@growthub/cli 0.6.6 → 0.6.7

package/dist/auth/overlay-store.js

@@ -1,123 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { resolveHostedOverlayPath, resolveProfilesDir } from "./paths.js";
-function parseJson(filePath) {
-    try {
-        return JSON.parse(fs.readFileSync(filePath, "utf-8"));
-    }
-    catch (err) {
-        throw new Error(`Failed to parse hosted overlay at ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-}
-function toStringOrUndefined(value) {
-    return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
-}
-function toStringArray(value) {
-    if (!Array.isArray(value))
-        return [];
-    const out = [];
-    for (const item of value) {
-        const normalized = toStringOrUndefined(item);
-        if (normalized && !out.includes(normalized))
-            out.push(normalized);
-    }
-    return out;
-}
-function toRecord(value) {
-    if (typeof value !== "object" || value === null || Array.isArray(value))
-        return undefined;
-    return value;
-}
-function normalizeExecutionDefaults(value) {
-    const record = toRecord(value) ?? {};
-    const modeRaw = toStringOrUndefined(record.preferredMode);
-    const preferredMode = modeRaw === "local" || modeRaw === "serverless" || modeRaw === "browser" || modeRaw === "auto"
-        ? modeRaw
-        : "local";
-    return {
-        preferredMode,
-        allowServerlessFallback: typeof record.allowServerlessFallback === "boolean"
-            ? record.allowServerlessFallback
-            : false,
-        allowBrowserBridge: typeof record.allowBrowserBridge === "boolean"
-            ? record.allowBrowserBridge
-            : false,
-    };
-}
-function defaultExecutionPreferences() {
-    return {
-        preferredMode: "local",
-        allowServerlessFallback: false,
-        allowBrowserBridge: false,
-    };
-}
-function normalizeOverlay(raw) {
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
-        return null;
-    const record = raw;
-    const hostedBaseUrl = toStringOrUndefined(record.hostedBaseUrl);
-    if (!hostedBaseUrl)
-        return null;
-    return {
-        version: 1,
-        hostedBaseUrl,
-        userId: toStringOrUndefined(record.userId),
-        email: toStringOrUndefined(record.email),
-        displayName: toStringOrUndefined(record.displayName),
-        orgId: toStringOrUndefined(record.orgId),
-        orgName: toStringOrUndefined(record.orgName),
-        entitlements: toStringArray(record.entitlements),
-        gatedKitSlugs: toStringArray(record.gatedKitSlugs),
-        executionDefaults: normalizeExecutionDefaults(record.executionDefaults),
-        linkedInstanceId: toStringOrUndefined(record.linkedInstanceId),
-        lastPulledAt: toStringOrUndefined(record.lastPulledAt),
-        lastPushedAt: toStringOrUndefined(record.lastPushedAt),
-        extra: toRecord(record.extra),
-    };
-}
-export function readHostedOverlay() {
-    const filePath = resolveHostedOverlayPath();
-    if (!fs.existsSync(filePath))
-        return null;
-    return normalizeOverlay(parseJson(filePath));
-}
-export function writeHostedOverlay(overlay) {
-    const filePath = resolveHostedOverlayPath();
-    fs.mkdirSync(resolveProfilesDir(), { recursive: true });
-    fs.writeFileSync(filePath, `${JSON.stringify(overlay, null, 2)}\n`, { mode: 0o600 });
-    try {
-        fs.chmodSync(filePath, 0o600);
-    }
-    catch {
-        // non-posix best-effort
-    }
-}
-export function clearHostedOverlay() {
-    const filePath = resolveHostedOverlayPath();
-    if (!fs.existsSync(filePath))
-        return false;
-    fs.rmSync(filePath, { force: true });
-    return true;
-}
-export function describeHostedOverlayPath() {
-    return path.resolve(resolveHostedOverlayPath());
-}
-export function seedHostedOverlayFromSession(input) {
-    return {
-        version: 1,
-        hostedBaseUrl: input.hostedBaseUrl,
-        userId: input.userId,
-        email: input.email,
-        displayName: input.email,
-        orgId: input.orgId,
-        orgName: input.orgName,
-        entitlements: [],
-        gatedKitSlugs: [],
-        executionDefaults: defaultExecutionPreferences(),
-        linkedInstanceId: input.linkedInstanceId,
-        lastPulledAt: undefined,
-        lastPushedAt: undefined,
-        extra: input.machineLabel ? { machineLabel: input.machineLabel } : undefined,
-    };
-}
-//# sourceMappingURL=overlay-store.js.map

package/dist/auth/overlay-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"overlay-store.js","sourceRoot":"","sources":["../../src/auth/overlay-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA0C1E,SAAS,SAAS,CAAC,QAAgB;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,aAAa,GACjB,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM;QAC5F,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,OAAO,CAAC;IACd,OAAO;QACL,aAAa;QACb,uBAAuB,EAAE,OAAO,MAAM,CAAC,uBAAuB,KAAK,SAAS;YAC1E,CAAC,CAAC,MAAM,CAAC,uBAAuB;YAChC,CAAC,CAAC,KAAK;QACT,kBAAkB,EAAE,OAAO,MAAM,CAAC,kBAAkB,KAAK,SAAS;YAChE,CAAC,CAAC,MAAM,CAAC,kBAAkB;YAC3B,CAAC,CAAC,KAAK;KACV,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,uBAAuB,EAAE,KAAK;QAC9B,kBAAkB,EAAE,KAAK;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,OAAO;QACL,OAAO,EAAE,CAAC;QACV,aAAa;QACb,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1C,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,WAAW,EAAE,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC;QACpD,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5C,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;QAChD,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC;QAClD,iBAAiB,EAAE,0BAA0B,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACvE,gBAAgB,EAAE,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC9D,YAAY,EAAE,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC;QACtD,YAAY,EAAE,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC;QACtD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC9D,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,EAAE,CAAC,SAAS,CAAC,kBAAkB,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAQ5C;IACC,OAAO;QACL,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,EAAE;QAChB,aAAa,EAAE,EAAE;QACjB,iBAAiB,EAAE,2BAA2B,EAAE;QAChD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,YAAY,EAAE,SAAS;QACvB,YAAY,EAAE,SAAS;QACvB,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;KAC7E,CAAC;AACJ,CAAC"}

package/dist/auth/paths.d.ts

@@ -1,15 +0,0 @@
-/**
- * CLI-owned auth + profile storage roots.
- *
- * These live under the Paperclip home directory (`~/.paperclip` by default) but
- * are deliberately scoped outside `instances/<id>/config.json` so hosted auth
- * overlay metadata does not leak into local workspace config files or kit
- * export folders. This preserves the "paperclip local workspace profile stays
- * the base layer, hosted overlay lives above it" design contract.
- */
-export declare function resolveAuthDir(): string;
-export declare function resolveProfilesDir(): string;
-export declare function resolveSessionPath(): string;
-export declare function resolveHostedOverlayPath(): string;
-export declare function resolveEffectiveProfilePath(): string;
-//# sourceMappingURL=paths.d.ts.map

package/dist/auth/paths.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/auth/paths.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAgB,2BAA2B,IAAI,MAAM,CAEpD"}

package/dist/auth/paths.js

@@ -1,27 +0,0 @@
-import path from "node:path";
-import { resolvePaperclipHomeDir } from "../config/home.js";
-/**
- * CLI-owned auth + profile storage roots.
- *
- * These live under the Paperclip home directory (`~/.paperclip` by default) but
- * are deliberately scoped outside `instances/<id>/config.json` so hosted auth
- * overlay metadata does not leak into local workspace config files or kit
- * export folders. This preserves the "paperclip local workspace profile stays
- * the base layer, hosted overlay lives above it" design contract.
- */
-export function resolveAuthDir() {
-    return path.resolve(resolvePaperclipHomeDir(), "auth");
-}
-export function resolveProfilesDir() {
-    return path.resolve(resolvePaperclipHomeDir(), "profiles");
-}
-export function resolveSessionPath() {
-    return path.resolve(resolveAuthDir(), "session.json");
-}
-export function resolveHostedOverlayPath() {
-    return path.resolve(resolveProfilesDir(), "hosted-overlay.json");
-}
-export function resolveEffectiveProfilePath() {
-    return path.resolve(resolveProfilesDir(), "effective-profile.json");
-}
-//# sourceMappingURL=paths.js.map

package/dist/auth/paths.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/auth/paths.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D;;;;;;;;GAQG;AAEH,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,UAAU,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,qBAAqB,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,wBAAwB,CAAC,CAAC;AACtE,CAAC"}

package/dist/auth/session-store.d.ts

@@ -1,35 +0,0 @@
-/**
- * Minimal hosted session material persisted by the CLI.
- *
- * The CLI deliberately does NOT implement Supabase/BetterAuth semantics; it
- * only stores the short-lived token exchanged by the hosted app via the
- * browser-driven login flow. Server-side session semantics remain owned by
- * `gh-app` / the hosted Growthub Next.js app.
- */
-export interface CliAuthSession {
-    version: 1;
-    /** Hosted base URL the token was issued against. */
-    hostedBaseUrl: string;
-    /** Short-lived bearer token from the hosted exchange. */
-    accessToken: string;
-    /** ISO timestamp when the token expires, if known. */
-    expiresAt?: string;
-    /** Authenticated user id (opaque string). */
-    userId?: string;
-    /** Human-readable email (optional, surfaced in whoami). */
-    email?: string;
-    /** Organization id, if hosted app scopes tokens to an org. */
-    orgId?: string;
-    /** Organization display name. */
-    orgName?: string;
-    /** Machine label the hosted app stamped the session with. */
-    machineLabel?: string;
-    /** ISO timestamp when the session was minted locally. */
-    issuedAt: string;
-}
-export declare function readSession(): CliAuthSession | null;
-export declare function writeSession(session: CliAuthSession): void;
-export declare function clearSession(): boolean;
-export declare function isSessionExpired(session: CliAuthSession, now?: Date): boolean;
-export declare function describeSessionPath(): string;
-//# sourceMappingURL=session-store.d.ts.map

package/dist/auth/session-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/auth/session-store.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAwCD,wBAAgB,WAAW,IAAI,cAAc,GAAG,IAAI,CAKnD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAS1D;AAED,wBAAgB,YAAY,IAAI,OAAO,CAKtC;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAKzF;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/dist/auth/session-store.js

@@ -1,73 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { resolveAuthDir, resolveSessionPath } from "./paths.js";
-function parseJson(filePath) {
-    try {
-        return JSON.parse(fs.readFileSync(filePath, "utf-8"));
-    }
-    catch (err) {
-        throw new Error(`Failed to parse auth session at ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-}
-function toStringOrUndefined(value) {
-    return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
-}
-function normalizeSession(raw) {
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
-        return null;
-    const record = raw;
-    const accessToken = toStringOrUndefined(record.accessToken);
-    const hostedBaseUrl = toStringOrUndefined(record.hostedBaseUrl);
-    if (!accessToken || !hostedBaseUrl)
-        return null;
-    const issuedAt = toStringOrUndefined(record.issuedAt) ?? new Date().toISOString();
-    return {
-        version: 1,
-        hostedBaseUrl,
-        accessToken,
-        expiresAt: toStringOrUndefined(record.expiresAt),
-        userId: toStringOrUndefined(record.userId),
-        email: toStringOrUndefined(record.email),
-        orgId: toStringOrUndefined(record.orgId),
-        orgName: toStringOrUndefined(record.orgName),
-        machineLabel: toStringOrUndefined(record.machineLabel),
-        issuedAt,
-    };
-}
-export function readSession() {
-    const filePath = resolveSessionPath();
-    if (!fs.existsSync(filePath))
-        return null;
-    const raw = parseJson(filePath);
-    return normalizeSession(raw);
-}
-export function writeSession(session) {
-    const filePath = resolveSessionPath();
-    fs.mkdirSync(resolveAuthDir(), { recursive: true });
-    fs.writeFileSync(filePath, `${JSON.stringify(session, null, 2)}\n`, { mode: 0o600 });
-    try {
-        fs.chmodSync(filePath, 0o600);
-    }
-    catch {
-        // non-posix filesystems — best-effort
-    }
-}
-export function clearSession() {
-    const filePath = resolveSessionPath();
-    if (!fs.existsSync(filePath))
-        return false;
-    fs.rmSync(filePath, { force: true });
-    return true;
-}
-export function isSessionExpired(session, now = new Date()) {
-    if (!session.expiresAt)
-        return false;
-    const expires = Date.parse(session.expiresAt);
-    if (Number.isNaN(expires))
-        return false;
-    return expires <= now.getTime();
-}
-export function describeSessionPath() {
-    return path.resolve(resolveSessionPath());
-}
-//# sourceMappingURL=session-store.js.map

package/dist/auth/session-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-store.js","sourceRoot":"","sources":["../../src/auth/session-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAgChE,SAAS,SAAS,CAAC,QAAgB;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mCAAmC,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,MAAM,GAAG,GAA8B,CAAC;IAE9C,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAElF,OAAO;QACL,OAAO,EAAE,CAAC;QACV,aAAa;QACb,WAAW;QACX,SAAS,EAAE,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC;QAChD,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1C,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5C,YAAY,EAAE,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC;QACtD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAuB,EAAE,MAAY,IAAI,IAAI,EAAE;IAC9E,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/auth/workflow-access.d.ts

@@ -1,7 +0,0 @@
-export type WorkflowAccessState = "unauthenticated" | "unlinked" | "ready";
-export interface WorkflowAccess {
-    state: WorkflowAccessState;
-    reason: string;
-}
-export declare function getWorkflowAccess(): WorkflowAccess;
-//# sourceMappingURL=workflow-access.d.ts.map

package/dist/auth/workflow-access.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow-access.d.ts","sourceRoot":"","sources":["../../src/auth/workflow-access.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,GAAG,UAAU,GAAG,OAAO,CAAC;AAE3E,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iBAAiB,IAAI,cAAc,CA4BlD"}

package/dist/auth/workflow-access.js

@@ -1,27 +0,0 @@
-import { computeEffectiveProfile } from "./effective-profile.js";
-export function getWorkflowAccess() {
-    const profile = computeEffectiveProfile();
-    if (!profile.authenticated) {
-        return {
-            state: "unauthenticated",
-            reason: "Requires growthub auth login",
-        };
-    }
-    if (!profile.hosted.present || !profile.hosted.linkedInstanceId) {
-        return {
-            state: "unlinked",
-            reason: "Requires Growthub Local Machine connection",
-        };
-    }
-    if (profile.hosted.linkedInstanceId !== profile.local.instanceId) {
-        return {
-            state: "unlinked",
-            reason: `Linked to ${profile.hosted.linkedInstanceId}, not this workspace`,
-        };
-    }
-    return {
-        state: "ready",
-        reason: "Workflow tools unlocked",
-    };
-}
-//# sourceMappingURL=workflow-access.js.map

package/dist/auth/workflow-access.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow-access.js","sourceRoot":"","sources":["../../src/auth/workflow-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AASjE,MAAM,UAAU,iBAAiB;IAC/B,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAE1C,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,iBAAiB;YACxB,MAAM,EAAE,8BAA8B;SACvC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAChE,OAAO;YACL,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,4CAA4C;SACrD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,CAAC,gBAAgB,KAAK,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACjE,OAAO;YACL,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,aAAa,OAAO,CAAC,MAAM,CAAC,gBAAgB,sBAAsB;SAC3E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,yBAAyB;KAClC,CAAC;AACJ,CAAC"}

package/dist/checks/agent-jwt-secret-check.d.ts

@@ -1,3 +0,0 @@
-import type { CheckResult } from "./index.js";
-export declare function agentJwtSecretCheck(configPath?: string): CheckResult;
-//# sourceMappingURL=agent-jwt-secret-check.d.ts.map

package/dist/checks/agent-jwt-secret-check.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-jwt-secret-check.d.ts","sourceRoot":"","sources":["../../src/checks/agent-jwt-secret-check.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,wBAAgB,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CA+BpE"}

package/dist/checks/agent-jwt-secret-check.js

@@ -1,31 +0,0 @@
-import { ensureAgentJwtSecret, readAgentJwtSecretFromEnv, readAgentJwtSecretFromEnvFile, resolveAgentJwtEnvFile, } from "../config/env.js";
-export function agentJwtSecretCheck(configPath) {
-    if (readAgentJwtSecretFromEnv(configPath)) {
-        return {
-            name: "Agent JWT secret",
-            status: "pass",
-            message: "PAPERCLIP_AGENT_JWT_SECRET is set in environment",
-        };
-    }
-    const envPath = resolveAgentJwtEnvFile(configPath);
-    const fileSecret = readAgentJwtSecretFromEnvFile(envPath);
-    if (fileSecret) {
-        return {
-            name: "Agent JWT secret",
-            status: "warn",
-            message: `PAPERCLIP_AGENT_JWT_SECRET is present in ${envPath} but not loaded into environment`,
-            repairHint: `Set the value from ${envPath} in your shell before starting the Growthub server`,
-        };
-    }
-    return {
-        name: "Agent JWT secret",
-        status: "fail",
-        message: `PAPERCLIP_AGENT_JWT_SECRET missing from environment and ${envPath}`,
-        canRepair: true,
-        repair: () => {
-            ensureAgentJwtSecret(configPath);
-        },
-        repairHint: `Run with --repair to create ${envPath} containing PAPERCLIP_AGENT_JWT_SECRET`,
-    };
-}
-//# sourceMappingURL=agent-jwt-secret-check.js.map

package/dist/checks/agent-jwt-secret-check.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-jwt-secret-check.js","sourceRoot":"","sources":["../../src/checks/agent-jwt-secret-check.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAG1B,MAAM,UAAU,mBAAmB,CAAC,UAAmB;IACrD,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kDAAkD;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAE1D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,4CAA4C,OAAO,kCAAkC;YAC9F,UAAU,EAAE,sBAAsB,OAAO,oDAAoD;SAC9F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,2DAA2D,OAAO,EAAE;QAC7E,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,GAAG,EAAE;YACX,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACnC,CAAC;QACD,UAAU,EAAE,+BAA+B,OAAO,wCAAwC;KAC3F,CAAC;AACJ,CAAC"}

package/dist/checks/config-check.d.ts

@@ -1,3 +0,0 @@
-import type { CheckResult } from "./index.js";
-export declare function configCheck(configPath?: string): CheckResult;
-//# sourceMappingURL=config-check.d.ts.map

package/dist/checks/config-check.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"config-check.d.ts","sourceRoot":"","sources":["../../src/checks/config-check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,wBAAgB,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CA6B5D"}

package/dist/checks/config-check.js

@@ -1,31 +0,0 @@
-import { readConfig, configExists, resolveConfigPath } from "../config/store.js";
-export function configCheck(configPath) {
-    const filePath = resolveConfigPath(configPath);
-    if (!configExists(configPath)) {
-        return {
-            name: "Config file",
-            status: "fail",
-            message: `Config file not found at ${filePath}`,
-            canRepair: false,
-            repairHint: "Run `paperclipai onboard` to create one",
-        };
-    }
-    try {
-        readConfig(configPath);
-        return {
-            name: "Config file",
-            status: "pass",
-            message: `Valid config at ${filePath}`,
-        };
-    }
-    catch (err) {
-        return {
-            name: "Config file",
-            status: "fail",
-            message: `Invalid config: ${err instanceof Error ? err.message : String(err)}`,
-            canRepair: false,
-            repairHint: "Run `paperclipai configure --section database` (or `paperclipai onboard` to recreate)",
-        };
-    }
-}
-//# sourceMappingURL=config-check.js.map

package/dist/checks/config-check.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config-check.js","sourceRoot":"","sources":["../../src/checks/config-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGjF,MAAM,UAAU,WAAW,CAAC,UAAmB;IAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE/C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,4BAA4B,QAAQ,EAAE;YAC/C,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,yCAAyC;SACtD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,UAAU,CAAC,UAAU,CAAC,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mBAAmB,QAAQ,EAAE;SACvC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAC9E,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,uFAAuF;SACpG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/checks/database-check.d.ts

@@ -1,4 +0,0 @@
-import type { PaperclipConfig } from "../config/schema.js";
-import type { CheckResult } from "./index.js";
-export declare function databaseCheck(config: PaperclipConfig, configPath?: string): Promise<CheckResult>;
-//# sourceMappingURL=database-check.d.ts.map

package/dist/checks/database-check.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"database-check.d.ts","sourceRoot":"","sources":["../../src/checks/database-check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,wBAAsB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAqDtG"}

package/dist/checks/database-check.js

@@ -1,54 +0,0 @@
-import fs from "node:fs";
-import { resolveRuntimeLikePath } from "./path-resolver.js";
-export async function databaseCheck(config, configPath) {
-    if (config.database.mode === "postgres") {
-        if (!config.database.connectionString) {
-            return {
-                name: "Database",
-                status: "fail",
-                message: "PostgreSQL mode selected but no connection string configured",
-                canRepair: false,
-                repairHint: "Run `paperclipai configure --section database`",
-            };
-        }
-        try {
-            const { createDb } = await import("@paperclipai/db");
-            const db = createDb(config.database.connectionString);
-            await db.execute("SELECT 1");
-            return {
-                name: "Database",
-                status: "pass",
-                message: "PostgreSQL connection successful",
-            };
-        }
-        catch (err) {
-            return {
-                name: "Database",
-                status: "fail",
-                message: `Cannot connect to PostgreSQL: ${err instanceof Error ? err.message : String(err)}`,
-                canRepair: false,
-                repairHint: "Check your connection string and ensure PostgreSQL is running",
-            };
-        }
-    }
-    if (config.database.mode === "embedded-postgres") {
-        const dataDir = resolveRuntimeLikePath(config.database.embeddedPostgresDataDir, configPath);
-        const reportedPath = dataDir;
-        if (!fs.existsSync(dataDir)) {
-            fs.mkdirSync(reportedPath, { recursive: true });
-        }
-        return {
-            name: "Database",
-            status: "pass",
-            message: `Embedded PostgreSQL configured at ${dataDir} (port ${config.database.embeddedPostgresPort})`,
-        };
-    }
-    return {
-        name: "Database",
-        status: "fail",
-        message: `Unknown database mode: ${String(config.database.mode)}`,
-        canRepair: false,
-        repairHint: "Run `paperclipai configure --section database`",
-    };
-}
-//# sourceMappingURL=database-check.js.map

package/dist/checks/database-check.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"database-check.js","sourceRoot":"","sources":["../../src/checks/database-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAGzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAuB,EAAE,UAAmB;IAC9E,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACtC,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,8DAA8D;gBACvE,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,gDAAgD;aAC7D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACrD,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YACtD,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,kCAAkC;aAC5C,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBAC5F,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,+DAA+D;aAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,UAAU,CAAC,CAAC;QAC5F,MAAM,YAAY,GAAG,OAAO,CAAC;QAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,qCAAqC,OAAO,UAAU,MAAM,CAAC,QAAQ,CAAC,oBAAoB,GAAG;SACvG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,0BAA0B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACjE,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,gDAAgD;KAC7D,CAAC;AACJ,CAAC"}

package/dist/checks/deployment-auth-check.d.ts

@@ -1,4 +0,0 @@
-import type { PaperclipConfig } from "../config/schema.js";
-import type { CheckResult } from "./index.js";
-export declare function deploymentAuthCheck(config: PaperclipConfig): CheckResult;
-//# sourceMappingURL=deployment-auth-check.d.ts.map

package/dist/checks/deployment-auth-check.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deployment-auth-check.d.ts","sourceRoot":"","sources":["../../src/checks/deployment-auth-check.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAO9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,CAkFxE"}

package/dist/checks/deployment-auth-check.js

@@ -1,83 +0,0 @@
-function isLoopbackHost(host) {
-    const normalized = host.trim().toLowerCase();
-    return normalized === "127.0.0.1" || normalized === "localhost" || normalized === "::1";
-}
-export function deploymentAuthCheck(config) {
-    const mode = config.server.deploymentMode;
-    const exposure = config.server.exposure;
-    const auth = config.auth;
-    if (mode === "local_trusted") {
-        if (!isLoopbackHost(config.server.host)) {
-            return {
-                name: "Deployment/auth mode",
-                status: "fail",
-                message: `local_trusted requires loopback host binding (found ${config.server.host})`,
-                canRepair: false,
-                repairHint: "Run `paperclipai configure --section server` and set host to 127.0.0.1",
-            };
-        }
-        return {
-            name: "Deployment/auth mode",
-            status: "pass",
-            message: "local_trusted mode is configured for loopback-only access",
-        };
-    }
-    const secret = process.env.BETTER_AUTH_SECRET?.trim() ??
-        process.env.PAPERCLIP_AGENT_JWT_SECRET?.trim();
-    if (!secret) {
-        return {
-            name: "Deployment/auth mode",
-            status: "fail",
-            message: "authenticated mode requires BETTER_AUTH_SECRET (or PAPERCLIP_AGENT_JWT_SECRET)",
-            canRepair: false,
-            repairHint: "Set BETTER_AUTH_SECRET before starting Paperclip",
-        };
-    }
-    if (auth.baseUrlMode === "explicit" && !auth.publicBaseUrl) {
-        return {
-            name: "Deployment/auth mode",
-            status: "fail",
-            message: "auth.baseUrlMode=explicit requires auth.publicBaseUrl",
-            canRepair: false,
-            repairHint: "Run `paperclipai configure --section server` and provide a base URL",
-        };
-    }
-    if (exposure === "public") {
-        if (auth.baseUrlMode !== "explicit" || !auth.publicBaseUrl) {
-            return {
-                name: "Deployment/auth mode",
-                status: "fail",
-                message: "authenticated/public requires explicit auth.publicBaseUrl",
-                canRepair: false,
-                repairHint: "Run `paperclipai configure --section server` and select public exposure",
-            };
-        }
-        try {
-            const url = new URL(auth.publicBaseUrl);
-            if (url.protocol !== "https:") {
-                return {
-                    name: "Deployment/auth mode",
-                    status: "warn",
-                    message: "Public exposure should use an https:// auth.publicBaseUrl",
-                    canRepair: false,
-                    repairHint: "Use HTTPS in production for secure session cookies",
-                };
-            }
-        }
-        catch {
-            return {
-                name: "Deployment/auth mode",
-                status: "fail",
-                message: "auth.publicBaseUrl is not a valid URL",
-                canRepair: false,
-                repairHint: "Run `paperclipai configure --section server` and provide a valid URL",
-            };
-        }
-    }
-    return {
-        name: "Deployment/auth mode",
-        status: "pass",
-        message: `Mode ${mode}/${exposure} with auth URL mode ${auth.baseUrlMode}`,
-    };
-}
-//# sourceMappingURL=deployment-auth-check.js.map

package/dist/checks/deployment-auth-check.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"deployment-auth-check.js","sourceRoot":"","sources":["../../src/checks/deployment-auth-check.ts"],"names":[],"mappings":"AAGA,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAuB;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,uDAAuD,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG;gBACrF,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,wEAAwE;aACrF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2DAA2D;SACrE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gFAAgF;YACzF,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,kDAAkD;SAC/D,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3D,OAAO;YACL,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uDAAuD;YAChE,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,qEAAqE;SAClF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3D,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,2DAA2D;gBACpE,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,yEAAyE;aACtF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACxC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO;oBACL,IAAI,EAAE,sBAAsB;oBAC5B,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,2DAA2D;oBACpE,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,oDAAoD;iBACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,uCAAuC;gBAChD,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,sEAAsE;aACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,QAAQ,IAAI,IAAI,QAAQ,uBAAuB,IAAI,CAAC,WAAW,EAAE;KAC3E,CAAC;AACJ,CAAC"}

package/dist/checks/index.d.ts

@@ -1,18 +0,0 @@
-export interface CheckResult {
-    name: string;
-    status: "pass" | "warn" | "fail";
-    message: string;
-    canRepair?: boolean;
-    repair?: () => void | Promise<void>;
-    repairHint?: string;
-}
-export { agentJwtSecretCheck } from "./agent-jwt-secret-check.js";
-export { configCheck } from "./config-check.js";
-export { deploymentAuthCheck } from "./deployment-auth-check.js";
-export { databaseCheck } from "./database-check.js";
-export { llmCheck } from "./llm-check.js";
-export { logCheck } from "./log-check.js";
-export { portCheck } from "./port-check.js";
-export { secretsCheck } from "./secrets-check.js";
-export { storageCheck } from "./storage-check.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/checks/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/checks/index.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}