@aligndottech/cli 0.50.0 → 0.52.0

package/dist/lib/join-flow.d.ts

@@ -0,0 +1,60 @@
+/**
+ * `align join <link>`: save a team's server as a named destination, additively.
+ *
+ * The link is a claim, not an instruction. Everything that decides where a credential goes is
+ * checked against the gateway's own answer BEFORE a browser opens, and the person confirms the
+ * host when it is not Align's. Nothing already saved is moved, archived or expired: the new token
+ * is minted by the server for this machine only, verified with one request, and only then stored.
+ * Join plan: thoughts/shared/plans/2026-10-10-org-invite-join-destination.md (attacks S1-S10).
+ */
+import type { CallbackResult } from './cli-oauth.js';
+import type { createConfigStore } from './config.js';
+type ConfigStore = ReturnType<typeof createConfigStore>;
+export interface JoinDeps {
+    config: Pick<ConfigStore, 'hasTeamDestination' | 'saveTeamDestination' | 'getShareDestination' | 'setShareDestination' | 'getEnvironment'>;
+    /** stdin AND stdout are terminals. Joining is a person's act: it never runs without one. */
+    isTTY: boolean;
+    /** Inside an agent align launched (ALIGN_WRAPPED). Such a process is not the person, so it cannot join. */
+    wrapped: boolean;
+    out(line: string): void;
+    openUrl(url: string): Promise<boolean>;
+    /** One line typed by the person, or null if they cancelled. Only called on a terminal. */
+    promptLine(question: string): Promise<string | null>;
+    confirm(question: string): Promise<boolean>;
+    waitForCallback(opts: {
+        ports: number[];
+        timeoutMs: number;
+        onBound?: (port: number, nonce: string) => void | Promise<void>;
+    }): Promise<CallbackResult>;
+    now(): Date;
+    callbackPorts: number[];
+    timeoutMs: number;
+}
+export interface JoinInput {
+    link: string;
+    gateway?: string;
+    name?: string;
+    replace?: boolean;
+}
+export type JoinResult = {
+    ok: true;
+    name: string;
+    expiresAt?: string;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function runJoin(deps: JoinDeps, input: JoinInput): Promise<JoinResult>;
+export interface VerifiedIdentity {
+    email: string;
+    tenantId: string;
+    tenantName: string;
+}
+/**
+ * "Verified" means the gateway answered /auth/me like an Align gateway would, with this token and no other, not that it said 2xx.
+ * Every field that is saved or printed is checked for type and shape first, so a hostile server cannot save an object as a tenant
+ * id or put escape sequences on the person's screen. Anything else is a string saying why, and nothing is saved.
+ */
+export declare function verifyToken(gatewayUrl: string, token: string): Promise<VerifiedIdentity | string>;
+export {};
+//# sourceMappingURL=join-flow.d.ts.map

package/dist/lib/join-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"join-flow.d.ts","sourceRoot":"","sources":["../../src/lib/join-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKrD,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAExD,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,oBAAoB,GAAG,qBAAqB,GAAG,qBAAqB,GAAG,qBAAqB,GAAG,gBAAgB,CAAC,CAAC;IAC3I,4FAA4F;IAC5F,KAAK,EAAE,OAAO,CAAC;IACf,2GAA2G;IAC3G,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,0FAA0F;IAC1F,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,eAAe,CAAC,IAAI,EAAE;QACpB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACjE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,GAAG,IAAI,IAAI,CAAC;IACZ,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAUxG,wBAAsB,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CA6GnF;AAwGD,MAAM,WAAW,gBAAgB;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAKzF;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,MAAM,CAAC,CAevG"}

package/dist/lib/join-flow.js

@@ -0,0 +1,282 @@
+import { createGatewayClient } from './gateway-client.js';
+import { validateDestinationName } from './destination-name.js';
+import { assertTransport, describeHost, needsTypeBack, parseJoinLink, slugOrgName, TransportError } from './destination-trust.js';
+import { visible } from './share/visible.js';
+const PEEK_MAX_BYTES = 16 * 1024;
+const ORG_NOTE = 'chosen by that organisation, not verified by Align';
+const PEEK_TIMEOUT_MS = 10_000;
+const ORG_NAME_MAX = 100;
+const TOKEN_SHAPE = /^[\x21-\x7e]{8,512}$/;
+export async function runJoin(deps, input) {
+    const refuse = (reason) => {
+        deps.out(`\nNothing was saved and no browser was opened.\n  ${reason}\n`);
+        return { ok: false, reason };
+    };
+    // After the browser step: a browser WAS opened, and if the server already issued a token it is still live there. Say both.
+    const refuseLate = (reason, issued) => {
+        const live = issued
+            ? `\n  ${issued.host} issued a token to this computer and it was not saved. It stays valid until ${issued.expiresAt ? issued.expiresAt.slice(0, 10) : 'it expires'} (or until the organisation's admin revokes the invite); nothing here can revoke it.`
+            : '';
+        deps.out(`\nNothing was saved. A browser was opened.\n  ${reason}${live}\n`);
+        return { ok: false, reason };
+    };
+    // First, before any request: a join gives a server a credential and a place to send shares, so it is a person's act, at a
+    // terminal of their own. An agent (or a script) that has been handed a link must not be able to finish it, whichever host
+    // the link names, and the refusal says nothing about a way around it.
+    if (deps.wrapped)
+        return refuse('align join has to be run by you, in your own terminal, not from inside an agent.');
+    if (!deps.isTTY)
+        return refuse('align join needs a terminal: both input and output must be a terminal, so a person answers the questions.');
+    let link;
+    try {
+        link = parseJoinLink(input.link, input.gateway === undefined ? {} : { gateway: input.gateway });
+    }
+    catch (e) {
+        return refuse(e instanceof TransportError ? e.message : 'That link could not be read.');
+    }
+    const gwHost = new URL(link.gatewayUrl).host;
+    if (input.name !== undefined) {
+        const bad = validateDestinationName(input.name);
+        if (bad)
+            return refuse(`The name "${visible(input.name.slice(0, 40))}" cannot be used: ${bad}.`);
+    }
+    const peeked = await peek(link.gatewayUrl, link.token);
+    if (typeof peeked === 'string')
+        return refuse(peeked);
+    // The gateway's own account of itself has to match the link, or the link is lying about one of them.
+    let peekApp;
+    try {
+        peekApp = assertTransport(peeked.appUrl);
+    }
+    catch (e) {
+        return refuse(`The server's web app address is not acceptable: ${e.message}`);
+    }
+    const peekAppHost = new URL(peekApp).host;
+    if (peekAppHost !== link.appHost) {
+        return refuse(`The link points at the web app ${link.appHost}, but ${gwHost} says its web app is ${peekAppHost}. Both are shown so you can see which to trust; neither was used.`);
+    }
+    if (peeked.gatewayClaim !== undefined && peeked.gatewayClaim !== link.gatewayUrl) {
+        return refuse(`The link names the server ${gwHost}, but that server says it is ${new URL(peeked.gatewayClaim).host}. Neither was used.`);
+    }
+    // A gateway that wrote gw= into the link also reports its own address when asked. An answer with none, to a link that carried one, is not that gateway.
+    if (peeked.gatewayClaim === undefined && link.gatewayFromLink) {
+        return refuse(`The link names the server ${gwHost}, but that server did not say it is the one that made the link. Ask for a new link.`);
+    }
+    const claimed = visible(peeked.orgName).slice(0, ORG_NAME_MAX);
+    const gwShown = describeHost(gwHost);
+    const appShown = describeHost(peekAppHost);
+    deps.out('\nJoining a team graph');
+    deps.out(`  Gateway:  ${gwShown.text}`);
+    deps.out(`  Web app:  ${appShown.text}`);
+    deps.out(`  Org:      "${claimed || '(no name given)'}" (${ORG_NOTE})`);
+    for (const w of new Set([gwShown.warning, appShown.warning]))
+        if (w)
+            deps.out(`  Warning:  ${w}`);
+    const hostTyped = { done: false };
+    if (needsTypeBack(gwHost, peekAppHost)) {
+        const typed = await typeBack(deps, gwHost);
+        if (typed === null || typed.trim().toLowerCase() !== gwHost)
+            return refuse(`That is not ${gwHost}, so nothing was done.`);
+        hostTyped.done = true;
+    }
+    else {
+        // An Align address does not make the org name Align's: any hosted org picks its own name and can issue invites.
+        const yes = await deps.promptLine(`Join "${claimed}" at ${gwHost}? The name is ${ORG_NOTE}. Type y to continue: `);
+        if (yes === null || !/^y(es)?$/i.test(yes.trim()))
+            return refuse('You did not answer y, so nothing was done.');
+    }
+    const derived = input.name ?? slugOrgName(claimed);
+    if (!derived)
+        return refuse('Could not make a name from the org name. Choose one with --name <name>.');
+    const name = derived;
+    if (deps.config.hasTeamDestination(name)) {
+        if (!input.replace)
+            return refuse(`You already have a destination called "${name}". Use --replace to replace it, or --name <other> to keep both.`);
+        const refusal = await confirmReplace(deps, name, gwHost, claimed, hostTyped.done);
+        if (refusal)
+            return refuse(refusal);
+    }
+    const received = await receive(deps, link.token, peekApp, link.gatewayUrl);
+    if (typeof received === 'string')
+        return refuseLate(received);
+    const me = await verifyToken(link.gatewayUrl, received.token);
+    if (typeof me === 'string')
+        return refuseLate(`${gwHost} ${me}`, { host: gwHost, ...(received.expiresAt ? { expiresAt: received.expiresAt } : {}) });
+    const tenantName = visible(me.tenantName).slice(0, ORG_NAME_MAX);
+    if (tenantName.trim() !== claimed.trim()) {
+        deps.out(`\n  Heads up: the invite said "${claimed}" but you are signed in to "${tenantName}". Both come from ${gwHost}, so neither proves who runs it.`);
+    }
+    deps.config.saveTeamDestination(name, {
+        gatewayUrl: link.gatewayUrl,
+        appUrl: peekApp,
+        authToken: received.token,
+        tenantId: me.tenantId,
+        orgNameClaimed: claimed,
+    }, deps.now());
+    await chooseShareDestination(deps, name, claimed, gwHost);
+    deps.out(`\nJoined as "${name}" (${visible(me.email)}, ${tenantName}).`);
+    if (received.expiresAt)
+        deps.out(`  This access expires on ${received.expiresAt.slice(0, 10)}. Renew it with: align login --env ${name}`);
+    deps.out(`  Use it with: align <command> --env ${name}`);
+    return received.expiresAt ? { ok: true, name, expiresAt: received.expiresAt } : { ok: true, name };
+}
+/** Replacing a destination points a saved name at a server a person has not used under that name. Never silent. */
+async function confirmReplace(deps, name, newHost, claimed, hostAlreadyTyped) {
+    let oldHost = '(unknown)';
+    try {
+        oldHost = new URL(deps.config.getEnvironment(name).gatewayUrl).host;
+    }
+    catch { /* unreadable entry: shown as unknown */ }
+    deps.out(`\n  Replacing "${name}":  ${describeHost(oldHost).text}  ->  ${describeHost(newHost).text}`);
+    if (!hostAlreadyTyped) {
+        const typed = await deps.promptLine('Type the new gateway host to confirm the replacement: ');
+        if (typed === null || typed.trim().toLowerCase() !== newHost)
+            return `That is not ${newHost}, so "${name}" was not replaced.`;
+    }
+    if (deps.config.getShareDestination() === name) {
+        const ok = await deps.confirm(`"${name}" is where "align share" sends decisions. Send them to "${claimed}" at ${newHost} instead?`);
+        if (!ok)
+            return `"${name}" was not replaced: it is where your shares go, and you did not agree to move them.`;
+    }
+    return null;
+}
+async function typeBack(deps, gwHost) {
+    deps.out(`\n  ${gwHost} is not an Align address. If you did not expect this link, stop here.`);
+    return deps.promptLine('Type the gateway host to confirm: ');
+}
+/** Reads at most `max` bytes, and stops reading (cancels the stream) the moment it would pass that. Null when the body is too big. */
+async function readCapped(res, max) {
+    const reader = res.body?.getReader();
+    if (!reader)
+        return '';
+    const parts = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > max) {
+            await reader.cancel().catch(() => undefined);
+            return null;
+        }
+        parts.push(value);
+    }
+    return Buffer.concat(parts).toString('utf8');
+}
+async function peek(gatewayUrl, token) {
+    const host = new URL(gatewayUrl).host;
+    let res;
+    try {
+        res = await fetch(`${gatewayUrl}/auth/invite-peek?token=${encodeURIComponent(token)}`, {
+            headers: { accept: 'application/json' },
+            redirect: 'error',
+            signal: AbortSignal.timeout(PEEK_TIMEOUT_MS),
+        });
+    }
+    catch {
+        return `Could not reach ${host}.`;
+    }
+    if (res.status === 404)
+        return 'That invite was not found. It may have expired, been used, or been revoked. Ask for a new link.';
+    if (!res.ok)
+        return `${host} answered ${res.status} when asked about the invite.`;
+    let body;
+    try {
+        const text = await readCapped(res, PEEK_MAX_BYTES);
+        if (text === null)
+            return `${host} sent an unexpectedly large answer.`;
+        body = JSON.parse(text);
+    }
+    catch {
+        return `${host} did not answer with an invite description.`;
+    }
+    const b = body;
+    if (typeof b !== 'object' || b === null)
+        return `${host} did not answer with an invite description.`;
+    if (typeof b.app_url !== 'string' || b.app_url === '') {
+        return `${host} did not say where its web app is. It may be too old to join from the CLI; ask its admin to update it.`;
+    }
+    let gatewayClaim;
+    if (b.gateway_url !== undefined) {
+        if (typeof b.gateway_url !== 'string')
+            return `${host} sent a malformed server address.`;
+        try {
+            gatewayClaim = assertTransport(b.gateway_url);
+        }
+        catch (e) {
+            return `The server address ${host} reports is not acceptable: ${e.message}`;
+        }
+    }
+    return { orgName: typeof b.org_name === 'string' ? b.org_name : '', appUrl: b.app_url, gatewayClaim };
+}
+async function receive(deps, token, appUrl, gatewayUrl) {
+    let result;
+    try {
+        result = await deps.waitForCallback({
+            ports: deps.callbackPorts,
+            timeoutMs: deps.timeoutMs,
+            onBound: async (port, nonce) => {
+                // cli_gw: the gateway THIS CLI validated. The web app is the one party that knows its own gateway, so it can refuse a
+                // link whose gw= was swapped for another server's, which no check on this side can tell from the real one.
+                const url = `${appUrl}/join?token=${token}&cli_port=${port}&cli_nonce=${nonce}&cli_gw=${encodeURIComponent(gatewayUrl)}`;
+                deps.out(`\nOpening your browser at:\n  ${url}`);
+                if (!(await deps.openUrl(url)))
+                    deps.out('  Could not open a browser here. Open that link yourself.');
+                deps.out('Waiting for you to approve in the browser (5 min)...');
+            },
+        });
+    }
+    catch (e) {
+        return `No approval arrived: ${e.message}.`;
+    }
+    const t = result.data['token'];
+    if (typeof t !== 'string' || !TOKEN_SHAPE.test(t))
+        return 'The browser sent back no usable token. Run the command again.';
+    const raw = result.data['expires_at'];
+    let expiresAt;
+    if (typeof raw === 'string' && !Number.isNaN(Date.parse(raw)))
+        expiresAt = new Date(raw).toISOString();
+    return expiresAt ? { token: t, expiresAt } : { token: t };
+}
+const ID_SHAPE = /^[\x21-\x7e]{1,128}$/;
+const EMAIL_SHAPE = /^[^\s\p{C}]{3,254}$/u;
+/**
+ * "Verified" means the gateway answered /auth/me like an Align gateway would, with this token and no other, not that it said 2xx.
+ * Every field that is saved or printed is checked for type and shape first, so a hostile server cannot save an object as a tenant
+ * id or put escape sequences on the person's screen. Anything else is a string saying why, and nothing is saved.
+ */
+export async function verifyToken(gatewayUrl, token) {
+    let raw;
+    try {
+        raw = await createGatewayClient({ gatewayUrl, authToken: token, tenantId: null, mode: 'auth' }).whoami();
+    }
+    catch (e) {
+        return `did not accept the new token (${visible(String(e.message).slice(0, 120))}).`;
+    }
+    const r = raw;
+    const email = r?.user?.email;
+    const id = r?.tenant?.id;
+    const name = r?.tenant?.name;
+    if (typeof email !== 'string' || !EMAIL_SHAPE.test(email) || typeof id !== 'string' || !ID_SHAPE.test(id) || typeof name !== 'string') {
+        return 'answered, but not the way an Align gateway answers who you are. The token was not saved.';
+    }
+    return { email, tenantId: id, tenantName: name };
+}
+async function chooseShareDestination(deps, name, claimed, gwHost) {
+    const current = deps.config.getShareDestination();
+    // Where shares go is a decision about where decisions are sent, so it is made by a yes at this terminal and never by default.
+    // (A replace of the share destination was already agreed to, and keeps pointing at the name it had.)
+    if (current !== name) {
+        const q = current === null
+            ? `Send "align share" to "${claimed}" at ${gwHost} from now on?`
+            : `Send "align share" to "${claimed}" at ${gwHost} from now on? It currently goes to "${current}".`;
+        if (!(await deps.confirm(q))) {
+            deps.out(`  "align share" ${current === null ? 'has no destination yet' : `still goes to "${current}"`}. Send one share to "${name}" with --to ${name}.`);
+            return;
+        }
+        deps.config.setShareDestination(name);
+    }
+    deps.out(`  Shares from this machine now go to "${claimed}" at ${gwHost}.`);
+}
+//# sourceMappingURL=join-flow.js.map

package/dist/lib/join-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"join-flow.js","sourceRoot":"","sources":["../../src/lib/join-flow.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAClI,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAkC7C,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,MAAM,QAAQ,GAAG,oDAAoD,CAAC;AACtE,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAI3C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,KAAgB;IAC5D,MAAM,MAAM,GAAG,CAAC,MAAc,EAAc,EAAE;QAC5C,IAAI,CAAC,GAAG,CAAC,qDAAqD,MAAM,IAAI,CAAC,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC,CAAC;IACF,2HAA2H;IAC3H,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,MAA6C,EAAc,EAAE;QAC/F,MAAM,IAAI,GAAG,MAAM;YACjB,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,+EAA+E,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,sFAAsF;YACxP,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,GAAG,CAAC,iDAAiD,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC;QAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC,CAAC;IAEF,0HAA0H;IAC1H,0HAA0H;IAC1H,sEAAsE;IACtE,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,kFAAkF,CAAC,CAAC;IACpH,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,2GAA2G,CAAC,CAAC;IAE5I,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,CAAC,YAAY,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;IAE7C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC,aAAa,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,qBAAqB,GAAG,GAAG,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IAEtD,qGAAqG;IACrG,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,mDAAoD,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAC1C,IAAI,WAAW,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,kCAAkC,IAAI,CAAC,OAAO,SAAS,MAAM,wBAAwB,WAAW,mEAAmE,CAAC,CAAC;IACrL,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QACjF,OAAO,MAAM,CAAC,6BAA6B,MAAM,gCAAgC,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,qBAAqB,CAAC,CAAC;IAC3I,CAAC;IACD,wJAAwJ;IACxJ,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,6BAA6B,MAAM,qFAAqF,CAAC,CAAC;IAC1I,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,eAAe,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,gBAAgB,OAAO,IAAI,iBAAiB,MAAM,QAAQ,GAAG,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAE,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAElG,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClC,IAAI,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,eAAe,MAAM,wBAAwB,CAAC,CAAC;QAC1H,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,gHAAgH;QAChH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,OAAO,QAAQ,MAAM,iBAAiB,QAAQ,wBAAwB,CAAC,CAAC;QACnH,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,MAAM,CAAC,4CAA4C,CAAC,CAAC;IACjH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,yEAAyE,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,OAAO,CAAC;IACrB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,0CAA0C,IAAI,iEAAiE,CAAC,CAAC;QACnJ,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,OAAO;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAE9D,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,GAAG,MAAM,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAErJ,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACjE,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,kCAAkC,OAAO,+BAA+B,UAAU,qBAAqB,MAAM,kCAAkC,CAAC,CAAC;IAC5J,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;QACpC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,QAAQ,CAAC,KAAK;QACzB,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,cAAc,EAAE,OAAO;KACxB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEf,MAAM,sBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAE1D,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,SAAS;QAAE,IAAI,CAAC,GAAG,CAAC,4BAA4B,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;IAC1I,IAAI,CAAC,GAAG,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACrG,CAAC;AAED,mHAAmH;AACnH,KAAK,UAAU,cAAc,CAAC,IAAc,EAAE,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,gBAAyB;IACrH,IAAI,OAAO,GAAG,WAAW,CAAC;IAC1B,IAAI,CAAC;QAAC,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAa,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,wCAAwC,CAAC,CAAC;IACxI,IAAI,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,SAAS,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,wDAAwD,CAAC,CAAC;QAC9F,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;YAAE,OAAO,eAAe,OAAO,SAAS,IAAI,qBAAqB,CAAC;IAChI,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,2DAA2D,OAAO,QAAQ,OAAO,WAAW,CAAC,CAAC;QACpI,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,IAAI,qFAAqF,CAAC;IAChH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAc,EAAE,MAAc;IACpD,IAAI,CAAC,GAAG,CAAC,OAAO,MAAM,uEAAuE,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC,UAAU,CAAC,oCAAoC,CAAC,CAAC;AAC/D,CAAC;AAED,sIAAsI;AACtI,KAAK,UAAU,UAAU,CAAC,GAAa,EAAE,GAAW;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC/E,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,UAAkB,EAAE,KAAa;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;IACtC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,2BAA2B,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;YACrF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,mBAAmB,IAAI,GAAG,CAAC;IACpC,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,iGAAiG,CAAC;IACjI,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,IAAI,aAAa,GAAG,CAAC,MAAM,+BAA+B,CAAC;IAClF,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,GAAG,IAAI,qCAAqC,CAAC;QACvE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,IAAI,6CAA6C,CAAC;IAC9D,CAAC;IACD,MAAM,CAAC,GAAG,IAA+E,CAAC;IAC1F,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,GAAG,IAAI,6CAA6C,CAAC;IACrG,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACtD,OAAO,GAAG,IAAI,wGAAwG,CAAC;IACzH,CAAC;IACD,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;YAAE,OAAO,GAAG,IAAI,mCAAmC,CAAC;QACzF,IAAI,CAAC;YACH,YAAY,GAAG,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,sBAAsB,IAAI,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;AACxG,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,KAAa,EAAE,MAAc,EAAE,UAAkB;IACtF,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,IAAI,CAAC,aAAa;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC7B,sHAAsH;gBACtH,2GAA2G;gBAC3G,MAAM,GAAG,GAAG,GAAG,MAAM,eAAe,KAAK,aAAa,IAAI,cAAc,KAAK,WAAW,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzH,IAAI,CAAC,GAAG,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;gBACjD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;gBACtG,IAAI,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;YACnE,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,wBAAyB,CAAW,CAAC,OAAO,GAAG,CAAC;IACzD,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,+DAA+D,CAAC;IAC1H,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,SAA6B,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACvG,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC;AAID,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AACxC,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,KAAa;IACjE,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3G,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,iCAAiC,OAAO,CAAC,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;IAClG,CAAC;IACD,MAAM,CAAC,GAAG,GAAuF,CAAC;IAClG,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC;IAC7B,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtI,OAAO,0FAA0F,CAAC;IACpG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAc,EAAE,IAAY,EAAE,OAAe,EAAE,MAAc;IACjG,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAClD,8HAA8H;IAC9H,qGAAqG;IACrG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,OAAO,KAAK,IAAI;YACxB,CAAC,CAAC,0BAA0B,OAAO,QAAQ,MAAM,eAAe;YAChE,CAAC,CAAC,0BAA0B,OAAO,QAAQ,MAAM,uCAAuC,OAAO,IAAI,CAAC;QACtG,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,mBAAmB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,kBAAkB,OAAO,GAAG,wBAAwB,IAAI,eAAe,IAAI,GAAG,CAAC,CAAC;YAC1J,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,yCAAyC,OAAO,QAAQ,MAAM,GAAG,CAAC,CAAC;AAC9E,CAAC"}

package/dist/lib/launch/mcp-child-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-child-env.d.ts","sourceRoot":"","sources":["../../../src/lib/launch/mcp-child-env.ts"],"names":[],"mappings":"AA8CA,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAEvC,CAAC;AAET,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAEpC,CAAC;AAET;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAsBvD,CAAC;AAiBF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CASxF;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI3F;AAaD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAQhK;AAED,2DAA2D;AAC3D,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAEvD"}
+{"version":3,"file":"mcp-child-env.d.ts","sourceRoot":"","sources":["../../../src/lib/launch/mcp-child-env.ts"],"names":[],"mappings":"AA8CA,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAEvC,CAAC;AAET,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAEpC,CAAC;AAET;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAyBvD,CAAC;AAiBF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CASxF;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI3F;AAaD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAQhK;AAED,2DAA2D;AAC3D,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAEvD"}

package/dist/lib/launch/mcp-child-env.js

@@ -15,9 +15,9 @@ import { absoluteXdg, XDG_VARS } from '../xdg.js';
  */
 /** Every ALIGN_* variable align reads from its environment (src/, outside tests). A parity test keeps this complete. */
 const ALIGN_READS = [
-    'ALIGN_DEBUG', 'ALIGN_ENV', 'ALIGN_GATEWAY_URL', 'ALIGN_HEAD_SHA', 'ALIGN_INGEST_CONCURRENCY', 'ALIGN_INTERNAL',
+    'ALIGN_DEBUG', 'ALIGN_DETECTOR', 'ALIGN_ENV', 'ALIGN_GATEWAY_URL', 'ALIGN_HEAD_SHA', 'ALIGN_INGEST_CONCURRENCY', 'ALIGN_INTERNAL',
     'ALIGN_LAUNCH_DRY_RUN', 'ALIGN_LAUNCH_TRACE', 'ALIGN_LLM_API_KEY', 'ALIGN_LLM_BASE_URL', 'ALIGN_LLM_PROVIDER',
-    'ALIGN_LLM_TIMEOUT_MS', 'ALIGN_MODEL_CACHE', 'ALIGN_NO_LAUNCH', 'ALIGN_NO_SYNC', 'ALIGN_OLLAMA_MODEL', 'ALIGN_PLATFORM',
+    'ALIGN_LLM_TIMEOUT_MS', 'ALIGN_MODEL_CACHE', 'ALIGN_NO_LAUNCH', 'ALIGN_NO_LEAD_PROMPT', 'ALIGN_NO_SYNC', 'ALIGN_OLLAMA_MODEL', 'ALIGN_PLATFORM',
     'ALIGN_SUBJECT_KEY', 'ALIGN_TELEMETRY', 'ALIGN_TENANT_ID', 'ALIGN_TOKEN', 'ALIGN_WRAPPED',
 ];
 /**
@@ -62,6 +62,9 @@ export const CHILD_ENV_NOT_PINNED = {
     COLORTERM: 'output colour only',
     COLORFGBG: 'output colour only',
     DO_NOT_TRACK: 'can only turn telemetry off; not pinned because the first align run that sees it stores the opt-out (storeEnvOptOut), so a trimmed MCP env needs no copy',
+    ...Object.fromEntries([
+        'GITHUB_ACTIONS', 'SSH_CONNECTION', 'SSH_TTY', 'SSH_CLIENT', 'CODESPACES', 'REMOTE_CONTAINERS', 'DISPLAY', 'WAYLAND_DISPLAY', 'TERM', 'LC_ALL', 'LC_CTYPE', 'LANG', 'SystemRoot',
+    ].map((v) => [v, 'read by `align share` to decide whether to open a browser or draw a QR code at the person\'s terminal; the MCP server never does either'])),
     COPILOT_ALLOW_ALL: 'read by the launcher about Copilot, not by align mcp',
     GEMINI_RESTRICTED_MODE: 'read by the launcher about Gemini folder trust, not by align mcp',
     ...Object.fromEntries([

package/dist/lib/launch/mcp-child-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-child-env.js","sourceRoot":"","sources":["../../../src/lib/launch/mcp-child-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAElD;;;;;;;;;;;;GAYG;AAEH,wHAAwH;AACxH,MAAM,WAAW,GAAG;IAClB,aAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,gBAAgB;IAC/G,sBAAsB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,oBAAoB;IAC7G,sBAAsB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,eAAe,EAAE,oBAAoB,EAAE,gBAAgB;IACvH,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,aAAa,EAAE,eAAe;CACjF,CAAC;AAEX;;;GAGG;AACH,MAAM,WAAW,GAAG,CAAC,aAAa,EAAE,uBAAuB,EAAE,IAAI,CAAU,CAAC;AAE5E,yIAAyI;AACzI,MAAM,OAAO,GAAG;IACd,oBAAoB,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU;CACxH,CAAC;AACX,wDAAwD;AACxD,MAAM,UAAU,GAAG,CAAC,qBAAqB,EAAE,eAAe,EAAE,cAAc,CAAU,CAAC;AACrF,uGAAuG;AACvG,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,wBAAwB,CAAU,CAAC;AAErE,2EAA2E;AAC3E,MAAM,YAAY,GAAG;IACnB,cAAc,EAAE,WAAW,EAAE,2BAA2B,EAAE,8BAA8B;IACxF,YAAY,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,qBAAqB;CACrG,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;CACvK,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,YAAY,EAAE,GAAG,WAAW,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,UAAU,EAAE,GAAG,iBAAiB,EAAE,GAAG,iBAAiB,CAAC,CAAC;CACjK,CAAC,IAAI,EAAE,CAAC;AAET;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA2B;IAC1D,IAAI,EAAE,wDAAwD;IAC9D,WAAW,EAAE,qDAAqD;IAClE,OAAO,EAAE,uBAAuB;IAChC,YAAY,EAAE,uBAAuB;IACrC,WAAW,EAAE,kDAAkD;IAC/D,IAAI,EAAE,uCAAuC;IAC7C,IAAI,EAAE,sCAAsC;IAC5C,OAAO,EAAE,uBAAuB;IAChC,QAAQ,EAAE,oBAAoB;IAC9B,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,oBAAoB;IAC/B,YAAY,EAAE,0JAA0J;IACxK,iBAAiB,EAAE,sDAAsD;IACzE,sBAAsB,EAAE,kEAAkE;IAC1F,GAAG,MAAM,CAAC,WAAW,CAAC;QACpB,gCAAgC,EAAE,gCAAgC,EAAE,gCAAgC,EAAE,WAAW;QACjH,iCAAiC,EAAE,iCAAiC,EAAE,4BAA4B,EAAE,iCAAiC,EAAE,iBAAiB;QACxJ,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe;QACrI,+BAA+B,EAAE,uBAAuB,EAAE,cAAc,EAAE,qBAAqB,EAAE,YAAY;QAC7G,WAAW,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,mBAAmB;KAC9E,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,0EAA0E,CAAC,CAAC,CAAC;CAC/F,CAAC;AAEF,2FAA2F;AAC3F,SAAS,eAAe,CAAC,CAAS;IAChC,KAAK,MAAM,SAAS,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO,CAAC,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEnF,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,GAAuC;IAC9E,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACzE,IAAK,QAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClF,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACxB,IAAK,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACjE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,GAAuC;IACjE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,cAAc;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,SAAS,cAAc,CAAC,CAAS,EAAE,GAAY;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,KAAK,EAAE,CAAC;IACjF,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAK,QAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;IACnG,IAAK,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC9E,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAU,EAAE,GAAuC;IAClF,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACpG,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAA6B,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5I,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,OAAO,gBAAgB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;AACpD,CAAC"}
+{"version":3,"file":"mcp-child-env.js","sourceRoot":"","sources":["../../../src/lib/launch/mcp-child-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAElD;;;;;;;;;;;;GAYG;AAEH,wHAAwH;AACxH,MAAM,WAAW,GAAG;IAClB,aAAa,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,gBAAgB;IACjI,sBAAsB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,oBAAoB;IAC7G,sBAAsB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,eAAe,EAAE,oBAAoB,EAAE,gBAAgB;IAC/I,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,aAAa,EAAE,eAAe;CACjF,CAAC;AAEX;;;GAGG;AACH,MAAM,WAAW,GAAG,CAAC,aAAa,EAAE,uBAAuB,EAAE,IAAI,CAAU,CAAC;AAE5E,yIAAyI;AACzI,MAAM,OAAO,GAAG;IACd,oBAAoB,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU;CACxH,CAAC;AACX,wDAAwD;AACxD,MAAM,UAAU,GAAG,CAAC,qBAAqB,EAAE,eAAe,EAAE,cAAc,CAAU,CAAC;AACrF,uGAAuG;AACvG,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,wBAAwB,CAAU,CAAC;AAErE,2EAA2E;AAC3E,MAAM,YAAY,GAAG;IACnB,cAAc,EAAE,WAAW,EAAE,2BAA2B,EAAE,8BAA8B;IACxF,YAAY,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,qBAAqB;CACrG,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;CACvK,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,YAAY,EAAE,GAAG,WAAW,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,UAAU,EAAE,GAAG,iBAAiB,EAAE,GAAG,iBAAiB,CAAC,CAAC;CACjK,CAAC,IAAI,EAAE,CAAC;AAET;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA2B;IAC1D,IAAI,EAAE,wDAAwD;IAC9D,WAAW,EAAE,qDAAqD;IAClE,OAAO,EAAE,uBAAuB;IAChC,YAAY,EAAE,uBAAuB;IACrC,WAAW,EAAE,kDAAkD;IAC/D,IAAI,EAAE,uCAAuC;IAC7C,IAAI,EAAE,sCAAsC;IAC5C,OAAO,EAAE,uBAAuB;IAChC,QAAQ,EAAE,oBAAoB;IAC9B,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,oBAAoB;IAC/B,YAAY,EAAE,0JAA0J;IACxK,GAAG,MAAM,CAAC,WAAW,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY;KACjL,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,yIAAyI,CAAC,CAAC,CAAC;IAC7J,iBAAiB,EAAE,sDAAsD;IACzE,sBAAsB,EAAE,kEAAkE;IAC1F,GAAG,MAAM,CAAC,WAAW,CAAC;QACpB,gCAAgC,EAAE,gCAAgC,EAAE,gCAAgC,EAAE,WAAW;QACjH,iCAAiC,EAAE,iCAAiC,EAAE,4BAA4B,EAAE,iCAAiC,EAAE,iBAAiB;QACxJ,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe;QACrI,+BAA+B,EAAE,uBAAuB,EAAE,cAAc,EAAE,qBAAqB,EAAE,YAAY;QAC7G,WAAW,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,mBAAmB;KAC9E,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,0EAA0E,CAAC,CAAC,CAAC;CAC/F,CAAC;AAEF,2FAA2F;AAC3F,SAAS,eAAe,CAAC,CAAS;IAChC,KAAK,MAAM,SAAS,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO,CAAC,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEnF,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,GAAuC;IAC9E,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACzE,IAAK,QAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClF,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACxB,IAAK,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACjE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,GAAuC;IACjE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,cAAc;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,SAAS,cAAc,CAAC,CAAS,EAAE,GAAY;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,KAAK,EAAE,CAAC;IACjF,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAK,QAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;IACnG,IAAK,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC9E,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAU,EAAE,GAAuC;IAClF,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACpG,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAA6B,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5I,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,OAAO,gBAAgB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;AACpD,CAAC"}

package/dist/lib/lead-prompt.d.ts

@@ -0,0 +1,106 @@
+/**
+ * The optional work-email prompt at the share moment. NOT telemetry: it is a separate consent, it is
+ * described as its own thing in docs/commands.md, and nothing here touches the telemetry state or events.
+ *
+ * It appears in one place only: `align share` run by a person at a terminal with no team login, right where
+ * the one upgrade line already prints. The decision lives in `leadPromptDecision` so every refusal is one
+ * named reason. The address is validated here, sent once to the gateway's public lead route, and never
+ * stored anywhere on this machine: the config keeps a timestamp and an outcome word, not the address.
+ *
+ * `align_share` and `align_share_status` (the MCP tools) never import this module: an agent must not
+ * collect an email on a person's behalf. Honest limit: an agent that opens its OWN pseudo-terminal passes every
+ * terminal check here and can see the prompt; the server's double opt-in (nothing is stored as confirmed until the
+ * address's owner clicks) is the backstop, the same stated limit as the typed share confirmation in SECURITY.md (share-lead-wiring.test.ts holds that: "the MCP tool modules do not import the prompt at all").
+ */
+import { type LeadPromptOutcome, type LeadState } from './config.js';
+/** The consent text version. The privacy page uses the same string: change both together. */
+export declare const LEAD_CONSENT_VERSION = "2026-10-cli-share-1";
+export declare const PRIVACY_URL = "https://align.tech/privacy";
+export declare const LEAD_CONSENT_LINE = "We will store it to email you about team plans. One confirmation email, unsubscribe any time. Details: https://align.tech/privacy.";
+export declare const LEAD_QUESTION_LINE = "Want an email when your team can join Align, or to set up a call?";
+export declare const LEAD_INPUT_PROMPT = "Work email (press Enter to skip):";
+export type LeadSkipReason = 'not-hosted' | 'has-team-destination' | 'wrapped' | 'ci' | 'suppressed' | 'not-a-terminal' | 'has-login' | 'already-asked';
+export interface LeadGateInput {
+    env: Record<string, string | undefined>;
+    /** stdin, stdout and stderr are all real terminals. */
+    tty: boolean;
+    hasLogin: boolean;
+    inCi: boolean;
+    state: LeadState;
+    /** The gateway this run talks to (resolved from config, the same one the share path uses). */
+    gatewayUrl: string;
+    /** Align's own hosted gateway. Only that target may be asked for, or sent, an email. */
+    hostedGatewayUrl: string;
+    /** The person has joined a team (`align join`): they are not the audience for Align's list. */
+    hasTeamDestination: boolean;
+}
+/** Null means ask. Anything else is the one reason it must not. Pure, so the decision table is testable as one. */
+export declare function leadPromptDecision(i: LeadGateInput): LeadSkipReason | null;
+/** The address to send, or null. Trims, lowercases the domain, and refuses anything the server would also refuse. */
+export declare function normaliseEmail(raw: string): string | null;
+export type LeadSendOutcome = {
+    kind: 'accepted';
+} | {
+    kind: 'invalid';
+} | {
+    kind: 'rate-limited';
+} | {
+    kind: 'unavailable';
+} | {
+    kind: 'failed';
+};
+export interface LeadBody {
+    email: string;
+    source: 'cli-share';
+    consent_version: string;
+    cli_version?: string;
+    os?: 'darwin' | 'linux' | 'win32';
+}
+export declare function leadBody(email: string): LeadBody;
+/** One attempt. No retry, no redirect, a hard time cap and a size cap on what is read back. Never throws. */
+export declare function postLead(email: string, baseUrl: string, capMs?: number): Promise<LeadSendOutcome>;
+export interface LeadStore {
+    getLeadState(): LeadState;
+    markLeadPromptShown(version: string): void;
+    setLeadOutcome(outcome: LeadPromptOutcome): void;
+    clearLeadPromptShown(): void;
+}
+export interface LeadDeps {
+    store: LeadStore;
+    env: Record<string, string | undefined>;
+    hasLogin: boolean;
+    inCi: boolean;
+    gatewayUrl: string;
+    hostedGatewayUrl: string;
+    hasTeamDestination: boolean;
+    /** stdin, stdout and stderr are terminals. The controlling terminal itself is proven by `ask`. */
+    tty: boolean;
+    /** Show `shown` on the controlling terminal, call onShown once visible, return the typed line, or null with no terminal. */
+    ask: (shown: string, question: string, onShown: () => void) => Promise<string | null>;
+    /** Posts to the resolved gateway URL, the same one the gate compared. */
+    post: (email: string) => Promise<LeadSendOutcome>;
+    out: (line: string) => void;
+}
+/** Runs the whole prompt. Returns what happened, for tests. Never throws: a broken store costs the prompt, never the command. */
+export declare function maybeAskLead(d: LeadDeps): Promise<'skipped-by-gate' | 'no-terminal' | LeadPromptOutcome | 'not-sent'>;
+export interface LeadPromptWiring {
+    store: LeadStore & {
+        listTeamDestinationNames(): string[];
+    };
+    /** The gateway this share resolved to: compared with the hosted one, never posted to. */
+    cloudGatewayUrl: string;
+    hostedGatewayUrl: string;
+    env: Record<string, string | undefined>;
+    inCi: boolean;
+    tty: boolean;
+    ask: LeadDeps['ask'];
+    out: (line: string) => void;
+}
+/**
+ * What `align share` hands the run as its lead prompt. Two rules live here so a test can hold them:
+ * a saved team destination switches the prompt off, and the address is posted to Align's hosted gateway
+ * as Align spells it, never to whatever the run resolved (a self-host, or an environment override that merely
+ * matches after normalising).
+ */
+export declare function leadPromptFor(w: LeadPromptWiring): () => ReturnType<typeof maybeAskLead>;
+//# sourceMappingURL=lead-prompt.d.ts.map

package/dist/lib/lead-prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lead-prompt.d.ts","sourceRoot":"","sources":["../../src/lib/lead-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAIrE,6FAA6F;AAC7F,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAC1D,eAAO,MAAM,WAAW,+BAA+B,CAAC;AAExD,eAAO,MAAM,iBAAiB,uIAA2H,CAAC;AAC1J,eAAO,MAAM,kBAAkB,sEAAsE,CAAC;AACtG,eAAO,MAAM,iBAAiB,sCAAsC,CAAC;AAKrE,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,sBAAsB,GAAG,SAAS,GAAG,IAAI,GAAG,YAAY,GAAG,gBAAgB,GAAG,WAAW,GAAG,eAAe,CAAC;AAExJ,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,uDAAuD;IACvD,GAAG,EAAE,OAAO,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,8FAA8F;IAC9F,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,gBAAgB,EAAE,MAAM,CAAC;IACzB,+FAA+F;IAC/F,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAMD,mHAAmH;AACnH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,aAAa,GAAG,cAAc,GAAG,IAAI,CAW1E;AAMD,qHAAqH;AACrH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASzD;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEnJ,MAAM,WAAW,QAAQ;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAA;CAAE;AAElJ,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAShD;AAED,6GAA6G;AAC7G,wBAAsB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,MAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CA+B/G;AAED,MAAM,WAAW,SAAS;IACxB,YAAY,IAAI,SAAS,CAAC;IAC1B,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACjD,oBAAoB,IAAI,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,SAAS,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,kGAAkG;IAClG,GAAG,EAAE,OAAO,CAAC;IACb,4HAA4H;IAC5H,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtF,yEAAyE;IACzE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAID,iIAAiI;AACjI,wBAAsB,YAAY,CAAC,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,GAAG,aAAa,GAAG,iBAAiB,GAAG,UAAU,CAAC,CAuC3H;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,SAAS,GAAG;QAAE,wBAAwB,IAAI,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5D,yFAAyF;IACzF,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,UAAU,CAAC,OAAO,YAAY,CAAC,CAcxF"}