@paperclipai/server 2026.817.0 → 2026.818.0-beta.1

package/dist/adapters/hermes-gateway-doc.d.ts

@@ -1,2 +1,2 @@
-export declare const hermesGatewayAgentConfigurationDoc = "# hermes_gateway agent configuration\n\nAdapter: hermes_gateway\n\nUse when:\n- Hermes is already running outside Paperclip and exposes its API server.\n- Paperclip should invoke Hermes through the gateway HTTP API instead of spawning Hermes locally.\n- The Hermes runtime may live on another host, a private overlay, in Docker, or behind a TLS reverse proxy.\n\nDon't use when:\n- Paperclip should start the Hermes CLI directly on the same host. Use the built-in hermes_local adapter for that flow.\n- Hermes is the process calling Paperclip APIs after claiming its key. That is Hermes-originated Paperclip API usage, not the gateway adapter transport.\n\nRuntime distinction:\n- hermes_local: Paperclip starts Hermes on the Paperclip host through the built-in local adapter.\n- hermes_gateway: Paperclip calls an already-running Hermes API server using agentDefaultsPayload.apiBaseUrl.\n- Hermes-originated Paperclip API usage: Hermes calls Paperclip with PAPERCLIP_API_URL and the Paperclip API key claimed through the standard join approval flow. Do not use agentDefaultsPayload.apiBaseUrl for Paperclip API calls. For internet-facing Hermes chat/webhook task bridges, use a separate task_bridge key instead of exposing the normal claimed agent key.\n\nHermes gateway process setup:\n- Set API_SERVER_ENABLED=true.\n- Set API_SERVER_KEY to a generated secret value. Do not paste a real key into tickets, docs, screenshots, or tests.\n- Start Hermes with: hermes gateway run --replace --accept-hooks\n- Default Hermes API server port: 8642.\n- Default Hermes dashboard port: 9119. If Paperclip is configured with a default dashboard root or chat URL such as http://127.0.0.1:9119 or http://127.0.0.1:9119/chat, it maps the base URL to /api automatically.\n- Watch out: /chat and the dashboard root are browser UI routes. Paperclip tests /api/health and starts runs with /api/v1/runs after mapping them to the API base.\n\nJoin request minimum:\n{\n  \"requestType\": \"agent\",\n  \"agentName\": \"My Hermes Gateway Agent\",\n  \"adapterType\": \"hermes_gateway\",\n  \"capabilities\": \"Hermes gateway agent\",\n  \"agentDefaultsPayload\": {\n    \"apiBaseUrl\": \"http://127.0.0.1:8642\",\n    \"apiKey\": \"<same-value-as-API_SERVER_KEY>\",\n    \"paperclipApiUrl\": \"http://localhost:3100\"\n  }\n}\n\nCore fields:\n- agentDefaultsPayload.apiBaseUrl (string, required): Base URL for the Hermes API server as reachable from the Paperclip server. A default dashboard root or chat URL such as http://127.0.0.1:9119 or http://127.0.0.1:9119/chat is accepted and maps to http://127.0.0.1:9119/api.\n- agentDefaultsPayload.apiKey (string, required unless the adapter package documents another auth field): Hermes API server key matching API_SERVER_KEY. This is the Hermes gateway key, not the claimed Paperclip API key.\n- agentDefaultsPayload.paperclipApiUrl (string, strongly recommended): Paperclip base URL as reachable from Hermes for invite, claim, skill bootstrap, and later Paperclip API calls.\n- agentDefaultsPayload.timeoutSec or timeoutMs (number, optional): Runtime request timeout when supported by the installed Hermes gateway adapter.\n\nNetwork examples:\n- Local loopback on one host: agentDefaultsPayload.apiBaseUrl = \"http://127.0.0.1:8642\"; agentDefaultsPayload.paperclipApiUrl = \"http://127.0.0.1:3100\".\n- Local dashboard root or chat URL on one host: agentDefaultsPayload.apiBaseUrl = \"http://127.0.0.1:9119\" or \"http://127.0.0.1:9119/chat\"; Paperclip maps it to \"http://127.0.0.1:9119/api\".\n- LAN/private network: agentDefaultsPayload.apiBaseUrl = \"http://192.168.1.25:8642\"; agentDefaultsPayload.paperclipApiUrl = \"http://192.168.1.10:3100\". Use private IPs or hostnames reachable from both machines.\n- Private overlay: agentDefaultsPayload.apiBaseUrl = \"http://hermes-host.tailnet-name.ts.net:8642\"; agentDefaultsPayload.paperclipApiUrl = \"http://paperclip-host.tailnet-name.ts.net:3100\". Add the Paperclip hostname with pnpm paperclipai allowed-hostname <host> when authenticated/private mode requires it.\n- Docker: if Hermes runs on the host and Paperclip runs in Docker, use agentDefaultsPayload.apiBaseUrl = \"http://host.docker.internal:8642\". If Hermes runs in another container, use the Compose service DNS name such as \"http://hermes:8642\".\n- Reverse proxy/TLS: publish Hermes behind HTTPS and set agentDefaultsPayload.apiBaseUrl = \"https://hermes-gateway.example\"; set agentDefaultsPayload.paperclipApiUrl = \"https://paperclip.example\". Keep API_SERVER_KEY required at the origin or proxy.\n\nSecurity notes:\n- Treat API_SERVER_KEY and PAPERCLIP_BRIDGE_API_KEY as secrets.\n- When claiming the normal Paperclip agent API key, store the parsed token field from the raw claim response before printing or summarizing it. Hermes/tool displays may redact secrets with literal ... or [redacted]; those previews are not valid keys.\n- Never use a normal claimed Paperclip agent API key for internet-facing Hermes-originated task bridge calls; task_bridge keys cannot use company-wide issue list/search/read surfaces and can only mutate bridge-created or assigned issues.\n- Prefer private network or TLS for non-loopback gateway access.\n- Use placeholders such as <same-value-as-API_SERVER_KEY> in docs and tests.\n";
+export declare const hermesGatewayAgentConfigurationDoc = "# hermes_gateway agent configuration\n\nAdapter: hermes_gateway\n\nUse when:\n- Hermes is already running outside Paperclip and exposes its API server.\n- Paperclip should invoke Hermes through the gateway HTTP API instead of spawning Hermes locally.\n- The Hermes runtime may live on another host, a private overlay, in Docker, or behind a TLS reverse proxy.\n\nDon't use when:\n- Paperclip should start the Hermes CLI directly on the same host. Use the built-in hermes_local adapter for that flow.\n- Hermes is the process calling Paperclip APIs after claiming its key. That is Hermes-originated Paperclip API usage, not the gateway adapter transport.\n\nRuntime distinction:\n- hermes_local: Paperclip starts Hermes on the Paperclip host through the built-in local adapter.\n- hermes_gateway: Paperclip calls an already-running Hermes API server using agentDefaultsPayload.apiBaseUrl.\n- Hermes-originated Paperclip API usage: Hermes calls Paperclip with PAPERCLIP_API_URL and the Paperclip API key claimed through the standard join approval flow. Do not use agentDefaultsPayload.apiBaseUrl for Paperclip API calls. For internet-facing Hermes chat/webhook task bridges, use a separate task_bridge key instead of exposing the normal claimed agent key.\n\nHermes gateway process setup:\n- Set API_SERVER_ENABLED=true.\n- Set API_SERVER_KEY to a generated secret value. Do not paste a real key into tickets, docs, screenshots, or tests.\n- Start Hermes with: hermes gateway run --replace --accept-hooks\n- Default Hermes API server port: 8642.\n- Default Hermes dashboard port: 9119. If Paperclip is configured with a default dashboard root or chat URL such as http://127.0.0.1:9119 or http://127.0.0.1:9119/chat, it maps the base URL to /api automatically.\n- Watch out: /chat and the dashboard root are browser UI routes. Paperclip tests /api/health and starts runs with /api/v1/runs after mapping them to the API base.\n\nJoin request minimum:\n{\n  \"requestType\": \"agent\",\n  \"agentName\": \"My Hermes Gateway Agent\",\n  \"adapterType\": \"hermes_gateway\",\n  \"capabilities\": \"Hermes gateway agent\",\n  \"agentDefaultsPayload\": {\n    \"apiBaseUrl\": \"http://127.0.0.1:8642\",\n    \"apiKey\": \"<same-value-as-API_SERVER_KEY>\",\n    \"paperclipApiUrl\": \"http://localhost:3100\"\n  }\n}\n\nCore fields:\n- agentDefaultsPayload.apiBaseUrl (string, required): Base URL for the Hermes API server as reachable from the Paperclip server. A default dashboard root or chat URL such as http://127.0.0.1:9119 or http://127.0.0.1:9119/chat is accepted and maps to http://127.0.0.1:9119/api.\n- agentDefaultsPayload.apiKey (string, required unless the adapter package documents another auth field): Hermes API server key matching API_SERVER_KEY. This is the Hermes gateway key, not the claimed Paperclip API key.\n- agentDefaultsPayload.paperclipApiUrl (string, strongly recommended): Paperclip base URL as reachable from Hermes for invite, claim, skill bootstrap, and later Paperclip API calls.\n- agentDefaultsPayload.timeoutSec or timeoutMs (number, optional): Runtime request timeout when supported by the installed Hermes gateway adapter.\n\nNetwork examples:\n- Local loopback on one host: agentDefaultsPayload.apiBaseUrl = \"http://127.0.0.1:8642\"; agentDefaultsPayload.paperclipApiUrl = \"http://127.0.0.1:3100\".\n- Local dashboard root or chat URL on one host: agentDefaultsPayload.apiBaseUrl = \"http://127.0.0.1:9119\" or \"http://127.0.0.1:9119/chat\"; Paperclip maps it to \"http://127.0.0.1:9119/api\".\n- LAN/private network: agentDefaultsPayload.apiBaseUrl = \"http://192.168.1.25:8642\"; agentDefaultsPayload.paperclipApiUrl = \"http://192.168.1.10:3100\". Use private IPs or hostnames reachable from both machines.\n- Private overlay: agentDefaultsPayload.apiBaseUrl = \"http://hermes-host.tailnet-name.ts.net:8642\"; agentDefaultsPayload.paperclipApiUrl = \"http://paperclip-host.tailnet-name.ts.net:3100\". Add the Paperclip hostname with npx paperclipai allowed-hostname <host> when authenticated/private mode requires it.\n- Docker: if Hermes runs on the host and Paperclip runs in Docker, use agentDefaultsPayload.apiBaseUrl = \"http://host.docker.internal:8642\". If Hermes runs in another container, use the Compose service DNS name such as \"http://hermes:8642\".\n- Reverse proxy/TLS: publish Hermes behind HTTPS and set agentDefaultsPayload.apiBaseUrl = \"https://hermes-gateway.example\"; set agentDefaultsPayload.paperclipApiUrl = \"https://paperclip.example\". Keep API_SERVER_KEY required at the origin or proxy.\n\nSecurity notes:\n- Treat API_SERVER_KEY and PAPERCLIP_BRIDGE_API_KEY as secrets.\n- When claiming the normal Paperclip agent API key, store the parsed token field from the raw claim response before printing or summarizing it. Hermes/tool displays may redact secrets with literal ... or [redacted]; those previews are not valid keys.\n- Never use a normal claimed Paperclip agent API key for internet-facing Hermes-originated task bridge calls; task_bridge keys cannot use company-wide issue list/search/read surfaces and can only mutate bridge-created or assigned issues.\n- Prefer private network or TLS for non-loopback gateway access.\n- Use placeholders such as <same-value-as-API_SERVER_KEY> in docs and tests.\n";
 //# sourceMappingURL=hermes-gateway-doc.d.ts.map

package/dist/adapters/hermes-gateway-doc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hermes-gateway-doc.d.ts","sourceRoot":"","sources":["../../src/adapters/hermes-gateway-doc.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,kCAAkC,kqKA2D9C,CAAC"}
+{"version":3,"file":"hermes-gateway-doc.d.ts","sourceRoot":"","sources":["../../src/adapters/hermes-gateway-doc.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,kCAAkC,iqKA2D9C,CAAC"}

package/dist/adapters/hermes-gateway-doc.js

@@ -47,7 +47,7 @@ Network examples:
 - Local loopback on one host: agentDefaultsPayload.apiBaseUrl = "http://127.0.0.1:8642"; agentDefaultsPayload.paperclipApiUrl = "http://127.0.0.1:3100".
 - Local dashboard root or chat URL on one host: agentDefaultsPayload.apiBaseUrl = "http://127.0.0.1:9119" or "http://127.0.0.1:9119/chat"; Paperclip maps it to "http://127.0.0.1:9119/api".
 - LAN/private network: agentDefaultsPayload.apiBaseUrl = "http://192.168.1.25:8642"; agentDefaultsPayload.paperclipApiUrl = "http://192.168.1.10:3100". Use private IPs or hostnames reachable from both machines.
-- Private overlay: agentDefaultsPayload.apiBaseUrl = "http://hermes-host.tailnet-name.ts.net:8642"; agentDefaultsPayload.paperclipApiUrl = "http://paperclip-host.tailnet-name.ts.net:3100". Add the Paperclip hostname with pnpm paperclipai allowed-hostname <host> when authenticated/private mode requires it.
+- Private overlay: agentDefaultsPayload.apiBaseUrl = "http://hermes-host.tailnet-name.ts.net:8642"; agentDefaultsPayload.paperclipApiUrl = "http://paperclip-host.tailnet-name.ts.net:3100". Add the Paperclip hostname with npx paperclipai allowed-hostname <host> when authenticated/private mode requires it.
 - Docker: if Hermes runs on the host and Paperclip runs in Docker, use agentDefaultsPayload.apiBaseUrl = "http://host.docker.internal:8642". If Hermes runs in another container, use the Compose service DNS name such as "http://hermes:8642".
 - Reverse proxy/TLS: publish Hermes behind HTTPS and set agentDefaultsPayload.apiBaseUrl = "https://hermes-gateway.example"; set agentDefaultsPayload.paperclipApiUrl = "https://paperclip.example". Keep API_SERVER_KEY required at the origin or proxy.
 

package/dist/adapters/plugin-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-loader.d.ts","sourceRoot":"","sources":["../../src/adapters/plugin-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAgBtD,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiBlF;AA+GD,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,mBAAmB,CAAC,CAmB9B;AAcD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA6CrC;AAED;;GAEG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAmB5E"}
+{"version":3,"file":"plugin-loader.d.ts","sourceRoot":"","sources":["../../src/adapters/plugin-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAgBtD,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiBlF;AA+GD,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,mBAAmB,CAAC,CAmB9B;AAcD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA6CrC;AAED;;GAEG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAmB5E"}

package/dist/adapters/plugin-loader.js

@@ -10,6 +10,7 @@
  */
 import fs from "node:fs";
 import path from "node:path";
+import { pathToFileURL } from "node:url";
 import { logger } from "../middleware/logger.js";
 import { listAdapterPlugins, getAdapterPluginsDir, getAdapterPluginByType, } from "../services/adapter-plugin-store.js";
 // ---------------------------------------------------------------------------
@@ -122,7 +123,7 @@ export async function loadExternalAdapterPackage(packageName, localPath) {
     const modulePath = path.resolve(packageDir, entryPoint);
     const uiParserSource = extractUiParserSource(packageDir, packageName);
     logger.info({ packageName, packageDir, entryPoint, modulePath, hasUiParser: !!uiParserSource }, "Loading external adapter package");
-    const mod = await import(modulePath);
+    const mod = await import(pathToFileURL(modulePath).href);
     const adapterModule = validateAdapterModule(mod, packageName);
     if (uiParserSource) {
         uiParserCache.set(adapterModule.type, uiParserSource);
@@ -149,7 +150,7 @@ export async function reloadExternalAdapter(type) {
     const packageDir = resolvePackageDir(record);
     const entryPoint = resolvePackageEntryPoint(packageDir);
     const modulePath = path.resolve(packageDir, entryPoint);
-    const fileUrl = `file://${modulePath}`;
+    const fileUrl = pathToFileURL(modulePath).href;
     // Bust ESM module cache so re-import loads fresh code from disk.
     // Query-string trick (?t=...) works in Node; Bun may need the file:// URL
     // to be evicted from its internal registry first.

package/dist/adapters/plugin-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-loader.js","sourceRoot":"","sources":["../../src/adapters/plugin-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qCAAqC,CAAC;AAG7C,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEhD,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAmB;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,MAAM,EAAE,CAAC;QACX,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,EACtE,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,MAA8D;IACvF,OAAO,MAAM,CAAC,SAAS;QACrB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAkB;IAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9D,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC,SAAS,qBAAqB,CAC5B,UAAkB,EAClB,WAAmB;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9D,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC;IACvD,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,yBAAyB,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,yBAAyB,IAAI,EAAE,EAC7E,8EAA8E,CAC/E,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,EACf,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,OAAO,WAAW,KAAK,QAAQ;QAClD,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAE5D,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QACnF,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,YAAY,EAAE,EAC7B,qDAAqD,CACtD,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,EAClD,wCAAwC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAC1F,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,+CAA+C,CAAC,CAAC;QACjG,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,SAAS,qBAAqB,CAAC,GAAY,EAAE,WAAmB;IAC9D,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,mBAAmB,GAAG,CAAC,CAAC,mBAAmB,CAAC;IAClD,IAAI,OAAO,mBAAmB,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,YAAY,WAAW,2CAA2C;YAClE,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,mBAAmB,EAAyB,CAAC;IACnE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,+BAA+B,WAAW,gDAAgD,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,SAAkB;IAElB,MAAM,UAAU,GAAG,SAAS;QAC1B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,qBAAqB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAEtE,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE,kCAAkC,CAAC,CAAC;IAEpI,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,aAAa,GAAG,qBAAqB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAE9D,IAAI,cAAc,EAAE,CAAC;QACnB,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAA2B;IACvD,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAC3D,uDAAuD,CACxD,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY;IAEZ,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,UAAU,UAAU,EAAE,CAAC;IAEvC,iEAAiE;IACjE,0EAA0E;IAC1E,kDAAkD;IAClD,IAAI,CAAC;QACH,gDAAgD;QAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,aAAiD,CAAC;QACnF,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzB,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,OAAO,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAElD,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,EACnE,yCAAyC,CAC1C,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAErE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,cAAc,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,cAAc,EAAE,CAAC;QACnB,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,cAAc,EAAE,EACxE,wCAAwC,CACzC,CAAC;IAEF,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,OAAO,GAA0B,EAAE,CAAC;IAE1C,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAC/D,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"plugin-loader.js","sourceRoot":"","sources":["../../src/adapters/plugin-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qCAAqC,CAAC;AAG7C,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEhD,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAmB;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,MAAM,EAAE,CAAC;QACX,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,EACtE,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,MAA8D;IACvF,OAAO,MAAM,CAAC,SAAS;QACrB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAkB;IAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9D,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC,SAAS,qBAAqB,CAC5B,UAAkB,EAClB,WAAmB;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9D,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC;IACvD,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,yBAAyB,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,yBAAyB,IAAI,EAAE,EAC7E,8EAA8E,CAC/E,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,EACf,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,OAAO,WAAW,KAAK,QAAQ;QAClD,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAE5D,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QACnF,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,YAAY,EAAE,EAC7B,qDAAqD,CACtD,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,EAClD,wCAAwC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAC1F,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,+CAA+C,CAAC,CAAC;QACjG,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,SAAS,qBAAqB,CAAC,GAAY,EAAE,WAAmB;IAC9D,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,mBAAmB,GAAG,CAAC,CAAC,mBAAmB,CAAC;IAClD,IAAI,OAAO,mBAAmB,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,YAAY,WAAW,2CAA2C;YAClE,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,mBAAmB,EAAyB,CAAC;IACnE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,+BAA+B,WAAW,gDAAgD,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,SAAkB;IAElB,MAAM,UAAU,GAAG,SAAS;QAC1B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,qBAAqB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAEtE,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE,kCAAkC,CAAC,CAAC;IAEpI,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,qBAAqB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAE9D,IAAI,cAAc,EAAE,CAAC;QACnB,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAA2B;IACvD,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAC3D,uDAAuD,CACxD,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY;IAEZ,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;IAE/C,iEAAiE;IACjE,0EAA0E;IAC1E,kDAAkD;IAClD,IAAI,CAAC;QACH,gDAAgD;QAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,aAAiD,CAAC;QACnF,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzB,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,OAAO,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAElD,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,EACnE,yCAAyC,CAC1C,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAErE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,cAAc,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,cAAc,EAAE,CAAC;QACnB,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,cAAc,EAAE,EACxE,wCAAwC,CACzC,CAAC;IAEF,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,OAAO,GAA0B,EAAE,CAAC;IAE1C,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAC/D,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/agent-auth-jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-auth-jwt.d.ts","sourceRoot":"","sources":["../src/agent-auth-jwt.ts"],"names":[],"mappings":"AACA,OAAO,EAA6B,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQvF,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA6FD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,EACjC,QAAQ,GAAE,gBAAuC,iBAiClD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CA4F7E"}
+{"version":3,"file":"agent-auth-jwt.d.ts","sourceRoot":"","sources":["../src/agent-auth-jwt.ts"],"names":[],"mappings":"AACA,OAAO,EAA6B,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQvF,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAmGD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,EACjC,QAAQ,GAAE,gBAAuC,iBAiClD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CA4F7E"}

package/dist/agent-auth-jwt.js

@@ -20,7 +20,13 @@ function jwtConfig() {
         return null;
     return {
         secret,
-        ttlSeconds: parseNumber(process.env.PAPERCLIP_AGENT_JWT_TTL_SECONDS, 60 * 60),
+        // 48h default, matching DEFAULT_AGENT_JWT_TTL_SECONDS in cli/src/commands/env.ts
+        // and the agent-authentication design doc. Run tokens are minted once at
+        // adapter spawn and injected as env, so the TTL must cover the entire run —
+        // including host-suspension gaps: heartbeats scheduled while a laptop lid is
+        // closed fire during ~2s dark wakes, and the spawned session can then sit
+        // frozen for over an hour before it first executes.
+        ttlSeconds: parseNumber(process.env.PAPERCLIP_AGENT_JWT_TTL_SECONDS, 60 * 60 * 48),
         issuer: process.env.PAPERCLIP_AGENT_JWT_ISSUER ?? "paperclip",
         audience: process.env.PAPERCLIP_AGENT_JWT_AUDIENCE ?? "paperclip-api",
         // The control-plane instance this process belongs to. The live plane runs as
@@ -146,7 +152,7 @@ export function verifyLocalAgentJwt(token) {
     // bounds the legacy window naturally).
     //
     // Operators should set `PAPERCLIP_AGENT_JWT_DISABLE_LEGACY_FALLBACK=true`
-    // approximately one JWT TTL (~1h by default, see PAPERCLIP_AGENT_JWT_TTL_SECONDS)
+    // approximately one JWT TTL (~48h by default, see PAPERCLIP_AGENT_JWT_TTL_SECONDS)
     // after deploying per-company signing. Once set, the master-secret fallback
     // is disabled and only tokens validating under the per-instance/per-company
     // derived key are accepted — closing the window in which a leaked master

package/dist/agent-auth-jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-auth-jwt.js","sourceRoot":"","sources":["../src/agent-auth-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAyB,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAsB7D,MAAM,aAAa,GAAG,OAAO,CAAC;AAE9B,SAAS,WAAW,CAAC,KAAyB,EAAE,QAAgB;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,IAAI,CAAC;AACpG,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACxG,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,OAAO;QACL,MAAM;QACN,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,EAAE,GAAG,EAAE,CAAC;QAC7E,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,WAAW;QAC7D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,eAAe;QACrE,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,UAAU,EAAE,0BAA0B,EAAE;QACxC,qBAAqB,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC;KAChG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,uBAAuB,CAAC,YAAoB,EAAE,SAAiB,EAAE,UAAkB;IAC1F,OAAO,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,UAAU,IAAI,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,YAAoB;IACvD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,SAAiB,EACjB,WAAmB,EACnB,KAAa,EACb,iBAAiC,EACjC,WAA6B,EAAE,IAAI,EAAE,UAAU,EAAE;IAEjD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAwB;QAClC,GAAG,EAAE,OAAO;QACZ,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,KAAK;QACb,mBAAmB,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI;QACtD,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAChE,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,UAAU;QAC5B,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,MAAM,CAAC,QAAQ;QACpB,WAAW,EAAE,MAAM,CAAC,UAAU;KAC/B,CAAC;IAEF,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,KAAK;KACX,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IAC7G,wEAAwE;IACxE,8EAA8E;IAC9E,8CAA8C;IAC9C,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAExD,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAEhD,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,gBAAgB,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACjD,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,uCAAuC;IACvC,EAAE;IACF,0EAA0E;IAC1E,kFAAkF;IAClF,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,8EAA8E;IAC9E,2EAA2E;IAC3E,4DAA4D;IAC5D,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAClG,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC/D,IAAI,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC3D,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACvE,CAAC,CAAC,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACnF,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACnC,CAAC,CAAC,IAAI;QACR,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;QACtD,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC;IAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1D,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,aAAa,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,IAAI,aAAa,IAAI,aAAa,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAEtE,OAAO;QACL,GAAG;QACH,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,KAAK;QACb,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG;QACH,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"agent-auth-jwt.js","sourceRoot":"","sources":["../src/agent-auth-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAyB,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAsB7D,MAAM,aAAa,GAAG,OAAO,CAAC;AAE9B,SAAS,WAAW,CAAC,KAAyB,EAAE,QAAgB;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,IAAI,CAAC;AACpG,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACxG,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,OAAO;QACL,MAAM;QACN,iFAAiF;QACjF,yEAAyE;QACzE,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,oDAAoD;QACpD,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAClF,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,WAAW;QAC7D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,eAAe;QACrE,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,UAAU,EAAE,0BAA0B,EAAE;QACxC,qBAAqB,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC;KAChG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,uBAAuB,CAAC,YAAoB,EAAE,SAAiB,EAAE,UAAkB;IAC1F,OAAO,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,UAAU,IAAI,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,YAAoB;IACvD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,SAAiB,EACjB,WAAmB,EACnB,KAAa,EACb,iBAAiC,EACjC,WAA6B,EAAE,IAAI,EAAE,UAAU,EAAE;IAEjD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAwB;QAClC,GAAG,EAAE,OAAO;QACZ,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,KAAK;QACb,mBAAmB,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI;QACtD,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAChE,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,UAAU;QAC5B,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,MAAM,CAAC,QAAQ;QACpB,WAAW,EAAE,MAAM,CAAC,UAAU;KAC/B,CAAC;IAEF,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,KAAK;KACX,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IAC7G,wEAAwE;IACxE,8EAA8E;IAC9E,8CAA8C;IAC9C,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAExD,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAEhD,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,gBAAgB,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACjD,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,uCAAuC;IACvC,EAAE;IACF,0EAA0E;IAC1E,mFAAmF;IACnF,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,8EAA8E;IAC9E,2EAA2E;IAC3E,4DAA4D;IAC5D,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAClG,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC/D,IAAI,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC3D,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACvE,CAAC,CAAC,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACnF,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACnC,CAAC,CAAC,IAAI;QACR,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;QACtD,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC;IAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1D,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,aAAa,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,IAAI,aAAa,IAAI,aAAa,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAEtE,OAAO;QACL,GAAG;QACH,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,KAAK;QACb,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG;QACH,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;AACJ,CAAC"}

package/dist/app.d.ts

@@ -1,6 +1,7 @@
 import express, { type Request as ExpressRequest } from "express";
+import { type Server as HttpServer } from "node:http";
 import type { Db } from "@paperclipai/db";
-import type { DeploymentExposure, DeploymentMode } from "@paperclipai/shared";
+import { type DeploymentExposure, type DeploymentMode } from "@paperclipai/shared";
 import type { InspectDatabaseBackupHealthOptions } from "./services/database-backup-health.js";
 import type { StorageService } from "./storage/types.js";
 import type { DecisionServiceOptions } from "./services/decisions.js";
@@ -12,6 +13,8 @@ type UiMode = "none" | "static" | "vite-dev";
 export declare function isDatabaseConnectionUnavailableError(err: unknown): boolean;
 export declare function resolveViteHmrPort(serverPort: number): number;
 export declare function resolveViteHmrHost(bindHost: string): string | undefined;
+export declare function resolveViteHmrProtocol(value: string | undefined): "ws" | "wss" | undefined;
+export declare function listenViteHmrServer(server: HttpServer, port: number, bindHost: string): Promise<void>;
 export declare function shouldServeViteDevHtml(req: ExpressRequest): boolean;
 export declare function shouldEnablePrivateHostnameGuard(opts: {
     deploymentMode: DeploymentMode;
@@ -43,6 +46,7 @@ export declare function createApp(db: Db, opts: {
     deploymentExposure: DeploymentExposure;
     allowedHostnames: string[];
     bindHost: string;
+    authPublicBaseUrl?: string;
     authReady: boolean;
     companyDeletionEnabled: boolean;
     instanceId?: string;

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAU,KAAK,OAAO,IAAI,cAAc,EAAE,MAAM,SAAS,CAAC;AAI1E,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAwCzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAQtE,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,uCAAuC,CAAC;AAY/C,OAAO,EAA0C,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAOxG,OAAO,EAA6B,KAAK,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAc1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAMrE,KAAK,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAC;AAqB7C,wBAAgB,oCAAoC,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAI1E;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAK7D;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIvE;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAKnE;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;CACxC,GAAG,OAAO,CAKV;AAED,wBAAgB,wCAAwC,CAAC,KAAK,EAAE;IAC9D,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,aAAa,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC,CAAC;IACnF,SAAS,EAAE,MAAM,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC;CAC1D,GAAG,CAAC,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CA2ElE;AAED,wBAAsB,SAAS,CAC7B,EAAE,EAAE,EAAE,EACN,IAAI,EAAE;IACJ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,qBAAqB,CAAC,EAAE;QACtB,0BAA0B,CAAC,KAAK,CAAC,EAAE;YACjC,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,IAAI,CAAC;SACZ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACtB,CAAC;IACF,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD,oBAAoB,CAAC,EAAE,kCAAkC,CAAC;IAC1D,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,sBAAsB,EAAE,OAAO,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,EAAE,CAAC;IACvB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,iBAAiB,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC;IAC3C,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAClF;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACpD,yDAAyD;IACzD,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC,wDA6dF"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAU,KAAK,OAAO,IAAI,cAAc,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAoC,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAC;AAIxF,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAA8B,KAAK,kBAAkB,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC/G,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAyDzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAQtE,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,uCAAuC,CAAC;AAY/C,OAAO,EAA0C,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAOxG,OAAO,EAA6B,KAAK,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAc1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAMrE,KAAK,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAC;AAqB7C,wBAAgB,oCAAoC,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAI1E;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUvE;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,KAAK,GAAG,SAAS,CAI1F;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcrG;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAKnE;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;CACxC,GAAG,OAAO,CAKV;AAED,wBAAgB,wCAAwC,CAAC,KAAK,EAAE;IAC9D,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,aAAa,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC,CAAC;IACnF,SAAS,EAAE,MAAM,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC;CAC1D,GAAG,CAAC,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CA2ElE;AAED,wBAAsB,SAAS,CAC7B,EAAE,EAAE,EAAE,EACN,IAAI,EAAE;IACJ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,qBAAqB,CAAC,EAAE;QACtB,0BAA0B,CAAC,KAAK,CAAC,EAAE;YACjC,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,IAAI,CAAC;SACZ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACtB,CAAC;IACF,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD,oBAAoB,CAAC,EAAE,kCAAkC,CAAC;IAC1D,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,sBAAsB,EAAE,OAAO,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,EAAE,CAAC;IACvB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,iBAAiB,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC;IAC3C,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAClF;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACpD,yDAAyD;IACzD,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC,wDAkoBF"}

package/dist/app.js

@@ -1,12 +1,16 @@
 import express, { Router } from "express";
+import { createServer as createHttpServer } from "node:http";
 import path from "node:path";
 import fs from "node:fs";
 import { fileURLToPath } from "node:url";
+import { derivePaperclipViteHmrPort } from "@paperclipai/shared";
 import { httpLogger, errorHandler } from "./middleware/index.js";
 import { actorMiddleware } from "./middleware/auth.js";
 import { boardMutationGuard } from "./middleware/board-mutation-guard.js";
 import { privateHostnameGuard, resolvePrivateHostnameAllowSet } from "./middleware/private-hostname-guard.js";
 import { applyTrustProxy, parseTrustProxyEnv } from "./middleware/trust-proxy.js";
+import { IMPORT_TRANSFER_SPOOL_SWEEP_INTERVAL_MS, resolveDefaultImportTransferSpoolRoot, sweepAbandonedImportTransferSpools, } from "./services/company-import-transfers.js";
+import { companyTransferRunService } from "./services/company-transfer-runs.js";
 import { healthRoutes } from "./routes/health.js";
 import { cloudRoutes } from "./routes/cloud.js";
 import { companyRoutes } from "./routes/companies.js";
@@ -19,6 +23,9 @@ import { summarySlotRoutes } from "./routes/summary-slots.js";
 import { statusCardRoutes } from "./routes/status-cards.js";
 import { teamsCatalogRoutes } from "./routes/teams-catalog.js";
 import { agentRoutes } from "./routes/agents.js";
+import { buildSetupTokenLoginTransport, createProductionSetupTokenSandboxProvider, createProductionSetupTokenCleanupStore, createSetupTokenSecretWriter, createWorkerBoundSetupTokenPtyOpener, } from "./services/setup-token-transport-binding.js";
+import { environmentService } from "./services/environments.js";
+import { environmentRuntimeService } from "./services/environment-runtime.js";
 import { projectRoutes } from "./routes/projects.js";
 import { issueRoutes } from "./routes/issues.js";
 import { issueTreeControlRoutes } from "./routes/issue-tree-control.js";
@@ -29,6 +36,7 @@ import { pipelineRoutes } from "./routes/pipelines.js";
 import { environmentRoutes } from "./routes/environments.js";
 import { executionWorkspaceRoutes } from "./routes/execution-workspaces.js";
 import { goalRoutes } from "./routes/goals.js";
+import { onboardingSeedRoutes } from "./routes/onboarding-seed.js";
 import { boardChatRoutes } from "./routes/board-chat.js";
 import { approvalRoutes } from "./routes/approvals.js";
 import { secretRoutes } from "./routes/secrets.js";
@@ -106,17 +114,40 @@ export function isDatabaseConnectionUnavailableError(err) {
     return Boolean(error?.cause && isDatabaseConnectionUnavailableError(error.cause));
 }
 export function resolveViteHmrPort(serverPort) {
-    if (serverPort <= 55_535) {
-        return serverPort + 10_000;
-    }
-    return Math.max(1_024, serverPort - 10_000);
+    return derivePaperclipViteHmrPort(serverPort);
 }
 export function resolveViteHmrHost(bindHost) {
     const normalized = bindHost.trim().toLowerCase();
-    if (normalized === "0.0.0.0" || normalized === "::")
+    if (normalized === "0.0.0.0"
+        || normalized === "::"
+        || normalized === "127.0.0.1"
+        || normalized === "::1"
+        || normalized === "localhost")
         return undefined;
     return bindHost;
 }
+export function resolveViteHmrProtocol(value) {
+    if (!value)
+        return undefined;
+    if (value === "ws" || value === "wss")
+        return value;
+    throw new Error("PAPERCLIP_VITE_HMR_PROTOCOL must be ws or wss");
+}
+export function listenViteHmrServer(server, port, bindHost) {
+    return new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.off("listening", onListening);
+            reject(error);
+        };
+        const onListening = () => {
+            server.off("error", onError);
+            resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, bindHost);
+    });
+}
 export function shouldServeViteDevHtml(req) {
     const pathname = req.path;
     if (VITE_DEV_STATIC_PATHS.has(pathname))
@@ -287,7 +318,82 @@ export async function createApp(db, opts) {
     api.use(summarySlotRoutes(db));
     api.use(statusCardRoutes(db));
     api.use(teamsCatalogRoutes(db));
-    api.use(agentRoutes(db, { pluginWorkerManager: workerManager }));
+    // The setup-token login session service. The router builds it and hands it
+    // back through the callback below, so the shutdown hook can cancel every live
+    // session (SR-4).
+    let setupTokenLoginService = null;
+    // The dedicated proxy IP or CIDR allowlist for the confidential setup-token
+    // login responses (SR-7). The global `TRUST_PROXY` setting does not satisfy
+    // the guard; an operator sets this allowlist to the real TLS-terminating
+    // proxy addresses. An empty value keeps the confidential responses on direct
+    // TLS (or a `local_trusted` loopback peer) only.
+    const setupTokenLoginProxyAllowlist = (process.env.CLAUDE_LOGIN_TRUSTED_PROXIES ?? "")
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+    // The explicit operator declaration that a platform edge terminates TLS for
+    // every client request (SR-7). This complements the allowlist for managed
+    // platforms (Railway, Render, Fly, and the like) where the app socket is
+    // always plain HTTP and the edge-proxy peer addresses are not stable or
+    // documented, so `CLAUDE_LOGIN_TRUSTED_PROXIES` cannot express them. It is a
+    // dedicated, single-purpose setting; the guard still never reads the global
+    // `TRUST_PROXY` value.
+    const setupTokenLoginEdgeTlsTerminated = /^(1|true|yes|on)$/i.test((process.env.CLAUDE_LOGIN_EDGE_TLS_TERMINATED ?? "").trim());
+    // Bind the production setup-token login transport. It carries the live lease
+    // manager, the login-process factory over the sandbox pseudo-terminal, and the
+    // durable cleanup store. The factory passes only the fixed command
+    // `CLAUDE_SETUP_TOKEN_COMMAND`; it never reads a command from a
+    // route, a request body, or an adapter configuration. The durable store and the
+    // startup reaper are live now, so a restart reaps a leftover lease.
+    //
+    // The live sandbox pseudo-terminal opener binds inside the sandbox provider
+    // worker, so the server process does not hold the raw sandbox process. The
+    // opener drives the worker through the plugin worker manager route gate.
+    // The manager mints a host-owned route identifier, permits one
+    // active credential pseudo-terminal per worker, binds the worker session
+    // identifier one time for output only, and terminalizes the route on every open
+    // failure path. With the opener supplied, the provider acquires a lease and the
+    // start route drives a live login instead of the fixed 503.
+    const setupTokenLoginTransport = buildSetupTokenLoginTransport({
+        sandbox: createProductionSetupTokenSandboxProvider({
+            environments: environmentService(db),
+            environmentRuntime: environmentRuntimeService(db, { pluginWorkerManager: workerManager }),
+            openLivePtySession: createWorkerBoundSetupTokenPtyOpener({
+                workerManager,
+                environments: environmentService(db),
+                log: (line) => logger.info(line),
+            }),
+            log: (line) => logger.info(line),
+        }),
+        store: createProductionSetupTokenCleanupStore(db),
+        // Bind the atomic credential-claim writer, so a completed login transitions
+        // the durable row to `stored` and stores the minted token in one control-plane
+        // transaction. The writer reads the company and the owner only from the
+        // immutable session scope. The confirm-replacement flow owns rotation. Without
+        // this writer the router falls back to the deferred, fail-closed 503 and never
+        // stores the token.
+        completeCredential: createSetupTokenSecretWriter({ db }),
+        // Forward the login runner diagnostic lines to the server logger. The
+        // runner is the sole producer, and every line is a fixed, non-secret
+        // literal. Without this sink the diagnostics fall back to a no-op in
+        // production, so a failed login leaves no log trail.
+        log: (line) => logger.info(line),
+    });
+    api.use(agentRoutes(db, {
+        pluginWorkerManager: workerManager,
+        deploymentMode: opts.deploymentMode,
+        confidentialProxyAllowlist: setupTokenLoginProxyAllowlist,
+        confidentialEdgeTlsTerminated: setupTokenLoginEdgeTlsTerminated,
+        setupTokenLogin: setupTokenLoginTransport,
+        onSetupTokenLoginService: (service) => {
+            setupTokenLoginService = service;
+            // Startup reaper (SR-4): release any lease whose login session is
+            // terminal or past its deadline after a restart. The DB is ready here.
+            void service.reap().catch((err) => {
+                logger.error({ err }, "Setup-token login startup reaper failed");
+            });
+        },
+    }));
     api.use(assetRoutes(db, opts.storageService));
     api.use(projectRoutes(db));
     api.use(caseRoutes(db, opts.storageService));
@@ -306,6 +412,7 @@ export async function createApp(db, opts) {
     }));
     api.use(executionWorkspaceRoutes(db, { pluginWorkerManager: workerManager }));
     api.use(goalRoutes(db));
+    api.use(onboardingSeedRoutes(db));
     api.use(boardChatRoutes(db, { deploymentMode: opts.deploymentMode }));
     api.use(approvalRoutes(db, { pluginWorkerManager: workerManager }));
     api.use(secretRoutes(db));
@@ -376,6 +483,8 @@ export async function createApp(db, opts) {
     });
     const hostServiceCleanup = createPluginHostServiceCleanup(lifecycle, hostServicesDisposers);
     let viteHtmlRenderer = null;
+    let viteDevServer = null;
+    let viteHmrServer = null;
     const loader = pluginLoader(db, {
         localPluginDir: opts.localPluginDir ?? DEFAULT_LOCAL_PLUGIN_DIR,
         migrationDb: opts.pluginMigrationDb,
@@ -419,6 +528,7 @@ export async function createApp(db, opts) {
         deploymentExposure: opts.deploymentExposure,
         bindHost: opts.bindHost,
         allowedHostnames: opts.allowedHostnames,
+        authPublicBaseUrl: opts.authPublicBaseUrl,
     }));
     app.use("/api", api);
     app.use("/api", (_req, res) => {
@@ -482,20 +592,40 @@ export async function createApp(db, opts) {
         const publicUiRoot = path.resolve(uiRoot, "public");
         const hmrPort = resolveViteHmrPort(opts.serverPort);
         const hmrHost = resolveViteHmrHost(opts.bindHost);
+        const hmrProtocol = resolveViteHmrProtocol(process.env.PAPERCLIP_VITE_HMR_PROTOCOL);
+        const hmrServer = createHttpServer((_req, res) => {
+            res.writeHead(426, { "Content-Type": "text/plain" });
+            res.end("Upgrade Required");
+        });
         const { createServer: createViteServer } = await import("vite");
         const vite = await createViteServer({
             root: uiRoot,
             appType: "custom",
             server: {
+                // Listener binding and browser HMR hostname are deliberately separate:
+                // exposed branch runtimes stay loopback-only while the browser uses the
+                // current MagicDNS hostname through the broker's HTTPS listener.
+                host: opts.bindHost,
                 middlewareMode: true,
                 hmr: {
+                    server: hmrServer,
                     ...(hmrHost ? { host: hmrHost } : {}),
+                    ...(hmrProtocol ? { protocol: hmrProtocol } : {}),
                     port: hmrPort,
                     clientPort: hmrPort,
                 },
                 allowedHosts: privateHostnameGateEnabled ? Array.from(privateHostnameAllowSet) : undefined,
             },
         });
+        try {
+            await listenViteHmrServer(hmrServer, hmrPort, opts.bindHost);
+        }
+        catch (error) {
+            await vite.close();
+            throw error;
+        }
+        viteDevServer = vite;
+        viteHmrServer = hmrServer;
         viteHtmlRenderer = createCachedViteHtmlRenderer({
             vite,
             uiRoot,
@@ -556,6 +686,42 @@ export async function createApp(db, opts) {
     if (opts.feedbackExportService) {
         void flushPendingFeedbackExports();
     }
+    // Abandoned chunked-import spool sweep: hourly (plus once at startup),
+    // deleting spool dirs whose transfer saw no activity for 24h and cancelling
+    // their still-open ledger runs. Same setInterval + unref + shutdown-clear
+    // shape as the feedback export flush above.
+    const importTransferSpoolRoot = resolveDefaultImportTransferSpoolRoot();
+    const sweepImportTransferSpools = () => {
+        sweepAbandonedImportTransferSpools(db, importTransferSpoolRoot)
+            .then((result) => {
+            if (result.swept > 0) {
+                logger.info(result, "swept abandoned company import transfer spools");
+            }
+        })
+            .catch((err) => {
+            logger.error({ err }, "abandoned company import transfer spool sweep failed");
+        });
+    };
+    let importTransferSweepTimer = setInterval(sweepImportTransferSpools, IMPORT_TRANSFER_SPOOL_SWEEP_INTERVAL_MS);
+    importTransferSweepTimer.unref?.();
+    // Startup only (never on the hourly interval — that would kill live
+    // applies): apply jobs are in-memory in this single process, so any run
+    // still "applying" now was interrupted by the previous shutdown and would
+    // otherwise 409 every retry forever. Fail those stranded runs — their
+    // spooled parts stay reusable — then run the normal sweep once.
+    void companyTransferRunService
+        .recoverStrandedApplyingRuns(db)
+        .then((recovered) => {
+        if (recovered.length > 0) {
+            logger.warn({ count: recovered.length, runIds: recovered }, "failed company transfer runs stranded in applying by a restart");
+        }
+    })
+        .catch((err) => {
+        logger.error({ err }, "stranded company transfer apply recovery failed");
+    })
+        .finally(() => {
+        sweepImportTransferSpools();
+    });
     void toolDispatcher.initialize().catch((err) => {
         logger.error({ err }, "Failed to initialize plugin tool dispatcher");
     });
@@ -610,19 +776,40 @@ export async function createApp(db, opts) {
         logger.error({ err }, "Failed to load ready plugins on startup");
     });
     app.locals.bundledPluginsStartup = bundledPluginsStartup;
-    let appServicesShutdown = false;
+    // The shutdown hook runs at most once. It caches the in-flight promise, so a
+    // second caller (for example the `exit` handler) awaits the same completion
+    // instead of starting a second teardown.
+    let appServicesShutdown = null;
     const shutdownAppServices = () => {
         if (appServicesShutdown)
-            return;
-        appServicesShutdown = true;
-        disableFeedbackExportFlushes();
-        devWatcher?.close();
-        viteHtmlRenderer?.dispose();
-        hostServiceCleanup.disposeAll();
-        hostServiceCleanup.teardown();
+            return appServicesShutdown;
+        appServicesShutdown = (async () => {
+            disableFeedbackExportFlushes();
+            if (importTransferSweepTimer) {
+                clearInterval(importTransferSweepTimer);
+                importTransferSweepTimer = null;
+            }
+            devWatcher?.close();
+            viteHtmlRenderer?.dispose();
+            void viteDevServer?.close().catch(() => undefined);
+            viteHmrServer?.close();
+            hostServiceCleanup.disposeAll();
+            hostServiceCleanup.teardown();
+            // Cancel every live setup-token login session and AWAIT the cancellation,
+            // so each direct child stops and the server releases each lease before the
+            // caller stops the database and the provider. A lease release that
+            // fails stays a durable record for the startup reaper.
+            await setupTokenLoginService?.shutdown();
+        })();
+        return appServicesShutdown;
     };
     app.locals.paperclipShutdown = shutdownAppServices;
-    process.once("exit", shutdownAppServices);
+    // The `exit` event is synchronous. It cannot await the teardown, so it runs
+    // the best-effort cleanup and drops the returned promise. The orderly signal
+    // path awaits `shutdownAppServices` in full before the process exits.
+    process.once("exit", () => {
+        void shutdownAppServices();
+    });
     process.once("beforeExit", () => {
         void flushPluginLogBuffer();
     });