@corenel/tools-node 0.2.2 → 0.3.1

package/dist/auth.d.ts

@@ -8,9 +8,266 @@ export declare function sidecarDir(base?: string): string;
 /** The ACCOUNT token from the device flow. Top level, and staying there: it is
  *  not the daemon's, and moving it would sign the user out on upgrade. */
 export declare function authTokenPath(base?: string): string;
-export declare function writeAuthToken(token: string): Promise<void>;
-export declare function readAuthToken(): Promise<string | null>;
-export declare function clearAuthToken(): Promise<void>;
-/** The IAuthTokenProvider for node: the stored login token, else CORENEL_TOKEN env. */
-export declare function nodeAuthToken(): IAuthTokenProvider;
+/**
+ * The directory both credential files live in.
+ *
+ * STATE-DIR DECISION, made deliberately: the token file stays HOME-scoped by
+ * default and does NOT move under a daemon-private directory. @corenel/cli
+ * resolves it from homedir() with no notion of a state dir, and `corenel login`
+ * writes it there; relocating it would sign every existing user out on upgrade
+ * and leave the CLI unable to find the credential it just wrote. What
+ * `--state-dir` does instead is redirect the whole state dir, exactly as the
+ * sidecar's `authDir` already does — so `<stateDir>/token` and
+ * `<stateDir>/auth.json` stay siblings, an isolated state dir stays isolated
+ * (nothing reaches back into the real home), and with no `--state-dir` this
+ * resolves to the same `~/.corenel/token` the CLI reads. Identical computation
+ * to packages/sidecar/src/auth/store.ts `authDir`, and it must stay identical.
+ */
+export declare function credentialDir(stateDir?: string): string;
+/** `<credentialDir>/token` — equals authTokenPath() when no state dir is given. */
+export declare function tokenFilePath(stateDir?: string): string;
+/** `<credentialDir>/auth.json` — the sidecar's richer credential record. */
+export declare function credentialFilePath(stateDir?: string): string;
+/** The environment variable that carries a headless credential. */
+export declare const TOKEN_ENV = "CORENEL_TOKEN";
+/** The environment variable that names the API. Same spelling @corenel/cli's
+ *  `apiBase()` reads, because two names for one decision is how they drift. */
+export declare const API_BASE_ENV = "CORENEL_API_BASE";
+/** The credential file's shape. `expiresAt` absent means the issuer did not say
+ *  — which is NOT the same as "not expired". */
+export interface StoredCredential {
+    accessToken: string;
+    refreshToken?: string;
+    /** Epoch ms. Absent means the issuer did not say. */
+    expiresAt?: number;
+    /**
+     * WHO this credential belongs to, as the sign-in reported it.
+     *
+     * Never an authorization input: nothing is granted on the strength of this
+     * string. It IS an identity input in one place -- a sidecar daemon compares
+     * it against what a same-machine client claims to be signed in as, and files
+     * a match under one synced directory instead of one per browser origin
+     * (@corenel/sidecar's hostIdentity.ts). That comparison decides a directory,
+     * not an access decision, and a mismatch simply keeps today's behaviour.
+     *
+     * Consequence worth stating: this is frequently an EMAIL ADDRESS. It lives in
+     * a 0600 file on purpose. It must not be logged, printed, or used to name a
+     * directory -- the rule that consumes it keys off a truncated digest for
+     * exactly that reason.
+     */
+    account?: string;
+    /**
+     * The API base this credential was MINTED against.
+     *
+     * A token is only valid at the host that issued it, so the base belongs to
+     * the login, not to the machine: a daemon defaulting to a different host
+     * spends a token nobody there has heard of, and the failure is a 401 a long
+     * way from the sign-in that caused it. Absent on every credential written
+     * before this was recorded, which is why every reader falls back to the
+     * default rather than treating absence as an error.
+     */
+    apiBase?: string;
+}
+export declare function writeAuthToken(token: string, stateDir?: string): Promise<void>;
+/**
+ * Record a completed sign-in in BOTH stores, including WHERE it was minted.
+ *
+ * `writeAuthToken` alone leaves the token file holding a bearer token with no
+ * record of which API issued it -- which is fine right up until the machine is
+ * pointed somewhere else by a default, and then it is a 401 with no visible
+ * cause. The base goes in auth.json because the token file is one line by
+ * contract and every existing reader of it splits on nothing.
+ *
+ * The credential record is REPLACED, not merged: a new sign-in may be a
+ * different account at a different host, and carrying the previous one's
+ * account or base onto it would report something nobody established.
+ *
+ * TWO FILES, AND A READER BETWEEN THEM. `resolveNodeCredential` borrows the
+ * account from auth.json only when auth.json describes the SAME token the
+ * token file holds -- which is right, and which means that during a RE-login
+ * the two disagree and the account reads as absent. That is fail-closed (a
+ * daemon files that handshake under its per-origin id, exactly as it did
+ * before any of this) but it is not free: the directory it mints then
+ * persists. So the window is made as small as two files allow. Both new
+ * contents are staged first, and the two renames happen back to back with no
+ * mkdir, no chmod and no JSON encoding between them -- microseconds rather
+ * than the duration of two file writes.
+ *
+ * It is not ZERO, and cannot be while the credential lives in two files. The
+ * honest fix is one file, which means changing what the gateway client and
+ * @corenel/cli have always read; the precedence comment at the top of this
+ * module is the record of why that has not been done.
+ *
+ * The credential file is renamed FIRST. Whichever order is chosen the
+ * intermediate state loses the account, so the tiebreak is which token a
+ * reader gets in that instant: credential-first leaves the token file holding
+ * the PREVIOUS token, which is the credential that was working a moment ago.
+ * Token-first would publish the new token with no account and no recorded
+ * base -- a state no sign-in ever produced.
+ */
+export declare function writeLoginCredential(token: string, opts?: {
+    apiBase?: string;
+    stateDir?: string;
+    account?: string;
+}): Promise<void>;
+/**
+ * A store read that says WHICH kind of nothing it found.
+ *
+ * "There is no credential" and "the credential could not be read" are the same
+ * `null` to every caller that only wants a token, and that is right for them:
+ * neither can be authenticated with. They are NOT the same to a caller that
+ * publishes a STATE off the answer. A daemon that re-reads its own sign-in
+ * treats a null as a logout -- and an antivirus lock, an EMFILE under load or a
+ * directory mode change then publishes a sign-out that never happened, which in
+ * the sidecar's case permanently mints a synced directory (see
+ * @corenel/sidecar's accountWatch.ts). So the distinction is carried here,
+ * where it is known, rather than guessed at by the caller.
+ *
+ * `unreadable` is true only for a store that EXISTS as far as the filesystem is
+ * concerned and could not be read: ENOENT is a clean absence and never sets it.
+ * A malformed credential file is also an absence, deliberately -- the writes
+ * are atomic renames, so a parse failure is a corrupt file rather than a
+ * half-written one, and corruption should send the user through sign-in rather
+ * than being retried forever.
+ */
+export interface CredentialRead<T> {
+    /** What was read, or null when there is nothing to read. */
+    value: T | null;
+    /** The store is there but could not be read. Never true alongside a value. */
+    unreadable: boolean;
+}
+export declare function readAuthToken(stateDir?: string): Promise<string | null>;
+/** `readAuthToken`, keeping the absent/unreadable distinction. */
+export declare function readAuthTokenRead(stateDir?: string): Promise<CredentialRead<string>>;
+/** Remove the token file only. Prefer clearAllCredentials for anything a user
+ *  would call signing out — see the warning there. */
+export declare function clearAuthToken(stateDir?: string): Promise<void>;
+/** Read `<dir>/auth.json`, or null when there is none. A malformed file is
+ * treated as absent rather than fatal — a corrupt credential should send the
+ * user through sign-in, not wedge the daemon. */
+export declare function readCredentialFile(stateDir?: string): Promise<StoredCredential | null>;
+/** `readCredentialFile`, keeping the absent/unreadable distinction. See
+ *  CredentialRead for why a caller would want it. */
+export declare function readCredentialFileRead(stateDir?: string): Promise<CredentialRead<StoredCredential>>;
+/**
+ * Sign out of BOTH stores.
+ *
+ * Clearing one while the other still authenticates is the same divergence bug
+ * pointing the other way, and worse: the operator believes they signed out
+ * while the gateway keeps sending a credential. Every sign-out path must land
+ * here rather than removing a single file.
+ */
+export declare function clearAllCredentials(stateDir?: string): Promise<void>;
+/** Which store answered. */
+export type CredentialSource = 'env' | 'token-file' | 'credential-file' | 'none';
+export interface ResolvedCredential {
+    token: string | null;
+    source: CredentialSource;
+    /** Where it was read from on disk. Absent for 'env' and 'none'. */
+    path?: string;
+    /** Epoch ms, when a store recorded one. Absent means UNKNOWN, not "fresh". */
+    expiresAt?: number;
+    /** True only when an expiry is known AND has passed. */
+    expired?: boolean;
+    /** Who the credential belongs to. Never an authorization input; see
+     *  StoredCredential.account, including why it must not be logged. */
+    account?: string;
+    /** The API this credential was minted against, when the sign-in recorded one.
+     *  Absent for an older credential — read that as "not recorded", never as
+     *  "the default". */
+    apiBase?: string;
+    /**
+     * At least one credential store is present and could not be read.
+     *
+     * Absent means every store was read cleanly, so a missing token or a missing
+     * `account` above really is an absence. Present, it is not: the answer is
+     * incomplete for a reason that is likely to pass (a file lock, EMFILE under
+     * load), and a caller that publishes a STATE off this must not read it as a
+     * sign-out. Nothing is granted on it either way -- an unreadable credential
+     * authenticates nothing and identifies nobody. See CredentialRead.
+     */
+    unreadable?: true;
+}
+export interface ResolveCredentialOptions {
+    env?: NodeJS.ProcessEnv;
+    stateDir?: string;
+    now?: () => number;
+}
+/**
+ * Resolve the credential this machine authenticates with, per the precedence
+ * documented at the top of this file.
+ *
+ * An expired stored credential is REPORTED, not skipped: the caller decides
+ * whether to refresh or re-prompt, and one that ignores `expired` fails at the
+ * gateway rather than here. A token file records no expiry at all, so
+ * `expiresAt` stays undefined for it unless the credential file beside it
+ * describes the same token — the absence of an expiry must never be read as
+ * evidence of freshness.
+ */
+export declare function resolveNodeCredential(opts?: ResolveCredentialOptions): Promise<ResolvedCredential>;
+/** Which answer resolveApiBase gave. Reported so a startup banner can say why
+ *  it is talking to the host it is talking to. */
+export type ApiBaseSource = 'explicit' | 'env' | 'credential' | 'default';
+export interface ResolvedApiBase {
+    base: string;
+    source: ApiBaseSource;
+}
+export interface ResolveApiBaseOptions {
+    /** A flag the operator typed (`--endpoint`, `--base`). Empty means absent —
+     *  that is how a missing flag arrives from every caller here. */
+    explicit?: string;
+    env?: NodeJS.ProcessEnv;
+    stateDir?: string;
+}
+/**
+ * Which API to talk to.
+ *
+ *   1. an explicit flag        — the operator is pointing somewhere on purpose
+ *   2. CORENEL_API_BASE        — a container/CI statement of present intent
+ *   3. the credential's base   — where the token this machine holds was minted
+ *   4. DEFAULT_API_BASE        — nothing has been said, so say the product's own
+ *
+ * (3) is the change worth stating: the sidecar carried a literal default, so a
+ * user who signed in against one deployment had their daemon talk to another,
+ * and the only symptom was a 401 or a 404 far from the login. Preferring the
+ * credential's own base makes the common case need no flag at all, while (1)
+ * keeps `--endpoint` meaning exactly what it says for local dev.
+ *
+ * A second change to (1): the sidecar's `daemon.json` can also carry an
+ * `endpoint`, and since the CLI's config-layering fix it is passed in here as
+ * `explicit` too (an operator who wrote it into the file chose it, same as
+ * typing the flag) -- so it now outranks (2) `CORENEL_API_BASE` as well. A
+ * container/CI operator relying on the env var to override a baked-in
+ * `daemon.json` endpoint at deploy time now silently no-ops: the file wins.
+ * Override it with `--endpoint` (still rung 1, and still per-invocation) or by
+ * editing the file itself, not the environment.
+ */
+export declare function resolveApiBase(opts?: ResolveApiBaseOptions): Promise<ResolvedApiBase>;
+/** A token is a credential; printing one puts it in scrollback, shell history
+ *  and any screen share. Four leading characters identify WHICH token this is
+ *  without being usable if the output is pasted somewhere. */
+export declare function maskToken(token: string): string;
+/**
+ * Mask an account/identity string for output that might land in a support
+ * thread or a public issue tracker (`corenel doctor`'s REACHABILITY line) --
+ * as opposed to `corenel login`/`corenel auth`, which print it in full because
+ * they are interactive and purpose-built for exactly that question. Preserves
+ * the domain (still answers "is this the org/deployment I expected?") while
+ * hiding the local part: `sbaker@logikbug.com` -> `s***r@logikbug.com`.
+ *
+ * A one- or two-character local part is NOT masked by keeping its first and
+ * last character -- for length 1 that character IS the whole local part, and
+ * for length 2 it is BOTH characters, so that scheme would print it in full
+ * under the name of masking it. Those collapse to a fixed, content-free `**`
+ * instead. A value that is not email-shaped at all (no `@`, or an empty local
+ * or domain half) -- or is empty/absent -- degrades to a generic redacted
+ * marker rather than being printed raw. Never throws: this runs in a
+ * diagnostic command that exists for when things are already broken, and a
+ * masking helper crashing on an unexpected shape would be exactly backwards.
+ */
+export declare function maskAccount(account: string | undefined | null): string;
+/** The IAuthTokenProvider for node. Resolves exactly what `auth` reports, which
+ *  is the whole point: the status command must describe the credential the
+ *  gateway will actually send. */
+export declare function nodeAuthToken(stateDir?: string): IAuthTokenProvider;
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../auth.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAW5D;2DAC2D;AAC3D,wBAAgB,UAAU,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE3D;AAED;iFACiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE3D;AAED;0EAC0E;AAC1E,wBAAgB,aAAa,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE9D;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcjE;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAO5D;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAEpD;AAED,uFAAuF;AACvF,wBAAgB,aAAa,IAAI,kBAAkB,CAElD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../auth.ts"],"names":[],"mappings":"AAiDA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAW5D;2DAC2D;AAC3D,wBAAgB,UAAU,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE3D;AAED;iFACiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE3D;AAED;0EAC0E;AAC1E,wBAAgB,aAAa,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE9D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,mEAAmE;AACnE,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAEzC;+EAC+E;AAC/E,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAE/C;gDACgD;AAChD,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8BD,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcpF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GACnE,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,4DAA4D;IAC5D,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IAChB,8EAA8E;IAC9E,UAAU,EAAE,OAAO,CAAC;CACrB;AAOD,wBAAsB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE7E;AAED,kEAAkE;AAClE,wBAAsB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAS1F;AAED;sDACsD;AACtD,wBAAsB,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErE;AAED;;iDAEiD;AACjD,wBAAsB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAE5F;AAED;qDACqD;AACrD,wBAAsB,sBAAsB,CAC1C,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CA6B3C;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1E;AAED,4BAA4B;AAC5B,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,YAAY,GAAG,iBAAiB,GAAG,MAAM,CAAC;AAEjF,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;yEACqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;yBAEqB;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,kBAAkB,CAAC,CAwC7B;AAkBD;kDACkD;AAClD,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,SAAS,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC;qEACiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,cAAc,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,eAAe,CAAC,CAW/F;AAED;;8DAE8D;AAC9D,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CAStE;AAED;;kCAEkC;AAClC,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAEnE"}

package/dist/auth.js

@@ -1,19 +1,60 @@
-/* Node auth token store — ~/<state dir>/token (default ~/.corenel/token, owner-only).
- * `corenel login` writes it via the device flow; the CLI's token guard + gateway
- * client read it through the IAuthTokenProvider port (falling back to the
- * CORENEL_TOKEN env). Separate from the sidecar's ~/<state dir>/daemon.token
- * (default ~/.corenel/daemon.token — that's the local pairing token). */
+/* Node auth credential store — the ONE place that decides which credential this
+ * machine authenticates with.
+ *
+ * TWO STORES, ONE ANSWER. A sign-in can land in either of two files, written by
+ * different halves of the product:
+ *
+ *   <dir>/token      a bare bearer token, one line. Written by `corenel login`
+ *                    (@corenel/cli's device flow) and read by the gateway
+ *                    client. This is the file real users are signed in with.
+ *   <dir>/auth.json  the richer record from the sidecar's PKCE flow
+ *                    (packages/sidecar/src/auth/store.ts): accessToken plus
+ *                    refreshToken, expiresAt and account.
+ *
+ * They used to be resolved independently, so `corenel-sidecar auth` could
+ * answer "Not signed in" about auth.json on a machine whose gateway calls were
+ * succeeding with the token file. That is the bug this module exists to close:
+ * everything that asks "is this machine signed in?" and everything that asks
+ * "what do I send?" now goes through resolveNodeCredential below.
+ *
+ * PRECEDENCE, stated once so nobody has to derive it:
+ *
+ *   1. CORENEL_TOKEN in the environment.
+ *   2. <dir>/token       — the token file.
+ *   3. <dir>/auth.json   — the credential file.
+ *
+ * (1) is first because the environment is a present-tense statement of intent:
+ * it is how a container, a CI job or an SSH session supplies identity, and
+ * those are exactly the places where a file on disk may be a stale artifact of
+ * an image build. It also means a `logout` cannot silently appear to fail — the
+ * commands say so explicitly when the variable is set.
+ *
+ * (2) beats (3) because the token file is the credential that already works:
+ * the gateway client and @corenel/cli have always read it, and real installs
+ * are signed in through it right now. Making the newer store win would change
+ * which token a working machine sends. The two only ever diverge on a machine
+ * that signed in both ways, because saveCredential writes BOTH and
+ * clearAllCredentials removes BOTH — so login and logout leave the two readers
+ * agreeing rather than leaning on the precedence at all. When the credential
+ * file describes the SAME token, its account/expiry metadata is carried over,
+ * which is the only reason (3) is consulted after (2) has already answered.
+ *
+ * Separate from the sidecar's <dir>/sidecar/daemon.token, which is the local
+ * PAIRING token: that authenticates a connection to a port, it does not say who
+ * the user is, and merging the two would turn "can reach the port" into "is the
+ * account owner".
+ */
 import { promises as fs } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { stateDirName } from '@corenel/protocol';
+import { stateDirName, DEFAULT_API_BASE } from '@corenel/protocol';
 /* Every path helper takes an explicit base, defaulting to the real home.
  *
  * Not a convenience. The layout migration built on these MOVES files, and a
  * helper that can only resolve homedir() would force every test of it to run
  * against the developer's own ~/.corenel -- the one holding their edited
- * personas. Taking a base makes that mistake impossible rather than
- * discouraged. */
+ * personas, and the token they are signed in with right now. Taking a base
+ * makes that mistake impossible rather than discouraged. */
 /** The state dir: `<home>/.corenel`. ALSO the global crew root -- global agents
  *  resolve as `<stateDir>/crew` -- so this never moves. */
 export function corenelDir(base = homedir()) {
@@ -29,7 +70,72 @@ export function sidecarDir(base = homedir()) {
 export function authTokenPath(base = homedir()) {
     return join(corenelDir(base), 'token');
 }
-export async function writeAuthToken(token) {
+/**
+ * The directory both credential files live in.
+ *
+ * STATE-DIR DECISION, made deliberately: the token file stays HOME-scoped by
+ * default and does NOT move under a daemon-private directory. @corenel/cli
+ * resolves it from homedir() with no notion of a state dir, and `corenel login`
+ * writes it there; relocating it would sign every existing user out on upgrade
+ * and leave the CLI unable to find the credential it just wrote. What
+ * `--state-dir` does instead is redirect the whole state dir, exactly as the
+ * sidecar's `authDir` already does — so `<stateDir>/token` and
+ * `<stateDir>/auth.json` stay siblings, an isolated state dir stays isolated
+ * (nothing reaches back into the real home), and with no `--state-dir` this
+ * resolves to the same `~/.corenel/token` the CLI reads. Identical computation
+ * to packages/sidecar/src/auth/store.ts `authDir`, and it must stay identical.
+ */
+export function credentialDir(stateDir) {
+    return stateDir ?? corenelDir();
+}
+/** `<credentialDir>/token` — equals authTokenPath() when no state dir is given. */
+export function tokenFilePath(stateDir) {
+    return join(credentialDir(stateDir), 'token');
+}
+/** `<credentialDir>/auth.json` — the sidecar's richer credential record. */
+export function credentialFilePath(stateDir) {
+    return join(credentialDir(stateDir), 'auth.json');
+}
+/** The environment variable that carries a headless credential. */
+export const TOKEN_ENV = 'CORENEL_TOKEN';
+/** The environment variable that names the API. Same spelling @corenel/cli's
+ *  `apiBase()` reads, because two names for one decision is how they drift. */
+export const API_BASE_ENV = 'CORENEL_API_BASE';
+/**
+ * Write one 0600 file so that no reader ever sees a half-written one.
+ *
+ * A credential is read by OTHER processes while it is being written -- a
+ * running daemon re-reads it, the gateway client reads it per request -- and
+ * `writeFile` truncates before it fills. A reader landing mid-write gets an
+ * empty token file (read as signed out) or a JSON parse failure on auth.json
+ * (read as no credential at all). A rename over the top is atomic on POSIX and
+ * on NTFS, so a reader sees the old file or the new one.
+ *
+ * The temp file is created 0600 and chmod'ed before the rename, never after:
+ * the point is that the file is never readable at a weaker mode, not that it
+ * ends up at the right one.
+ */
+async function writeFilePrivateAtomic(path, contents) {
+    const tmp = `${path}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+    await fs.writeFile(tmp, contents, { mode: 0o600 });
+    // Best-effort: non-POSIX filesystems reject it, and a failure must not lose
+    // a credential that is otherwise written correctly.
+    try {
+        await fs.chmod(tmp, 0o600);
+    }
+    catch { /* non-POSIX */ }
+    try {
+        await fs.rename(tmp, path);
+    }
+    catch (e) {
+        try {
+            await fs.rm(tmp, { force: true });
+        }
+        catch { /* nothing to clean */ }
+        throw e;
+    }
+}
+export async function writeAuthToken(token, stateDir) {
     /* 0o700 on the DIRECTORY, not just 0o600 on the file. Without a mode, mkdir
      * lands on the process umask -- typically 0o755, so the directory holding a
      * bearer token is world-listable. The file's own contents stay protected
@@ -37,36 +143,319 @@ export async function writeAuthToken(token) {
      * has a Corenel token and when they last refreshed it. `recursive: true`
      * applies the mode only to directories it actually CREATES, so this never
      * tightens a pre-existing ~/.corenel a user set up deliberately. */
-    await fs.mkdir(corenelDir(), { recursive: true, mode: 0o700 });
-    await fs.writeFile(authTokenPath(), token.trim() + '\n', { mode: 0o600 });
-    // Both chmods are best-effort: non-POSIX filesystems reject them, and a
-    // failure here must not lose a token that is already written correctly.
+    const dir = credentialDir(stateDir);
+    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    await writeFilePrivateAtomic(tokenFilePath(stateDir), token.trim() + '\n');
+    // Best-effort: non-POSIX filesystems reject it, and a failure here must not
+    // lose a token that is already written correctly.
+    try {
+        await fs.chmod(dir, 0o700);
+    }
+    catch { /* non-POSIX */ }
+}
+/**
+ * Record a completed sign-in in BOTH stores, including WHERE it was minted.
+ *
+ * `writeAuthToken` alone leaves the token file holding a bearer token with no
+ * record of which API issued it -- which is fine right up until the machine is
+ * pointed somewhere else by a default, and then it is a 401 with no visible
+ * cause. The base goes in auth.json because the token file is one line by
+ * contract and every existing reader of it splits on nothing.
+ *
+ * The credential record is REPLACED, not merged: a new sign-in may be a
+ * different account at a different host, and carrying the previous one's
+ * account or base onto it would report something nobody established.
+ *
+ * TWO FILES, AND A READER BETWEEN THEM. `resolveNodeCredential` borrows the
+ * account from auth.json only when auth.json describes the SAME token the
+ * token file holds -- which is right, and which means that during a RE-login
+ * the two disagree and the account reads as absent. That is fail-closed (a
+ * daemon files that handshake under its per-origin id, exactly as it did
+ * before any of this) but it is not free: the directory it mints then
+ * persists. So the window is made as small as two files allow. Both new
+ * contents are staged first, and the two renames happen back to back with no
+ * mkdir, no chmod and no JSON encoding between them -- microseconds rather
+ * than the duration of two file writes.
+ *
+ * It is not ZERO, and cannot be while the credential lives in two files. The
+ * honest fix is one file, which means changing what the gateway client and
+ * @corenel/cli have always read; the precedence comment at the top of this
+ * module is the record of why that has not been done.
+ *
+ * The credential file is renamed FIRST. Whichever order is chosen the
+ * intermediate state loses the account, so the tiebreak is which token a
+ * reader gets in that instant: credential-first leaves the token file holding
+ * the PREVIOUS token, which is the credential that was working a moment ago.
+ * Token-first would publish the new token with no account and no recorded
+ * base -- a state no sign-in ever produced.
+ */
+export async function writeLoginCredential(token, opts = {}) {
+    const cred = {
+        accessToken: token.trim(),
+        ...(opts.account ? { account: opts.account } : {}),
+        ...(opts.apiBase ? { apiBase: opts.apiBase } : {}),
+    };
+    const dir = credentialDir(opts.stateDir);
+    const credPath = credentialFilePath(opts.stateDir);
+    const tokPath = tokenFilePath(opts.stateDir);
+    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    // Staged before either is published, so the publish is two renames and
+    // nothing else.
+    const credTmp = `${credPath}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+    const tokTmp = `${tokPath}.tmp-${process.pid.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+    await fs.writeFile(credTmp, `${JSON.stringify(cred, null, 2)}\n`, { mode: 0o600 });
+    await fs.writeFile(tokTmp, `${cred.accessToken}\n`, { mode: 0o600 });
     try {
-        await fs.chmod(authTokenPath(), 0o600);
+        await fs.chmod(credTmp, 0o600);
     }
     catch { /* non-POSIX */ }
     try {
-        await fs.chmod(corenelDir(), 0o700);
+        await fs.chmod(tokTmp, 0o600);
     }
     catch { /* non-POSIX */ }
+    try {
+        await fs.rename(credTmp, credPath);
+        await fs.rename(tokTmp, tokPath);
+    }
+    catch (e) {
+        try {
+            await fs.rm(credTmp, { force: true });
+        }
+        catch { /* nothing to clean */ }
+        try {
+            await fs.rm(tokTmp, { force: true });
+        }
+        catch { /* nothing to clean */ }
+        throw e;
+    }
+    try {
+        await fs.chmod(dir, 0o700);
+    }
+    catch { /* non-POSIX */ }
+}
+/** ENOENT -- the store simply is not there -- as opposed to any other failure. */
+function isMissing(err) {
+    return typeof err === 'object' && err !== null && err.code === 'ENOENT';
+}
+export async function readAuthToken(stateDir) {
+    return (await readAuthTokenRead(stateDir)).value;
+}
+/** `readAuthToken`, keeping the absent/unreadable distinction. */
+export async function readAuthTokenRead(stateDir) {
+    try {
+        const t = (await fs.readFile(tokenFilePath(stateDir), 'utf8')).trim();
+        // An empty file is an absence, not a failure: that is what a half-finished
+        // sign-out or an interrupted write leaves, and there is nothing to retry.
+        return { value: t || null, unreadable: false };
+    }
+    catch (err) {
+        return { value: null, unreadable: !isMissing(err) };
+    }
+}
+/** Remove the token file only. Prefer clearAllCredentials for anything a user
+ *  would call signing out — see the warning there. */
+export async function clearAuthToken(stateDir) {
+    try {
+        await fs.rm(tokenFilePath(stateDir), { force: true });
+    }
+    catch { /* already gone */ }
 }
-export async function readAuthToken() {
+/** Read `<dir>/auth.json`, or null when there is none. A malformed file is
+ * treated as absent rather than fatal — a corrupt credential should send the
+ * user through sign-in, not wedge the daemon. */
+export async function readCredentialFile(stateDir) {
+    return (await readCredentialFileRead(stateDir)).value;
+}
+/** `readCredentialFile`, keeping the absent/unreadable distinction. See
+ *  CredentialRead for why a caller would want it. */
+export async function readCredentialFileRead(stateDir) {
+    let raw;
     try {
-        const t = (await fs.readFile(authTokenPath(), 'utf8')).trim();
-        return t || null;
+        raw = await fs.readFile(credentialFilePath(stateDir), 'utf8');
+    }
+    catch (err) {
+        // ENOENT is the ordinary case and is a clean absence. EACCES/EISDIR/EBUSY
+        // yield no usable credential either -- crashing the daemon over one helps
+        // nobody -- but they are REPORTED as unreadable, because a caller that
+        // publishes a state off this answer must not read them as a sign-out.
+        return { value: null, unreadable: !isMissing(err) };
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null)
+            return { value: null, unreadable: false };
+        const c = parsed;
+        if (typeof c.accessToken !== 'string' || !c.accessToken)
+            return { value: null, unreadable: false };
+        return {
+            value: {
+                accessToken: c.accessToken,
+                ...(typeof c.refreshToken === 'string' ? { refreshToken: c.refreshToken } : {}),
+                ...(typeof c.expiresAt === 'number' ? { expiresAt: c.expiresAt } : {}),
+                ...(typeof c.account === 'string' ? { account: c.account } : {}),
+                ...(typeof c.apiBase === 'string' && c.apiBase ? { apiBase: c.apiBase } : {}),
+            },
+            unreadable: false,
+        };
     }
     catch {
-        return null;
+        return { value: null, unreadable: false };
     }
 }
-export async function clearAuthToken() {
+/**
+ * Sign out of BOTH stores.
+ *
+ * Clearing one while the other still authenticates is the same divergence bug
+ * pointing the other way, and worse: the operator believes they signed out
+ * while the gateway keeps sending a credential. Every sign-out path must land
+ * here rather than removing a single file.
+ */
+export async function clearAllCredentials(stateDir) {
+    await clearAuthToken(stateDir);
     try {
-        await fs.rm(authTokenPath(), { force: true });
+        await fs.rm(credentialFilePath(stateDir), { force: true });
     }
     catch { /* already gone */ }
 }
-/** The IAuthTokenProvider for node: the stored login token, else CORENEL_TOKEN env. */
-export function nodeAuthToken() {
-    return { getToken: async () => (await readAuthToken()) ?? process.env.CORENEL_TOKEN ?? null };
+/**
+ * Resolve the credential this machine authenticates with, per the precedence
+ * documented at the top of this file.
+ *
+ * An expired stored credential is REPORTED, not skipped: the caller decides
+ * whether to refresh or re-prompt, and one that ignores `expired` fails at the
+ * gateway rather than here. A token file records no expiry at all, so
+ * `expiresAt` stays undefined for it unless the credential file beside it
+ * describes the same token — the absence of an expiry must never be read as
+ * evidence of freshness.
+ */
+export async function resolveNodeCredential(opts = {}) {
+    const env = opts.env ?? process.env;
+    const now = opts.now ?? Date.now;
+    const stateDir = opts.stateDir;
+    const fromEnv = env[TOKEN_ENV]?.trim();
+    if (fromEnv)
+        return { token: fromEnv, source: 'env' };
+    const credRead = await readCredentialFileRead(stateDir);
+    const tokenRead = await readAuthTokenRead(stateDir);
+    const cred = credRead.value;
+    const fileToken = tokenRead.value;
+    /* Carried through whatever this resolves to, including a SUCCESSFUL resolve:
+     * a readable token file beside an unreadable auth.json answers with a token
+     * and no account, and a caller that publishes a sign-out off that missing
+     * account needs to know the difference. Omitted rather than set false, so an
+     * ordinary result is the same object it always was. */
+    const unreadable = credRead.unreadable || tokenRead.unreadable ? { unreadable: true } : {};
+    if (fileToken) {
+        // Metadata is borrowed ONLY when the credential file describes this same
+        // token. Two different tokens mean two different sign-ins, and attaching
+        // one's expiry to the other would report a freshness nobody established.
+        const same = cred && cred.accessToken === fileToken ? cred : null;
+        return {
+            ...withExpiry({ token: fileToken, source: 'token-file', path: tokenFilePath(stateDir) }, same, now),
+            ...unreadable,
+        };
+    }
+    if (cred) {
+        return {
+            ...withExpiry({ token: cred.accessToken, source: 'credential-file', path: credentialFilePath(stateDir) }, cred, now),
+            ...unreadable,
+        };
+    }
+    return { token: null, source: 'none', ...unreadable };
+}
+function withExpiry(base, cred, now) {
+    if (!cred)
+        return base;
+    const expired = typeof cred.expiresAt === 'number' && cred.expiresAt <= now();
+    return {
+        ...base,
+        ...(typeof cred.expiresAt === 'number' ? { expiresAt: cred.expiresAt } : {}),
+        ...(expired ? { expired: true } : {}),
+        ...(cred.account ? { account: cred.account } : {}),
+        ...(cred.apiBase ? { apiBase: cred.apiBase } : {}),
+    };
+}
+/**
+ * Which API to talk to.
+ *
+ *   1. an explicit flag        — the operator is pointing somewhere on purpose
+ *   2. CORENEL_API_BASE        — a container/CI statement of present intent
+ *   3. the credential's base   — where the token this machine holds was minted
+ *   4. DEFAULT_API_BASE        — nothing has been said, so say the product's own
+ *
+ * (3) is the change worth stating: the sidecar carried a literal default, so a
+ * user who signed in against one deployment had their daemon talk to another,
+ * and the only symptom was a 401 or a 404 far from the login. Preferring the
+ * credential's own base makes the common case need no flag at all, while (1)
+ * keeps `--endpoint` meaning exactly what it says for local dev.
+ *
+ * A second change to (1): the sidecar's `daemon.json` can also carry an
+ * `endpoint`, and since the CLI's config-layering fix it is passed in here as
+ * `explicit` too (an operator who wrote it into the file chose it, same as
+ * typing the flag) -- so it now outranks (2) `CORENEL_API_BASE` as well. A
+ * container/CI operator relying on the env var to override a baked-in
+ * `daemon.json` endpoint at deploy time now silently no-ops: the file wins.
+ * Override it with `--endpoint` (still rung 1, and still per-invocation) or by
+ * editing the file itself, not the environment.
+ */
+export async function resolveApiBase(opts = {}) {
+    const explicit = opts.explicit?.trim();
+    if (explicit)
+        return { base: explicit, source: 'explicit' };
+    const fromEnv = (opts.env ?? process.env)[API_BASE_ENV]?.trim();
+    if (fromEnv)
+        return { base: fromEnv, source: 'env' };
+    const cred = await resolveNodeCredential({
+        env: {},
+        ...(opts.stateDir ? { stateDir: opts.stateDir } : {}),
+    });
+    if (cred.apiBase)
+        return { base: cred.apiBase, source: 'credential' };
+    return { base: DEFAULT_API_BASE, source: 'default' };
+}
+/** A token is a credential; printing one puts it in scrollback, shell history
+ *  and any screen share. Four leading characters identify WHICH token this is
+ *  without being usable if the output is pasted somewhere. */
+export function maskToken(token) {
+    const t = token.trim();
+    if (t.length <= 8)
+        return '****';
+    return `${t.slice(0, 4)}…${t.slice(-2)} (${t.length} chars)`;
+}
+/**
+ * Mask an account/identity string for output that might land in a support
+ * thread or a public issue tracker (`corenel doctor`'s REACHABILITY line) --
+ * as opposed to `corenel login`/`corenel auth`, which print it in full because
+ * they are interactive and purpose-built for exactly that question. Preserves
+ * the domain (still answers "is this the org/deployment I expected?") while
+ * hiding the local part: `sbaker@logikbug.com` -> `s***r@logikbug.com`.
+ *
+ * A one- or two-character local part is NOT masked by keeping its first and
+ * last character -- for length 1 that character IS the whole local part, and
+ * for length 2 it is BOTH characters, so that scheme would print it in full
+ * under the name of masking it. Those collapse to a fixed, content-free `**`
+ * instead. A value that is not email-shaped at all (no `@`, or an empty local
+ * or domain half) -- or is empty/absent -- degrades to a generic redacted
+ * marker rather than being printed raw. Never throws: this runs in a
+ * diagnostic command that exists for when things are already broken, and a
+ * masking helper crashing on an unexpected shape would be exactly backwards.
+ */
+export function maskAccount(account) {
+    const s = (account ?? '').trim();
+    if (!s)
+        return '(no identity recorded)';
+    const at = s.indexOf('@');
+    if (at <= 0 || at === s.length - 1)
+        return '(unrecognized identity)';
+    const local = s.slice(0, at);
+    const domain = s.slice(at + 1);
+    const maskedLocal = local.length <= 2 ? '**' : `${local[0]}***${local[local.length - 1]}`;
+    return `${maskedLocal}@${domain}`;
+}
+/** The IAuthTokenProvider for node. Resolves exactly what `auth` reports, which
+ *  is the whole point: the status command must describe the credential the
+ *  gateway will actually send. */
+export function nodeAuthToken(stateDir) {
+    return { getToken: async () => (await resolveNodeCredential(stateDir ? { stateDir } : {})).token };
 }
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../auth.ts"],"names":[],"mappings":"AAAA;;;;yEAIyE;AACzE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;;;;;kBAMkB;AAElB;2DAC2D;AAC3D,MAAM,UAAU,UAAU,CAAC,OAAe,OAAO,EAAE;IACjD,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;iFACiF;AACjF,MAAM,UAAU,UAAU,CAAC,OAAe,OAAO,EAAE;IACjD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,aAAa,CAAC,OAAe,OAAO,EAAE;IACpD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD;;;;;;wEAMoE;IACpE,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IACzE,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,OAAO,CAAC,IAAI,IAAI,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AACrF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,aAAa;IAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,aAAa,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;AAChG,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEnE;;;;;;4DAM4D;AAE5D;2DAC2D;AAC3D,MAAM,UAAU,UAAU,CAAC,OAAe,OAAO,EAAE;IACjD,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;iFACiF;AACjF,MAAM,UAAU,UAAU,CAAC,OAAe,OAAO,EAAE;IACjD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,aAAa,CAAC,OAAe,OAAO,EAAE;IACpD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,OAAO,QAAQ,IAAI,UAAU,EAAE,CAAC;AAClC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,QAAiB;IAClD,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;AAEzC;+EAC+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAsC/C;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACjG,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,4EAA4E;IAC5E,oDAAoD;IACpD,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC3E,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,QAAiB;IACnE;;;;;;wEAMoE;IACpE,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,sBAAsB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3E,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa,EACb,OAAkE,EAAE;IAEpE,MAAM,IAAI,GAAqB;QAC7B,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE;QACzB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;IACF,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,uEAAuE;IACvE,gBAAgB;IAChB,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACzG,MAAM,MAAM,GAAG,GAAG,OAAO,QAAQ,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACvG,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IACjE,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC/E,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC9E,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;AAC/D,CAAC;AA6BD,kFAAkF;AAClF,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAK,GAA0B,CAAC,IAAI,KAAK,QAAQ,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAiB;IACnD,OAAO,CAAC,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAiB;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,OAAO,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED;sDACsD;AACtD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAiB;IACpD,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAC7F,CAAC;AAED;;iDAEiD;AACjD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAiB;IACxD,OAAO,CAAC,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AACxD,CAAC;AAED;qDACqD;AACrD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAiB;IAEjB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,sEAAsE;QACtE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7F,MAAM,CAAC,GAAG,MAAiC,CAAC;QAC5C,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QACnG,OAAO;YACL,KAAK,EAAE;gBACL,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,GAAG,CAAC,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9E;YACD,UAAU,EAAE,KAAK;SAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAiB;IACzD,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAClG,CAAC;AAwCD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAiC,EAAE;IAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAE/B,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAEtD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC5B,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;IAClC;;;;2DAIuD;IACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpG,IAAI,SAAS,EAAE,CAAC;QACd,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,OAAO;YACL,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC;YACnG,GAAG,UAAU;SACd,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;YACL,GAAG,UAAU,CACX,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAC1F,IAAI,EACJ,GAAG,CACJ;YACD,GAAG,UAAU;SACd,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CACjB,IAAwB,EACxB,IAA6B,EAC7B,GAAiB;IAEjB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;IAC9E,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;AACJ,CAAC;AAmBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B,EAAE;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,IAAI,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC;QACvC,GAAG,EAAE,EAAE;QACP,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACtE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvD,CAAC;AAED;;8DAE8D;AAC9D,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACjC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,WAAW,CAAC,OAAkC;IAC5D,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,wBAAwB,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,yBAAyB,CAAC;IACrE,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;IAC1F,OAAO,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC;AACpC,CAAC;AAED;;kCAEkC;AAClC,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AACrG,CAAC"}

package/dist/fileService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fileService.d.ts","sourceRoot":"","sources":["../fileService.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAsE1F;;;;;;;;;;uBAUuB;AACvB,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,GAAE,MAAY,GAAG,OAAO,CAgB3E;AAED,qBAAa,eAAgB,YAAW,WAAW;IACjD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAe;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,QAAQ;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO;IAM3D,yEAAyE;IACzE,OAAO,CAAC,MAAM;IAId;sFACkF;IAClF,OAAO,CAAC,GAAG;IAMX;;uFAEmF;YACrE,UAAU;IAoBxB,mFAAmF;YACrE,OAAO;IAMf,IAAI,CAAC,GAAG,SAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAuBnC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAS5C,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/C,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAU9C,QAAQ,IAAI,MAAM,IAAI;CAGvB"}
+{"version":3,"file":"fileService.d.ts","sourceRoot":"","sources":["../fileService.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAsE1F;;;;;;;;;;uBAUuB;AACvB,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,GAAE,MAAY,GAAG,OAAO,CAgB3E;AAED,qBAAa,eAAgB,YAAW,WAAW;IACjD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAe;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,QAAQ;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO;IAM3D,yEAAyE;IACzE,OAAO,CAAC,MAAM;IAId;sFACkF;IAClF,OAAO,CAAC,GAAG;IAMX;;uFAEmF;YACrE,UAAU;IAoBxB,mFAAmF;YACrE,OAAO;IAMf,IAAI,CAAC,GAAG,SAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IA4BnC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAS5C,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/C,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAU9C,QAAQ,IAAI,MAAM,IAAI;CAGvB"}

package/dist/fileService.js

@@ -206,8 +206,13 @@ export class NodeFileService {
                     out.push({ name: e.name, path, kind: 'directory', children: await walk(absChild) });
                 }
                 else {
+                    // The stat is already being paid for `size`; `mtime` rides along for
+                    // free. It is what lets a caller ORDER files without reading them
+                    // (the session store pages its newest-first list off this), so the
+                    // node backend now matches DirectoryHandleFileService, which has
+                    // always supplied both.
                     const st = await fs.stat(absChild).catch(() => null);
-                    out.push({ name: e.name, path, kind: 'file', size: st?.size, ext: extOf(e.name) });
+                    out.push({ name: e.name, path, kind: 'file', size: st?.size, mtime: st?.mtimeMs, ext: extOf(e.name) });
                 }
             }
             return out;
@@ -220,7 +225,7 @@ export class NodeFileService {
     async stat(path) {
         try {
             const st = await fs.stat(this.abs(path));
-            return { path: normalizeFilePath(path), kind: st.isDirectory() ? 'directory' : 'file', size: st.size, ext: extOf(path) };
+            return { path: normalizeFilePath(path), kind: st.isDirectory() ? 'directory' : 'file', size: st.size, mtime: st.mtimeMs, ext: extOf(path) };
         }
         catch {
             return null;

package/dist/fileService.js.map

@@ -1 +1 @@
-{"version":3,"file":"fileService.js","sourceRoot":"","sources":["../fileService.ts"],"names":[],"mappings":"AAAA;;;;gDAIgD;AAChD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAExF,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;;;;;;;;;;;;;sCAiBsC;AACtC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;IACnB,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;IACpE,cAAc,EAAE,cAAc,EAAE,mBAAmB;CACpD,CAAC,CAAC;AAEH;;;;;;;;eAQe;AACf,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAE/C;;;;;;;;;;;;;;iDAciD;AACjD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,qBAAqB,EAAE,WAAW,EAAE,YAAY,EAAE,uBAAuB;IACzE,aAAa;CACd,CAAC,CAAC;AAEH;;;uBAGuB;AACvB,KAAK,UAAU,0BAA0B,CAAC,MAAc;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;uBAUuB;AACvB,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,cAAsB,GAAG;IAChE,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpD,gEAAgE;IAChE,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,oCAAoC;QAC7E,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,YAAY;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,eAAe;IAO1B,YAAY,IAAY,EAAE,OAA+B,EAAE;QANlD;;;;mBAAwB,WAAW;WAAC;QACpC;;;;;WAAc;QACd;;;;mBAAc,IAAI;WAAC;QACnB;;;;;WAAkB;QACV;;;;;WAAa;QAG5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACxC,CAAC;IAED,yEAAyE;IACjE,MAAM,CAAC,CAAS;QACtB,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED;sFACkF;IAC1E,GAAG,CAAC,CAAS;QACnB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;uFAEmF;IAC3E,KAAK,CAAC,UAAU,CAAC,CAAS;QAChC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,SAAS,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACrC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,EAAE,CAAC,CAAC;gBACvE,CAAC;gBACD,OAAO;YACT,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;oBAAE,MAAM,CAAC,CAAC;gBACrE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC9B,IAAI,MAAM,KAAK,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAC;gBAC5F,KAAK,GAAG,MAAM,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,OAAO,CAAC,CAAS;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE;QACjB,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAuB,EAAE;YACzD,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBAAC,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,CAAC;YAAC,CAAC;YACzF,MAAM,GAAG,GAAe,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtC,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC9D,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACtD,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,0BAA0B,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACrG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;oBACpB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACtF,CAAC;qBAAM,CAAC;oBACN,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;oBACrD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3H,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,OAAe;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,KAAiB;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,OAAO,GAAG,EAAE;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,0BAA0B;QAC5E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;YAC/F,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,EAAU;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACrE,IAAI,CAAC;gBAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;QACtH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,QAAQ;QACN,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,gEAAgE;IACnF,CAAC;CACF"}
+{"version":3,"file":"fileService.js","sourceRoot":"","sources":["../fileService.ts"],"names":[],"mappings":"AAAA;;;;gDAIgD;AAChD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAExF,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;;;;;;;;;;;;;sCAiBsC;AACtC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;IACnB,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;IACpE,cAAc,EAAE,cAAc,EAAE,mBAAmB;CACpD,CAAC,CAAC;AAEH;;;;;;;;eAQe;AACf,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAE/C;;;;;;;;;;;;;;iDAciD;AACjD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,qBAAqB,EAAE,WAAW,EAAE,YAAY,EAAE,uBAAuB;IACzE,aAAa;CACd,CAAC,CAAC;AAEH;;;uBAGuB;AACvB,KAAK,UAAU,0BAA0B,CAAC,MAAc;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;uBAUuB;AACvB,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,cAAsB,GAAG;IAChE,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpD,gEAAgE;IAChE,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,oCAAoC;QAC7E,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,YAAY;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,eAAe;IAO1B,YAAY,IAAY,EAAE,OAA+B,EAAE;QANlD;;;;mBAAwB,WAAW;WAAC;QACpC;;;;;WAAc;QACd;;;;mBAAc,IAAI;WAAC;QACnB;;;;;WAAkB;QACV;;;;;WAAa;QAG5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACxC,CAAC;IAED,yEAAyE;IACjE,MAAM,CAAC,CAAS;QACtB,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED;sFACkF;IAC1E,GAAG,CAAC,CAAS;QACnB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;uFAEmF;IAC3E,KAAK,CAAC,UAAU,CAAC,CAAS;QAChC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,SAAS,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACrC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,EAAE,CAAC,CAAC;gBACvE,CAAC;gBACD,OAAO;YACT,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;oBAAE,MAAM,CAAC,CAAC;gBACrE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC9B,IAAI,MAAM,KAAK,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAC;gBAC5F,KAAK,GAAG,MAAM,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,OAAO,CAAC,CAAS;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE;QACjB,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAuB,EAAE;YACzD,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBAAC,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,CAAC;YAAC,CAAC;YACzF,MAAM,GAAG,GAAe,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtC,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC9D,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACtD,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,0BAA0B,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACrG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;oBACpB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACtF,CAAC;qBAAM,CAAC;oBACN,qEAAqE;oBACrE,kEAAkE;oBAClE,mEAAmE;oBACnE,iEAAiE;oBACjE,wBAAwB;oBACxB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;oBACrD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACzG,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9I,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,OAAe;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,KAAiB;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,OAAO,GAAG,EAAE;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,0BAA0B;QAC5E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;YAC/F,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,EAAU;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACrE,IAAI,CAAC;gBAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;QACtH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,QAAQ;QACN,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,gEAAgE;IACnF,CAAC;CACF"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { NodeFileService } from './fileService';
-export { corenelDir, sidecarDir, authTokenPath, writeAuthToken, readAuthToken, clearAuthToken, nodeAuthToken, } from './auth';
+export { corenelDir, sidecarDir, authTokenPath, credentialDir, tokenFilePath, credentialFilePath, writeAuthToken, readAuthToken, readAuthTokenRead, readCredentialFile, readCredentialFileRead, clearAuthToken, clearAllCredentials, resolveNodeCredential, nodeAuthToken, maskToken, maskAccount, TOKEN_ENV, writeLoginCredential, resolveApiBase, API_BASE_ENV, type StoredCredential, type CredentialSource, type ResolvedCredential, type ResolveCredentialOptions, type CredentialRead, type ApiBaseSource, type ResolvedApiBase, type ResolveApiBaseOptions, } from './auth';
 export { nodePromptHost } from './promptHost';
 export { migrateHomeLayout, type MigrationReport } from './migrateHome';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,GACpG,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EACvF,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,EAC5F,cAAc,EAAE,mBAAmB,EACnC,qBAAqB,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EACvE,oBAAoB,EAAE,cAAc,EAAE,YAAY,EAClD,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,KAAK,wBAAwB,EACpG,KAAK,cAAc,EACnB,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,qBAAqB,GACrE,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 /* @corenel/tools-node — node capabilities (the tools-web twin). */
 export { NodeFileService } from './fileService';
-export { corenelDir, sidecarDir, authTokenPath, writeAuthToken, readAuthToken, clearAuthToken, nodeAuthToken, } from './auth';
+export { corenelDir, sidecarDir, authTokenPath, credentialDir, tokenFilePath, credentialFilePath, writeAuthToken, readAuthToken, readAuthTokenRead, readCredentialFile, readCredentialFileRead, clearAuthToken, clearAllCredentials, resolveNodeCredential, nodeAuthToken, maskToken, maskAccount, TOKEN_ENV, writeLoginCredential, resolveApiBase, API_BASE_ENV, } from './auth';
 export { nodePromptHost } from './promptHost';
 export { migrateHomeLayout } from './migrateHome';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,GACpG,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAwB,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EACvF,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,EAC5F,cAAc,EAAE,mBAAmB,EACnC,qBAAqB,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EACvE,oBAAoB,EAAE,cAAc,EAAE,YAAY,GAInD,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAwB,MAAM,eAAe,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corenel/tools-node",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "license": "Elastic-2.0",
   "type": "module",
   "description": "Corenel node capabilities — the tools-web twin. A disk-backed FileService (the harness file tools + node PromptHost workspace) over node:fs, confined to a root. Shell/secrets/~/.corenel to follow.",
@@ -16,8 +16,8 @@
   },
   "dependencies": {
     "@prompd/core": "0.5.0-beta.10",
-    "@corenel/harness": "0.4.1",
-    "@corenel/protocol": "0.4.1"
+    "@corenel/protocol": "0.6.1",
+    "@corenel/harness": "0.6.1"
   },
   "devDependencies": {
     "@types/node": "^24.13.1",
@@ -30,6 +30,11 @@
   "files": [
     "dist"
   ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Prompd/prompd-web.git",
+    "directory": "packages/tools-node"
+  },
   "scripts": {
     "typecheck": "tsc --noEmit",
     "preverify": "pnpm --filter @corenel/protocol build && pnpm --filter @corenel/harness build",