@growthub/cli 0.6.0 → 0.6.2

package/dist/auth/overlay-store.js

@@ -0,0 +1,123 @@
+import fs from "node:fs";
+import path from "node:path";
+import { resolveHostedOverlayPath, resolveProfilesDir } from "./paths.js";
+function parseJson(filePath) {
+    try {
+        return JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    }
+    catch (err) {
+        throw new Error(`Failed to parse hosted overlay at ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+function toStringOrUndefined(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+function toStringArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    const out = [];
+    for (const item of value) {
+        const normalized = toStringOrUndefined(item);
+        if (normalized && !out.includes(normalized))
+            out.push(normalized);
+    }
+    return out;
+}
+function toRecord(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    return value;
+}
+function normalizeExecutionDefaults(value) {
+    const record = toRecord(value) ?? {};
+    const modeRaw = toStringOrUndefined(record.preferredMode);
+    const preferredMode = modeRaw === "local" || modeRaw === "serverless" || modeRaw === "browser" || modeRaw === "auto"
+        ? modeRaw
+        : "local";
+    return {
+        preferredMode,
+        allowServerlessFallback: typeof record.allowServerlessFallback === "boolean"
+            ? record.allowServerlessFallback
+            : false,
+        allowBrowserBridge: typeof record.allowBrowserBridge === "boolean"
+            ? record.allowBrowserBridge
+            : false,
+    };
+}
+function defaultExecutionPreferences() {
+    return {
+        preferredMode: "local",
+        allowServerlessFallback: false,
+        allowBrowserBridge: false,
+    };
+}
+function normalizeOverlay(raw) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+        return null;
+    const record = raw;
+    const hostedBaseUrl = toStringOrUndefined(record.hostedBaseUrl);
+    if (!hostedBaseUrl)
+        return null;
+    return {
+        version: 1,
+        hostedBaseUrl,
+        userId: toStringOrUndefined(record.userId),
+        email: toStringOrUndefined(record.email),
+        displayName: toStringOrUndefined(record.displayName),
+        orgId: toStringOrUndefined(record.orgId),
+        orgName: toStringOrUndefined(record.orgName),
+        entitlements: toStringArray(record.entitlements),
+        gatedKitSlugs: toStringArray(record.gatedKitSlugs),
+        executionDefaults: normalizeExecutionDefaults(record.executionDefaults),
+        linkedInstanceId: toStringOrUndefined(record.linkedInstanceId),
+        lastPulledAt: toStringOrUndefined(record.lastPulledAt),
+        lastPushedAt: toStringOrUndefined(record.lastPushedAt),
+        extra: toRecord(record.extra),
+    };
+}
+export function readHostedOverlay() {
+    const filePath = resolveHostedOverlayPath();
+    if (!fs.existsSync(filePath))
+        return null;
+    return normalizeOverlay(parseJson(filePath));
+}
+export function writeHostedOverlay(overlay) {
+    const filePath = resolveHostedOverlayPath();
+    fs.mkdirSync(resolveProfilesDir(), { recursive: true });
+    fs.writeFileSync(filePath, `${JSON.stringify(overlay, null, 2)}\n`, { mode: 0o600 });
+    try {
+        fs.chmodSync(filePath, 0o600);
+    }
+    catch {
+        // non-posix best-effort
+    }
+}
+export function clearHostedOverlay() {
+    const filePath = resolveHostedOverlayPath();
+    if (!fs.existsSync(filePath))
+        return false;
+    fs.rmSync(filePath, { force: true });
+    return true;
+}
+export function describeHostedOverlayPath() {
+    return path.resolve(resolveHostedOverlayPath());
+}
+export function seedHostedOverlayFromSession(input) {
+    return {
+        version: 1,
+        hostedBaseUrl: input.hostedBaseUrl,
+        userId: input.userId,
+        email: input.email,
+        displayName: input.email,
+        orgId: input.orgId,
+        orgName: input.orgName,
+        entitlements: [],
+        gatedKitSlugs: [],
+        executionDefaults: defaultExecutionPreferences(),
+        linkedInstanceId: input.linkedInstanceId,
+        lastPulledAt: undefined,
+        lastPushedAt: undefined,
+        extra: input.machineLabel ? { machineLabel: input.machineLabel } : undefined,
+    };
+}
+//# sourceMappingURL=overlay-store.js.map

package/dist/auth/overlay-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"overlay-store.js","sourceRoot":"","sources":["../../src/auth/overlay-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA0C1E,SAAS,SAAS,CAAC,QAAgB;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,aAAa,GACjB,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM;QAC5F,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,OAAO,CAAC;IACd,OAAO;QACL,aAAa;QACb,uBAAuB,EAAE,OAAO,MAAM,CAAC,uBAAuB,KAAK,SAAS;YAC1E,CAAC,CAAC,MAAM,CAAC,uBAAuB;YAChC,CAAC,CAAC,KAAK;QACT,kBAAkB,EAAE,OAAO,MAAM,CAAC,kBAAkB,KAAK,SAAS;YAChE,CAAC,CAAC,MAAM,CAAC,kBAAkB;YAC3B,CAAC,CAAC,KAAK;KACV,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,uBAAuB,EAAE,KAAK;QAC9B,kBAAkB,EAAE,KAAK;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,OAAO;QACL,OAAO,EAAE,CAAC;QACV,aAAa;QACb,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1C,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,WAAW,EAAE,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC;QACpD,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5C,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;QAChD,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC;QAClD,iBAAiB,EAAE,0BAA0B,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACvE,gBAAgB,EAAE,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC9D,YAAY,EAAE,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC;QACtD,YAAY,EAAE,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC;QACtD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC9D,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,EAAE,CAAC,SAAS,CAAC,kBAAkB,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAQ5C;IACC,OAAO;QACL,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,EAAE;QAChB,aAAa,EAAE,EAAE;QACjB,iBAAiB,EAAE,2BAA2B,EAAE;QAChD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,YAAY,EAAE,SAAS;QACvB,YAAY,EAAE,SAAS;QACvB,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;KAC7E,CAAC;AACJ,CAAC"}

package/dist/auth/paths.d.ts

@@ -0,0 +1,15 @@
+/**
+ * CLI-owned auth + profile storage roots.
+ *
+ * These live under the Paperclip home directory (`~/.paperclip` by default) but
+ * are deliberately scoped outside `instances/<id>/config.json` so hosted auth
+ * overlay metadata does not leak into local workspace config files or kit
+ * export folders. This preserves the "paperclip local workspace profile stays
+ * the base layer, hosted overlay lives above it" design contract.
+ */
+export declare function resolveAuthDir(): string;
+export declare function resolveProfilesDir(): string;
+export declare function resolveSessionPath(): string;
+export declare function resolveHostedOverlayPath(): string;
+export declare function resolveEffectiveProfilePath(): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/auth/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/auth/paths.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAgB,2BAA2B,IAAI,MAAM,CAEpD"}

package/dist/auth/paths.js

@@ -0,0 +1,27 @@
+import path from "node:path";
+import { resolvePaperclipHomeDir } from "../config/home.js";
+/**
+ * CLI-owned auth + profile storage roots.
+ *
+ * These live under the Paperclip home directory (`~/.paperclip` by default) but
+ * are deliberately scoped outside `instances/<id>/config.json` so hosted auth
+ * overlay metadata does not leak into local workspace config files or kit
+ * export folders. This preserves the "paperclip local workspace profile stays
+ * the base layer, hosted overlay lives above it" design contract.
+ */
+export function resolveAuthDir() {
+    return path.resolve(resolvePaperclipHomeDir(), "auth");
+}
+export function resolveProfilesDir() {
+    return path.resolve(resolvePaperclipHomeDir(), "profiles");
+}
+export function resolveSessionPath() {
+    return path.resolve(resolveAuthDir(), "session.json");
+}
+export function resolveHostedOverlayPath() {
+    return path.resolve(resolveProfilesDir(), "hosted-overlay.json");
+}
+export function resolveEffectiveProfilePath() {
+    return path.resolve(resolveProfilesDir(), "effective-profile.json");
+}
+//# sourceMappingURL=paths.js.map

package/dist/auth/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/auth/paths.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D;;;;;;;;GAQG;AAEH,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,UAAU,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,qBAAqB,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,wBAAwB,CAAC,CAAC;AACtE,CAAC"}

package/dist/auth/session-store.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Minimal hosted session material persisted by the CLI.
+ *
+ * The CLI deliberately does NOT implement Supabase/BetterAuth semantics; it
+ * only stores the short-lived token exchanged by the hosted app via the
+ * browser-driven login flow. Server-side session semantics remain owned by
+ * `gh-app` / the hosted Growthub Next.js app.
+ */
+export interface CliAuthSession {
+    version: 1;
+    /** Hosted base URL the token was issued against. */
+    hostedBaseUrl: string;
+    /** Short-lived bearer token from the hosted exchange. */
+    accessToken: string;
+    /** ISO timestamp when the token expires, if known. */
+    expiresAt?: string;
+    /** Authenticated user id (opaque string). */
+    userId?: string;
+    /** Human-readable email (optional, surfaced in whoami). */
+    email?: string;
+    /** Organization id, if hosted app scopes tokens to an org. */
+    orgId?: string;
+    /** Organization display name. */
+    orgName?: string;
+    /** Machine label the hosted app stamped the session with. */
+    machineLabel?: string;
+    /** ISO timestamp when the session was minted locally. */
+    issuedAt: string;
+}
+export declare function readSession(): CliAuthSession | null;
+export declare function writeSession(session: CliAuthSession): void;
+export declare function clearSession(): boolean;
+export declare function isSessionExpired(session: CliAuthSession, now?: Date): boolean;
+export declare function describeSessionPath(): string;
+//# sourceMappingURL=session-store.d.ts.map

package/dist/auth/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/auth/session-store.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAwCD,wBAAgB,WAAW,IAAI,cAAc,GAAG,IAAI,CAKnD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAS1D;AAED,wBAAgB,YAAY,IAAI,OAAO,CAKtC;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAKzF;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/dist/auth/session-store.js

@@ -0,0 +1,73 @@
+import fs from "node:fs";
+import path from "node:path";
+import { resolveAuthDir, resolveSessionPath } from "./paths.js";
+function parseJson(filePath) {
+    try {
+        return JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    }
+    catch (err) {
+        throw new Error(`Failed to parse auth session at ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+function toStringOrUndefined(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+function normalizeSession(raw) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+        return null;
+    const record = raw;
+    const accessToken = toStringOrUndefined(record.accessToken);
+    const hostedBaseUrl = toStringOrUndefined(record.hostedBaseUrl);
+    if (!accessToken || !hostedBaseUrl)
+        return null;
+    const issuedAt = toStringOrUndefined(record.issuedAt) ?? new Date().toISOString();
+    return {
+        version: 1,
+        hostedBaseUrl,
+        accessToken,
+        expiresAt: toStringOrUndefined(record.expiresAt),
+        userId: toStringOrUndefined(record.userId),
+        email: toStringOrUndefined(record.email),
+        orgId: toStringOrUndefined(record.orgId),
+        orgName: toStringOrUndefined(record.orgName),
+        machineLabel: toStringOrUndefined(record.machineLabel),
+        issuedAt,
+    };
+}
+export function readSession() {
+    const filePath = resolveSessionPath();
+    if (!fs.existsSync(filePath))
+        return null;
+    const raw = parseJson(filePath);
+    return normalizeSession(raw);
+}
+export function writeSession(session) {
+    const filePath = resolveSessionPath();
+    fs.mkdirSync(resolveAuthDir(), { recursive: true });
+    fs.writeFileSync(filePath, `${JSON.stringify(session, null, 2)}\n`, { mode: 0o600 });
+    try {
+        fs.chmodSync(filePath, 0o600);
+    }
+    catch {
+        // non-posix filesystems — best-effort
+    }
+}
+export function clearSession() {
+    const filePath = resolveSessionPath();
+    if (!fs.existsSync(filePath))
+        return false;
+    fs.rmSync(filePath, { force: true });
+    return true;
+}
+export function isSessionExpired(session, now = new Date()) {
+    if (!session.expiresAt)
+        return false;
+    const expires = Date.parse(session.expiresAt);
+    if (Number.isNaN(expires))
+        return false;
+    return expires <= now.getTime();
+}
+export function describeSessionPath() {
+    return path.resolve(resolveSessionPath());
+}
+//# sourceMappingURL=session-store.js.map

package/dist/auth/session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.js","sourceRoot":"","sources":["../../src/auth/session-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAgChE,SAAS,SAAS,CAAC,QAAgB;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mCAAmC,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,MAAM,GAAG,GAA8B,CAAC;IAE9C,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAElF,OAAO;QACL,OAAO,EAAE,CAAC;QACV,aAAa;QACb,WAAW;QACX,SAAS,EAAE,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC;QAChD,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1C,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5C,YAAY,EAAE,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC;QACtD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAuB,EAAE,MAAY,IAAI,IAAI,EAAE;IAC9E,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/auth/workflow-access.d.ts

@@ -0,0 +1,7 @@
+export type WorkflowAccessState = "unauthenticated" | "unlinked" | "ready";
+export interface WorkflowAccess {
+    state: WorkflowAccessState;
+    reason: string;
+}
+export declare function getWorkflowAccess(): WorkflowAccess;
+//# sourceMappingURL=workflow-access.d.ts.map

package/dist/auth/workflow-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-access.d.ts","sourceRoot":"","sources":["../../src/auth/workflow-access.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,GAAG,UAAU,GAAG,OAAO,CAAC;AAE3E,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iBAAiB,IAAI,cAAc,CA4BlD"}

package/dist/auth/workflow-access.js

@@ -0,0 +1,27 @@
+import { computeEffectiveProfile } from "./effective-profile.js";
+export function getWorkflowAccess() {
+    const profile = computeEffectiveProfile();
+    if (!profile.authenticated) {
+        return {
+            state: "unauthenticated",
+            reason: "Requires growthub auth login",
+        };
+    }
+    if (!profile.hosted.present || !profile.hosted.linkedInstanceId) {
+        return {
+            state: "unlinked",
+            reason: "Requires Growthub Local Machine connection",
+        };
+    }
+    if (profile.hosted.linkedInstanceId !== profile.local.instanceId) {
+        return {
+            state: "unlinked",
+            reason: `Linked to ${profile.hosted.linkedInstanceId}, not this workspace`,
+        };
+    }
+    return {
+        state: "ready",
+        reason: "Workflow tools unlocked",
+    };
+}
+//# sourceMappingURL=workflow-access.js.map

package/dist/auth/workflow-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-access.js","sourceRoot":"","sources":["../../src/auth/workflow-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AASjE,MAAM,UAAU,iBAAiB;IAC/B,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAE1C,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,iBAAiB;YACxB,MAAM,EAAE,8BAA8B;SACvC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAChE,OAAO;YACL,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,4CAA4C;SACrD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,CAAC,gBAAgB,KAAK,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACjE,OAAO;YACL,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,aAAa,OAAO,CAAC,MAAM,CAAC,gBAAgB,sBAAsB;SAC3E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,yBAAyB;KAClC,CAAC;AACJ,CAAC"}

package/dist/checks/agent-jwt-secret-check.d.ts

@@ -0,0 +1,3 @@
+import type { CheckResult } from "./index.js";
+export declare function agentJwtSecretCheck(configPath?: string): CheckResult;
+//# sourceMappingURL=agent-jwt-secret-check.d.ts.map

package/dist/checks/agent-jwt-secret-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-jwt-secret-check.d.ts","sourceRoot":"","sources":["../../src/checks/agent-jwt-secret-check.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,wBAAgB,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CA+BpE"}

package/dist/checks/agent-jwt-secret-check.js

@@ -0,0 +1,31 @@
+import { ensureAgentJwtSecret, readAgentJwtSecretFromEnv, readAgentJwtSecretFromEnvFile, resolveAgentJwtEnvFile, } from "../config/env.js";
+export function agentJwtSecretCheck(configPath) {
+    if (readAgentJwtSecretFromEnv(configPath)) {
+        return {
+            name: "Agent JWT secret",
+            status: "pass",
+            message: "PAPERCLIP_AGENT_JWT_SECRET is set in environment",
+        };
+    }
+    const envPath = resolveAgentJwtEnvFile(configPath);
+    const fileSecret = readAgentJwtSecretFromEnvFile(envPath);
+    if (fileSecret) {
+        return {
+            name: "Agent JWT secret",
+            status: "warn",
+            message: `PAPERCLIP_AGENT_JWT_SECRET is present in ${envPath} but not loaded into environment`,
+            repairHint: `Set the value from ${envPath} in your shell before starting the Growthub server`,
+        };
+    }
+    return {
+        name: "Agent JWT secret",
+        status: "fail",
+        message: `PAPERCLIP_AGENT_JWT_SECRET missing from environment and ${envPath}`,
+        canRepair: true,
+        repair: () => {
+            ensureAgentJwtSecret(configPath);
+        },
+        repairHint: `Run with --repair to create ${envPath} containing PAPERCLIP_AGENT_JWT_SECRET`,
+    };
+}
+//# sourceMappingURL=agent-jwt-secret-check.js.map

package/dist/checks/agent-jwt-secret-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-jwt-secret-check.js","sourceRoot":"","sources":["../../src/checks/agent-jwt-secret-check.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAG1B,MAAM,UAAU,mBAAmB,CAAC,UAAmB;IACrD,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kDAAkD;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAE1D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,4CAA4C,OAAO,kCAAkC;YAC9F,UAAU,EAAE,sBAAsB,OAAO,oDAAoD;SAC9F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,2DAA2D,OAAO,EAAE;QAC7E,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,GAAG,EAAE;YACX,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACnC,CAAC;QACD,UAAU,EAAE,+BAA+B,OAAO,wCAAwC;KAC3F,CAAC;AACJ,CAAC"}

package/dist/checks/config-check.d.ts

@@ -0,0 +1,3 @@
+import type { CheckResult } from "./index.js";
+export declare function configCheck(configPath?: string): CheckResult;
+//# sourceMappingURL=config-check.d.ts.map

package/dist/checks/config-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-check.d.ts","sourceRoot":"","sources":["../../src/checks/config-check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,wBAAgB,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CA6B5D"}

package/dist/checks/config-check.js

@@ -0,0 +1,31 @@
+import { readConfig, configExists, resolveConfigPath } from "../config/store.js";
+export function configCheck(configPath) {
+    const filePath = resolveConfigPath(configPath);
+    if (!configExists(configPath)) {
+        return {
+            name: "Config file",
+            status: "fail",
+            message: `Config file not found at ${filePath}`,
+            canRepair: false,
+            repairHint: "Run `paperclipai onboard` to create one",
+        };
+    }
+    try {
+        readConfig(configPath);
+        return {
+            name: "Config file",
+            status: "pass",
+            message: `Valid config at ${filePath}`,
+        };
+    }
+    catch (err) {
+        return {
+            name: "Config file",
+            status: "fail",
+            message: `Invalid config: ${err instanceof Error ? err.message : String(err)}`,
+            canRepair: false,
+            repairHint: "Run `paperclipai configure --section database` (or `paperclipai onboard` to recreate)",
+        };
+    }
+}
+//# sourceMappingURL=config-check.js.map

package/dist/checks/config-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-check.js","sourceRoot":"","sources":["../../src/checks/config-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGjF,MAAM,UAAU,WAAW,CAAC,UAAmB;IAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE/C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,4BAA4B,QAAQ,EAAE;YAC/C,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,yCAAyC;SACtD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,UAAU,CAAC,UAAU,CAAC,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mBAAmB,QAAQ,EAAE;SACvC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAC9E,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,uFAAuF;SACpG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/checks/database-check.d.ts

@@ -0,0 +1,4 @@
+import type { PaperclipConfig } from "../config/schema.js";
+import type { CheckResult } from "./index.js";
+export declare function databaseCheck(config: PaperclipConfig, configPath?: string): Promise<CheckResult>;
+//# sourceMappingURL=database-check.d.ts.map

package/dist/checks/database-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-check.d.ts","sourceRoot":"","sources":["../../src/checks/database-check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,wBAAsB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAqDtG"}

package/dist/checks/database-check.js

@@ -0,0 +1,54 @@
+import fs from "node:fs";
+import { resolveRuntimeLikePath } from "./path-resolver.js";
+export async function databaseCheck(config, configPath) {
+    if (config.database.mode === "postgres") {
+        if (!config.database.connectionString) {
+            return {
+                name: "Database",
+                status: "fail",
+                message: "PostgreSQL mode selected but no connection string configured",
+                canRepair: false,
+                repairHint: "Run `paperclipai configure --section database`",
+            };
+        }
+        try {
+            const { createDb } = await import("@paperclipai/db");
+            const db = createDb(config.database.connectionString);
+            await db.execute("SELECT 1");
+            return {
+                name: "Database",
+                status: "pass",
+                message: "PostgreSQL connection successful",
+            };
+        }
+        catch (err) {
+            return {
+                name: "Database",
+                status: "fail",
+                message: `Cannot connect to PostgreSQL: ${err instanceof Error ? err.message : String(err)}`,
+                canRepair: false,
+                repairHint: "Check your connection string and ensure PostgreSQL is running",
+            };
+        }
+    }
+    if (config.database.mode === "embedded-postgres") {
+        const dataDir = resolveRuntimeLikePath(config.database.embeddedPostgresDataDir, configPath);
+        const reportedPath = dataDir;
+        if (!fs.existsSync(dataDir)) {
+            fs.mkdirSync(reportedPath, { recursive: true });
+        }
+        return {
+            name: "Database",
+            status: "pass",
+            message: `Embedded PostgreSQL configured at ${dataDir} (port ${config.database.embeddedPostgresPort})`,
+        };
+    }
+    return {
+        name: "Database",
+        status: "fail",
+        message: `Unknown database mode: ${String(config.database.mode)}`,
+        canRepair: false,
+        repairHint: "Run `paperclipai configure --section database`",
+    };
+}
+//# sourceMappingURL=database-check.js.map

package/dist/checks/database-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-check.js","sourceRoot":"","sources":["../../src/checks/database-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAGzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAuB,EAAE,UAAmB;IAC9E,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtC,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,8DAA8D;gBACvE,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,gDAAgD;aAC7D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACrD,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YACtD,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,kCAAkC;aAC5C,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBAC5F,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,+DAA+D;aAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,UAAU,CAAC,CAAC;QAC5F,MAAM,YAAY,GAAG,OAAO,CAAC;QAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,qCAAqC,OAAO,UAAU,MAAM,CAAC,QAAQ,CAAC,oBAAoB,GAAG;SACvG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,0BAA0B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACjE,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,gDAAgD;KAC7D,CAAC;AACJ,CAAC"}

package/dist/checks/deployment-auth-check.d.ts

@@ -0,0 +1,4 @@
+import type { PaperclipConfig } from "../config/schema.js";
+import type { CheckResult } from "./index.js";
+export declare function deploymentAuthCheck(config: PaperclipConfig): CheckResult;
+//# sourceMappingURL=deployment-auth-check.d.ts.map

package/dist/checks/deployment-auth-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-auth-check.d.ts","sourceRoot":"","sources":["../../src/checks/deployment-auth-check.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAO9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,CAkFxE"}

package/dist/checks/deployment-auth-check.js

@@ -0,0 +1,83 @@
+function isLoopbackHost(host) {
+    const normalized = host.trim().toLowerCase();
+    return normalized === "127.0.0.1" || normalized === "localhost" || normalized === "::1";
+}
+export function deploymentAuthCheck(config) {
+    const mode = config.server.deploymentMode;
+    const exposure = config.server.exposure;
+    const auth = config.auth;
+    if (mode === "local_trusted") {
+        if (!isLoopbackHost(config.server.host)) {
+            return {
+                name: "Deployment/auth mode",
+                status: "fail",
+                message: `local_trusted requires loopback host binding (found ${config.server.host})`,
+                canRepair: false,
+                repairHint: "Run `paperclipai configure --section server` and set host to 127.0.0.1",
+            };
+        }
+        return {
+            name: "Deployment/auth mode",
+            status: "pass",
+            message: "local_trusted mode is configured for loopback-only access",
+        };
+    }
+    const secret = process.env.BETTER_AUTH_SECRET?.trim() ??
+        process.env.PAPERCLIP_AGENT_JWT_SECRET?.trim();
+    if (!secret) {
+        return {
+            name: "Deployment/auth mode",
+            status: "fail",
+            message: "authenticated mode requires BETTER_AUTH_SECRET (or PAPERCLIP_AGENT_JWT_SECRET)",
+            canRepair: false,
+            repairHint: "Set BETTER_AUTH_SECRET before starting Paperclip",
+        };
+    }
+    if (auth.baseUrlMode === "explicit" && !auth.publicBaseUrl) {
+        return {
+            name: "Deployment/auth mode",
+            status: "fail",
+            message: "auth.baseUrlMode=explicit requires auth.publicBaseUrl",
+            canRepair: false,
+            repairHint: "Run `paperclipai configure --section server` and provide a base URL",
+        };
+    }
+    if (exposure === "public") {
+        if (auth.baseUrlMode !== "explicit" || !auth.publicBaseUrl) {
+            return {
+                name: "Deployment/auth mode",
+                status: "fail",
+                message: "authenticated/public requires explicit auth.publicBaseUrl",
+                canRepair: false,
+                repairHint: "Run `paperclipai configure --section server` and select public exposure",
+            };
+        }
+        try {
+            const url = new URL(auth.publicBaseUrl);
+            if (url.protocol !== "https:") {
+                return {
+                    name: "Deployment/auth mode",
+                    status: "warn",
+                    message: "Public exposure should use an https:// auth.publicBaseUrl",
+                    canRepair: false,
+                    repairHint: "Use HTTPS in production for secure session cookies",
+                };
+            }
+        }
+        catch {
+            return {
+                name: "Deployment/auth mode",
+                status: "fail",
+                message: "auth.publicBaseUrl is not a valid URL",
+                canRepair: false,
+                repairHint: "Run `paperclipai configure --section server` and provide a valid URL",
+            };
+        }
+    }
+    return {
+        name: "Deployment/auth mode",
+        status: "pass",
+        message: `Mode ${mode}/${exposure} with auth URL mode ${auth.baseUrlMode}`,
+    };
+}
+//# sourceMappingURL=deployment-auth-check.js.map

package/dist/checks/deployment-auth-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-auth-check.js","sourceRoot":"","sources":["../../src/checks/deployment-auth-check.ts"],"names":[],"mappings":"AAGA,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAuB;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,uDAAuD,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG;gBACrF,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,wEAAwE;aACrF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2DAA2D;SACrE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gFAAgF;YACzF,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,kDAAkD;SAC/D,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3D,OAAO;YACL,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uDAAuD;YAChE,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,qEAAqE;SAClF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3D,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,2DAA2D;gBACpE,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,yEAAyE;aACtF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACxC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO;oBACL,IAAI,EAAE,sBAAsB;oBAC5B,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,2DAA2D;oBACpE,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,oDAAoD;iBACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,uCAAuC;gBAChD,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,sEAAsE;aACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,QAAQ,IAAI,IAAI,QAAQ,uBAAuB,IAAI,CAAC,WAAW,EAAE;KAC3E,CAAC;AACJ,CAAC"}

package/dist/checks/index.d.ts

@@ -0,0 +1,18 @@
+export interface CheckResult {
+    name: string;
+    status: "pass" | "warn" | "fail";
+    message: string;
+    canRepair?: boolean;
+    repair?: () => void | Promise<void>;
+    repairHint?: string;
+}
+export { agentJwtSecretCheck } from "./agent-jwt-secret-check.js";
+export { configCheck } from "./config-check.js";
+export { deploymentAuthCheck } from "./deployment-auth-check.js";
+export { databaseCheck } from "./database-check.js";
+export { llmCheck } from "./llm-check.js";
+export { logCheck } from "./log-check.js";
+export { portCheck } from "./port-check.js";
+export { secretsCheck } from "./secrets-check.js";
+export { storageCheck } from "./storage-check.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/checks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/checks/index.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}