnvironmentConfig, ctx?: ShareToolContext): Promise<ShareToolResult>;
+//# sourceMappingURL=share-tool.d.ts.map

package/dist/lib/mcp/share-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-tool.d.ts","sourceRoot":"","sources":["../../../src/lib/mcp/share-tool.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAC;AAS1D,OAAO,EAAyC,KAAK,WAAW,EAAc,MAAM,iBAAiB,CAAC;AAItG,eAAO,MAAM,UAAU,gBAAgB,CAAC;AACxC,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAQtD,eAAO,MAAM,iBAAiB;;;;;;;;CAcpB,CAAC;AAEX,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,mGAAmG;IACnG,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,iBAAiB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACpJ;AAED,MAAM,WAAW,eAAe;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE;AAEtF,MAAM,WAAW,WAAW;IAAG,QAAQ,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,CAAC,kEAAkE;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE;AAEvO,oHAAoH;AACpH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAe3G;AAED,eAAO,MAAM,QAAQ,QAAO,MAA8G,CAAC;AAC3I,eAAO,MAAM,QAAQ,GAAI,GAAG,iBAAiB,KAAG,OAAgF,CAAC;AA0DjI,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,GAAE,gBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgC1J"}