@levr-one/auth 1.0.3 → 1.1.1

package/dist/workspace-store.js

@@ -1,20 +1,216 @@
 /**
- * Disk-backed workspace state at ~/.tq/workspace.json
- * Follows the same atomic-write pattern as token-store.ts
+ * Disk-backed workspace/identity state at ~/.tq/workspace.json
+ *
+ * Stored as a map keyed by backend URL — the SAME key space as
+ * ~/.tq/oauth-tokens.json (see token-store.ts):
+ * {
+ *   "https://api.levr.now":  { workspace_id, user_id, user_email, ... },
+ *   "http://localhost:8180": { ... }
+ * }
+ *
+ * internal: this file used to hold a SINGLE global record with no note of
+ * which backend it came from. A login or `select_workspace` against a local
+ * backend (including a worktree's own backend on its assigned port)
+ * overwrote it machine-globally, and the next `yarn setup:mcp` stamped that
+ * local workspace id into the `Workspace-Id` header of a STAGING levr URL.
+ * Keying by backend URL makes that structurally impossible: a local id lives
+ * under a different key than the staging one, so it cannot be read back for
+ * a staging endpoint.
+ *
+ * Backward-compatible: a legacy flat file (`{ workspace_id, ... }` at the top
+ * level) is attributed to the currently-configured backend and migrated
+ * in-place on first read — the same treatment `readTokenMap()` gives legacy
+ * token files. Attribution is a best guess by construction; that is
+ * acceptable because this file is a hint-only cache (see `IdentityCache`) and
+ * a wrong guess costs one workspace re-selection, not a security decision.
+ *
+ * Follows the same atomic-write pattern as token-store.ts.
  */
 import * as fs from 'fs';
 import * as path from 'path';
-import { getTqDir } from './token-store.js';
+import { getTqDir, normalizeBackendUrl } from './token-store.js';
+import { loadConfig } from './config.js';
 const WORKSPACE_FILE = 'workspace.json';
 function getWorkspacePath() {
     return path.join(getTqDir(), WORKSPACE_FILE);
 }
+/** The only fields an identity record — or the mirror — may carry. */
+const IDENTITY_FIELDS = [
+    'workspace_id',
+    'user_id',
+    'user_email',
+    'user_name',
+    'role',
+];
+function isIdentityKey(key) {
+    return /^https?:\/\//i.test(key);
+}
 /**
- * Atomically write `payload` as JSON to `~/.tq/workspace.json`.
+ * Strip trailing slashes and reject anything that is not an http(s) origin.
+ *
+ * This is the SINGLE gate both sides use: `resolveKey` will not write under a
+ * key that `readIdentityMap` would later discard. Without that agreement a
+ * scheme-less `apiBaseUrl` (`localhost:8080`) wrote an entry to disk that
+ * every subsequent read dropped — a silent, permanent loss of the pin with no
+ * error anywhere.
+ */
+function normalizeKey(url) {
+    // Canonical form comes from token-store, so the two files cannot disagree
+    // about what key a given backend has (internal). The http(s) gate on top is
+    // this store's own: it will not write a key that readIdentityMap discards.
+    const trimmed = normalizeBackendUrl(url);
+    if (!trimmed || !isIdentityKey(trimmed))
+        return undefined;
+    return trimmed;
+}
+/**
+ * The backend the UNKEYED callers actually talk to.
+ *
+ * This MUST be `loadConfig()`, not `getCurrentApiUrl()`. The two disagree:
+ * `getCurrentApiUrl()` has two tiers (`TQ_BACKEND_URL` > `~/.tq/config.json`)
+ * while `loadConfig()` has four, and its third is the STORED TOKEN's
+ * `apiBaseUrl`. With no `config.json` but a token for a local backend, the
+ * two-tier version returns undefined and the old fallback guessed `staging` —
+ * filing a LOCAL workspace id under the STAGING key, which `setup-mcp` then
+ * stamped into the staging `Workspace-Id` header. That is internal reappearing
+ * through its own fix.
+ *
+ * Using the same resolver the callers use makes the key correct by
+ * construction: whatever backend they are about to talk to is the backend the
+ * record is filed under, including when that resolution itself ends at the
+ * staging default.
+ */
+function configuredBackend() {
+    return normalizeKey(loadConfig().apiUrl) ?? 'https://api.levr.now';
+}
+/**
+ * Resolve which backend URL an identity read/write belongs to.
+ *
+ * An explicit argument (the caller knows its backend) wins; otherwise the
+ * configured backend. Callers that know their backend SHOULD pass it.
+ * `setup-mcp.ts` in particular must pass the URL it is about to write into
+ * `.mcp.json`, which is not necessarily the configured one — the levr MCP
+ * host differs from the API host (`https://ai.levr.now/api/v1/mcp` is served
+ * by the backend at `https://api.levr.now`), and stdio MCP servers resolve
+ * their own backend independently of whatever the levr HTTP entry points at.
+ *
+ * An explicit-but-malformed key is ignored rather than written, with a log —
+ * silently retargeting it at another backend would be the very leak this
+ * module exists to prevent.
+ */
+function resolveKey(apiBaseUrl) {
+    if (apiBaseUrl !== undefined) {
+        const explicit = normalizeKey(apiBaseUrl);
+        if (explicit)
+            return explicit;
+        console.error(`[levr-auth] Ignoring malformed backend url "${apiBaseUrl}" — ` +
+            'expected an http(s) origin. Falling back to the configured backend.');
+    }
+    return configuredBackend();
+}
+/**
+ * Read the raw identity map from disk.
+ * Handles migration from the legacy single-record format.
+ */
+function readIdentityMap() {
+    try {
+        const filePath = getWorkspacePath();
+        if (!fs.existsSync(filePath))
+            return {};
+        const content = fs.readFileSync(filePath, 'utf-8');
+        const parsed = JSON.parse(content);
+        // `typeof [] === 'object'` — explicitly reject arrays so property access
+        // on a parsed JSON array (`[0]`, `[1]`...) cannot accidentally satisfy
+        // the per-field checks in loadIdentityCache().
+        if (parsed === null ||
+            typeof parsed !== 'object' ||
+            Array.isArray(parsed)) {
+            return {};
+        }
+        // Keep only URL-shaped keys. This also strips the back-compat mirror
+        // fields (see writeIdentityMap) so they can never be mistaken for a
+        // backend entry.
+        const map = {};
+        for (const [key, value] of Object.entries(parsed)) {
+            if (!isIdentityKey(key))
+                continue;
+            if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+                continue;
+            }
+            // Normalize on read, mirroring readTokenMap: a `.../` entry and a `...`
+            // entry are the same backend, and only the canonical form is ever
+            // looked up, so an un-normalized key would be permanently unreachable.
+            map[normalizeKey(key) ?? key] = value;
+        }
+        // Legacy flat shape — `{ workspace_id, ... }` and NOT ONE url key. The
+        // test is the ABSENCE of url keys, never the presence of `workspace_id`:
+        // a current file carries BOTH (the mirror), and treating that as legacy
+        // would collapse every backend's entry into one on the next read.
+        if (Object.keys(map).length === 0 && 'workspace_id' in parsed) {
+            const key = configuredBackend();
+            const migrated = { [key]: parsed };
+            writeIdentityMap(migrated);
+            return migrated;
+        }
+        return map;
+    }
+    catch (error) {
+        console.error('[levr-auth] Failed to load workspace:', error);
+        return {};
+    }
+}
+/**
+ * Atomically write the identity map to `~/.tq/workspace.json`.
  * Ensures the ~/.tq directory exists with 0o700, writes to `*.tmp` with
  * 0o600, then renames over the target. Errors are logged, never thrown.
+ *
+ * ## TRANSITIONAL: the top-level mirror
+ *
+ * Alongside the url-keyed entries we also write the CONFIGURED backend's
+ * record at the top level, in the pre-internal flat shape:
+ *
+ * {
+ *   "https://api.levr.now":  { workspace_id: "A", ... },
+ *   "http://localhost:8180": { workspace_id: "B", ... },
+ *   "workspace_id": "A", "user_id": ..., ...   <-- mirror of the configured one
+ * }
+ *
+ * ~/.tq is machine-global but every checkout runs its OWN
+ * `plugins/<name>/dist/index.js` (the `.mcp.json` entries use relative
+ * paths, so each worktree loads its own build), and
+ * a worktree on a feature branch does not get this code until that branch
+ * merges main — days or weeks. Without the mirror, an old stdio server in
+ * such a worktree reads `.workspace_id`, gets undefined, falls through to
+ * `ensureWorkspace()`, and its old `saveWorkspace()` REWRITES THE WHOLE FILE
+ * FLAT — wiping every other backend's entry. Main then re-migrates it, and
+ * the two ping-pong for as long as any stale checkout is in use.
+ *
+ * The mirror keeps those old readers resolving, so they never reach the
+ * read-fallthrough that ends in a flattening write.
+ *
+ * It does NOT stop an old WRITER, and that is not only the deliberate case
+ * (`tq:workspace` in a stale checkout). Observed live: `yarn tq:login`
+ * rewrites oauth-tokens.json, the running qinetic-mcp server's token watcher
+ * fires, and `qinetic-mcp/src/auth.ts` calls `saveIdentityCache()`
+ * unconditionally after re-auth — flattening the file two seconds after the
+ * login wrote it, with no user action at all.
+ *
+ * Note what decides that: a long-lived process holds whatever `@levr-one/auth`
+ * it imported AT STARTUP, so a freshly rebuilt `dist/` on disk changes
+ * nothing until the server is restarted (`/mcp` reconnect). Checkout
+ * freshness is necessary but not sufficient.
+ *
+ * This is survivable rather than fixed: the flat file still carries the
+ * correct id for the configured backend, and the next read by new code
+ * re-migrates it. What is lost each time is OTHER backends' entries — local
+ * worktree pins, which re-derive on their own since those backends
+ * auto-select their single seeded workspace. Nothing new code writes can
+ * prevent an old writer from overwriting the file.
+ *
+ * REMOVE once every checkout has rebuilt against this version — the mirror is
+ * only meaningful for one backend and is pure carrying cost after that.
  */
-function writeWorkspaceJsonAtomic(payload) {
+function writeIdentityMap(map) {
     try {
         const tqDir = getTqDir();
         if (!fs.existsSync(tqDir)) {
@@ -22,6 +218,19 @@ function writeWorkspaceJsonAtomic(payload) {
         }
         const filePath = getWorkspacePath();
         const tempPath = filePath + '.tmp';
+        // Mirror ONLY the five IdentityCache fields. Spreading the entry wholesale
+        // promoted any url-shaped field INSIDE it to a top-level entry, where the
+        // next read would serve it as that backend's record — a hand-edited or
+        // corrupted file could put an arbitrary workspace id under an arbitrary
+        // backend.
+        const mirrored = map[configuredBackend()];
+        const payload = { ...map };
+        if (mirrored) {
+            for (const field of IDENTITY_FIELDS) {
+                if (typeof mirrored[field] === 'string')
+                    payload[field] = mirrored[field];
+            }
+        }
         fs.writeFileSync(tempPath, JSON.stringify(payload, null, 2), {
             mode: 0o600,
         });
@@ -32,112 +241,127 @@ function writeWorkspaceJsonAtomic(payload) {
     }
 }
 /**
- * Load persisted workspace ID from disk
- * @returns workspace_id or null if missing/corrupt
+ * Load the persisted workspace ID for a backend.
+ *
+ * @param apiBaseUrl Backend the id must belong to. Defaults to the currently
+ *   configured backend — correct for stdio MCP servers and the CLI, which
+ *   talk to whatever `~/.tq/config.json` points at.
+ * @returns workspace_id, or null when this backend has no entry
  */
-export function loadWorkspace() {
-    try {
-        const filePath = getWorkspacePath();
-        if (fs.existsSync(filePath)) {
-            const content = fs.readFileSync(filePath, 'utf-8');
-            const data = JSON.parse(content);
-            if (data.workspace_id && typeof data.workspace_id === 'string') {
-                return data.workspace_id;
-            }
-        }
-    }
-    catch (error) {
-        console.error('[levr-auth] Failed to load workspace:', error);
-    }
-    return null;
+export function loadWorkspace(apiBaseUrl) {
+    const entry = readIdentityMap()[resolveKey(apiBaseUrl)];
+    const id = entry?.workspace_id;
+    return typeof id === 'string' && id ? id : null;
 }
 /**
- * Save workspace ID to disk with atomic write
+ * Save a workspace ID against a backend, leaving every other backend's entry
+ * intact. Preserves any identity fields already cached for that backend.
  */
-export function saveWorkspace(workspaceId) {
-    writeWorkspaceJsonAtomic({ workspace_id: workspaceId });
+export function saveWorkspace(workspaceId, apiBaseUrl) {
+    const map = readIdentityMap();
+    const key = resolveKey(apiBaseUrl);
+    map[key] = { ...map[key], workspace_id: workspaceId };
+    writeIdentityMap(map);
 }
 /**
- * Load the full identity cache from disk.
+ * Load the full identity cache for a backend.
  *
- * Reads ~/.tq/workspace.json and returns a typed `IdentityCache` only when
- * all five required fields are present and are strings. Returns `null` for:
- *  - missing file
- *  - malformed JSON
- *  - legacy single-field shape (`{ workspace_id }` only)
- *  - any field present but not a string
+ * Returns a typed `IdentityCache` only when all five fields are present and
+ * are strings. Returns `null` for a missing file, malformed JSON, a backend
+ * with no entry, a workspace-id-only entry, or any field that is not a
+ * string.
  *
  * Never throws — graceful degradation is mandatory because callers wire this
  * into startup paths and watcher callbacks.
  */
-export function loadIdentityCache() {
-    try {
-        const filePath = getWorkspacePath();
-        if (!fs.existsSync(filePath))
-            return null;
-        const content = fs.readFileSync(filePath, 'utf-8');
-        const data = JSON.parse(content);
-        // `typeof [] === 'object'` — explicitly reject arrays so property
-        // access on a parsed JSON array (`[0]`, `[1]`...) cannot accidentally
-        // satisfy the per-field checks below.
-        if (data === null || typeof data !== 'object' || Array.isArray(data)) {
-            return null;
-        }
-        const keys = [
-            'workspace_id',
-            'user_id',
-            'user_email',
-            'user_name',
-            'role',
-        ];
-        for (const key of keys) {
-            const value = data[key];
-            if (typeof value !== 'string')
-                return null;
-        }
-        return {
-            workspace_id: data.workspace_id,
-            user_id: data.user_id,
-            user_email: data.user_email,
-            user_name: data.user_name,
-            role: data.role,
-        };
-    }
-    catch {
+export function loadIdentityCache(apiBaseUrl) {
+    const entry = readIdentityMap()[resolveKey(apiBaseUrl)];
+    if (!entry)
         return null;
+    const keys = [
+        'workspace_id',
+        'user_id',
+        'user_email',
+        'user_name',
+        'role',
+    ];
+    for (const key of keys) {
+        if (typeof entry[key] !== 'string')
+            return null;
     }
+    return {
+        workspace_id: entry.workspace_id,
+        user_id: entry.user_id,
+        user_email: entry.user_email,
+        user_name: entry.user_name,
+        role: entry.role,
+    };
 }
 /**
- * Save the full identity cache to disk with atomic write.
- *
- * Single writer pattern: `saveWorkspace` writes only `{ workspace_id }`;
- * `saveIdentityCache` is the only path that writes the five-field shape.
- * After the first identity-aware save, the file always contains all five
- * fields. Same `.tmp` + `renameSync` pattern as `saveWorkspace`.
+ * Save the full identity cache for a backend with an atomic write, leaving
+ * every other backend's entry intact.
  */
-export function saveIdentityCache(data) {
-    writeWorkspaceJsonAtomic({
+export function saveIdentityCache(data, apiBaseUrl) {
+    const map = readIdentityMap();
+    map[resolveKey(apiBaseUrl)] = {
         workspace_id: data.workspace_id,
         user_id: data.user_id,
         user_email: data.user_email,
         user_name: data.user_name,
         role: data.role,
-    });
+    };
+    writeIdentityMap(map);
 }
 /**
- * Clear persisted workspace (e.g. on env switch or login)
+ * Clear the persisted identity for ONE backend (e.g. on logout).
+ *
+ * Mirrors `clearTokens()`: only the current backend's entry is removed, and
+ * the file is deleted outright once the last entry is gone. An env switch
+ * must NOT call this — under URL keying, switching environments already
+ * selects a different entry, and clearing would throw away a still-valid
+ * workspace pin the user would have to re-select.
  */
-export function clearWorkspace() {
+export function clearWorkspace(apiBaseUrl) {
     try {
         const filePath = getWorkspacePath();
-        if (fs.existsSync(filePath)) {
+        if (!fs.existsSync(filePath))
+            return;
+        const map = readIdentityMap();
+        const key = resolveKey(apiBaseUrl);
+        if (!(key in map))
+            return;
+        delete map[key];
+        if (Object.keys(map).length === 0) {
             fs.unlinkSync(filePath);
         }
+        else {
+            writeIdentityMap(map);
+        }
     }
     catch (error) {
         console.error('[levr-auth] Failed to clear workspace:', error);
     }
 }
+/**
+ * Re-point the transitional top-level mirror at the CURRENTLY configured
+ * backend, without touching any keyed entry. Call this after changing which
+ * backend is configured (`tq:env`).
+ *
+ * The mirror is only recomputed on write, and an env switch writes nothing —
+ * so without this the mirror keeps pointing at the PREVIOUS backend and an
+ * old (pre-internal) client reads a pin for a backend it is no longer talking
+ * to. That is strictly worse than what it replaced: before the file was
+ * keyed, `tq:env` deleted the whole file, so an old client got nothing and
+ * fell back to unpinned. Failing to unpinned is safe; failing to another
+ * backend's workspace is not.
+ *
+ * No-op when the file does not exist. Remove alongside the mirror itself.
+ */
+export function refreshMirror() {
+    if (!fs.existsSync(getWorkspacePath()))
+        return;
+    writeIdentityMap(readIdentityMap());
+}
 /**
  * Get workspace file path (for debugging)
  */

package/dist/workspace-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-store.js","sourceRoot":"","sources":["../src/workspace-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;QAEnC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YAC3D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QAEH,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAkBD;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA8B,CAAC;YAC9D,IAAI,IAAI,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,wBAAwB,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAC5D,kEAAkE;QAClE,sEAAsE;QACtE,sCAAsC;QACtC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAA+B;YACvC,cAAc;YACd,SAAS;YACT,YAAY;YACZ,WAAW;YACX,MAAM;SACP,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAsB;YACzC,OAAO,EAAE,IAAI,CAAC,OAAiB;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAoB;YACrC,SAAS,EAAE,IAAI,CAAC,SAAmB;YACnC,IAAI,EAAE,IAAI,CAAC,IAAc;SAC1B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,wBAAwB,CAAC;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"workspace-store.js","sourceRoot":"","sources":["../src/workspace-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC;AAoBD,sEAAsE;AACtE,MAAM,eAAe,GAA+B;IAClD,cAAc;IACd,SAAS;IACT,YAAY;IACZ,WAAW;IACX,MAAM;CACP,CAAC;AAEF,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,GAAuB;IAC3C,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,iBAAiB;IACxB,OAAO,YAAY,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,UAAU,CAAC,UAAmB;IACrC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,OAAO,CAAC,KAAK,CACX,+CAA+C,UAAU,MAAM;YAC7D,qEAAqE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAE9D,yEAAyE;QACzE,uEAAuE;QACvE,+CAA+C;QAC/C,IACE,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACrB,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,iBAAiB;QACjB,MAAM,GAAG,GAAgB,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxE,SAAS;YACX,CAAC;YACD,wEAAwE;YACxE,kEAAkE;YAClE,uEAAuE;YACvE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,KAA+B,CAAC;QAClE,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,kEAAkE;QAClE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,IAAI,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAgB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAgC,EAAE,CAAC;YAC1E,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;QAC9D,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,SAAS,gBAAgB,CAAC,GAAgB;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;QAEnC,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,WAAW;QACX,MAAM,QAAQ,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC1C,MAAM,OAAO,GAA4B,EAAE,GAAG,GAAG,EAAE,CAAC;QACpD,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;gBACpC,IAAI,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,QAAQ;oBACrC,OAAO,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YAC3D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,UAAmB;IAC/C,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,KAAK,EAAE,YAAY,CAAC;IAC/B,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,UAAmB;IACpE,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;IACtD,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAmB;IACnD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,IAAI,GAA+B;QACvC,cAAc;QACd,SAAS;QACT,YAAY;QACZ,WAAW;QACX,MAAM;KACP,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IAClD,CAAC;IAED,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,YAAsB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAiB;QAChC,UAAU,EAAE,KAAK,CAAC,UAAoB;QACtC,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,IAAI,EAAE,KAAK,CAAC,IAAc;KAC3B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAmB,EACnB,UAAmB;IAEnB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,GAAG;QAC5B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC;IACF,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,UAAmB;IAChD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO;QAErC,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;YAAE,OAAO;QAE1B,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;QAAE,OAAO;IAC/C,gBAAgB,CAAC,eAAe,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC"}