@aligndottech/cli 0.50.0 → 0.51.0

package/dist/lib/advisory-verdict.js

@@ -1,6 +1,7 @@
 import { lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
+import { tightenFile } from './private-files.js';
 import { createHash, randomUUID } from 'node:crypto';
 /**
  * ALI-570: the store that carries an adjudication verdict from the background adjudicator
@@ -65,7 +66,8 @@ export function contentHashOf(text) {
  * each user a private %LOCALAPPDATA%\Temp - which is also why the uid falls back to a
  * constant there rather than trying to synthesise one.
  */
-function storeDir() {
+/** `<tmp>/align-<uid>`: created 0700, refused when it is a link or not ours. Also holds the advisory dedup markers. */
+export function privateTmpDir() {
     try {
         const uid = typeof process.getuid === 'function' ? String(process.getuid()) : 'win';
         const dir = path.join(tmpdir(), `align-${uid}`);
@@ -77,6 +79,7 @@ function storeDir() {
             return null;
         if (typeof process.getuid === 'function' && st.uid !== process.getuid())
             return null;
+        tightenFile(dir); // ours, but an older version may have left it wider: owner-only now
         return dir;
     }
     catch {
@@ -89,7 +92,7 @@ function storeDir() {
  * the change hash - the key has to be as specific as the thing it identifies.
  */
 function storePath(cwd, envName) {
-    const dir = storeDir();
+    const dir = privateTmpDir();
     if (!dir)
         return null;
     const hash = createHash('sha1').update(`${cwd}\0${envName}`).digest('hex').slice(0, 16);
@@ -97,7 +100,7 @@ function storePath(cwd, envName) {
 }
 /** Where the adjudication payload for one change is handed to the detached child. */
 export function adjudicationPayloadPath(contentHash) {
-    const dir = storeDir();
+    const dir = privateTmpDir();
     if (!dir)
         return null;
     return path.join(dir, `adjudicate-${contentHash.slice(0, 12)}-${randomUUID()}.json`);

package/dist/lib/advisory-verdict.js.map

@@ -1 +1 @@
-{"version":3,"file":"advisory-verdict.js","sourceRoot":"","sources":["../../src/lib/advisory-verdict.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AACzC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAE9C,oEAAoE;AACpE,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,CAAC;AAqCvB,MAAM,KAAK,GAAU,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAEnD,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,QAAQ;IACf,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACpF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,GAAG,EAAE,CAAC,CAAC;QAChD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,sFAAsF;QACtF,gFAAgF;QAChF,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1D,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QACrF,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAW,EAAE,OAAe;IAC7C,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,YAAY,IAAI,IAAI,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,QAAQ,GAAG,EAAE;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/C,0FAA0F;IAC1F,wFAAwF;IACxF,sFAAsF;IACtF,yFAAyF;IACzF,OAAO,KAAK,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,QAAQ,GAAoB;QAChC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACpC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxB,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC1B,QAAQ;KACT,CAAC;IACF,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ;QAAE,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ;QAAE,QAAQ,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACjG,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;QACX,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC9B,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC;QAC7B,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,IAAI;QACtC,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,GAAW,EAAE,OAAe;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;QAC/D,MAAM,CAAC,GAAG,MAAiC,CAAC;QAC5C,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAClC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;gBACzE,CAAC,CAAC,EAAE;YACN,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBACpC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;gBAC5E,CAAC,CAAC,EAAE;SACP,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;QACxF,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAAe,EAAE,KAAY;IAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAC1C,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,GAAW,EAAE,GAAW;IACjD,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,qFAAqF;AACrF,SAAS,MAAM,CAAC,OAAsB;IACpC,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,OAAe,EACf,UAAkB,EAClB,QAAgB,EAChB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CACjD,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,WAAW,KAAK,UAAU;QAC5B,CAAC,CAAC,QAAQ,KAAK,QAAQ;QACvB,CAAC,CAAC,WAAW;QACb,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,CACnC,CAAC;IACF,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,OAAe,EACf,OAAsB,EACtB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtC,KAAK,CAAC,QAAQ,GAAG;QACf,OAAO;QACP,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;KACpG,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAChC,+EAA+E;IAC/E,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAClC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,CAC/E,CAAC;IACF,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,OAAe,EACf,WAAmB,EACnB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,OAAe,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC1F,OAAO,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAW,EACX,OAAe,EACf,WAAmB,EACnB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtC,KAAK,CAAC,OAAO,GAAG;QACd,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE;QACxB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;KAChG,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAChC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"advisory-verdict.js","sourceRoot":"","sources":["../../src/lib/advisory-verdict.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AACzC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAE9C,oEAAoE;AACpE,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,CAAC;AAqCvB,MAAM,KAAK,GAAU,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAEnD,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,uHAAuH;AACvH,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACpF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,GAAG,EAAE,CAAC,CAAC;QAChD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,sFAAsF;QACtF,gFAAgF;QAChF,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1D,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QACrF,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,oEAAoE;QACtF,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAW,EAAE,OAAe;IAC7C,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,YAAY,IAAI,IAAI,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,QAAQ,GAAG,EAAE;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/C,0FAA0F;IAC1F,wFAAwF;IACxF,sFAAsF;IACtF,yFAAyF;IACzF,OAAO,KAAK,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,QAAQ,GAAoB;QAChC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACpC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxB,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC1B,QAAQ;KACT,CAAC;IACF,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ;QAAE,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ;QAAE,QAAQ,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACjG,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;QACX,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC9B,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC;QAC7B,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,IAAI;QACtC,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,GAAW,EAAE,OAAe;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;QAC/D,MAAM,CAAC,GAAG,MAAiC,CAAC;QAC5C,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAClC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;gBACzE,CAAC,CAAC,EAAE;YACN,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBACpC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;gBAC5E,CAAC,CAAC,EAAE;SACP,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;QACxF,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAAe,EAAE,KAAY;IAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAC1C,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,GAAW,EAAE,GAAW;IACjD,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,qFAAqF;AACrF,SAAS,MAAM,CAAC,OAAsB;IACpC,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,OAAe,EACf,UAAkB,EAClB,QAAgB,EAChB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CACjD,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,WAAW,KAAK,UAAU;QAC5B,CAAC,CAAC,QAAQ,KAAK,QAAQ;QACvB,CAAC,CAAC,WAAW;QACb,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,CACnC,CAAC;IACF,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,OAAe,EACf,OAAsB,EACtB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtC,KAAK,CAAC,QAAQ,GAAG;QACf,OAAO;QACP,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;KACpG,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAChC,+EAA+E;IAC/E,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAClC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,CAC/E,CAAC;IACF,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,OAAe,EACf,WAAmB,EACnB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,OAAe,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC1F,OAAO,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAW,EACX,OAAe,EACf,WAAmB,EACnB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtC,KAAK,CAAC,OAAO,GAAG;QACd,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE;QACxB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;KAChG,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAChC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC"}

package/dist/lib/backup-exclusion.d.ts

@@ -0,0 +1,10 @@
+export declare const CACHEDIR_TAG_SIGNATURE = "Signature: 8a477f597d28d172789f06886806bc55";
+export interface BackupDeps {
+    platform: string;
+    hasTmutil: () => boolean;
+    run: (cmd: string, args: string[]) => void;
+    writeFile?: (p: string, data: string) => void;
+}
+/** Exclude the directory holding `dbPath` from backups, once. A no-op until the graph exists. */
+export declare function excludeGraphFromBackups(dbPath: string, deps?: BackupDeps): void;
+//# sourceMappingURL=backup-exclusion.d.ts.map

package/dist/lib/backup-exclusion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-exclusion.d.ts","sourceRoot":"","sources":["../../src/lib/backup-exclusion.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,sBAAsB,gDAAgD,CAAC;AAGpF,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IAC3C,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/C;AAQD,iGAAiG;AACjG,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,UAAwB,GAAG,IAAI,CAgB5F"}

package/dist/lib/backup-exclusion.js

@@ -0,0 +1,58 @@
+/**
+ * Keep the local graph out of backups and sync, best effort.
+ *
+ * The graph holds decision text from every connector a person imported, and it is not encrypted
+ * (by design, see docs/local-mode.md). A Time Machine disk or a backup service is a second copy of
+ * it, in a place the person may not think of as theirs to protect. So, once, the directory that
+ * holds it is:
+ * - excluded from Time Machine on macOS (`tmutil addexclusion`, a sticky exclusion that follows
+ *   the folder, run only when /usr/bin/tmutil exists), and
+ * - tagged with CACHEDIR.TAG (https://bford.info/cachedir/), which borg, restic, tar and other
+ *   backup tools skip when asked to exclude caches.
+ *
+ * There is no marker-FILE convention for iCloud or Dropbox: iCloud skips items whose NAME ends in
+ * `.nosync`, which would mean renaming the user's config directory. Neither syncs the config
+ * directory by default, so nothing is written for them. Undo: `tmutil removeexclusion <dir>` and
+ * delete the tag (docs/local-mode.md); a separate `.backup-exclusion-done` marker
+ * keeps that undo from being reversed.
+ *
+ * Never fatal: every step is wrapped, and nothing here can stop a command from running.
+ */
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+export const CACHEDIR_TAG_SIGNATURE = 'Signature: 8a477f597d28d172789f06886806bc55';
+const TMUTIL = '/usr/bin/tmutil';
+const defaultDeps = {
+    platform: process.platform,
+    hasTmutil: () => fs.existsSync(TMUTIL),
+    run: (cmd, args) => { spawnSync(cmd, args, { stdio: 'ignore', timeout: 5000 }); },
+};
+/** Exclude the directory holding `dbPath` from backups, once. A no-op until the graph exists. */
+export function excludeGraphFromBackups(dbPath, deps = defaultDeps) {
+    try {
+        if (!fs.existsSync(dbPath))
+            return;
+        const dir = path.dirname(dbPath);
+        const tag = path.join(dir, 'CACHEDIR.TAG');
+        // Its own "already done" marker, not the tag: a person who deletes the tag to back the graph up again
+        // (the documented undo) must not have it, or the Time Machine exclusion, put back by the next command.
+        const done = path.join(dir, '.backup-exclusion-done');
+        if (fs.existsSync(done) || fs.existsSync(tag))
+            return;
+        try {
+            fs.writeFileSync(done, '', { mode: 0o600 });
+        }
+        catch { /* best effort */ }
+        if (deps.platform === 'darwin' && deps.hasTmutil()) {
+            try {
+                deps.run(TMUTIL, ['addexclusion', dir]);
+            }
+            catch { /* best effort */ }
+        }
+        const body = `${CACHEDIR_TAG_SIGNATURE}\n# This file marks the Align CLI local decision graph so backup tools can skip it.\n# See https://bford.info/cachedir/ and docs/local-mode.md in align-cli.\n`;
+        (deps.writeFile ?? ((p, d) => fs.writeFileSync(p, d, { mode: 0o600 })))(tag, body);
+    }
+    catch { /* best effort: never stop a command */ }
+}
+//# sourceMappingURL=backup-exclusion.js.map

package/dist/lib/backup-exclusion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-exclusion.js","sourceRoot":"","sources":["../../src/lib/backup-exclusion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,sBAAsB,GAAG,6CAA6C,CAAC;AACpF,MAAM,MAAM,GAAG,iBAAiB,CAAC;AASjC,MAAM,WAAW,GAAe;IAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;IACtC,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;CAClF,CAAC;AAEF,iGAAiG;AACjG,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,OAAmB,WAAW;IACpF,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC3C,sGAAsG;QACtG,uGAAuG;QACvG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACtD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QACtD,IAAI,CAAC;YAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,sBAAsB,gKAAgK,CAAC;QACvM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;AACrD,CAAC"}

package/dist/lib/cli-oauth.d.ts

@@ -6,6 +6,8 @@ export declare function waitForCallback(opts: {
     ports: number[];
     timeoutMs: number;
     onBound?: (port: number, nonce: string) => void | Promise<void>;
+    /** Stops the wait: the listeners close and the promise rejects. */
+    signal?: AbortSignal;
 }): Promise<CallbackResult>;
 export declare const CLI_CALLBACK_PORTS: number[];
 //# sourceMappingURL=cli-oauth.d.ts.map

package/dist/lib/cli-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-oauth.d.ts","sourceRoot":"","sources":["../../src/lib/cli-oauth.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE,GAAG,OAAO,CAAC,cAAc,CAAC,CAmE1B;AAED,eAAO,MAAM,kBAAkB,UAAiC,CAAC"}
+{"version":3,"file":"cli-oauth.d.ts","sourceRoot":"","sources":["../../src/lib/cli-oauth.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAKD,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,mEAAmE;IACnE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,cAAc,CAAC,CA0G1B;AAED,eAAO,MAAM,kBAAkB,UAAiC,CAAC"}

package/dist/lib/cli-oauth.js

@@ -1,11 +1,20 @@
 import http from 'node:http';
 import { randomBytes } from 'node:crypto';
+/** The page posts a token and a nonce: well under this. Anything larger is not it. */
+const MAX_BODY_BYTES = 8 * 1024;
 export function waitForCallback(opts) {
     return new Promise((resolve, reject) => {
-        let server;
+        let servers = [];
+        const closeAll = () => { for (const x of servers)
+            x.close(); };
         const nonce = randomBytes(16).toString('hex');
+        opts.signal?.addEventListener('abort', () => {
+            clearTimeout(timer);
+            closeAll();
+            reject(new Error('cancelled'));
+        }, { once: true });
         const timer = setTimeout(() => {
-            server?.close();
+            closeAll();
             reject(new Error('CLI OAuth timed out waiting for browser callback'));
         }, opts.timeoutMs);
         function tryPort(remaining) {
@@ -15,7 +24,7 @@ export function waitForCallback(opts) {
                 return;
             }
             const [port, ...rest] = remaining;
-            const s = http.createServer((req, res) => {
+            const onRequest = (req, res) => {
                 const origin = req.headers['origin'];
                 if (origin)
                     res.setHeader('Access-Control-Allow-Origin', origin);
@@ -31,16 +40,34 @@ export function waitForCallback(opts) {
                     res.writeHead(405).end();
                     return;
                 }
-                let body = '';
-                req.on('data', (chunk) => { body += chunk; });
+                // Any web page can POST here (a no-cors request needs no permission), so what arrives is read under a bound and a
+                // stray request is answered and ignored. Only the right nonce ends the wait.
+                const chunks = [];
+                let size = 0;
+                let tooBig = false;
+                req.on('data', (chunk) => {
+                    if (tooBig)
+                        return;
+                    size += chunk.length;
+                    if (size > MAX_BODY_BYTES) {
+                        tooBig = true;
+                        res.writeHead(413, { Connection: 'close' }).end(() => req.destroy());
+                        return;
+                    }
+                    chunks.push(chunk);
+                });
                 req.on('end', () => {
+                    if (tooBig)
+                        return;
                     let parsed;
                     try {
-                        parsed = JSON.parse(body);
+                        const v = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+                        if (typeof v !== 'object' || v === null || Array.isArray(v))
+                            throw new Error('not an object');
+                        parsed = v;
                     }
                     catch {
                         res.writeHead(400).end();
-                        reject(new Error('Invalid JSON received in CLI OAuth callback'));
                         return;
                     }
                     if (parsed['cli_nonce'] !== nonce) {
@@ -50,10 +77,11 @@ export function waitForCallback(opts) {
                     const { cli_nonce: _, ...payload } = parsed;
                     res.writeHead(200, { 'Content-Type': 'application/json' }).end('{"ok":true}');
                     clearTimeout(timer);
-                    s.close();
+                    closeAll();
                     resolve({ data: payload, port });
                 });
-            });
+            };
+            const s = http.createServer(onRequest);
             s.on('error', (err) => {
                 if (err.code === 'EADDRINUSE') {
                     tryPort(rest);
@@ -62,7 +90,30 @@ export function waitForCallback(opts) {
                 clearTimeout(timer);
                 reject(err);
             });
-            s.listen(port, () => { server = s; void opts.onBound?.(port, nonce); });
+            // 127.0.0.1, not every interface: this socket accepts a credential, and on 0.0.0.0 anyone on the LAN can dial it (ALI-1504).
+            s.listen(port, '127.0.0.1', () => {
+                // The web page posts to http://localhost, which a browser may resolve to ::1. Answer there too, or the token goes to
+                // whatever else holds ::1 on this port. A port whose ::1 side is taken is skipped whole: never half of a pair.
+                const s6 = http.createServer(onRequest);
+                s6.once('error', (err) => {
+                    if (err.code === 'EADDRINUSE') {
+                        s.close();
+                        tryPort(rest);
+                        return;
+                    }
+                    // No IPv6 loopback on this machine (a container, a disabled stack): IPv4 alone is all there is to answer on.
+                    servers = [s];
+                    if (opts.signal?.aborted) {
+                        closeAll();
+                        return;
+                    }
+                    void opts.onBound?.(port, nonce);
+                });
+                s6.listen(port, '::1', () => { servers = [s, s6]; if (opts.signal?.aborted) {
+                    closeAll();
+                    return;
+                } void opts.onBound?.(port, nonce); });
+            });
         }
         tryPort(opts.ports);
     });

package/dist/lib/cli-oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-oauth.js","sourceRoot":"","sources":["../../src/lib/cli-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C,MAAM,UAAU,eAAe,CAAC,IAI/B;IACC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAA+B,CAAC;QACpC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC,CAAC;QACxE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,SAAS,OAAO,CAAC,SAAmB;YAClC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC,CAAC;gBACrF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,SAAkC,CAAC;YAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACvC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACrC,IAAI,MAAM;oBAAE,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;gBACjE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;gBAC/D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;gBAC9D,IAAI,MAAM;oBAAE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAE5C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,GAAG,EAAE,CAAC;gBACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,IAAI,MAA+B,CAAC;oBACpC,IAAI,CAAC;wBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;oBACvD,CAAC;oBAAC,MAAM,CAAC;wBACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;wBACzB,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;wBACjE,OAAO;oBACT,CAAC;oBACD,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,KAAK,EAAE,CAAC;wBAClC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;wBACzB,OAAO;oBACT,CAAC;oBACD,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC;oBAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBAC9E,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,CAAC,CAAC,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA8B,EAAE,EAAE;gBAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC9B,OAAO,CAAC,IAAI,CAAC,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC"}
+{"version":3,"file":"cli-oauth.js","sourceRoot":"","sources":["../../src/lib/cli-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C,sFAAsF;AACtF,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AAEhC,MAAM,UAAU,eAAe,CAAC,IAM/B;IACC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,GAAkB,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAS,EAAE,GAAG,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9C,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;YAC1C,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,QAAQ,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACjC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC,CAAC;QACxE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,SAAS,OAAO,CAAC,SAAmB;YAClC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC,CAAC;gBACrF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,SAAkC,CAAC;YAC3D,MAAM,SAAS,GAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACnD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACrC,IAAI,MAAM;oBAAE,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;gBACjE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;gBAC/D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;gBAC9D,IAAI,MAAM;oBAAE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAE5C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,kHAAkH;gBAClH,6EAA6E;gBAC7E,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;gBACb,IAAI,MAAM,GAAG,KAAK,CAAC;gBACnB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBAC/B,IAAI,MAAM;wBAAE,OAAO;oBACnB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;oBACrB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;wBAC1B,MAAM,GAAG,IAAI,CAAC;wBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;wBACrE,OAAO;oBACT,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;gBACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,IAAI,MAAM;wBAAE,OAAO;oBACnB,IAAI,MAA+B,CAAC;oBACpC,IAAI,CAAC;wBACH,MAAM,CAAC,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;wBACtE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;4BAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;wBAC9F,MAAM,GAAG,CAA4B,CAAC;oBACxC,CAAC;oBAAC,MAAM,CAAC;wBACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;wBACzB,OAAO;oBACT,CAAC;oBACD,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,KAAK,EAAE,CAAC;wBAClC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;wBACzB,OAAO;oBACT,CAAC;oBACD,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC;oBAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBAC9E,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,QAAQ,EAAE,CAAC;oBACX,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;YACF,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA8B,EAAE,EAAE;gBAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC9B,OAAO,CAAC,IAAI,CAAC,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YACH,6HAA6H;YAC7H,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;gBAC/B,qHAAqH;gBACrH,+GAA+G;gBAC/G,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA8B,EAAE,EAAE;oBAClD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC9B,CAAC,CAAC,KAAK,EAAE,CAAC;wBACV,OAAO,CAAC,IAAI,CAAC,CAAC;wBACd,OAAO;oBACT,CAAC;oBACD,6GAA6G;oBAC7G,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;oBACd,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;wBAAC,QAAQ,EAAE,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBACjD,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;oBAAC,QAAQ,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3I,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC"}

package/dist/lib/config.d.ts

@@ -1,7 +1,10 @@
 import { type WrittenConfig } from './safe-config-write.js';
 import { type StoredProviderId } from './llm-providers.js';
 import type { StoredScope } from './scope-values.js';
-export type EnvName = 'local' | 'preview' | 'prod';
+import { type TeamDestinationName } from './destination-name.js';
+export type BuiltinEnv = 'local' | 'preview' | 'prod';
+/** A builtin, or the name of a team destination saved by `align join`. */
+export type EnvName = BuiltinEnv | TeamDestinationName;
 export interface EnvironmentConfig {
     gatewayUrl: string;
     authToken: string | null;
@@ -9,6 +12,13 @@ export interface EnvironmentConfig {
     ngrokUrl?: string;
     mode: 'demo' | 'auth' | 'local-embedded';
     localDbPath?: string;
+    /** 'team' for a destination saved by `align join`; absent for the three builtins. */
+    kind?: 'builtin' | 'team';
+    /** Team destinations: the web app the gateway named at join time (never guessed from the gateway URL). */
+    appUrl?: string;
+    /** Team destinations: the org name the SERVER claimed. Display only, never an identity. */
+    orgNameClaimed?: string;
+    joinedAt?: string;
 }
 /** The gateway URL an environment uses when nothing overrides it (ALIGN_GATEWAY_URL, a saved value). */
 export declare function defaultGatewayUrlFor(env: string): string;
@@ -77,11 +87,34 @@ export declare function savedLlmConfig(config: {
     provider?: string;
     model?: string;
 };
+export type LeadPromptOutcome = 'declined' | 'submitted' | 'skipped';
+export interface LeadState {
+    shownAt?: string;
+    version?: string;
+    outcome?: LeadPromptOutcome;
+    submittedAt?: string;
+}
 export declare function createConfigStore(): {
     getEnvironment(env: EnvName): EnvironmentConfig;
+    /** One write: a crash cannot leave a token saved without the gateway it belongs to. */
+    saveTeamDestination(name: string, d: {
+        gatewayUrl: string;
+        appUrl: string;
+        authToken: string;
+        tenantId: string | null;
+        orgNameClaimed?: string;
+    }, now?: Date): void;
+    /** Logout for a team destination: the entry stays so `align login --env <name>` can renew it. */
+    clearTeamToken(name: string): void;
+    getShareDestination(): string | null;
+    setShareDestination(name: string): void;
+    clearShareDestination(): void;
     setAuthToken(env: EnvName, token: string): void;
     setTenantId(env: EnvName, tenantId: string): void;
     setNgrokUrl(url: string): void;
+    /** True only for a destination `align join` saved. A builtin name is never one. */
+    hasTeamDestination(name: string): boolean;
+    listTeamDestinationNames(): string[];
     setDefaultEnv(env: EnvName): void;
     getDefaultEnv(): EnvName;
     getConnectorToken(env: EnvName, connectorKey: string): string | null;
@@ -123,6 +156,9 @@ export declare function createConfigStore(): {
     setAgent(agent: string): void;
     isLaunchOff(): boolean;
     setLaunchOff(off: boolean): void;
+    /** The saved detector choice, or undefined when none is saved (the default then applies). */
+    getDetector(): string | undefined;
+    setDetector(detector: string): void;
     clearAgent(): void;
     isBackgroundSyncOff(): boolean;
     setBackgroundSyncOff(off: boolean): void;
@@ -147,6 +183,10 @@ export declare function createConfigStore(): {
     } | undefined;
     getTelemetryNoticeShownAt(): string | undefined;
     markTelemetryNoticeShown(): void;
+    getLeadState(): LeadState;
+    markLeadPromptShown(version: string, now?: Date): void;
+    setLeadOutcome(outcome: LeadPromptOutcome, now?: Date): void;
+    clearLeadPromptShown(): void;
     getProviderKey(provider: GuidedProviderKey): string | null;
     setProviderKey(provider: GuidedProviderKey, key: string): void;
     clearProviderKey(provider: GuidedProviderKey): void;

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAe,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAElE,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAQD,wGAAwG;AACxG,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAA4B,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;AAE9D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAM3E;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAEjD,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAAG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAEpE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IACrC,cAAc,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3D,gBAAgB,IAAI,aAAa,CAAC;CACnC,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAO1F;AAED,wBAAgB,iBAAiB;wBAgDT,OAAO,GAAG,iBAAiB;sBAc7B,OAAO,SAAS,MAAM;qBAIvB,OAAO,YAAY,MAAM;qBAIzB,MAAM;uBAIJ,OAAO;qBACT,OAAO;2BACD,OAAO,gBAAgB,MAAM,GAAG,MAAM,GAAG,IAAI;2BAI7C,OAAO,gBAAgB,MAAM,SAAS,MAAM;IAInE;;;;;OAKG;4BACqB,OAAO,gBAAgB,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;6BAY5D,OAAO,gBAAgB,MAAM,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAYtF,iGAAiG;yBAC5E,OAAO,gBAAgB,MAAM;IAWlD,6FAA6F;6BACpE,OAAO;6BAOP,OAAO,gBAAgB,MAAM,GAAG,MAAM,GAAG,IAAI;6BAI7C,OAAO,gBAAgB,MAAM,WAAW,MAAM;8BAI7C,OAAO,gBAAgB,MAAM,GAAG,MAAM,GAAG,IAAI;8BAI7C,OAAO,gBAAgB,MAAM,YAAY,MAAM;IAIzE;;;;;OAKG;2BAIoB,OAAO,gBAAgB,MAAM,GAAG,WAAW,GAAG,IAAI;2BAmBlD,OAAO,gBAAgB,MAAM,SAAS,WAAW;6BAG/C,OAAO,gBAAgB,MAAM;oCAMtB,MAAM,GAAG,IAAI;gCAKjB,MAAM,EAAE;iCAIP,MAAM,YAAY,MAAM,GAAG,OAAO;mCAGhC,MAAM,YAAY,MAAM,GAAG,IAAI;yBAKzC,MAAM;;eAWhB,OAAO;oBAQF,MAAM;gBASV,MAAM,GAAG,SAAS;oBAGd,MAAM;mBAOP,OAAO;sBAGJ,OAAO;;2BAQF,OAAO;8BAGJ,OAAO;iCAKJ,OAAO;sCAGF,MAAM;4BAIhB,MAAM,GAAG,SAAS;4BAGlB,MAAM;yBAMT,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;8BAKxB,MAAM,SAAS,aAAa;IAItD,kFAAkF;8BACxD,MAAM,EAAE;0BAQZ,MAAM,GAAG,OAAO;6BAGb,MAAM;;2BAOR,MAAM;2BAIN,gBAAgB,GAAG,SAAS;+BAIxB,gBAAgB;8BAQjB,MAAM,QAAO,IAAI;4BAMnB;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;iCAOlC,MAAM,GAAG,SAAS;gCAGnB,IAAI;6BAOP,iBAAiB,GAAG,MAAM,GAAG,IAAI;6BAGjC,iBAAiB,OAAO,MAAM;+BAO5B,iBAAiB;wBAOxB,aAAa;2BAGV,aAAa;;8BAQV,OAAO;uCAGE,OAAO;kCAOZ,MAAM,GAAG,OAAO;4BAMtB,MAAM,GAAG,OAAO;8BAQd,MAAM,GAAG,OAAO;mCAMX,MAAM,GAAG,IAAI;EAK/C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAe,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EAAqB,KAAK,mBAAmB,EAA2B,MAAM,uBAAuB,CAAC;AAI7G,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AACtD,0EAA0E;AAC1E,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,mBAAmB,CAAC;AAEvD,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,IAAI,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC1B,0GAA0G;IAC1G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAQD,wGAAwG;AACxG,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAA4B,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;AAE9D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQ3E;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAEjD,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAAG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAEpE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE;IACrC,cAAc,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3D,gBAAgB,IAAI,aAAa,CAAC;CACnC,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAO1F;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AACrE,MAAM,WAAW,SAAS;IAAG,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE;AAEpH,wBAAgB,iBAAiB;wBAiET,OAAO,GAAG,iBAAiB;IAyB/C,uFAAuF;8BAE/E,MAAM,KACT;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,QACzG,IAAI;IAgBX,iGAAiG;yBAC5E,MAAM;2BAKJ,MAAM,GAAG,IAAI;8BAIV,MAAM;;sBAOd,OAAO,SAAS,MAAM;qBAIvB,OAAO,YAAY,MAAM;qBAIzB,MAAM;IAIvB,mFAAmF;6BAC1D,MAAM,GAAG,OAAO;gCAGb,MAAM,EAAE;uBAGjB,OAAO;qBACT,OAAO;2BACD,OAAO,gBAAgB,MAAM,GAAG,MAAM,GAAG,IAAI;2BAI7C,OAAO,gBAAgB,MAAM,SAAS,MAAM;IAInE;;;;;OAKG;4BACqB,OAAO,gBAAgB,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;6BAY5D,OAAO,gBAAgB,MAAM,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAYtF,iGAAiG;yBAC5E,OAAO,gBAAgB,MAAM;IAWlD,6FAA6F;6BACpE,OAAO;6BAOP,OAAO,gBAAgB,MAAM,GAAG,MAAM,GAAG,IAAI;6BAI7C,OAAO,gBAAgB,MAAM,WAAW,MAAM;8BAI7C,OAAO,gBAAgB,MAAM,GAAG,MAAM,GAAG,IAAI;8BAI7C,OAAO,gBAAgB,MAAM,YAAY,MAAM;IAIzE;;;;;OAKG;2BAIoB,OAAO,gBAAgB,MAAM,GAAG,WAAW,GAAG,IAAI;2BAmBlD,OAAO,gBAAgB,MAAM,SAAS,WAAW;6BAG/C,OAAO,gBAAgB,MAAM;oCAMtB,MAAM,GAAG,IAAI;gCAKjB,MAAM,EAAE;iCAIP,MAAM,YAAY,MAAM,GAAG,OAAO;mCAGhC,MAAM,YAAY,MAAM,GAAG,IAAI;yBAKzC,MAAM;;eAWhB,OAAO;oBASF,MAAM;gBASV,MAAM,GAAG,SAAS;oBAGd,MAAM;mBAOP,OAAO;sBAGJ,OAAO;IAIzB,6FAA6F;mBAC9E,MAAM,GAAG,SAAS;0BAGX,MAAM;;2BAOL,OAAO;8BAGJ,OAAO;iCAKJ,OAAO;sCAGF,MAAM;4BAIhB,MAAM,GAAG,SAAS;4BAGlB,MAAM;yBAMT,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;8BAKxB,MAAM,SAAS,aAAa;IAItD,kFAAkF;8BACxD,MAAM,EAAE;0BAQZ,MAAM,GAAG,OAAO;6BAGb,MAAM;;2BAOR,MAAM;2BAIN,gBAAgB,GAAG,SAAS;+BAIxB,gBAAgB;8BAQjB,MAAM,QAAO,IAAI;4BAMnB;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;iCAOlC,MAAM,GAAG,SAAS;gCAGnB,IAAI;oBAKhB,SAAS;iCAQI,MAAM,QAAO,IAAI,GAAgB,IAAI;4BAK1C,iBAAiB,QAAO,IAAI,GAAgB,IAAI;4BAIhD,IAAI;6BASH,iBAAiB,GAAG,MAAM,GAAG,IAAI;6BAGjC,iBAAiB,OAAO,MAAM;+BAO5B,iBAAiB;wBAOxB,aAAa;2BAGV,aAAa;;8BAQV,OAAO;uCAGE,OAAO;kCAOZ,MAAM,GAAG,OAAO;4BAMtB,MAAM,GAAG,OAAO;8BAQd,MAAM,GAAG,OAAO;mCAMX,MAAM,GAAG,IAAI;EAK/C"}

package/dist/lib/config.js

@@ -4,6 +4,9 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { mergeWrittenConfig } from './safe-config-write.js';
 import { STORABLE_PROVIDERS } from './llm-providers.js';
+import { asDestinationName, validateDestinationName } from './destination-name.js';
+import { assertTransport } from './destination-trust.js';
+import { ensurePrivateDir, tightenFile } from './private-files.js';
 const DEFAULTS = {
     local: { gatewayUrl: 'http://localhost:8080', authToken: null, tenantId: null, mode: 'demo' },
     preview: { gatewayUrl: 'https://api.preview.align.tech', authToken: null, tenantId: null, mode: 'auth' },
@@ -51,8 +54,10 @@ export function migrateConfigDirectory(oldDir, newDir) {
     const newFile = path.join(newDir, 'config.json');
     if (fs.existsSync(newFile) || !fs.existsSync(oldFile))
         return;
-    fs.mkdirSync(newDir, { recursive: true });
+    // copyFileSync carries the old file's mode across, so the copy is tightened (it holds tokens).
+    ensurePrivateDir(newDir);
     fs.copyFileSync(oldFile, newFile);
+    tightenFile(newFile);
 }
 /**
  * Saved provider keys and the saved preference, as data for local-llm's setSavedLlmSource.
@@ -84,14 +89,38 @@ export function createConfigStore() {
         // rather than ordinary config. 0600 is also what the setup copy promises the user.
         configFileMode: 0o600,
     });
+    // configFileMode applies when conf WRITES the file, and conf creates the directory 0755. Re-check
+    // both on every open, so a file an older version wrote 0644 is tightened before anything reads it.
+    // `path` is absent only on a test double of conf.
+    if (typeof store.path === 'string') {
+        ensurePrivateDir(path.dirname(store.path));
+        tightenFile(store.path);
+    }
     const getEnvs = () => store.get('environments');
     const getTokens = () => store.get('connectorTokens');
+    // A team destination is a saved entry of kind team under a VALID name. The name check is what keeps a hand-edited key
+    // such as `a;b` from ever reaching a command line this CLI prints (envFlag) or a `--env` an agent config stores.
+    const isTeam = (name) => Object.hasOwn(getEnvs(), name) && getEnvs()[name]?.kind === 'team' && validateDestinationName(name) === null;
     // Extra fields (an Atlassian email, a GitLab domain) live beside the token under a `field:`
     // segment. The OAuth path already writes `<env>:<key>:cloudId` and `:siteBase` in this same
     // map, and the segment is what stops a connector field of either name colliding with them.
     const fieldPrefix = (env, connectorKey) => `${env}:${connectorKey}:field:`;
     return {
         getEnvironment(env) {
+            // A team destination is exactly what `align join` stored. No builtin defaults, and none of
+            // the ALIGN_* overrides below: those exist for CI and self-hosts of the builtins, and on a
+            // named destination they would let the shell redirect a saved token to another server (S4, S5).
+            if (!Object.hasOwn(DEFAULTS, env)) {
+                const saved = isTeam(env) ? getEnvs()[env] : undefined;
+                if (saved === undefined)
+                    throw new Error(`Unknown environment "${String(env).slice(0, 40)}"`);
+                // The file is a person's to edit: the transport rule is re-checked on READ, so a hand-written plain-http gateway is unusable, not trusted.
+                if (saved.gatewayUrl)
+                    assertTransport(saved.gatewayUrl);
+                if (saved.appUrl)
+                    assertTransport(saved.appUrl);
+                return { authToken: null, tenantId: null, mode: 'auth', ...saved };
+            }
             const base = { ...DEFAULTS[env], ...(getEnvs()[env] ?? {}) };
             // Env var overrides - useful for CI and self-hosted deployments
             if (!base.authToken && process.env['ALIGN_TOKEN']) {
@@ -105,6 +134,41 @@ export function createConfigStore() {
             }
             return base;
         },
+        /** One write: a crash cannot leave a token saved without the gateway it belongs to. */
+        saveTeamDestination(name, d, now = new Date()) {
+            const valid = asDestinationName(name);
+            if (!d.authToken)
+                throw new Error('saveTeamDestination: needs a non-empty token');
+            const entry = {
+                kind: 'team',
+                mode: 'auth',
+                gatewayUrl: assertTransport(d.gatewayUrl),
+                appUrl: assertTransport(d.appUrl),
+                authToken: d.authToken,
+                tenantId: d.tenantId,
+                joinedAt: now.toISOString(),
+                ...(d.orgNameClaimed === undefined ? {} : { orgNameClaimed: d.orgNameClaimed }),
+            };
+            store.set('environments', { ...getEnvs(), [valid]: entry });
+        },
+        /** Logout for a team destination: the entry stays so `align login --env <name>` can renew it. */
+        clearTeamToken(name) {
+            const envs = getEnvs();
+            if (!isTeam(name))
+                return;
+            store.set('environments', { ...envs, [name]: { ...envs[name], authToken: null } });
+        },
+        getShareDestination() {
+            const n = store.get('shareDestination');
+            return typeof n === 'string' && isTeam(n) ? n : null;
+        },
+        setShareDestination(name) {
+            if (!isTeam(name)) {
+                throw new Error(`"${name.slice(0, 40)}" is not a saved team destination`);
+            }
+            store.set('shareDestination', name);
+        },
+        clearShareDestination() { store.delete('shareDestination'); },
         setAuthToken(env, token) {
             const envs = getEnvs();
             store.set('environments', { ...envs, [env]: { ...(envs[env] ?? {}), authToken: token } });
@@ -117,6 +181,13 @@ export function createConfigStore() {
             const envs = getEnvs();
             store.set('environments', { ...envs, local: { ...(envs['local'] ?? {}), ngrokUrl: url } });
         },
+        /** True only for a destination `align join` saved. A builtin name is never one. */
+        hasTeamDestination(name) {
+            return isTeam(name);
+        },
+        listTeamDestinationNames() {
+            return Object.keys(getEnvs()).filter(isTeam).sort();
+        },
         setDefaultEnv(env) { store.set('defaultEnv', env); },
         getDefaultEnv() { return store.get('defaultEnv'); },
         getConnectorToken(env, connectorKey) {
@@ -268,6 +339,8 @@ export function createConfigStore() {
             const envs = getEnvs();
             const { [env]: _, ...rest } = envs;
             store.set('environments', rest);
+            if (store.get('shareDestination') === env)
+                store.delete('shareDestination');
         },
         // ALI-618: global to the machine's install, not per-environment - unlike authToken/tenantId,
         // an anonymous local-mode user has no account for either to belong to. Generated once and
@@ -301,6 +374,13 @@ export function createConfigStore() {
             else
                 store.delete('launchOff');
         },
+        /** The saved detector choice, or undefined when none is saved (the default then applies). */
+        getDetector() {
+            return store.get('detector');
+        },
+        setDetector(detector) {
+            store.set('detector', detector);
+        },
         clearAgent() {
             store.delete('agent');
         },
@@ -399,6 +479,31 @@ export function createConfigStore() {
             if (!store.get('telemetryNoticeShownAt'))
                 store.set('telemetryNoticeShownAt', new Date().toISOString());
         },
+        // The optional work-email prompt at the share moment (lib/lead-prompt.ts). NOT telemetry, so its
+        // state is its own keys. Only timestamps and an outcome word live here, never the address.
+        getLeadState() {
+            return {
+                shownAt: store.get('leadPromptShownAt'),
+                version: store.get('leadPromptVersion'),
+                outcome: store.get('leadPromptOutcome'),
+                submittedAt: store.get('leadEmailSubmittedAt'),
+            };
+        },
+        markLeadPromptShown(version, now = new Date()) {
+            store.set('leadPromptShownAt', now.toISOString());
+            store.set('leadPromptVersion', version);
+            store.set('leadPromptOutcome', 'skipped');
+        },
+        setLeadOutcome(outcome, now = new Date()) {
+            store.set('leadPromptOutcome', outcome);
+            if (outcome === 'submitted')
+                store.set('leadEmailSubmittedAt', now.toISOString());
+        },
+        clearLeadPromptShown() {
+            store.delete('leadPromptShownAt');
+            store.delete('leadPromptVersion');
+            store.delete('leadPromptOutcome');
+        },
         // ALI-1284: the key `align setup`'s guided free-tier path collected, persisted the same
         // way a local connector's read-only token already is (saveConnectorFields above) - one
         // paste, reused on every later invocation. savedLlmConfig hands it to local-llm as data;