@paperclipai/server 2026.824.1 → 2026.825.0-beta.1

package/dist/auth/workspace-login-handoff.d.ts

@@ -0,0 +1,189 @@
+/**
+ * Signed workspace login handoff (PAP-17572).
+ *
+ * A board user opening a managed workspace must not have to know which cloned
+ * password is current. The authenticated main control plane mints a short-lived,
+ * single-use ticket; the isolated workspace verifies it against its own copy of
+ * the signing key and creates its own instance-scoped session.
+ *
+ * Threat model notes that drive the shape below:
+ *
+ *  - **Nothing browser-supplied is trusted.** The audience is the origin the
+ *    control plane published for that runtime and the workspace compares it
+ *    against its *configured* public origin. `Host`, `X-Forwarded-Host`,
+ *    `X-Forwarded-Proto` and Tailscale identity headers are never consulted, so
+ *    a spoofed forwarded header cannot retarget or authorize a ticket.
+ *  - **Keys are per workspace.** The control plane keeps the root secret and
+ *    hands each guest only `HMAC(root, instanceId|executionWorkspaceId)`. A
+ *    compromised workspace therefore cannot mint a ticket for a sibling
+ *    workspace, and the guest never sees material that would let it do so.
+ *  - **Replay is bounded twice.** A short expiry limits the window and the
+ *    workspace records the nonce on first use, so a captured ticket cannot be
+ *    exchanged a second time even inside that window.
+ */
+/** Ticket envelope version. Bumped whenever the signed payload shape changes. */
+export declare const WORKSPACE_HANDOFF_TICKET_VERSION = "wh1";
+/**
+ * Default ticket lifetime. Long enough for a click plus a cold guest response,
+ * short enough that a ticket leaked through a proxy log is worthless.
+ */
+export declare const WORKSPACE_HANDOFF_TICKET_TTL_SECONDS = 90;
+/** Tolerated clock skew between the control plane and the isolated workspace. */
+export declare const WORKSPACE_HANDOFF_CLOCK_SKEW_SECONDS = 30;
+/** Path the guest exposes for the exchange, relative to the Better Auth mount. */
+export declare const WORKSPACE_HANDOFF_EXCHANGE_PATH = "/workspace-handoff/exchange";
+/** Query parameter carrying the ticket. Redacted from request logs by name. */
+export declare const WORKSPACE_HANDOFF_TICKET_QUERY_PARAM = "ticket";
+export declare const WORKSPACE_HANDOFF_KEY_ENV_KEY = "PAPERCLIP_WORKSPACE_HANDOFF_KEY";
+export declare const WORKSPACE_READINESS_TOKEN_ENV_KEY = "PAPERCLIP_WORKSPACE_READINESS_TOKEN";
+export declare const WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY = "PAPERCLIP_EXECUTION_WORKSPACE_ID";
+export declare const WORKSPACE_EXECUTION_WORKSPACE_COMPANY_ID_ENV_KEY = "PAPERCLIP_EXECUTION_WORKSPACE_COMPANY_ID";
+export declare const WORKSPACE_READINESS_TOKEN_HEADER = "x-paperclip-workspace-readiness-token";
+export declare const WORKSPACE_READINESS_USER_ID_HEADER = "x-paperclip-workspace-readiness-user-id";
+export declare const WORKSPACE_READINESS_USER_EMAIL_HEADER = "x-paperclip-workspace-readiness-user-email";
+export type WorkspaceHandoffTicketPayload = {
+    /** Envelope version. */
+    v: typeof WORKSPACE_HANDOFF_TICKET_VERSION;
+    /** Single-use nonce; the guest records it on first exchange. */
+    jti: string;
+    /** Cloned user id the guest must sign in. */
+    sub: string;
+    /** Expected email of that cloned user, compared case-insensitively. */
+    email: string;
+    /** Execution workspace the ticket is scoped to. */
+    ws: string;
+    /**
+     * Company whose board this workspace represents.
+     *
+     * Bound because "the cloned user has *some* active membership" is not the
+     * question worth asking: a multi-company clone can satisfy it while leaving the
+     * signed-in user with no access to the company they were opening, which lands
+     * them on an empty board with no explanation.
+     */
+    cid: string;
+    /** Isolated instance id the ticket is scoped to. */
+    iid: string;
+    /** Origin the control plane published for this runtime. */
+    aud: string;
+    /** Issuing instance id, recorded for audit. */
+    iss: string;
+    /** Seconds since epoch. */
+    iat: number;
+    exp: number;
+    /** Relative path to land on after the exchange. */
+    next: string;
+};
+export type WorkspaceHandoffVerificationFailure = "not_configured" | "malformed" | "unsupported_version" | "bad_signature" | "expired" | "not_yet_valid" | "origin_mismatch" | "instance_mismatch" | "workspace_mismatch" | "company_mismatch";
+export type WorkspaceHandoffVerificationResult = {
+    ok: true;
+    payload: WorkspaceHandoffTicketPayload;
+} | {
+    ok: false;
+    reason: WorkspaceHandoffVerificationFailure;
+};
+/**
+ * Normalize an origin for comparison: scheme + host + explicit non-default port.
+ * Returns null when the input is not an absolute http(s) URL, so an unparseable
+ * or relative value can never accidentally compare equal.
+ */
+export declare function normalizeWorkspaceHandoffOrigin(value: string | null | undefined): string | null;
+/**
+ * Reduce a caller-supplied landing target to a safe same-origin path.
+ *
+ * Anything absolute, protocol-relative, or backslash-escaped collapses to `/`.
+ * A handoff must never double as an open redirect.
+ */
+export declare function sanitizeWorkspaceHandoffRedirectPath(value: string | null | undefined): string;
+/**
+ * Derive the per-workspace signing key handed to one guest instance.
+ *
+ * Domain-separated from every other use of the root secret and bound to both
+ * identities, so a key only ever validates tickets for the exact workspace it
+ * was issued to.
+ */
+export declare function deriveWorkspaceHandoffKey(input: {
+    rootSecret: string;
+    instanceId: string;
+    executionWorkspaceId: string;
+}): string;
+/**
+ * Derive the bearer token the control plane presents to read a guest's
+ * protected readiness. Separate derivation from {@link deriveWorkspaceHandoffKey}
+ * so a probe token that leaks through an HTTP client log cannot sign tickets.
+ */
+export declare function deriveWorkspaceReadinessToken(input: {
+    rootSecret: string;
+    instanceId: string;
+    executionWorkspaceId: string;
+}): string;
+/**
+ * Root secret for handoff key derivation, on the control-plane side only.
+ *
+ * A dedicated `PAPERCLIP_WORKSPACE_HANDOFF_SECRET` is preferred. When it is
+ * absent we derive dedicated key material from the instance's existing signing
+ * secret rather than disabling the feature: the alternative is that every
+ * already-deployed instance silently falls back to "remember the cloned
+ * password", which is the defect this work exists to remove. The derivation is
+ * one-way and domain-separated, so the handoff key is never equal to — and
+ * cannot be used to recover — the secret it came from.
+ */
+export declare function resolveWorkspaceHandoffRootSecret(env?: NodeJS.ProcessEnv): {
+    secret: string;
+    source: "dedicated" | "derived";
+} | null;
+/** The verification key injected into this (guest) process, when present. */
+export declare function resolveWorkspaceHandoffLocalKey(env?: NodeJS.ProcessEnv): string | null;
+/** The readiness-probe token injected into this (guest) process, when present. */
+export declare function resolveWorkspaceReadinessLocalToken(env?: NodeJS.ProcessEnv): string | null;
+/** The execution workspace this (guest) process was provisioned for. */
+export declare function resolveWorkspaceHandoffLocalWorkspaceId(env?: NodeJS.ProcessEnv): string | null;
+/** The company whose board this (guest) workspace represents. */
+export declare function resolveWorkspaceHandoffLocalCompanyId(env?: NodeJS.ProcessEnv): string | null;
+export declare function issueWorkspaceHandoffTicket(input: {
+    key: string;
+    userId: string;
+    email: string;
+    executionWorkspaceId: string;
+    companyId: string;
+    instanceId: string;
+    origin: string;
+    issuerInstanceId: string;
+    next?: string | null;
+    ttlSeconds?: number;
+    now?: Date;
+    nonce?: string;
+}): {
+    ticket: string;
+    payload: WorkspaceHandoffTicketPayload;
+};
+/** Absolute exchange URL for a minted ticket. */
+export declare function buildWorkspaceHandoffExchangeUrl(input: {
+    origin: string;
+    ticket: string;
+}): string;
+/**
+ * Verify a ticket against this workspace's own key and identity.
+ *
+ * `expected` must come from persisted configuration. Passing header-derived
+ * values would reintroduce exactly the spoofing path this design closes.
+ */
+export declare function verifyWorkspaceHandoffTicket(input: {
+    ticket: string | null | undefined;
+    key: string | null | undefined;
+    expected: {
+        instanceId: string | null;
+        executionWorkspaceId: string | null;
+        companyId: string | null;
+        origin: string | null;
+    };
+    now?: Date;
+    clockSkewSeconds?: number;
+}): WorkspaceHandoffVerificationResult;
+/** Verification-key identifier safe to log: proves which key, reveals no key bytes. */
+export declare function workspaceHandoffKeyFingerprint(key: string): string;
+/**
+ * Strip the ticket from a URL or URL-ish string before it reaches a log sink.
+ * Applied by the request logger and by the guest's own audit records.
+ */
+export declare function redactWorkspaceHandoffTicket(value: string): string;
+//# sourceMappingURL=workspace-login-handoff.d.ts.map

package/dist/auth/workspace-login-handoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-login-handoff.d.ts","sourceRoot":"","sources":["../../src/auth/workspace-login-handoff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,iFAAiF;AACjF,eAAO,MAAM,gCAAgC,QAAQ,CAAC;AAEtD;;;GAGG;AACH,eAAO,MAAM,oCAAoC,KAAK,CAAC;AAEvD,iFAAiF;AACjF,eAAO,MAAM,oCAAoC,KAAK,CAAC;AAEvD,kFAAkF;AAClF,eAAO,MAAM,+BAA+B,gCAAgC,CAAC;AAE7E,+EAA+E;AAC/E,eAAO,MAAM,oCAAoC,WAAW,CAAC;AAQ7D,eAAO,MAAM,6BAA6B,oCAAkB,CAAC;AAC7D,eAAO,MAAM,iCAAiC,wCAAsB,CAAC;AACrE,eAAO,MAAM,wCAAwC,qCAA6B,CAAC;AACnF,eAAO,MAAM,gDAAgD,6CAAqC,CAAC;AACnG,eAAO,MAAM,gCAAgC,0CAA0C,CAAC;AACxF,eAAO,MAAM,kCAAkC,4CAA4C,CAAC;AAC5F,eAAO,MAAM,qCAAqC,+CAA+C,CAAC;AAElG,MAAM,MAAM,6BAA6B,GAAG;IAC1C,wBAAwB;IACxB,CAAC,EAAE,OAAO,gCAAgC,CAAC;IAC3C,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX;;;;;;;OAOG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,mCAAmC,GAC3C,gBAAgB,GAChB,WAAW,GACX,qBAAqB,GACrB,eAAe,GACf,SAAS,GACT,eAAe,GACf,iBAAiB,GACjB,mBAAmB,GACnB,oBAAoB,GACpB,kBAAkB,CAAC;AAEvB,MAAM,MAAM,kCAAkC,GAC1C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,6BAA6B,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mCAAmC,CAAA;CAAE,CAAC;AAwB/D;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAW/F;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAS7F;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB,EAAE,MAAM,CAAC;CAC9B,GAAG,MAAM,CAMT;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB,EAAE,MAAM,CAAC;CAC9B,GAAG,MAAM,CAMT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAA;CAAE,GAAG,IAAI,CAY5D;AAED,6EAA6E;AAC7E,wBAAgB,+BAA+B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAEnG;AAED,kFAAkF;AAClF,wBAAgB,mCAAmC,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAEvG;AAED,wEAAwE;AACxE,wBAAgB,uCAAuC,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAE3G;AAED,iEAAiE;AACjE,wBAAgB,qCAAqC,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAEzG;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB,EAAE,MAAM,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,6BAA6B,CAAA;CAAE,CA0B7D;AAED,iDAAiD;AACjD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAMlG;AAoBD;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/B,QAAQ,EAAE;QACR,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,CAAC;IACF,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,kCAAkC,CAwDrC;AAED,uFAAuF;AACvF,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlE"}

package/dist/auth/workspace-login-handoff.js

@@ -0,0 +1,319 @@
+/**
+ * Signed workspace login handoff (PAP-17572).
+ *
+ * A board user opening a managed workspace must not have to know which cloned
+ * password is current. The authenticated main control plane mints a short-lived,
+ * single-use ticket; the isolated workspace verifies it against its own copy of
+ * the signing key and creates its own instance-scoped session.
+ *
+ * Threat model notes that drive the shape below:
+ *
+ *  - **Nothing browser-supplied is trusted.** The audience is the origin the
+ *    control plane published for that runtime and the workspace compares it
+ *    against its *configured* public origin. `Host`, `X-Forwarded-Host`,
+ *    `X-Forwarded-Proto` and Tailscale identity headers are never consulted, so
+ *    a spoofed forwarded header cannot retarget or authorize a ticket.
+ *  - **Keys are per workspace.** The control plane keeps the root secret and
+ *    hands each guest only `HMAC(root, instanceId|executionWorkspaceId)`. A
+ *    compromised workspace therefore cannot mint a ticket for a sibling
+ *    workspace, and the guest never sees material that would let it do so.
+ *  - **Replay is bounded twice.** A short expiry limits the window and the
+ *    workspace records the nonce on first use, so a captured ticket cannot be
+ *    exchanged a second time even inside that window.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+/** Ticket envelope version. Bumped whenever the signed payload shape changes. */
+export const WORKSPACE_HANDOFF_TICKET_VERSION = "wh1";
+/**
+ * Default ticket lifetime. Long enough for a click plus a cold guest response,
+ * short enough that a ticket leaked through a proxy log is worthless.
+ */
+export const WORKSPACE_HANDOFF_TICKET_TTL_SECONDS = 90;
+/** Tolerated clock skew between the control plane and the isolated workspace. */
+export const WORKSPACE_HANDOFF_CLOCK_SKEW_SECONDS = 30;
+/** Path the guest exposes for the exchange, relative to the Better Auth mount. */
+export const WORKSPACE_HANDOFF_EXCHANGE_PATH = "/workspace-handoff/exchange";
+/** Query parameter carrying the ticket. Redacted from request logs by name. */
+export const WORKSPACE_HANDOFF_TICKET_QUERY_PARAM = "ticket";
+const HANDOFF_KEY_ENV = "PAPERCLIP_WORKSPACE_HANDOFF_KEY";
+const HANDOFF_ROOT_SECRET_ENV = "PAPERCLIP_WORKSPACE_HANDOFF_SECRET";
+const READINESS_TOKEN_ENV = "PAPERCLIP_WORKSPACE_READINESS_TOKEN";
+const EXECUTION_WORKSPACE_ID_ENV = "PAPERCLIP_EXECUTION_WORKSPACE_ID";
+const EXECUTION_WORKSPACE_COMPANY_ID_ENV = "PAPERCLIP_EXECUTION_WORKSPACE_COMPANY_ID";
+export const WORKSPACE_HANDOFF_KEY_ENV_KEY = HANDOFF_KEY_ENV;
+export const WORKSPACE_READINESS_TOKEN_ENV_KEY = READINESS_TOKEN_ENV;
+export const WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY = EXECUTION_WORKSPACE_ID_ENV;
+export const WORKSPACE_EXECUTION_WORKSPACE_COMPANY_ID_ENV_KEY = EXECUTION_WORKSPACE_COMPANY_ID_ENV;
+export const WORKSPACE_READINESS_TOKEN_HEADER = "x-paperclip-workspace-readiness-token";
+export const WORKSPACE_READINESS_USER_ID_HEADER = "x-paperclip-workspace-readiness-user-id";
+export const WORKSPACE_READINESS_USER_EMAIL_HEADER = "x-paperclip-workspace-readiness-user-email";
+function base64UrlEncode(value) {
+    return value.toString("base64url");
+}
+function base64UrlDecode(value) {
+    // `Buffer.from` silently drops invalid characters, so round-trip to prove the
+    // input really was canonical base64url before trusting the bytes.
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        return null;
+    const decoded = Buffer.from(value, "base64url");
+    if (decoded.length === 0)
+        return null;
+    return base64UrlEncode(decoded) === value ? decoded : null;
+}
+function sign(key, message) {
+    return createHmac("sha256", key).update(message).digest();
+}
+function constantTimeMatches(expected, provided) {
+    if (expected.length !== provided.length)
+        return false;
+    return timingSafeEqual(expected, provided);
+}
+/**
+ * Normalize an origin for comparison: scheme + host + explicit non-default port.
+ * Returns null when the input is not an absolute http(s) URL, so an unparseable
+ * or relative value can never accidentally compare equal.
+ */
+export function normalizeWorkspaceHandoffOrigin(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:")
+        return null;
+    return parsed.origin;
+}
+/**
+ * Reduce a caller-supplied landing target to a safe same-origin path.
+ *
+ * Anything absolute, protocol-relative, or backslash-escaped collapses to `/`.
+ * A handoff must never double as an open redirect.
+ */
+export function sanitizeWorkspaceHandoffRedirectPath(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return "/";
+    if (!trimmed.startsWith("/"))
+        return "/";
+    // `//host` and `/\host` are both browser-recognized protocol-relative forms.
+    if (trimmed.startsWith("//") || trimmed.startsWith("/\\"))
+        return "/";
+    // Control characters and raw whitespace can split a `Location` header.
+    if (/[\u0000-\u0020\u007f]/.test(trimmed))
+        return "/";
+    return trimmed;
+}
+/**
+ * Derive the per-workspace signing key handed to one guest instance.
+ *
+ * Domain-separated from every other use of the root secret and bound to both
+ * identities, so a key only ever validates tickets for the exact workspace it
+ * was issued to.
+ */
+export function deriveWorkspaceHandoffKey(input) {
+    return createHmac("sha256", input.rootSecret)
+        .update(`paperclip.workspace-login-handoff.${WORKSPACE_HANDOFF_TICKET_VERSION}\n`)
+        .update(`${input.instanceId}\n`)
+        .update(`${input.executionWorkspaceId}`)
+        .digest("hex");
+}
+/**
+ * Derive the bearer token the control plane presents to read a guest's
+ * protected readiness. Separate derivation from {@link deriveWorkspaceHandoffKey}
+ * so a probe token that leaks through an HTTP client log cannot sign tickets.
+ */
+export function deriveWorkspaceReadinessToken(input) {
+    return createHmac("sha256", input.rootSecret)
+        .update(`paperclip.workspace-readiness-probe.${WORKSPACE_HANDOFF_TICKET_VERSION}\n`)
+        .update(`${input.instanceId}\n`)
+        .update(`${input.executionWorkspaceId}`)
+        .digest("hex");
+}
+/**
+ * Root secret for handoff key derivation, on the control-plane side only.
+ *
+ * A dedicated `PAPERCLIP_WORKSPACE_HANDOFF_SECRET` is preferred. When it is
+ * absent we derive dedicated key material from the instance's existing signing
+ * secret rather than disabling the feature: the alternative is that every
+ * already-deployed instance silently falls back to "remember the cloned
+ * password", which is the defect this work exists to remove. The derivation is
+ * one-way and domain-separated, so the handoff key is never equal to — and
+ * cannot be used to recover — the secret it came from.
+ */
+export function resolveWorkspaceHandoffRootSecret(env = process.env) {
+    const dedicated = env[HANDOFF_ROOT_SECRET_ENV]?.trim();
+    if (dedicated)
+        return { secret: dedicated, source: "dedicated" };
+    const fallback = env.BETTER_AUTH_SECRET?.trim() || env.PAPERCLIP_AGENT_JWT_SECRET?.trim();
+    if (!fallback)
+        return null;
+    return {
+        secret: createHmac("sha256", fallback)
+            .update(`paperclip.workspace-login-handoff.root.${WORKSPACE_HANDOFF_TICKET_VERSION}`)
+            .digest("hex"),
+        source: "derived",
+    };
+}
+/** The verification key injected into this (guest) process, when present. */
+export function resolveWorkspaceHandoffLocalKey(env = process.env) {
+    return env[HANDOFF_KEY_ENV]?.trim() || null;
+}
+/** The readiness-probe token injected into this (guest) process, when present. */
+export function resolveWorkspaceReadinessLocalToken(env = process.env) {
+    return env[READINESS_TOKEN_ENV]?.trim() || null;
+}
+/** The execution workspace this (guest) process was provisioned for. */
+export function resolveWorkspaceHandoffLocalWorkspaceId(env = process.env) {
+    return env[EXECUTION_WORKSPACE_ID_ENV]?.trim() || null;
+}
+/** The company whose board this (guest) workspace represents. */
+export function resolveWorkspaceHandoffLocalCompanyId(env = process.env) {
+    return env[EXECUTION_WORKSPACE_COMPANY_ID_ENV]?.trim() || null;
+}
+export function issueWorkspaceHandoffTicket(input) {
+    const origin = normalizeWorkspaceHandoffOrigin(input.origin);
+    if (!origin) {
+        throw new Error("Workspace login handoff needs an absolute http(s) target origin");
+    }
+    const issuedAtMs = (input.now ?? new Date()).getTime();
+    const issuedAt = Math.floor(issuedAtMs / 1000);
+    const ttlSeconds = Math.max(1, Math.floor(input.ttlSeconds ?? WORKSPACE_HANDOFF_TICKET_TTL_SECONDS));
+    const payload = {
+        v: WORKSPACE_HANDOFF_TICKET_VERSION,
+        jti: input.nonce ?? randomBytes(18).toString("base64url"),
+        sub: input.userId,
+        email: input.email,
+        ws: input.executionWorkspaceId,
+        cid: input.companyId,
+        iid: input.instanceId,
+        aud: origin,
+        iss: input.issuerInstanceId,
+        iat: issuedAt,
+        exp: issuedAt + ttlSeconds,
+        next: sanitizeWorkspaceHandoffRedirectPath(input.next),
+    };
+    const encodedPayload = base64UrlEncode(Buffer.from(JSON.stringify(payload), "utf8"));
+    const signedMessage = `${WORKSPACE_HANDOFF_TICKET_VERSION}.${encodedPayload}`;
+    const signature = base64UrlEncode(sign(input.key, signedMessage));
+    return { ticket: `${signedMessage}.${signature}`, payload };
+}
+/** Absolute exchange URL for a minted ticket. */
+export function buildWorkspaceHandoffExchangeUrl(input) {
+    const origin = normalizeWorkspaceHandoffOrigin(input.origin);
+    if (!origin)
+        throw new Error("Workspace login handoff needs an absolute http(s) target origin");
+    const url = new URL(`/api/auth${WORKSPACE_HANDOFF_EXCHANGE_PATH}`, origin);
+    url.searchParams.set(WORKSPACE_HANDOFF_TICKET_QUERY_PARAM, input.ticket);
+    return url.toString();
+}
+function isPayloadShape(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const candidate = value;
+    return (typeof candidate.jti === "string" && candidate.jti.length > 0
+        && typeof candidate.sub === "string" && candidate.sub.length > 0
+        && typeof candidate.email === "string" && candidate.email.length > 0
+        && typeof candidate.ws === "string" && candidate.ws.length > 0
+        && typeof candidate.cid === "string" && candidate.cid.length > 0
+        && typeof candidate.iid === "string" && candidate.iid.length > 0
+        && typeof candidate.aud === "string" && candidate.aud.length > 0
+        && typeof candidate.iss === "string"
+        && Number.isFinite(candidate.iat)
+        && Number.isFinite(candidate.exp)
+        && typeof candidate.next === "string");
+}
+/**
+ * Verify a ticket against this workspace's own key and identity.
+ *
+ * `expected` must come from persisted configuration. Passing header-derived
+ * values would reintroduce exactly the spoofing path this design closes.
+ */
+export function verifyWorkspaceHandoffTicket(input) {
+    const key = input.key?.trim();
+    if (!key)
+        return { ok: false, reason: "not_configured" };
+    const expectedOrigin = normalizeWorkspaceHandoffOrigin(input.expected.origin);
+    const expectedInstanceId = input.expected.instanceId?.trim();
+    const expectedWorkspaceId = input.expected.executionWorkspaceId?.trim();
+    const expectedCompanyId = input.expected.companyId?.trim();
+    // Fail closed on unresolved local identity: without it the checks below would
+    // degrade into "any validly signed ticket wins".
+    if (!expectedOrigin)
+        return { ok: false, reason: "origin_mismatch" };
+    if (!expectedInstanceId)
+        return { ok: false, reason: "instance_mismatch" };
+    if (!expectedWorkspaceId)
+        return { ok: false, reason: "workspace_mismatch" };
+    if (!expectedCompanyId)
+        return { ok: false, reason: "company_mismatch" };
+    const ticket = input.ticket?.trim();
+    if (!ticket)
+        return { ok: false, reason: "malformed" };
+    const segments = ticket.split(".");
+    if (segments.length !== 3)
+        return { ok: false, reason: "malformed" };
+    const [version, encodedPayload, encodedSignature] = segments;
+    if (version !== WORKSPACE_HANDOFF_TICKET_VERSION)
+        return { ok: false, reason: "unsupported_version" };
+    const providedSignature = base64UrlDecode(encodedSignature);
+    if (!providedSignature)
+        return { ok: false, reason: "malformed" };
+    const expectedSignature = sign(key, `${version}.${encodedPayload}`);
+    // Signature first: never parse attacker-controlled JSON we have not authenticated.
+    if (!constantTimeMatches(expectedSignature, providedSignature))
+        return { ok: false, reason: "bad_signature" };
+    const decodedPayload = base64UrlDecode(encodedPayload);
+    if (!decodedPayload)
+        return { ok: false, reason: "malformed" };
+    let parsed;
+    try {
+        parsed = JSON.parse(decodedPayload.toString("utf8"));
+    }
+    catch {
+        return { ok: false, reason: "malformed" };
+    }
+    if (!isPayloadShape(parsed))
+        return { ok: false, reason: "malformed" };
+    if (parsed.v !== WORKSPACE_HANDOFF_TICKET_VERSION)
+        return { ok: false, reason: "unsupported_version" };
+    const nowSeconds = Math.floor((input.now ?? new Date()).getTime() / 1000);
+    const skew = Math.max(0, Math.floor(input.clockSkewSeconds ?? WORKSPACE_HANDOFF_CLOCK_SKEW_SECONDS));
+    if (parsed.exp + skew < nowSeconds)
+        return { ok: false, reason: "expired" };
+    if (parsed.iat - skew > nowSeconds)
+        return { ok: false, reason: "not_yet_valid" };
+    if (parsed.exp <= parsed.iat)
+        return { ok: false, reason: "malformed" };
+    if (normalizeWorkspaceHandoffOrigin(parsed.aud) !== expectedOrigin) {
+        return { ok: false, reason: "origin_mismatch" };
+    }
+    if (parsed.iid !== expectedInstanceId)
+        return { ok: false, reason: "instance_mismatch" };
+    if (parsed.ws !== expectedWorkspaceId)
+        return { ok: false, reason: "workspace_mismatch" };
+    if (parsed.cid !== expectedCompanyId)
+        return { ok: false, reason: "company_mismatch" };
+    return {
+        ok: true,
+        payload: { ...parsed, next: sanitizeWorkspaceHandoffRedirectPath(parsed.next) },
+    };
+}
+/** Verification-key identifier safe to log: proves which key, reveals no key bytes. */
+export function workspaceHandoffKeyFingerprint(key) {
+    return createHmac("sha256", "paperclip.workspace-login-handoff.fingerprint").update(key).digest("hex").slice(0, 12);
+}
+/**
+ * Strip the ticket from a URL or URL-ish string before it reaches a log sink.
+ * Applied by the request logger and by the guest's own audit records.
+ */
+export function redactWorkspaceHandoffTicket(value) {
+    if (!value.includes(WORKSPACE_HANDOFF_TICKET_QUERY_PARAM))
+        return value;
+    return value.replace(new RegExp(`([?&]${WORKSPACE_HANDOFF_TICKET_QUERY_PARAM}=)[^&#\\s]+`, "gi"), "$1[redacted]");
+}
+//# sourceMappingURL=workspace-login-handoff.js.map

package/dist/auth/workspace-login-handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-login-handoff.js","sourceRoot":"","sources":["../../src/auth/workspace-login-handoff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,iFAAiF;AACjF,MAAM,CAAC,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAEtD;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,CAAC;AAEvD,iFAAiF;AACjF,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,CAAC;AAEvD,kFAAkF;AAClF,MAAM,CAAC,MAAM,+BAA+B,GAAG,6BAA6B,CAAC;AAE7E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oCAAoC,GAAG,QAAQ,CAAC;AAE7D,MAAM,eAAe,GAAG,iCAAiC,CAAC;AAC1D,MAAM,uBAAuB,GAAG,oCAAoC,CAAC;AACrE,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAClE,MAAM,0BAA0B,GAAG,kCAAkC,CAAC;AACtE,MAAM,kCAAkC,GAAG,0CAA0C,CAAC;AAEtF,MAAM,CAAC,MAAM,6BAA6B,GAAG,eAAe,CAAC;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAG,mBAAmB,CAAC;AACrE,MAAM,CAAC,MAAM,wCAAwC,GAAG,0BAA0B,CAAC;AACnF,MAAM,CAAC,MAAM,gDAAgD,GAAG,kCAAkC,CAAC;AACnG,MAAM,CAAC,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AACxF,MAAM,CAAC,MAAM,kCAAkC,GAAG,yCAAyC,CAAC;AAC5F,MAAM,CAAC,MAAM,qCAAqC,GAAG,4CAA4C,CAAC;AAmDlG,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,8EAA8E;IAC9E,kEAAkE;IAClE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,eAAe,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,OAAe;IACxC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,QAAgB;IAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAgC;IAC9E,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAAC,KAAgC;IACnF,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC;IACzB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACzC,6EAA6E;IAC7E,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACtE,uEAAuE;IACvE,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC;IACtD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAIzC;IACC,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;SAC1C,MAAM,CAAC,qCAAqC,gCAAgC,IAAI,CAAC;SACjF,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC;SAC/B,MAAM,CAAC,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAC;SACvC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;SAC1C,MAAM,CAAC,uCAAuC,gCAAgC,IAAI,CAAC;SACnF,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC;SAC/B,MAAM,CAAC,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAC;SACvC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAC/C,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,SAAS,GAAG,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAEjE,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAC;IAC1F,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACnC,MAAM,CAAC,0CAA0C,gCAAgC,EAAE,CAAC;aACpF,MAAM,CAAC,KAAK,CAAC;QAChB,MAAM,EAAE,SAAS;KAClB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,+BAA+B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClF,OAAO,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mCAAmC,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtF,OAAO,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AAClD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,uCAAuC,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1F,OAAO,GAAG,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACzD,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qCAAqC,CAAC,MAAyB,OAAO,CAAC,GAAG;IACxF,OAAO,GAAG,CAAC,kCAAkC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAa3C;IACC,MAAM,MAAM,GAAG,+BAA+B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,IAAI,oCAAoC,CAAC,CAAC,CAAC;IACrG,MAAM,OAAO,GAAkC;QAC7C,CAAC,EAAE,gCAAgC;QACnC,GAAG,EAAE,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzD,GAAG,EAAE,KAAK,CAAC,MAAM;QACjB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,EAAE,EAAE,KAAK,CAAC,oBAAoB;QAC9B,GAAG,EAAE,KAAK,CAAC,SAAS;QACpB,GAAG,EAAE,KAAK,CAAC,UAAU;QACrB,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,KAAK,CAAC,gBAAgB;QAC3B,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,QAAQ,GAAG,UAAU;QAC1B,IAAI,EAAE,oCAAoC,CAAC,KAAK,CAAC,IAAI,CAAC;KACvD,CAAC;IACF,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACrF,MAAM,aAAa,GAAG,GAAG,gCAAgC,IAAI,cAAc,EAAE,CAAC;IAC9E,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;IAClE,OAAO,EAAE,MAAM,EAAE,GAAG,aAAa,IAAI,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,gCAAgC,CAAC,KAAyC;IACxF,MAAM,MAAM,GAAG,+BAA+B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IAChG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,+BAA+B,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,oCAAoC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,OAAO,CACL,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;WAC1D,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;WAC7D,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;WACjE,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,IAAI,SAAS,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC;WAC3D,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;WAC7D,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;WAC7D,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;WAC7D,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;WACjC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC;WAC9B,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC;WAC9B,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CACtC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAW5C;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAEzD,MAAM,cAAc,GAAG,+BAA+B,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9E,MAAM,kBAAkB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7D,MAAM,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IACxE,MAAM,iBAAiB,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3D,8EAA8E;IAC9E,iDAAiD;IACjD,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACrE,IAAI,CAAC,kBAAkB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC3E,IAAI,CAAC,mBAAmB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC7E,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAEzE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrE,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,QAAoC,CAAC;IACzF,IAAI,OAAO,KAAK,gCAAgC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAEtG,MAAM,iBAAiB,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAC5D,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClE,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,cAAc,EAAE,CAAC,CAAC;IACpE,mFAAmF;IACnF,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAE9G,MAAM,cAAc,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACvE,IAAI,MAAM,CAAC,CAAC,KAAK,gCAAgC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAEvG,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,IAAI,oCAAoC,CAAC,CAAC,CAAC;IACrG,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAClF,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAExE,IAAI,+BAA+B,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,kBAAkB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzF,IAAI,MAAM,CAAC,EAAE,KAAK,mBAAmB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1F,IAAI,MAAM,CAAC,GAAG,KAAK,iBAAiB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAEvF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,oCAAoC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;KAChF,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,8BAA8B,CAAC,GAAW;IACxD,OAAO,UAAU,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAa;IACxD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,oCAAoC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,KAAK,CAAC,OAAO,CAClB,IAAI,MAAM,CAAC,QAAQ,oCAAoC,aAAa,EAAE,IAAI,CAAC,EAC3E,cAAc,CACf,CAAC;AACJ,CAAC"}

package/dist/build-info.json

@@ -0,0 +1,3 @@
+{
+  "commit": "bef928866"
+}

package/dist/config.d.ts

@@ -20,6 +20,7 @@ export interface Config {
     databaseBackupIntervalMinutes: number;
     databaseBackupRetentionDays: number;
     databaseBackupDir: string;
+    workspaceReaperCooldownDays: number;
     serveUi: boolean;
     uiDevMiddleware: boolean;
     secretsProvider: SecretProvider;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAOA,OAAO,EAOL,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EAIrB,MAAM,qBAAqB,CAAC;AA0B7B,KAAK,YAAY,GAAG,mBAAmB,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,MAAM;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,IAAI,EAAE,QAAQ,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,eAAe,CAAC;IACjC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,uBAAuB,EAAE,MAAM,CAAC;IAChC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,6BAA6B,EAAE,MAAM,CAAC;IACtC,2BAA2B,EAAE,MAAM,CAAC;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,cAAc,CAAC;IAChC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,wBAAwB,EAAE,MAAM,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,EAAE,MAAM,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,OAAO,CAAC;IACjC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,0BAA0B,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,yBAAyB,EAAE,OAAO,CAAC;IACnC,4BAA4B,EAAE,MAAM,CAAC;IACrC,sBAAsB,EAAE,OAAO,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAqBD,wBAAgB,UAAU,IAAI,MAAM,CAkOnC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAOA,OAAO,EAOL,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EAIrB,MAAM,qBAAqB,CAAC;AA0B7B,KAAK,YAAY,GAAG,mBAAmB,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,MAAM;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,IAAI,EAAE,QAAQ,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,eAAe,CAAC;IACjC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,uBAAuB,EAAE,MAAM,CAAC;IAChC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,6BAA6B,EAAE,MAAM,CAAC;IACtC,2BAA2B,EAAE,MAAM,CAAC;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,2BAA2B,EAAE,MAAM,CAAC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,cAAc,CAAC;IAChC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,wBAAwB,EAAE,MAAM,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,EAAE,MAAM,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,OAAO,CAAC;IACjC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,0BAA0B,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,yBAAyB,EAAE,OAAO,CAAC;IACnC,4BAA4B,EAAE,MAAM,CAAC;IACrC,sBAAsB,EAAE,OAAO,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAqBD,wBAAgB,UAAU,IAAI,MAAM,CAkPnC"}

package/dist/config.js

@@ -160,6 +160,19 @@ export function loadConfig() {
     const databaseBackupDir = resolveHomeAwarePath(process.env.PAPERCLIP_DB_BACKUP_DIR ??
         fileDatabaseBackup?.dir ??
         resolveDefaultBackupDir());
+    // The terminal-workspace reaper waits this many days after an issue tree
+    // becomes terminal before it archives the workspace. A person can reopen the
+    // work inside this window. A value of 0 disables the cooldown and restores
+    // immediate reaping. A negative or non-numeric value falls back to the
+    // default. The day granularity and the default of 7 obey the
+    // PAPERCLIP_DB_BACKUP_RETENTION_DAYS precedent above.
+    const workspaceReaperCooldownDaysEnv = process.env.PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS?.trim();
+    const workspaceReaperCooldownDaysRaw = Number(workspaceReaperCooldownDaysEnv);
+    const workspaceReaperCooldownDays = workspaceReaperCooldownDaysEnv
+        && Number.isFinite(workspaceReaperCooldownDaysRaw)
+        && workspaceReaperCooldownDaysRaw >= 0
+        ? workspaceReaperCooldownDaysRaw
+        : 7;
     const bindValidationErrors = validateConfiguredBindMode({
         deploymentMode,
         deploymentExposure,
@@ -199,6 +212,7 @@ export function loadConfig() {
         databaseBackupIntervalMinutes,
         databaseBackupRetentionDays,
         databaseBackupDir,
+        workspaceReaperCooldownDays,
         serveUi: process.env.SERVE_UI !== undefined
             ? process.env.SERVE_UI === "true"
             : fileConfig?.server.serveUi ?? true,

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,0CAA0C,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EAOjB,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,gCAAgC,EAChC,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,uBAAuB,GAAG,uBAAuB,EAAE,CAAC;AAC1D,IAAI,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;IACxC,UAAU,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;AACpD,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,uBAAuB,CAAC;IAChF,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,YAAY,CAAC,uBAAuB,CAAC;IACtE,CAAC,CAAC,YAAY,KAAK,uBAAuB,CAAC;AAC7C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;IAC5C,UAAU,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,0CAA0C,EAAE,CAAC;AAE7C,MAAM,2BAA2B,GAAG,IAAI,CAAC;AA4CzC,SAAS,qBAAqB;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;YACrD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,2BAA2B;SACrC,CAAC,CAAC;QACH,OAAO,MAAM;aACV,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,IAAI,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,gBAAgB,GACpB,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAiB,CAAC;IAEhG,MAAM,SAAS,GACb,gBAAgB,KAAK,UAAU;QAC7B,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,gBAAgB;QACvC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,kBAAkB,GAAG,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC;IACvD,MAAM,WAAW,GAAG,UAAU,EAAE,OAAO,CAAC;IACxC,MAAM,WAAW,GAAG,UAAU,EAAE,OAAO,CAAC;IAExC,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAClE,MAAM,eAAe,GACnB,kBAAkB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,kBAAoC,CAAC;QACnF,CAAC,CAAE,kBAAqC;QACxC,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,gBAAgB,GAAG,WAAW,EAAE,QAAQ,CAAC;IAC/C,MAAM,eAAe,GAAmB,eAAe,IAAI,gBAAgB,IAAI,iBAAiB,CAAC;IAEjG,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACzE,MAAM,sBAAsB,GAC1B,yBAAyB,IAAI,iBAAiB,CAAC,QAAQ,CAAC,yBAA4C,CAAC;QACnG,CAAC,CAAE,yBAA6C;QAChD,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,eAAe,GAAoB,sBAAsB,IAAI,WAAW,EAAE,QAAQ,IAAI,YAAY,CAAC;IACzG,MAAM,uBAAuB,GAAG,oBAAoB,CAClD,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACrC,WAAW,EAAE,SAAS,EAAE,OAAO;QAC/B,wBAAwB,EAAE,CAC7B,CAAC;IACF,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,WAAW,EAAE,EAAE,EAAE,MAAM,IAAI,WAAW,CAAC;IAC1G,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,WAAW,EAAE,EAAE,EAAE,MAAM,IAAI,WAAW,CAAC;IAC1G,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,WAAW,EAAE,EAAE,EAAE,QAAQ,IAAI,SAAS,CAAC;IAC9G,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,WAAW,EAAE,EAAE,EAAE,MAAM,IAAI,EAAE,CAAC;IACjG,MAAM,uBAAuB,GAC3B,OAAO,CAAC,GAAG,CAAC,qCAAqC,KAAK,SAAS;QAC7D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qCAAqC,KAAK,MAAM;QAC9D,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,cAAc,IAAI,KAAK,CAAC,CAAC;IACjD,MAAM,wBAAwB,GAC5B,OAAO,CAAC,GAAG,CAAC,qCAAqC,EAAE,IAAI,EAAE;QACzD,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE;QACnD,SAAS,CAAC;IACZ,MAAM,0BAA0B,GAC9B,OAAO,CAAC,GAAG,CAAC,uCAAuC,EAAE,IAAI,EAAE;QAC3D,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE;QACrD,SAAS,CAAC;IAEZ,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACvE,MAAM,qBAAqB,GACzB,wBAAwB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,wBAA0C,CAAC;QAC/F,CAAC,CAAE,wBAA2C;QAC9C,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,cAAc,GAAmB,qBAAqB,IAAI,UAAU,EAAE,MAAM,CAAC,cAAc,IAAI,eAAe,CAAC;IACrH,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IACpE,MAAM,iBAAiB,GACrB,iBAAiB,KAAK,SAAS;QAC7B,CAAC,CAAC,iBAAiB,KAAK,MAAM;QAC9B,CAAC,CAAC,CAAC,WAAW,EAAE,UAAU,IAAI,cAAc,KAAK,eAAe,CAAC,CAAC;IACtE,MAAM,4BAA4B,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IAC/E,MAAM,yBAAyB,GAC7B,4BAA4B;QAC5B,oBAAoB,CAAC,QAAQ,CAAC,4BAAkD,CAAC;QAC/E,CAAC,CAAE,4BAAmD;QACtD,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,kBAAkB,GACtB,cAAc,KAAK,eAAe;QAChC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,yBAAyB,IAAI,UAAU,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAClD,MAAM,WAAW,GACf,cAAc,IAAI,UAAU,CAAC,QAAQ,CAAC,cAA0B,CAAC;QAC/D,CAAC,CAAE,cAA2B;QAC9B,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC;IAClF,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAC;IAChD,MAAM,IAAI,GACR,WAAW;QACX,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,qBAAqB,CAAC,cAAc,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC;IAC5F,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAC3E,MAAM,sBAAsB,GAC1B,yBAAyB;QACzB,mBAAmB,CAAC,QAAQ,CAAC,yBAA4C,CAAC;QACxE,CAAC,CAAE,yBAA6C;QAChD,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC1D,MAAM,oBAAoB,GACxB,OAAO,CAAC,GAAG,CAAC,8BAA8B;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAChC,gBAAgB;QAChB,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC;IAClC,MAAM,iBAAiB,GAAG,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACpE,MAAM,eAAe,GACnB,sBAAsB;QACtB,UAAU,EAAE,IAAI,EAAE,WAAW;QAC7B,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;IACxE,MAAM,iBAAiB,GACrB,oBAAoB,KAAK,SAAS;QAChC,CAAC,CAAC,oBAAoB,KAAK,MAAM;QACjC,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,IAAI,KAAK,CAAC,CAAC;IACjD,MAAM,0BAA0B,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC3E,MAAM,uBAAuB,GAAG,0BAA0B;QACxD,CAAC,CAAC,0BAA0B;aACzB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,iBAAiB,GAAG,iBAAiB;QACzC,CAAC,CAAC,CAAC,GAAG,EAAE;YACN,IAAI,CAAC;gBACH,OAAO,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CACjC,IAAI,GAAG,CACL;QACE,GAAG,CAAC,uBAAuB,IAAI,UAAU,EAAE,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACzE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD;SACE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CACnB,CACF,CAAC;IACF,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC;IAC5E,MAAM,sBAAsB,GAC1B,qBAAqB,KAAK,SAAS;QACjC,CAAC,CAAC,qBAAqB,KAAK,MAAM;QAClC,CAAC,CAAC,cAAc,KAAK,eAAe,CAAC;IACzC,MAAM,qBAAqB,GACzB,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,SAAS;QACnD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM;QACpD,CAAC,CAAC,CAAC,kBAAkB,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAC5C,MAAM,6BAA6B,GAAG,IAAI,CAAC,GAAG,CAC5C,CAAC,EACD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;QACtD,kBAAkB,EAAE,eAAe;QACnC,EAAE,CACL,CAAC;IACF,MAAM,2BAA2B,GAAG,IAAI,CAAC,GAAG,CAC1C,CAAC,EACD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;QACpD,kBAAkB,EAAE,aAAa;QACjC,CAAC,CACJ,CAAC;IACF,MAAM,iBAAiB,GAAG,oBAAoB,CAC5C,OAAO,CAAC,GAAG,CAAC,uBAAuB;QACjC,kBAAkB,EAAE,GAAG;QACvB,uBAAuB,EAAE,CAC5B,CAAC;IACF,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;QACtD,cAAc;QACd,kBAAkB;QAClB,IAAI;QACJ,IAAI,EAAE,cAAc;QACpB,cAAc;KACf,CAAC,CAAC;IACH,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,YAAY,GAAG,kBAAkB,CAAC;QACtC,IAAI;QACJ,IAAI,EAAE,cAAc;QACpB,cAAc;QACd,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO;QACL,cAAc;QACd,kBAAkB;QAClB,IAAI,EAAE,YAAY,CAAC,IAAI;QACvB,cAAc,EAAE,YAAY,CAAC,cAAc;QAC3C,IAAI,EAAE,YAAY,CAAC,IAAI;QACvB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;QACjE,gBAAgB;QAChB,eAAe;QACf,iBAAiB;QACjB,iBAAiB;QACjB,YAAY,EAAE,gBAAgB;QAC9B,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,SAAS;QAClD,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QACxD,uBAAuB,EAAE,oBAAoB,CAC3C,UAAU,EAAE,QAAQ,CAAC,uBAAuB,IAAI,iCAAiC,EAAE,CACpF;QACD,oBAAoB,EAAE,UAAU,EAAE,QAAQ,CAAC,oBAAoB,IAAI,KAAK;QACxE,qBAAqB;QACrB,6BAA6B;QAC7B,2BAA2B;QAC3B,iBAAiB;QACjB,OAAO,EACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS;YAChC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;YACjC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QACxC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM;QACnE,eAAe;QACf,iBAAiB;QACjB,wBAAwB,EACtB,oBAAoB,CAClB,OAAO,CAAC,GAAG,CAAC,iCAAiC;YAC3C,WAAW,EAAE,cAAc,CAAC,WAAW;YACvC,gCAAgC,EAAE,CACrC;QACH,eAAe;QACf,uBAAuB;QACvB,eAAe;QACf,eAAe;QACf,iBAAiB;QACjB,eAAe;QACf,uBAAuB;QACvB,wBAAwB;QACxB,0BAA0B;QAC1B,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,OAAO;QAC9E,4BAA4B,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,IAAI,KAAK,CAAC;QAC3G,sBAAsB;QACtB,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,IAAI,IAAI;KACzD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,0CAA0C,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EAOjB,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,gCAAgC,EAChC,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,uBAAuB,GAAG,uBAAuB,EAAE,CAAC;AAC1D,IAAI,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;IACxC,UAAU,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;AACpD,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,uBAAuB,CAAC;IAChF,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,YAAY,CAAC,uBAAuB,CAAC;IACtE,CAAC,CAAC,YAAY,KAAK,uBAAuB,CAAC;AAC7C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;IAC5C,UAAU,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,0CAA0C,EAAE,CAAC;AAE7C,MAAM,2BAA2B,GAAG,IAAI,CAAC;AA6CzC,SAAS,qBAAqB;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;YACrD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,2BAA2B;SACrC,CAAC,CAAC;QACH,OAAO,MAAM;aACV,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,IAAI,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,gBAAgB,GACpB,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAiB,CAAC;IAEhG,MAAM,SAAS,GACb,gBAAgB,KAAK,UAAU;QAC7B,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,gBAAgB;QACvC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,kBAAkB,GAAG,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC;IACvD,MAAM,WAAW,GAAG,UAAU,EAAE,OAAO,CAAC;IACxC,MAAM,WAAW,GAAG,UAAU,EAAE,OAAO,CAAC;IAExC,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAClE,MAAM,eAAe,GACnB,kBAAkB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,kBAAoC,CAAC;QACnF,CAAC,CAAE,kBAAqC;QACxC,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,gBAAgB,GAAG,WAAW,EAAE,QAAQ,CAAC;IAC/C,MAAM,eAAe,GAAmB,eAAe,IAAI,gBAAgB,IAAI,iBAAiB,CAAC;IAEjG,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACzE,MAAM,sBAAsB,GAC1B,yBAAyB,IAAI,iBAAiB,CAAC,QAAQ,CAAC,yBAA4C,CAAC;QACnG,CAAC,CAAE,yBAA6C;QAChD,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,eAAe,GAAoB,sBAAsB,IAAI,WAAW,EAAE,QAAQ,IAAI,YAAY,CAAC;IACzG,MAAM,uBAAuB,GAAG,oBAAoB,CAClD,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACrC,WAAW,EAAE,SAAS,EAAE,OAAO;QAC/B,wBAAwB,EAAE,CAC7B,CAAC;IACF,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,WAAW,EAAE,EAAE,EAAE,MAAM,IAAI,WAAW,CAAC;IAC1G,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,WAAW,EAAE,EAAE,EAAE,MAAM,IAAI,WAAW,CAAC;IAC1G,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,WAAW,EAAE,EAAE,EAAE,QAAQ,IAAI,SAAS,CAAC;IAC9G,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,WAAW,EAAE,EAAE,EAAE,MAAM,IAAI,EAAE,CAAC;IACjG,MAAM,uBAAuB,GAC3B,OAAO,CAAC,GAAG,CAAC,qCAAqC,KAAK,SAAS;QAC7D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qCAAqC,KAAK,MAAM;QAC9D,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,cAAc,IAAI,KAAK,CAAC,CAAC;IACjD,MAAM,wBAAwB,GAC5B,OAAO,CAAC,GAAG,CAAC,qCAAqC,EAAE,IAAI,EAAE;QACzD,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE;QACnD,SAAS,CAAC;IACZ,MAAM,0BAA0B,GAC9B,OAAO,CAAC,GAAG,CAAC,uCAAuC,EAAE,IAAI,EAAE;QAC3D,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE;QACrD,SAAS,CAAC;IAEZ,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACvE,MAAM,qBAAqB,GACzB,wBAAwB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,wBAA0C,CAAC;QAC/F,CAAC,CAAE,wBAA2C;QAC9C,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,cAAc,GAAmB,qBAAqB,IAAI,UAAU,EAAE,MAAM,CAAC,cAAc,IAAI,eAAe,CAAC;IACrH,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IACpE,MAAM,iBAAiB,GACrB,iBAAiB,KAAK,SAAS;QAC7B,CAAC,CAAC,iBAAiB,KAAK,MAAM;QAC9B,CAAC,CAAC,CAAC,WAAW,EAAE,UAAU,IAAI,cAAc,KAAK,eAAe,CAAC,CAAC;IACtE,MAAM,4BAA4B,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IAC/E,MAAM,yBAAyB,GAC7B,4BAA4B;QAC5B,oBAAoB,CAAC,QAAQ,CAAC,4BAAkD,CAAC;QAC/E,CAAC,CAAE,4BAAmD;QACtD,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,kBAAkB,GACtB,cAAc,KAAK,eAAe;QAChC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,yBAAyB,IAAI,UAAU,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAClD,MAAM,WAAW,GACf,cAAc,IAAI,UAAU,CAAC,QAAQ,CAAC,cAA0B,CAAC;QAC/D,CAAC,CAAE,cAA2B;QAC9B,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC;IAClF,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAC;IAChD,MAAM,IAAI,GACR,WAAW;QACX,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,qBAAqB,CAAC,cAAc,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC;IAC5F,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAC3E,MAAM,sBAAsB,GAC1B,yBAAyB;QACzB,mBAAmB,CAAC,QAAQ,CAAC,yBAA4C,CAAC;QACxE,CAAC,CAAE,yBAA6C;QAChD,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC1D,MAAM,oBAAoB,GACxB,OAAO,CAAC,GAAG,CAAC,8BAA8B;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAChC,gBAAgB;QAChB,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC;IAClC,MAAM,iBAAiB,GAAG,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACpE,MAAM,eAAe,GACnB,sBAAsB;QACtB,UAAU,EAAE,IAAI,EAAE,WAAW;QAC7B,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;IACxE,MAAM,iBAAiB,GACrB,oBAAoB,KAAK,SAAS;QAChC,CAAC,CAAC,oBAAoB,KAAK,MAAM;QACjC,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,IAAI,KAAK,CAAC,CAAC;IACjD,MAAM,0BAA0B,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAC3E,MAAM,uBAAuB,GAAG,0BAA0B;QACxD,CAAC,CAAC,0BAA0B;aACzB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,iBAAiB,GAAG,iBAAiB;QACzC,CAAC,CAAC,CAAC,GAAG,EAAE;YACN,IAAI,CAAC;gBACH,OAAO,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CACjC,IAAI,GAAG,CACL;QACE,GAAG,CAAC,uBAAuB,IAAI,UAAU,EAAE,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACzE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD;SACE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CACnB,CACF,CAAC;IACF,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC;IAC5E,MAAM,sBAAsB,GAC1B,qBAAqB,KAAK,SAAS;QACjC,CAAC,CAAC,qBAAqB,KAAK,MAAM;QAClC,CAAC,CAAC,cAAc,KAAK,eAAe,CAAC;IACzC,MAAM,qBAAqB,GACzB,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,SAAS;QACnD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM;QACpD,CAAC,CAAC,CAAC,kBAAkB,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAC5C,MAAM,6BAA6B,GAAG,IAAI,CAAC,GAAG,CAC5C,CAAC,EACD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;QACtD,kBAAkB,EAAE,eAAe;QACnC,EAAE,CACL,CAAC;IACF,MAAM,2BAA2B,GAAG,IAAI,CAAC,GAAG,CAC1C,CAAC,EACD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;QACpD,kBAAkB,EAAE,aAAa;QACjC,CAAC,CACJ,CAAC;IACF,MAAM,iBAAiB,GAAG,oBAAoB,CAC5C,OAAO,CAAC,GAAG,CAAC,uBAAuB;QACjC,kBAAkB,EAAE,GAAG;QACvB,uBAAuB,EAAE,CAC5B,CAAC;IACF,yEAAyE;IACzE,6EAA6E;IAC7E,2EAA2E;IAC3E,uEAAuE;IACvE,6DAA6D;IAC7D,sDAAsD;IACtD,MAAM,8BAA8B,GAClC,OAAO,CAAC,GAAG,CAAC,wCAAwC,EAAE,IAAI,EAAE,CAAC;IAC/D,MAAM,8BAA8B,GAAG,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAC9E,MAAM,2BAA2B,GAC/B,8BAA8B;WACzB,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAC;WAC/C,8BAA8B,IAAI,CAAC;QACtC,CAAC,CAAC,8BAA8B;QAChC,CAAC,CAAC,CAAC,CAAC;IACR,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;QACtD,cAAc;QACd,kBAAkB;QAClB,IAAI;QACJ,IAAI,EAAE,cAAc;QACpB,cAAc;KACf,CAAC,CAAC;IACH,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,YAAY,GAAG,kBAAkB,CAAC;QACtC,IAAI;QACJ,IAAI,EAAE,cAAc;QACpB,cAAc;QACd,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO;QACL,cAAc;QACd,kBAAkB;QAClB,IAAI,EAAE,YAAY,CAAC,IAAI;QACvB,cAAc,EAAE,YAAY,CAAC,cAAc;QAC3C,IAAI,EAAE,YAAY,CAAC,IAAI;QACvB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;QACjE,gBAAgB;QAChB,eAAe;QACf,iBAAiB;QACjB,iBAAiB;QACjB,YAAY,EAAE,gBAAgB;QAC9B,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,SAAS;QAClD,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QACxD,uBAAuB,EAAE,oBAAoB,CAC3C,UAAU,EAAE,QAAQ,CAAC,uBAAuB,IAAI,iCAAiC,EAAE,CACpF;QACD,oBAAoB,EAAE,UAAU,EAAE,QAAQ,CAAC,oBAAoB,IAAI,KAAK;QACxE,qBAAqB;QACrB,6BAA6B;QAC7B,2BAA2B;QAC3B,iBAAiB;QACjB,2BAA2B;QAC3B,OAAO,EACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS;YAChC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;YACjC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QACxC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM;QACnE,eAAe;QACf,iBAAiB;QACjB,wBAAwB,EACtB,oBAAoB,CAClB,OAAO,CAAC,GAAG,CAAC,iCAAiC;YAC3C,WAAW,EAAE,cAAc,CAAC,WAAW;YACvC,gCAAgC,EAAE,CACrC;QACH,eAAe;QACf,uBAAuB;QACvB,eAAe;QACf,eAAe;QACf,iBAAiB;QACjB,eAAe;QACf,uBAAuB;QACvB,wBAAwB;QACxB,0BAA0B;QAC1B,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,OAAO;QAC9E,4BAA4B,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,IAAI,KAAK,CAAC;QAC3G,sBAAsB;QACtB,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,IAAI,IAAI;KACzD,CAAC;AACJ,CAAC"}

package/dist/dev-runner-worktree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-runner-worktree.d.ts","sourceRoot":"","sources":["../src/dev-runner-worktree.ts"],"names":[],"mappings":"AAuCA,KAAK,0BAA0B,GAC3B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,KAAK,CAAA;CAAE,GACpC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,GACrC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,KAAK,CAAA;CAAE,CAAC;AAE3C,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQpE;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI9D;AAyCD,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,0BAA0B,CA8B5B"}
+{"version":3,"file":"dev-runner-worktree.d.ts","sourceRoot":"","sources":["../src/dev-runner-worktree.ts"],"names":[],"mappings":"AAwCA,KAAK,0BAA0B,GAC3B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,KAAK,CAAA;CAAE,GACpC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,GACrC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,KAAK,CAAA;CAAE,CAAC;AAE3C,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQpE;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ9D;AAyCD,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,0BAA0B,CA8B5B"}