@fml-inc/fml 0.7.0 → 0.8.0-rc.2

package/dist/chunk-VV4JHH4H.js

@@ -1,437 +0,0 @@
-// src/auth/token-store.ts
-import fs3 from "fs";
-import path3 from "path";
-
-// src/config.ts
-import fs2 from "fs";
-import os2 from "os";
-import path2 from "path";
-
-// src/dirs.ts
-import fs from "fs";
-import os from "os";
-import path from "path";
-var home = os.homedir();
-function dataDir() {
-  if (process.env.FML_DATA_DIR) return process.env.FML_DATA_DIR;
-  switch (process.platform) {
-    case "darwin":
-      return path.join(home, "Library", "Application Support", "fml");
-    case "win32":
-      return path.join(
-        process.env.APPDATA ?? path.join(home, "AppData", "Roaming"),
-        "fml"
-      );
-    default:
-      return path.join(
-        process.env.XDG_DATA_HOME ?? path.join(home, ".local", "share"),
-        "fml"
-      );
-  }
-}
-function logDir() {
-  if (process.env.FML_LOG_DIR) return process.env.FML_LOG_DIR;
-  switch (process.platform) {
-    case "darwin":
-      return path.join(home, "Library", "Logs", "fml");
-    case "win32":
-      return path.join(
-        process.env.APPDATA ?? path.join(home, "AppData", "Roaming"),
-        "fml",
-        "logs"
-      );
-    default:
-      return path.join(
-        process.env.XDG_STATE_HOME ?? path.join(home, ".local", "state"),
-        "fml",
-        "log"
-      );
-  }
-}
-var FML_DATA_DIR = dataDir();
-var FML_LOG_DIR = logDir();
-
-// src/config.ts
-var DEFAULT_PROD_URL = "https://trustworthy-chihuahua-382.convex.cloud";
-var DEFAULT_SYNC_URL = DEFAULT_PROD_URL.replace(
-  ".convex.cloud",
-  ".convex.site"
-);
-var DEFAULT_TARGET_NAME = "fml";
-var ENV_CONFIG_PATH = path2.join(FML_DATA_DIR, "env.json");
-function readEnvConfig() {
-  try {
-    const raw = fs2.readFileSync(ENV_CONFIG_PATH, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return { active: DEFAULT_TARGET_NAME };
-  }
-}
-function writeEnvConfig(config) {
-  const dir = path2.dirname(ENV_CONFIG_PATH);
-  if (!fs2.existsSync(dir)) {
-    fs2.mkdirSync(dir, { recursive: true, mode: 448 });
-  }
-  fs2.writeFileSync(ENV_CONFIG_PATH, `${JSON.stringify(config, null, 2)}
-`, {
-    mode: 384
-  });
-}
-function envConfigExists() {
-  return fs2.existsSync(ENV_CONFIG_PATH);
-}
-function resolveEnvConvexUrl(envName) {
-  try {
-    const panoDataDir = process.env.PANOPTICON_DATA_DIR ?? (process.platform === "darwin" ? path2.join(
-      os2.homedir(),
-      "Library",
-      "Application Support",
-      "panopticon"
-    ) : process.platform === "win32" ? path2.join(
-      process.env.APPDATA ?? path2.join(os2.homedir(), "AppData", "Roaming"),
-      "panopticon"
-    ) : path2.join(os2.homedir(), ".local", "share", "panopticon"));
-    const raw = fs2.readFileSync(path2.join(panoDataDir, "config.json"), "utf-8");
-    const panoConf = JSON.parse(raw);
-    const target = panoConf.sync?.targets?.find((t) => t.name === envName);
-    if (target) {
-      return target.url.replace(".convex.site", ".convex.cloud");
-    }
-  } catch {
-  }
-  return null;
-}
-function getActiveEnv() {
-  const name = readEnvConfig().active;
-  return { name, convexUrl: resolveEnvConvexUrl(name) };
-}
-function authStorePathFor(envName) {
-  return path2.join(FML_DATA_DIR, `auth.${envName}.json`);
-}
-var ENV_NAME_RE = /^[A-Za-z0-9_-]+$/;
-function isValidEnvName(envName) {
-  return ENV_NAME_RE.test(envName);
-}
-var CONVEX_URL = (process.env.FML_CONVEX_URL ?? getActiveEnv().convexUrl ?? DEFAULT_PROD_URL).replace(/\/$/, "");
-var WORKOS_API_URL = "https://api.workos.com";
-var WORKOS_AUTH_URL = "https://auth.fml.inc";
-function authStorePath() {
-  return authStorePathFor(getActiveEnv().name);
-}
-function getSiteUrl() {
-  return CONVEX_URL.replace(".convex.cloud", ".convex.site").replace(
-    /:\d+$/,
-    ""
-  );
-}
-
-// src/sentry.ts
-var initialized = false;
-var sentry = null;
-async function loadSentry() {
-  if (sentry) return sentry;
-  try {
-    sentry = await import("./esm-2EUDFZWP.js");
-    return sentry;
-  } catch {
-    return null;
-  }
-}
-async function initSentry() {
-  if (initialized) return;
-  initialized = true;
-  const mod = await loadSentry();
-  if (!mod) return;
-  const client = new mod.ServerRuntimeClient({
-    dsn: "https://4c243521c03917c886d0bf33bc0038c8@o4510167429873664.ingest.us.sentry.io/4511078213156864",
-    tracesSampleRate: 0,
-    integrations: [],
-    stackParser: mod.createStackParser(mod.nodeStackLineParser()),
-    transport: (options) => mod.createTransport(options, async (request) => {
-      const res = await fetch(options.url, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-sentry-envelope" },
-        body: request.body
-      });
-      return { statusCode: res.status };
-    })
-  });
-  mod.setCurrentClient(client);
-  client.init();
-}
-var Sentry = {
-  captureException: (err) => sentry?.captureException(err),
-  captureMessage: (msg) => sentry?.captureMessage(msg)
-};
-
-// src/auth/token-store.ts
-function storePathFor(envName) {
-  return envName ? authStorePathFor(envName) : authStorePath();
-}
-function ensureDir(envName) {
-  const dir = path3.dirname(storePathFor(envName));
-  if (!fs3.existsSync(dir)) {
-    fs3.mkdirSync(dir, { recursive: true, mode: 448 });
-  }
-}
-function readTokens(envName) {
-  try {
-    const data = fs3.readFileSync(storePathFor(envName), "utf-8");
-    return JSON.parse(data);
-  } catch {
-    return null;
-  }
-}
-function writeTokens(auth, envName) {
-  ensureDir(envName);
-  fs3.writeFileSync(storePathFor(envName), JSON.stringify(auth, null, 2), {
-    mode: 384
-  });
-}
-function getSelectedOrg(envName) {
-  return readTokens(envName)?.orgSlug ?? null;
-}
-function setSelectedOrg(orgSlug, envName) {
-  const stored = readTokens(envName);
-  if (!stored) return;
-  writeTokens({ ...stored, orgSlug }, envName);
-}
-var SERVICE_TOKEN_LOGIN_USER_ID = "service-token";
-var ACTIVE_KEY = "__active__";
-var serviceTokenCaches = /* @__PURE__ */ new Map();
-var serviceRefreshPromises = /* @__PURE__ */ new Map();
-var oauthRefreshPromises = /* @__PURE__ */ new Map();
-var cacheKey = (envName) => envName ?? ACTIVE_KEY;
-var SERVICE_ACCESS_TOKEN_PATH = path3.join(FML_DATA_DIR, "access_token");
-function getSiteUrl2(envName) {
-  const explicit = process.env.CONVEX_SITE_URL;
-  if (explicit) return explicit.replace(/\/$/, "");
-  if (envName) {
-    const envConvexUrl = resolveEnvConvexUrl(envName);
-    if (envConvexUrl) {
-      return envConvexUrl.replace(".convex.cloud", ".convex.site");
-    }
-  }
-  return CONVEX_URL.replace(".convex.cloud", ".convex.site");
-}
-async function refreshServiceToken(refreshToken2, envName) {
-  try {
-    const response = await fetch(`${getSiteUrl2(envName)}/api/tokens/refresh`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${refreshToken2}`
-      }
-    });
-    if (!response.ok) {
-      console.error(
-        `[fml] Service token refresh failed: HTTP ${response.status}`
-      );
-      return null;
-    }
-    const data = await response.json();
-    if (!data.ok || !data.accessToken) {
-      console.error(`[fml] Service token refresh error: ${data.error}`);
-      return null;
-    }
-    serviceTokenCaches.set(cacheKey(envName), {
-      accessToken: data.accessToken,
-      expiresAt: data.expiresAt
-    });
-    try {
-      const dir = path3.dirname(SERVICE_ACCESS_TOKEN_PATH);
-      if (!fs3.existsSync(dir)) {
-        fs3.mkdirSync(dir, { recursive: true, mode: 448 });
-      }
-      fs3.writeFileSync(SERVICE_ACCESS_TOKEN_PATH, data.accessToken, {
-        mode: 384
-      });
-    } catch {
-    }
-    return data.accessToken;
-  } catch (err) {
-    Sentry.captureException(err);
-    console.error(`[fml] Service token refresh error: ${err}`);
-    return null;
-  }
-}
-async function storeServiceRefreshToken(refreshToken2, opts) {
-  const token = refreshToken2.trim();
-  if (!token.startsWith("fml_srt_")) {
-    console.error(
-      "[fml] Auth: service-token login expects a refresh token that starts with fml_srt_."
-    );
-    return false;
-  }
-  const accessToken = await refreshServiceToken(token, opts?.env);
-  const cached = serviceTokenCaches.get(cacheKey(opts?.env));
-  if (!accessToken || !cached) {
-    return false;
-  }
-  writeTokens(
-    {
-      accessToken,
-      refreshToken: token,
-      expiresAt: cached.expiresAt,
-      user: {
-        id: SERVICE_TOKEN_LOGIN_USER_ID,
-        email: "service-token",
-        name: "FML service token"
-      },
-      tokenType: "service"
-    },
-    opts?.env
-  );
-  return true;
-}
-async function getValidToken(opts) {
-  const envName = opts?.env;
-  const key = cacheKey(envName);
-  const envToken = process.env.FML_TOKEN;
-  if (envToken?.startsWith("fml_srt_")) {
-    const cached = serviceTokenCaches.get(key);
-    if (cached && cached.expiresAt > Date.now() + 6e4) {
-      return cached.accessToken;
-    }
-    const inflight2 = serviceRefreshPromises.get(key);
-    if (inflight2) return inflight2;
-    const promise2 = refreshServiceToken(envToken, envName);
-    serviceRefreshPromises.set(key, promise2);
-    try {
-      return await promise2;
-    } finally {
-      serviceRefreshPromises.delete(key);
-    }
-  }
-  if (envToken?.startsWith("fml_st_")) return envToken;
-  if (envToken) {
-    console.error(
-      "[fml] Auth: unsupported FML_TOKEN format. Expected fml_srt_* or fml_st_*."
-    );
-    return null;
-  }
-  const stored = readTokens(envName);
-  if (!stored) {
-    console.error(
-      envName ? `[fml] Auth: no stored tokens for env "${envName}"` : "[fml] Auth: no stored tokens"
-    );
-    return null;
-  }
-  if (stored.expiresAt > Date.now() + 6e4) {
-    return stored.accessToken;
-  }
-  if (stored.tokenType === "service") {
-    const inflight2 = serviceRefreshPromises.get(key);
-    if (inflight2) return inflight2;
-    const promise2 = (async () => {
-      const newAccessToken = await refreshServiceToken(
-        stored.refreshToken,
-        envName
-      );
-      const cached = serviceTokenCaches.get(key);
-      if (newAccessToken && cached) {
-        writeTokens(
-          {
-            ...stored,
-            accessToken: newAccessToken,
-            expiresAt: cached.expiresAt
-          },
-          envName
-        );
-      }
-      return newAccessToken;
-    })();
-    serviceRefreshPromises.set(key, promise2);
-    try {
-      return await promise2;
-    } finally {
-      serviceRefreshPromises.delete(key);
-    }
-  }
-  const inflight = oauthRefreshPromises.get(key);
-  if (inflight) return inflight;
-  const promise = refreshToken(stored, envName);
-  oauthRefreshPromises.set(key, promise);
-  try {
-    return await promise;
-  } finally {
-    oauthRefreshPromises.delete(key);
-  }
-}
-async function refreshToken(stored, envName) {
-  if (!stored.workosClientId) {
-    console.error(
-      "[fml] Auth: token expired, missing workosClientId \u2014 run `fml login`"
-    );
-    return null;
-  }
-  try {
-    const response = await fetch(
-      `${WORKOS_API_URL}/user_management/authenticate`,
-      {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          grant_type: "refresh_token",
-          client_id: stored.workosClientId,
-          refresh_token: stored.refreshToken
-        })
-      }
-    );
-    if (!response.ok) {
-      console.error(
-        `[fml] Auth: refresh failed (HTTP ${response.status}) \u2014 token preserved`
-      );
-      return null;
-    }
-    const data = await response.json();
-    const userName = [data.user.first_name, data.user.last_name].filter(Boolean).join(" ");
-    const refreshed = {
-      accessToken: data.access_token,
-      refreshToken: data.refresh_token,
-      expiresAt: Date.now() + (data.expires_in ?? 300) * 1e3,
-      user: {
-        id: data.user.id,
-        email: data.user.email,
-        name: userName || stored.user.name
-      },
-      orgSlug: stored.orgSlug,
-      workosClientId: stored.workosClientId
-    };
-    writeTokens(refreshed, envName);
-    return refreshed.accessToken;
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(
-      `[fml] Auth: refresh failed (network error: ${msg}) \u2014 token preserved`
-    );
-    Sentry.captureException(err);
-    return null;
-  }
-}
-
-export {
-  initSentry,
-  Sentry,
-  FML_DATA_DIR,
-  FML_LOG_DIR,
-  DEFAULT_SYNC_URL,
-  DEFAULT_TARGET_NAME,
-  writeEnvConfig,
-  envConfigExists,
-  getActiveEnv,
-  isValidEnvName,
-  CONVEX_URL,
-  WORKOS_API_URL,
-  WORKOS_AUTH_URL,
-  authStorePath,
-  getSiteUrl,
-  readTokens,
-  writeTokens,
-  getSelectedOrg,
-  setSelectedOrg,
-  SERVICE_TOKEN_LOGIN_USER_ID,
-  storeServiceRefreshToken,
-  getValidToken
-};
-//# sourceMappingURL=chunk-VV4JHH4H.js.map

package/dist/chunk-VV4JHH4H.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/auth/token-store.ts","../src/config.ts","../src/dirs.ts","../src/sentry.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport {\n  CONVEX_URL,\n  WORKOS_API_URL,\n  authStorePath,\n  authStorePathFor,\n  resolveEnvConvexUrl,\n} from \"../config.js\";\nimport { FML_DATA_DIR } from \"../dirs.js\";\nimport { Sentry } from \"../sentry.js\";\n\nexport interface StoredAuth {\n  accessToken: string;\n  refreshToken: string;\n  expiresAt: number; // Unix timestamp in ms\n  user: {\n    id: string;\n    email: string;\n    name: string;\n  };\n  orgSlug?: string;\n  /** OAuth client ID used to obtain these tokens (needed for refresh) */\n  workosClientId?: string;\n  /**\n   * Token family marker for older stores.\n   *\n   * New human login paths (browser OAuth and device OAuth) store user\n   * credentials and omit this field. `\"service\"` is retained only for\n   * legacy opaque service-token-family sessions and explicit machine auth\n   * compatibility.\n   */\n  tokenType?: \"oauth\" | \"service\";\n}\n\nfunction storePathFor(envName?: string): string {\n  return envName ? authStorePathFor(envName) : authStorePath();\n}\n\nfunction ensureDir(envName?: string): void {\n  const dir = path.dirname(storePathFor(envName));\n  if (!fs.existsSync(dir)) {\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  }\n}\n\nexport function readTokens(envName?: string): StoredAuth | null {\n  try {\n    const data = fs.readFileSync(storePathFor(envName), \"utf-8\");\n    return JSON.parse(data) as StoredAuth;\n  } catch {\n    return null;\n  }\n}\n\nexport function writeTokens(auth: StoredAuth, envName?: string): void {\n  ensureDir(envName);\n  fs.writeFileSync(storePathFor(envName), JSON.stringify(auth, null, 2), {\n    mode: 0o600,\n  });\n}\n\nexport function getSelectedOrg(envName?: string): string | null {\n  return readTokens(envName)?.orgSlug ?? null;\n}\n\nexport function setSelectedOrg(orgSlug: string, envName?: string): void {\n  const stored = readTokens(envName);\n  if (!stored) return;\n  writeTokens({ ...stored, orgSlug }, envName);\n}\n\n// ── Service Token Refresh (sandbox fml_srt_* → fml_st_*) ────────────────────\n\ninterface ServiceTokenCache {\n  accessToken: string;\n  expiresAt: number;\n}\n\nexport const SERVICE_TOKEN_LOGIN_USER_ID = \"service-token\";\n\n/**\n * Caches and refresh-deduplication promises are keyed by env so in-process\n * callers that read multiple envs (`getValidToken({ env: \"a\" })` followed by\n * `getValidToken({ env: \"b\" })`) don't cross-contaminate. The sentinel\n * \"__active__\" stands in for calls with no explicit env.\n */\nconst ACTIVE_KEY = \"__active__\";\nconst serviceTokenCaches = new Map<string, ServiceTokenCache>();\nconst serviceRefreshPromises = new Map<string, Promise<string | null>>();\nconst oauthRefreshPromises = new Map<string, Promise<string | null>>();\nconst cacheKey = (envName?: string): string => envName ?? ACTIVE_KEY;\n\n/** File where the current access token is written for panopticon's tokenCommand */\nconst SERVICE_ACCESS_TOKEN_PATH = path.join(FML_DATA_DIR, \"access_token\");\n\nfunction getSiteUrl(envName?: string): string {\n  const explicit = process.env.CONVEX_SITE_URL;\n  if (explicit) return explicit.replace(/\\/$/, \"\");\n  if (envName) {\n    const envConvexUrl = resolveEnvConvexUrl(envName);\n    if (envConvexUrl) {\n      return envConvexUrl.replace(\".convex.cloud\", \".convex.site\");\n    }\n  }\n  return CONVEX_URL.replace(\".convex.cloud\", \".convex.site\");\n}\n\nasync function refreshServiceToken(\n  refreshToken: string,\n  envName?: string,\n): Promise<string | null> {\n  try {\n    const response = await fetch(`${getSiteUrl(envName)}/api/tokens/refresh`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${refreshToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      console.error(\n        `[fml] Service token refresh failed: HTTP ${response.status}`,\n      );\n      return null;\n    }\n\n    const data = (await response.json()) as {\n      ok: boolean;\n      accessToken: string;\n      expiresAt: number;\n      error?: string;\n    };\n\n    if (!data.ok || !data.accessToken) {\n      console.error(`[fml] Service token refresh error: ${data.error}`);\n      return null;\n    }\n\n    serviceTokenCaches.set(cacheKey(envName), {\n      accessToken: data.accessToken,\n      expiresAt: data.expiresAt,\n    });\n\n    // Write to file for panopticon's tokenCommand\n    try {\n      const dir = path.dirname(SERVICE_ACCESS_TOKEN_PATH);\n      if (!fs.existsSync(dir)) {\n        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n      }\n      fs.writeFileSync(SERVICE_ACCESS_TOKEN_PATH, data.accessToken, {\n        mode: 0o600,\n      });\n    } catch {\n      // Non-fatal — in-memory cache still works for the plugin itself\n    }\n\n    return data.accessToken;\n  } catch (err: unknown) {\n    Sentry.captureException(err);\n    console.error(`[fml] Service token refresh error: ${err}`);\n    return null;\n  }\n}\n\nexport async function storeServiceRefreshToken(\n  refreshToken: string,\n  opts?: { env?: string },\n): Promise<boolean> {\n  const token = refreshToken.trim();\n  if (!token.startsWith(\"fml_srt_\")) {\n    console.error(\n      \"[fml] Auth: service-token login expects a refresh token that starts with fml_srt_.\",\n    );\n    return false;\n  }\n\n  const accessToken = await refreshServiceToken(token, opts?.env);\n  const cached = serviceTokenCaches.get(cacheKey(opts?.env));\n  if (!accessToken || !cached) {\n    return false;\n  }\n\n  writeTokens(\n    {\n      accessToken,\n      refreshToken: token,\n      expiresAt: cached.expiresAt,\n      user: {\n        id: SERVICE_TOKEN_LOGIN_USER_ID,\n        email: \"service-token\",\n        name: \"FML service token\",\n      },\n      tokenType: \"service\",\n    },\n    opts?.env,\n  );\n\n  return true;\n}\n\n// ── Token Resolution ────────────────────────────────────────────────────────\n\n/**\n * Get a valid access token, refreshing if expired.\n *\n * Three paths:\n * 1. FML_TOKEN=fml_srt_* → exchange refresh token for short-lived access token\n * 2. FML_TOKEN=fml_st_*  → use directly (legacy/CI)\n * 3. No FML_TOKEN         → OAuth flow (interactive user)\n */\nexport async function getValidToken(opts?: {\n  env?: string;\n}): Promise<string | null> {\n  const envName = opts?.env;\n  const key = cacheKey(envName);\n  const envToken = process.env.FML_TOKEN;\n\n  // Service refresh token → exchange for short-lived access token\n  if (envToken?.startsWith(\"fml_srt_\")) {\n    const cached = serviceTokenCaches.get(key);\n    if (cached && cached.expiresAt > Date.now() + 60_000) {\n      return cached.accessToken;\n    }\n\n    const inflight = serviceRefreshPromises.get(key);\n    if (inflight) return inflight;\n    const promise = refreshServiceToken(envToken, envName);\n    serviceRefreshPromises.set(key, promise);\n    try {\n      return await promise;\n    } finally {\n      serviceRefreshPromises.delete(key);\n    }\n  }\n\n  // Static service access token.\n  if (envToken?.startsWith(\"fml_st_\")) return envToken;\n\n  if (envToken) {\n    console.error(\n      \"[fml] Auth: unsupported FML_TOKEN format. Expected fml_srt_* or fml_st_*.\",\n    );\n    return null;\n  }\n\n  // Stored token path (OAuth user credentials or legacy service-family credentials)\n  const stored = readTokens(envName);\n  if (!stored) {\n    console.error(\n      envName\n        ? `[fml] Auth: no stored tokens for env \"${envName}\"`\n        : \"[fml] Auth: no stored tokens\",\n    );\n    return null;\n  }\n\n  // If token expires in more than 60 seconds, use it\n  if (stored.expiresAt > Date.now() + 60_000) {\n    return stored.accessToken;\n  }\n\n  // Legacy stored service-family credentials refresh via /api/tokens/refresh.\n  // Current device OAuth login no longer writes tokenType: \"service\".\n  if (stored.tokenType === \"service\") {\n    const inflight = serviceRefreshPromises.get(key);\n    if (inflight) return inflight;\n    const promise = (async () => {\n      const newAccessToken = await refreshServiceToken(\n        stored.refreshToken,\n        envName,\n      );\n      const cached = serviceTokenCaches.get(key);\n      if (newAccessToken && cached) {\n        writeTokens(\n          {\n            ...stored,\n            accessToken: newAccessToken,\n            expiresAt: cached.expiresAt,\n          },\n          envName,\n        );\n      }\n      return newAccessToken;\n    })();\n    serviceRefreshPromises.set(key, promise);\n    try {\n      return await promise;\n    } finally {\n      serviceRefreshPromises.delete(key);\n    }\n  }\n\n  // OAuth user tokens (browser or device): refresh via OAuth provider\n  const inflight = oauthRefreshPromises.get(key);\n  if (inflight) return inflight;\n  const promise = refreshToken(stored, envName);\n  oauthRefreshPromises.set(key, promise);\n  try {\n    return await promise;\n  } finally {\n    oauthRefreshPromises.delete(key);\n  }\n}\n\nasync function refreshToken(\n  stored: StoredAuth,\n  envName?: string,\n): Promise<string | null> {\n  if (!stored.workosClientId) {\n    console.error(\n      \"[fml] Auth: token expired, missing workosClientId — run `fml login`\",\n    );\n    return null;\n  }\n\n  try {\n    const response = await fetch(\n      `${WORKOS_API_URL}/user_management/authenticate`,\n      {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({\n          grant_type: \"refresh_token\",\n          client_id: stored.workosClientId,\n          refresh_token: stored.refreshToken,\n        }),\n      },\n    );\n\n    if (!response.ok) {\n      console.error(\n        `[fml] Auth: refresh failed (HTTP ${response.status}) — token preserved`,\n      );\n      return null;\n    }\n\n    const data = (await response.json()) as {\n      access_token: string;\n      refresh_token: string;\n      expires_in: number;\n      user: {\n        id: string;\n        email: string;\n        first_name?: string;\n        last_name?: string;\n      };\n    };\n\n    const userName = [data.user.first_name, data.user.last_name]\n      .filter(Boolean)\n      .join(\" \");\n\n    const refreshed: StoredAuth = {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token,\n      expiresAt: Date.now() + (data.expires_in ?? 300) * 1000,\n      user: {\n        id: data.user.id,\n        email: data.user.email,\n        name: userName || stored.user.name,\n      },\n      orgSlug: stored.orgSlug,\n      workosClientId: stored.workosClientId,\n    };\n\n    writeTokens(refreshed, envName);\n    return refreshed.accessToken;\n  } catch (err: unknown) {\n    const msg = err instanceof Error ? err.message : String(err);\n    console.error(\n      `[fml] Auth: refresh failed (network error: ${msg}) — token preserved`,\n    );\n    Sentry.captureException(err);\n    return null;\n  }\n}\n","import fs from \"node:fs\";\nimport os from \"node:os\";\nimport path from \"node:path\";\nimport { FML_DATA_DIR } from \"./dirs.js\";\n\n// ── Default production deployment ───────────────────────────────────────────\n\nexport const DEFAULT_PROD_URL =\n  \"https://trustworthy-chihuahua-382.convex.cloud\";\n\n/** Convex site URL for sync/HTTP actions — derived from DEFAULT_PROD_URL. */\nexport const DEFAULT_SYNC_URL = DEFAULT_PROD_URL.replace(\n  \".convex.cloud\",\n  \".convex.site\",\n);\n\n/** Default sync target name created by `fml install` */\nexport const DEFAULT_TARGET_NAME = \"fml\";\n\n// ── Persistent env selection ────────────────────────────────────────────────\n\ninterface EnvConfig {\n  /** Name of the active sync target */\n  active: string;\n}\n\nconst ENV_CONFIG_PATH = path.join(FML_DATA_DIR, \"env.json\");\n\nfunction readEnvConfig(): EnvConfig {\n  try {\n    const raw = fs.readFileSync(ENV_CONFIG_PATH, \"utf-8\");\n    return JSON.parse(raw) as EnvConfig;\n  } catch {\n    return { active: DEFAULT_TARGET_NAME };\n  }\n}\n\nexport function writeEnvConfig(config: EnvConfig): void {\n  const dir = path.dirname(ENV_CONFIG_PATH);\n  if (!fs.existsSync(dir)) {\n    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  }\n  fs.writeFileSync(ENV_CONFIG_PATH, `${JSON.stringify(config, null, 2)}\\n`, {\n    mode: 0o600,\n  });\n}\n\n/** Whether an env selection has already been persisted (not a fresh install). */\nexport function envConfigExists(): boolean {\n  return fs.existsSync(ENV_CONFIG_PATH);\n}\n\n/**\n * Look up a panopticon sync target by name and return its Convex deployment\n * URL (`.convex.cloud`). Returns null if panopticon isn't installed or the\n * target isn't configured.\n */\nexport function resolveEnvConvexUrl(envName: string): string | null {\n  try {\n    const panoDataDir =\n      process.env.PANOPTICON_DATA_DIR ??\n      (process.platform === \"darwin\"\n        ? path.join(\n            os.homedir(),\n            \"Library\",\n            \"Application Support\",\n            \"panopticon\",\n          )\n        : process.platform === \"win32\"\n          ? path.join(\n              process.env.APPDATA ??\n                path.join(os.homedir(), \"AppData\", \"Roaming\"),\n              \"panopticon\",\n            )\n          : path.join(os.homedir(), \".local\", \"share\", \"panopticon\"));\n    const raw = fs.readFileSync(path.join(panoDataDir, \"config.json\"), \"utf-8\");\n    const panoConf = JSON.parse(raw) as {\n      sync?: { targets?: Array<{ name: string; url: string }> };\n    };\n    const target = panoConf.sync?.targets?.find((t) => t.name === envName);\n    if (target) {\n      return target.url.replace(\".convex.site\", \".convex.cloud\");\n    }\n  } catch {\n    // Panopticon config not available\n  }\n  return null;\n}\n\n/**\n * Resolve the active environment by looking up the sync target.\n * Derives the .convex.cloud URL from the target's .convex.site URL.\n * Returns null convexUrl if the target is not found (panopticon not installed).\n */\nexport function getActiveEnv(): { name: string; convexUrl: string | null } {\n  const name = readEnvConfig().active;\n  return { name, convexUrl: resolveEnvConvexUrl(name) };\n}\n\n/** Auth store path for a specific env name (tokens are segregated per env). */\nexport function authStorePathFor(envName: string): string {\n  return path.join(FML_DATA_DIR, `auth.${envName}.json`);\n}\n\n/**\n * Env names flow into `tokenCommand` strings that panopticon shells out, so\n * refuse anything that could carry shell metacharacters. Target names are\n * also written to panopticon's config by this rule (see `fml env use`).\n */\nconst ENV_NAME_RE = /^[A-Za-z0-9_-]+$/;\nexport function isValidEnvName(envName: string): boolean {\n  return ENV_NAME_RE.test(envName);\n}\n\n/**\n * Require a resolved Convex URL. Exits with an error if the sync target\n * is not configured (panopticon not installed).\n */\nexport function requireConvexUrl(): string {\n  const { name, convexUrl } = getActiveEnv();\n  if (!convexUrl) {\n    console.error(\n      `Sync target \"${name}\" not found. Run \\`fml install\\` or \\`fml sync setup\\`.`,\n    );\n    process.exit(1);\n  }\n  return convexUrl;\n}\n\n// ── Exports ─────────────────────────────────────────────────────────────────\n\n/**\n * Convex deployment URL (switches with `fml env`).\n *\n * Resolution order:\n *   1. `FML_CONVEX_URL` env var (dev/preview overrides)\n *   2. Active panopticon sync target\n *   3. `DEFAULT_PROD_URL` — lets a fresh `npm install -g` log in against\n *      prod before `fml install` has had a chance to seed a sync target.\n */\nexport const CONVEX_URL: string = (\n  process.env.FML_CONVEX_URL ??\n  getActiveEnv().convexUrl ??\n  DEFAULT_PROD_URL\n).replace(/\\/$/, \"\");\n\n/** OAuth provider API base URL */\nexport const WORKOS_API_URL = \"https://api.workos.com\";\n\n/** OAuth authorization base URL */\nexport const WORKOS_AUTH_URL = \"https://auth.fml.inc\";\n\n/**\n * Path to the auth token store for the *currently* active env. Resolved\n * lazily so long-running processes that outlive an `fml env use` switch\n * still read the correct file on the next call.\n */\nexport function authStorePath(): string {\n  return authStorePathFor(getActiveEnv().name);\n}\n\n/** Convex site URL (HTTP actions) — derived from CONVEX_URL */\nexport function getSiteUrl(): string {\n  return CONVEX_URL.replace(\".convex.cloud\", \".convex.site\").replace(\n    /:\\d+$/,\n    \"\",\n  );\n}\n","/**\n * Platform-native directories for FML runtime data.\n *\n * macOS:   ~/Library/Application Support/fml   + ~/Library/Logs/fml\n * Linux:   ~/.local/share/fml                  + ~/.local/state/fml/log\n * Windows: %APPDATA%/fml                       + %APPDATA%/fml/logs\n */\nimport fs from \"node:fs\";\nimport os from \"node:os\";\nimport path from \"node:path\";\n\nconst home = os.homedir();\n\nfunction dataDir(): string {\n  // Override (tests, eval replays, sandboxes) so they never touch a real\n  // user's auth/config in the platform-default location.\n  if (process.env.FML_DATA_DIR) return process.env.FML_DATA_DIR;\n  switch (process.platform) {\n    case \"darwin\":\n      return path.join(home, \"Library\", \"Application Support\", \"fml\");\n    case \"win32\":\n      return path.join(\n        process.env.APPDATA ?? path.join(home, \"AppData\", \"Roaming\"),\n        \"fml\",\n      );\n    default:\n      return path.join(\n        process.env.XDG_DATA_HOME ?? path.join(home, \".local\", \"share\"),\n        \"fml\",\n      );\n  }\n}\n\nfunction logDir(): string {\n  if (process.env.FML_LOG_DIR) return process.env.FML_LOG_DIR;\n  switch (process.platform) {\n    case \"darwin\":\n      return path.join(home, \"Library\", \"Logs\", \"fml\");\n    case \"win32\":\n      return path.join(\n        process.env.APPDATA ?? path.join(home, \"AppData\", \"Roaming\"),\n        \"fml\",\n        \"logs\",\n      );\n    default:\n      return path.join(\n        process.env.XDG_STATE_HOME ?? path.join(home, \".local\", \"state\"),\n        \"fml\",\n        \"log\",\n      );\n  }\n}\n\n/** Runtime data — auth tokens, env config, PID files */\nexport const FML_DATA_DIR = dataDir();\n\n/** Log files — daemon logs, MCP logs */\nexport const FML_LOG_DIR = logDir();\n\n/** Ensure both directories exist (called once at startup). */\nexport function ensureDirs(): void {\n  fs.mkdirSync(FML_DATA_DIR, { recursive: true, mode: 0o700 });\n  fs.mkdirSync(FML_LOG_DIR, { recursive: true, mode: 0o700 });\n}\n","declare const __SENTRY_DSN__: string;\n\nlet initialized = false;\nlet sentry: typeof import(\"@sentry/core\") | null = null;\n\nasync function loadSentry(): Promise<typeof import(\"@sentry/core\") | null> {\n  if (sentry) return sentry;\n  try {\n    sentry = await import(\"@sentry/core\");\n    return sentry;\n  } catch {\n    return null;\n  }\n}\n\nexport async function initSentry(): Promise<void> {\n  if (initialized) return;\n  initialized = true;\n\n  const mod = await loadSentry();\n  if (!mod) return;\n\n  const client = new mod.ServerRuntimeClient({\n    dsn: __SENTRY_DSN__,\n    tracesSampleRate: 0,\n    integrations: [],\n    stackParser: mod.createStackParser(mod.nodeStackLineParser()),\n    transport: (options) =>\n      mod.createTransport(options, async (request) => {\n        const res = await fetch(options.url, {\n          method: \"POST\",\n          headers: { \"Content-Type\": \"application/x-sentry-envelope\" },\n          body: request.body as BodyInit,\n        });\n        return { statusCode: res.status };\n      }),\n  });\n\n  mod.setCurrentClient(client);\n  client.init();\n}\n\nexport const Sentry = {\n  captureException: (err: unknown) => sentry?.captureException(err),\n  captureMessage: (msg: string) => sentry?.captureMessage(msg),\n} as const;\n"],"mappings":";AAAA,OAAOA,SAAQ;AACf,OAAOC,WAAU;;;ACDjB,OAAOC,SAAQ;AACf,OAAOC,SAAQ;AACf,OAAOC,WAAU;;;ACKjB,OAAO,QAAQ;AACf,OAAO,QAAQ;AACf,OAAO,UAAU;AAEjB,IAAM,OAAO,GAAG,QAAQ;AAExB,SAAS,UAAkB;AAGzB,MAAI,QAAQ,IAAI,aAAc,QAAO,QAAQ,IAAI;AACjD,UAAQ,QAAQ,UAAU;AAAA,IACxB,KAAK;AACH,aAAO,KAAK,KAAK,MAAM,WAAW,uBAAuB,KAAK;AAAA,IAChE,KAAK;AACH,aAAO,KAAK;AAAA,QACV,QAAQ,IAAI,WAAW,KAAK,KAAK,MAAM,WAAW,SAAS;AAAA,QAC3D;AAAA,MACF;AAAA,IACF;AACE,aAAO,KAAK;AAAA,QACV,QAAQ,IAAI,iBAAiB,KAAK,KAAK,MAAM,UAAU,OAAO;AAAA,QAC9D;AAAA,MACF;AAAA,EACJ;AACF;AAEA,SAAS,SAAiB;AACxB,MAAI,QAAQ,IAAI,YAAa,QAAO,QAAQ,IAAI;AAChD,UAAQ,QAAQ,UAAU;AAAA,IACxB,KAAK;AACH,aAAO,KAAK,KAAK,MAAM,WAAW,QAAQ,KAAK;AAAA,IACjD,KAAK;AACH,aAAO,KAAK;AAAA,QACV,QAAQ,IAAI,WAAW,KAAK,KAAK,MAAM,WAAW,SAAS;AAAA,QAC3D;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACE,aAAO,KAAK;AAAA,QACV,QAAQ,IAAI,kBAAkB,KAAK,KAAK,MAAM,UAAU,OAAO;AAAA,QAC/D;AAAA,QACA;AAAA,MACF;AAAA,EACJ;AACF;AAGO,IAAM,eAAe,QAAQ;AAG7B,IAAM,cAAc,OAAO;;;ADlD3B,IAAM,mBACX;AAGK,IAAM,mBAAmB,iBAAiB;AAAA,EAC/C;AAAA,EACA;AACF;AAGO,IAAM,sBAAsB;AASnC,IAAM,kBAAkBC,MAAK,KAAK,cAAc,UAAU;AAE1D,SAAS,gBAA2B;AAClC,MAAI;AACF,UAAM,MAAMC,IAAG,aAAa,iBAAiB,OAAO;AACpD,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO,EAAE,QAAQ,oBAAoB;AAAA,EACvC;AACF;AAEO,SAAS,eAAe,QAAyB;AACtD,QAAM,MAAMD,MAAK,QAAQ,eAAe;AACxC,MAAI,CAACC,IAAG,WAAW,GAAG,GAAG;AACvB,IAAAA,IAAG,UAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,EACpD;AACA,EAAAA,IAAG,cAAc,iBAAiB,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,GAAM;AAAA,IACxE,MAAM;AAAA,EACR,CAAC;AACH;AAGO,SAAS,kBAA2B;AACzC,SAAOA,IAAG,WAAW,eAAe;AACtC;AAOO,SAAS,oBAAoB,SAAgC;AAClE,MAAI;AACF,UAAM,cACJ,QAAQ,IAAI,wBACX,QAAQ,aAAa,WAClBD,MAAK;AAAA,MACHE,IAAG,QAAQ;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA,QAAQ,aAAa,UACnBF,MAAK;AAAA,MACH,QAAQ,IAAI,WACVA,MAAK,KAAKE,IAAG,QAAQ,GAAG,WAAW,SAAS;AAAA,MAC9C;AAAA,IACF,IACAF,MAAK,KAAKE,IAAG,QAAQ,GAAG,UAAU,SAAS,YAAY;AAC/D,UAAM,MAAMD,IAAG,aAAaD,MAAK,KAAK,aAAa,aAAa,GAAG,OAAO;AAC1E,UAAM,WAAW,KAAK,MAAM,GAAG;AAG/B,UAAM,SAAS,SAAS,MAAM,SAAS,KAAK,CAAC,MAAM,EAAE,SAAS,OAAO;AACrE,QAAI,QAAQ;AACV,aAAO,OAAO,IAAI,QAAQ,gBAAgB,eAAe;AAAA,IAC3D;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAOO,SAAS,eAA2D;AACzE,QAAM,OAAO,cAAc,EAAE;AAC7B,SAAO,EAAE,MAAM,WAAW,oBAAoB,IAAI,EAAE;AACtD;AAGO,SAAS,iBAAiB,SAAyB;AACxD,SAAOA,MAAK,KAAK,cAAc,QAAQ,OAAO,OAAO;AACvD;AAOA,IAAM,cAAc;AACb,SAAS,eAAe,SAA0B;AACvD,SAAO,YAAY,KAAK,OAAO;AACjC;AA4BO,IAAM,cACX,QAAQ,IAAI,kBACZ,aAAa,EAAE,aACf,kBACA,QAAQ,OAAO,EAAE;AAGZ,IAAM,iBAAiB;AAGvB,IAAM,kBAAkB;AAOxB,SAAS,gBAAwB;AACtC,SAAO,iBAAiB,aAAa,EAAE,IAAI;AAC7C;AAGO,SAAS,aAAqB;AACnC,SAAO,WAAW,QAAQ,iBAAiB,cAAc,EAAE;AAAA,IACzD;AAAA,IACA;AAAA,EACF;AACF;;;AErKA,IAAI,cAAc;AAClB,IAAI,SAA+C;AAEnD,eAAe,aAA4D;AACzE,MAAI,OAAQ,QAAO;AACnB,MAAI;AACF,aAAS,MAAM,OAAO,mBAAc;AACpC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,aAA4B;AAChD,MAAI,YAAa;AACjB,gBAAc;AAEd,QAAM,MAAM,MAAM,WAAW;AAC7B,MAAI,CAAC,IAAK;AAEV,QAAM,SAAS,IAAI,IAAI,oBAAoB;AAAA,IACzC,KAAK;AAAA,IACL,kBAAkB;AAAA,IAClB,cAAc,CAAC;AAAA,IACf,aAAa,IAAI,kBAAkB,IAAI,oBAAoB,CAAC;AAAA,IAC5D,WAAW,CAAC,YACV,IAAI,gBAAgB,SAAS,OAAO,YAAY;AAC9C,YAAM,MAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,QACnC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,gCAAgC;AAAA,QAC3D,MAAM,QAAQ;AAAA,MAChB,CAAC;AACD,aAAO,EAAE,YAAY,IAAI,OAAO;AAAA,IAClC,CAAC;AAAA,EACL,CAAC;AAED,MAAI,iBAAiB,MAAM;AAC3B,SAAO,KAAK;AACd;AAEO,IAAM,SAAS;AAAA,EACpB,kBAAkB,CAAC,QAAiB,QAAQ,iBAAiB,GAAG;AAAA,EAChE,gBAAgB,CAAC,QAAgB,QAAQ,eAAe,GAAG;AAC7D;;;AHVA,SAAS,aAAa,SAA0B;AAC9C,SAAO,UAAU,iBAAiB,OAAO,IAAI,cAAc;AAC7D;AAEA,SAAS,UAAU,SAAwB;AACzC,QAAM,MAAMG,MAAK,QAAQ,aAAa,OAAO,CAAC;AAC9C,MAAI,CAACC,IAAG,WAAW,GAAG,GAAG;AACvB,IAAAA,IAAG,UAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,EACpD;AACF;AAEO,SAAS,WAAW,SAAqC;AAC9D,MAAI;AACF,UAAM,OAAOA,IAAG,aAAa,aAAa,OAAO,GAAG,OAAO;AAC3D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,YAAY,MAAkB,SAAwB;AACpE,YAAU,OAAO;AACjB,EAAAA,IAAG,cAAc,aAAa,OAAO,GAAG,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG;AAAA,IACrE,MAAM;AAAA,EACR,CAAC;AACH;AAEO,SAAS,eAAe,SAAiC;AAC9D,SAAO,WAAW,OAAO,GAAG,WAAW;AACzC;AAEO,SAAS,eAAe,SAAiB,SAAwB;AACtE,QAAM,SAAS,WAAW,OAAO;AACjC,MAAI,CAAC,OAAQ;AACb,cAAY,EAAE,GAAG,QAAQ,QAAQ,GAAG,OAAO;AAC7C;AASO,IAAM,8BAA8B;AAQ3C,IAAM,aAAa;AACnB,IAAM,qBAAqB,oBAAI,IAA+B;AAC9D,IAAM,yBAAyB,oBAAI,IAAoC;AACvE,IAAM,uBAAuB,oBAAI,IAAoC;AACrE,IAAM,WAAW,CAAC,YAA6B,WAAW;AAG1D,IAAM,4BAA4BD,MAAK,KAAK,cAAc,cAAc;AAExE,SAASE,YAAW,SAA0B;AAC5C,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,SAAU,QAAO,SAAS,QAAQ,OAAO,EAAE;AAC/C,MAAI,SAAS;AACX,UAAM,eAAe,oBAAoB,OAAO;AAChD,QAAI,cAAc;AAChB,aAAO,aAAa,QAAQ,iBAAiB,cAAc;AAAA,IAC7D;AAAA,EACF;AACA,SAAO,WAAW,QAAQ,iBAAiB,cAAc;AAC3D;AAEA,eAAe,oBACbC,eACA,SACwB;AACxB,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,GAAGD,YAAW,OAAO,CAAC,uBAAuB;AAAA,MACxE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,UAAUC,aAAY;AAAA,MACvC;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,cAAQ;AAAA,QACN,4CAA4C,SAAS,MAAM;AAAA,MAC7D;AACA,aAAO;AAAA,IACT;AAEA,UAAM,OAAQ,MAAM,SAAS,KAAK;AAOlC,QAAI,CAAC,KAAK,MAAM,CAAC,KAAK,aAAa;AACjC,cAAQ,MAAM,sCAAsC,KAAK,KAAK,EAAE;AAChE,aAAO;AAAA,IACT;AAEA,uBAAmB,IAAI,SAAS,OAAO,GAAG;AAAA,MACxC,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,IAClB,CAAC;AAGD,QAAI;AACF,YAAM,MAAMH,MAAK,QAAQ,yBAAyB;AAClD,UAAI,CAACC,IAAG,WAAW,GAAG,GAAG;AACvB,QAAAA,IAAG,UAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,MACpD;AACA,MAAAA,IAAG,cAAc,2BAA2B,KAAK,aAAa;AAAA,QAC5D,MAAM;AAAA,MACR,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAEA,WAAO,KAAK;AAAA,EACd,SAAS,KAAc;AACrB,WAAO,iBAAiB,GAAG;AAC3B,YAAQ,MAAM,sCAAsC,GAAG,EAAE;AACzD,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,yBACpBE,eACA,MACkB;AAClB,QAAM,QAAQA,cAAa,KAAK;AAChC,MAAI,CAAC,MAAM,WAAW,UAAU,GAAG;AACjC,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,MAAM,oBAAoB,OAAO,MAAM,GAAG;AAC9D,QAAM,SAAS,mBAAmB,IAAI,SAAS,MAAM,GAAG,CAAC;AACzD,MAAI,CAAC,eAAe,CAAC,QAAQ;AAC3B,WAAO;AAAA,EACT;AAEA;AAAA,IACE;AAAA,MACE;AAAA,MACA,cAAc;AAAA,MACd,WAAW,OAAO;AAAA,MAClB,MAAM;AAAA,QACJ,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,MAAM;AAAA,MACR;AAAA,MACA,WAAW;AAAA,IACb;AAAA,IACA,MAAM;AAAA,EACR;AAEA,SAAO;AACT;AAYA,eAAsB,cAAc,MAET;AACzB,QAAM,UAAU,MAAM;AACtB,QAAM,MAAM,SAAS,OAAO;AAC5B,QAAM,WAAW,QAAQ,IAAI;AAG7B,MAAI,UAAU,WAAW,UAAU,GAAG;AACpC,UAAM,SAAS,mBAAmB,IAAI,GAAG;AACzC,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,IAAI,KAAQ;AACpD,aAAO,OAAO;AAAA,IAChB;AAEA,UAAMC,YAAW,uBAAuB,IAAI,GAAG;AAC/C,QAAIA,UAAU,QAAOA;AACrB,UAAMC,WAAU,oBAAoB,UAAU,OAAO;AACrD,2BAAuB,IAAI,KAAKA,QAAO;AACvC,QAAI;AACF,aAAO,MAAMA;AAAA,IACf,UAAE;AACA,6BAAuB,OAAO,GAAG;AAAA,IACnC;AAAA,EACF;AAGA,MAAI,UAAU,WAAW,SAAS,EAAG,QAAO;AAE5C,MAAI,UAAU;AACZ,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,WAAW,OAAO;AACjC,MAAI,CAAC,QAAQ;AACX,YAAQ;AAAA,MACN,UACI,yCAAyC,OAAO,MAChD;AAAA,IACN;AACA,WAAO;AAAA,EACT;AAGA,MAAI,OAAO,YAAY,KAAK,IAAI,IAAI,KAAQ;AAC1C,WAAO,OAAO;AAAA,EAChB;AAIA,MAAI,OAAO,cAAc,WAAW;AAClC,UAAMD,YAAW,uBAAuB,IAAI,GAAG;AAC/C,QAAIA,UAAU,QAAOA;AACrB,UAAMC,YAAW,YAAY;AAC3B,YAAM,iBAAiB,MAAM;AAAA,QAC3B,OAAO;AAAA,QACP;AAAA,MACF;AACA,YAAM,SAAS,mBAAmB,IAAI,GAAG;AACzC,UAAI,kBAAkB,QAAQ;AAC5B;AAAA,UACE;AAAA,YACE,GAAG;AAAA,YACH,aAAa;AAAA,YACb,WAAW,OAAO;AAAA,UACpB;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT,GAAG;AACH,2BAAuB,IAAI,KAAKA,QAAO;AACvC,QAAI;AACF,aAAO,MAAMA;AAAA,IACf,UAAE;AACA,6BAAuB,OAAO,GAAG;AAAA,IACnC;AAAA,EACF;AAGA,QAAM,WAAW,qBAAqB,IAAI,GAAG;AAC7C,MAAI,SAAU,QAAO;AACrB,QAAM,UAAU,aAAa,QAAQ,OAAO;AAC5C,uBAAqB,IAAI,KAAK,OAAO;AACrC,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,yBAAqB,OAAO,GAAG;AAAA,EACjC;AACF;AAEA,eAAe,aACb,QACA,SACwB;AACxB,MAAI,CAAC,OAAO,gBAAgB;AAC1B,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,WAAW,MAAM;AAAA,MACrB,GAAG,cAAc;AAAA,MACjB;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,YAAY;AAAA,UACZ,WAAW,OAAO;AAAA,UAClB,eAAe,OAAO;AAAA,QACxB,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,cAAQ;AAAA,QACN,oCAAoC,SAAS,MAAM;AAAA,MACrD;AACA,aAAO;AAAA,IACT;AAEA,UAAM,OAAQ,MAAM,SAAS,KAAK;AAYlC,UAAM,WAAW,CAAC,KAAK,KAAK,YAAY,KAAK,KAAK,SAAS,EACxD,OAAO,OAAO,EACd,KAAK,GAAG;AAEX,UAAM,YAAwB;AAAA,MAC5B,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB,WAAW,KAAK,IAAI,KAAK,KAAK,cAAc,OAAO;AAAA,MACnD,MAAM;AAAA,QACJ,IAAI,KAAK,KAAK;AAAA,QACd,OAAO,KAAK,KAAK;AAAA,QACjB,MAAM,YAAY,OAAO,KAAK;AAAA,MAChC;AAAA,MACA,SAAS,OAAO;AAAA,MAChB,gBAAgB,OAAO;AAAA,IACzB;AAEA,gBAAY,WAAW,OAAO;AAC9B,WAAO,UAAU;AAAA,EACnB,SAAS,KAAc;AACrB,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAQ;AAAA,MACN,8CAA8C,GAAG;AAAA,IACnD;AACA,WAAO,iBAAiB,GAAG;AAC3B,WAAO;AAAA,EACT;AACF;","names":["fs","path","fs","os","path","path","fs","os","path","fs","getSiteUrl","refreshToken","inflight","promise"]}

package/dist/chunk-YH5ROR7G.js

@@ -1,69 +0,0 @@
-// src/bin-utils.ts
-import fs from "fs";
-import path from "path";
-import { execFileSync, execSync } from "child_process";
-var IS_WIN = process.platform === "win32";
-var DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
-function resolveBin(name) {
-  const pathDirs = (process.env.PATH ?? "").split(path.delimiter).filter(Boolean);
-  const hasExt = path.extname(name) !== "";
-  const exts = !IS_WIN || hasExt ? [""] : (process.env.PATHEXT ?? DEFAULT_PATHEXT).split(";").filter(Boolean);
-  for (const dir of pathDirs) {
-    for (const ext of exts) {
-      const candidate = path.join(dir, name + ext);
-      try {
-        if (fs.statSync(candidate).isFile()) return candidate;
-      } catch {
-      }
-    }
-  }
-  return null;
-}
-function isWinShim(bin) {
-  return IS_WIN && /\.(cmd|bat)$/i.test(bin);
-}
-function quoteWinArg(arg) {
-  if (arg.length === 0) return '""';
-  if (/^[A-Za-z0-9@\-_+=:/.,]+$/.test(arg)) return arg;
-  const crt = arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, "$1$1");
-  const quoted = `"${crt}"`;
-  return quoted.replace(/([()%!^<>&|"])/g, "^$1");
-}
-function execBinSync(bin, args, opts = {}) {
-  const { timeout = 1e4, encoding = "utf-8", stdio = "pipe" } = opts;
-  if (isWinShim(bin)) {
-    const command = [bin, ...args].map(quoteWinArg).join(" ");
-    return execSync(command, { timeout, encoding, stdio });
-  }
-  return execFileSync(bin, args, { timeout, encoding, stdio });
-}
-
-// src/daemon-utils.ts
-function resolvePanopticonBin() {
-  return resolveBin("panopticon");
-}
-function panopticonExec(...argsAndOpts) {
-  let timeout = 1e4;
-  const args = [];
-  for (const a of argsAndOpts) {
-    if (typeof a === "string") args.push(a);
-    else timeout = a.timeout ?? timeout;
-  }
-  const bin = resolvePanopticonBin();
-  if (!bin) return { ok: false, stdout: "panopticon binary not found" };
-  try {
-    const stdout = execBinSync(bin, args, { timeout });
-    return { ok: true, stdout };
-  } catch (err) {
-    const e = err;
-    return { ok: false, stdout: (e.stdout ?? "") + (e.stderr ?? "") };
-  }
-}
-
-export {
-  resolveBin,
-  execBinSync,
-  resolvePanopticonBin,
-  panopticonExec
-};
-//# sourceMappingURL=chunk-YH5ROR7G.js.map

package/dist/chunk-YH5ROR7G.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/bin-utils.ts","../src/daemon-utils.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { execFileSync, execSync } from \"node:child_process\";\n\nconst IS_WIN = process.platform === \"win32\";\nconst DEFAULT_PATHEXT = \".COM;.EXE;.BAT;.CMD\";\n\n/**\n * Resolve a CLI binary by walking process.env.PATH. On Windows, probe each\n * process.env.PATHEXT extension. Returns an absolute path or null.\n *\n * Pass the bare command name (e.g. \"npm\", not \"npm.cmd\"); the extension is\n * applied via PATHEXT on Windows. If the caller does include an extension,\n * it's used as-is.\n *\n * Replaces `which`/`where`: avoids spawning a child process and works the\n * same on macOS, Linux, and Windows.\n */\nexport function resolveBin(name: string): string | null {\n  const pathDirs = (process.env.PATH ?? \"\").split(path.delimiter).filter(Boolean);\n  const hasExt = path.extname(name) !== \"\";\n  const exts = !IS_WIN || hasExt\n    ? [\"\"]\n    : (process.env.PATHEXT ?? DEFAULT_PATHEXT).split(\";\").filter(Boolean);\n\n  for (const dir of pathDirs) {\n    for (const ext of exts) {\n      const candidate = path.join(dir, name + ext);\n      try {\n        if (fs.statSync(candidate).isFile()) return candidate;\n      } catch {}\n    }\n  }\n  return null;\n}\n\n/** True for Windows shell shims that execFile cannot run directly. */\nfunction isWinShim(bin: string): boolean {\n  return IS_WIN && /\\.(cmd|bat)$/i.test(bin);\n}\n\n/**\n * Quote a single argument for safe inclusion in a Windows command line that\n * will be parsed by cmd.exe and then re-parsed by a CRT program.\n *\n * Two layers:\n *   1. CRT (CommandLineToArgvW): wrap in `\"`, escape internal `\"` as `\\\"`,\n *      double any backslashes that precede a quote.\n *   2. cmd.exe: escape its metacharacters with `^` so they aren't expanded\n *      before the CRT layer sees them. `%` and `!` (delayed expansion) are\n *      the dangerous ones inside quotes; the rest are safest belt-and-braces.\n */\nexport function quoteWinArg(arg: string): string {\n  if (arg.length === 0) return '\"\"';\n\n  // Fast path: bare-word args that need no quoting at all.\n  // Backslash is intentionally excluded so `path\\` and similar still go\n  // through the trailing-backslash doubling logic below.\n  if (/^[A-Za-z0-9@\\-_+=:/.,]+$/.test(arg)) return arg;\n\n  // CRT layer: double backslashes before quotes, escape quotes, double trailing backslashes.\n  const crt = arg\n    .replace(/(\\\\*)\"/g, '$1$1\\\\\"')\n    .replace(/(\\\\+)$/, \"$1$1\");\n  const quoted = `\"${crt}\"`;\n\n  // cmd.exe layer: escape metacharacters (including the surrounding quotes)\n  // so cmd's first pass passes them through verbatim.\n  return quoted.replace(/([()%!^<>&|\"])/g, \"^$1\");\n}\n\nexport interface ExecBinOptions {\n  timeout?: number;\n  encoding?: BufferEncoding;\n  stdio?: \"pipe\" | \"inherit\" | \"ignore\";\n}\n\n/**\n * Run a resolved binary path with the given args, handling Windows .cmd/.bat\n * shims correctly. Throws on non-zero exit (matching execFileSync).\n */\nexport function execBinSync(\n  bin: string,\n  args: string[],\n  opts: ExecBinOptions = {},\n): string {\n  const { timeout = 10_000, encoding = \"utf-8\", stdio = \"pipe\" } = opts;\n\n  if (isWinShim(bin)) {\n    // CVE-2024-27980: Node refuses to spawn .cmd/.bat without shell: true.\n    // Build the command string ourselves so we control the quoting.\n    const command = [bin, ...args].map(quoteWinArg).join(\" \");\n    return execSync(command, { timeout, encoding, stdio });\n  }\n\n  return execFileSync(bin, args, { timeout, encoding, stdio });\n}\n","import { execBinSync, resolveBin } from \"./bin-utils.js\";\n\n/** Resolve the panopticon CLI binary from PATH (globally installed). */\nexport function resolvePanopticonBin(): string | null {\n  return resolveBin(\"panopticon\");\n}\n\n/** Run a panopticon CLI command and return stdout. */\nexport function panopticonExec(...args: string[]): {\n  ok: boolean;\n  stdout: string;\n};\nexport function panopticonExec(\n  ...argsAndOpts: [...string[], { timeout?: number }]\n): { ok: boolean; stdout: string };\nexport function panopticonExec(\n  ...argsAndOpts: Array<string | { timeout?: number }>\n): {\n  ok: boolean;\n  stdout: string;\n} {\n  let timeout = 10_000;\n  const args: string[] = [];\n  for (const a of argsAndOpts) {\n    if (typeof a === \"string\") args.push(a);\n    else timeout = a.timeout ?? timeout;\n  }\n  const bin = resolvePanopticonBin();\n  if (!bin) return { ok: false, stdout: \"panopticon binary not found\" };\n  try {\n    const stdout = execBinSync(bin, args, { timeout });\n    return { ok: true, stdout };\n  } catch (err: unknown) {\n    const e = err as { stdout?: string; stderr?: string; status?: number };\n    return { ok: false, stdout: (e.stdout ?? \"\") + (e.stderr ?? \"\") };\n  }\n}\n"],"mappings":";AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,cAAc,gBAAgB;AAEvC,IAAM,SAAS,QAAQ,aAAa;AACpC,IAAM,kBAAkB;AAajB,SAAS,WAAW,MAA6B;AACtD,QAAM,YAAY,QAAQ,IAAI,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,OAAO,OAAO;AAC9E,QAAM,SAAS,KAAK,QAAQ,IAAI,MAAM;AACtC,QAAM,OAAO,CAAC,UAAU,SACpB,CAAC,EAAE,KACF,QAAQ,IAAI,WAAW,iBAAiB,MAAM,GAAG,EAAE,OAAO,OAAO;AAEtE,aAAW,OAAO,UAAU;AAC1B,eAAW,OAAO,MAAM;AACtB,YAAM,YAAY,KAAK,KAAK,KAAK,OAAO,GAAG;AAC3C,UAAI;AACF,YAAI,GAAG,SAAS,SAAS,EAAE,OAAO,EAAG,QAAO;AAAA,MAC9C,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,UAAU,KAAsB;AACvC,SAAO,UAAU,gBAAgB,KAAK,GAAG;AAC3C;AAaO,SAAS,YAAY,KAAqB;AAC/C,MAAI,IAAI,WAAW,EAAG,QAAO;AAK7B,MAAI,2BAA2B,KAAK,GAAG,EAAG,QAAO;AAGjD,QAAM,MAAM,IACT,QAAQ,WAAW,SAAS,EAC5B,QAAQ,UAAU,MAAM;AAC3B,QAAM,SAAS,IAAI,GAAG;AAItB,SAAO,OAAO,QAAQ,mBAAmB,KAAK;AAChD;AAYO,SAAS,YACd,KACA,MACA,OAAuB,CAAC,GAChB;AACR,QAAM,EAAE,UAAU,KAAQ,WAAW,SAAS,QAAQ,OAAO,IAAI;AAEjE,MAAI,UAAU,GAAG,GAAG;AAGlB,UAAM,UAAU,CAAC,KAAK,GAAG,IAAI,EAAE,IAAI,WAAW,EAAE,KAAK,GAAG;AACxD,WAAO,SAAS,SAAS,EAAE,SAAS,UAAU,MAAM,CAAC;AAAA,EACvD;AAEA,SAAO,aAAa,KAAK,MAAM,EAAE,SAAS,UAAU,MAAM,CAAC;AAC7D;;;AC7FO,SAAS,uBAAsC;AACpD,SAAO,WAAW,YAAY;AAChC;AAUO,SAAS,kBACX,aAIH;AACA,MAAI,UAAU;AACd,QAAM,OAAiB,CAAC;AACxB,aAAW,KAAK,aAAa;AAC3B,QAAI,OAAO,MAAM,SAAU,MAAK,KAAK,CAAC;AAAA,QACjC,WAAU,EAAE,WAAW;AAAA,EAC9B;AACA,QAAM,MAAM,qBAAqB;AACjC,MAAI,CAAC,IAAK,QAAO,EAAE,IAAI,OAAO,QAAQ,8BAA8B;AACpE,MAAI;AACF,UAAM,SAAS,YAAY,KAAK,MAAM,EAAE,QAAQ,CAAC;AACjD,WAAO,EAAE,IAAI,MAAM,OAAO;AAAA,EAC5B,SAAS,KAAc;AACrB,UAAM,IAAI;AACV,WAAO,EAAE,IAAI,OAAO,SAAS,EAAE,UAAU,OAAO,EAAE,UAAU,IAAI;AAAA,EAClE;AACF;","names":[]}