@growthub/cli 0.5.1 → 0.6.1

package/dist/auth/hosted-client.js

@@ -0,0 +1,140 @@
+import { PaperclipApiClient, ApiRequestError } from "../client/http.js";
+/**
+ * Thin hosted client used by the CLI profile bridge.
+ *
+ * The CLI never speaks raw Supabase/BetterAuth — it only calls a small set of
+ * CLI-scoped endpoints on the hosted Growthub app (gh-app). Endpoints are
+ * treated as best-effort: when they respond 404, the profile bridge falls
+ * back to the locally cached overlay so the user still sees a useful state.
+ */
+const DEFAULT_PULL_PATH = "/api/cli/profile";
+const DEFAULT_PUSH_PATH = "/api/cli/profile";
+const DEFAULT_SESSION_PATH = "/api/cli/session";
+const DEFAULT_WORKFLOWS_PATH = "/api/cli/profile?view=workflows";
+const DEFAULT_WORKFLOW_DETAIL_PATH = "/api/cli/profile?view=workflow";
+const DEFAULT_WORKFLOW_SAVE_PATH = "/api/cli/profile?action=save-workflow";
+const DEFAULT_WORKFLOW_ARCHIVE_PATH = "/api/cli/profile?action=archive-workflow";
+const DEFAULT_WORKFLOW_DELETE_PATH = "/api/cli/profile?action=delete-workflow";
+const DEFAULT_CREDITS_PATH = "/api/cli/profile?view=credits";
+function toApiClient(session) {
+    return new PaperclipApiClient({
+        apiBase: session.hostedBaseUrl,
+        apiKey: session.accessToken,
+    });
+}
+export class HostedEndpointUnavailableError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+export async function fetchHostedSession(session) {
+    const client = toApiClient(session);
+    try {
+        return await client.get(DEFAULT_SESSION_PATH, { ignoreNotFound: true });
+    }
+    catch (err) {
+        if (err instanceof ApiRequestError && (err.status === 404 || err.status === 501)) {
+            throw new HostedEndpointUnavailableError(err.status, err.message);
+        }
+        throw err;
+    }
+}
+export async function fetchHostedProfile(session) {
+    const client = toApiClient(session);
+    try {
+        return await client.get(DEFAULT_PULL_PATH, { ignoreNotFound: true });
+    }
+    catch (err) {
+        if (err instanceof ApiRequestError && (err.status === 404 || err.status === 501)) {
+            throw new HostedEndpointUnavailableError(err.status, err.message);
+        }
+        throw err;
+    }
+}
+export async function pushHostedProfile(session, payload) {
+    const client = toApiClient(session);
+    try {
+        return await client.post(DEFAULT_PUSH_PATH, payload, { ignoreNotFound: true });
+    }
+    catch (err) {
+        if (err instanceof ApiRequestError && (err.status === 404 || err.status === 501)) {
+            throw new HostedEndpointUnavailableError(err.status, err.message);
+        }
+        throw err;
+    }
+}
+export async function listHostedWorkflows(session) {
+    const client = toApiClient(session);
+    try {
+        return await client.get(DEFAULT_WORKFLOWS_PATH, { ignoreNotFound: true });
+    }
+    catch (err) {
+        if (err instanceof ApiRequestError && (err.status === 404 || err.status === 501)) {
+            throw new HostedEndpointUnavailableError(err.status, err.message);
+        }
+        throw err;
+    }
+}
+export async function fetchHostedWorkflow(session, workflowId) {
+    const client = toApiClient(session);
+    try {
+        return await client.get(`${DEFAULT_WORKFLOW_DETAIL_PATH}&workflowId=${encodeURIComponent(workflowId)}`, { ignoreNotFound: true });
+    }
+    catch (err) {
+        if (err instanceof ApiRequestError && (err.status === 404 || err.status === 501)) {
+            throw new HostedEndpointUnavailableError(err.status, err.message);
+        }
+        throw err;
+    }
+}
+export async function saveHostedWorkflow(session, payload) {
+    const client = toApiClient(session);
+    try {
+        return await client.post(DEFAULT_WORKFLOW_SAVE_PATH, payload, { ignoreNotFound: true });
+    }
+    catch (err) {
+        if (err instanceof ApiRequestError && (err.status === 404 || err.status === 501)) {
+            throw new HostedEndpointUnavailableError(err.status, err.message);
+        }
+        throw err;
+    }
+}
+export async function archiveHostedWorkflow(session, payload) {
+    const client = toApiClient(session);
+    try {
+        return await client.post(DEFAULT_WORKFLOW_ARCHIVE_PATH, payload, { ignoreNotFound: true });
+    }
+    catch (err) {
+        if (err instanceof ApiRequestError && (err.status === 404 || err.status === 501)) {
+            throw new HostedEndpointUnavailableError(err.status, err.message);
+        }
+        throw err;
+    }
+}
+export async function deleteHostedWorkflow(session, payload) {
+    const client = toApiClient(session);
+    try {
+        return await client.post(DEFAULT_WORKFLOW_DELETE_PATH, payload, { ignoreNotFound: true });
+    }
+    catch (err) {
+        if (err instanceof ApiRequestError && (err.status === 404 || err.status === 501)) {
+            throw new HostedEndpointUnavailableError(err.status, err.message);
+        }
+        throw err;
+    }
+}
+export async function fetchHostedCredits(session) {
+    const client = toApiClient(session);
+    try {
+        return await client.get(DEFAULT_CREDITS_PATH, { ignoreNotFound: true });
+    }
+    catch (err) {
+        if (err instanceof ApiRequestError && (err.status === 404 || err.status === 501)) {
+            throw new HostedEndpointUnavailableError(err.status, err.message);
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=hosted-client.js.map

package/dist/auth/hosted-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-client.js","sourceRoot":"","sources":["../../src/auth/hosted-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIxE;;;;;;;GAOG;AAEH,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAChD,MAAM,sBAAsB,GAAG,iCAAiC,CAAC;AACjE,MAAM,4BAA4B,GAAG,gCAAgC,CAAC;AACtE,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAC3E,MAAM,6BAA6B,GAAG,0CAA0C,CAAC;AACjF,MAAM,4BAA4B,GAAG,yCAAyC,CAAC;AAC/E,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAqG7D,SAAS,WAAW,CAAC,OAAuB;IAC1C,OAAO,IAAI,kBAAkB,CAAC;QAC5B,OAAO,EAAE,OAAO,CAAC,aAAa;QAC9B,MAAM,EAAE,OAAO,CAAC,WAAW;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAC9C,MAAM,CAAS;IACxB,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAuB;IAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,GAAG,CAAwB,oBAAoB,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAuB;IAEvB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,GAAG,CAAsB,iBAAiB,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAuB,EACvB,OAA2B;IAE3B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,IAAI,CAAuB,iBAAiB,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACvG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAuB;IAEvB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,GAAG,CAA6B,sBAAsB,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACxG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAuB,EACvB,UAAkB;IAElB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,GAAG,CACrB,GAAG,4BAA4B,eAAe,kBAAkB,CAAC,UAAU,CAAC,EAAE,EAC9E,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAuB,EACvB,OAAkC;IAElC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,IAAI,CAA6B,0BAA0B,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACtH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAuB,EACvB,OAAuC;IAEvC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,IAAI,CAAkC,6BAA6B,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9H,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAuB,EACvB,OAAuC;IAEvC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,IAAI,CAAkC,4BAA4B,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7H,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAuB;IAEvB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,GAAG,CAAwB,oBAAoB,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/auth/hosted-integrations.d.ts

@@ -0,0 +1,33 @@
+import type { CliAuthSession } from "./session-store.js";
+export interface HostedIntegrationRecord {
+    /** Stable provider id — e.g. "github", "google-drive", "notion". */
+    provider: string;
+    /** Display label shown in the hosted app. */
+    label?: string;
+    /** ISO timestamp the user connected this integration. */
+    connectedAt?: string;
+    /** Scopes / permissions granted, when the provider reports them. */
+    scopes?: string[];
+    /** Provider-specific handle (e.g. GitHub login). */
+    handle?: string;
+    /** true = ready to mint credentials; false = expired / reauth needed. */
+    ready?: boolean;
+}
+export interface HostedIntegrationListResponse {
+    userId?: string;
+    integrations: HostedIntegrationRecord[];
+}
+export interface HostedIntegrationCredentialResponse {
+    provider: string;
+    /** Short-lived access token minted by the hosted app on demand. */
+    accessToken: string;
+    /** ISO expiry — short-lived by design (seconds / minutes). */
+    expiresAt?: string;
+    /** Scopes effectively granted on this minted token. */
+    scopes?: string[];
+    /** Handle associated with the token (e.g. GitHub login). */
+    handle?: string;
+}
+export declare function fetchHostedIntegrations(session: CliAuthSession): Promise<HostedIntegrationListResponse | null>;
+export declare function fetchHostedIntegrationCredential(session: CliAuthSession, providerId: string): Promise<HostedIntegrationCredentialResponse | null>;
+//# sourceMappingURL=hosted-integrations.d.ts.map

package/dist/auth/hosted-integrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-integrations.d.ts","sourceRoot":"","sources":["../../src/auth/hosted-integrations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAsBzD,MAAM,WAAW,uBAAuB;IACtC,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,uBAAuB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AASD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAa/C;AAED,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAWrD"}

package/dist/auth/hosted-integrations.js

@@ -0,0 +1,51 @@
+import { PaperclipApiClient, ApiRequestError } from "../client/http.js";
+import { HostedEndpointUnavailableError } from "./hosted-client.js";
+/**
+ * Hosted integrations extension — thin endpoint additions that re-use the
+ * existing CLI ↔ gh-app HTTP transport already established by
+ * `hosted-client.ts`. No new transport, no new auth surface. Purely surfaces
+ * the integrations that a Growthub-authenticated user has connected inside
+ * the hosted app (gh-app) — GitHub is the first consumer, any additional
+ * first-party integration will flow through the same adapter.
+ *
+ * Endpoints (implemented server-side; 404 = not yet deployed in a given
+ * hosted environment; the bridge treats absence as "no integrations" and
+ * falls through to direct CLI auth.)
+ *
+ *   GET  /api/cli/profile?view=integrations
+ *   GET  /api/cli/profile?view=integration&provider=<id>
+ */
+const DEFAULT_INTEGRATIONS_PATH = "/api/cli/profile?view=integrations";
+const DEFAULT_INTEGRATION_CREDENTIAL_PATH = "/api/cli/profile?view=integration";
+function toApiClient(session) {
+    return new PaperclipApiClient({
+        apiBase: session.hostedBaseUrl,
+        apiKey: session.accessToken,
+    });
+}
+export async function fetchHostedIntegrations(session) {
+    const client = toApiClient(session);
+    try {
+        return await client.get(DEFAULT_INTEGRATIONS_PATH, { ignoreNotFound: true });
+    }
+    catch (err) {
+        if (err instanceof ApiRequestError && (err.status === 404 || err.status === 501)) {
+            throw new HostedEndpointUnavailableError(err.status, err.message);
+        }
+        throw err;
+    }
+}
+export async function fetchHostedIntegrationCredential(session, providerId) {
+    const client = toApiClient(session);
+    const path = `${DEFAULT_INTEGRATION_CREDENTIAL_PATH}&provider=${encodeURIComponent(providerId)}`;
+    try {
+        return await client.get(path, { ignoreNotFound: true });
+    }
+    catch (err) {
+        if (err instanceof ApiRequestError && (err.status === 404 || err.status === 501)) {
+            throw new HostedEndpointUnavailableError(err.status, err.message);
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=hosted-integrations.js.map

package/dist/auth/hosted-integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-integrations.js","sourceRoot":"","sources":["../../src/auth/hosted-integrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEpE;;;;;;;;;;;;;;GAcG;AAEH,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AACvE,MAAM,mCAAmC,GAAG,mCAAmC,CAAC;AAkChF,SAAS,WAAW,CAAC,OAAuB;IAC1C,OAAO,IAAI,kBAAkB,CAAC;QAC5B,OAAO,EAAE,OAAO,CAAC,aAAa;QAC9B,MAAM,EAAE,OAAO,CAAC,WAAW;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAuB;IAEvB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,GAAG,CACrB,yBAAyB,EACzB,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAuB,EACvB,UAAkB;IAElB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,GAAG,mCAAmC,aAAa,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;IACjG,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,GAAG,CAAsC,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/auth/login-flow.d.ts

@@ -0,0 +1,27 @@
+export interface LoginFlowResult {
+    state: string;
+    token: string;
+    hostedBaseUrl: string;
+    expiresAt?: string;
+    userId?: string;
+    email?: string;
+    orgId?: string;
+    orgName?: string;
+    machineLabel?: string;
+}
+export interface StartLoginFlowOptions {
+    hostedBaseUrl: string;
+    timeoutMs?: number;
+    machineLabel?: string;
+    workspaceLabel?: string;
+    hostedLoginPath?: string;
+}
+export interface LoginFlowContext {
+    state: string;
+    callbackUrl: string;
+    loginUrl: string;
+    waitForCallback: () => Promise<LoginFlowResult>;
+    close: () => void;
+}
+export declare function startLoginFlow(opts: StartLoginFlowOptions): Promise<LoginFlowContext>;
+//# sourceMappingURL=login-flow.d.ts.map

package/dist/auth/login-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-flow.d.ts","sourceRoot":"","sources":["../../src/auth/login-flow.ts"],"names":[],"mappings":"AA2BA,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;IAChD,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAyED,wBAAsB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmI3F"}

package/dist/auth/login-flow.js

@@ -0,0 +1,212 @@
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+import os from "node:os";
+import { URL } from "node:url";
+/**
+ * Browser-driven hosted login flow for the CLI.
+ *
+ * Mirrors the `GrowthubConnectionCard` server flow (`/auth/callback?token=...`)
+ * but the callback listener is owned by the CLI (ephemeral local HTTP server)
+ * so authentication works without a running Growthub local server.
+ *
+ * Flow:
+ *   1. CLI generates a random `state`.
+ *   2. CLI binds an ephemeral loopback HTTP listener (127.0.0.1:<random-port>).
+ *   3. CLI opens `${hostedBaseUrl}/cli/login?state=...&callback=http://127.0.0.1:<port>/cli-callback`.
+ *   4. Hosted app authenticates the user, exchanges Supabase session for a
+ *      short-lived bearer token, redirects to the CLI callback with
+ *      `token`, `state`, and optional profile metadata.
+ *   5. CLI validates `state`, captures token + metadata, closes the listener.
+ *
+ * For CI / headless environments, the caller can bypass the browser flow by
+ * providing a token directly via `growthub auth login --token ...`.
+ */
+const DEFAULT_HOSTED_LOGIN_PATH = "/cli/login";
+const CALLBACK_PATH = "/cli-callback";
+function randomState() {
+    return randomBytes(16).toString("hex");
+}
+function trimSlashes(value) {
+    return value.replace(/\/+$/, "");
+}
+function pickParam(url, name) {
+    const value = url.searchParams.get(name);
+    if (value === null)
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function renderSuccessPage(hostedBaseUrl) {
+    const safeBase = hostedBaseUrl.replace(/"/g, "&quot;");
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Growthub CLI connected</title>
+    <style>
+      body { font-family: ui-sans-serif, system-ui, sans-serif; margin: 0; background: #0b0f14; color: #f5f7fa; }
+      main { min-height: 100vh; display: grid; place-items: center; padding: 24px; }
+      section { width: min(560px, 100%); background: #121821; border: 1px solid #263244; border-radius: 16px; padding: 24px; box-sizing: border-box; }
+      h1 { margin: 0 0 12px; font-size: 22px; }
+      p { margin: 0 0 12px; line-height: 1.5; color: #c7d2e0; }
+      a { color: #7dd3fc; }
+    </style>
+  </head>
+  <body>
+    <main>
+      <section>
+        <h1>Growthub CLI connected</h1>
+        <p>Your local CLI now has a hosted session token. You can close this tab and return to your terminal.</p>
+        <p>Hosted app: <a href="${safeBase}">${safeBase}</a></p>
+      </section>
+    </main>
+    <script>window.setTimeout(() => { try { window.close(); } catch {} }, 1200);</script>
+  </body>
+</html>`;
+}
+function renderErrorPage(message) {
+    const safeMessage = message.replace(/</g, "&lt;");
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8" /><title>Growthub CLI login error</title></head>
+<body style="font-family: ui-sans-serif, system-ui, sans-serif; background: #0b0f14; color: #f5f7fa; padding: 24px;">
+  <h1>Login error</h1>
+  <p>${safeMessage}</p>
+  <p>Return to your terminal and try again.</p>
+</body></html>`;
+}
+function listenOnEphemeralLoopback(server) {
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen({ host: "127.0.0.1", port: 0 }, () => {
+            server.off("error", reject);
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                reject(new Error("Failed to bind loopback port for CLI auth callback."));
+                return;
+            }
+            resolve(address.port);
+        });
+    });
+}
+export async function startLoginFlow(opts) {
+    const hostedBaseUrl = trimSlashes(opts.hostedBaseUrl);
+    if (!hostedBaseUrl) {
+        throw new Error("hostedBaseUrl is required to start the CLI login flow.");
+    }
+    try {
+        // validate
+        new URL(hostedBaseUrl);
+    }
+    catch {
+        throw new Error(`Invalid hosted base URL: ${opts.hostedBaseUrl}`);
+    }
+    const state = randomState();
+    const machineLabel = opts.machineLabel?.trim() || os.hostname();
+    const workspaceLabel = opts.workspaceLabel?.trim();
+    const timeoutMs = Math.max(30_000, opts.timeoutMs ?? 5 * 60_000);
+    let resolver = null;
+    let rejecter = null;
+    const waitPromise = new Promise((resolve, reject) => {
+        resolver = resolve;
+        rejecter = reject;
+    });
+    const server = createServer((req, res) => {
+        try {
+            const host = req.headers.host ?? "127.0.0.1";
+            const requestUrl = new URL(req.url ?? "/", `http://${host}`);
+            if (requestUrl.pathname !== CALLBACK_PATH) {
+                res.statusCode = 404;
+                res.end("Not found");
+                return;
+            }
+            const incomingState = pickParam(requestUrl, "state");
+            if (!incomingState || incomingState !== state) {
+                res.statusCode = 400;
+                res.setHeader("content-type", "text/html; charset=utf-8");
+                res.end(renderErrorPage("State token mismatch. Restart `growthub auth login`."));
+                rejecter?.(new Error("CLI auth callback rejected — state mismatch."));
+                return;
+            }
+            const error = pickParam(requestUrl, "error");
+            if (error) {
+                res.statusCode = 400;
+                res.setHeader("content-type", "text/html; charset=utf-8");
+                res.end(renderErrorPage(error));
+                rejecter?.(new Error(`Hosted app reported login error: ${error}`));
+                return;
+            }
+            const token = pickParam(requestUrl, "token");
+            if (!token) {
+                res.statusCode = 400;
+                res.setHeader("content-type", "text/html; charset=utf-8");
+                res.end(renderErrorPage("Missing token in callback."));
+                rejecter?.(new Error("CLI auth callback missing token."));
+                return;
+            }
+            const result = {
+                state,
+                token,
+                hostedBaseUrl,
+                expiresAt: pickParam(requestUrl, "expiresAt"),
+                userId: pickParam(requestUrl, "userId"),
+                email: pickParam(requestUrl, "email"),
+                orgId: pickParam(requestUrl, "orgId"),
+                orgName: pickParam(requestUrl, "orgName"),
+                machineLabel: pickParam(requestUrl, "machineLabel") ?? machineLabel,
+            };
+            res.statusCode = 200;
+            res.setHeader("content-type", "text/html; charset=utf-8");
+            res.end(renderSuccessPage(hostedBaseUrl));
+            resolver?.(result);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            res.statusCode = 500;
+            res.end(message);
+            rejecter?.(err instanceof Error ? err : new Error(message));
+        }
+    });
+    const port = await listenOnEphemeralLoopback(server);
+    const callbackUrl = `http://127.0.0.1:${port}${CALLBACK_PATH}`;
+    const hostedLoginPath = opts.hostedLoginPath ?? DEFAULT_HOSTED_LOGIN_PATH;
+    const loginUrl = (() => {
+        const url = new URL(hostedLoginPath, `${hostedBaseUrl}/`);
+        url.searchParams.set("state", state);
+        url.searchParams.set("callback", callbackUrl);
+        url.searchParams.set("machineLabel", machineLabel);
+        if (workspaceLabel)
+            url.searchParams.set("workspaceLabel", workspaceLabel);
+        url.searchParams.set("source", "cli");
+        return url.toString();
+    })();
+    let timeoutHandle = setTimeout(() => {
+        rejecter?.(new Error(`CLI login timed out after ${Math.round(timeoutMs / 1000)}s.`));
+    }, timeoutMs);
+    if (typeof timeoutHandle.unref === "function")
+        timeoutHandle.unref();
+    const close = () => {
+        if (timeoutHandle) {
+            clearTimeout(timeoutHandle);
+            timeoutHandle = null;
+        }
+        server.close();
+    };
+    const waitForCallback = async () => {
+        try {
+            const result = await waitPromise;
+            return result;
+        }
+        finally {
+            close();
+        }
+    };
+    return {
+        state,
+        callbackUrl,
+        loginUrl,
+        waitForCallback,
+        close,
+    };
+}
+//# sourceMappingURL=login-flow.js.map

package/dist/auth/login-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-flow.js","sourceRoot":"","sources":["../../src/auth/login-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAC/C,MAAM,aAAa,GAAG,eAAe,CAAC;AA8BtC,SAAS,WAAW;IAClB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,SAAS,CAAC,GAAQ,EAAE,IAAY;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAC,aAAqB;IAC9C,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvD,OAAO;;;;;;;;;;;;;;;;;;;;kCAoByB,QAAQ,KAAK,QAAQ;;;;;QAK/C,CAAC;AACT,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO;;;;OAIF,WAAW;;eAEH,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAc;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE;YACjD,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;gBACzE,OAAO;YACT,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC;QACH,WAAW;QACX,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;IAChE,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;IAEjE,IAAI,QAAQ,GAA+C,IAAI,CAAC;IAChE,IAAI,QAAQ,GAAkC,IAAI,CAAC;IAEnD,MAAM,WAAW,GAAG,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnE,QAAQ,GAAG,OAAO,CAAC;QACnB,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACxE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;YAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;YAE7D,IAAI,UAAU,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC1C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,aAAa,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACrD,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC9C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBAC1D,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,sDAAsD,CAAC,CAAC,CAAC;gBACjF,QAAQ,EAAE,CAAC,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC7C,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBAC1D,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChC,QAAQ,EAAE,CAAC,IAAI,KAAK,CAAC,oCAAoC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBAC1D,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,4BAA4B,CAAC,CAAC,CAAC;gBACvD,QAAQ,EAAE,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAoB;gBAC9B,KAAK;gBACL,KAAK;gBACL,aAAa;gBACb,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC;gBAC7C,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC;gBACvC,KAAK,EAAE,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC;gBACrC,KAAK,EAAE,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC;gBACrC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC;gBACzC,YAAY,EAAE,SAAS,CAAC,UAAU,EAAE,cAAc,CAAC,IAAI,YAAY;aACpE,CAAC;YAEF,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YAC1D,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC;YAE1C,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjB,QAAQ,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,oBAAoB,IAAI,GAAG,aAAa,EAAE,CAAC;IAE/D,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAC1E,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE;QACrB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,GAAG,aAAa,GAAG,CAAC,CAAC;QAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,cAAc;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QAC3E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,aAAa,GAA0B,UAAU,CAAC,GAAG,EAAE;QACzD,QAAQ,EAAE,CAAC,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,CAAC,EAAE,SAAS,CAAC,CAAC;IACd,IAAI,OAAO,aAAa,CAAC,KAAK,KAAK,UAAU;QAAE,aAAa,CAAC,KAAK,EAAE,CAAC;IAErE,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,aAAa,EAAE,CAAC;YAClB,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5B,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,IAAI,EAAE;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;YACjC,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,WAAW;QACX,QAAQ;QACR,eAAe;QACf,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/auth/overlay-store.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Hosted Growthub profile overlay.
+ *
+ * This sits ABOVE the local Paperclip workspace profile. It never replaces
+ * local-first execution defaults — it only carries server-recognized identity,
+ * entitlements, and routing preferences. If the overlay is absent or cleared,
+ * the CLI must continue to operate against the local workspace profile alone.
+ */
+export interface ExecutionPreferences {
+    preferredMode: "local" | "serverless" | "browser" | "auto";
+    allowServerlessFallback: boolean;
+    allowBrowserBridge: boolean;
+}
+export interface HostedProfileOverlay {
+    version: 1;
+    /** Hosted app base URL this overlay was pulled from. */
+    hostedBaseUrl: string;
+    /** Authenticated user id, mirrors session. */
+    userId?: string;
+    email?: string;
+    displayName?: string;
+    orgId?: string;
+    orgName?: string;
+    /** Server-recognized entitlement keys (opaque catalog). */
+    entitlements: string[];
+    /** Server-recognized gated kit slugs the user has access to. */
+    gatedKitSlugs: string[];
+    /** Execution routing defaults recommended by hosted app. */
+    executionDefaults: ExecutionPreferences;
+    /** Linked local workspace instance id (Paperclip instance). */
+    linkedInstanceId?: string;
+    /** Last successful pull timestamp (ISO). */
+    lastPulledAt?: string;
+    /** Last successful push timestamp (ISO). */
+    lastPushedAt?: string;
+    /** Arbitrary hosted preferences that the CLI should not interpret. */
+    extra?: Record<string, unknown>;
+}
+export declare function readHostedOverlay(): HostedProfileOverlay | null;
+export declare function writeHostedOverlay(overlay: HostedProfileOverlay): void;
+export declare function clearHostedOverlay(): boolean;
+export declare function describeHostedOverlayPath(): string;
+export declare function seedHostedOverlayFromSession(input: {
+    hostedBaseUrl: string;
+    userId?: string;
+    email?: string;
+    orgId?: string;
+    orgName?: string;
+    machineLabel?: string;
+    linkedInstanceId?: string;
+}): HostedProfileOverlay;
+//# sourceMappingURL=overlay-store.d.ts.map

package/dist/auth/overlay-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"overlay-store.d.ts","sourceRoot":"","sources":["../../src/auth/overlay-store.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,GAAG,MAAM,CAAC;IAC3D,uBAAuB,EAAE,OAAO,CAAC;IACjC,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,CAAC,CAAC;IACX,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gEAAgE;IAChE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,4DAA4D;IAC5D,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAiFD,wBAAgB,iBAAiB,IAAI,oBAAoB,GAAG,IAAI,CAI/D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAStE;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAK5C;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,oBAAoB,CAiBvB"}