@oharness/engine 0.1.0 → 0.2.0

package/dist/auth/providers/account.js

@@ -1,282 +1,172 @@
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { errorMessage } from "../../core/errors.js";
-import { userPath } from "../../paths.js";
-import { parseJson } from "../../util/json.js";
-/**
- * Read once, and lazily: most runs of the CLI never sign in, and a synchronous
- * read at module load would put a stat on the start-up path of all of them.
- *
- * `..` three times from either `src/auth/providers` or `dist/auth/providers`
- * lands on the package root, which is why the file sits there — the same trick
- * agent/skills.ts uses to find the skills directory.
- */
-let packaged;
-let configured;
-function readJsonFile(file) {
+import { readUserFile } from "../../config-files.js";
+/** Client knows the OHarness service, not its database/auth vendor. */
+export function siteUrl() {
+    const cloud = readUserFile("cloud.json");
+    const legacy = cloud === undefined ? readUserFile("config.json")?.account : undefined;
+    let packaged = {};
+    try {
+        const here = path.dirname(fileURLToPath(import.meta.url));
+        packaged = JSON.parse(readFileSync(path.resolve(here, "..", "..", "..", "official.json"), "utf8"));
+    }
+    catch { /* Optional deployment file; no Supabase credentials are consumed. */ }
+    return validateSiteUrl(process.env["OHARNESS_SITE_URL"] || cloud?.siteUrl || legacy?.siteUrl || process.env["OHARNESS_PACKAGED_SITE_URL"] || packaged?.siteUrl || "https://oharness.ai");
+}
+function validateSiteUrl(value) {
+    let url;
     try {
-        const parsed = parseJson(readFileSync(file, "utf8"));
-        return parsed.ok ? parsed.value : {};
+        url = new URL(value);
     }
     catch {
-        // Absent or unreadable. Both are ordinary, and neither is this layer's
-        // business to complain about.
-        return {};
+        throw new Error("Invalid OHarness Cloud address");
     }
+    const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    if ((url.protocol !== "https:" && !(url.protocol === "http:" && local)) || url.username || url.password ||
+        url.search || url.hash || url.pathname !== "/")
+        throw new Error("Cloud address must be an HTTPS origin (HTTP allowed for loopback development)");
+    return url.origin;
 }
-/** The ids this build was packaged with, if it was packaged with any. */
-function fromPackage() {
-    if (packaged)
-        return packaged;
-    const here = path.dirname(fileURLToPath(import.meta.url));
-    packaged = readJsonFile(path.resolve(here, "..", "..", "..", "official.json"));
-    return packaged;
-}
-/** The `account` section of the user's own config file. */
-function fromUserConfig() {
-    if (configured)
-        return configured;
-    const file = readJsonFile(userPath("config.json"));
-    configured = file.account ?? {};
-    return configured;
-}
-function configuredUrl() {
-    const value = process.env["OHARNESS_SUPABASE_URL"] ||
-        fromUserConfig().supabaseUrl ||
-        fromPackage().supabaseUrl ||
-        "";
-    return value.replace(/\/+$/, "");
-}
-function configuredKey() {
-    return (process.env["OHARNESS_SUPABASE_ANON_KEY"] ||
-        fromUserConfig().supabaseAnonKey ||
-        fromPackage().supabaseAnonKey ||
-        "");
-}
-/** Whether this build knows an account project to talk to at all. */
+/** Configuration readiness, not a network health check. */
 export function accountsConfigured() {
-    return Boolean(configuredUrl() && configuredKey());
-}
-// Names the config file first, because for anyone running their own fork that
-// is the answer, and an error that only mentions environment variables sends
-// them off to arrange an export that will not survive their next shell.
-const NO_ACCOUNTS = 'no account project is configured. Add {"account":{"supabaseUrl":"…","supabaseAnonKey":"…"}} to ~/.oharness/config.json, or set OHARNESS_SUPABASE_URL and OHARNESS_SUPABASE_ANON_KEY.';
-export function supabaseUrl() {
-    const url = configuredUrl();
-    if (!url)
-        throw new Error(NO_ACCOUNTS);
-    return url;
-}
-/**
- * The OHarness site — where accounts are made, paid for, and signed into.
- *
- * A deployment moves it the same way it moves the gateway, and a local `next
- * dev` on port 4000 is the reason this is not a constant.
- */
-const DEFAULT_SITE_URL = "https://oharness.ai";
-export function siteUrl() {
-    // Same order as the project ids above, and it has to be: the browser sign-in
-    // hands a session back from whichever site owns those accounts, so a fork
-    // that moved the project and not the site would send people to ours to sign
-    // in to theirs.
-    const value = process.env["OHARNESS_SITE_URL"] ||
-        fromUserConfig().siteUrl ||
-        fromPackage().siteUrl ||
-        DEFAULT_SITE_URL;
-    return value.replace(/\/+$/, "");
+    try {
+        return Boolean(siteUrl());
+    }
+    catch {
+        return false;
+    }
 }
-/**
- * Signing in by sending the user to the site, in their own browser.
- *
- * The emailed code below works from anywhere, which is why it is still here —
- * a terminal over SSH has no browser to open. But on a machine that does have
- * one, sending them to the site's own login is strictly better: it is the page
- * that offers a password and Google, it is the page that knows how to sign
- * someone *up*, and neither of those has to be reimplemented here to stay
- * working.
- *
- * What comes back is a sealed code on a loopback redirect, traded for the
- * session over HTTPS. The frontend owns the loopback listener because it is
- * the one already running a local server; this pair of functions is the part
- * that belongs to the account rather than to any one frontend.
- */
 export function browserSignInUrl(opts) {
-    const url = new URL("/auth/desktop", `${siteUrl()}/`);
+    const url = new URL("/auth/desktop", siteUrl());
     url.searchParams.set("state", opts.state);
     url.searchParams.set("redirect_uri", opts.redirectUri);
     if (opts.locale)
         url.searchParams.set("locale", opts.locale);
     return url.toString();
 }
-/** Trade a sealed handoff code for the session it stands for. */
-export async function exchangeHandoff(code, state) {
+export function browserKeyUrl(opts) {
+    const url = new URL(browserSignInUrl(opts));
+    url.searchParams.set("intent", "key");
+    return url.toString();
+}
+/** Native-server request: no browser cookies, redirects or automatic retries. */
+async function cloudPost(origin, route, body) {
     let response;
     try {
-        response = await fetch(`${siteUrl()}/api/desktop/exchange`, {
-            method: "POST",
+        response = await fetch(origin + route, {
+            method: "POST", redirect: "error", signal: AbortSignal.timeout(20_000),
             headers: { "content-type": "application/json", accept: "application/json" },
-            body: JSON.stringify({ code, state }),
+            body: JSON.stringify(body),
         });
     }
-    catch (err) {
-        // A site that cannot be reached is the common failure here — offline, or
-        // OHARNESS_SITE_URL pointing at a dev server that is not running — and it
-        // deserves better than "sign-in failed".
-        return { type: "failed", error: `could not reach ${siteUrl()}: ${errorMessage(err)}` };
+    catch {
+        throw new Error("Could not reach OHarness Cloud; check its address and availability");
     }
-    const body = parseJson(await response.text());
     if (!response.ok) {
-        return {
-            type: "failed",
-            error: (body.ok && body.value.error) || `the site refused the sign-in (HTTP ${response.status})`,
-        };
+        await response.body?.cancel();
+        const hint = response.status === 404 ? "; update OHarness Cloud to support desktop authentication" : "";
+        throw new Error("OHarness Cloud authentication failed (HTTP " + response.status + ")" + hint);
     }
-    if (!body.ok || !body.value.access_token || !body.value.refresh_token) {
-        return { type: "failed", error: "the site returned no session" };
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new Error("OHarness Cloud returned an empty response");
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > 64 * 1024) {
+                await reader.cancel();
+                throw new Error("Response too large");
+            }
+            chunks.push(value);
+        }
+        const result = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (!result || typeof result !== "object" || Array.isArray(result))
+            throw new Error();
+        return result;
+    }
+    catch {
+        throw new Error("OHarness Cloud returned an invalid authentication response");
+    }
+    finally {
+        reader.releaseLock();
     }
-    return {
-        type: "success",
-        access: body.value.access_token,
-        refresh: body.value.refresh_token,
-        expires: body.value.expires_at ?? 0,
-    };
-}
-function supabaseKey() {
-    const key = configuredKey();
-    if (!key)
-        throw new Error(NO_ACCOUNTS);
-    return key;
 }
-/** Every Supabase auth call carries the anon key as well as any bearer token. */
-export function supabaseHeaders() {
+/** Epoch milliseconds, matching the existing desktop exchange contract. */
+function sessionCredential(data, origin, previous) {
+    if (typeof data.access_token !== "string" || !data.access_token ||
+        typeof data.refresh_token !== "string" || !data.refresh_token ||
+        typeof data.expires_at !== "number" || !Number.isFinite(data.expires_at) || data.expires_at <= 0) {
+        throw new Error("OHarness Cloud returned an incomplete session");
+    }
     return {
-        apikey: supabaseKey(),
-        "content-type": "application/json",
-        accept: "application/json",
+        ...previous, type: "oauth", access: data.access_token, refresh: data.refresh_token,
+        expires: data.expires_at, metadata: { ...previous?.metadata, cloudOrigin: origin },
     };
 }
-/** The emailed-code sign-in, as an OAuth method a provider can declare. */
+export async function exchangeHandoff(code, state) {
+    try {
+        const origin = siteUrl();
+        const data = await cloudPost(origin, "/api/desktop/exchange", { code, state });
+        if (typeof data.api_key === "string" && data.api_key) {
+            const metadata = {};
+            if (typeof data.prefix === "string")
+                metadata.prefix = data.prefix;
+            if (typeof data.name === "string")
+                metadata.name = data.name;
+            return { type: "success", key: data.api_key, metadata };
+        }
+        const { type: _, ...credential } = sessionCredential(data, origin);
+        return { type: "success", ...credential };
+    }
+    catch (error) {
+        return { type: "failed", error: error.message };
+    }
+}
+/** SSH/terminal fallback. The legacy code flow now also goes through Cloud. */
 export function accountSignIn(label) {
     return {
-        type: "oauth",
-        label,
-        prompts: [
-            {
-                type: "text",
-                key: "email",
-                message: "Email on your OHarness account",
-                placeholder: "you@example.com",
-                validate: (value) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value) ? undefined : "that does not look like an email",
-            },
-        ],
+        type: "oauth", label,
+        prompts: [{ type: "text", key: "email", message: "Email on your OHarness account", placeholder: "you@example.com",
+                validate: (value) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value) ? undefined : "Enter an email address" }],
         async authorize(inputs) {
-            const email = (inputs["email"] ?? "").trim();
-            const response = await fetch(`${supabaseUrl()}/auth/v1/otp`, {
-                method: "POST",
-                headers: supabaseHeaders(),
-                // Signing up is the website's job: a subscription has to be paid for
-                // before it can be signed into, and silently creating an account
-                // here would hand out a login that cannot call anything.
-                body: JSON.stringify({ email, create_user: false }),
-            });
-            if (!response.ok) {
-                const detail = await failureDetail(response);
-                // GoTrue phrases "this address has no account" as a signup refusal,
-                // which reads as a bug in the client to anyone who does have one.
-                const noAccount = /signups? not allowed/i.test(detail);
-                throw new Error(noAccount
-                    ? `no OHarness account for ${email}. Sign up on the OHarness site first, then sign in here.`
-                    : `could not send the sign-in code to ${email}: ${detail}`);
-            }
+            const email = (inputs.email ?? "").trim();
+            const origin = siteUrl();
+            await cloudPost(origin, "/api/desktop/auth/otp", { email });
             return {
-                method: "code",
-                instructions: `We emailed a sign-in code to ${email}. Paste it here — the code, not the link.`,
-                // No page to open: the code arrives by email, and sending a browser
-                // to the login form would only invite a second, competing session.
-                async callback(code) {
-                    try {
-                        return await verifyOtp(email, code);
-                    }
-                    catch (err) {
-                        return { type: "failed", error: errorMessage(err) };
-                    }
-                },
+                method: "code", instructions: "Check " + email + " for your sign-in code.",
+                callback: (code) => verifyOtp(email, code, origin),
             };
         },
     };
 }
-/** Exchange the emailed code for a session. */
-export async function verifyOtp(email, code) {
-    const response = await fetch(`${supabaseUrl()}/auth/v1/verify`, {
-        method: "POST",
-        headers: supabaseHeaders(),
-        body: JSON.stringify({ email, token: code.trim(), type: "email" }),
-    });
-    if (!response.ok) {
-        return { type: "failed", error: await failureDetail(response) };
+export async function verifyOtp(email, code, origin = siteUrl()) {
+    try {
+        const data = await cloudPost(validateSiteUrl(origin), "/api/desktop/auth/verify", { email, token: code.trim() });
+        const { type: _, ...credential } = sessionCredential(data, origin);
+        return { type: "success", ...credential };
     }
-    const session = parseJson(await response.text());
-    if (!session.ok || !session.value.access_token) {
-        return { type: "failed", error: "the sign-in returned no access token" };
+    catch (error) {
+        return { type: "failed", error: error.message };
     }
-    const credential = toCredential(session.value);
-    return {
-        type: "success",
-        access: credential.access,
-        refresh: credential.refresh,
-        expires: credential.expires,
-    };
 }
-/** Trade a refresh token for a fresh session, or nothing if it is still good. */
 export async function refreshSession(credential) {
     if (!credential.refresh)
         return undefined;
-    // GoTrue takes the grant type in the query string and the body as JSON,
-    // so the generic form-encoded OAuth refresh does not fit.
-    const response = await fetch(`${supabaseUrl()}/auth/v1/token?grant_type=refresh_token`, {
-        method: "POST",
-        headers: supabaseHeaders(),
-        body: JSON.stringify({ refresh_token: credential.refresh }),
-    });
-    if (!response.ok) {
-        throw new Error(`subscription refresh failed: ${await failureDetail(response)}`);
+    const origin = siteUrl();
+    // Never forward a credential to another deployment after a config change.
+    if (credential.metadata?.cloudOrigin && credential.metadata.cloudOrigin !== origin) {
+        throw new Error("Cloud address changed; sign in again before refreshing this account");
     }
-    const session = parseJson(await response.text());
-    if (!session.ok || !session.value.access_token) {
-        throw new Error("subscription refresh returned no access token");
-    }
-    return toCredential(session.value, credential);
-}
-export function toCredential(session, previous) {
-    return {
-        type: "oauth",
-        access: session.access_token,
-        // GoTrue rotates the refresh token on every use, but keep the previous one
-        // if a response ever omits it — dropping it ends the session at expiry.
-        refresh: session.refresh_token ?? previous?.refresh ?? "",
-        expires: session.expires_in ? Date.now() + session.expires_in * 1_000 : 0,
-        ...(previous?.baseUrl ? { baseUrl: previous.baseUrl } : {}),
-    };
-}
-/**
- * GoTrue reports failures under several field names depending on the version
- * and the error class. Probing them beats showing a bare status code, which is
- * what "sign-in failed (400)" leaves the user debugging.
- */
-export async function failureDetail(response) {
-    const text = await response.text();
-    const parsed = parseJson(text);
-    const detail = parsed.ok
-        ? (parsed.value.error_description ??
-            parsed.value.msg ??
-            parsed.value.message ??
-            parsed.value.error)
-        : undefined;
-    return `HTTP ${response.status}${detail ? `: ${detail}` : ` ${text.slice(0, 200)}`}`;
+    const data = await cloudPost(origin, "/api/desktop/auth/refresh", { refresh_token: credential.refresh });
+    return sessionCredential(data, origin, credential);
 }
-/** The bearer shape both account-backed providers resolve to. */
 export function bearer(token, source) {
-    return { headers: { authorization: `Bearer ${token}` }, source };
+    return { headers: { authorization: "Bearer " + token }, source };
 }
 //# sourceMappingURL=account.js.map

package/dist/auth/providers/account.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../src/auth/providers/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AA6D/C;;;;;;;GAOG;AACH,IAAI,QAAoC,CAAC;AACzC,IAAI,UAAsC,CAAC;AAE3C,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAiB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,8BAA8B;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW;IAClB,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IAC/E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2DAA2D;AAC3D,SAAS,cAAc;IACrB,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAiC,CAAC;IACnF,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAChC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACpC,cAAc,EAAE,CAAC,WAAW;QAC5B,WAAW,EAAE,CAAC,WAAW;QACzB,EAAE,CAAC;IACL,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACzC,cAAc,EAAE,CAAC,eAAe;QAChC,WAAW,EAAE,CAAC,eAAe;QAC7B,EAAE,CACH,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAC,aAAa,EAAE,IAAI,aAAa,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,wEAAwE;AACxE,MAAM,WAAW,GACf,sLAAsL,CAAC;AAEzL,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C,MAAM,UAAU,OAAO;IACrB,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,gBAAgB;IAChB,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAChC,cAAc,EAAE,CAAC,OAAO;QACxB,WAAW,EAAE,CAAC,OAAO;QACrB,gBAAgB,CAAC;IACnB,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAOhC;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IAC/D,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,EAAE,uBAAuB,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,0EAA0E;QAC1E,yCAAyC;QACzC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,OAAO,EAAE,KAAK,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACzF,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAKnB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAE1B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,sCAAsC,QAAQ,CAAC,MAAM,GAAG;SACjG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACnE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,MAAM,EAAE,WAAW,EAAE;QACrB,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC3B,CAAC;AACJ,CAAC;AAYD,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,OAAO;gBACZ,OAAO,EAAE,gCAAgC;gBACzC,WAAW,EAAE,iBAAiB;gBAC9B,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kCAAkC;aAC5F;SACF;QAED,KAAK,CAAC,SAAS,CAAC,MAAM;YACpB,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,EAAE,cAAc,EAAE;gBAC3D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,eAAe,EAAE;gBAC1B,qEAAqE;gBACrE,iEAAiE;gBACjE,yDAAyD;gBACzD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;aACpD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC7C,oEAAoE;gBACpE,kEAAkE;gBAClE,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvD,MAAM,IAAI,KAAK,CACb,SAAS;oBACP,CAAC,CAAC,2BAA2B,KAAK,0DAA0D;oBAC5F,CAAC,CAAC,sCAAsC,KAAK,KAAK,MAAM,EAAE,CAC7D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,YAAY,EAAE,gCAAgC,KAAK,2CAA2C;gBAC9F,oEAAoE;gBACpE,mEAAmE;gBACnE,KAAK,CAAC,QAAQ,CAAC,IAAY;oBACzB,IAAI,CAAC;wBACH,OAAO,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBACtC,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtD,CAAC;gBACH,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,IAAY;IACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,EAAE,iBAAiB,EAAE;QAC9D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,eAAe,EAAE;QAC1B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;KACnE,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAgB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAA2B;IAE3B,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE1C,wEAAwE;IACxE,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,EAAE,yCAAyC,EAAE;QACtF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,eAAe,EAAE;QAC1B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;KAC5D,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAgB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,OAAsB,EACtB,QAA0B;IAE1B,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO,CAAC,YAAa;QAC7B,2EAA2E;QAC3E,wEAAwE;QACxE,OAAO,EAAE,OAAO,CAAC,aAAa,IAAI,QAAQ,EAAE,OAAO,IAAI,EAAE;QACzD,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAkB;IACpD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,CAAgB,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE;QACtB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB;YAC/B,MAAM,CAAC,KAAK,CAAC,GAAG;YAChB,MAAM,CAAC,KAAK,CAAC,OAAO;YACpB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,QAAQ,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,MAAM,CAAC,KAAa,EAAE,MAAc;IAClD,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACnE,CAAC"}
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../src/auth/providers/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAIrD,uEAAuE;AACvE,MAAM,UAAU,OAAO;IACrB,MAAM,KAAK,GAAG,YAAY,CAAY,YAAY,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAA0B,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,IAAI,QAAQ,GAAc,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC,CAAC,qEAAqE,CAAC,CAAC;IACjF,OAAO,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,KAAK,EAAE,OAAO,IAAI,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,QAAQ,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;AAC3L,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QACnG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACrJ,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QAAC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAA6D;IAC5F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAA6D;IACzF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,KAAa,EAAE,IAAY;IAClE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE;YACrC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACtE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAAC,CAAC;IAClG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,QAAQ,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAAC,CAAC;YACvF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACtF,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAAC,CAAC;YAClF,CAAC;QAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;AACnC,CAAC;AAED,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,IAA6B,EAAE,MAAc,EAAE,QAA0B;IAClG,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY;QAC3D,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa;QAC7D,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO;QACL,GAAG,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa;QAClF,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE;KACnF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IAC/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,uBAAuB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,QAAQ,GAA2B,EAAE,CAAC;YAC5C,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACnE,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YAC7D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACjF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO;QACL,IAAI,EAAE,OAAO,EAAE,KAAK;QACpB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,gCAAgC,EAAE,WAAW,EAAE,iBAAiB;gBAC/G,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC;QACzG,KAAK,CAAC,SAAS,CAAC,MAAM;YACpB,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;YACzB,MAAM,SAAS,CAAC,MAAM,EAAE,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO;gBACL,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,GAAG,KAAK,GAAG,yBAAyB;gBAC1E,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;aACnD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,IAAY,EAAE,MAAM,GAAG,OAAO,EAAE;IAC7E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjH,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAA2B;IAC9D,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;IACzB,0EAA0E;IAC1E,IAAI,UAAU,CAAC,QAAQ,EAAE,WAAW,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,2BAA2B,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;IACzG,OAAO,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa,EAAE,MAAc;IAClD,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC;AACnE,CAAC"}

package/dist/config-files.d.ts

@@ -0,0 +1,27 @@
+import type { McpServerConfig } from "./mcp/client.ts";
+import type { RuntimePluginConfig } from "./runtime-plugins/types.ts";
+import type { PluginConfig } from "./plugins.ts";
+export interface PluginFile {
+    runtimePlugins?: RuntimePluginConfig[];
+    plugins?: PluginConfig;
+}
+export interface McpFile {
+    mcpServers?: Record<string, McpServerConfig>;
+}
+export interface CloudFile {
+    siteUrl?: string;
+}
+/** Read only trusted user files, never a repository's executable plugin list. */
+export declare function readUserFile<T extends object>(name: string): T | undefined;
+export declare function readPluginFile(): PluginFile | undefined;
+export declare function readMcpFile(): McpFile | undefined;
+/** Atomic private files; no credentials/config values in error messages. */
+export declare function writeUserFile(name: string, data: object): Promise<void>;
+export declare function updateRuntimePluginConfig(id: string, change: (config: Record<string, unknown>) => Record<string, unknown>): Promise<void>;
+export declare function updateUserMcpConfig(change: (servers: Record<string, McpServerConfig>) => Record<string, McpServerConfig>): Promise<void>;
+/** An explicit migration, not a startup side effect. Back up before removing old fields. */
+export declare function migrateUserConfig(apply?: boolean): Promise<{
+    changed: boolean;
+    files: string[];
+    backup?: string;
+}>;

package/dist/config-files.js

@@ -0,0 +1,116 @@
+import { readFileSync } from "node:fs";
+import { mkdir, writeFile, rename, rm } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+import { userPath } from "./paths.js";
+import { ConfigError } from "./core/errors.js";
+/** Read only trusted user files, never a repository's executable plugin list. */
+export function readUserFile(name) {
+    const file = userPath(name);
+    let raw;
+    try {
+        raw = readFileSync(file, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw new ConfigError(`Cannot read ${file}`);
+    }
+    try {
+        const data = JSON.parse(raw);
+        if (!data || typeof data !== "object" || Array.isArray(data))
+            throw new Error();
+        return data;
+    }
+    catch {
+        throw new ConfigError(`${file} must contain a JSON object`);
+    }
+}
+export function readPluginFile() {
+    const config = readUserFile("plugins.json");
+    if (config?.runtimePlugins !== undefined && !Array.isArray(config.runtimePlugins)) {
+        throw new ConfigError("plugins.json runtimePlugins must be an array");
+    }
+    return config;
+}
+export function readMcpFile() {
+    const config = readUserFile("mcp.json");
+    if (config?.mcpServers !== undefined && (!config.mcpServers || typeof config.mcpServers !== "object" || Array.isArray(config.mcpServers))) {
+        throw new ConfigError("mcp.json mcpServers must be an object");
+    }
+    return config;
+}
+/** Atomic private files; no credentials/config values in error messages. */
+export async function writeUserFile(name, data) {
+    const file = userPath(name);
+    await mkdir(path.dirname(file), { recursive: true });
+    const temp = `${file}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(temp, JSON.stringify(data, null, 2) + "\n", { mode: 0o600, flag: "wx" });
+        await rename(temp, file);
+    }
+    finally {
+        await rm(temp, { force: true });
+    }
+}
+let mcpWriteQueue = Promise.resolve();
+let pluginWriteQueue = Promise.resolve();
+export function updateRuntimePluginConfig(id, change) {
+    const job = pluginWriteQueue.then(async () => {
+        const separate = readPluginFile();
+        const previous = separate ?? readUserFile("config.json") ?? {};
+        const entries = [...(previous.runtimePlugins ?? [])];
+        const index = entries.findIndex((entry) => entry.id === id);
+        const entry = entries[index] ?? { id };
+        const raw = entry.config && typeof entry.config === "object" && !Array.isArray(entry.config) ? entry.config : {};
+        const next = { ...entry, config: change(raw) };
+        if (index >= 0)
+            entries[index] = next;
+        else
+            entries.push(next);
+        await writeUserFile("plugins.json", { ...(separate ?? {}), ...(previous.plugins ? { plugins: previous.plugins } : {}), runtimePlugins: entries });
+    });
+    pluginWriteQueue = job.catch(() => { });
+    return job;
+}
+export function updateUserMcpConfig(change) {
+    const job = mcpWriteQueue.then(async () => {
+        const separate = readMcpFile();
+        const old = separate === undefined ? readUserFile("config.json") : undefined;
+        await writeUserFile("mcp.json", { ...separate, mcpServers: change({ ...(separate?.mcpServers ?? old?.mcpServers) }) });
+    });
+    mcpWriteQueue = job.catch(() => { });
+    return job;
+}
+/** An explicit migration, not a startup side effect. Back up before removing old fields. */
+export async function migrateUserConfig(apply = false) {
+    const current = readUserFile("config.json");
+    if (!current || !["account", "mcpServers", "runtimePlugins", "plugins"].some((key) => key in current)) {
+        return { changed: false, files: [] };
+    }
+    // Validate destinations before changing anything; existing files are authoritative.
+    const plugins = readPluginFile();
+    const mcp = readMcpFile();
+    const cloud = readUserFile("cloud.json");
+    const { account, mcpServers, runtimePlugins, plugins: bundles, ...general } = current;
+    const outputs = {};
+    if (!plugins) {
+        outputs["plugins.json"] = { runtimePlugins: runtimePlugins ?? [], ...(bundles !== undefined ? { plugins: bundles } : {}) };
+    }
+    if (!mcp && mcpServers !== undefined)
+        outputs["mcp.json"] = { mcpServers };
+    const site = account && typeof account === "object" ? account.siteUrl : undefined;
+    if (!cloud && typeof site === "string" && site)
+        outputs["cloud.json"] = { siteUrl: site };
+    outputs["config.json"] = general;
+    const files = Object.keys(outputs).map((name) => userPath(name));
+    if (!apply)
+        return { changed: true, files };
+    const backup = `config.before-split.${randomUUID()}.json`;
+    await writeUserFile(backup, current);
+    // Write config.json last. A crash leaves the legacy source intact and is retryable.
+    for (const [name, data] of Object.entries(outputs))
+        await writeUserFile(name, data);
+    return { changed: true, files, backup: userPath(backup) };
+}
+//# sourceMappingURL=config-files.js.map

package/dist/config-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-files.js","sourceRoot":"","sources":["../src/config-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAS/C,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAmB,IAAY;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QAAC,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IACzC,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,IAAI,WAAW,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAChF,OAAO,IAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,YAAY,CAAa,cAAc,CAAC,CAAC;IACxD,IAAI,MAAM,EAAE,cAAc,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,WAAW,CAAC,8CAA8C,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,MAAM,GAAG,YAAY,CAAU,UAAU,CAAC,CAAC;IACjD,IAAI,MAAM,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC1I,MAAM,IAAI,WAAW,CAAC,uCAAuC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AAChD,CAAC;AAED,IAAI,aAAa,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;AACxD,IAAI,gBAAgB,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3D,MAAM,UAAU,yBAAyB,CAAC,EAAU,EAAE,MAAoE;IACxH,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QAC3C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,QAAQ,IAAI,YAAY,CAAa,aAAa,CAAC,IAAI,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,MAAM,IAAI,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC1E,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;;YAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,aAAa,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;IACpJ,CAAC,CAAC,CAAC;IACH,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAAC,OAAO,GAAG,CAAC;AACrD,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,MAAqF;IACvH,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QACxC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAU,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,IAAI,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC,CAAC,CAAC;IACH,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAK,GAAG,KAAK;IACnD,MAAM,OAAO,GAAG,YAAY,CAA0B,aAAa,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC;QACtG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACvC,CAAC;IACD,oFAAoF;IACpF,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,YAAY,CAAY,YAAY,CAAC,CAAC;IACpD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC;IACtF,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,IAAI,EAAE,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7H,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,OAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI;QAAE,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1F,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,uBAAuB,UAAU,EAAE,OAAO,CAAC;IAC1D,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,oFAAoF;IACpF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AAC5D,CAAC"}