@rubytech/create-maxy-code 0.1.36 → 0.1.38

package/dist/__tests__/onboarding-state-readback.test.js

@@ -1,61 +0,0 @@
-// Task 033 — install-invariant for OnboardingState seed.
-//
-// The installer re-reads Neo4j after seed-neo4j.sh to verify the
-// OnboardingState node landed. The parser turns cypher-shell's plain-
-// format output into a tri-state outcome consumed by the loud-fail
-// branch in src/index.ts. These tests fence the three outcomes the
-// installer logs name: present / missing / unreachable.
-import test from "node:test";
-import assert from "node:assert/strict";
-import { classifyOnboardingReadBack } from "../onboarding-readback.js";
-test("non-zero exit → unreachable, with stderr tail captured", () => {
-    const outcome = classifyOnboardingReadBack({
-        status: 1,
-        stdout: "",
-        stderr: "Connection refused: bolt://localhost:7687",
-    });
-    assert.equal(outcome.kind, "unreachable");
-    if (outcome.kind === "unreachable") {
-        assert.match(outcome.stderrTail, /Connection refused/);
-    }
-});
-test("header row only (no match) → missing", () => {
-    // cypher-shell --format plain emits the column header even when zero rows
-    // matched. The seed-or-fail contract treats header-only as the loud-fail.
-    const outcome = classifyOnboardingReadBack({
-        status: 0,
-        stdout: "currentStep\n",
-        stderr: "",
-    });
-    assert.equal(outcome.kind, "missing");
-});
-test("data row present → present, currentStep relayed verbatim", () => {
-    const outcome = classifyOnboardingReadBack({
-        status: 0,
-        stdout: "currentStep\n0\n",
-        stderr: "",
-    });
-    assert.equal(outcome.kind, "present");
-    if (outcome.kind === "present") {
-        assert.equal(outcome.currentStep, "0");
-    }
-});
-test("empty stdout + zero exit → missing (defensive: cypher-shell flushed nothing)", () => {
-    const outcome = classifyOnboardingReadBack({
-        status: 0,
-        stdout: "",
-        stderr: "",
-    });
-    assert.equal(outcome.kind, "missing");
-});
-test("trailing whitespace tolerated on present row", () => {
-    const outcome = classifyOnboardingReadBack({
-        status: 0,
-        stdout: "currentStep\n0  \n\n",
-        stderr: "",
-    });
-    assert.equal(outcome.kind, "present");
-    if (outcome.kind === "present") {
-        assert.equal(outcome.currentStep, "0");
-    }
-});

package/dist/onboarding-readback.js

@@ -1,27 +0,0 @@
-// Task 033 — pure parser for the OnboardingState read-back assertion.
-//
-// Extracted into a dedicated module (not src/index.ts) so the test
-// suite can import it without triggering index's brand.json-at-load
-// side effect. The installer's loud-fail branches at
-// `assertOnboardingStateSeeded` consume the tri-state outcome.
-/**
- * Classify cypher-shell --format plain output into one of three states:
- *
- * - `unreachable` — non-zero exit (auth, network, syntax). Stderr tail
- *   (last 200 chars) is preserved so the install log carries the
- *   symptom verbatim.
- * - `missing` — exit 0 but no data row beyond the header. cypher-shell
- *   prints the column name even on a zero-match query.
- * - `present` — exit 0 with at least one data row. `currentStep` is the
- *   first field on row 2.
- */
-export function classifyOnboardingReadBack(input) {
-    if (input.status !== 0) {
-        return { kind: "unreachable", stderrTail: input.stderr.trim().slice(-200) };
-    }
-    const lines = input.stdout.trim().split("\n").filter((l) => l.length > 0);
-    if (lines.length < 2) {
-        return { kind: "missing" };
-    }
-    return { kind: "present", currentStep: lines[1].trim() };
-}

package/payload/platform/lib/anthropic-key/dist/index.d.ts

@@ -1,22 +0,0 @@
-/**
- * Centralised Anthropic API key management.
- *
- * Provides read/write/validate operations for the Anthropic API key
- * used by the public agent. All consumers import from this module
- * instead of inlining the env-var-then-file lookup pattern.
- *
- * Follows the same shape as cloudflare/mcp/src/lib/cloudflared.ts
- * (readToken, writeToken, hasToken, validateToken).
- */
-export declare function readKey(): string | null;
-export declare function writeKey(key: string): void;
-export declare function hasKey(): boolean;
-export declare function deleteKey(): void;
-export type KeyStatus = "valid" | "billing" | "auth_error" | "missing" | "error";
-export interface KeyValidation {
-    status: KeyStatus;
-    message: string;
-}
-export declare function validateKey(key?: string): Promise<KeyValidation>;
-export declare function keyFilePath(): string;
-//# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/anthropic-key/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAoEH,wBAAgB,OAAO,IAAI,MAAM,GAAG,IAAI,CAiDvC;AAMD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAiB1C;AAMD,wBAAgB,MAAM,IAAI,OAAO,CAEhC;AAaD,wBAAgB,SAAS,IAAI,IAAI,CAsBhC;AAUD,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,GAAG,OAAO,CAAC;AAEjF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAsFtE;AAOD,wBAAgB,WAAW,IAAI,MAAM,CAEpC"}

package/payload/platform/lib/anthropic-key/dist/index.js

@@ -1,232 +0,0 @@
-"use strict";
-/**
- * Centralised Anthropic API key management.
- *
- * Provides read/write/validate operations for the Anthropic API key
- * used by the public agent. All consumers import from this module
- * instead of inlining the env-var-then-file lookup pattern.
- *
- * Follows the same shape as cloudflare/mcp/src/lib/cloudflared.ts
- * (readToken, writeToken, hasToken, validateToken).
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.readKey = readKey;
-exports.writeKey = writeKey;
-exports.hasKey = hasKey;
-exports.deleteKey = deleteKey;
-exports.validateKey = validateKey;
-exports.keyFilePath = keyFilePath;
-const index_js_1 = require("../../models/dist/index.js");
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const node_os_1 = require("node:os");
-// ---------------------------------------------------------------------------
-// Path resolution — lazy, cached
-//
-// The key file lives at ~/{configDir}/.anthropic-api-key where configDir
-// is read from brand.json. Resolution strategy:
-//   1. PLATFORM_ROOT env var → brand.json → configDir  (MCP servers)
-//   2. MAXY_PLATFORM_ROOT env var → brand.json → configDir  (UI/Next.js)
-//   3. Fall back to .maxy  (dev environment, neither env var set)
-// ---------------------------------------------------------------------------
-let cachedKeyFilePath = null;
-function resolveKeyFilePath() {
-    if (cachedKeyFilePath)
-        return cachedKeyFilePath;
-    let configDirName = ".maxy"; // default for dev
-    const platformRoot = process.env.PLATFORM_ROOT ?? process.env.MAXY_PLATFORM_ROOT;
-    if (platformRoot) {
-        const brandPath = (0, node_path_1.join)(platformRoot, "config", "brand.json");
-        if (!(0, node_fs_1.existsSync)(brandPath)) {
-            throw new Error(`brand.json not found at ${brandPath} — platform not properly installed`);
-        }
-        try {
-            const brand = JSON.parse((0, node_fs_1.readFileSync)(brandPath, "utf-8"));
-            if (!brand.configDir) {
-                throw new Error(`brand.json at ${brandPath} is missing the configDir field`);
-            }
-            configDirName = brand.configDir;
-        }
-        catch (err) {
-            if (err instanceof SyntaxError) {
-                throw new Error(`brand.json at ${brandPath} is not valid JSON: ${err.message}`);
-            }
-            throw err;
-        }
-    }
-    cachedKeyFilePath = (0, node_path_1.resolve)((0, node_os_1.homedir)(), configDirName, ".anthropic-api-key");
-    return cachedKeyFilePath;
-}
-// ---------------------------------------------------------------------------
-// readKey — two-tier lookup: env var → file
-//
-// Returns the key string or null if unavailable. Never throws on
-// missing/unreadable key — callers handle null per their context.
-// ---------------------------------------------------------------------------
-function readKey() {
-    const envKey = process.env.ANTHROPIC_API_KEY;
-    if (envKey && envKey.trim()) {
-        return envKey.trim();
-    }
-    let keyFilePath;
-    try {
-        keyFilePath = resolveKeyFilePath();
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`[anthropic-key] path resolution failed: ${msg}`);
-        return null;
-    }
-    if (envKey !== undefined) {
-        // env var was set but empty — log and fall through to file
-        console.error(`[anthropic-key] ANTHROPIC_API_KEY env var is set but empty, falling back to file`);
-    }
-    try {
-        const raw = (0, node_fs_1.readFileSync)(keyFilePath, "utf-8").trim();
-        if (!raw) {
-            console.error(`[anthropic-key] key file exists but is empty: ${keyFilePath}`);
-            return null;
-        }
-        return raw;
-    }
-    catch (err) {
-        const code = err instanceof Error && "code" in err
-            ? err.code
-            : undefined;
-        if (code === "ENOENT") {
-            // File does not exist — expected on fresh installs
-            console.error(`[anthropic-key] no key available (env var unset, file not found: ${keyFilePath})`);
-        }
-        else {
-            const msg = err instanceof Error ? err.message : String(err);
-            console.error(`[anthropic-key] failed to read key file ${keyFilePath}: ${msg}`);
-        }
-        return null;
-    }
-}
-// ---------------------------------------------------------------------------
-// writeKey — validate format and write with restricted permissions
-// ---------------------------------------------------------------------------
-function writeKey(key) {
-    const trimmed = key.trim();
-    if (!trimmed.startsWith("sk-ant-")) {
-        throw new Error("Invalid key format. Must start with sk-ant-.");
-    }
-    if (trimmed.length < 90) {
-        throw new Error("Invalid key format. Must be at least 90 characters.");
-    }
-    const keyFilePath = resolveKeyFilePath();
-    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(keyFilePath), { recursive: true });
-    (0, node_fs_1.writeFileSync)(keyFilePath, trimmed, { mode: 0o600 });
-    console.error(`[anthropic-key] key written to ${keyFilePath}`);
-}
-// ---------------------------------------------------------------------------
-// hasKey — thin check, no validation
-// ---------------------------------------------------------------------------
-function hasKey() {
-    return readKey() !== null;
-}
-// ---------------------------------------------------------------------------
-// deleteKey — remove the stored key file; idempotent on ENOENT
-//
-// Throws on unexpected fs errors (EACCES, EBUSY, EPERM) so callers can
-// surface a structured failure. ENOENT is treated as a no-op because the
-// intended post-condition ("no key file on disk") is already satisfied.
-// Per Task 531 learning, never use `{ force: true }` — it swallows the
-// error classes that matter (permission, busy) and leaves the caller
-// believing removal succeeded.
-// ---------------------------------------------------------------------------
-function deleteKey() {
-    const keyFilePath = resolveKeyFilePath();
-    try {
-        (0, node_fs_1.unlinkSync)(keyFilePath);
-        console.error(`[anthropic-key] deleteKey: removed ${keyFilePath}`);
-    }
-    catch (err) {
-        const code = err instanceof Error && "code" in err
-            ? err.code
-            : undefined;
-        if (code === "ENOENT") {
-            console.error(`[anthropic-key] deleteKey: nothing to remove (ENOENT): ${keyFilePath}`);
-            return;
-        }
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`[anthropic-key] deleteKey: failed to remove ${keyFilePath}: ${msg}`);
-        throw err;
-    }
-}
-async function validateKey(key) {
-    const effectiveKey = key ?? readKey();
-    if (!effectiveKey) {
-        return {
-            status: "missing",
-            message: "No API key available (env var unset, file missing or empty).",
-        };
-    }
-    const start = Date.now();
-    try {
-        const res = await fetch("https://api.anthropic.com/v1/messages", {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                "x-api-key": effectiveKey,
-                "anthropic-version": "2023-06-01",
-            },
-            body: JSON.stringify({
-                model: index_js_1.HAIKU_MODEL,
-                max_tokens: 1,
-                messages: [{ role: "user", content: "hi" }],
-            }),
-            signal: AbortSignal.timeout(10000),
-        });
-        const latency = Date.now() - start;
-        if (res.ok || res.status === 429) {
-            // Consume the response body to release the connection back to the pool.
-            await res.text();
-            console.error(`[anthropic-key] validate: valid (${res.status}, ${latency}ms)`);
-            return {
-                status: "valid",
-                message: "API key is working. Credits available.",
-            };
-        }
-        const body = await res.text();
-        if (/credit balance|billing|purchase credits/i.test(body)) {
-            console.error(`[anthropic-key] validate: billing (${res.status}, ${latency}ms)`);
-            return {
-                status: "billing",
-                message: "API key is valid but credit balance is too low. The user must add credits at console.anthropic.com under Plans & Billing, or enable auto-top-up.",
-            };
-        }
-        if (res.status === 401 ||
-            res.status === 403 ||
-            /authentication_error|permission_error/i.test(body)) {
-            console.error(`[anthropic-key] validate: auth_error (${res.status}, ${latency}ms)`);
-            return {
-                status: "auth_error",
-                message: "API key was rejected. It may be invalid, revoked, or expired. The user should create a new key at console.anthropic.com/settings/keys.",
-            };
-        }
-        console.error(`[anthropic-key] validate: error (${res.status}, ${latency}ms)`);
-        return {
-            status: "error",
-            message: `Could not verify API key. Anthropic returned ${res.status}. This may be a temporary outage — try again later.`,
-        };
-    }
-    catch (err) {
-        const latency = Date.now() - start;
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`[anthropic-key] validate: error (network failure, ${latency}ms): ${msg}`);
-        return {
-            status: "error",
-            message: `Could not reach the Anthropic API: ${msg}. Check network connectivity.`,
-        };
-    }
-}
-// ---------------------------------------------------------------------------
-// keyFilePath — expose the resolved path for callers that need it
-// (e.g., existsSync checks, user-facing messages about the key location)
-// ---------------------------------------------------------------------------
-function keyFilePath() {
-    return resolveKeyFilePath();
-}
-//# sourceMappingURL=index.js.map

package/payload/platform/lib/anthropic-key/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAoEH,0BAiDC;AAMD,4BAiBC;AAMD,wBAEC;AAaD,8BAsBC;AAiBD,kCAsFC;AAOD,kCAEC;AArSD,yDAAyD;AACzD,qCAMiB;AACjB,yCAAmD;AACnD,qCAAkC;AAElC,8EAA8E;AAC9E,iCAAiC;AACjC,EAAE;AACF,yEAAyE;AACzE,gDAAgD;AAChD,qEAAqE;AACrE,yEAAyE;AACzE,kEAAkE;AAClE,8EAA8E;AAE9E,IAAI,iBAAiB,GAAkB,IAAI,CAAC;AAE5C,SAAS,kBAAkB;IACzB,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC;IAEhD,IAAI,aAAa,GAAG,OAAO,CAAC,CAAC,kBAAkB;IAC/C,MAAM,YAAY,GAChB,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAE9D,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,2BAA2B,SAAS,oCAAoC,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,iBAAiB,SAAS,iCAAiC,CAC5D,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,iBAAiB,SAAS,uBAAuB,GAAG,CAAC,OAAO,EAAE,CAC/D,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,iBAAiB,GAAG,IAAA,mBAAO,EAAC,IAAA,iBAAO,GAAE,EAAE,aAAa,EAAE,oBAAoB,CAAC,CAAC;IAC5E,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,4CAA4C;AAC5C,EAAE;AACF,iEAAiE;AACjE,kEAAkE;AAClE,8EAA8E;AAE9E,SAAgB,OAAO;IACrB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC7C,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,kBAAkB,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,2DAA2D;QAC3D,OAAO,CAAC,KAAK,CACX,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CACX,iDAAiD,WAAW,EAAE,CAC/D,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GACR,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG;YACnC,CAAC,CAAE,GAA6B,CAAC,IAAI;YACrC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,mDAAmD;YACnD,OAAO,CAAC,KAAK,CACX,oEAAoE,WAAW,GAAG,CACnF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CACX,2CAA2C,WAAW,KAAK,GAAG,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,mEAAmE;AACnE,8EAA8E;AAE9E,SAAgB,QAAQ,CAAC,GAAW;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC;IACzC,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,IAAA,uBAAa,EAAC,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,KAAK,CAAC,kCAAkC,WAAW,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E,SAAgB,MAAM;IACpB,OAAO,OAAO,EAAE,KAAK,IAAI,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,+BAA+B;AAC/B,8EAA8E;AAE9E,SAAgB,SAAS;IACvB,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,IAAA,oBAAU,EAAC,WAAW,CAAC,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,sCAAsC,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GACR,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG;YACnC,CAAC,CAAE,GAA6B,CAAC,IAAI;YACrC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CACX,0DAA0D,WAAW,EAAE,CACxE,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CACX,+CAA+C,WAAW,KAAK,GAAG,EAAE,CACrE,CAAC;QACF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAiBM,KAAK,UAAU,WAAW,CAAC,GAAY;IAC5C,MAAM,YAAY,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IACtC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,8DAA8D;SACxE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,uCAAuC,EAAE;YAC/D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,YAAY;gBACzB,mBAAmB,EAAE,YAAY;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,sBAAW;gBAClB,UAAU,EAAE,CAAC;gBACb,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aAC5C,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAEnC,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACjC,wEAAwE;YACxE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,KAAK,CACX,oCAAoC,GAAG,CAAC,MAAM,KAAK,OAAO,KAAK,CAChE,CAAC;YACF,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,wCAAwC;aAClD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAE9B,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,KAAK,CACX,sCAAsC,GAAG,CAAC,MAAM,KAAK,OAAO,KAAK,CAClE,CAAC;YACF,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,OAAO,EACL,kJAAkJ;aACrJ,CAAC;QACJ,CAAC;QAED,IACE,GAAG,CAAC,MAAM,KAAK,GAAG;YAClB,GAAG,CAAC,MAAM,KAAK,GAAG;YAClB,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,EACnD,CAAC;YACD,OAAO,CAAC,KAAK,CACX,yCAAyC,GAAG,CAAC,MAAM,KAAK,OAAO,KAAK,CACrE,CAAC;YACF,OAAO;gBACL,MAAM,EAAE,YAAY;gBACpB,OAAO,EACL,wIAAwI;aAC3I,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,KAAK,CACX,oCAAoC,GAAG,CAAC,MAAM,KAAK,OAAO,KAAK,CAChE,CAAC;QACF,OAAO;YACL,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,gDAAgD,GAAG,CAAC,MAAM,qDAAqD;SACzH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CACX,qDAAqD,OAAO,QAAQ,GAAG,EAAE,CAC1E,CAAC;QACF,OAAO;YACL,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,sCAAsC,GAAG,+BAA+B;SAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,yEAAyE;AACzE,8EAA8E;AAE9E,SAAgB,WAAW;IACzB,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC"}

package/payload/platform/plugins/admin/mcp/dist/lib/onboarding.d.ts

@@ -1,39 +0,0 @@
-export interface OnboardingState {
-    currentStep: number;
-    step1CompletedAt: string | null;
-    step2CompletedAt: string | null;
-    step3CompletedAt: string | null;
-    step4CompletedAt: string | null;
-    step5CompletedAt: string | null;
-    step6CompletedAt: string | null;
-    step7CompletedAt: string | null;
-    step8CompletedAt: string | null;
-    step9CompletedAt: string | null;
-    createdAt: string;
-    updatedAt: string;
-}
-export interface SessionLike {
-    run(query: string, params?: Record<string, unknown>): Promise<{
-        records: Array<{
-            get(key: string): unknown;
-        }>;
-    }>;
-    close(): Promise<void>;
-}
-/**
- * Task 562: consume the step-7 completion flag written by setup-tunnel.sh
- * before the service restart. The script runs inside ${BRAND}.service's
- * cgroup and cannot complete the MCP call after dispatching the restart —
- * so it drops a filesystem marker instead. The first read of onboarding
- * state after the restart picks it up, advances the graph via the same
- * CASE-WHEN-NULL cypher as completeOnboardingStep, and deletes the marker.
- *
- * Idempotent at every layer: a missing flag is a no-op; a flag present
- * against an already-completed step is a no-op on the graph (CASE-WHEN-NULL
- * preserves the existing timestamp); a crash between graph write and flag
- * delete re-consumes on the next call with the same no-op outcome.
- */
-export declare function consumeStep7Flag(session: SessionLike, accountId: string, accountDir: string): Promise<boolean>;
-export declare function getOnboardingState(sessionFactory: () => SessionLike, accountId: string, accountDir: string): Promise<OnboardingState>;
-export declare function completeOnboardingStep(sessionFactory: () => SessionLike, accountId: string, step: number): Promise<OnboardingState>;
-//# sourceMappingURL=onboarding.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/lib/onboarding.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/lib/onboarding.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC,CAAC;KAC/C,CAAC,CAAC;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAoED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CA4DlB;AAgBD,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,WAAW,EACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC,CA4E1B;AAED,wBAAsB,sBAAsB,CAC1C,cAAc,EAAE,MAAM,WAAW,EACjC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,CAAC,CA6C1B"}

package/payload/platform/plugins/admin/mcp/dist/lib/onboarding.js

@@ -1,249 +0,0 @@
-// Onboarding state management — graph-persisted workflow state.
-// Purpose-built for Phase 0; migrates to a Workflow node with Task 13.
-import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-const STEP_FIELDS = [
-    "step1CompletedAt",
-    "step2CompletedAt",
-    "step3CompletedAt",
-    "step4CompletedAt",
-    "step5CompletedAt",
-    "step6CompletedAt",
-    "step7CompletedAt",
-    "step8CompletedAt",
-    "step9CompletedAt",
-];
-// neo4j-driver v5 returns Integer objects for integer properties, not native
-// JS numbers. This converts them safely (values 0–9 are well within range).
-function toJsNumber(val) {
-    if (typeof val === "number")
-        return val;
-    if (val && typeof val === "object" && "toNumber" in val) {
-        return val.toNumber();
-    }
-    return 0;
-}
-function recordToState(record) {
-    return {
-        currentStep: toJsNumber(record.get("currentStep")),
-        step1CompletedAt: record.get("step1CompletedAt") ?? null,
-        step2CompletedAt: record.get("step2CompletedAt") ?? null,
-        step3CompletedAt: record.get("step3CompletedAt") ?? null,
-        step4CompletedAt: record.get("step4CompletedAt") ?? null,
-        step5CompletedAt: record.get("step5CompletedAt") ?? null,
-        step6CompletedAt: record.get("step6CompletedAt") ?? null,
-        step7CompletedAt: record.get("step7CompletedAt") ?? null,
-        step8CompletedAt: record.get("step8CompletedAt") ?? null,
-        step9CompletedAt: record.get("step9CompletedAt") ?? null,
-        createdAt: record.get("createdAt") ?? new Date().toISOString(),
-        updatedAt: record.get("updatedAt") ?? new Date().toISOString(),
-    };
-}
-function readMigrationStep(accountDir) {
-    try {
-        const raw = readFileSync(join(accountDir, "account.json"), "utf-8");
-        const config = JSON.parse(raw);
-        if (typeof config.onboardingStep === "number" && config.onboardingStep > 0) {
-            return config.onboardingStep;
-        }
-    }
-    catch {
-        // File missing, unreadable, or malformed — no migration data
-    }
-    return 0;
-}
-function removeOnboardingStepFromFile(accountDir) {
-    try {
-        const configPath = join(accountDir, "account.json");
-        const raw = readFileSync(configPath, "utf-8");
-        const config = JSON.parse(raw);
-        if ("onboardingStep" in config) {
-            delete config.onboardingStep;
-            writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
-        }
-    }
-    catch {
-        // Tolerate cleanup failure — graph is the authority now
-    }
-}
-/**
- * Task 562: consume the step-7 completion flag written by setup-tunnel.sh
- * before the service restart. The script runs inside ${BRAND}.service's
- * cgroup and cannot complete the MCP call after dispatching the restart —
- * so it drops a filesystem marker instead. The first read of onboarding
- * state after the restart picks it up, advances the graph via the same
- * CASE-WHEN-NULL cypher as completeOnboardingStep, and deletes the marker.
- *
- * Idempotent at every layer: a missing flag is a no-op; a flag present
- * against an already-completed step is a no-op on the graph (CASE-WHEN-NULL
- * preserves the existing timestamp); a crash between graph write and flag
- * delete re-consumes on the next call with the same no-op outcome.
- */
-export async function consumeStep7Flag(session, accountId, accountDir) {
-    const flagPath = join(accountDir, "onboarding", "step7-complete");
-    if (!existsSync(flagPath))
-        return false;
-    let completedAt = new Date().toISOString();
-    try {
-        const raw = readFileSync(flagPath, "utf-8").trim();
-        if (raw) {
-            const parsed = JSON.parse(raw);
-            if (typeof parsed.completedAt === "string") {
-                completedAt = parsed.completedAt;
-            }
-        }
-    }
-    catch {
-        // Malformed flag content still advances state — the flag's presence
-        // alone is the authoritative signal; the embedded timestamp is forensic.
-    }
-    // RETURN count(o) so we can detect the "no OnboardingState node" case
-    // where SET is a silent no-op. Without this check, rmSync below would
-    // delete the flag against a graph that never applied the write, silently
-    // losing the step-7 completion signal forever.
-    const result = await session.run(`MATCH (o:OnboardingState {accountId: $accountId})
-     SET o.step7CompletedAt = CASE WHEN o.step7CompletedAt IS NULL THEN $completedAt ELSE o.step7CompletedAt END,
-         o.currentStep = CASE WHEN 7 > o.currentStep THEN 7 ELSE o.currentStep END,
-         o.updatedAt = $completedAt
-     RETURN count(o) AS updated`, { accountId, completedAt });
-    const updatedRaw = result.records[0]?.get("updated");
-    const updated = toJsNumber(updatedRaw);
-    if (updated === 0) {
-        // No OnboardingState node yet — leave the flag in place so the next
-        // reader (after node creation via MERGE in this function's migration
-        // branch below) can still consume it.
-        console.log(`[onboarding-flag-consumed] accountId=${accountId.slice(0, 8)}… step=7 ` +
-            `source=filesystem flagPath=${flagPath} skipped=no-node`);
-        return false;
-    }
-    console.log(`[onboarding-flag-consumed] accountId=${accountId.slice(0, 8)}… step=7 ` +
-        `source=filesystem flagPath=${flagPath} completedAt=${completedAt}`);
-    try {
-        rmSync(flagPath);
-    }
-    catch (err) {
-        console.error(`[onboarding-flag-consumed] warn: failed to delete ${flagPath}: ` +
-            `${err instanceof Error ? err.message : String(err)}`);
-    }
-    return true;
-}
-const READ_STATE_QUERY = `MATCH (o:OnboardingState {accountId: $accountId})
-       RETURN o.currentStep AS currentStep,
-              o.step1CompletedAt AS step1CompletedAt,
-              o.step2CompletedAt AS step2CompletedAt,
-              o.step3CompletedAt AS step3CompletedAt,
-              o.step4CompletedAt AS step4CompletedAt,
-              o.step5CompletedAt AS step5CompletedAt,
-              o.step6CompletedAt AS step6CompletedAt,
-              o.step7CompletedAt AS step7CompletedAt,
-              o.step8CompletedAt AS step8CompletedAt,
-              o.step9CompletedAt AS step9CompletedAt,
-              o.createdAt AS createdAt,
-              o.updatedAt AS updatedAt`;
-export async function getOnboardingState(sessionFactory, accountId, accountDir) {
-    const session = sessionFactory();
-    try {
-        // Check for existing graph node
-        const existing = await session.run(READ_STATE_QUERY, { accountId });
-        const nodeExisted = existing.records.length > 0;
-        if (nodeExisted) {
-            // Task 562: consume setup-tunnel.sh step-7 flag against the existing
-            // node. loadOnboardingStep (UI side) usually does this first at session
-            // start; this call is defensive in case this read precedes it.
-            //
-            // Always re-read after the consume attempt. If a concurrent caller
-            // consumed the flag between our initial read and our consumeStep7Flag
-            // call, consumeStep7Flag returns false (flag gone) but the graph still
-            // advanced — returning `existing.records[0]` would hand back the stale
-            // pre-consumption record. One extra indexed MATCH is negligible and
-            // guarantees the caller sees the authoritative state.
-            await consumeStep7Flag(session, accountId, accountDir);
-            const refreshed = await session.run(READ_STATE_QUERY, { accountId });
-            return recordToState(refreshed.records[0]);
-        }
-        // No graph node — check for migration from account.json
-        const migratedStep = readMigrationStep(accountDir);
-        const now = new Date().toISOString();
-        // Build step completion timestamps for migrated steps.
-        // account.json only stored a step counter, not per-step timestamps,
-        // so migrated steps all get the current time — the original times
-        // were never recorded.
-        const stepProps = {};
-        for (let i = 0; i < STEP_FIELDS.length; i++) {
-            stepProps[STEP_FIELDS[i]] = i < migratedStep ? now : null;
-        }
-        // Create the node via MERGE (idempotent under concurrent access)
-        const result = await session.run(`MERGE (o:OnboardingState {accountId: $accountId})
-       ON CREATE SET
-         o.currentStep = $currentStep,
-         o.step1CompletedAt = $step1CompletedAt,
-         o.step2CompletedAt = $step2CompletedAt,
-         o.step3CompletedAt = $step3CompletedAt,
-         o.step4CompletedAt = $step4CompletedAt,
-         o.step5CompletedAt = $step5CompletedAt,
-         o.step6CompletedAt = $step6CompletedAt,
-         o.step7CompletedAt = $step7CompletedAt,
-         o.step8CompletedAt = $step8CompletedAt,
-         o.step9CompletedAt = $step9CompletedAt,
-         o.createdAt = $now,
-         o.updatedAt = $now
-       RETURN o.currentStep AS currentStep,
-              o.step1CompletedAt AS step1CompletedAt,
-              o.step2CompletedAt AS step2CompletedAt,
-              o.step3CompletedAt AS step3CompletedAt,
-              o.step4CompletedAt AS step4CompletedAt,
-              o.step5CompletedAt AS step5CompletedAt,
-              o.step6CompletedAt AS step6CompletedAt,
-              o.step7CompletedAt AS step7CompletedAt,
-              o.step8CompletedAt AS step8CompletedAt,
-              o.step9CompletedAt AS step9CompletedAt,
-              o.createdAt AS createdAt,
-              o.updatedAt AS updatedAt`, { accountId, currentStep: migratedStep, now, ...stepProps });
-        // Clean up account.json if migration happened
-        if (migratedStep > 0) {
-            removeOnboardingStepFromFile(accountDir);
-        }
-        return recordToState(result.records[0]);
-    }
-    finally {
-        await session.close();
-    }
-}
-export async function completeOnboardingStep(sessionFactory, accountId, step) {
-    if (!Number.isInteger(step) || step < 1 || step > 9) {
-        throw new Error("Step must be between 1 and 9");
-    }
-    const session = sessionFactory();
-    try {
-        const stepField = STEP_FIELDS[step - 1];
-        const now = new Date().toISOString();
-        // Single query: MATCH + SET. If no node exists, MATCH returns zero
-        // records and we detect that from the result — no separate check needed.
-        const result = await session.run(`MATCH (o:OnboardingState {accountId: $accountId})
-       SET o.${stepField} = CASE WHEN o.${stepField} IS NULL THEN $now ELSE o.${stepField} END,
-           o.currentStep = CASE WHEN $step > o.currentStep THEN $step ELSE o.currentStep END,
-           o.updatedAt = $now
-       RETURN o.currentStep AS currentStep,
-              o.step1CompletedAt AS step1CompletedAt,
-              o.step2CompletedAt AS step2CompletedAt,
-              o.step3CompletedAt AS step3CompletedAt,
-              o.step4CompletedAt AS step4CompletedAt,
-              o.step5CompletedAt AS step5CompletedAt,
-              o.step6CompletedAt AS step6CompletedAt,
-              o.step7CompletedAt AS step7CompletedAt,
-              o.step8CompletedAt AS step8CompletedAt,
-              o.step9CompletedAt AS step9CompletedAt,
-              o.createdAt AS createdAt,
-              o.updatedAt AS updatedAt`, { accountId, step, now });
-        if (result.records.length === 0) {
-            throw new Error("No onboarding state found for this account. Call onboarding-get first.");
-        }
-        console.log(`[onboarding-step-complete] accountId=${accountId.slice(0, 8)}… ` +
-            `step=${step} completedAt=${now}`);
-        return recordToState(result.records[0]);
-    }
-    finally {
-        await session.close();
-    }
-}
-//# sourceMappingURL=onboarding.js.map